@aztec/pxe 0.0.1-commit.d3ec352c → 0.0.1-commit.d58ff9d0

package/src/storage/private_event_store/private_event_store.ts

@@ -0,0 +1,382 @@
+import { BlockNumber } from '@aztec/foundation/branded-types';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { createLogger } from '@aztec/foundation/log';
+import { Semaphore } from '@aztec/foundation/queue';
+import type { AztecAsyncKVStore, AztecAsyncMap, AztecAsyncMultiMap } from '@aztec/kv-store';
+import type { EventSelector } from '@aztec/stdlib/abi';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+import type { InTx, TxHash } from '@aztec/stdlib/tx';
+
+import type { StagedStore } from '../../job_coordinator/job_coordinator.js';
+import type { PackedPrivateEvent } from '../../pxe.js';
+import { StoredPrivateEvent } from './stored_private_event.js';
+
+export type PrivateEventStoreFilter = {
+  contractAddress: AztecAddress;
+  fromBlock: number;
+  toBlock: number;
+  scopes: AztecAddress[];
+  txHash?: TxHash;
+};
+
+type PrivateEventMetadata = InTx & {
+  contractAddress: AztecAddress;
+  scope: AztecAddress;
+  /** The index of the tx within the block */
+  txIndexInBlock: number;
+  /** The index of the event within the tx (based on nullifier position) */
+  eventIndexInTx: number;
+};
+
+/// Alias types for kv map readability
+type EventId = string; // the siloedEventCommitment, stringified
+type JobId = string;
+type ContractAndSelectorKey = string;
+type BlockNum = number;
+type StoredEventBuffer = Buffer;
+
+/**
+ * Stores decrypted private event logs.
+ *
+ * Append-only: events are never deleted during normal operation. Reorgs are handled by delete-on-prune, which removes
+ * every event originating on a reorg'd block.
+ */
+export class PrivateEventStore implements StagedStore {
+  readonly storeName: string = 'private_event';
+
+  #store: AztecAsyncKVStore;
+  /** Actual private event log entries, keyed by siloedEventCommitment */
+  #events: AztecAsyncMap<EventId, StoredEventBuffer>;
+  /** Multi-map from contractAddress_eventSelector to siloedEventCommitment for efficient lookup */
+  #eventsByContractAndEventSelector: AztecAsyncMultiMap<ContractAndSelectorKey, EventId>;
+  /** Multi-map from block number to siloedEventCommitment, for delete-on-prune. */
+  #eventsByBlockNumber: AztecAsyncMultiMap<BlockNum, EventId>;
+
+  /** jobId => eventId (event siloed nullifier) => StoredPrivateEvent */
+  #eventsForJob: Map<JobId, Map<EventId, StoredPrivateEvent>>;
+
+  /** Per-job locks to prevent concurrent writes from affecting each other. */
+  #jobLocks: Map<JobId, Semaphore>;
+
+  logger = createLogger('private_event_store');
+
+  constructor(store: AztecAsyncKVStore) {
+    this.#store = store;
+    this.#events = this.#store.openMap('private_event_logs');
+    this.#eventsByContractAndEventSelector = this.#store.openMultiMap('events_by_contract_selector');
+    this.#eventsByBlockNumber = this.#store.openMultiMap('events_by_block_number');
+
+    this.#eventsForJob = new Map();
+    this.#jobLocks = new Map();
+  }
+
+  /**
+   * Store a private event log.
+   * @param eventSelector - The event selector of the event.
+   * @param randomness - The randomness used for the event commitment.
+   * @param msgContent - The content of the event.
+   * @param siloedEventCommitment - The siloed event commitment (used as unique identifier).
+   * @param metadata
+   *  contractAddress - The address of the contract that emitted the event.
+   *  scope - The address to which the event is scoped.
+   *  txHash - The transaction hash of the event log.
+   *  blockNumber - The block number in which the event was emitted.
