@aztec/txe 0.0.1-commit.96dac018d → 0.0.1-commit.9a89641

package/dest/oracle/txe_oracle_top_level_context.js

@@ -1,29 +1,98 @@
-import { CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS, DEFAULT_DA_GAS_LIMIT, DEFAULT_L2_GAS_LIMIT, DEFAULT_TEARDOWN_DA_GAS_LIMIT, DEFAULT_TEARDOWN_L2_GAS_LIMIT, NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP } from '@aztec/constants';
+function _ts_add_disposable_resource(env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() {
+            try {
+                inner.call(this);
+            } catch (e) {
+                return Promise.reject(e);
+            }
+        };
+        env.stack.push({
+            value: value,
+            dispose: dispose,
+            async: async
+        });
+    } else if (async) {
+        env.stack.push({
+            async: true
+        });
+    }
+    return value;
+}
+function _ts_dispose_resources(env) {
+    var _SuppressedError = typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
+        var e = new Error(message);
+        return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+    };
+    return (_ts_dispose_resources = function _ts_dispose_resources(env) {
+        function fail(e) {
+            env.error = env.hasError ? new _SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while(r = env.stack.pop()){
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) {
+                            fail(e);
+                            return next();
+                        });
+                    } else s |= 1;
+                } catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    })(env);
+}
+import { CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS, MAX_PRIVATE_LOGS_PER_TX, NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP } from '@aztec/constants';
 import { BlockNumber } from '@aztec/foundation/branded-types';
 import { Schnorr } from '@aztec/foundation/crypto/schnorr';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { LogLevels, applyStringFormatting, createLogger } from '@aztec/foundation/log';
 import { TestDateProvider } from '@aztec/foundation/timer';
-import { ORACLE_VERSION, enrichPublicSimulationError } from '@aztec/pxe/server';
-import { ExecutionNoteCache, ExecutionTaggingIndexCache, HashedValuesCache, Oracle, PrivateExecutionOracle, UtilityExecutionOracle, executePrivateFunction, generateSimulatedProvingResult } from '@aztec/pxe/simulator';
+import { AnchoredContractData, CapsuleService, FactService, ORACLE_VERSION_MAJOR, composeHooks, enrichPublicSimulationError } from '@aztec/pxe/server';
+import { CONTRACT_INSTANCE, ExecutionNoteCache, ExecutionTaggingIndexCache, HashedValuesCache, PrivateExecutionOracle, TransientArrayService, UtilityExecutionOracle, buildACIRCallback, executePrivateFunction, generateSimulatedProvingResult } from '@aztec/pxe/simulator';
 import { ExecutionError, WASMSimulator, createSimulationError, extractCallStack, resolveAssertionMessageFromError, toACVMWitness, witnessMapToFields } from '@aztec/simulator/client';
-import { CppPublicTxSimulator, GuardedMerkleTreeOperations, PublicContractsDB, PublicProcessor } from '@aztec/simulator/server';
+import { GuardedMerkleTreeOperations, PublicContractsDB, PublicProcessor, PublicTxSimulator } from '@aztec/simulator/server';
 import { FunctionCall, FunctionSelector, FunctionType } from '@aztec/stdlib/abi';
 import { AuthWitness } from '@aztec/stdlib/auth-witness';
 import { PublicSimulatorConfig } from '@aztec/stdlib/avm';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { computePartialAddress } from '@aztec/stdlib/contract';
-import { Gas, GasFees, GasSettings } from '@aztec/stdlib/gas';
+import { Gas, GasFees } from '@aztec/stdlib/gas';
 import { computeCalldataHash, computeProtocolNullifier, siloNullifier } from '@aztec/stdlib/hash';
 import { PartialPrivateTailPublicInputsForPublic, PrivateKernelTailCircuitPublicInputs, PrivateToPublicAccumulatedData, PublicCallRequest } from '@aztec/stdlib/kernel';
+import { deriveKeys, hashPublicKey } from '@aztec/stdlib/keys';
+import { AppTaggingSecretKind } from '@aztec/stdlib/logs';
+import { L1Actor, L1ToL2Message, L2Actor } from '@aztec/stdlib/messaging';
 import { ChonkProof } from '@aztec/stdlib/proofs';
 import { makeGlobalVariables } from '@aztec/stdlib/testing';
 import { MerkleTreeId } from '@aztec/stdlib/trees';
 import { CallContext, HashedValues, PrivateExecutionResult, Tx, TxConstantData, TxContext, TxEffect, TxHash, collectNested } from '@aztec/stdlib/tx';
-import { ForkCheckpoint } from '@aztec/world-state';
-import { DEFAULT_ADDRESS } from '../constants.js';
-import { TXEPublicContractDataSource } from '../util/txe_public_contract_data_source.js';
+import { ForkCheckpoint } from '@aztec/world-state/native';
+import { DEFAULT_ADDRESS, MAX_PRIVATE_EVENTS_PER_TXE_QUERY, MAX_PRIVATE_EVENT_LEN } from '../constants.js';
 import { getSingleTxBlockRequestHash, insertTxEffectIntoWorldTrees, makeTXEBlock } from '../utils/block_creation.js';
+import { TXEPublicContractDataSource } from '../utils/txe_public_contract_data_source.js';
+import { makeResolveTaggingSecretStrategyHook } from './tagging_secret_strategy.js';
 export class TXEOracleTopLevelContext {
     stateMachine;
     contractStore;
@@ -33,17 +102,23 @@ export class TXEOracleTopLevelContext {
     accountStore;
     senderTaggingStore;
     recipientTaggingStore;
-    senderAddressBookStore;
+    taggingSecretSourcesStore;
     capsuleStore;
+    factStore;
     privateEventStore;
     nextBlockTimestamp;
     version;
     chainId;
     authwits;
+    taggingSecretStrategies;
+    authorizeAllUtilityCallTargets;
+    artifactResolver;
+    rootPath;
+    packageName;
     isMisc;
     isTxe;
     logger;
-    constructor(stateMachine, contractStore, noteStore, keyStore, addressStore, accountStore, senderTaggingStore, recipientTaggingStore, senderAddressBookStore, capsuleStore, privateEventStore, nextBlockTimestamp, version, chainId, authwits){
+    constructor(stateMachine, contractStore, noteStore, keyStore, addressStore, accountStore, senderTaggingStore, recipientTaggingStore, taggingSecretSourcesStore, capsuleStore, factStore, privateEventStore, nextBlockTimestamp, version, chainId, authwits, taggingSecretStrategies, authorizeAllUtilityCallTargets, artifactResolver, rootPath, packageName){
         this.stateMachine = stateMachine;
         this.contractStore = contractStore;
         this.noteStore = noteStore;
@@ -52,30 +127,46 @@ export class TXEOracleTopLevelContext {
         this.accountStore = accountStore;
         this.senderTaggingStore = senderTaggingStore;
         this.recipientTaggingStore = recipientTaggingStore;
-        this.senderAddressBookStore = senderAddressBookStore;
+        this.taggingSecretSourcesStore = taggingSecretSourcesStore;
         this.capsuleStore = capsuleStore;
+        this.factStore = factStore;
         this.privateEventStore = privateEventStore;
         this.nextBlockTimestamp = nextBlockTimestamp;
         this.version = version;
         this.chainId = chainId;
         this.authwits = authwits;
+        this.taggingSecretStrategies = taggingSecretStrategies;
+        this.authorizeAllUtilityCallTargets = authorizeAllUtilityCallTargets;
+        this.artifactResolver = artifactResolver;
+        this.rootPath = rootPath;
+        this.packageName = packageName;
         this.isMisc = true;
         this.isTxe = true;
         this.logger = createLogger('txe:top_level_context');
         this.logger.debug('Entering Top Level Context');
     }
-    utilityAssertCompatibleOracleVersion(version) {
-        if (version !== ORACLE_VERSION) {
-            throw new Error(`Incompatible oracle version. TXE is using version '${ORACLE_VERSION}', but got a request for '${version}'.`);
+    contractOracleVersion;
+    assertCompatibleOracleVersion(major, minor) {
+        if (major !== ORACLE_VERSION_MAJOR) {
+            const hint = major > ORACLE_VERSION_MAJOR ? 'The contract was compiled with a newer version of Aztec.nr than this aztec cli version supports. Upgrade your aztec cli version to a compatible version.' : 'The contract was compiled with an older version of Aztec.nr than this aztec cli version supports. Recompile the contract with a compatible version of Aztec.nr.';
+            throw new Error(`Incompatible aztec cli version: ${hint} See https://docs.aztec.network/errors/8 (expected oracle major version ${ORACLE_VERSION_MAJOR}, got ${major})`);
         }
+        this.contractOracleVersion = {
+            major,
+            minor
+        };
+    }
+    // Prefixed with "nonOracleFunction" as it is not used as an oracle handler.
