@aztec/pxe 0.0.1-commit.993d240 → 0.0.1-commit.9a89641

package/dest/storage/private_event_store/private_event_store.d.ts

@@ -22,6 +22,9 @@ type PrivateEventMetadata = InTx & {
 };
 /**
  * Stores decrypted private event logs.
+ *
+ * Append-only: events are never deleted during normal operation. Reorgs are handled by delete-on-prune, which removes
+ * every event originating on a reorg'd block.
  */
 export declare class PrivateEventStore implements StagedStore {
     #private;
@@ -53,24 +56,18 @@ export declare class PrivateEventStore implements StagedStore {
      * included.
      */
     getPrivateEvents(eventSelector: EventSelector, filter: PrivateEventStoreFilter): Promise<PackedPrivateEvent[]>;
+    /** Returns the ids (siloed event commitments) of all events emitted at the given block number. Used by delete-on-prune. */
+    eventIdsAtBlock(blockNumber: number): Promise<string[]>;
     /**
-     * Rolls back private events that were stored after a given `blockNumber` and up to `synchedBlockNumber` (the block
-     * number up to which PXE managed to sync before the reorg happened).
+     * Rolls the store back to `toBlock`: deletes every event anchored to a block strictly above it, as if nothing past
+     * that block height ever happened. Used by the reorg (`chain-pruned`) path to truncate the orphaned tail. Scanning
+     * from `toBlock + 1` upward covers everything above the rollback target without needing to know the chain tip.
      *
-     * We don't need staged writes for a rollback since it's handled in the context of a blockchain rewind.
-     *
-     * Rollbacks are handled by the BlockSynchronizer, which runs a DB transaction across stores when it detects a
-     * re-org, including setting the new anchor block after rolling back.
-     *
-     * So if anything fails in the process of rolling back any store, all DB changes occurring during rollbacks will be
-     * lost and the anchor block will not be updated; which means this code will eventually need to run again
-     * (i.e.: PXE will detect it's basing it work on an invalid block hash, then which re-triggers rewind).
-     *
-     * For further details, refer to `BlockSynchronizer#handleBlockStreamEvent`.
-     *
-     * IMPORTANT: This method must be called within a transaction to ensure atomicity.
+     * Must be called inside a transaction owned by the caller (it issues no `transactionAsync` of its own, the reorg
+     * path wraps it together with the anchor update, and IndexedDB has no nested transactions). Throws if any job has
+     * uncommitted staged writes, since rolling back mid-job could later re-introduce events anchored to deleted blocks.
      */
-    rollback(blockNumber: number, synchedBlockNumber: number): Promise<void>;
+    rollback(toBlock: number): Promise<void>;
     /**
      * Commits in memory job data to persistent storage.
      *
@@ -88,4 +85,4 @@ export declare class PrivateEventStore implements StagedStore {
     discardStaged(jobId: string): Promise<void>;
 }
 export {};
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpdmF0ZV9ldmVudF9zdG9yZS5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3N0b3JhZ2UvcHJpdmF0ZV9ldmVudF9zdG9yZS9wcml2YXRlX2V2ZW50X3N0b3JlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxFQUFFLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUdwRCxPQUFPLEtBQUssRUFBRSxpQkFBaUIsRUFBcUMsTUFBTSxpQkFBaUIsQ0FBQztBQUM1RixPQUFPLEtBQUssRUFBRSxhQUFhLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssRUFBRSxZQUFZLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUNoRSxPQUFPLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFckQsT0FBTyxLQUFLLEVBQUUsV0FBVyxFQUFFLE1BQU0sMENBQTBDLENBQUM7QUFDNUUsT0FBTyxLQUFLLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFHdkQsTUFBTSxNQUFNLHVCQUF1QixHQUFHO0lBQ3BDLGVBQWUsRUFBRSxZQUFZLENBQUM7SUFDOUIsU0FBUyxFQUFFLE1BQU0sQ0FBQztJQUNsQixPQUFPLEVBQUUsTUFBTSxDQUFDO0lBQ2hCLE1BQU0sRUFBRSxZQUFZLEVBQUUsQ0FBQztJQUN2QixNQUFNLENBQUMsRUFBRSxNQUFNLENBQUM7Q0FDakIsQ0FBQztBQUVGLEtBQUssb0JBQW9CLEdBQUcsSUFBSSxHQUFHO0lBQ2pDLGVBQWUsRUFBRSxZQUFZLENBQUM7SUFDOUIsS0FBSyxFQUFFLFlBQVksQ0FBQztJQUNwQiwyQ0FBMkM7SUFDM0MsY0FBYyxFQUFFLE1BQU0sQ0FBQztJQUN2Qix5RUFBeUU7SUFDekUsY0FBYyxFQUFFLE1BQU0sQ0FBQztDQUN4QixDQUFDO0FBRUY7O0dBRUc7QUFDSCxxQkFBYSxpQkFBa0IsWUFBVyxXQUFXOztJQUNuRCxRQUFRLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBbUI7SUFnQjdDLE1BQU0seUNBQXVDO0lBRTdDLFlBQVksS0FBSyxFQUFFLGlCQUFpQixFQVFuQztJQUVEOzs7Ozs7Ozs7OztPQVdHO0lBQ0gsb0JBQW9CLENBQ2xCLGFBQWEsRUFBRSxhQUFhLEVBQzVCLFVBQVUsRUFBRSxFQUFFLEVBQ2QsVUFBVSxFQUFFLEVBQUUsRUFBRSxFQUNoQixxQkFBcUIsRUFBRSxFQUFFLEVBQ3pCLFFBQVEsRUFBRSxvQkFBb0IsRUFDOUIsS0FBSyxFQUFFLE1BQU0saUJBeUNkO0lBRUQ7Ozs7Ozs7Ozs7T0FVRztJQUNJLGdCQUFnQixDQUNyQixhQUFhLEVBQUUsYUFBYSxFQUM1QixNQUFNLEVBQUUsdUJBQXVCLEdBQzlCLE9BQU8sQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLENBK0UvQjtJQUVEOzs7Ozs7Ozs7Ozs7Ozs7O09BZ0JHO0lBQ1UsUUFBUSxDQUFDLFdBQVcsRUFBRSxNQUFNLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0EwQ3BGO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0csTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQWdCekM7SUFFRDs7T0FFRztJQUNILGFBQWEsQ0FBQyxLQUFLLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FHMUM7Q0EwRUYifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpdmF0ZV9ldmVudF9zdG9yZS5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3N0b3JhZ2UvcHJpdmF0ZV9ldmVudF9zdG9yZS9wcml2YXRlX2V2ZW50X3N0b3JlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxFQUFFLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUdwRCxPQUFPLEtBQUssRUFBRSxpQkFBaUIsRUFBcUMsTUFBTSxpQkFBaUIsQ0FBQztBQUM1RixPQUFPLEtBQUssRUFBRSxhQUFhLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssRUFBRSxZQUFZLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUNoRSxPQUFPLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFckQsT0FBTyxLQUFLLEVBQUUsV0FBVyxFQUFFLE1BQU0sMENBQTBDLENBQUM7QUFDNUUsT0FBTyxLQUFLLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFHdkQsTUFBTSxNQUFNLHVCQUF1QixHQUFHO0lBQ3BDLGVBQWUsRUFBRSxZQUFZLENBQUM7SUFDOUIsU0FBUyxFQUFFLE1BQU0sQ0FBQztJQUNsQixPQUFPLEVBQUUsTUFBTSxDQUFDO0lBQ2hCLE1BQU0sRUFBRSxZQUFZLEVBQUUsQ0FBQztJQUN2QixNQUFNLENBQUMsRUFBRSxNQUFNLENBQUM7Q0FDakIsQ0FBQztBQUVGLEtBQUssb0JBQW9CLEdBQUcsSUFBSSxHQUFHO0lBQ2pDLGVBQWUsRUFBRSxZQUFZLENBQUM7SUFDOUIsS0FBSyxFQUFFLFlBQVksQ0FBQztJQUNwQiwyQ0FBMkM7SUFDM0MsY0FBYyxFQUFFLE1BQU0sQ0FBQztJQUN2Qix5RUFBeUU7SUFDekUsY0FBYyxFQUFFLE1BQU0sQ0FBQztDQUN4QixDQUFDO0FBU0Y7Ozs7O0dBS0c7QUFDSCxxQkFBYSxpQkFBa0IsWUFBVyxXQUFXOztJQUNuRCxRQUFRLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBbUI7SUFnQjdDLE1BQU0seUNBQXVDO0lBRTdDLFlBQVksS0FBSyxFQUFFLGlCQUFpQixFQVFuQztJQUVEOzs7Ozs7Ozs7OztPQVdHO0lBQ0gsb0JBQW9CLENBQ2xCLGFBQWEsRUFBRSxhQUFhLEVBQzVCLFVBQVUsRUFBRSxFQUFFLEVBQ2QsVUFBVSxFQUFFLEVBQUUsRUFBRSxFQUNoQixxQkFBcUIsRUFBRSxFQUFFLEVBQ3pCLFFBQVEsRUFBRSxvQkFBb0IsRUFDOUIsS0FBSyxFQUFFLE1BQU0saUJBeUNkO0lBRUQ7Ozs7Ozs7Ozs7T0FVRztJQUNJLGdCQUFnQixDQUNyQixhQUFhLEVBQUUsYUFBYSxFQUM1QixNQUFNLEVBQUUsdUJBQXVCLEdBQzlCLE9BQU8sQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLENBK0UvQjtJQUVELDJIQUEySDtJQUM5RyxlQUFlLENBQUMsV0FBVyxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FNbkU7SUFFRDs7Ozs7Ozs7T0FRRztJQUNVLFFBQVEsQ0FBQyxPQUFPLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0F5QnBEO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0csTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQWdCekM7SUFFRDs7T0FFRztJQUNILGFBQWEsQ0FBQyxLQUFLLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FHMUM7Q0EwRUYifQ==

