@aztec/txe 5.0.0-rc.2 → 5.0.1

package/src/oracle/test-resolver/resolver.ts

@@ -53,7 +53,7 @@ export class OracleTestResolver {
 
   /**
    * Builds a resolver whose fixtures are the default scenarios synthesized from the registry's type mappings. The
-   * matching Noir serialization tests are auto-generated by `#[auto_serialization_test]` from the same convention.
+   * matching Noir serialization tests are auto-generated by `#[generate_oracle_tests]` from the same convention.
    */
   static fromRegistry(registry: Record<string, OracleRegistryEntry>, logger?: Logger): OracleTestResolver {
     return new OracleTestResolver(registry, synthesizeDefaultFixtures(registry), logger);
@@ -179,6 +179,11 @@ function decodeScenarioName(inputs: ForeignCallArgs): string {
 }
 
 function valuesEqual(actual: unknown, expected: unknown): boolean {
+  if (!isNonNullObject(actual) || !isNonNullObject(expected)) {
+    // Primitive scalars; String() bridges bigint vs number representations of the same seed. A primitive compared
+    // against an object is never equal.
+    return isNonNullObject(actual) === isNonNullObject(expected) && String(actual) === String(expected);
+  }
   if (actual instanceof Option && expected instanceof Option) {
     return actual.equals(expected, valuesEqual);
   }
@@ -188,7 +193,49 @@ function valuesEqual(actual: unknown, expected: unknown): boolean {
   if (Array.isArray(actual) && Array.isArray(expected)) {
     return actual.length === expected.length && actual.every((v, i) => valuesEqual(v, expected[i]));
   }
-  return String(actual) === String(expected);
+  if (isPlainObject(actual) && isPlainObject(expected)) {
+    const expectedKeys = Object.keys(expected);
+    return (
+      Object.keys(actual).length === expectedKeys.length &&
+      expectedKeys.every(key => valuesEqual(actual[key], expected[key]))
+    );
+  }
+  if (actual.constructor !== expected.constructor) {
+    return false;
+  }
+  if (hasEquals(actual)) {
+    return actual.equals(expected);
+  }
+  const actualStr = customStringForm(actual);
+  const expectedStr = customStringForm(expected);
+  if (actualStr !== undefined && expectedStr !== undefined) {
+    return actualStr === expectedStr;
+  }
+  // Comparing blindly here could pass vacuously (e.g. two '[object Object]' strings), so refuse instead.
+  throw new Error(
+    `valuesEqual cannot compare a '${actual.constructor?.name}' against a '${expected.constructor?.name}'. Add a branch for the type.`,
+  );
+}
+
+function isNonNullObject(value: unknown): value is object {
+  return typeof value === 'object' && value !== null;
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return isNonNullObject(value) && value.constructor === Object;
+}
+
+function hasEquals(value: object): value is { equals(other: unknown): boolean } {
+  return typeof (value as { equals?: unknown }).equals === 'function';
+}
+
+/** The value's string form when its class overrides `toString` (a meaningful representation), undefined otherwise. */
+function customStringForm(value: object): string | undefined {
+  const { toString } = value;
+  if (typeof toString !== 'function' || toString === Object.prototype.toString) {
+    return undefined;
+  }
+  return toString.call(value);
 }
 
 function versionBumpHint(oracle: string): string {

package/src/oracle/txe_oracle_public_context.ts

@@ -5,7 +5,7 @@ import type { ContractStore } from '@aztec/pxe/server';
 import { PublicDataWrite } from '@aztec/stdlib/avm';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import type { L2Block } from '@aztec/stdlib/block';
-import type { ContractInstanceWithAddress } from '@aztec/stdlib/contract';
+import type { ContractInstancePreimageWithAddress } from '@aztec/stdlib/contract';
 import { computePublicDataTreeLeafSlot, siloNoteHash, siloNullifier } from '@aztec/stdlib/hash';
 import {
   MerkleTreeId,
@@ -125,34 +125,36 @@ export class TXEOraclePublicContext implements IAvmExecutionOracle {
     return value;
   }
 
-  getContractInstanceDeployer(address: AztecAddress): Promise<{ member: Fr; exists: boolean }> {
+  getContractInstanceDeployer(address: AztecAddress): Promise<{ member: Fr; exists: boolean }[]> {
     return this.getContractInstanceMember(address, i => i.deployer.toField());
   }
 