+    nonOracleFunctionGetContractOracleVersion() {
+        return this.contractOracleVersion;
     }
     // This is typically only invoked in private contexts, but it is convenient to also have it in top-level for testing
     // setup.
-    utilityGetRandomField() {
+    getRandomField() {
         return Fr.random();
     }
     // We instruct users to debug contracts via this oracle, so it makes sense that they'd expect it to also work in tests
-    utilityLog(level, message, fields) {
+    log(level, message, _fieldsSize, fields) {
         if (!LogLevels[level]) {
             throw new Error(`Invalid log level: ${level}`);
         }
@@ -85,46 +176,56 @@ export class TXEOracleTopLevelContext {
         });
         return Promise.resolve();
     }
-    txeGetDefaultAddress() {
+    getDefaultAddress() {
         return DEFAULT_ADDRESS;
     }
-    async txeGetNextBlockNumber() {
+    async getNextBlockNumber() {
         return BlockNumber(await this.getLastBlockNumber() + 1);
     }
-    txeGetNextBlockTimestamp() {
+    getNextBlockTimestamp() {
         return Promise.resolve(this.nextBlockTimestamp);
     }
-    async txeGetLastBlockTimestamp() {
-        return (await this.stateMachine.node.getBlockHeader('latest')).globalVariables.timestamp;
+    async getLastBlockTimestamp() {
+        return (await this.stateMachine.node.getBlockData('latest')).header.globalVariables.timestamp;
     }
-    async txeGetLastTxEffects() {
+    async getLastTxEffects() {
         const latestBlockNumber = await this.stateMachine.archiver.getBlockNumber();
-        const block = await this.stateMachine.archiver.getBlock(latestBlockNumber);
+        const block = await this.stateMachine.archiver.getBlock({
+            number: latestBlockNumber
+        });
         if (block.body.txEffects.length != 1) {
             // Note that calls like env.mine() will result in blocks with no transactions, hitting this
             throw new Error(`Expected a single transaction in the last block, found ${block.body.txEffects.length}`);
         }
         const txEffects = block.body.txEffects[0];
+        const privateLogs = txEffects.privateLogs;
+        if (privateLogs.length > MAX_PRIVATE_LOGS_PER_TX) {
+            throw new Error(`${privateLogs.length} private logs exceed max ${MAX_PRIVATE_LOGS_PER_TX}`);
+        }
         return {
             txHash: txEffects.txHash,
             noteHashes: txEffects.noteHashes,
-            nullifiers: txEffects.nullifiers
+            nullifiers: txEffects.nullifiers,
+            privateLogs
         };
     }
     async syncContractNonOracleMethod(contractAddress, scope, jobId) {
         if (contractAddress.equals(DEFAULT_ADDRESS)) {
-            this.logger.debug(`Skipping sync in txeGetPrivateEvents because the events correspond to the default address.`);
+            this.logger.debug(`Skipping sync in getPrivateEvents because the events correspond to the default address.`);
             return;
         }
         const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
         await this.stateMachine.contractSyncService.ensureContractSynced(contractAddress, null, async (call, execScopes)=>{
-            await this.executeUtilityCall(call, execScopes, jobId);
+            await this.executeUtilityCall(call, {
+                scopes: execScopes,
+                jobId
+            });
         }, blockHeader, jobId, [
             scope
         ]);
     }
-    async txeGetPrivateEvents(selector, contractAddress, scope) {
-        return (await this.privateEventStore.getPrivateEvents(selector, {
+    async getPrivateEvents(selector, contractAddress, scope) {
+        const events = (await this.privateEventStore.getPrivateEvents(selector, {
             contractAddress,
             scopes: [
                 scope
@@ -132,63 +233,119 @@ export class TXEOracleTopLevelContext {
             fromBlock: 0,
             toBlock: await this.getLastBlockNumber() + 1
         })).map((e)=>e.packedEvent);
+        if (events.length > MAX_PRIVATE_EVENTS_PER_TXE_QUERY) {
+            throw new Error(`Array of length ${events.length} larger than maxLen ${MAX_PRIVATE_EVENTS_PER_TXE_QUERY}`);
+        }
+        if (events.some((e)=>e.length > MAX_PRIVATE_EVENT_LEN)) {
+            throw new Error(`Some private event has length larger than maxLen ${MAX_PRIVATE_EVENT_LEN}`);
+        }
+        return events;
     }
-    async txeAdvanceBlocksBy(blocks) {
+    async advanceBlocksBy(blocks) {
         this.logger.debug(`time traveling ${blocks} blocks`);
         for(let i = 0; i < blocks; i++){
             await this.mineBlock();
         }
     }
-    txeAdvanceTimestampBy(duration) {
+    advanceTimestampBy(duration) {
         this.logger.debug(`time traveling ${duration} seconds`);
         this.nextBlockTimestamp += duration;
     }
-    async txeDeploy(artifact, instance, secret) {
+    deploymentNullifier(address) {
+        return siloNullifier(AztecAddress.fromNumberUnsafe(CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS), address.toField());
+    }
+    async deploy(contractPath, initializer, args, secret, salt, deployer) {
+        const { artifact, instance } = await this.artifactResolver.resolveDeployArtifact({
+            rootPath: this.rootPath,
+            packageName: this.packageName,
+            contractPath,
+            initializer,
+            args,
+            secret,
+            salt,
+            deployer
+        });
         // Emit deployment nullifier
         await this.mineBlock({
             nullifiers: [
-                await siloNullifier(AztecAddress.fromNumber(CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS), instance.address.toField())
+                await this.deploymentNullifier(instance.address)
             ]
         });
         if (!secret.equals(Fr.ZERO)) {
-            await this.txeAddAccount(artifact, instance, secret);
+            await this.registerContractAndAddAccount(artifact, instance, secret);
         } else {
             await this.contractStore.addContractInstance(instance);
             await this.contractStore.addContractArtifact(artifact);
             this.logger.debug(`Deployed ${artifact.name} at ${instance.address}`);
         }
+        return CONTRACT_INSTANCE.serialization.fn(instance).flat();
+    }
+    /**
+   * Mines a single block containing only the deployment nullifiers for the contracts at the given addresses.
