@aztec-labs/pxe 6.0.0-nightly.20260829

package/src/storage/tagging_store/sender_tagging_store.ts

@@ -0,0 +1,564 @@
+import { allToCompletion } from '@aztec-labs/foundation/promise';
+import type { AztecAsyncKVStore, AztecAsyncMap } from '@aztec-labs/kv-store';
+import { AppTaggingSecret, SiloedTag, type TaggingIndexRange } from '@aztec-labs/stdlib/logs';
+import { TxEffect, TxHash } from '@aztec-labs/stdlib/tx';
+
+import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN, unfinalizedTaggingIndexesWindowEnd } from '../../tagging/constants.js';
+import type { ChangeSetId, StagedStore } from '../staged_write_coordinator.js';
+
+/** A tx still awaiting finalization, and the highest tagging index it used for one secret. */
+export type PendingTx = { txHash: string; highestIndex: number };
+
+/** Internal representation of a pending index range entry. */
+type PendingIndexesEntry = PendingTx & { lowestIndex: number };
+
+/**
+ * Data provider of tagging data used when syncing the sender tagging indexes. The recipient counterpart of this class
+ * is called RecipientTaggingStore. We have the data stores separate for sender and recipient because
+ * the algorithms are completely disjoint and there is not data reuse between the two.
+ */
+export class SenderTaggingStore implements StagedStore {
+  readonly storeName = 'sender_tagging';
+
+  #store: AztecAsyncKVStore;
+
+  // Stores the pending index ranges for each directional app tagging secret. Pending here means that the tx that
+  // contained the private logs with tags corresponding to these indexes has not been finalized yet.
+  //
+  // We store the full range (lowestIndex, highestIndex) for each secret-tx pair because transactions can partially
+  // revert, in which case only some logs (from the non-revertible phase) survive onchain. By storing the range,
+  // we can expand it and check each individual siloed tag against the TxEffect to determine which indexes made it
+  // onchain.
+  //
+  // directional app tagging secret => { lowestIndex, highestIndex, txHash }[]
+  #pendingIndexes: AztecAsyncMap<string, PendingIndexesEntry[]>;
+
+  // changeSetId => directional app tagging secret => { lowestIndex, highestIndex, txHash }[]
+  #pendingIndexesForChangeSet: Map<ChangeSetId, Map<string, PendingIndexesEntry[]>>;
+
+  // Stores the last (highest) finalized index for each directional app tagging secret. We care only about the last
+  // index because unlike the pending indexes, it will never happen that a finalized index would be removed and hence
+  // we don't need to store the history.
+  //
+  // directional app tagging secret => highest finalized index
+  #lastFinalizedIndexes: AztecAsyncMap<string, number>;
+
+  // changeSetId => directional app tagging secret => highest finalized index
+  #lastFinalizedIndexesForChangeSet: Map<ChangeSetId, Map<string, number>>;
+
+  constructor(store: AztecAsyncKVStore) {
+    this.#store = store;
+
+    this.#pendingIndexes = this.#store.openMap('pending_indexes');
+    this.#lastFinalizedIndexes = this.#store.openMap('last_finalized_indexes');
+
+    this.#pendingIndexesForChangeSet = new Map();
+    this.#lastFinalizedIndexesForChangeSet = new Map();
+  }
+
+  #getPendingIndexesForChangeSet(changeSetId: ChangeSetId): Map<string, PendingIndexesEntry[]> {
+    let pendingIndexesForChangeSet = this.#pendingIndexesForChangeSet.get(changeSetId);
+    if (!pendingIndexesForChangeSet) {
+      pendingIndexesForChangeSet = new Map();
+      this.#pendingIndexesForChangeSet.set(changeSetId, pendingIndexesForChangeSet);
+    }
+    return pendingIndexesForChangeSet;
+  }
+
+  #getLastFinalizedIndexesForChangeSet(changeSetId: ChangeSetId): Map<string, number> {
+    let stagedLastFinalizedIndexes = this.#lastFinalizedIndexesForChangeSet.get(changeSetId);
+    if (!stagedLastFinalizedIndexes) {
+      stagedLastFinalizedIndexes = new Map();
+      this.#lastFinalizedIndexesForChangeSet.set(changeSetId, stagedLastFinalizedIndexes);
+    }
+    return stagedLastFinalizedIndexes;
+  }
+
+  async #readPendingIndexes(changeSetId: ChangeSetId, secret: string): Promise<PendingIndexesEntry[]> {
+    // Always issue DB read to keep IndexedDB transaction alive (they auto-commit when a new micro-task starts and there
+    // are no pending read requests). The staged value still takes precedence if it exists.
