@aztec/txe 0.0.1-commit.b655e406 → 0.0.1-commit.b8a057fa

package/src/oracle/txe_oracle_top_level_context.ts

@@ -1,30 +1,45 @@
 import {
   CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS,
-  DEFAULT_DA_GAS_LIMIT,
-  DEFAULT_L2_GAS_LIMIT,
-  DEFAULT_TEARDOWN_DA_GAS_LIMIT,
-  DEFAULT_TEARDOWN_L2_GAS_LIMIT,
+  MAX_PRIVATE_LOGS_PER_TX,
   NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP,
 } from '@aztec/constants';
-import { Schnorr } from '@aztec/foundation/crypto';
-import { Fr } from '@aztec/foundation/fields';
+import { BlockNumber } from '@aztec/foundation/branded-types';
+import { Schnorr } from '@aztec/foundation/crypto/schnorr';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import type { EthAddress } from '@aztec/foundation/eth-address';
 import { LogLevels, type Logger, applyStringFormatting, createLogger } from '@aztec/foundation/log';
 import { TestDateProvider } from '@aztec/foundation/timer';
 import type { KeyStore } from '@aztec/key-store';
 import {
-  AddressDataProvider,
-  ORACLE_VERSION,
-  PXEOracleInterface,
+  AddressStore,
+  AnchoredContractData,
+  CapsuleService,
+  CapsuleStore,
+  type ContractStore,
+  type ExecutionHooks,
+  FactService,
+  FactStore,
+  NoteStore,
+  ORACLE_VERSION_MAJOR,
+  PrivateEventStore,
+  RecipientTaggingStore,
+  SenderTaggingStore,
+  TaggingSecretSourcesStore,
+  type TaggingSecretStrategy,
+  composeHooks,
   enrichPublicSimulationError,
 } from '@aztec/pxe/server';
 import {
+  CONTRACT_INSTANCE,
   ExecutionNoteCache,
   ExecutionTaggingIndexCache,
   HashedValuesCache,
   type IMiscOracle,
-  Oracle,
+  type Option,
   PrivateExecutionOracle,
+  TransientArrayService,
   UtilityExecutionOracle,
+  buildACIRCallback,
   executePrivateFunction,
   generateSimulatedProvingResult,
 } from '@aztec/pxe/simulator';
@@ -43,21 +58,24 @@ import {
   PublicProcessor,
   PublicTxSimulator,
 } from '@aztec/simulator/server';
-import { type ContractArtifact, FunctionSelector, FunctionType } from '@aztec/stdlib/abi';
+import { type ContractArtifact, EventSelector, FunctionCall, FunctionSelector, FunctionType } from '@aztec/stdlib/abi';
 import { AuthWitness } from '@aztec/stdlib/auth-witness';
+import { PublicSimulatorConfig } from '@aztec/stdlib/avm';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
-import { Body, L2Block } from '@aztec/stdlib/block';
 import { type ContractInstanceWithAddress, computePartialAddress } from '@aztec/stdlib/contract';
 import { Gas, GasFees, GasSettings } from '@aztec/stdlib/gas';
-import { computeCalldataHash, siloNullifier } from '@aztec/stdlib/hash';
+import { computeCalldataHash, computeProtocolNullifier, siloNullifier } from '@aztec/stdlib/hash';
 import {
   PartialPrivateTailPublicInputsForPublic,
   PrivateKernelTailCircuitPublicInputs,
   PrivateToPublicAccumulatedData,
   PublicCallRequest,
 } from '@aztec/stdlib/kernel';
+import { deriveKeys, hashPublicKey } from '@aztec/stdlib/keys';
+import type { PrivateLog } from '@aztec/stdlib/logs';
+import { L1Actor, L1ToL2Message, L2Actor } from '@aztec/stdlib/messaging';
 import { ChonkProof } from '@aztec/stdlib/proofs';
-import { makeAppendOnlyTreeSnapshot, makeGlobalVariables } from '@aztec/stdlib/testing';
+import { makeGlobalVariables } from '@aztec/stdlib/testing';
 import { MerkleTreeId } from '@aztec/stdlib/trees';
 import {
   CallContext,
@@ -72,17 +90,14 @@ import {
   collectNested,
 } from '@aztec/stdlib/tx';
 import type { UInt64 } from '@aztec/stdlib/types';
-import { ForkCheckpoint } from '@aztec/world-state';
+import { ForkCheckpoint } from '@aztec/world-state/native';
 
+import { DEFAULT_ADDRESS, MAX_PRIVATE_EVENTS_PER_TXE_QUERY, MAX_PRIVATE_EVENT_LEN } from '../constants.js';
 import type { TXEStateMachine } from '../state_machine/index.js';
-import type { TXEAccountDataProvider } from '../util/txe_account_data_provider.js';
-import type { TXEContractDataProvider } from '../util/txe_contract_data_provider.js';
-import { TXEPublicContractDataSource } from '../util/txe_public_contract_data_source.js';
-import {
-  getSingleTxBlockRequestHash,
-  insertTxEffectIntoWorldTrees,
-  makeTXEBlockHeader,
-} from '../utils/block_creation.js';
+import { getSingleTxBlockRequestHash, insertTxEffectIntoWorldTrees, makeTXEBlock } from '../utils/block_creation.js';
+import type { TXEAccountStore } from '../utils/txe_account_store.js';
+import type { TXEArtifactResolver } from '../utils/txe_artifact_resolver.js';
+import { TXEPublicContractDataSource } from '../utils/txe_public_contract_data_source.js';
 import type { ITxeExecutionOracle } from './interfaces.js';
 
 export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracle {
@@ -93,58 +108,86 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
 