+   */ async mineDeploymentNullifiers(addresses) {
+        await this.mineBlock({
+            nullifiers: await Promise.all(addresses.map((address)=>this.deploymentNullifier(address)))
+        });
     }
-    async txeAddAccount(artifact, instance, secret) {
+    async addAccount(secret) {
+        const { artifact, instance } = await this.artifactResolver.resolveAccountArtifact(secret);
+        return this.registerContractAndAddAccount(artifact, instance, secret);
+    }
+    async registerContractAndAddAccount(artifact, instance, secret) {
         const partialAddress = await computePartialAddress(instance);
         this.logger.debug(`Deployed ${artifact.name} at ${instance.address}`);
         await this.contractStore.addContractInstance(instance);
         await this.contractStore.addContractArtifact(artifact);
-        const completeAddress = await this.keyStore.addAccount(secret, partialAddress);
+        const completeAddress = await this.keyStore.addAccount(await deriveKeys(secret), partialAddress);
         await this.accountStore.setAccount(completeAddress.address, completeAddress);
         await this.addressStore.addCompleteAddress(completeAddress);
         this.logger.debug(`Created account ${completeAddress.address}`);
         return completeAddress;
     }
-    async txeCreateAccount(secret) {
-        // This is a foot gun !
-        const completeAddress = await this.keyStore.addAccount(secret, secret);
+    async createAccount(secret, partialAddress) {
+        const completeAddress = await this.keyStore.addAccount(await deriveKeys(secret), partialAddress);
         await this.accountStore.setAccount(completeAddress.address, completeAddress);
         await this.addressStore.addCompleteAddress(completeAddress);
         this.logger.debug(`Created account ${completeAddress.address}`);
         return completeAddress;
     }
-    async txeAddAuthWitness(address, messageHash) {
+    async addAuthWitness(address, messageHash) {
         const account = await this.accountStore.getAccount(address);
-        const privateKey = await this.keyStore.getMasterSecretKey(account.publicKeys.masterIncomingViewingPublicKey);
+        const ivpkMHash = await hashPublicKey(account.publicKeys.ivpkM);
+        const privateKey = await this.keyStore.getMasterSecretKey(ivpkMHash);
         const schnorr = new Schnorr();
-        const signature = await schnorr.constructSignature(messageHash.toBuffer(), privateKey);
-        const authWitness = new AuthWitness(messageHash, [
-            ...signature.toBuffer()
-        ]);
+        const signature = await schnorr.constructSignature(messageHash, privateKey);
+        const authWitness = new AuthWitness(messageHash, signature.toLimbFields());
         this.authwits.set(authWitness.requestHash.toString(), authWitness);
     }
+    setTaggingSecretStrategies(unconstrainedStrategy, constrainedStrategy) {
+        const apply = (mode, strategy)=>{
+            if (strategy.isSome()) {
+                this.taggingSecretStrategies.set(mode, strategy.value);
+            } else {
+                this.taggingSecretStrategies.delete(mode);
+            }
+        };
+        apply(AppTaggingSecretKind.UNCONSTRAINED, unconstrainedStrategy);
+        apply(AppTaggingSecretKind.CONSTRAINED, constrainedStrategy);
+    }
+    setAuthorizeAllUtilityCallTargets(authorizeAll) {
+        this.authorizeAllUtilityCallTargets = authorizeAll;
+    }
+    async sendL1ToL2Message(content, secretHash, sender, recipient) {
+        // Messages are appended to the tree, so the next free slot is simply the current tree size.
+        const { size } = await this.stateMachine.synchronizer.getCommitted().getTreeInfo(MerkleTreeId.L1_TO_L2_MESSAGE_TREE);
+        const leafIndex = new Fr(size);
+        const message = new L1ToL2Message(new L1Actor(sender, this.chainId.toNumber()), new L2Actor(recipient, this.version.toNumber()), content, secretHash, leafIndex);
+        await this.mineBlock({
+            l1ToL2Messages: [
+                message.hash()
+            ]
+        });
+        return leafIndex;
+    }
     async mineBlock(options = {}) {
-        const blockNumber = await this.txeGetNextBlockNumber();
+        const blockNumber = await this.getNextBlockNumber();
         const txEffect = TxEffect.empty();
         txEffect.nullifiers = [
             getSingleTxBlockRequestHash(blockNumber),
@@ -196,7 +353,7 @@ export class TXEOracleTopLevelContext {
         ];
         txEffect.txHash = new TxHash(new Fr(blockNumber));
         const forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
-        await insertTxEffectIntoWorldTrees(txEffect, forkedWorldTrees);
+        await insertTxEffectIntoWorldTrees(txEffect, forkedWorldTrees, options.l1ToL2Messages ?? []);
         const globals = makeGlobalVariables(undefined, {
             blockNumber,
             timestamp: this.nextBlockTimestamp,
@@ -208,269 +365,320 @@ export class TXEOracleTopLevelContext {
         ]);
         await forkedWorldTrees.close();
         this.logger.info(`Created block ${blockNumber} with timestamp ${block.header.globalVariables.timestamp}`);
-        await this.stateMachine.handleL2Block(block);
+        await this.stateMachine.handleL2Block(block, options.l1ToL2Messages ?? []);
     }
-    async txePrivateCallNewFlow(from, targetContractAddress = AztecAddress.zero(), functionSelector = FunctionSelector.empty(), args, argsHash = Fr.zero(), isStaticCall = false, jobId) {
-        this.logger.verbose(`Executing external function ${await this.contractStore.getDebugFunctionName(targetContractAddress, functionSelector)}@${targetContractAddress} isStaticCall=${isStaticCall}`);
-        const artifact = await this.contractStore.getFunctionArtifact(targetContractAddress, functionSelector);
-        if (!artifact) {
-            const message = functionSelector.equals(await FunctionSelector.fromSignature('verify_private_authwit(Field)')) ? 'Found no account contract artifact for a private authwit check - use `create_contract_account` instead of `create_light_account` for authwit support.' : 'Function Artifact does not exist';
-            throw new Error(message);
-        }
-        // When `from` is the zero address (e.g. when deploying a new account contract), we return an
-        // empty scope list which acts as deny-all: no notes are visible and no keys are accessible.