+    const dbValue = await this.#pendingIndexes.getAsync(secret);
+    const staged = this.#getPendingIndexesForChangeSet(changeSetId).get(secret);
+    return staged !== undefined ? staged : (dbValue ?? []);
+  }
+
+  #writePendingIndexes(changeSetId: ChangeSetId, secret: string, pendingIndexes: PendingIndexesEntry[]) {
+    this.#getPendingIndexesForChangeSet(changeSetId).set(secret, pendingIndexes);
+  }
+
+  async #readLastFinalizedIndex(changeSetId: ChangeSetId, secret: string): Promise<number | undefined> {
+    // Always issue DB read to keep IndexedDB transaction alive (they auto-commit when a new micro-task starts and there
+    // are no pending read requests). The staged value still takes precedence if it exists.
+    const dbValue = await this.#lastFinalizedIndexes.getAsync(secret);
+    const staged = this.#getLastFinalizedIndexesForChangeSet(changeSetId).get(secret);
+    return staged ?? dbValue;
+  }
+
+  #writeLastFinalizedIndex(changeSetId: ChangeSetId, secret: string, lastFinalizedIndex: number) {
+    this.#getLastFinalizedIndexesForChangeSet(changeSetId).set(secret, lastFinalizedIndex);
+  }
+
+  /**
+   * Writes all change set-specific in-memory data to persistent storage.
+   *
+   * @remark This method must run in a DB transaction context. It's designed to be called from
+   * {@link StagedWriteCoordinator.commit}.
+   */
+  async commitChangeSet(changeSetId: ChangeSetId): Promise<void> {
+    const pendingIndexesForChangeSet = this.#pendingIndexesForChangeSet.get(changeSetId);
+    if (pendingIndexesForChangeSet) {
+      for (const [secret, pendingIndexes] of pendingIndexesForChangeSet.entries()) {
+        if (pendingIndexes.length === 0) {
+          await this.#pendingIndexes.delete(secret);
+        } else {
+          await this.#pendingIndexes.set(secret, pendingIndexes);
+        }
+      }
+    }
+
+    const lastFinalizedIndexesForChangeSet = this.#lastFinalizedIndexesForChangeSet.get(changeSetId);
+    if (lastFinalizedIndexesForChangeSet) {
+      for (const [secret, lastFinalizedIndex] of lastFinalizedIndexesForChangeSet.entries()) {
+        await this.#lastFinalizedIndexes.set(secret, lastFinalizedIndex);
+      }
+    }
+
+    this.discardChangeSet(changeSetId);
+  }
+
+  discardChangeSet(changeSetId: ChangeSetId): void {
+    this.#pendingIndexesForChangeSet.delete(changeSetId);
+    this.#lastFinalizedIndexesForChangeSet.delete(changeSetId);
+  }
+
+  /**
+   * Stores pending index ranges, rejecting any range that disagrees with an already-stored one.
+   * @remarks If the same (secret, txHash) pair already exists in the db with an equal range, it's a no-op. This is
+   * expected to happen because whenever we start sync we start from the last finalized index and we can have pending
+   * ranges already stored from previous syncs. If the ranges differ, it throws an error as that indicates a bug in
+   * callers that record indexes at prove time. Discovery from onchain logs must use `mergePendingIndexes` instead.