package/dest/storage/private_event_store/private_event_store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private_event_store.d.ts","sourceRoot":"","sources":["../../../src/storage/private_event_store/private_event_store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAAqC,MAAM,iBAAiB,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD,MAAM,MAAM,uBAAuB,GAAG;IACpC,eAAe,EAAE,YAAY,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,KAAK,oBAAoB,GAAG,IAAI,GAAG;IACjC,eAAe,EAAE,YAAY,CAAC;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,qBAAa,iBAAkB,YAAW,WAAW;;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAmB;IAgB7C,MAAM,yCAAuC;IAE7C,YAAY,KAAK,EAAE,iBAAiB,EAQnC;IAED;;;;;;;;;;;OAWG;IACH,oBAAoB,CAClB,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,EAAE,EACd,UAAU,EAAE,EAAE,EAAE,EAChB,qBAAqB,EAAE,EAAE,EACzB,QAAQ,EAAE,oBAAoB,EAC9B,KAAK,EAAE,MAAM,iBAyCd;IAED;;;;;;;;;;OAUG;IACI,gBAAgB,CACrB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA+E/B;IAED;;;;;;;;;;;;;;;;OAgBG;IACU,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CpF;IAED;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBzC;IAED;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1C;CA0EF"}
+{"version":3,"file":"private_event_store.d.ts","sourceRoot":"","sources":["../../../src/storage/private_event_store/private_event_store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAAqC,MAAM,iBAAiB,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD,MAAM,MAAM,uBAAuB,GAAG;IACpC,eAAe,EAAE,YAAY,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,KAAK,oBAAoB,GAAG,IAAI,GAAG;IACjC,eAAe,EAAE,YAAY,CAAC;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AASF;;;;;GAKG;AACH,qBAAa,iBAAkB,YAAW,WAAW;;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAmB;IAgB7C,MAAM,yCAAuC;IAE7C,YAAY,KAAK,EAAE,iBAAiB,EAQnC;IAED;;;;;;;;;;;OAWG;IACH,oBAAoB,CAClB,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,EAAE,EACd,UAAU,EAAE,EAAE,EAAE,EAChB,qBAAqB,EAAE,EAAE,EACzB,QAAQ,EAAE,oBAAoB,EAC9B,KAAK,EAAE,MAAM,iBAyCd;IAED;;;;;;;;;;OAUG;IACI,gBAAgB,CACrB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA+E/B;IAED,2HAA2H;IAC9G,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMnE;IAED;;;;;;;;OAQG;IACU,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBpD;IAED;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBzC;IAED;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1C;CA0EF"}