-        const effectiveScopes = from.isZero() ? [] : [
-            from
-        ];
-        // Sync notes before executing private function to discover notes from previous transactions
-        const utilityExecutor = async (call, execScopes)=>{
-            await this.executeUtilityCall(call, execScopes, jobId);
+    async privateCallNewFlow(from, targetContractAddress = AztecAddress.zero(), functionSelector = FunctionSelector.empty(), args, argsHash = Fr.zero(), isStaticCall = false, additionalScopes = [], jobId, authorizedUtilityCallTargets, gasSettings) {
+        const env = {
+            stack: [],
+            error: void 0,
+            hasError: false
         };
-        const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
-        await this.stateMachine.contractSyncService.ensureContractSynced(targetContractAddress, functionSelector, utilityExecutor, blockHeader, jobId, effectiveScopes);
-        const blockNumber = await this.txeGetNextBlockNumber();
-        const callContext = new CallContext(from, targetContractAddress, functionSelector, isStaticCall);
-        const gasLimits = new Gas(DEFAULT_DA_GAS_LIMIT, DEFAULT_L2_GAS_LIMIT);
-        const teardownGasLimits = new Gas(DEFAULT_TEARDOWN_DA_GAS_LIMIT, DEFAULT_TEARDOWN_L2_GAS_LIMIT);
-        const gasSettings = new GasSettings(gasLimits, teardownGasLimits, GasFees.empty(), GasFees.empty());
-        const txContext = new TxContext(this.chainId, this.version, gasSettings);
-        const protocolNullifier = await computeProtocolNullifier(getSingleTxBlockRequestHash(blockNumber));
-        const noteCache = new ExecutionNoteCache(protocolNullifier);
-        // In production, the account contract sets the min revertible counter before calling the app function.
-        // Since TXE bypasses the account contract, we simulate this by setting minRevertibleSideEffectCounter to 1,
-        // marking all side effects as revertible.
-        const minRevertibleSideEffectCounter = 1;
-        await noteCache.setMinRevertibleSideEffectCounter(minRevertibleSideEffectCounter);
-        const taggingIndexCache = new ExecutionTaggingIndexCache();
-        const simulator = new WASMSimulator();
-        const privateExecutionOracle = new PrivateExecutionOracle({
-            argsHash,
-            txContext,
-            callContext,
-            anchorBlockHeader: blockHeader,
-            utilityExecutor,
-            authWitnesses: Array.from(this.authwits.values()),
-            capsules: [],
-            executionCache: HashedValuesCache.create([
-                new HashedValues(args, argsHash)
-            ]),
-            noteCache,
-            taggingIndexCache,
-            contractStore: this.contractStore,
-            noteStore: this.noteStore,
-            keyStore: this.keyStore,
-            addressStore: this.addressStore,
-            aztecNode: this.stateMachine.node,
-            senderTaggingStore: this.senderTaggingStore,
-            recipientTaggingStore: this.recipientTaggingStore,
-            senderAddressBookStore: this.senderAddressBookStore,
-            capsuleStore: this.capsuleStore,
-            privateEventStore: this.privateEventStore,
-            contractSyncService: this.stateMachine.contractSyncService,
-            jobId,
-            totalPublicCalldataCount: 0,
-            sideEffectCounter: minRevertibleSideEffectCounter,
-            scopes: effectiveScopes,
-            // In TXE, the typical transaction entrypoint is skipped, so we need to simulate the actions that such a
-            // contract would perform, including setting senderForTags.
-            senderForTags: from,
-            simulator
-        });
-        // Note: This is a slight modification of simulator.run without any of the checks. Maybe we should modify simulator.run with a boolean value to skip checks.
-        let result;
-        let executionResult;
         try {
-            executionResult = await executePrivateFunction(simulator, privateExecutionOracle, artifact, targetContractAddress, functionSelector);
-            const publicCallRequests = collectNested([
+            const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+            const anchoredContractData = new AnchoredContractData(this.contractStore, this.stateMachine.contractClassService, blockHeader);
+            this.logger.verbose(`Executing external function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, functionSelector)}@${targetContractAddress} isStaticCall=${isStaticCall}`);
+            const artifact = await anchoredContractData.getFunctionArtifact(targetContractAddress, functionSelector);
+            if (!artifact) {
+                const message = functionSelector.equals(await FunctionSelector.fromSignature('verify_private_authwit(Field)')) ? 'Found no account contract artifact for a private authwit check - use `create_contract_account` instead of `create_light_account` for authwit support.' : 'Function Artifact does not exist';
+                throw new Error(message);
+            }
+            const scopes = from === undefined ? additionalScopes : [
+                from,
+                ...additionalScopes
+            ];
+            // Sync notes before executing private function to discover notes from previous transactions
+            const utilityExecutor = async (call, execScopes)=>{
+                await this.executeUtilityCall(call, {
+                    scopes: execScopes,
+                    jobId
+                });
+            };
+            await this.stateMachine.contractSyncService.ensureContractSynced(targetContractAddress, functionSelector, utilityExecutor, blockHeader, jobId, scopes);
+            const blockNumber = await this.getNextBlockNumber();
+            const msgSender = from ?? AztecAddress.NULL_MSG_SENDER;
+            const callContext = new CallContext(msgSender, targetContractAddress, functionSelector, isStaticCall);
+            const txContext = new TxContext(this.chainId, this.version, gasSettings);
+            const protocolNullifier = await computeProtocolNullifier(getSingleTxBlockRequestHash(blockNumber));
+            const noteCache = new ExecutionNoteCache(protocolNullifier);
+            // In production, the account contract sets the min revertible counter before calling the app function.
+            // Since TXE bypasses the account contract, we simulate this by setting minRevertibleSideEffectCounter to 1,
+            // marking all side effects as revertible.
+            const minRevertibleSideEffectCounter = 1;
+            await noteCache.setMinRevertibleSideEffectCounter(minRevertibleSideEffectCounter);
+            const taggingIndexCache = new ExecutionTaggingIndexCache();
+            const simulator = new WASMSimulator();
+            const transientArrayService = new TransientArrayService();
+            const privateExecutionOracle = new PrivateExecutionOracle({
+                argsHash,
+                txContext,
+                txRequestSalt: Fr.ZERO,
+                callContext,
+                anchorBlockHeader: blockHeader,
+                utilityExecutor,
+                authWitnesses: Array.from(this.authwits.values()),
+                capsules: [],
+                executionCache: HashedValuesCache.create([
+                    new HashedValues(args, argsHash)
+                ]),
+                noteCache,
+                taggingIndexCache,
+                anchoredContractData,
+                noteStore: this.noteStore,
+                keyStore: this.keyStore,
+                addressStore: this.addressStore,
+                aztecNode: this.stateMachine.node,
+                senderTaggingStore: this.senderTaggingStore,
+                recipientTaggingStore: this.recipientTaggingStore,
+                taggingSecretSourcesStore: this.taggingSecretSourcesStore,
+                capsuleService: new CapsuleService(this.capsuleStore, scopes),
+                factService: new FactService(this.factStore, scopes),
+                privateEventStore: this.privateEventStore,
+                contractSyncService: this.stateMachine.contractSyncService,
+                jobId,
+                totalPublicCalldataCount: 0,
+                sideEffectCounter: minRevertibleSideEffectCounter,
+                scopes,
+                // In TXE, the typical transaction entrypoint is skipped, so we need to simulate the actions that such a
+                // contract would perform, including setting senderForTags.