+   * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
+   * to be stored in the db.
+   * @param txHash - The tx in which the tagging indexes were used in private logs.
+   * @param changeSetId - change set to stage this store's writes under. See {@link StagedWriteCoordinator} for more
+   * details.
+   * @throws If the highestIndex is further than window length from the highest finalized index for the same secret.
+   * @throws If the lowestIndex is lower than or equal to the last finalized index for the same secret.
+   * @throws If a different range already exists for the same (secret, txHash) pair.
+   */
+  storePendingIndexes(ranges: TaggingIndexRange[], txHash: TxHash, changeSetId: ChangeSetId): Promise<void> {
+    return this.#storePendingIndexes(ranges, txHash, changeSetId, false);
+  }
+
+  /**
+   * Stores pending index ranges, widening an existing entry for the same (secret, txHash) pair to the union of the
+   * stored and incoming ranges instead of throwing on a mismatch. Discovery from onchain logs needs this: it may see
+   * only the surviving (non-revertible phase) sub-range of a partially reverted tx recorded at prove time (the
+   * finalized receipt step of the sync resolves that difference), or indexes beyond a partially discovered entry
+   * when a tx from another PXE straddles a sync window boundary. Callers that record indexes at prove time must use
+   * `storePendingIndexes` instead, so that a range disagreement surfaces as a bug rather than being absorbed.
+   * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
+   * to be stored in the db.
+   * @param txHash - The tx in which the tagging indexes were used in private logs.
+   * @param changeSetId - change set to stage this store's writes under. See {@link StagedWriteCoordinator} for more
+   * details.
+   * @throws If the highestIndex is further than window length from the highest finalized index for the same secret.
+   * @throws If the lowestIndex is lower than or equal to the last finalized index for the same secret.
+   */
+  mergePendingIndexes(ranges: TaggingIndexRange[], txHash: TxHash, changeSetId: ChangeSetId): Promise<void> {
+    return this.#storePendingIndexes(ranges, txHash, changeSetId, true);
+  }
+
+  #storePendingIndexes(
+    ranges: TaggingIndexRange[],
+    txHash: TxHash,
+    changeSetId: ChangeSetId,
+    mergeExisting: boolean,
+  ): Promise<void> {
+    if (ranges.length === 0) {
+      return Promise.resolve();
+    }
+
+    const txHashStr = txHash.toString();
+
+    return this.#store.transactionAsync(async () => {
+      // Prefetch all data, start reads during iteration to keep IndexedDB transaction alive
+      const rangeReadPromises = ranges.map(range => ({
+        range,
+        secretStr: range.extendedSecret.toString(),
+        pending: this.#readPendingIndexes(changeSetId, range.extendedSecret.toString()),
+        finalized: this.#readLastFinalizedIndex(changeSetId, range.extendedSecret.toString()),
+      }));
+
+      // Await all reads together
+      const rangeData = await allToCompletion(
+        rangeReadPromises.map(async item => ({
+          ...item,
+          pendingData: await item.pending,
+          finalizedIndex: await item.finalized,
+        })),
+      );
+
+      // Process in memory and validate
+      for (const { range, secretStr, pendingData, finalizedIndex } of rangeData) {
+        const windowEnd = unfinalizedTaggingIndexesWindowEnd(finalizedIndex);
+        if (range.highestIndex >= windowEnd) {
+          throw windowExceededError(range.highestIndex, windowEnd, finalizedIndex);
+        }
+
+        // Throw if the lowest index is lower than or equal to the last finalized index
+        if (finalizedIndex !== undefined && range.lowestIndex <= finalizedIndex) {
+          throw new Error(
+            `Cannot store pending index range [${range.lowestIndex}, ${range.highestIndex}] for secret ${secretStr}: ` +
+              `lowestIndex is lower than or equal to the last finalized index ${finalizedIndex}`,
+          );
+        }
+
+        // Check if an entry with the same txHash already exists
+        const existingEntry = pendingData.find(entry => entry.txHash === txHashStr);
+
+        let updatedPending: PendingIndexesEntry[] | undefined;
+        if (!existingEntry) {
+          updatedPending = [
+            ...pendingData,
+            { lowestIndex: range.lowestIndex, highestIndex: range.highestIndex, txHash: txHashStr },
+          ];
+        } else if (mergeExisting) {
+          // Widen the entry to the union of both ranges, never shrink it: replacing would drop prove-time
+          // indexes the chain doesn't show (partially reverted tx), and skipping would drop onchain indexes
+          // discovered in a later sync window (tx straddling the window boundary).