package/dest/storage/private_event_store/private_event_store.js

@@ -4,12 +4,15 @@ import { Semaphore } from '@aztec/foundation/queue';
 import { StoredPrivateEvent } from './stored_private_event.js';
 /**
  * Stores decrypted private event logs.
+ *
+ * Append-only: events are never deleted during normal operation. Reorgs are handled by delete-on-prune, which removes
+ * every event originating on a reorg'd block.
  */ export class PrivateEventStore {
     storeName = 'private_event';
     #store;
     /** Actual private event log entries, keyed by siloedEventCommitment */ #events;
     /** Multi-map from contractAddress_eventSelector to siloedEventCommitment for efficient lookup */ #eventsByContractAndEventSelector;
-    /** Multi-map from block number to siloedEventCommitment for rollback support */ #eventsByBlockNumber;
+    /** Multi-map from block number to siloedEventCommitment, for delete-on-prune. */ #eventsByBlockNumber;
     /** jobId => eventId (event siloed nullifier) => StoredPrivateEvent */ #eventsForJob;
     /** Per-job locks to prevent concurrent writes from affecting each other. */ #jobLocks;
     logger = createLogger('private_event_store');
@@ -127,57 +130,51 @@ import { StoredPrivateEvent } from './stored_private_event.js';
             return events.map((ev)=>ev.event);
         });
     }
+    /** Returns the ids (siloed event commitments) of all events emitted at the given block number. Used by delete-on-prune. */ async eventIdsAtBlock(blockNumber) {
+        const eventIds = [];
+        for await (const eventId of this.#eventsByBlockNumber.getValuesAsync(blockNumber)){
+            eventIds.push(eventId);
+        }
+        return eventIds;
+    }
     /**
-   * Rolls back private events that were stored after a given `blockNumber` and up to `synchedBlockNumber` (the block
-   * number up to which PXE managed to sync before the reorg happened).
-   *
-   * We don't need staged writes for a rollback since it's handled in the context of a blockchain rewind.
-   *
-   * Rollbacks are handled by the BlockSynchronizer, which runs a DB transaction across stores when it detects a
-   * re-org, including setting the new anchor block after rolling back.
+   * Rolls the store back to `toBlock`: deletes every event anchored to a block strictly above it, as if nothing past
+   * that block height ever happened. Used by the reorg (`chain-pruned`) path to truncate the orphaned tail. Scanning
+   * from `toBlock + 1` upward covers everything above the rollback target without needing to know the chain tip.
    *
-   * So if anything fails in the process of rolling back any store, all DB changes occurring during rollbacks will be
-   * lost and the anchor block will not be updated; which means this code will eventually need to run again
-   * (i.e.: PXE will detect it's basing it work on an invalid block hash, then which re-triggers rewind).
-   *
-   * For further details, refer to `BlockSynchronizer#handleBlockStreamEvent`.
-   *
-   * IMPORTANT: This method must be called within a transaction to ensure atomicity.
-   */ async rollback(blockNumber, synchedBlockNumber) {
+   * Must be called inside a transaction owned by the caller (it issues no `transactionAsync` of its own, the reorg
+   * path wraps it together with the anchor update, and IndexedDB has no nested transactions). Throws if any job has
+   * uncommitted staged writes, since rolling back mid-job could later re-introduce events anchored to deleted blocks.
+   */ async rollback(toBlock) {
         if (this.#eventsForJob.size > 0) {
             throw new Error('PXE private event store rollback is not allowed while jobs are running');
         }
-        // First pass: collect all event IDs for all blocks, starting reads during iteration to keep tx alive.
-        const eventsByBlock = new Map();
-        for(let block = blockNumber + 1; block <= synchedBlockNumber; block++){
-            const blockEvents = [];
-            for await (const eventId of this.#eventsByBlockNumber.getValuesAsync(block)){
-                // Start read immediately during iteration to keep IndexedDB transaction alive
-                blockEvents.push({
-                    eventId,
-                    eventReadPromise: this.#events.getAsync(eventId)
-                });
-            }
-            if (blockEvents.length > 0) {
-                eventsByBlock.set(block, blockEvents);
-            }
+        // Snapshot before mutating so we never delete from the multimap we are iterating.
+        const orphaned = [];
+        for await (const [block, eventId] of this.#eventsByBlockNumber.entriesAsync({
+            start: toBlock + 1
+        })){
+            orphaned.push({
+                block,
+                eventId
+            });
         }
-        // Second pass: await reads and perform deletes
         let removedCount = 0;
-        for (const [block, events] of eventsByBlock){
-            await this.#eventsByBlockNumber.delete(block);
-            for (const { eventId, eventReadPromise } of events){
-                const buffer = await eventReadPromise;
-                if (!buffer) {
-                    throw new Error(`Event not found for eventId ${eventId}`);
-                }
-                const entry = StoredPrivateEvent.fromBuffer(buffer);
-                await this.#events.delete(eventId);
-                await this.#eventsByContractAndEventSelector.deleteValue(this.#keyFor(entry.contractAddress, entry.eventSelector), eventId);
-                removedCount++;
+        for (const { block, eventId } of orphaned){
+            const buf = await this.#events.getAsync(eventId);
+            if (!buf) {
+                throw new Error(`Event not found for eventId ${eventId}`);
             }
+            const stored = StoredPrivateEvent.fromBuffer(buf);
+            await this.#events.delete(eventId);
+            await this.#eventsByContractAndEventSelector.deleteValue(this.#keyFor(stored.contractAddress, stored.eventSelector), eventId);
+            await this.#eventsByBlockNumber.deleteValue(block, eventId);
+            removedCount++;
         }
-        this.logger.verbose(`Rolled back ${removedCount} private events after block ${blockNumber}`);
+        this.logger.verbose('rolled back private events', {
+            removedCount,
+            toBlock
+        });
     }
     /**
    * Commits in memory job data to persistent storage.