   constructor(
     private stateMachine: TXEStateMachine,
-    private contractDataProvider: TXEContractDataProvider,
+    private contractStore: ContractStore,
+    private noteStore: NoteStore,
     private keyStore: KeyStore,
-    private addressDataProvider: AddressDataProvider,
-    private accountDataProvider: TXEAccountDataProvider,
-    private pxeOracleInterface: PXEOracleInterface,
+    private addressStore: AddressStore,
+    private accountStore: TXEAccountStore,
+    private senderTaggingStore: SenderTaggingStore,
+    private recipientTaggingStore: RecipientTaggingStore,
+    private taggingSecretSourcesStore: TaggingSecretSourcesStore,
+    private capsuleStore: CapsuleStore,
+    private factStore: FactStore,
+    private privateEventStore: PrivateEventStore,
     private nextBlockTimestamp: bigint,
     private version: Fr,
     private chainId: Fr,
     private authwits: Map<string, AuthWitness>,
+    private taggingSecretStrategy: TaggingSecretStrategy | undefined,
+    private readonly artifactResolver: TXEArtifactResolver,
+    private readonly rootPath: string,
+    private readonly packageName: string,
   ) {
     this.logger = createLogger('txe:top_level_context');
     this.logger.debug('Entering Top Level Context');
   }
 
-  utilityAssertCompatibleOracleVersion(version: number): void {
-    if (version !== ORACLE_VERSION) {
+  private contractOracleVersion: { major: number; minor: number } | undefined;
+
+  assertCompatibleOracleVersion(major: number, minor: number): void {
+    if (major !== ORACLE_VERSION_MAJOR) {
+      const hint =
+        major > ORACLE_VERSION_MAJOR
+          ? 'The contract was compiled with a newer version of Aztec.nr than this aztec cli version supports. Upgrade your aztec cli version to a compatible version.'
+          : 'The contract was compiled with an older version of Aztec.nr than this aztec cli version supports. Recompile the contract with a compatible version of Aztec.nr.';
       throw new Error(
-        `Incompatible oracle version. TXE is using version '${ORACLE_VERSION}', but got a request for '${version}'.`,
+        `Incompatible aztec cli version: ${hint} See https://docs.aztec.network/errors/8 (expected oracle major version ${ORACLE_VERSION_MAJOR}, got ${major})`,
       );
     }
+    this.contractOracleVersion = { major, minor };
+  }
+
+  // Prefixed with "nonOracleFunction" as it is not used as an oracle handler.
+  nonOracleFunctionGetContractOracleVersion(): { major: number; minor: number } | undefined {
+    return this.contractOracleVersion;
   }
 
   // This is typically only invoked in private contexts, but it is convenient to also have it in top-level for testing
   // setup.
-  utilityGetRandomField(): Fr {
+  getRandomField(): Fr {
     return Fr.random();
   }
 
   // We instruct users to debug contracts via this oracle, so it makes sense that they'd expect it to also work in tests
-  utilityDebugLog(level: number, message: string, fields: Fr[]): void {
+  log(level: number, message: string, _fieldsSize: number, fields: Fr[]): Promise<void> {
     if (!LogLevels[level]) {
-      throw new Error(`Invalid debug log level: ${level}`);
+      throw new Error(`Invalid log level: ${level}`);
     }
     const levelName = LogLevels[level];
 
     this.logger[levelName](`${applyStringFormatting(message, fields)}`, { module: `${this.logger.module}:debug_log` });
+    return Promise.resolve();
   }
 
-  async txeGetNextBlockNumber(): Promise<number> {
-    return (await this.getLastBlockNumber()) + 1;
+  getDefaultAddress(): AztecAddress {
+    return DEFAULT_ADDRESS;
   }
 
-  txeGetNextBlockTimestamp(): Promise<bigint> {
+  async getNextBlockNumber(): Promise<BlockNumber> {
+    return BlockNumber((await this.getLastBlockNumber()) + 1);
+  }
+
+  getNextBlockTimestamp(): Promise<bigint> {
     return Promise.resolve(this.nextBlockTimestamp);
   }
 
-  async txeGetLastBlockTimestamp() {
-    return (await this.stateMachine.node.getBlockHeader('latest'))!.globalVariables.timestamp;
+  async getLastBlockTimestamp() {
+    return (await this.stateMachine.node.getBlockData('latest'))!.header.globalVariables.timestamp;
   }
 
-  async txeGetLastTxEffects() {
-    const block = await this.stateMachine.archiver.getBlock('latest');
+  async getLastTxEffects(): Promise<{ txHash: TxHash; noteHashes: Fr[]; nullifiers: Fr[]; privateLogs: PrivateLog[] }> {
+    const latestBlockNumber = await this.stateMachine.archiver.getBlockNumber();
+    const block = await this.stateMachine.archiver.getBlock({ number: latestBlockNumber });
 
     if (block!.body.txEffects.length != 1) {
       // Note that calls like env.mine() will result in blocks with no transactions, hitting this
@@ -153,10 +196,59 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
 
     const txEffects = block!.body.txEffects[0];
 