+   */
+  storePrivateEventLog(
+    eventSelector: EventSelector,
+    randomness: Fr,
+    msgContent: Fr[],
+    siloedEventCommitment: Fr,
+    metadata: PrivateEventMetadata,
+    jobId: string,
+  ) {
+    return this.#withJobLock(jobId, () =>
+      this.#store.transactionAsync(async () => {
+        const { contractAddress, scope, txHash, l2BlockNumber, l2BlockHash, txIndexInBlock, eventIndexInTx } = metadata;
+        const eventId = siloedEventCommitment.toString();
+
+        this.logger.verbose('storing private event log (job stage)', {
+          eventId,
+          contractAddress,
+          scope,
+          msgContent,
+          l2BlockNumber,
+        });
+
+        const existing = await this.#readEvent(eventId, jobId);
+
+        if (existing) {
+          // If we already stored this event, we still want to make sure to track it for the given scope
+          existing.addScope(scope.toString());
+          this.#writeEvent(eventId, existing, jobId);
+        } else {
+          this.#writeEvent(
+            eventId,
+            new StoredPrivateEvent(
+              randomness,
+              msgContent,
+              l2BlockNumber,
+              l2BlockHash,
+              txHash,
+              txIndexInBlock,
+              eventIndexInTx,
+              contractAddress,
+              eventSelector,
+              new Set([scope.toString()]),
+            ),
+            jobId,
+          );
+        }
+      }),
+    );
+  }
+
+  /**
+   * Returns the private events given search parameters.
+   * @param eventSelector - The event selector to filter by.
+   * @param filter - Filtering criteria:
+   *  contractAddress: The address of the contract to get events from.
+   *  fromBlock: The block number to search from (inclusive).
+   *  toBlock: The block number to search upto (exclusive).
+   *  scope: - The addresses that decrypted the logs.
+   * @returns - The event log contents, augmented with metadata about the transaction and block in which the event was
+   * included.
+   */
+  public getPrivateEvents(
+    eventSelector: EventSelector,
+    filter: PrivateEventStoreFilter,
+  ): Promise<PackedPrivateEvent[]> {
+    return this.#store.transactionAsync(async () => {
+      const key = this.#keyFor(filter.contractAddress, eventSelector);
+      const targetScopes = new Set(filter.scopes.map(s => s.toString()));
+
+      // Map from eventId to the promise that reads the event buffer.
+      // We start reads during iteration to keep DB requests pending and avoid IndexedDB auto-commit.
+      const eventReadPromises: Map<string, Promise<Buffer | undefined>> = new Map();
+
+      for await (const eventId of this.#eventsByContractAndEventSelector.getValuesAsync(key)) {
+        eventReadPromises.set(eventId, this.#events.getAsync(eventId));
+      }
+
+      const eventIds = [...eventReadPromises.keys()];
+      const eventBuffers = await Promise.all(eventReadPromises.values());
+
+      const events: Array<{
+        l2BlockNumber: number;
+        txIndexInBlock: number;
+        eventIndexInTx: number;
+        event: PackedPrivateEvent;
+      }> = [];
+
+      for (let i = 0; i < eventIds.length; i++) {
+        const eventId = eventIds[i];
+        const eventBuffer = eventBuffers[i];
+
+        // Defensive, if it happens, there's a problem with how we're handling #eventsByContractAndEventSelector
+        if (!eventBuffer) {
+          this.logger.verbose(
+            `EventId ${eventId} does not exist in main index but it is referenced from contract event selector index`,
+          );
+          continue;
+        }
+
+        const storedPrivateEvent = StoredPrivateEvent.fromBuffer(eventBuffer);
+
+        // Filter by block range
+        if (storedPrivateEvent.l2BlockNumber < filter.fromBlock || storedPrivateEvent.l2BlockNumber >= filter.toBlock) {
+          continue;
+        }
+
+        // Filter by scopes
+        if (storedPrivateEvent.scopes.intersection(targetScopes).size === 0) {
+          continue;
+        }
+
+        // Filter by txHash
+        if (filter.txHash && !storedPrivateEvent.txHash.equals(filter.txHash)) {