+                senderForTags: from,
+                simulator,
+                txResolver: this.stateMachine.txResolver,
+                l2TipsStore: this.stateMachine.l2TipsProvider,
+                hooks: composeHooks({
+                    authorizeUtilityCall: this.buildAuthorizeUtilityCallHook(isStaticCall ? 'private view' : 'private', authorizedUtilityCallTargets),
+                    resolveTaggingSecretStrategy: makeResolveTaggingSecretStrategyHook(this.taggingSecretStrategies)
+                }),
+                transientArrayService
+            });
+            // Note: This is a slight modification of simulator.run without any of the checks. Maybe we should modify simulator.run with a boolean value to skip checks.
+            let result;
+            let executionResult;
+            try {
+                executionResult = await executePrivateFunction(simulator, privateExecutionOracle, artifact, targetContractAddress, functionSelector);
+                const publicCallRequests = collectNested([
+                    executionResult
+                ], (r)=>r.publicInputs.publicCallRequests.getActiveItems().map((r)=>r.inner).concat(r.publicInputs.publicTeardownCallRequest.isEmpty() ? [] : [
+                        r.publicInputs.publicTeardownCallRequest
+                    ]));
+                const publicFunctionsCalldata = await Promise.all(publicCallRequests.map(async (r)=>{
+                    const calldata = await privateExecutionOracle.getHashPreimage(r.calldataHash);
+                    return new HashedValues(calldata, r.calldataHash);
+                }));
+                const nonceGenerator = noteCache.getNonceGenerator();
+                result = new PrivateExecutionResult(executionResult, nonceGenerator, publicFunctionsCalldata);
+            } catch (err) {
+                throw createSimulationError(err instanceof Error ? err : new Error('Unknown error during private execution'));
+            }
+            // According to the protocol rules, there must be at least one nullifier in the tx. The first nullifier is used as
+            // the nonce generator for the note hashes.
+            // We pass the non-zero minRevertibleSideEffectCounter to make sure the side effects are split correctly.
+            const { publicInputs } = await generateSimulatedProvingResult(result, (addr, sel)=>anchoredContractData.getDebugFunctionName(addr, sel), this.stateMachine.node, minRevertibleSideEffectCounter);
+            const globals = makeGlobalVariables();
+            globals.blockNumber = blockNumber;
+            globals.timestamp = this.nextBlockTimestamp;
+            globals.chainId = this.chainId;
+            globals.version = this.version;
+            globals.gasFees = GasFees.empty();
+            const forkedWorldTrees = _ts_add_disposable_resource(env, await this.stateMachine.synchronizer.nativeWorldStateService.fork(), true);
+            const bindings = this.logger.getBindings();
+            const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractStore), bindings);
+            const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
+            const config = PublicSimulatorConfig.from({
+                skipFeeEnforcement: true,
+                collectDebugLogs: true,
+                collectHints: false,
+                collectStatistics: false,
+                collectCallMetadata: true
+            });
+            // The AVM simulator reads this fork's contracts DB, scoped by fork id, for each simulation.
+            const forkId = forkedWorldTrees.getRevision().forkId;
+            const processor = new PublicProcessor(globals, guardedMerkleTrees, contractsDB, new PublicTxSimulator(this.stateMachine.synchronizer.avmSimulator, globals, contractsDB, forkId, config, bindings), new TestDateProvider(), undefined, createLogger('simulator:public-processor', bindings));
+            const tx = await Tx.create({
+                data: publicInputs,
+                chonkProof: ChonkProof.empty(),
+                contractClassLogFields: [],
+                publicFunctionCalldata: result.publicFunctionCalldata
+            });
+            let checkpoint;
+            if (isStaticCall) {
+                checkpoint = await ForkCheckpoint.new(forkedWorldTrees);
+            }
+            const results = await processor.process([
+                tx
+            ]);
+            const [processedTx] = results[0];
+            const failedTxs = results[1];
+            if (failedTxs.length !== 0) {
+                throw new Error(`Public execution has failed: ${failedTxs[0].error}`);
+            } else if (!processedTx.revertCode.isOK()) {
+                if (processedTx.revertReason) {
+                    try {
+                        await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.stateMachine.contractClassService, await this.stateMachine.anchorBlockStore.getBlockHeader(), this.logger);
+                    // eslint-disable-next-line no-empty
+                    } catch  {}
+                    throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
+                } else {
+                    throw new Error('Contract execution has reverted');
+                }
+            }
+            // Walk the nested private-call tree and collect every offchain effect the transaction emitted.
+            // PXE stores these on each `PrivateCallExecutionResult` and they never reach TXE via the
+            // `aztec_utl_emitOffchainEffect` foreign-call path (that path only fires at the top-level), so
+            // we pull them out here and the RPC wrapper will hand them to `TXESession` for buffering.
+            const offchainEffects = collectNested([
                 executionResult
-            ], (r)=>r.publicInputs.publicCallRequests.getActiveItems().map((r)=>r.inner).concat(r.publicInputs.publicTeardownCallRequest.isEmpty() ? [] : [
-                    r.publicInputs.publicTeardownCallRequest
-                ]));
-            const publicFunctionsCalldata = await Promise.all(publicCallRequests.map(async (r)=>{
-                const calldata = await privateExecutionOracle.privateLoadFromExecutionCache(r.calldataHash);
-                return new HashedValues(calldata, r.calldataHash);
-            }));
-            noteCache.finish();
-            const nonceGenerator = noteCache.getNonceGenerator();
-            result = new PrivateExecutionResult(executionResult, nonceGenerator, publicFunctionsCalldata);
-        } catch (err) {
-            throw createSimulationError(err instanceof Error ? err : new Error('Unknown error during private execution'));
-        }
-        // According to the protocol rules, there must be at least one nullifier in the tx. The first nullifier is used as
-        // the nonce generator for the note hashes.
-        // We pass the non-zero minRevertibleSideEffectCounter to make sure the side effects are split correctly.