-    return { txHash: txEffects.txHash, noteHashes: txEffects.noteHashes, nullifiers: txEffects.nullifiers };
+    const privateLogs = txEffects.privateLogs;
+    if (privateLogs.length > MAX_PRIVATE_LOGS_PER_TX) {
+      throw new Error(`${privateLogs.length} private logs exceed max ${MAX_PRIVATE_LOGS_PER_TX}`);
+    }
+
+    return {
+      txHash: txEffects.txHash,
+      noteHashes: txEffects.noteHashes,
+      nullifiers: txEffects.nullifiers,
+      privateLogs,
+    };
+  }
+
+  async syncContractNonOracleMethod(contractAddress: AztecAddress, scope: AztecAddress, jobId: string) {
+    if (contractAddress.equals(DEFAULT_ADDRESS)) {
+      this.logger.debug(`Skipping sync in getPrivateEvents because the events correspond to the default address.`);
+      return;
+    }
+
+    const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+    await this.stateMachine.contractSyncService.ensureContractSynced(
+      contractAddress,
+      null,
+      async (call, execScopes) => {
+        await this.executeUtilityCall(call, { scopes: execScopes, jobId });
+      },
+      blockHeader,
+      jobId,
+      [scope],
+    );
+  }
+
+  async getPrivateEvents(selector: EventSelector, contractAddress: AztecAddress, scope: AztecAddress) {
+    const events = (
+      await this.privateEventStore.getPrivateEvents(selector, {
+        contractAddress,
+        scopes: [scope],
+        fromBlock: 0,
+        toBlock: (await this.getLastBlockNumber()) + 1,
+      })
+    ).map(e => e.packedEvent);
+
+    if (events.length > MAX_PRIVATE_EVENTS_PER_TXE_QUERY) {
+      throw new Error(`Array of length ${events.length} larger than maxLen ${MAX_PRIVATE_EVENTS_PER_TXE_QUERY}`);
+    }
+    if (events.some(e => e.length > MAX_PRIVATE_EVENT_LEN)) {
+      throw new Error(`Some private event has length larger than maxLen ${MAX_PRIVATE_EVENT_LEN}`);
+    }
+
+    return events;
   }
 
-  async txeAdvanceBlocksBy(blocks: number) {
+  async advanceBlocksBy(blocks: number) {
     this.logger.debug(`time traveling ${blocks} blocks`);
 
     for (let i = 0; i < blocks; i++) {
@@ -164,112 +256,179 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     }
   }
 
-  txeAdvanceTimestampBy(duration: UInt64) {
+  advanceTimestampBy(duration: UInt64) {
     this.logger.debug(`time traveling ${duration} seconds`);
     this.nextBlockTimestamp += duration;
   }
 
-  async txeDeploy(artifact: ContractArtifact, instance: ContractInstanceWithAddress, secret: Fr) {
+  private deploymentNullifier(address: AztecAddress): Promise<Fr> {
+    return siloNullifier(AztecAddress.fromNumberUnsafe(CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS), address.toField());
+  }
+
+  async deploy(
+    contractPath: string,
+    initializer: string,
+    args: Fr[],
+    secret: Fr,
+    salt: Fr,
+    deployer: AztecAddress,
+  ): Promise<Fr[]> {
+    const { artifact, instance } = await this.artifactResolver.resolveDeployArtifact({
+      rootPath: this.rootPath,
+      packageName: this.packageName,
+      contractPath,
+      initializer,
+      args,
+      secret,
+      salt,
+      deployer,
+    });
+
     // Emit deployment nullifier
     await this.mineBlock({
-      nullifiers: [
-        await siloNullifier(
-          AztecAddress.fromNumber(CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS),
-          instance.address.toField(),
-        ),
-      ],
+      nullifiers: [await this.deploymentNullifier(instance.address)],
     });
 
     if (!secret.equals(Fr.ZERO)) {
-      await this.txeAddAccount(artifact, instance, secret);
+      await this.registerContractAndAddAccount(artifact, instance, secret);
     } else {
-      await this.contractDataProvider.addContractInstance(instance);
-      await this.contractDataProvider.addContractArtifact(instance.currentContractClassId, artifact);
+      await this.contractStore.addContractInstance(instance);
+      await this.contractStore.addContractArtifact(artifact);
       this.logger.debug(`Deployed ${artifact.name} at ${instance.address}`);
     }
+
+    return CONTRACT_INSTANCE.serialization!.fn(instance).flat();
+  }
+
+  /**
+   * Mines a single block containing only the deployment nullifiers for the contracts at the given addresses.
+   */
+  async mineDeploymentNullifiers(addresses: AztecAddress[]) {
+    await this.mineBlock({
+      nullifiers: await Promise.all(addresses.map(address => this.deploymentNullifier(address))),
+    });
+  }
+
+  async addAccount(secret: Fr) {
+    const { artifact, instance } = await this.artifactResolver.resolveAccountArtifact(secret);
+    return this.registerContractAndAddAccount(artifact, instance, secret);
   }
 
-  async txeAddAccount(artifact: ContractArtifact, instance: ContractInstanceWithAddress, secret: Fr) {
+  private async registerContractAndAddAccount(
+    artifact: ContractArtifact,
+    instance: ContractInstanceWithAddress,
+    secret: Fr,
+  ) {
     const partialAddress = await computePartialAddress(instance);
 
     this.logger.debug(`Deployed ${artifact.name} at ${instance.address}`);
-    await this.contractDataProvider.addContractInstance(instance);
-    await this.contractDataProvider.addContractArtifact(instance.currentContractClassId, artifact);
+    await this.contractStore.addContractInstance(instance);
+    await this.contractStore.addContractArtifact(artifact);
 
-    const completeAddress = await this.keyStore.addAccount(secret, partialAddress);
-    await this.accountDataProvider.setAccount(completeAddress.address, completeAddress);
-    await this.addressDataProvider.addCompleteAddress(completeAddress);
+    const completeAddress = await this.keyStore.addAccount(await deriveKeys(secret), partialAddress);
+    await this.accountStore.setAccount(completeAddress.address, completeAddress);
+    await this.addressStore.addCompleteAddress(completeAddress);
     this.logger.debug(`Created account ${completeAddress.address}`);
 
     return completeAddress;
   }
 
-  async txeCreateAccount(secret: Fr) {
-    // This is a footgun !
-    const completeAddress = await this.keyStore.addAccount(secret, secret);
-    await this.accountDataProvider.setAccount(completeAddress.address, completeAddress);
-    await this.addressDataProvider.addCompleteAddress(completeAddress);
+  async createAccount(secret: Fr) {
+    // This is a foot gun !
+    const completeAddress = await this.keyStore.addAccount(await deriveKeys(secret), secret);
+    await this.accountStore.setAccount(completeAddress.address, completeAddress);
+    await this.addressStore.addCompleteAddress(completeAddress);
     this.logger.debug(`Created account ${completeAddress.address}`);
 