+          continue;
+        }
+
+        events.push({
+          l2BlockNumber: storedPrivateEvent.l2BlockNumber,
+          txIndexInBlock: storedPrivateEvent.txIndexInBlock,
+          eventIndexInTx: storedPrivateEvent.eventIndexInTx,
+          event: {
+            packedEvent: storedPrivateEvent.msgContent,
+            l2BlockNumber: BlockNumber(storedPrivateEvent.l2BlockNumber),
+            txHash: storedPrivateEvent.txHash,
+            l2BlockHash: storedPrivateEvent.l2BlockHash,
+            eventSelector,
+          },
+        });
+      }
+
+      // Sort by block number, then by tx index within block, then by event index within tx
+      events.sort((a, b) => {
+        if (a.l2BlockNumber !== b.l2BlockNumber) {
+          return a.l2BlockNumber - b.l2BlockNumber;
+        }
+        if (a.txIndexInBlock !== b.txIndexInBlock) {
+          return a.txIndexInBlock - b.txIndexInBlock;
+        }
+        return a.eventIndexInTx - b.eventIndexInTx;
+      });
+
+      return events.map(ev => ev.event);
+    });
+  }
+
+  /** Returns the ids (siloed event commitments) of all events emitted at the given block number. Used by delete-on-prune. */
+  public async eventIdsAtBlock(blockNumber: number): Promise<string[]> {
+    const eventIds: string[] = [];
+    for await (const eventId of this.#eventsByBlockNumber.getValuesAsync(blockNumber)) {
+      eventIds.push(eventId);
+    }
+    return eventIds;
+  }
+
+  /**
+   * Rolls the store back to `toBlock`: deletes every event anchored to a block strictly above it, as if nothing past
+   * that block height ever happened. Used by the reorg (`chain-pruned`) path to truncate the orphaned tail. Scanning
+   * from `toBlock + 1` upward covers everything above the rollback target without needing to know the chain tip.
+   *
+   * Must be called inside a transaction owned by the caller (it issues no `transactionAsync` of its own, the reorg
+   * path wraps it together with the anchor update, and IndexedDB has no nested transactions). Throws if any job has
+   * uncommitted staged writes, since rolling back mid-job could later re-introduce events anchored to deleted blocks.
+   */
+  public async rollback(toBlock: number): Promise<void> {
+    if (this.#eventsForJob.size > 0) {
+      throw new Error('PXE private event store rollback is not allowed while jobs are running');
+    }
+    // Snapshot before mutating so we never delete from the multimap we are iterating.
+    const orphaned: { block: number; eventId: string }[] = [];
+    for await (const [block, eventId] of this.#eventsByBlockNumber.entriesAsync({ start: toBlock + 1 })) {
+      orphaned.push({ block, eventId });
+    }
+    let removedCount = 0;
+    for (const { block, eventId } of orphaned) {
+      const buf = await this.#events.getAsync(eventId);
+      if (!buf) {
+        throw new Error(`Event not found for eventId ${eventId}`);
+      }
+      const stored = StoredPrivateEvent.fromBuffer(buf);
+      await this.#events.delete(eventId);
+      await this.#eventsByContractAndEventSelector.deleteValue(
+        this.#keyFor(stored.contractAddress, stored.eventSelector),
+        eventId,
+      );
+      await this.#eventsByBlockNumber.deleteValue(block, eventId);
+      removedCount++;
+    }
+    this.logger.verbose('rolled back private events', { removedCount, toBlock });
+  }
+
+  /**
+   * Commits in memory job data to persistent storage.
+   *
+   * Called by JobCoordinator when a job completes successfully.
+   *
+   * Note: JobCoordinator wraps all commits in a single transaction, so we don't need our own transactionAsync here
+   * (and using one would throw on IndexedDB as it does not support nested txs).
+   *
+   * @param jobId - The jobId identifying which staged data to commit
+   */
+  async commit(jobId: string): Promise<void> {
+    // Note: Don't use #withJobLock here - commit runs within JobCoordinator's transactionAsync,
+    // and awaiting the lock would create a microtask boundary with no pending DB request,
+    // causing IndexedDB to auto-commit the transaction.