+          const lowestIndex = Math.min(existingEntry.lowestIndex, range.lowestIndex);
+          const highestIndex = Math.max(existingEntry.highestIndex, range.highestIndex);
+          if (lowestIndex !== existingEntry.lowestIndex || highestIndex !== existingEntry.highestIndex) {
+            updatedPending = pendingData.map(entry =>
+              entry === existingEntry ? { lowestIndex, highestIndex, txHash: entry.txHash } : entry,
+            );
+          }
+        } else if (
+          existingEntry.lowestIndex !== range.lowestIndex ||
+          existingEntry.highestIndex !== range.highestIndex
+        ) {
+          // Different ranges for the same (secret, txHash) indicate a bug in callers that record indexes at prove
+          // time.
+          throw new Error(
+            `Conflicting range for secret ${secretStr} and txHash ${txHashStr}: ` +
+              `existing [${existingEntry.lowestIndex}, ${existingEntry.highestIndex}] vs ` +
+              `new [${range.lowestIndex}, ${range.highestIndex}]`,
+          );
+        }
+        // Remaining cases (a merge whose union equals the stored range, or an identical range without
+        // mergeExisting): duplicate evidence, nothing to write.
+
+        if (updatedPending) {
+          this.#writePendingIndexes(changeSetId, secretStr, updatedPending);
+        }
+      }
+    });
+  }
+
+  /**
+   * Returns the pending txs whose highest index falls within [startIndex, endIndex) for a given directional app
+   * tagging secret. The highest index is what decides whether a tx belongs to the window, so it alone is matched
+   * against the bounds, and it is also the only index a caller needs: a tx whose highest index is onchain has every
+   * lower one onchain too. A secret holds at most one entry per tx hash, so no tx hash appears twice in the result.
+   * @param secret - The directional app tagging secret to query pending indexes for.
+   * @param startIndex - The lower bound of the index range (inclusive).
+   * @param endIndex - The upper bound of the index range (exclusive).
+   */
+  getPendingTxs(
+    secret: AppTaggingSecret,
+    startIndex: number,
+    endIndex: number,
+    changeSetId: ChangeSetId,
+  ): Promise<PendingTx[]> {
+    return this.#store.transactionAsync(async () => {
+      const existing = await this.#readPendingIndexes(changeSetId, secret.toString());
+      return existing
+        .filter(entry => entry.highestIndex >= startIndex && entry.highestIndex < endIndex)
+        .map(entry => ({ txHash: entry.txHash, highestIndex: entry.highestIndex }));
+    });
+  }
+
+  /**
+   * Returns the last (highest) finalized index for a given secret.
+   * @param secret - The secret to get the last finalized index for.
+   * @returns The last (highest) finalized index for the given secret.
+   */
+  getLastFinalizedIndex(secret: AppTaggingSecret, changeSetId: ChangeSetId): Promise<number | undefined> {
+    return this.#store.transactionAsync(() => this.#readLastFinalizedIndex(changeSetId, secret.toString()));
+  }
+
+  /**
+   * Returns the last used index for a given directional app tagging secret, considering both finalized and pending
+   * indexes.
+   * @param secret - The directional app tagging secret to query the last used index for.
+   * @returns The last used index.