     return completeAddress;
   }
 
-  async txeAddAuthWitness(address: AztecAddress, messageHash: Fr) {
-    const account = await this.accountDataProvider.getAccount(address);
-    const privateKey = await this.keyStore.getMasterSecretKey(account.publicKeys.masterIncomingViewingPublicKey);
+  async addAuthWitness(address: AztecAddress, messageHash: Fr) {
+    const account = await this.accountStore.getAccount(address);
+    const ivpkMHash = await hashPublicKey(account.publicKeys.ivpkM);
+    const privateKey = await this.keyStore.getMasterSecretKey(ivpkMHash);
 
     const schnorr = new Schnorr();
-    const signature = await schnorr.constructSignature(messageHash.toBuffer(), privateKey);
+    const signature = await schnorr.constructSignature(messageHash, privateKey);
 
-    const authWitness = new AuthWitness(messageHash, [...signature.toBuffer()]);
+    const authWitness = new AuthWitness(messageHash, signature.toLimbFields());
 
     this.authwits.set(authWitness.requestHash.toString(), authWitness);
   }
 
-  async mineBlock(options: { nullifiers?: Fr[] } = {}) {
-    const blockNumber = await this.txeGetNextBlockNumber();
+  setTaggingSecretStrategy(strategy: Option<TaggingSecretStrategy>): void {
+    this.taggingSecretStrategy = strategy.value;
+  }
+
+  async sendL1ToL2Message(content: Fr, secretHash: Fr, sender: EthAddress, recipient: AztecAddress): Promise<Fr> {
+    // Messages are appended to the tree, so the next free slot is simply the current tree size.
+    const { size } = await this.stateMachine.synchronizer
+      .getCommitted()
+      .getTreeInfo(MerkleTreeId.L1_TO_L2_MESSAGE_TREE);
+    const leafIndex = new Fr(size);
+
+    const message = new L1ToL2Message(
+      new L1Actor(sender, this.chainId.toNumber()),
+      new L2Actor(recipient, this.version.toNumber()),
+      content,
+      secretHash,
+      leafIndex,
+    );
+
+    await this.mineBlock({ l1ToL2Messages: [message.hash()] });
+
+    return leafIndex;
+  }
+
+  async mineBlock(options: { nullifiers?: Fr[]; l1ToL2Messages?: Fr[] } = {}) {
+    const blockNumber = await this.getNextBlockNumber();
 
     const txEffect = TxEffect.empty();
     txEffect.nullifiers = [getSingleTxBlockRequestHash(blockNumber), ...(options.nullifiers ?? [])];
     txEffect.txHash = new TxHash(new Fr(blockNumber));
 
     const forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
-    await insertTxEffectIntoWorldTrees(txEffect, forkedWorldTrees);
-
-    const block = new L2Block(
-      makeAppendOnlyTreeSnapshot(),
-      await makeTXEBlockHeader(
-        forkedWorldTrees,
-        makeGlobalVariables(undefined, {
-          blockNumber,
-          timestamp: this.nextBlockTimestamp,
-          version: this.version,
-          chainId: this.chainId,
-        }),
-      ),
-      new Body([txEffect]),
-    );
+    await insertTxEffectIntoWorldTrees(txEffect, forkedWorldTrees, options.l1ToL2Messages ?? []);
+
+    const globals = makeGlobalVariables(undefined, {
+      blockNumber,
+      timestamp: this.nextBlockTimestamp,
+      version: this.version,
+      chainId: this.chainId,
+    });
+    const block = await makeTXEBlock(forkedWorldTrees, globals, [txEffect]);
 
     await forkedWorldTrees.close();
 
     this.logger.info(`Created block ${blockNumber} with timestamp ${block.header.globalVariables.timestamp}`);
 
-    await this.stateMachine.handleL2Block(block);
+    await this.stateMachine.handleL2Block(block, options.l1ToL2Messages ?? []);
   }
 
-  async txePrivateCallNewFlow(
-    from: AztecAddress,
+  async privateCallNewFlow(
+    from: AztecAddress | undefined,
     targetContractAddress: AztecAddress = AztecAddress.zero(),
     functionSelector: FunctionSelector = FunctionSelector.empty(),
     args: Fr[],
     argsHash: Fr = Fr.zero(),
     isStaticCall: boolean = false,
+    additionalScopes: AztecAddress[] = [],
+    jobId: string,
+    authorizedUtilityCallTargets: AztecAddress[],
+    gasSettings: GasSettings,
   ) {
+    const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+    const anchoredContractData = new AnchoredContractData(
+      this.contractStore,
+      this.stateMachine.contractClassService,
+      blockHeader,
+    );
+
     this.logger.verbose(
-      `Executing external function ${await this.contractDataProvider.getDebugFunctionName(targetContractAddress, functionSelector)}@${targetContractAddress} isStaticCall=${isStaticCall}`,
+      `Executing external function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, functionSelector)}@${targetContractAddress} isStaticCall=${isStaticCall}`,
     );
 
-    const artifact = await this.contractDataProvider.getFunctionArtifact(targetContractAddress, functionSelector);
+    const artifact = await anchoredContractData.getFunctionArtifact(targetContractAddress, functionSelector);
     if (!artifact) {
       const message = functionSelector.equals(await FunctionSelector.fromSignature('verify_private_authwit(Field)'))
         ? 'Found no account contract artifact for a private authwit check - use `create_contract_account` instead of `create_light_account` for authwit support.'
@@ -277,51 +436,87 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
       throw new Error(message);
     }
 
-    const blockNumber = await this.txeGetNextBlockNumber();
+    const scopes = from === undefined ? additionalScopes : [from, ...additionalScopes];
 