-  getContractInstanceClassId(address: AztecAddress): Promise<{ member: Fr; exists: boolean }> {
-    return this.getContractInstanceMember(address, i => i.currentContractClassId);
+  getContractInstanceClassId(address: AztecAddress): Promise<{ member: Fr; exists: boolean }[]> {
+    // TXE has no contract updates, so the current class always equals the original.
+    return this.getContractInstanceMember(address, i => i.originalContractClassId);
   }
 
-  getContractInstanceInitializationHash(address: AztecAddress): Promise<{ member: Fr; exists: boolean }> {
+  getContractInstanceInitializationHash(address: AztecAddress): Promise<{ member: Fr; exists: boolean }[]> {
     return this.getContractInstanceMember(address, i => i.initializationHash);
   }
 
-  getContractInstanceImmutablesHash(address: AztecAddress): Promise<{ member: Fr; exists: boolean }> {
+  getContractInstanceImmutablesHash(address: AztecAddress): Promise<{ member: Fr; exists: boolean }[]> {
     return this.getContractInstanceMember(address, i => i.immutablesHash);
   }
 
+  // The one-element array mirrors the oracles' Noir return type, `[GetContractInstanceResult; 1]`.
   private async getContractInstanceMember(
     address: AztecAddress,
-    accessor: (instance: ContractInstanceWithAddress) => Fr,
-  ): Promise<{ member: Fr; exists: boolean }> {
+    accessor: (instance: ContractInstancePreimageWithAddress) => Fr,
+  ): Promise<{ member: Fr; exists: boolean }[]> {
     const instance = await this.contractStore.getContractInstance(address);
     if (!instance) {
-      return { member: Fr.ZERO, exists: false };
+      return [{ member: Fr.ZERO, exists: false }];
     }
-    return { member: accessor(instance), exists: true };
+    return [{ member: accessor(instance), exists: true }];
   }
 
-  returndataSize(): Promise<Fr> {
+  returndataSize(): Promise<number> {
     throw new Error(
       'Contract calls are forbidden inside a `TestEnvironment::public_context`, use `public_call` instead',
     );

package/src/oracle/txe_oracle_registry.ts

@@ -19,17 +19,21 @@ import {
   BOOL,
   ETH_ADDRESS,
   FIELD,
+  FIXED_ARRAY,
   FUNCTION_SELECTOR,
   type InputSlot,
   type MaybePromise,
   OPTION,
   ORACLE_REGISTRY,
   type OracleRegistryEntry,
+  type OutputSlot,
   type ParamTypes,
   STR,
+  STRUCT,
   type SlotShape,
   type TypeMapping,
   U32,
+  buildACIRCallback,
   makeEntry,
 } from '@aztec/pxe/simulator';
 import { EventSelector } from '@aztec/stdlib/abi';
@@ -63,11 +67,12 @@ const GAS_SETTINGS: TypeMapping<GasSettings> = {
 };
 
 // Tagging secret strategy discriminants. Must match the Noir test helper `TaggingSecretStrategy` in
-// aztec-nr `test/helpers/tagging_secret_strategy.nr`. This is a test-only oracle (only `set_tagging_secret_strategy`
+// aztec-nr `test/helpers/tagging_secret_strategy.nr`. This is a test-only oracle (only `set_tagging_secret_strategies`
 // reads it), so the mapping lives here on the TXE side rather than in the production oracle type mappings.
 const STRATEGY_NON_INTERACTIVE_HANDSHAKE = 1;
 const STRATEGY_ARBITRARY_SECRET = 2;
 const STRATEGY_ADDRESS_DERIVED = 3;
+const STRATEGY_INTERACTIVE_HANDSHAKE = 4;
 