package/dest/storage/store_identity.d.ts

@@ -0,0 +1,35 @@
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { AztecAsyncKVStore } from '@aztec/kv-store';
+/** The triple that determine which physical store a logical store name maps to. */
+export type StoreIdentity = {
+    /** Chain ID of the L1 the rollup is deployed to. */
+    l1ChainId: number;
+    /** Address of the rollup contract the store's data pertains to. */
+    rollupAddress: EthAddress;
+    /** Schema version of the data held in the store. */
+    schemaVersion: number;
+};
+/**
+ * Composes the store-name discriminator for a store identity. Two identities map to the same physical store iff
+ * their slugs are equal, so the format must stay stable: `<l1ChainId>-<rollupAddress>-v<schemaVersion>` — changing
+ * it orphans every existing store.
+ */
+export declare function storeIdentitySlug({ l1ChainId, rollupAddress, schemaVersion }: StoreIdentity): string;
+/** Composes the physical store name for a logical store name and identity. */
+export declare function effectiveStoreName(name: string, identity: StoreIdentity): string;
+/**
+ * Invariant check for stores whose physical name carries their identity: the recorded version can
+ * only disagree with the expected one if there is a store-naming bug.
+ */
+export declare function assertStoreIdentity(store: AztecAsyncKVStore, storeName: string, identity: StoreIdentity): Promise<void>;
+/**
+ * Thrown when a store's recorded identity does not match the identity it was opened under. Since the identity is
+ * part of the physical store name, this can only indicate a store-naming bug; the store is left untouched.
+ */
+export declare class StoreIdentityMismatchError extends Error {
+    readonly storeName: string;
+    readonly expected: string;
+    readonly actual: string;
+    constructor(storeName: string, expected: string, actual: string);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmVfaWRlbnRpdHkuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zdG9yYWdlL3N0b3JlX2lkZW50aXR5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLFVBQVUsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ2hFLE9BQU8sS0FBSyxFQUFFLGlCQUFpQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFHekQsbUZBQW1GO0FBQ25GLE1BQU0sTUFBTSxhQUFhLEdBQUc7SUFDMUIsb0RBQW9EO0lBQ3BELFNBQVMsRUFBRSxNQUFNLENBQUM7SUFDbEIsbUVBQW1FO0lBQ25FLGFBQWEsRUFBRSxVQUFVLENBQUM7SUFDMUIsb0RBQW9EO0lBQ3BELGFBQWEsRUFBRSxNQUFNLENBQUM7Q0FDdkIsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCx3QkFBZ0IsaUJBQWlCLENBQUMsRUFBRSxTQUFTLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxFQUFFLGFBQWEsR0FBRyxNQUFNLENBRXBHO0FBRUQsOEVBQThFO0FBQzlFLHdCQUFnQixrQkFBa0IsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxhQUFhLEdBQUcsTUFBTSxDQUVoRjtBQUVEOzs7R0FHRztBQUNILHdCQUFzQixtQkFBbUIsQ0FDdkMsS0FBSyxFQUFFLGlCQUFpQixFQUN4QixTQUFTLEVBQUUsTUFBTSxFQUNqQixRQUFRLEVBQUUsYUFBYSxHQUN0QixPQUFPLENBQUMsSUFBSSxDQUFDLENBaUJmO0FBRUQ7OztHQUdHO0FBQ0gscUJBQWEsMEJBQTJCLFNBQVEsS0FBSzthQUVqQyxTQUFTLEVBQUUsTUFBTTthQUNqQixRQUFRLEVBQUUsTUFBTTthQUNoQixNQUFNLEVBQUUsTUFBTTtJQUhoQyxZQUNrQixTQUFTLEVBQUUsTUFBTSxFQUNqQixRQUFRLEVBQUUsTUFBTSxFQUNoQixNQUFNLEVBQUUsTUFBTSxFQU8vQjtDQUNGIn0=

package/dest/storage/store_identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store_identity.d.ts","sourceRoot":"","sources":["../../src/storage/store_identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG;IAC1B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,aAAa,EAAE,UAAU,CAAC;IAC1B,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,aAAa,GAAG,MAAM,CAEpG;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAEhF;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,iBAAiB,EACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;IAHhC,YACkB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAO/B;CACF"}

package/dest/storage/store_identity.js

@@ -0,0 +1,44 @@
+import { DatabaseVersion } from '@aztec/stdlib/database-version/version';
+/**
+ * Composes the store-name discriminator for a store identity. Two identities map to the same physical store iff
+ * their slugs are equal, so the format must stay stable: `<l1ChainId>-<rollupAddress>-v<schemaVersion>` — changing
+ * it orphans every existing store.
+ */ export function storeIdentitySlug({ l1ChainId, rollupAddress, schemaVersion }) {
+    return `${l1ChainId}-${rollupAddress.toString()}-v${schemaVersion}`;
+}
+/** Composes the physical store name for a logical store name and identity. */ export function effectiveStoreName(name, identity) {
+    return `${name}_${storeIdentitySlug(identity)}`;
+}
+/**
+ * Invariant check for stores whose physical name carries their identity: the recorded version can
+ * only disagree with the expected one if there is a store-naming bug.
+ */ export async function assertStoreIdentity(store, storeName, identity) {
+    const expected = new DatabaseVersion(identity.schemaVersion, identity.rollupAddress);
+    const singleton = store.openSingleton('dbVersion');
+    const stored = await singleton.getAsync();
+    if (stored === undefined) {
+        await singleton.set(expected.toBuffer().toString('utf-8'));
+        return;
+    }
+    let storedVersion;
+    try {
+        storedVersion = DatabaseVersion.fromBuffer(Buffer.from(stored, 'utf-8'));
+    } catch  {
+        throw new StoreIdentityMismatchError(storeName, expected.toString(), stored);
+    }
+    if (!storedVersion.equals(expected)) {
+        throw new StoreIdentityMismatchError(storeName, expected.toString(), storedVersion.toString());
+    }
+}
+/**
+ * Thrown when a store's recorded identity does not match the identity it was opened under. Since the identity is
+ * part of the physical store name, this can only indicate a store-naming bug; the store is left untouched.
+ */ export class StoreIdentityMismatchError extends Error {
+    storeName;
+    expected;
+    actual;
+    constructor(storeName, expected, actual){
+        super(`Store '${storeName}' records identity ${actual} but was opened as ${expected}. ` + `Refusing to open; data was NOT modified.`), this.storeName = storeName, this.expected = expected, this.actual = actual;
+        this.name = 'StoreIdentityMismatchError';
+    }
+}