-    const callContext = new CallContext(from, targetContractAddress, functionSelector, isStaticCall);
+    // Sync notes before executing private function to discover notes from previous transactions
+    const utilityExecutor = async (call: FunctionCall, execScopes: AztecAddress[]) => {
+      await this.executeUtilityCall(call, { scopes: execScopes, jobId });
+    };
 
-    const gasLimits = new Gas(DEFAULT_DA_GAS_LIMIT, DEFAULT_L2_GAS_LIMIT);
+    await this.stateMachine.contractSyncService.ensureContractSynced(
+      targetContractAddress,
+      functionSelector,
+      utilityExecutor,
+      blockHeader,
+      jobId,
+      scopes,
+    );
 
-    const teardownGasLimits = new Gas(DEFAULT_TEARDOWN_DA_GAS_LIMIT, DEFAULT_TEARDOWN_L2_GAS_LIMIT);
+    const blockNumber = await this.getNextBlockNumber();
 
-    const gasSettings = new GasSettings(gasLimits, teardownGasLimits, GasFees.empty(), GasFees.empty());
+    const msgSender = from ?? AztecAddress.NULL_MSG_SENDER;
+    const callContext = new CallContext(msgSender, targetContractAddress, functionSelector, isStaticCall);
 
     const txContext = new TxContext(this.chainId, this.version, gasSettings);
 
-    const blockHeader = await this.pxeOracleInterface.getAnchorBlockHeader();
-
-    const txRequestHash = getSingleTxBlockRequestHash(blockNumber);
-    const noteCache = new ExecutionNoteCache(txRequestHash);
+    const protocolNullifier = await computeProtocolNullifier(getSingleTxBlockRequestHash(blockNumber));
+    const noteCache = new ExecutionNoteCache(protocolNullifier);
+    // In production, the account contract sets the min revertible counter before calling the app function.
+    // Since TXE bypasses the account contract, we simulate this by setting minRevertibleSideEffectCounter to 1,
+    // marking all side effects as revertible.
+    const minRevertibleSideEffectCounter = 1;
+    await noteCache.setMinRevertibleSideEffectCounter(minRevertibleSideEffectCounter);
     const taggingIndexCache = new ExecutionTaggingIndexCache();
 
     const simulator = new WASMSimulator();
 
-    const privateExecutionOracle = new PrivateExecutionOracle(
+    const transientArrayService = new TransientArrayService();
+    const taggingSecretStrategy = this.taggingSecretStrategy;
+    const privateExecutionOracle = new PrivateExecutionOracle({
       argsHash,
       txContext,
+      txRequestSalt: Fr.ZERO,
       callContext,
-      /** Header of a block whose state is used during private execution (not the block the transaction is included in). */
-      blockHeader,
-      /** List of transient auth witnesses to be used during this simulation */
-      Array.from(this.authwits.values()),
-      /** List of transient auth witnesses to be used during this simulation */
-      [],
-      HashedValuesCache.create([new HashedValues(args, argsHash)]),
+      anchorBlockHeader: blockHeader,
+      utilityExecutor,
+      authWitnesses: Array.from(this.authwits.values()),
+      capsules: [],
+      executionCache: HashedValuesCache.create([new HashedValues(args, argsHash)]),
       noteCache,
       taggingIndexCache,
-      this.pxeOracleInterface,
-      0,
-      1,
-      undefined, // log
-      undefined, // scopes
-      /**
-       * In TXE, the typical transaction entrypoint is skipped, so we need to simulate the actions that such a
-       * contract would perform, including setting senderForTags.
-       */
-      from,
+      anchoredContractData,
+      noteStore: this.noteStore,
+      keyStore: this.keyStore,
+      addressStore: this.addressStore,
+      aztecNode: this.stateMachine.node,
+      senderTaggingStore: this.senderTaggingStore,
+      recipientTaggingStore: this.recipientTaggingStore,
+      taggingSecretSourcesStore: this.taggingSecretSourcesStore,
+      capsuleService: new CapsuleService(this.capsuleStore, scopes),
+      factService: new FactService(this.factStore, scopes),
+      privateEventStore: this.privateEventStore,
+      contractSyncService: this.stateMachine.contractSyncService,
+      jobId,
+      totalPublicCalldataCount: 0,
+      sideEffectCounter: minRevertibleSideEffectCounter,
+      scopes,
+      // In TXE, the typical transaction entrypoint is skipped, so we need to simulate the actions that such a
+      // contract would perform, including setting senderForTags.
+      senderForTags: from,
       simulator,
-    );
+      txResolver: this.stateMachine.txResolver,
+      l2TipsStore: this.stateMachine.l2TipsProvider,
+      hooks: composeHooks({
+        authorizeUtilityCall: this.buildAuthorizeUtilityCallHook(
+          isStaticCall ? 'private view' : 'private',
+          authorizedUtilityCallTargets,
+        ),
+        // Only configure the hook when a strategy was explicitly set, so that otherwise the default tagging secret
+        // strategy is exercised.
+        resolveTaggingSecretStrategy: taggingSecretStrategy ? () => Promise.resolve(taggingSecretStrategy) : undefined,
+      }),
+      transientArrayService,
+    });
 
     // Note: This is a slight modification of simulator.run without any of the checks. Maybe we should modify simulator.run with a boolean value to skip checks.
     let result: PrivateExecutionResult;
@@ -343,24 +538,26 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
       );
       const publicFunctionsCalldata = await Promise.all(
         publicCallRequests.map(async r => {
-          const calldata = await privateExecutionOracle.privateLoadFromExecutionCache(r.calldataHash);
+          const calldata = await privateExecutionOracle.getHashPreimage(r.calldataHash);
           return new HashedValues(calldata, r.calldataHash);
         }),
       );
 