 const TAGGING_SECRET_STRATEGY: TypeMapping<TaggingSecretStrategy> = {
   serialization: {
@@ -75,6 +80,8 @@ const TAGGING_SECRET_STRATEGY: TypeMapping<TaggingSecretStrategy> = {
       switch (strategy.type) {
         case 'non-interactive-handshake':
           return [new Fr(STRATEGY_NON_INTERACTIVE_HANDSHAKE), Fr.ZERO, Fr.ZERO];
+        case 'interactive-handshake':
+          return [new Fr(STRATEGY_INTERACTIVE_HANDSHAKE), Fr.ZERO, Fr.ZERO];
         case 'address-derived':
           return [new Fr(STRATEGY_ADDRESS_DERIVED), Fr.ZERO, Fr.ZERO];
         case 'arbitrary-secret':
@@ -89,6 +96,8 @@ const TAGGING_SECRET_STRATEGY: TypeMapping<TaggingSecretStrategy> = {
       switch (kind) {
         case STRATEGY_NON_INTERACTIVE_HANDSHAKE:
           return { type: 'non-interactive-handshake' };
+        case STRATEGY_INTERACTIVE_HANDSHAKE:
+          return { type: 'interactive-handshake' };
         case STRATEGY_ADDRESS_DERIVED:
           return { type: 'address-derived' };
         case STRATEGY_ARBITRARY_SECRET:
@@ -191,10 +200,13 @@ const TXE_CALL_CONTEXT: TypeMapping<{ txHash: Fr; anchorBlockTimestamp: bigint }
   shape: ['scalar', 'scalar', 'scalar'], // discriminant, txHash, anchor block timestamp
 };
 
-const CONTRACT_INSTANCE_MEMBER: TypeMapping<{ member: Fr; exists: boolean }> = {
-  serialization: { fn: ({ member, exists }) => [member, new Fr(exists)] },
-  shape: ['scalar', 'scalar'],
-};
+const CONTRACT_INSTANCE_MEMBER: TypeMapping<{ exists: boolean; member: Fr }[]> = FIXED_ARRAY(
+  STRUCT([
+    { name: 'exists', type: BOOL },
+    { name: 'member', type: FIELD },
+  ]),
+  1,
+);
 
 const EVENT_SELECTOR: TypeMapping<EventSelector> = {
   serialization: { fn: v => [v.toField()] },
@@ -308,8 +320,15 @@ export const TXE_ORACLE_REGISTRY = {
     returnType: FIELD,
   }),
 
-  aztec_txe_setTaggingSecretStrategy: makeEntry({
-    params: [{ name: 'strategy', type: OPTION(TAGGING_SECRET_STRATEGY) }],
+  aztec_txe_setTaggingSecretStrategies: makeEntry({
+    params: [
+      { name: 'unconstrainedStrategy', type: OPTION(TAGGING_SECRET_STRATEGY) },
+      { name: 'constrainedStrategy', type: OPTION(TAGGING_SECRET_STRATEGY) },
+    ],
+  }),
+
+  aztec_txe_setAuthorizeAllUtilityCallTargets: makeEntry({
+    params: [{ name: 'authorizeAll', type: BOOL }],
   }),
 
   aztec_txe_getLastBlockTimestamp: makeEntry({
@@ -412,7 +431,7 @@ export const TXE_ORACLE_REGISTRY = {
     params: [{ name: 'message', type: ARRAY(FIELD) }],
   }),
 
-  aztec_avm_returndataSize: makeEntry({ returnType: FIELD }),
+  aztec_avm_returndataSize: makeEntry({ returnType: U32 }),
 
   aztec_avm_returndataCopy: makeEntry({
     params: [
@@ -487,7 +506,37 @@ export async function callTxeHandler<K extends keyof typeof TXE_ORACLE_REGISTRY>
   const named = entry.deserializeParams(toInputSlots(inputs));
   const positional = named.map((p: { value: unknown }) => p.value);
   const result = await handler(positional as any);
-  const outputSlots = entry.serializeReturn(result);
+  return outputSlotsToForeignCallResult(entry.serializeReturn(result));
+}
+
+/**
+ * Dispatches an oracle that has been retired into the PXE legacy registry. TXE has no explicit handler method for such
+ * names; this runs them through the same `buildACIRCallback` legacy path that contract execution already uses, so
+ * TXE's top-level oracle path and its in-contract path treat the legacy registry identically.
+ */
+const legacyCallbacksByHandler = new WeakMap<object, ReturnType<typeof buildACIRCallback>>();
+
+export async function callTxeLegacyHandler(
+  oracle: string,
+  inputs: ForeignCallArgs,
+  oracleHandler: Parameters<typeof buildACIRCallback>[0],
+): Promise<ForeignCallResult> {
+  // `buildACIRCallback` materializes the whole real+legacy closure set, so memoize it per handler rather than
+  // rebuilding on every call (TXE routes one legacy oracle through here on each top-level discovery).
+  let callback = legacyCallbacksByHandler.get(oracleHandler);
+  if (!callback) {
+    callback = buildACIRCallback(oracleHandler);
+    legacyCallbacksByHandler.set(oracleHandler, callback);
+  }
+  const outputSlots = await callback[oracle](...toInputSlots(inputs));
+  return outputSlotsToForeignCallResult(outputSlots);
+}
+
+/**
+ * Strips the `0x` prefix from each serialized output slot (TXE foreign calls use bare hex strings) and wraps them in a
+ * `ForeignCallResult`.
+ */
+function outputSlotsToForeignCallResult(outputSlots: OutputSlot[]): ForeignCallResult {
   return {
     values: outputSlots.map(slot => (Array.isArray(slot) ? slot.map(withoutHexPrefix) : withoutHexPrefix(slot))),
   };