package/dest/storage/tagging_store/index.d.ts

@@ -1,4 +1,4 @@
 export { SenderTaggingStore } from './sender_tagging_store.js';
-export { SenderAddressBookStore } from './sender_address_book_store.js';
+export { TaggingSecretSourcesStore } from './tagging_secret_sources_store.js';
 export { RecipientTaggingStore } from './recipient_tagging_store.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zdG9yYWdlL3RhZ2dpbmdfc3RvcmUvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sMkJBQTJCLENBQUM7QUFDL0QsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFDeEUsT0FBTyxFQUFFLHFCQUFxQixFQUFFLE1BQU0sOEJBQThCLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zdG9yYWdlL3RhZ2dpbmdfc3RvcmUvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sMkJBQTJCLENBQUM7QUFDL0QsT0FBTyxFQUFFLHlCQUF5QixFQUFFLE1BQU0sbUNBQW1DLENBQUM7QUFDOUUsT0FBTyxFQUFFLHFCQUFxQixFQUFFLE1BQU0sOEJBQThCLENBQUMifQ==

package/dest/storage/tagging_store/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/storage/tagging_store/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/storage/tagging_store/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC"}

package/dest/storage/tagging_store/index.js

@@ -1,3 +1,3 @@
 export { SenderTaggingStore } from './sender_tagging_store.js';
-export { SenderAddressBookStore } from './sender_address_book_store.js';
+export { TaggingSecretSourcesStore } from './tagging_secret_sources_store.js';
 export { RecipientTaggingStore } from './recipient_tagging_store.js';