-      // TXE's top level context does not track side effect counters, and as such, minRevertibleSideEffectCounter is always 0.
-      // This has the unfortunate consequence of always producing revertible nullifiers, which means we
-      // must set the firstNullifierHint to Fr.ZERO so the txRequestHash is always used as nonce generator
-      result = new PrivateExecutionResult(executionResult, Fr.ZERO, publicFunctionsCalldata);
+      const nonceGenerator = noteCache.getNonceGenerator();
+      result = new PrivateExecutionResult(executionResult, nonceGenerator, publicFunctionsCalldata);
     } catch (err) {
       throw createSimulationError(err instanceof Error ? err : new Error('Unknown error during private execution'));
     }
 
-    // According to the protocol rules, the nonce generator for the note hashes
-    // can either be the first nullifier in the tx or the hash of the initial tx request
-    // if there are none.
-    const nonceGenerator = result.firstNullifier.equals(Fr.ZERO) ? txRequestHash : result.firstNullifier;
-    const { publicInputs } = await generateSimulatedProvingResult(result, nonceGenerator, this.contractDataProvider);
+    // According to the protocol rules, there must be at least one nullifier in the tx. The first nullifier is used as
+    // the nonce generator for the note hashes.
+    // We pass the non-zero minRevertibleSideEffectCounter to make sure the side effects are split correctly.
+    const { publicInputs } = await generateSimulatedProvingResult(
+      result,
+      (addr, sel) => anchoredContractData.getDebugFunctionName(addr, sel),
+      this.stateMachine.node,
+      minRevertibleSideEffectCounter,
+    );
 
     const globals = makeGlobalVariables();
     globals.blockNumber = blockNumber;
@@ -369,19 +566,38 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     globals.version = this.version;
     globals.gasFees = GasFees.empty();
 
-    const forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
+    await using forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
 
-    const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractDataProvider));
+    const bindings = this.logger.getBindings();
+    const contractsDB = new PublicContractsDB(
+      new TXEPublicContractDataSource(blockNumber, this.contractStore),
+      bindings,
+    );
     const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
+    const config = PublicSimulatorConfig.from({
+      skipFeeEnforcement: true,
+      collectDebugLogs: true,
+      collectHints: false,
+      collectStatistics: false,
+      collectCallMetadata: true,
+    });
+    // The AVM simulator reads this fork's contracts DB, scoped by fork id, for each simulation.
+    const forkId = forkedWorldTrees.getRevision().forkId;
     const processor = new PublicProcessor(
       globals,
       guardedMerkleTrees,
       contractsDB,
-      new PublicTxSimulator(guardedMerkleTrees, contractsDB, globals, {
-        doMerkleOperations: true,
-        skipFeeEnforcement: true,
-      }),
+      new PublicTxSimulator(
+        this.stateMachine.synchronizer.avmSimulator,
+        globals,
+        contractsDB,
+        forkId,
+        config,
+        bindings,
+      ),
       new TestDateProvider(),
+      undefined,
+      createLogger('simulator:public-processor', bindings),
     );
 
     const tx = await Tx.create({
@@ -406,7 +622,13 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     } else if (!processedTx.revertCode.isOK()) {
       if (processedTx.revertReason) {
         try {
-          await enrichPublicSimulationError(processedTx.revertReason, this.contractDataProvider, this.logger);
+          await enrichPublicSimulationError(
+            processedTx.revertReason,
+            this.contractStore,
+            this.stateMachine.contractClassService,
+            await this.stateMachine.anchorBlockStore.getBlockHeader(),
+            this.logger,
+          );
           // eslint-disable-next-line no-empty
         } catch {}
         throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
@@ -415,11 +637,15 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
       }
     }
 
+    // Walk the nested private-call tree and collect every offchain effect the transaction emitted.
+    // PXE stores these on each `PrivateCallExecutionResult` and they never reach TXE via the
+    // `aztec_utl_emitOffchainEffect` foreign-call path (that path only fires at the top-level), so
+    // we pull them out here and the RPC wrapper will hand them to `TXESession` for buffering.
+    const offchainEffects = collectNested([executionResult], r => r.offchainEffects.map(e => e.data));
+
     if (isStaticCall) {
       await checkpoint!.revert();
-
-      await forkedWorldTrees.close();
-      return executionResult.returnValues ?? [];
+      return { returnValues: executionResult.returnValues ?? [], offchainEffects };
     }
 
     const txEffect = TxEffect.empty();
@@ -435,43 +661,35 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
     await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
 
-    const body = new Body([txEffect]);
-
-    const l2Block = new L2Block(
-      makeAppendOnlyTreeSnapshot(),
-      await makeTXEBlockHeader(forkedWorldTrees, globals),
-      body,
-    );
+    const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [txEffect]);
 
     await this.stateMachine.handleL2Block(l2Block);
 
-    await forkedWorldTrees.close();
-
-    return executionResult.returnValues ?? [];
+    return { returnValues: executionResult.returnValues ?? [], offchainEffects };
   }
 
-  async txePublicCallNewFlow(
-    from: AztecAddress,
+  async publicCallNewFlow(
+    from: AztecAddress | undefined,
     targetContractAddress: AztecAddress,
     calldata: Fr[],
     isStaticCall: boolean,
+    gasSettings: GasSettings,
   ) {
-    this.logger.verbose(
-      `Executing public function ${await this.contractDataProvider.getDebugFunctionName(targetContractAddress, FunctionSelector.fromField(calldata[0]))}@${targetContractAddress} isStaticCall=${isStaticCall}`,
+    const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+    const anchoredContractData = new AnchoredContractData(
+      this.contractStore,
+      this.stateMachine.contractClassService,
+      anchorBlockHeader,
     );
 
-    const blockNumber = await this.txeGetNextBlockNumber();
-
-    const gasLimits = new Gas(DEFAULT_DA_GAS_LIMIT, DEFAULT_L2_GAS_LIMIT);
-
-    const teardownGasLimits = new Gas(DEFAULT_TEARDOWN_DA_GAS_LIMIT, DEFAULT_TEARDOWN_L2_GAS_LIMIT);
+    this.logger.verbose(
+      `Executing public function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, FunctionSelector.fromField(calldata[0]))}@${targetContractAddress} isStaticCall=${isStaticCall}`,
+    );
 