-        const { publicInputs } = await generateSimulatedProvingResult(result, (addr, sel)=>this.contractStore.getDebugFunctionName(addr, sel), this.stateMachine.node, minRevertibleSideEffectCounter);
-        const globals = makeGlobalVariables();
-        globals.blockNumber = blockNumber;
-        globals.timestamp = this.nextBlockTimestamp;
-        globals.chainId = this.chainId;
-        globals.version = this.version;
-        globals.gasFees = GasFees.empty();
-        const forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
-        const bindings = this.logger.getBindings();
-        const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractStore), bindings);
-        const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
-        const config = PublicSimulatorConfig.from({
-            skipFeeEnforcement: true,
-            collectDebugLogs: true,
-            collectHints: false,
-            collectStatistics: false,
-            collectCallMetadata: true
-        });
-        const processor = new PublicProcessor(globals, guardedMerkleTrees, contractsDB, new CppPublicTxSimulator(guardedMerkleTrees, contractsDB, globals, config, bindings), new TestDateProvider(), undefined, createLogger('simulator:public-processor', bindings));
-        const tx = await Tx.create({
-            data: publicInputs,
-            chonkProof: ChonkProof.empty(),
-            contractClassLogFields: [],
-            publicFunctionCalldata: result.publicFunctionCalldata
-        });
-        let checkpoint;
-        if (isStaticCall) {
-            checkpoint = await ForkCheckpoint.new(forkedWorldTrees);
-        }
-        const results = await processor.process([
-            tx
-        ]);
-        const [processedTx] = results[0];
-        const failedTxs = results[1];
-        if (failedTxs.length !== 0) {
-            throw new Error(`Public execution has failed: ${failedTxs[0].error}`);
-        } else if (!processedTx.revertCode.isOK()) {
-            if (processedTx.revertReason) {
-                try {
-                    await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.logger);
-                // eslint-disable-next-line no-empty
-                } catch  {}
-                throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
-            } else {
-                throw new Error('Contract execution has reverted');
+            ], (r)=>r.offchainEffects.map((e)=>e.data));
+            if (isStaticCall) {
+                await checkpoint.revert();
+                return {
+                    returnValues: executionResult.returnValues ?? [],
+                    offchainEffects
+                };
             }
+            const txEffect = TxEffect.empty();
+            txEffect.noteHashes = processedTx.txEffect.noteHashes;
+            txEffect.nullifiers = processedTx.txEffect.nullifiers;
+            txEffect.privateLogs = processedTx.txEffect.privateLogs;
+            txEffect.publicLogs = processedTx.txEffect.publicLogs;
+            txEffect.publicDataWrites = processedTx.txEffect.publicDataWrites;
+            txEffect.txHash = new TxHash(new Fr(blockNumber));
+            const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
+            await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
+            const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [
+                txEffect
+            ]);
+            await this.stateMachine.handleL2Block(l2Block);
+            return {
+                returnValues: executionResult.returnValues ?? [],
+                offchainEffects
+            };
+        } catch (e) {
+            env.error = e;
+            env.hasError = true;
+        } finally{
+            const result = _ts_dispose_resources(env);
+            if (result) await result;
         }
-        if (isStaticCall) {
-            await checkpoint.revert();
-            await forkedWorldTrees.close();
-            return executionResult.returnValues ?? [];
-        }
-        const txEffect = TxEffect.empty();
-        txEffect.noteHashes = processedTx.txEffect.noteHashes;
-        txEffect.nullifiers = processedTx.txEffect.nullifiers;
-        txEffect.privateLogs = processedTx.txEffect.privateLogs;
-        txEffect.publicLogs = processedTx.txEffect.publicLogs;
-        txEffect.publicDataWrites = processedTx.txEffect.publicDataWrites;
-        txEffect.txHash = new TxHash(new Fr(blockNumber));
-        const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
-        await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
-        const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [
-            txEffect
-        ]);
-        await this.stateMachine.handleL2Block(l2Block);
-        await forkedWorldTrees.close();
-        return executionResult.returnValues ?? [];
-    }
-    async txePublicCallNewFlow(from, targetContractAddress, calldata, isStaticCall) {
-        this.logger.verbose(`Executing public function ${await this.contractStore.getDebugFunctionName(targetContractAddress, FunctionSelector.fromField(calldata[0]))}@${targetContractAddress} isStaticCall=${isStaticCall}`);
-        const blockNumber = await this.txeGetNextBlockNumber();
-        const gasLimits = new Gas(DEFAULT_DA_GAS_LIMIT, DEFAULT_L2_GAS_LIMIT);
-        const teardownGasLimits = new Gas(DEFAULT_TEARDOWN_DA_GAS_LIMIT, DEFAULT_TEARDOWN_L2_GAS_LIMIT);
-        const gasSettings = new GasSettings(gasLimits, teardownGasLimits, GasFees.empty(), GasFees.empty());
-        const txContext = new TxContext(this.chainId, this.version, gasSettings);
-        const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
-        const calldataHash = await computeCalldataHash(calldata);
-        const calldataHashedValues = new HashedValues(calldata, calldataHash);
-        const globals = makeGlobalVariables();
-        globals.blockNumber = blockNumber;
-        globals.timestamp = this.nextBlockTimestamp;
-        globals.chainId = this.chainId;
-        globals.version = this.version;
-        globals.gasFees = GasFees.empty();
-        const forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
-        const bindings2 = this.logger.getBindings();
-        const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractStore), bindings2);
-        const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
-        const config = PublicSimulatorConfig.from({
-            skipFeeEnforcement: true,
-            collectDebugLogs: true,
-            collectHints: false,
-            collectStatistics: false,
-            collectCallMetadata: true
-        });
-        const simulator = new CppPublicTxSimulator(guardedMerkleTrees, contractsDB, globals, config, bindings2);
-        const processor = new PublicProcessor(globals, guardedMerkleTrees, contractsDB, simulator, new TestDateProvider(), undefined, createLogger('simulator:public-processor', bindings2));
-        // We're simulating a scenario in which private execution immediately enqueues a public call and halts. The private
-        // kernel init would in this case inject a nullifier with the transaction request hash as a non-revertible
-        // side-effect, which the AVM then expects to exist in order to use it as the nonce generator when siloing notes as
-        // unique.
-        const nonRevertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
-        nonRevertibleAccumulatedData.nullifiers[0] = getSingleTxBlockRequestHash(blockNumber);
-        // The enqueued public call itself we make be revertible so that the public execution is itself revertible, as tests
-        // may require producing reverts.