package/dest/storage/tagging_store/sender_tagging_store.d.ts

@@ -2,6 +2,11 @@ import type { AztecAsyncKVStore } from '@aztec/kv-store';
 import { AppTaggingSecret, type TaggingIndexRange } from '@aztec/stdlib/logs';
 import { TxEffect, TxHash } from '@aztec/stdlib/tx';
 import type { StagedStore } from '../../job_coordinator/job_coordinator.js';
+/** A tx still awaiting finalization, and the highest tagging index it used for one secret. */
+export type PendingTx = {
+    txHash: string;
+    highestIndex: number;
+};
 /**
  * Data provider of tagging data used when syncing the sender tagging indexes. The recipient counterpart of this class
  * is called RecipientTaggingStore. We have the data stores separate for sender and recipient because
@@ -19,10 +24,11 @@ export declare class SenderTaggingStore implements StagedStore {
     commit(jobId: string): Promise<void>;
     discardStaged(jobId: string): Promise<void>;
     /**
-     * Stores pending index ranges.
+     * Stores pending index ranges, rejecting any range that disagrees with an already-stored one.
      * @remarks If the same (secret, txHash) pair already exists in the db with an equal range, it's a no-op. This is
      * expected to happen because whenever we start sync we start from the last finalized index and we can have pending
-     * ranges already stored from previous syncs. If the ranges differ, it throws an error as that indicates a bug.
+     * ranges already stored from previous syncs. If the ranges differ, it throws an error as that indicates a bug in
+     * callers that record indexes at prove time. Discovery from onchain logs must use `mergePendingIndexes` instead.
      * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
      * to be stored in the db.
      * @param txHash - The tx in which the tagging indexes were used in private logs.
@@ -33,16 +39,30 @@ export declare class SenderTaggingStore implements StagedStore {
      */
     storePendingIndexes(ranges: TaggingIndexRange[], txHash: TxHash, jobId: string): Promise<void>;
     /**
-     * Returns the transaction hashes of all pending transactions that contain highest indexes within a specified range
-     * for a given directional app tagging secret. We check based on the highest indexes only as that is the relevant
-     * information for the caller of this function.
+     * Stores pending index ranges, widening an existing entry for the same (secret, txHash) pair to the union of the
+     * stored and incoming ranges instead of throwing on a mismatch. Discovery from onchain logs needs this: it may see
+     * only the surviving (non-revertible phase) sub-range of a partially reverted tx recorded at prove time (the
+     * finalized receipt step of the sync resolves that difference), or indexes beyond a partially discovered entry
+     * when a tx from another PXE straddles a sync window boundary. Callers that record indexes at prove time must use
+     * `storePendingIndexes` instead, so that a range disagreement surfaces as a bug rather than being absorbed.
+     * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
+     * to be stored in the db.
+     * @param txHash - The tx in which the tagging indexes were used in private logs.
+     * @param jobId - job context for staged writes to this store. See `JobCoordinator` for more details.
+     * @throws If the highestIndex is further than window length from the highest finalized index for the same secret.
+     * @throws If the lowestIndex is lower than or equal to the last finalized index for the same secret.
+     */
+    mergePendingIndexes(ranges: TaggingIndexRange[], txHash: TxHash, jobId: string): Promise<void>;
+    /**
+     * Returns the pending txs whose highest index falls within [startIndex, endIndex) for a given directional app
+     * tagging secret. The highest index is what decides whether a tx belongs to the window, so it alone is matched
+     * against the bounds, and it is also the only index a caller needs: a tx whose highest index is onchain has every
+     * lower one onchain too. A secret holds at most one entry per tx hash, so no tx hash appears twice in the result.
      * @param secret - The directional app tagging secret to query pending indexes for.
      * @param startIndex - The lower bound of the index range (inclusive).
      * @param endIndex - The upper bound of the index range (exclusive).
-     * @returns An array of unique transaction hashes for pending transactions that contain indexes in the range
-     * [startIndex, endIndex). Returns an empty array if no pending indexes exist in the range.
      */
-    getTxHashesOfPendingIndexes(secret: AppTaggingSecret, startIndex: number, endIndex: number, jobId: string): Promise<TxHash[]>;
+    getPendingTxs(secret: AppTaggingSecret, startIndex: number, endIndex: number, jobId: string): Promise<PendingTx[]>;
     /**
      * Returns the last (highest) finalized index for a given secret.
      * @param secret - The secret to get the last finalized index for.
@@ -62,9 +82,18 @@ export declare class SenderTaggingStore implements StagedStore {
     dropPendingIndexes(txHashes: TxHash[], jobId: string): Promise<void>;
     /**
      * Updates pending indexes corresponding to the given transaction hashes to be finalized and prunes any lower pending
-     * indexes.
+     * indexes. Applies to every secret the txs used, so the caller must hold tx-level evidence that the whole tx
+     * finalized. Callers holding evidence about a single secret must use {@link finalizePendingIndexesOfSecret} instead.
      */
     finalizePendingIndexes(txHashes: TxHash[], jobId: string): Promise<void>;
+    /**
+     * Same as {@link finalizePendingIndexes}, but restricted to the pending indexes of a single secret.
+     *
+     * Finalizing every secret off single-secret evidence would be unsound: a tx whose execution partially reverted can
+     * have all of one secret's tags onchain and none of another's, and the second secret's indexes must not be recorded
+     * as finalized when they never reached the chain.
+     */
+    finalizePendingIndexesOfSecret(secret: AppTaggingSecret, txHashes: TxHash[], jobId: string): Promise<void>;
     /**
      * Handles finalization of pending indexes for a transaction whose execution was partially reverted.
      * Recomputes the siloed tags for each pending index of the given tx and checks which ones appear in the
@@ -75,4 +104,6 @@ export declare class SenderTaggingStore implements StagedStore {
      */
     finalizePendingIndexesOfAPartiallyRevertedTx(txEffect: TxEffect, jobId: string): Promise<void>;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VuZGVyX3RhZ2dpbmdfc3RvcmUuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zdG9yYWdlL3RhZ2dpbmdfc3RvcmUvc2VuZGVyX3RhZ2dpbmdfc3RvcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLEVBQUUsaUJBQWlCLEVBQWlCLE1BQU0saUJBQWlCLENBQUM7QUFDeEUsT0FBTyxFQUFFLGdCQUFnQixFQUFhLEtBQUssaUJBQWlCLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUN6RixPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRXBELE9BQU8sS0FBSyxFQUFFLFdBQVcsRUFBRSxNQUFNLDBDQUEwQyxDQUFDO0FBTTVFOzs7O0dBSUc7QUFDSCxxQkFBYSxrQkFBbUIsWUFBVyxXQUFXOztJQUNwRCxRQUFRLENBQUMsU0FBUyxvQkFBb0I7SUE0QnRDLFlBQVksS0FBSyxFQUFFLGlCQUFpQixFQVFuQztJQTRDRDs7OztPQUlHO0lBQ0csTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQW9CekM7SUFFRCxhQUFhLENBQUMsS0FBSyxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBSTFDO0lBRUQ7Ozs7Ozs7Ozs7OztPQVlHO0lBQ0gsbUJBQW1CLENBQUMsTUFBTSxFQUFFLGlCQUFpQixFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FpRTdGO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0gsMkJBQTJCLENBQ3pCLE1BQU0sRUFBRSxnQkFBZ0IsRUFDeEIsVUFBVSxFQUFFLE1BQU0sRUFDbEIsUUFBUSxFQUFFLE1BQU0sRUFDaEIsS0FBSyxFQUFFLE1BQU0sR0FDWixPQUFPLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FRbkI7SUFFRDs7OztPQUlHO0lBQ0gscUJBQXFCLENBQUMsTUFBTSxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUMsQ0FFMUY7SUFFRDs7Ozs7T0FLRztJQUNILGdCQUFnQixDQUFDLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxLQUFLLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLEdBQUcsU0FBUyxDQUFDLENBaUJyRjtJQUVEOztPQUVHO0lBQ0gsa0JBQWtCLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQTJDbkU7SUE0Q0Q7OztPQUdHO0lBQ0csc0JBQXNCLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQXNEN0U7SUFFRDs7Ozs7OztPQU9HO0lBQ0csNENBQTRDLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FnRG5HO0NBQ0YifQ==
+/** Builds the error thrown when a pending tag index is at or past the unfinalized tagging window end. */
+export declare function windowExceededError(highestIndex: number, windowEnd: number, finalizedIndex: number | undefined): Error;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VuZGVyX3RhZ2dpbmdfc3RvcmUuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zdG9yYWdlL3RhZ2dpbmdfc3RvcmUvc2VuZGVyX3RhZ2dpbmdfc3RvcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLEVBQUUsaUJBQWlCLEVBQWlCLE1BQU0saUJBQWlCLENBQUM7QUFDeEUsT0FBTyxFQUFFLGdCQUFnQixFQUFhLEtBQUssaUJBQWlCLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUN6RixPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRXBELE9BQU8sS0FBSyxFQUFFLFdBQVcsRUFBRSxNQUFNLDBDQUEwQyxDQUFDO0FBRzVFLDhGQUE4RjtBQUM5RixNQUFNLE1BQU0sU0FBUyxHQUFHO0lBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQztJQUFDLFlBQVksRUFBRSxNQUFNLENBQUE7Q0FBRSxDQUFDO0FBS2pFOzs7O0dBSUc7QUFDSCxxQkFBYSxrQkFBbUIsWUFBVyxXQUFXOztJQUNwRCxRQUFRLENBQUMsU0FBUyxvQkFBb0I7SUE0QnRDLFlBQVksS0FBSyxFQUFFLGlCQUFpQixFQVFuQztJQTRDRDs7OztPQUlHO0lBQ0csTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQW9CekM7SUFFRCxhQUFhLENBQUMsS0FBSyxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBSTFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7T0FhRztJQUNILG1CQUFtQixDQUFDLE1BQU0sRUFBRSxpQkFBaUIsRUFBRSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBRTdGO0lBRUQ7Ozs7Ozs7Ozs7Ozs7T0FhRztJQUNILG1CQUFtQixDQUFDLE1BQU0sRUFBRSxpQkFBaUIsRUFBRSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBRTdGO0lBeUZEOzs7Ozs7OztPQVFHO0lBQ0gsYUFBYSxDQUFDLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FPakg7SUFFRDs7OztPQUlHO0lBQ0gscUJBQXFCLENBQUMsTUFBTSxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUMsQ0FFMUY7SUFFRDs7Ozs7T0FLRztJQUNILGdCQUFnQixDQUFDLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxLQUFLLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLEdBQUcsU0FBUyxDQUFDLENBaUJyRjtJQUVEOztPQUVHO0lBQ0gsa0JBQWtCLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQTJDbkU7SUE0Q0Q7Ozs7T0FJRztJQUNILHNCQUFzQixDQUFDLFFBQVEsRUFBRSxNQUFNLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FFdkU7SUFFRDs7Ozs7O09BTUc7SUFDSCw4QkFBOEIsQ0FBQyxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUV6RztJQTRERDs7Ozs7OztPQU9HO0lBQ0csNENBQTRDLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FnRG5HO0NBQ0Y7QUFFRCx5R0FBeUc7QUFDekcsd0JBQWdCLG1CQUFtQixDQUNqQyxZQUFZLEVBQUUsTUFBTSxFQUNwQixTQUFTLEVBQUUsTUFBTSxFQUNqQixjQUFjLEVBQUUsTUFBTSxHQUFHLFNBQVMsR0FDakMsS0FBSyxDQVFQIn0=