-    const gasSettings = new GasSettings(gasLimits, teardownGasLimits, GasFees.empty(), GasFees.empty());
+    const blockNumber = await this.getNextBlockNumber();
 
     const txContext = new TxContext(this.chainId, this.version, gasSettings);
 
-    const anchorBlockHeader = await this.pxeOracleInterface.getAnchorBlockHeader();
-
     const calldataHash = await computeCalldataHash(calldata);
     const calldataHashedValues = new HashedValues(calldata, calldataHash);
 
@@ -482,30 +700,53 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     globals.version = this.version;
     globals.gasFees = GasFees.empty();
 
-    const forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
+    await using forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
 
-    const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractDataProvider));
+    const bindings2 = this.logger.getBindings();
+    const contractsDB = new PublicContractsDB(
+      new TXEPublicContractDataSource(blockNumber, this.contractStore),
+      bindings2,
+    );
     const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
-    const simulator = new PublicTxSimulator(guardedMerkleTrees, contractsDB, globals, {
-      doMerkleOperations: true,
+    const config = PublicSimulatorConfig.from({
       skipFeeEnforcement: true,
+      collectDebugLogs: true,
+      collectHints: false,
+      collectStatistics: false,
+      collectCallMetadata: true,
     });
-    const processor = new PublicProcessor(globals, guardedMerkleTrees, contractsDB, simulator, new TestDateProvider());
+    // The AVM simulator reads this fork's contracts DB, scoped by fork id, for each simulation.
+    const forkId2 = forkedWorldTrees.getRevision().forkId;
+    const simulator = new PublicTxSimulator(
+      this.stateMachine.synchronizer.avmSimulator,
+      globals,
+      contractsDB,
+      forkId2,
+      config,
+      bindings2,
+    );
+    const processor = new PublicProcessor(
+      globals,
+      guardedMerkleTrees,
+      contractsDB,
+      simulator,
+      new TestDateProvider(),
+      undefined,
+      createLogger('simulator:public-processor', bindings2),
+    );
 
     // We're simulating a scenario in which private execution immediately enqueues a public call and halts. The private
     // kernel init would in this case inject a nullifier with the transaction request hash as a non-revertible
     // side-effect, which the AVM then expects to exist in order to use it as the nonce generator when siloing notes as
     // unique.
     const nonRevertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
-    if (!isStaticCall) {
-      nonRevertibleAccumulatedData.nullifiers[0] = getSingleTxBlockRequestHash(blockNumber);
-    }
+    nonRevertibleAccumulatedData.nullifiers[0] = getSingleTxBlockRequestHash(blockNumber);
 
     // The enqueued public call itself we make be revertible so that the public execution is itself revertible, as tests
     // may require producing reverts.
     const revertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
     revertibleAccumulatedData.publicCallRequests[0] = new PublicCallRequest(
-      from,
+      from ?? AztecAddress.NULL_MSG_SENDER,
       targetContractAddress,
       isStaticCall,
       calldataHash,
@@ -523,7 +764,7 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
       constantData,
       /*gasUsed=*/ new Gas(0, 0),
       /*feePayer=*/ AztecAddress.zero(),
-      /*includeByTimestamp=*/ 0n,
+      /*expirationTimestamp=*/ 0n,
       inputsForPublic,
       undefined,
     );
@@ -550,7 +791,13 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     } else if (!processedTx.revertCode.isOK()) {
       if (processedTx.revertReason) {
         try {
-          await enrichPublicSimulationError(processedTx.revertReason, this.contractDataProvider, this.logger);
+          await enrichPublicSimulationError(
+            processedTx.revertReason,
+            this.contractStore,
+            this.stateMachine.contractClassService,
+            anchorBlockHeader,
+            this.logger,
+          );
           // eslint-disable-next-line no-empty
         } catch {}
         throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
@@ -563,9 +810,6 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
 
     if (isStaticCall) {
       await checkpoint!.revert();
-
-      await forkedWorldTrees.close();
-
       return returnValues ?? [];
     }
 
@@ -582,38 +826,84 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
     await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
 
-    const body = new Body([txEffect]);
-
-    const l2Block = new L2Block(
-      makeAppendOnlyTreeSnapshot(),
-      await makeTXEBlockHeader(forkedWorldTrees, globals),
-      body,
-    );
+    const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [txEffect]);
 
     await this.stateMachine.handleL2Block(l2Block);
 
-    await forkedWorldTrees.close();
-
     return returnValues ?? [];
   }
 
-  async txeSimulateUtilityFunction(
+  async executeUtilityFunction(
+    from: AztecAddress | undefined,
     targetContractAddress: AztecAddress,
     functionSelector: FunctionSelector,
     args: Fr[],
+    jobId: string,
+    authorizedUtilityCallTargets: AztecAddress[],
   ) {
-    const artifact = await this.contractDataProvider.getFunctionArtifact(targetContractAddress, functionSelector);
+    const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+    const anchoredContractData = new AnchoredContractData(
+      this.contractStore,
+      this.stateMachine.contractClassService,
+      blockHeader,
+    );
+
+    const artifact = await anchoredContractData.getFunctionArtifact(targetContractAddress, functionSelector);
     if (!artifact) {
       throw new Error(`Cannot call ${functionSelector} as there is no artifact found at ${targetContractAddress}.`);
     }
 