+    for (const [eventId, entry] of this.#getEventsForJob(jobId).entries()) {
+      const lookupKey = this.#keyFor(entry.contractAddress, entry.eventSelector);
+      this.logger.verbose('storing private event log', { eventId, lookupKey });
+
+      await Promise.all([
+        this.#events.set(eventId, entry.toBuffer()),
+        this.#eventsByContractAndEventSelector.set(lookupKey, eventId),
+        this.#eventsByBlockNumber.set(entry.l2BlockNumber, eventId),
+      ]);
+    }
+
+    this.#clearJobData(jobId);
+  }
+
+  /**
+   * Discards in memory job data without persisting it.
+   */
+  discardStaged(jobId: string): Promise<void> {
+    this.#clearJobData(jobId);
+    return Promise.resolve();
+  }
+
+  /**
+   * Reads an event from in-memory job data first, falling back to persistent storage if not found.
+   *
+   * Returns undefined if the event does not exist in the store overall.
+   */
+  async #readEvent(eventId: string, jobId: string): Promise<StoredPrivateEvent | undefined> {
+    // Always issue DB read to keep IndexedDB transaction alive (they auto-commit when a new micro-task starts and there
+    // are no pending read requests). The staged value still takes precedence if it exists.
+    const buffer = await this.#events.getAsync(eventId);
+    const eventForJob = this.#getEventsForJob(jobId).get(eventId);
+    return eventForJob ?? (buffer ? StoredPrivateEvent.fromBuffer(buffer) : undefined);
+  }
+
+  /**
+   * Writes an event to in-memory job data.
+   *
+   * Writes are only allowed in a job context. Events modified during a job will only be persisted when `commit` is
+   * called.
+   */
+  #writeEvent(eventId: string, entry: StoredPrivateEvent, jobId: string) {
+    this.#getEventsForJob(jobId).set(eventId, entry);
+  }
+
+  /**
+   * Get in-memory data only visible to @param jobId
+   */
+  #getEventsForJob(jobId: string): Map<string, StoredPrivateEvent> {
+    let eventsForJob = this.#eventsForJob.get(jobId);
+    if (eventsForJob === undefined) {
+      eventsForJob = new Map();
+      this.#eventsForJob.set(jobId, eventsForJob);
+    }
+    return eventsForJob;
+  }
+
+  /**
+   * Clear data structures supporting a specific job.
+   */
+  #clearJobData(jobId: string) {
+    this.#eventsForJob.delete(jobId);
+    this.#jobLocks.delete(jobId);
+  }
+
+  /**
+   * Ensures a function can only run once it acquires a unique per-job lock, and handles proper lock release after it
+   * runs.
+   *
+   * This primitive allows concurrent writes on this store without risking data corruption due to unsound write
+   * interleaving.
+   */
+  async #withJobLock<T>(jobId: string, fn: () => Promise<T>): Promise<T> {
+    let lock = this.#jobLocks.get(jobId);
+    if (!lock) {
+      lock = new Semaphore(1);
+      this.#jobLocks.set(jobId, lock);
+    }
+    await lock.acquire();
+    try {
+      return await fn();
+    } finally {
+      lock.release();
+    }
+  }
+
+  /**
+   * Returns a string key based on @param contractAddress and @param eventSelector.
+   *
+   * The returned key is meant to be used when interacting with index #eventsByContractAndEventSelector.