-        const revertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
-        revertibleAccumulatedData.publicCallRequests[0] = new PublicCallRequest(from, targetContractAddress, isStaticCall, calldataHash);
-        const inputsForPublic = new PartialPrivateTailPublicInputsForPublic(nonRevertibleAccumulatedData, revertibleAccumulatedData, PublicCallRequest.empty());
-        const constantData = new TxConstantData(anchorBlockHeader, txContext, Fr.zero(), Fr.zero());
-        const txData = new PrivateKernelTailCircuitPublicInputs(constantData, /*gasUsed=*/ new Gas(0, 0), /*feePayer=*/ AztecAddress.zero(), /*expirationTimestamp=*/ 0n, inputsForPublic, undefined);
-        const tx = await Tx.create({
-            data: txData,
-            chonkProof: ChonkProof.empty(),
-            contractClassLogFields: [],
-            publicFunctionCalldata: [
-                calldataHashedValues
-            ]
-        });
-        let checkpoint;
-        if (isStaticCall) {
-            checkpoint = await ForkCheckpoint.new(forkedWorldTrees);
-        }
-        const results = await processor.process([
-            tx
-        ]);
-        const [processedTx] = results[0];
-        const failedTxs = results[1];
-        if (failedTxs.length !== 0) {
-            throw new Error(`Public execution has failed: ${failedTxs[0].error}`);
-        } else if (!processedTx.revertCode.isOK()) {
-            if (processedTx.revertReason) {
-                try {
-                    await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.logger);
-                // eslint-disable-next-line no-empty
-                } catch  {}
-                throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
-            } else {
-                throw new Error('Contract execution has reverted');
+    }
+    async publicCallNewFlow(from, targetContractAddress, calldata, isStaticCall, gasSettings) {
+        const env = {
+            stack: [],
+            error: void 0,
+            hasError: false
+        };
+        try {
+            const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+            const anchoredContractData = new AnchoredContractData(this.contractStore, this.stateMachine.contractClassService, anchorBlockHeader);
+            this.logger.verbose(`Executing public function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, FunctionSelector.fromField(calldata[0]))}@${targetContractAddress} isStaticCall=${isStaticCall}`);
+            const blockNumber = await this.getNextBlockNumber();
+            const txContext = new TxContext(this.chainId, this.version, gasSettings);
+            const calldataHash = await computeCalldataHash(calldata);
+            const calldataHashedValues = new HashedValues(calldata, calldataHash);
+            const globals = makeGlobalVariables();
+            globals.blockNumber = blockNumber;
+            globals.timestamp = this.nextBlockTimestamp;
+            globals.chainId = this.chainId;
+            globals.version = this.version;
+            globals.gasFees = GasFees.empty();
+            const forkedWorldTrees = _ts_add_disposable_resource(env, await this.stateMachine.synchronizer.nativeWorldStateService.fork(), true);
+            const bindings2 = this.logger.getBindings();
+            const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractStore), bindings2);
+            const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
+            const config = PublicSimulatorConfig.from({
+                skipFeeEnforcement: true,
+                collectDebugLogs: true,
+                collectHints: false,
+                collectStatistics: false,
+                collectCallMetadata: true
+            });
+            // The AVM simulator reads this fork's contracts DB, scoped by fork id, for each simulation.
+            const forkId2 = forkedWorldTrees.getRevision().forkId;
+            const simulator = new PublicTxSimulator(this.stateMachine.synchronizer.avmSimulator, globals, contractsDB, forkId2, config, bindings2);
+            const processor = new PublicProcessor(globals, guardedMerkleTrees, contractsDB, simulator, new TestDateProvider(), undefined, createLogger('simulator:public-processor', bindings2));
+            // We're simulating a scenario in which private execution immediately enqueues a public call and halts. The private
+            // kernel init would in this case inject a nullifier with the transaction request hash as a non-revertible
+            // side-effect, which the AVM then expects to exist in order to use it as the nonce generator when siloing notes as
+            // unique.
+            const nonRevertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
+            nonRevertibleAccumulatedData.nullifiers[0] = getSingleTxBlockRequestHash(blockNumber);
+            // The enqueued public call itself we make be revertible so that the public execution is itself revertible, as tests
+            // may require producing reverts.
+            const revertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
+            revertibleAccumulatedData.publicCallRequests[0] = new PublicCallRequest(from ?? AztecAddress.NULL_MSG_SENDER, targetContractAddress, isStaticCall, calldataHash);
+            const inputsForPublic = new PartialPrivateTailPublicInputsForPublic(nonRevertibleAccumulatedData, revertibleAccumulatedData, PublicCallRequest.empty());
+            const constantData = new TxConstantData(anchorBlockHeader, txContext, Fr.zero(), Fr.zero());
+            const txData = new PrivateKernelTailCircuitPublicInputs(constantData, /*gasUsed=*/ new Gas(0, 0), /*feePayer=*/ AztecAddress.zero(), /*expirationTimestamp=*/ 0n, inputsForPublic, undefined);
+            const tx = await Tx.create({
+                data: txData,
+                chonkProof: ChonkProof.empty(),
+                contractClassLogFields: [],
+                publicFunctionCalldata: [
+                    calldataHashedValues
+                ]
+            });
+            let checkpoint;
+            if (isStaticCall) {
+                checkpoint = await ForkCheckpoint.new(forkedWorldTrees);
             }
-        }
-        const returnValues = results[3][0].values;
-        if (isStaticCall) {
-            await checkpoint.revert();
-            await forkedWorldTrees.close();
+            const results = await processor.process([
+                tx
+            ]);
+            const [processedTx] = results[0];
+            const failedTxs = results[1];
+            if (failedTxs.length !== 0) {
+                throw new Error(`Public execution has failed: ${failedTxs[0].error}`);
+            } else if (!processedTx.revertCode.isOK()) {
+                if (processedTx.revertReason) {
+                    try {
+                        await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.stateMachine.contractClassService, anchorBlockHeader, this.logger);
+                    // eslint-disable-next-line no-empty
+                    } catch  {}
+                    throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
+                } else {
+                    throw new Error('Contract execution has reverted');
+                }
+            }
+            const returnValues = results[3][0].values;
+            if (isStaticCall) {
+                await checkpoint.revert();
+                return returnValues ?? [];
+            }
+            const txEffect = TxEffect.empty();
+            txEffect.noteHashes = processedTx.txEffect.noteHashes;
+            txEffect.nullifiers = processedTx.txEffect.nullifiers;
+            txEffect.privateLogs = processedTx.txEffect.privateLogs;
+            txEffect.publicLogs = processedTx.txEffect.publicLogs;
+            txEffect.publicDataWrites = processedTx.txEffect.publicDataWrites;
+            txEffect.txHash = new TxHash(new Fr(blockNumber));
+            const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
+            await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
+            const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [
+                txEffect
+            ]);
+            await this.stateMachine.handleL2Block(l2Block);
             return returnValues ?? [];
+        } catch (e) {
+            env.error = e;
+            env.hasError = true;
+        } finally{
+            const result = _ts_dispose_resources(env);
+            if (result) await result;