-    const call = {
+    // Sync notes before executing utility function to discover notes from previous transactions
+    await this.stateMachine.contractSyncService.ensureContractSynced(
+      targetContractAddress,
+      functionSelector,
+      async (call, execScopes) => {
+        await this.executeUtilityCall(call, { scopes: execScopes, jobId });
+      },
+      blockHeader,
+      jobId,
+      await this.keyStore.getAccounts(),
+    );
+
+    const call = FunctionCall.from({
       name: artifact.name,
-      selector: functionSelector,
       to: targetContractAddress,
-    };
+      selector: functionSelector,
+      type: FunctionType.UTILITY,
+      hideMsgSender: false,
+      isStatic: false,
+      args,
+      returnTypes: [],
+    });
+
+    return this.executeUtilityCall(call, {
+      from,
+      scopes: await this.keyStore.getAccounts(),
+      jobId,
+      authorizedUtilityCallTargets,
+    });
+  }
+
+  private async executeUtilityCall(
+    call: FunctionCall,
+    {
+      from = AztecAddress.NULL_MSG_SENDER,
+      scopes,
+      jobId,
+      authorizedUtilityCallTargets = [],
+    }: { from?: AztecAddress; scopes: AztecAddress[]; jobId: string; authorizedUtilityCallTargets?: AztecAddress[] },
+  ): Promise<Fr[]> {
+    const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+    const anchoredContractData = new AnchoredContractData(
+      this.contractStore,
+      this.stateMachine.contractClassService,
+      anchorBlockHeader,
+    );
 
-    const entryPointArtifact = await this.pxeOracleInterface.getFunctionArtifact(call.to, call.selector);
+    const entryPointArtifact = await anchoredContractData.getFunctionArtifactWithDebugMetadata(call.to, call.selector);
+    if (!entryPointArtifact) {
+      throw new Error(`Cannot run function ${call.selector} on ${call.to}: the contract is not registered.`);
+    }
     if (entryPointArtifact.functionType !== FunctionType.UTILITY) {
       throw new Error(`Cannot run ${entryPointArtifact.functionType} function as utility`);
     }
@@ -624,9 +914,45 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     });
 
     try {
-      const oracle = new UtilityExecutionOracle(call.to, [], [], this.pxeOracleInterface);
-      const acirExecutionResult = await new WASMSimulator()
-        .executeUserCircuit(toACVMWitness(0, args), entryPointArtifact, new Oracle(oracle).toACIRCallback())
+      const simulator = new WASMSimulator();
+      const utilityExecutor = async (syncCall: FunctionCall, execScopes: AztecAddress[]) => {
+        await this.executeUtilityCall(syncCall, { scopes: execScopes, jobId });
+      };
+      const oracle = new UtilityExecutionOracle({
+        callContext: CallContext.from({
+          msgSender: from,
+          contractAddress: call.to,
+          functionSelector: call.selector,
+          isStaticCall: true,
+        }),
+        authWitnesses: [],
+        capsules: [],
+        anchorBlockHeader,
+        anchoredContractData,
+        noteStore: this.noteStore,
+        keyStore: this.keyStore,
+        addressStore: this.addressStore,
+        aztecNode: this.stateMachine.node,
+        recipientTaggingStore: this.recipientTaggingStore,
+        taggingSecretSourcesStore: this.taggingSecretSourcesStore,
+        capsuleService: new CapsuleService(this.capsuleStore, scopes),
+        factService: new FactService(this.factStore, scopes),
+        privateEventStore: this.privateEventStore,
+        txResolver: this.stateMachine.txResolver,
+        contractSyncService: this.stateMachine.contractSyncService,
+        l2TipsStore: this.stateMachine.l2TipsProvider,
+        jobId,
+        scopes,
+        simulator,
+        hooks: composeHooks({
+          authorizeUtilityCall: this.buildAuthorizeUtilityCallHook('utility', authorizedUtilityCallTargets),
+        }),
+        utilityExecutor,
+        // Execution-tree root (top-level utility run or contract sync): own store; nested frames inherit it.
+        transientArrayService: new TransientArrayService(),
+      });
+      const acirExecutionResult = await simulator
+        .executeUserCircuit(toACVMWitness(0, call.args), entryPointArtifact, buildACIRCallback(oracle))
         .catch((err: Error) => {
           err.message = resolveAssertionMessageFromError(err, entryPointArtifact);
           throw new ExecutionError(
@@ -640,19 +966,33 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
           );
         });
 
-      this.logger.verbose(`Utility simulation for ${call.to}.${call.selector} completed`);
+      this.logger.verbose(`Utility execution for ${call.to}.${call.selector} completed`);
       return witnessMapToFields(acirExecutionResult.returnWitness);
     } catch (err) {
-      throw createSimulationError(err instanceof Error ? err : new Error('Unknown error during utility simulation'));
+      throw createSimulationError(err instanceof Error ? err : new Error('Unknown error during utility execution'));
     }
   }
 
-  close(): [bigint, Map<string, AuthWitness>] {
+  close(): [bigint, Map<string, AuthWitness>, TaggingSecretStrategy | undefined] {
     this.logger.debug('Exiting Top Level Context');
-    return [this.nextBlockTimestamp, this.authwits];
+    return [this.nextBlockTimestamp, this.authwits, this.taggingSecretStrategy];
   }
 
-  private async getLastBlockNumber(): Promise<number> {
-    return (await this.stateMachine.node.getBlockHeader('latest'))?.globalVariables.blockNumber ?? 0;
+  private async getLastBlockNumber(): Promise<BlockNumber> {
+    const block = await this.stateMachine.node.getBlock('latest');
+    return block ? block.header.globalVariables.blockNumber : BlockNumber.ZERO;
+  }
+
+  private buildAuthorizeUtilityCallHook(
+    callerContext: 'private' | 'private view' | 'utility',
+    authorizedTargets: AztecAddress[],
+  ): ExecutionHooks['authorizeUtilityCall'] | undefined {
+    if (authorizedTargets.length === 0) {
+      return undefined;
+    }
+    return req =>
+      Promise.resolve({
+        authorized: req.callerContext === callerContext && authorizedTargets.some(t => t.equals(req.target)),
+      });
   }
 }