+   */
+  #keyFor(contractAddress: AztecAddress, eventSelector: EventSelector): string {
+    return `${contractAddress.toString()}_${eventSelector.toString()}`;
+  }
+}

package/src/storage/private_event_store/stored_private_event.ts

@@ -0,0 +1,73 @@
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
+import { EventSelector } from '@aztec/stdlib/abi';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+import { BlockHash } from '@aztec/stdlib/block';
+import { TxHash } from '@aztec/stdlib/tx';
+
+/** Serializable private event entry with scope tracking. */
+export class StoredPrivateEvent {
+  constructor(
+    readonly randomness: Fr,
+    readonly msgContent: Fr[],
+    readonly l2BlockNumber: number,
+    readonly l2BlockHash: BlockHash,
+    readonly txHash: TxHash,
+    readonly txIndexInBlock: number,
+    readonly eventIndexInTx: number,
+    readonly contractAddress: AztecAddress,
+    readonly eventSelector: EventSelector,
+    readonly scopes: Set<string>,
+  ) {}
+
+  addScope(scope: string) {
+    this.scopes.add(scope);
+  }
+
+  toBuffer(): Buffer {
+    const scopesArray = [...this.scopes];
+    return serializeToBuffer(
+      this.randomness,
+      this.msgContent.length,
+      ...this.msgContent,
+      this.l2BlockNumber,
+      this.l2BlockHash,
+      this.txHash,
+      this.txIndexInBlock,
+      this.eventIndexInTx,
+      this.contractAddress,
+      this.eventSelector.toBuffer(),
+      scopesArray.length,
+      ...scopesArray,
+    );
+  }
+
+  static fromBuffer(buffer: Buffer): StoredPrivateEvent {
+    const reader = BufferReader.asReader(buffer);
+
+    const randomness = Fr.fromBuffer(reader);
+    const msgContentLength = reader.readNumber();
+    const msgContent = reader.readArray(msgContentLength, Fr);
+    const l2BlockNumber = reader.readNumber();
+    const l2BlockHash = BlockHash.fromBuffer(reader);
+    const txHash = TxHash.fromBuffer(reader);
+    const txIndexInBlock = reader.readNumber();
+    const eventIndexInTx = reader.readNumber();
+    const contractAddress = AztecAddress.fromBuffer(reader);
+    const eventSelector = EventSelector.fromBuffer(reader);
+    const scopes = reader.readVector({ fromBuffer: (r: BufferReader) => r.readString() });
+
+    return new StoredPrivateEvent(
+      randomness,
+      msgContent,
+      l2BlockNumber,
+      l2BlockHash,
+      txHash,
+      txIndexInBlock,
+      eventIndexInTx,
+      contractAddress,
+      eventSelector,
+      new Set(scopes),
+    );
+  }
+}

package/src/storage/store_identity.ts

@@ -0,0 +1,72 @@
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { AztecAsyncKVStore } from '@aztec/kv-store';
+import { DatabaseVersion } from '@aztec/stdlib/database-version/version';
+
+/** The triple that determine which physical store a logical store name maps to. */
+export type StoreIdentity = {
+  /** Chain ID of the L1 the rollup is deployed to. */
+  l1ChainId: number;
+  /** Address of the rollup contract the store's data pertains to. */
+  rollupAddress: EthAddress;
+  /** Schema version of the data held in the store. */
+  schemaVersion: number;
+};
+
+/**
+ * Composes the store-name discriminator for a store identity. Two identities map to the same physical store iff
+ * their slugs are equal, so the format must stay stable: `<l1ChainId>-<rollupAddress>-v<schemaVersion>` — changing
+ * it orphans every existing store.
+ */
+export function storeIdentitySlug({ l1ChainId, rollupAddress, schemaVersion }: StoreIdentity): string {
+  return `${l1ChainId}-${rollupAddress.toString()}-v${schemaVersion}`;
+}
+
+/** Composes the physical store name for a logical store name and identity. */
+export function effectiveStoreName(name: string, identity: StoreIdentity): string {
+  return `${name}_${storeIdentitySlug(identity)}`;
+}
+
+/**
+ * Invariant check for stores whose physical name carries their identity: the recorded version can
+ * only disagree with the expected one if there is a store-naming bug.
+ */
+export async function assertStoreIdentity(
+  store: AztecAsyncKVStore,
+  storeName: string,
+  identity: StoreIdentity,
+): Promise<void> {
+  const expected = new DatabaseVersion(identity.schemaVersion, identity.rollupAddress);
+  const singleton = store.openSingleton<string>('dbVersion');
+  const stored = await singleton.getAsync();
+  if (stored === undefined) {
+    await singleton.set(expected.toBuffer().toString('utf-8'));
+    return;
+  }
+  let storedVersion: DatabaseVersion;
+  try {
+    storedVersion = DatabaseVersion.fromBuffer(Buffer.from(stored, 'utf-8'));
+  } catch {
+    throw new StoreIdentityMismatchError(storeName, expected.toString(), stored);
+  }
+  if (!storedVersion.equals(expected)) {
+    throw new StoreIdentityMismatchError(storeName, expected.toString(), storedVersion.toString());
+  }
+}
+
+/**
+ * Thrown when a store's recorded identity does not match the identity it was opened under. Since the identity is
+ * part of the physical store name, this can only indicate a store-naming bug; the store is left untouched.