+   */
+  getLastUsedIndex(secret: AppTaggingSecret, changeSetId: ChangeSetId): Promise<number | undefined> {
+    const secretStr = secret.toString();
+
+    return this.#store.transactionAsync(async () => {
+      const pendingPromise = this.#readPendingIndexes(changeSetId, secretStr);
+      const finalizedPromise = this.#readLastFinalizedIndex(changeSetId, secretStr);
+
+      const [pendingEntries, lastFinalized] = await allToCompletion([pendingPromise, finalizedPromise]);
+
+      if (pendingEntries.length === 0) {
+        return lastFinalized;
+      }
+
+      // As the last used index we return the highest one from the pending index ranges. Note that this value will be
+      // always higher than the last finalized index because we prune lower pending indexes when a tx is finalized.
+      return Math.max(...pendingEntries.map(entry => entry.highestIndex));
+    });
+  }
+
+  /**
+   * Drops all pending indexes corresponding to the given transaction hashes.
+   */
+  dropPendingIndexes(txHashes: TxHash[], changeSetId: ChangeSetId): Promise<void> {
+    if (txHashes.length === 0) {
+      return Promise.resolve();
+    }
+
+    const txHashStrings = new Set<string>(txHashes.map(txHash => txHash.toString()));
+
+    return this.#store.transactionAsync(async () => {
+      // Prefetch all data, start reads during iteration to keep IndexedDB transaction alive
+      const secretReadPromises: Map<string, Promise<PendingIndexesEntry[]>> = new Map();
+
+      for await (const secret of this.#pendingIndexes.keysAsync()) {
+        secretReadPromises.set(secret, this.#readPendingIndexes(changeSetId, secret));
+      }
+
+      // Add staged-only secrets (sync, no DB)
+      for (const secret of this.#getPendingIndexesForChangeSet(changeSetId).keys()) {
+        if (!secretReadPromises.has(secret)) {
+          secretReadPromises.set(
+            secret,
+            Promise.resolve(this.#getPendingIndexesForChangeSet(changeSetId).get(secret) ?? []),
+          );
+        }
+      }
+
+      // Await all reads together
+      const secrets = [...secretReadPromises.keys()];
+      const pendingDataResults = await allToCompletion([...secretReadPromises.values()]);
+
+      // Process in memory
+      for (let i = 0; i < secrets.length; i++) {
+        const secret = secrets[i];
+        const pendingData = pendingDataResults[i];
+
+        if (pendingData && pendingData.length > 0) {
+          const filtered = pendingData.filter(item => !txHashStrings.has(item.txHash));
+          if (filtered.length === 0) {
+            this.#writePendingIndexes(changeSetId, secret, []);
+          } else if (filtered.length !== pendingData.length) {
+            // Some items were filtered out, so update the pending data
+            this.#writePendingIndexes(changeSetId, secret, filtered);
+          }
+          // else: No items were filtered out (txHashes not found for this secret) --> no-op
+        }
+      }
+    });
+  }
+
+  /** Prefetches all pending and finalized index data for every secret (from both DB and staged writes). */
+  #getSecretsWithPendingData(
+    changeSetId: ChangeSetId,
+  ): Promise<{ secret: string; pendingData: PendingIndexesEntry[]; lastFinalized: number | undefined }[]> {
+    return this.#store.transactionAsync(async () => {
+      // Prefetch all data, start reads during iteration to keep IndexedDB transaction alive
+      const secretDataPromises: Map<
+        string,
+        { pending: Promise<PendingIndexesEntry[]>; finalized: Promise<number | undefined> }
+      > = new Map();
+
+      for await (const secret of this.#pendingIndexes.keysAsync()) {
+        secretDataPromises.set(secret, {
+          pending: this.#readPendingIndexes(changeSetId, secret),
+          finalized: this.#readLastFinalizedIndex(changeSetId, secret),
+        });
+      }
+
+      // Add staged-only secrets (sync, no DB)
+      for (const secret of this.#getPendingIndexesForChangeSet(changeSetId).keys()) {
+        if (!secretDataPromises.has(secret)) {
+          secretDataPromises.set(secret, {
+            pending: Promise.resolve(this.#getPendingIndexesForChangeSet(changeSetId).get(secret) ?? []),
+            finalized: Promise.resolve(this.#getLastFinalizedIndexesForChangeSet(changeSetId).get(secret)),
+          });
+        }
+      }
+
+      // Await all reads together
+      const secrets = [...secretDataPromises.keys()];
+      const dataResults = await allToCompletion(
+        secrets.map(async secret => ({
+          secret,
+          pendingData: await secretDataPromises.get(secret)!.pending,
+          lastFinalized: await secretDataPromises.get(secret)!.finalized,
+        })),
+      );
+
+      return dataResults.filter(r => r.pendingData.length > 0);
+    });
+  }
+
+  /**
+   * Updates pending indexes corresponding to the given transaction hashes to be finalized and prunes any lower pending
+   * indexes. Applies to every secret the txs used, so the caller must hold tx-level evidence that the whole tx
+   * finalized. Callers holding evidence about a single secret must use {@link finalizePendingIndexesOfSecret} instead.