package/src/oracle/txe_oracle_top_level_context.ts

@@ -12,6 +12,7 @@ import { TestDateProvider } from '@aztec/foundation/timer';
 import type { KeyStore } from '@aztec/key-store';
 import {
   AddressStore,
+  AnchoredContractData,
   CapsuleService,
   CapsuleStore,
   type ContractStore,
@@ -70,7 +71,9 @@ import {
   PrivateToPublicAccumulatedData,
   PublicCallRequest,
 } from '@aztec/stdlib/kernel';
-import { hashPublicKey } from '@aztec/stdlib/keys';
+import { deriveKeys, hashPublicKey } from '@aztec/stdlib/keys';
+import type { PrivateLog } from '@aztec/stdlib/logs';
+import { AppTaggingSecretKind } from '@aztec/stdlib/logs';
 import { L1Actor, L1ToL2Message, L2Actor } from '@aztec/stdlib/messaging';
 import { ChonkProof } from '@aztec/stdlib/proofs';
 import { makeGlobalVariables } from '@aztec/stdlib/testing';
@@ -97,6 +100,7 @@ import type { TXEAccountStore } from '../utils/txe_account_store.js';
 import type { TXEArtifactResolver } from '../utils/txe_artifact_resolver.js';
 import { TXEPublicContractDataSource } from '../utils/txe_public_contract_data_source.js';
 import type { ITxeExecutionOracle } from './interfaces.js';
+import { type TXETaggingSecretStrategies, makeResolveTaggingSecretStrategyHook } from './tagging_secret_strategy.js';
 
 export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracle {
   isMisc = true as const;
@@ -121,7 +125,8 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     private version: Fr,
     private chainId: Fr,
     private authwits: Map<string, AuthWitness>,
-    private taggingSecretStrategy: TaggingSecretStrategy | undefined,
+    private taggingSecretStrategies: TXETaggingSecretStrategies,
+    private authorizeAllUtilityCallTargets: boolean,
     private readonly artifactResolver: TXEArtifactResolver,
     private readonly rootPath: string,
     private readonly packageName: string,
@@ -183,7 +188,7 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     return (await this.stateMachine.node.getBlockData('latest'))!.header.globalVariables.timestamp;
   }
 
-  async getLastTxEffects() {
+  async getLastTxEffects(): Promise<{ txHash: TxHash; noteHashes: Fr[]; nullifiers: Fr[]; privateLogs: PrivateLog[] }> {
     const latestBlockNumber = await this.stateMachine.archiver.getBlockNumber();
     const block = await this.stateMachine.archiver.getBlock({ number: latestBlockNumber });
 
@@ -323,7 +328,7 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     await this.contractStore.addContractInstance(instance);
     await this.contractStore.addContractArtifact(artifact);
 
-    const completeAddress = await this.keyStore.addAccount(secret, partialAddress);
+    const completeAddress = await this.keyStore.addAccount(await deriveKeys(secret), partialAddress);
     await this.accountStore.setAccount(completeAddress.address, completeAddress);
     await this.addressStore.addCompleteAddress(completeAddress);
     this.logger.debug(`Created account ${completeAddress.address}`);
@@ -333,7 +338,7 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
 
   async createAccount(secret: Fr) {
     // This is a foot gun !
-    const completeAddress = await this.keyStore.addAccount(secret, secret);
+    const completeAddress = await this.keyStore.addAccount(await deriveKeys(secret), secret);
     await this.accountStore.setAccount(completeAddress.address, completeAddress);
     await this.addressStore.addCompleteAddress(completeAddress);
     this.logger.debug(`Created account ${completeAddress.address}`);
@@ -354,8 +359,23 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     this.authwits.set(authWitness.requestHash.toString(), authWitness);
   }
 