package/dest/storage/tagging_store/sender_tagging_store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sender_tagging_store.d.ts","sourceRoot":"","sources":["../../../src/storage/tagging_store/sender_tagging_store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAiB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAa,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAM5E;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,WAAW;;IACpD,QAAQ,CAAC,SAAS,oBAAoB;IA4BtC,YAAY,KAAK,EAAE,iBAAiB,EAQnC;IA4CD;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBzC;IAED,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1C;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiE7F;IAED;;;;;;;;;OASG;IACH,2BAA2B,CACzB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;IAED;;;;OAIG;IACH,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE1F;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiBrF;IAED;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CnE;IA4CD;;;OAGG;IACG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsD7E;IAED;;;;;;;OAOG;IACG,4CAA4C,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDnG;CACF"}
+{"version":3,"file":"sender_tagging_store.d.ts","sourceRoot":"","sources":["../../../src/storage/tagging_store/sender_tagging_store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAiB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAa,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAG5E,8FAA8F;AAC9F,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAKjE;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,WAAW;;IACpD,QAAQ,CAAC,SAAS,oBAAoB;IA4BtC,YAAY,KAAK,EAAE,iBAAiB,EAQnC;IA4CD;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBzC;IAED,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1C;IAED;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;IAED;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;IAyFD;;;;;;;;OAQG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAOjH;IAED;;;;OAIG;IACH,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE1F;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiBrF;IAED;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CnE;IA4CD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;IAED;;;;;;OAMG;IACH,8BAA8B,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzG;IA4DD;;;;;;;OAOG;IACG,4CAA4C,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDnG;CACF;AAED,yGAAyG;AACzG,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,KAAK,CAQP"}