+   */
+  finalizePendingIndexes(txHashes: TxHash[], changeSetId: ChangeSetId): Promise<void> {
+    return this.#finalizePendingIndexes(txHashes, changeSetId);
+  }
+
+  /**
+   * Same as {@link finalizePendingIndexes}, but restricted to the pending indexes of a single secret.
+   *
+   * Finalizing every secret off single-secret evidence would be unsound: a tx whose execution partially reverted can
+   * have all of one secret's tags onchain and none of another's, and the second secret's indexes must not be recorded
+   * as finalized when they never reached the chain.
+   */
+  finalizePendingIndexesOfSecret(
+    secret: AppTaggingSecret,
+    txHashes: TxHash[],
+    changeSetId: ChangeSetId,
+  ): Promise<void> {
+    return this.#finalizePendingIndexes(txHashes, changeSetId, secret.toString());
+  }
+
+  async #finalizePendingIndexes(txHashes: TxHash[], changeSetId: ChangeSetId, onlySecret?: string): Promise<void> {
+    if (txHashes.length === 0) {
+      return;
+    }
+
+    const txHashStrings = new Set(txHashes.map(tx => tx.toString()));
+    const secretsWithData = (await this.#getSecretsWithPendingData(changeSetId)).filter(
+      ({ secret }) => onlySecret === undefined || secret === onlySecret,
+    );
+
+    for (const { secret, pendingData, lastFinalized } of secretsWithData) {
+      let currentPending = pendingData;
+      let currentFinalized = lastFinalized;
+
+      // Process all txHashes for this secret
+      for (const txHashStr of txHashStrings) {
+        const matchingEntries = currentPending.filter(item => item.txHash === txHashStr);
+        if (matchingEntries.length === 0) {
+          // This is expected as a higher index might have already been finalized which would lead to pruning of
+          // pending entries.
+          continue;
+        }
+
+        if (matchingEntries.length > 1) {
+          // We should always just store the highest pending index for a given tx hash and secret because the lower
+          // values are irrelevant.
+          throw new Error(`Multiple pending entries found for tx hash ${txHashStr} and secret ${secret}`);
+        }
+
+        const newFinalized = matchingEntries[0].highestIndex;
+
+        if (newFinalized < (currentFinalized ?? 0)) {
+          // This should never happen because when last finalized index was finalized we should have pruned the lower
+          // pending indexes.
+          throw new Error(
+            `New finalized index ${newFinalized} is smaller than the current last finalized index ${currentFinalized}`,
+          );
+        }
+
+        currentFinalized = newFinalized;
+
+        // When we add pending indexes, we ensure they are higher than the last finalized index. However, because we
+        // cannot control the order in which transactions are finalized, there may be pending indexes that are now
+        // obsolete because they are lower than the most recently finalized index. For this reason, we prune these
+        // outdated pending indexes.