-  setTaggingSecretStrategy(strategy: Option<TaggingSecretStrategy>): void {
-    this.taggingSecretStrategy = strategy.value;
+  setTaggingSecretStrategies(
+    unconstrainedStrategy: Option<TaggingSecretStrategy>,
+    constrainedStrategy: Option<TaggingSecretStrategy>,
+  ): void {
+    const apply = (mode: AppTaggingSecretKind, strategy: Option<TaggingSecretStrategy>) => {
+      if (strategy.isSome()) {
+        this.taggingSecretStrategies.set(mode, strategy.value);
+      } else {
+        this.taggingSecretStrategies.delete(mode);
+      }
+    };
+    apply(AppTaggingSecretKind.UNCONSTRAINED, unconstrainedStrategy);
+    apply(AppTaggingSecretKind.CONSTRAINED, constrainedStrategy);
+  }
+
+  setAuthorizeAllUtilityCallTargets(authorizeAll: boolean): void {
+    this.authorizeAllUtilityCallTargets = authorizeAll;
   }
 
   async sendL1ToL2Message(content: Fr, secretHash: Fr, sender: EthAddress, recipient: AztecAddress): Promise<Fr> {
@@ -415,11 +435,18 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     authorizedUtilityCallTargets: AztecAddress[],
     gasSettings: GasSettings,
   ) {
+    const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+    const anchoredContractData = new AnchoredContractData(
+      this.contractStore,
+      this.stateMachine.contractClassService,
+      blockHeader,
+    );
+
     this.logger.verbose(
-      `Executing external function ${await this.contractStore.getDebugFunctionName(targetContractAddress, functionSelector)}@${targetContractAddress} isStaticCall=${isStaticCall}`,
+      `Executing external function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, functionSelector)}@${targetContractAddress} isStaticCall=${isStaticCall}`,
     );
 
-    const artifact = await this.contractStore.getFunctionArtifact(targetContractAddress, functionSelector);
+    const artifact = await anchoredContractData.getFunctionArtifact(targetContractAddress, functionSelector);
     if (!artifact) {
       const message = functionSelector.equals(await FunctionSelector.fromSignature('verify_private_authwit(Field)'))
         ? 'Found no account contract artifact for a private authwit check - use `create_contract_account` instead of `create_light_account` for authwit support.'
@@ -434,7 +461,6 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
       await this.executeUtilityCall(call, { scopes: execScopes, jobId });
     };
 
-    const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
     await this.stateMachine.contractSyncService.ensureContractSynced(
       targetContractAddress,
       functionSelector,
@@ -463,10 +489,11 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     const simulator = new WASMSimulator();
 
     const transientArrayService = new TransientArrayService();
-    const taggingSecretStrategy = this.taggingSecretStrategy;
     const privateExecutionOracle = new PrivateExecutionOracle({
       argsHash,
       txContext,
+      // The TXE does not run the init kernel's salt binding, so no tx-request salt is in scope.
+      txRequestSalt: Fr.ZERO,
       callContext,
       anchorBlockHeader: blockHeader,
       utilityExecutor,
@@ -475,7 +502,7 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
       executionCache: HashedValuesCache.create([new HashedValues(args, argsHash)]),
       noteCache,
       taggingIndexCache,
-      contractStore: this.contractStore,
+      anchoredContractData,
       noteStore: this.noteStore,
       keyStore: this.keyStore,
       addressStore: this.addressStore,
@@ -502,9 +529,7 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
           isStaticCall ? 'private view' : 'private',
           authorizedUtilityCallTargets,
         ),
-        // Only configure the hook when a strategy was explicitly set, so that otherwise the default tagging secret
-        // strategy is exercised.
-        resolveTaggingSecretStrategy: taggingSecretStrategy ? () => Promise.resolve(taggingSecretStrategy) : undefined,
+        resolveTaggingSecretStrategy: makeResolveTaggingSecretStrategyHook(this.taggingSecretStrategies),
       }),
       transientArrayService,
     });
@@ -534,7 +559,6 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
         }),
       );
 