+ */
+export class StoreIdentityMismatchError extends Error {
+  constructor(
+    public readonly storeName: string,
+    public readonly expected: string,
+    public readonly actual: string,
+  ) {
+    super(
+      `Store '${storeName}' records identity ${actual} but was opened as ${expected}. ` +
+        `Refusing to open; data was NOT modified.`,
+    );
+    this.name = 'StoreIdentityMismatchError';
+  }
+}

package/src/storage/tagging_store/index.ts

@@ -0,0 +1,3 @@
+export { SenderTaggingStore } from './sender_tagging_store.js';
+export { TaggingSecretSourcesStore } from './tagging_secret_sources_store.js';
+export { RecipientTaggingStore } from './recipient_tagging_store.js';

package/src/storage/tagging_store/recipient_tagging_store.ts

@@ -0,0 +1,139 @@
+import type { AztecAsyncKVStore, AztecAsyncMap } from '@aztec/kv-store';
+import type { AppTaggingSecret } from '@aztec/stdlib/logs';
+
+import type { StagedStore } from '../../job_coordinator/job_coordinator.js';
+
+/**
+ * Data provider of tagging data used when syncing the logs as a recipient. The sender counterpart of this class
+ * is called SenderTaggingStore. We have the providers separate for the sender and recipient because
+ * the algorithms are completely disjoint and there is not data reuse between the two.
+ *
+ * @dev Chain reorgs do not need to be handled here because both the finalized and aged indexes refer to finalized
+ * blocks, which by definition cannot be affected by reorgs.
+ */
+export class RecipientTaggingStore implements StagedStore {
+  storeName: string = 'recipient_tagging';
+
+  #store: AztecAsyncKVStore;
+
+  #highestAgedIndex: AztecAsyncMap<string, number>;
+  #highestFinalizedIndex: AztecAsyncMap<string, number>;
+
+  // jobId => secret => number
+  #highestAgedIndexForJob: Map<string, Map<string, number>>;
+
+  // jobId => secret => number
+  #highestFinalizedIndexForJob: Map<string, Map<string, number>>;
+
+  constructor(store: AztecAsyncKVStore) {
+    this.#store = store;
+
+    this.#highestAgedIndex = this.#store.openMap('highest_aged_index');
+    this.#highestFinalizedIndex = this.#store.openMap('highest_finalized_index');
+
+    this.#highestAgedIndexForJob = new Map();
+    this.#highestFinalizedIndexForJob = new Map();
+  }
+
+  #getHighestAgedIndexForJob(jobId: string): Map<string, number> {
+    let highestAgedIndexForJob = this.#highestAgedIndexForJob.get(jobId);
+    if (!highestAgedIndexForJob) {
+      highestAgedIndexForJob = new Map();
+      this.#highestAgedIndexForJob.set(jobId, highestAgedIndexForJob);
+    }
+    return highestAgedIndexForJob;
+  }
+
+  async #readHighestAgedIndex(jobId: string, secret: string): Promise<number | undefined> {
+    // Always issue DB read to keep IndexedDB transaction alive (they auto-commit when a new micro-task starts and there
+    // are no pending read requests). The staged value still takes precedence if it exists.