+        currentPending = currentPending.filter(item => item.highestIndex > currentFinalized!);
+      }
+
+      // Write final state if changed
+      if (currentFinalized !== lastFinalized) {
+        this.#writeLastFinalizedIndex(changeSetId, secret, currentFinalized!);
+      }
+      if (currentPending !== pendingData) {
+        this.#writePendingIndexes(changeSetId, secret, currentPending);
+      }
+    }
+  }
+
+  /**
+   * Handles finalization of pending indexes for a transaction whose execution was partially reverted.
+   * Recomputes the siloed tags for each pending index of the given tx and checks which ones appear in the
+   * TxEffect's private logs (i.e., which ones made it onchain). Those that survived are finalized; those that
+   * didn't are dropped.
+   * @param txEffect - The tx effect of the partially reverted transaction.
+   * @param changeSetId - change set to stage this store's writes under. See {@link StagedWriteCoordinator} for more
+   * details.
+   */
+  async finalizePendingIndexesOfAPartiallyRevertedTx(txEffect: TxEffect, changeSetId: ChangeSetId): Promise<void> {
+    const txHashStr = txEffect.txHash.toString();
+
+    // Build a set of all siloed tag values that made it onchain (first field of each private log).
+    const onChainTags = new Set<string>(txEffect.privateLogs.map(log => log.fields[0].toString()));
+
+    const secretsWithData = await this.#getSecretsWithPendingData(changeSetId);
+
+    for (const { secret, pendingData, lastFinalized } of secretsWithData) {
+      const matchingEntries = pendingData.filter(item => item.txHash === txHashStr);
+      if (matchingEntries.length === 0) {
+        // This is expected as a higher index might have already been finalized which would lead to pruning of
+        // pending entries.
+        continue;
+      }
+
+      if (matchingEntries.length > 1) {
+        // We should always just store the highest pending index for a given tx hash and secret because the lower
+        // values are irrelevant.
+        throw new Error(`Multiple pending entries found for tx hash ${txHashStr} and secret ${secret}`);
+      }
+
+      const pendingEntry = matchingEntries[0];
+
+      // Expand each matching entry's range and recompute siloed tags for each index.
+      const appTaggingSecret = AppTaggingSecret.fromString(secret);
+      let highestSurvivingIndex: number | undefined;
+
+      for (let index = pendingEntry.lowestIndex; index <= pendingEntry.highestIndex; index++) {
+        const siloedTag = await SiloedTag.compute({ extendedSecret: appTaggingSecret, index });
+        if (onChainTags.has(siloedTag.value.toString())) {
+          highestSurvivingIndex = highestSurvivingIndex !== undefined ? Math.max(highestSurvivingIndex, index) : index;
+        }
+      }
+
+      // Remove all entries for this txHash from pending (both surviving and non-surviving).
+      let currentPending = pendingData.filter(item => item.txHash !== txHashStr);
+
+      if (highestSurvivingIndex !== undefined) {
+        const newFinalized = Math.max(lastFinalized ?? 0, highestSurvivingIndex);
+        this.#writeLastFinalizedIndex(changeSetId, secret, newFinalized);
+
+        // Prune pending indexes that are now <= the finalized index.
+        currentPending = currentPending.filter(item => item.highestIndex > newFinalized);
+      }
+
+      this.#writePendingIndexes(changeSetId, secret, currentPending);
+    }
+  }
+}
+
+/** Builds the error thrown when a pending tag index is at or past the unfinalized tagging window end. */
+export function windowExceededError(
+  highestIndex: number,
+  windowEnd: number,
+  finalizedIndex: number | undefined,
+): Error {
+  const finalizedDescription =
+    finalizedIndex === undefined ? 'no index finalized yet' : `highest finalized index ${finalizedIndex}`;
+  return new Error(
+    `Highest used index ${highestIndex} is at or past the window end ${windowEnd} (${finalizedDescription}). ` +
+      `Tagging window length ${UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN} is configured too low. ` +
+      `Contact the Aztec team to increase it!`,
+  );
+}