package/dest/storage/tagging_store/sender_tagging_store.js

@@ -1,6 +1,5 @@
 import { AppTaggingSecret, SiloedTag } from '@aztec/stdlib/logs';
-import { TxHash } from '@aztec/stdlib/tx';
-import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../../tagging/constants.js';
+import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN, unfinalizedTaggingIndexesWindowEnd } from '../../tagging/constants.js';
 /**
  * Data provider of tagging data used when syncing the sender tagging indexes. The recipient counterpart of this class
  * is called RecipientTaggingStore. We have the data stores separate for sender and recipient because
@@ -100,10 +99,11 @@ import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../../tagging/constants.
         return Promise.resolve();
     }
     /**
-   * Stores pending index ranges.
+   * Stores pending index ranges, rejecting any range that disagrees with an already-stored one.
    * @remarks If the same (secret, txHash) pair already exists in the db with an equal range, it's a no-op. This is
    * expected to happen because whenever we start sync we start from the last finalized index and we can have pending
-   * ranges already stored from previous syncs. If the ranges differ, it throws an error as that indicates a bug.
+   * ranges already stored from previous syncs. If the ranges differ, it throws an error as that indicates a bug in
+   * callers that record indexes at prove time. Discovery from onchain logs must use `mergePendingIndexes` instead.
    * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
    * to be stored in the db.
    * @param txHash - The tx in which the tagging indexes were used in private logs.
@@ -112,6 +112,25 @@ import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../../tagging/constants.
    * @throws If the lowestIndex is lower than or equal to the last finalized index for the same secret.
    * @throws If a different range already exists for the same (secret, txHash) pair.
    */ storePendingIndexes(ranges, txHash, jobId) {
+        return this.#storePendingIndexes(ranges, txHash, jobId, false);
+    }
+    /**
+   * Stores pending index ranges, widening an existing entry for the same (secret, txHash) pair to the union of the
+   * stored and incoming ranges instead of throwing on a mismatch. Discovery from onchain logs needs this: it may see
+   * only the surviving (non-revertible phase) sub-range of a partially reverted tx recorded at prove time (the
+   * finalized receipt step of the sync resolves that difference), or indexes beyond a partially discovered entry
+   * when a tx from another PXE straddles a sync window boundary. Callers that record indexes at prove time must use
+   * `storePendingIndexes` instead, so that a range disagreement surfaces as a bug rather than being absorbed.
+   * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
+   * to be stored in the db.
+   * @param txHash - The tx in which the tagging indexes were used in private logs.
+   * @param jobId - job context for staged writes to this store. See `JobCoordinator` for more details.
+   * @throws If the highestIndex is further than window length from the highest finalized index for the same secret.
+   * @throws If the lowestIndex is lower than or equal to the last finalized index for the same secret.
+   */ mergePendingIndexes(ranges, txHash, jobId) {
+        return this.#storePendingIndexes(ranges, txHash, jobId, true);
+    }
+    #storePendingIndexes(ranges, txHash, jobId, mergeExisting) {
         if (ranges.length === 0) {
             return Promise.resolve();
         }
@@ -132,11 +151,9 @@ import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../../tagging/constants.
                 })));
             // Process in memory and validate
             for (const { range, secretStr, pendingData, finalizedIndex } of rangeData){
-                // Check that the highest index is not further than window length from the highest finalized index.
-                if (range.highestIndex > (finalizedIndex ?? 0) + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN) {
-                    throw new Error(`Highest used index ${range.highestIndex} is further than window length from the highest finalized index ${finalizedIndex ?? 0}.
-            Tagging window length ${UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN} is configured too low. Contact the Aztec team
-            to increase it!`);
+                const windowEnd = unfinalizedTaggingIndexesWindowEnd(finalizedIndex);
+                if (range.highestIndex >= windowEnd) {
+                    throw windowExceededError(range.highestIndex, windowEnd, finalizedIndex);
                 }
                 // Throw if the lowest index is lower than or equal to the last finalized index
                 if (finalizedIndex !== undefined && range.lowestIndex <= finalizedIndex) {
@@ -144,39 +161,57 @@ import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../../tagging/constants.
                 }
                 // Check if an entry with the same txHash already exists
                 const existingEntry = pendingData.find((entry)=>entry.txHash === txHashStr);
-                if (existingEntry) {
-                    // Assert that the ranges are equal — different ranges for the same (secret, txHash) indicates a bug
-                    if (existingEntry.lowestIndex !== range.lowestIndex || existingEntry.highestIndex !== range.highestIndex) {
-                        throw new Error(`Conflicting range for secret ${secretStr} and txHash ${txHashStr}: ` + `existing [${existingEntry.lowestIndex}, ${existingEntry.highestIndex}] vs ` + `new [${range.lowestIndex}, ${range.highestIndex}]`);
-                    }
-                // Exact duplicate — skip
-                } else {
-                    this.#writePendingIndexes(jobId, secretStr, [
+                let updatedPending;
+                if (!existingEntry) {
+                    updatedPending = [
                         ...pendingData,
                         {
                             lowestIndex: range.lowestIndex,
                             highestIndex: range.highestIndex,
                             txHash: txHashStr
                         }
-                    ]);
+                    ];
+                } else if (mergeExisting) {
+                    // Widen the entry to the union of both ranges, never shrink it: replacing would drop prove-time
+                    // indexes the chain doesn't show (partially reverted tx), and skipping would drop onchain indexes
+                    // discovered in a later sync window (tx straddling the window boundary).
+                    const lowestIndex = Math.min(existingEntry.lowestIndex, range.lowestIndex);
+                    const highestIndex = Math.max(existingEntry.highestIndex, range.highestIndex);
+                    if (lowestIndex !== existingEntry.lowestIndex || highestIndex !== existingEntry.highestIndex) {
+                        updatedPending = pendingData.map((entry)=>entry === existingEntry ? {
+                                lowestIndex,
+                                highestIndex,
+                                txHash: entry.txHash
+                            } : entry);
+                    }
+                } else if (existingEntry.lowestIndex !== range.lowestIndex || existingEntry.highestIndex !== range.highestIndex) {
+                    // Different ranges for the same (secret, txHash) indicate a bug in callers that record indexes at prove
+                    // time.
+                    throw new Error(`Conflicting range for secret ${secretStr} and txHash ${txHashStr}: ` + `existing [${existingEntry.lowestIndex}, ${existingEntry.highestIndex}] vs ` + `new [${range.lowestIndex}, ${range.highestIndex}]`);
+                }
+                // Remaining cases (a merge whose union equals the stored range, or an identical range without
+                // mergeExisting): duplicate evidence, nothing to write.
+                if (updatedPending) {
+                    this.#writePendingIndexes(jobId, secretStr, updatedPending);
                 }
             }
         });
     }
     /**
-   * Returns the transaction hashes of all pending transactions that contain highest indexes within a specified range
-   * for a given directional app tagging secret. We check based on the highest indexes only as that is the relevant
-   * information for the caller of this function.
+   * Returns the pending txs whose highest index falls within [startIndex, endIndex) for a given directional app
+   * tagging secret. The highest index is what decides whether a tx belongs to the window, so it alone is matched
+   * against the bounds, and it is also the only index a caller needs: a tx whose highest index is onchain has every
+   * lower one onchain too. A secret holds at most one entry per tx hash, so no tx hash appears twice in the result.
    * @param secret - The directional app tagging secret to query pending indexes for.
    * @param startIndex - The lower bound of the index range (inclusive).
    * @param endIndex - The upper bound of the index range (exclusive).
-   * @returns An array of unique transaction hashes for pending transactions that contain indexes in the range
-   * [startIndex, endIndex). Returns an empty array if no pending indexes exist in the range.
-   */ getTxHashesOfPendingIndexes(secret, startIndex, endIndex, jobId) {
+   */ getPendingTxs(secret, startIndex, endIndex, jobId) {
         return this.#store.transactionAsync(async ()=>{
             const existing = await this.#readPendingIndexes(jobId, secret.toString());
-            const txHashes = existing.filter((entry)=>entry.highestIndex >= startIndex && entry.highestIndex < endIndex).map((entry)=>entry.txHash);
-            return Array.from(new Set(txHashes)).map(TxHash.fromString);
+            return existing.filter((entry)=>entry.highestIndex >= startIndex && entry.highestIndex < endIndex).map((entry)=>({
+                    txHash: entry.txHash,
+                    highestIndex: entry.highestIndex
+                }));
         });
     }
     /**
@@ -282,13 +317,26 @@ import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../../tagging/constants.
     }
     /**
    * Updates pending indexes corresponding to the given transaction hashes to be finalized and prunes any lower pending
-   * indexes.
-   */ async finalizePendingIndexes(txHashes, jobId) {
+   * indexes. Applies to every secret the txs used, so the caller must hold tx-level evidence that the whole tx
+   * finalized. Callers holding evidence about a single secret must use {@link finalizePendingIndexesOfSecret} instead.
+   */ finalizePendingIndexes(txHashes, jobId) {
+        return this.#finalizePendingIndexes(txHashes, jobId);
+    }
+    /**
+   * Same as {@link finalizePendingIndexes}, but restricted to the pending indexes of a single secret.
+   *
+   * Finalizing every secret off single-secret evidence would be unsound: a tx whose execution partially reverted can
+   * have all of one secret's tags onchain and none of another's, and the second secret's indexes must not be recorded
+   * as finalized when they never reached the chain.
+   */ finalizePendingIndexesOfSecret(secret, txHashes, jobId) {
+        return this.#finalizePendingIndexes(txHashes, jobId, secret.toString());
+    }
+    async #finalizePendingIndexes(txHashes, jobId, onlySecret) {
         if (txHashes.length === 0) {
             return;
         }
         const txHashStrings = new Set(txHashes.map((tx)=>tx.toString()));
-        const secretsWithData = await this.#getSecretsWithPendingData(jobId);
+        const secretsWithData = (await this.#getSecretsWithPendingData(jobId)).filter(({ secret })=>onlySecret === undefined || secret === onlySecret);
         for (const { secret, pendingData, lastFinalized } of secretsWithData){
             let currentPending = pendingData;
             let currentFinalized = lastFinalized;
@@ -372,3 +420,7 @@ import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../../tagging/constants.
         }
     }
 }
+/** Builds the error thrown when a pending tag index is at or past the unfinalized tagging window end. */ export function windowExceededError(highestIndex, windowEnd, finalizedIndex) {
+    const finalizedDescription = finalizedIndex === undefined ? 'no index finalized yet' : `highest finalized index ${finalizedIndex}`;
+    return new Error(`Highest used index ${highestIndex} is at or past the window end ${windowEnd} (${finalizedDescription}). ` + `Tagging window length ${UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN} is configured too low. ` + `Contact the Aztec team to increase it!`);
+}