         }
-        const txEffect = TxEffect.empty();
-        txEffect.noteHashes = processedTx.txEffect.noteHashes;
-        txEffect.nullifiers = processedTx.txEffect.nullifiers;
-        txEffect.privateLogs = processedTx.txEffect.privateLogs;
-        txEffect.publicLogs = processedTx.txEffect.publicLogs;
-        txEffect.publicDataWrites = processedTx.txEffect.publicDataWrites;
-        txEffect.txHash = new TxHash(new Fr(blockNumber));
-        const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
-        await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
-        const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [
-            txEffect
-        ]);
-        await this.stateMachine.handleL2Block(l2Block);
-        await forkedWorldTrees.close();
-        return returnValues ?? [];
     }
-    async txeExecuteUtilityFunction(targetContractAddress, functionSelector, args, jobId) {
-        const artifact = await this.contractStore.getFunctionArtifact(targetContractAddress, functionSelector);
+    async executeUtilityFunction(from, targetContractAddress, functionSelector, args, jobId, authorizedUtilityCallTargets) {
+        const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+        const anchoredContractData = new AnchoredContractData(this.contractStore, this.stateMachine.contractClassService, blockHeader);
+        const artifact = await anchoredContractData.getFunctionArtifact(targetContractAddress, functionSelector);
         if (!artifact) {
             throw new Error(`Cannot call ${functionSelector} as there is no artifact found at ${targetContractAddress}.`);
         }
         // Sync notes before executing utility function to discover notes from previous transactions
-        const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
         await this.stateMachine.contractSyncService.ensureContractSynced(targetContractAddress, functionSelector, async (call, execScopes)=>{
-            await this.executeUtilityCall(call, execScopes, jobId);
-        }, blockHeader, jobId, 'ALL_SCOPES');
+            await this.executeUtilityCall(call, {
+                scopes: execScopes,
+                jobId
+            });
+        }, blockHeader, jobId, await this.keyStore.getAccounts());
         const call = FunctionCall.from({
             name: artifact.name,
             to: targetContractAddress,
@@ -478,13 +686,22 @@ export class TXEOracleTopLevelContext {
             type: FunctionType.UTILITY,
             hideMsgSender: false,
             isStatic: false,
-            args,
-            returnTypes: []
+            args
+        });
+        return this.executeUtilityCall(call, {
+            from,
+            scopes: await this.keyStore.getAccounts(),
+            jobId,
+            authorizedUtilityCallTargets
         });
-        return this.executeUtilityCall(call, 'ALL_SCOPES', jobId);
     }
-    async executeUtilityCall(call, scopes, jobId) {
-        const entryPointArtifact = await this.contractStore.getFunctionArtifactWithDebugMetadata(call.to, call.selector);
+    async executeUtilityCall(call, { from = AztecAddress.NULL_MSG_SENDER, scopes, jobId, authorizedUtilityCallTargets = [] }) {
+        const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+        const anchoredContractData = new AnchoredContractData(this.contractStore, this.stateMachine.contractClassService, anchorBlockHeader);
+        const entryPointArtifact = await anchoredContractData.getFunctionArtifactWithDebugMetadata(call.to, call.selector);
+        if (!entryPointArtifact) {
+            throw new Error(`Cannot run function ${call.selector} on ${call.to}: the contract is not registered.`);
+        }
         if (entryPointArtifact.functionType !== FunctionType.UTILITY) {
             throw new Error(`Cannot run ${entryPointArtifact.functionType} function as utility`);
         }
@@ -493,25 +710,47 @@ export class TXEOracleTopLevelContext {
             selector: call.selector
         });
         try {
-            const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+            const simulator = new WASMSimulator();
+            const utilityExecutor = async (syncCall, execScopes)=>{
+                await this.executeUtilityCall(syncCall, {
+                    scopes: execScopes,
+                    jobId
+                });
+            };
             const oracle = new UtilityExecutionOracle({
-                contractAddress: call.to,
+                callContext: CallContext.from({
+                    msgSender: from,
+                    contractAddress: call.to,
+                    functionSelector: call.selector,
+                    isStaticCall: true
+                }),
                 authWitnesses: [],
                 capsules: [],
                 anchorBlockHeader,
-                contractStore: this.contractStore,
+                anchoredContractData,
                 noteStore: this.noteStore,
                 keyStore: this.keyStore,
                 addressStore: this.addressStore,
                 aztecNode: this.stateMachine.node,
                 recipientTaggingStore: this.recipientTaggingStore,
-                senderAddressBookStore: this.senderAddressBookStore,
-                capsuleStore: this.capsuleStore,
+                taggingSecretSourcesStore: this.taggingSecretSourcesStore,
+                capsuleService: new CapsuleService(this.capsuleStore, scopes),
+                factService: new FactService(this.factStore, scopes),
                 privateEventStore: this.privateEventStore,
+                txResolver: this.stateMachine.txResolver,
+                contractSyncService: this.stateMachine.contractSyncService,
+                l2TipsStore: this.stateMachine.l2TipsProvider,
                 jobId,
-                scopes
+                scopes,
+                simulator,
+                hooks: composeHooks({
+                    authorizeUtilityCall: this.buildAuthorizeUtilityCallHook('utility', authorizedUtilityCallTargets)
+                }),
+                utilityExecutor,
+                // Execution-tree root (top-level utility run or contract sync): own store; nested frames inherit it.
+                transientArrayService: new TransientArrayService()
             });
-            const acirExecutionResult = await new WASMSimulator().executeUserCircuit(toACVMWitness(0, call.args), entryPointArtifact, new Oracle(oracle).toACIRCallback()).catch((err)=>{
+            const acirExecutionResult = await simulator.executeUserCircuit(toACVMWitness(0, call.args), entryPointArtifact, buildACIRCallback(oracle)).catch((err)=>{
                 err.message = resolveAssertionMessageFromError(err, entryPointArtifact);
                 throw new ExecutionError(err.message, {
                     contractAddress: call.to,
@@ -528,13 +767,33 @@ export class TXEOracleTopLevelContext {
     }
     close() {
         this.logger.debug('Exiting Top Level Context');
-        return [
-            this.nextBlockTimestamp,
-            this.authwits
-        ];
+        return {
+            nextBlockTimestamp: this.nextBlockTimestamp,
+            authwits: this.authwits,
+            taggingSecretStrategies: this.taggingSecretStrategies,
+            authorizeAllUtilityCallTargets: this.authorizeAllUtilityCallTargets
+        };
     }
     async getLastBlockNumber() {
-        const header = await this.stateMachine.node.getBlockHeader('latest');
-        return header ? header.globalVariables.blockNumber : BlockNumber.ZERO;
+        const block = await this.stateMachine.node.getBlock('latest');
+        return block ? block.header.globalVariables.blockNumber : BlockNumber.ZERO;
+    }
+    buildAuthorizeUtilityCallHook(callerContext, authorizedTargets) {
+        if (this.authorizeAllUtilityCallTargets) {
+            return authorizeAllUtilityCallsHook;
+        }
+        if (authorizedTargets.length === 0) {
+            return undefined;
+        }
+        return (req)=>Promise.resolve({
+                authorized: req.callerContext === callerContext && authorizedTargets.some((t)=>t.equals(req.target))
+            });
     }
 }
+/**
+ * An `authorizeUtilityCall` hook that authorizes every cross-contract utility call.
+ *
+ * Backs the `aztec_txe_setAuthorizeAllUtilityCallTargets` oracle.
+ */ export const authorizeAllUtilityCallsHook = ()=>Promise.resolve({
+        authorized: true
+    });