-      noteCache.finish();
       const nonceGenerator = noteCache.getNonceGenerator();
       result = new PrivateExecutionResult(executionResult, nonceGenerator, publicFunctionsCalldata);
     } catch (err) {
@@ -546,7 +570,7 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     // We pass the non-zero minRevertibleSideEffectCounter to make sure the side effects are split correctly.
     const { publicInputs } = await generateSimulatedProvingResult(
       result,
-      (addr, sel) => this.contractStore.getDebugFunctionName(addr, sel),
+      (addr, sel) => anchoredContractData.getDebugFunctionName(addr, sel),
       this.stateMachine.node,
       minRevertibleSideEffectCounter,
     );
@@ -605,7 +629,13 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     } else if (!processedTx.revertCode.isOK()) {
       if (processedTx.revertReason) {
         try {
-          await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.logger);
+          await enrichPublicSimulationError(
+            processedTx.revertReason,
+            this.contractStore,
+            this.stateMachine.contractClassService,
+            await this.stateMachine.anchorBlockStore.getBlockHeader(),
+            this.logger,
+          );
           // eslint-disable-next-line no-empty
         } catch {}
         throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
@@ -656,16 +686,21 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     isStaticCall: boolean,
     gasSettings: GasSettings,
   ) {
+    const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+    const anchoredContractData = new AnchoredContractData(
+      this.contractStore,
+      this.stateMachine.contractClassService,
+      anchorBlockHeader,
+    );
+
     this.logger.verbose(
-      `Executing public function ${await this.contractStore.getDebugFunctionName(targetContractAddress, FunctionSelector.fromField(calldata[0]))}@${targetContractAddress} isStaticCall=${isStaticCall}`,
+      `Executing public function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, FunctionSelector.fromField(calldata[0]))}@${targetContractAddress} isStaticCall=${isStaticCall}`,
     );
 
     const blockNumber = await this.getNextBlockNumber();
 
     const txContext = new TxContext(this.chainId, this.version, gasSettings);
 
-    const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
-
     const calldataHash = await computeCalldataHash(calldata);
     const calldataHashedValues = new HashedValues(calldata, calldataHash);
 
@@ -758,7 +793,13 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     } else if (!processedTx.revertCode.isOK()) {
       if (processedTx.revertReason) {
         try {
-          await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.logger);
+          await enrichPublicSimulationError(
+            processedTx.revertReason,
+            this.contractStore,
+            this.stateMachine.contractClassService,
+            anchorBlockHeader,
+            this.logger,
+          );
           // eslint-disable-next-line no-empty
         } catch {}
         throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
@@ -807,13 +848,19 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     jobId: string,
     authorizedUtilityCallTargets: AztecAddress[],
   ) {
-    const artifact = await this.contractStore.getFunctionArtifact(targetContractAddress, functionSelector);
+    const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+    const anchoredContractData = new AnchoredContractData(
+      this.contractStore,
+      this.stateMachine.contractClassService,
+      blockHeader,
+    );
+
+    const artifact = await anchoredContractData.getFunctionArtifact(targetContractAddress, functionSelector);
     if (!artifact) {
       throw new Error(`Cannot call ${functionSelector} as there is no artifact found at ${targetContractAddress}.`);
     }
 
     // Sync notes before executing utility function to discover notes from previous transactions
-    const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
     await this.stateMachine.contractSyncService.ensureContractSynced(
       targetContractAddress,
       functionSelector,
@@ -853,7 +900,17 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
       authorizedUtilityCallTargets = [],
     }: { from?: AztecAddress; scopes: AztecAddress[]; jobId: string; authorizedUtilityCallTargets?: AztecAddress[] },
   ): Promise<Fr[]> {
-    const entryPointArtifact = await this.contractStore.getFunctionArtifactWithDebugMetadata(call.to, call.selector);
+    const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+    const anchoredContractData = new AnchoredContractData(
+      this.contractStore,
+      this.stateMachine.contractClassService,
+      anchorBlockHeader,
+    );
+
+    const entryPointArtifact = await anchoredContractData.getFunctionArtifactWithDebugMetadata(call.to, call.selector);
+    if (!entryPointArtifact) {
+      throw new Error(`Cannot run function ${call.selector} on ${call.to}: the contract is not registered.`);
+    }
     if (entryPointArtifact.functionType !== FunctionType.UTILITY) {
       throw new Error(`Cannot run ${entryPointArtifact.functionType} function as utility`);
     }
@@ -864,10 +921,9 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     });
 