+    const dbValue = await this.#highestAgedIndex.getAsync(secret);
+    const staged = this.#getHighestAgedIndexForJob(jobId).get(secret);
+    return staged ?? dbValue;
+  }
+
+  #writeHighestAgedIndex(jobId: string, secret: string, index: number) {
+    this.#getHighestAgedIndexForJob(jobId).set(secret, index);
+  }
+
+  #getHighestFinalizedIndexForJob(jobId: string): Map<string, number> {
+    let jobStagedHighestFinalizedIndex = this.#highestFinalizedIndexForJob.get(jobId);
+    if (!jobStagedHighestFinalizedIndex) {
+      jobStagedHighestFinalizedIndex = new Map();
+      this.#highestFinalizedIndexForJob.set(jobId, jobStagedHighestFinalizedIndex);
+    }
+    return jobStagedHighestFinalizedIndex;
+  }
+
+  async #readHighestFinalizedIndex(jobId: string, secret: string): Promise<number | undefined> {
+    // Always issue DB read to keep IndexedDB transaction alive (they auto-commit when a new micro-task starts and there
+    // are no pending read requests). The staged value still takes precedence if it exists.
+    const dbValue = await this.#highestFinalizedIndex.getAsync(secret);
+    const staged = this.#getHighestFinalizedIndexForJob(jobId).get(secret);
+    return staged ?? dbValue;
+  }
+
+  #writeHighestFinalizedIndex(jobId: string, secret: string, index: number) {
+    this.#getHighestFinalizedIndexForJob(jobId).set(secret, index);
+  }
+
+  /**
+   * Writes all job-specific in-memory data to persistent storage.
+   *
+   * @remark This method must run in a DB transaction context. It's designed to be called from JobCoordinator#commitJob.
+   */
+  async commit(jobId: string): Promise<void> {
+    const highestAgedIndexForJob = this.#highestAgedIndexForJob.get(jobId);
+    if (highestAgedIndexForJob) {
+      for (const [secret, index] of highestAgedIndexForJob.entries()) {
+        await this.#highestAgedIndex.set(secret, index);
+      }
+    }
+
+    const highestFinalizedIndexForJob = this.#highestFinalizedIndexForJob.get(jobId);
+    if (highestFinalizedIndexForJob) {
+      for (const [secret, index] of highestFinalizedIndexForJob.entries()) {
+        await this.#highestFinalizedIndex.set(secret, index);
+      }
+    }
+
+    return this.discardStaged(jobId);
+  }
+
+  discardStaged(jobId: string): Promise<void> {
+    this.#highestAgedIndexForJob.delete(jobId);
+    this.#highestFinalizedIndexForJob.delete(jobId);
+    return Promise.resolve();
+  }
+
+  getHighestAgedIndex(secret: AppTaggingSecret, jobId: string): Promise<number | undefined> {
+    return this.#store.transactionAsync(() => this.#readHighestAgedIndex(jobId, secret.toString()));
+  }
+
+  updateHighestAgedIndex(secret: AppTaggingSecret, index: number, jobId: string): Promise<void> {
+    return this.#store.transactionAsync(async () => {
+      const currentIndex = await this.#readHighestAgedIndex(jobId, secret.toString());
+      if (currentIndex !== undefined && index <= currentIndex) {
+        // Log sync should never set a lower highest aged index.
+        throw new Error(`New highest aged index (${index}) must be higher than the current one (${currentIndex})`);
+      }
+      this.#writeHighestAgedIndex(jobId, secret.toString(), index);
+    });
+  }
+
+  getHighestFinalizedIndex(secret: AppTaggingSecret, jobId: string): Promise<number | undefined> {
+    return this.#store.transactionAsync(() => this.#readHighestFinalizedIndex(jobId, secret.toString()));
+  }
+
+  updateHighestFinalizedIndex(secret: AppTaggingSecret, index: number, jobId: string): Promise<void> {
+    return this.#store.transactionAsync(async () => {
+      const currentIndex = await this.#readHighestFinalizedIndex(jobId, secret.toString());
+      if (currentIndex !== undefined && index < currentIndex) {
+        // Log sync should never set a lower highest finalized index but it can happen that it would try to set the same
+        // one because we are loading logs from highest aged index + 1 and not from the highest finalized index.
+        throw new Error(`New highest finalized index (${index}) must be higher than the current one (${currentIndex})`);
+      }
+      this.#writeHighestFinalizedIndex(jobId, secret.toString(), index);
+    });
+  }
+}