     try {
-      const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
       const simulator = new WASMSimulator();
       const utilityExecutor = async (syncCall: FunctionCall, execScopes: AztecAddress[]) => {
-        await this.executeUtilityCall(syncCall, { scopes: execScopes, jobId });
+        await this.executeUtilityCall(syncCall, { scopes: execScopes, jobId, authorizedUtilityCallTargets });
       };
       const oracle = new UtilityExecutionOracle({
         callContext: CallContext.from({
@@ -879,7 +935,7 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
         authWitnesses: [],
         capsules: [],
         anchorBlockHeader,
-        contractStore: this.contractStore,
+        anchoredContractData,
         noteStore: this.noteStore,
         keyStore: this.keyStore,
         addressStore: this.addressStore,
@@ -895,10 +951,10 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
         jobId,
         scopes,
         simulator,
+        utilityExecutor,
         hooks: composeHooks({
           authorizeUtilityCall: this.buildAuthorizeUtilityCallHook('utility', authorizedUtilityCallTargets),
         }),
-        utilityExecutor,
         // Execution-tree root (top-level utility run or contract sync): own store; nested frames inherit it.
         transientArrayService: new TransientArrayService(),
       });
@@ -924,9 +980,19 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     }
   }
 
-  close(): [bigint, Map<string, AuthWitness>, TaggingSecretStrategy | undefined] {
+  close(): {
+    nextBlockTimestamp: bigint;
+    authwits: Map<string, AuthWitness>;
+    taggingSecretStrategies: TXETaggingSecretStrategies;
+    authorizeAllUtilityCallTargets: boolean;
+  } {
     this.logger.debug('Exiting Top Level Context');
-    return [this.nextBlockTimestamp, this.authwits, this.taggingSecretStrategy];
+    return {
+      nextBlockTimestamp: this.nextBlockTimestamp,
+      authwits: this.authwits,
+      taggingSecretStrategies: this.taggingSecretStrategies,
+      authorizeAllUtilityCallTargets: this.authorizeAllUtilityCallTargets,
+    };
   }
 
   private async getLastBlockNumber(): Promise<BlockNumber> {
@@ -938,6 +1004,9 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
     callerContext: 'private' | 'private view' | 'utility',
     authorizedTargets: AztecAddress[],
   ): ExecutionHooks['authorizeUtilityCall'] | undefined {
+    if (this.authorizeAllUtilityCallTargets) {
+      return authorizeAllUtilityCallsHook;
+    }
     if (authorizedTargets.length === 0) {
       return undefined;
     }
@@ -947,3 +1016,11 @@ export class TXEOracleTopLevelContext implements IMiscOracle, ITxeExecutionOracl
       });
   }
 }
+
+/**
+ * An `authorizeUtilityCall` hook that authorizes every cross-contract utility call.
+ *
+ * Backs the `aztec_txe_setAuthorizeAllUtilityCallTargets` oracle.
+ */
+export const authorizeAllUtilityCallsHook: NonNullable<ExecutionHooks['authorizeUtilityCall']> = () =>
+  Promise.resolve({ authorized: true });

package/src/oracle/txe_oracle_version.ts

@@ -5,8 +5,8 @@
  *
  * The Noir counterparts are in `noir-projects/aztec-nr/aztec/src/test/helpers/txe_oracles.nr`.
  */
-export const TXE_ORACLE_VERSION_MAJOR = 2;
-export const TXE_ORACLE_VERSION_MINOR = 2;
+export const TXE_ORACLE_VERSION_MAJOR = 3;
+export const TXE_ORACLE_VERSION_MINOR = 1;
 
 /**
  * This hash is computed from the TXE oracle interfaces (IAvmExecutionOracle and ITxeExecutionOracle) and is used to
@@ -14,4 +14,4 @@ export const TXE_ORACLE_VERSION_MINOR = 2;
  *   - TXE_ORACLE_VERSION_MAJOR (and reset MINOR to 0) for breaking changes, or
  *   - TXE_ORACLE_VERSION_MINOR for additive changes (new oracle method added).
  */
-export const TXE_ORACLE_INTERFACE_HASH = '118698345ea9d368ca82ea574a051e72f4df0b85454539ade14838a934976b62';
+export const TXE_ORACLE_INTERFACE_HASH = '89c60f191f8f60ef72d592e46dd6c4afff10dc47a9e14f4f8d37e31e40857d9c';