@bananapus/nana-sdk-core 2.24.1 → 2.24.3

package/dist/cjs/review/safeRelayr.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SafeRelayrRecoveryError = void 0;
+exports.canReplaceSafeRelayrQuote = canReplaceSafeRelayrQuote;
 exports.safeRelayrReservationKey = safeRelayrReservationKey;
 exports.sameSafeRelayrIntents = sameSafeRelayrIntents;
 exports.requireSafeRelayrExecution = requireSafeRelayrExecution;
@@ -12,6 +13,65 @@ const safe_js_1 = require("../safe.js");
 const safeService_js_1 = require("../safeService.js");
 const contractWrite_js_1 = require("./contractWrite.js");
 const relayr_js_1 = require("./relayr.js");
+function hasFundingRecords(records) {
+    if (records === undefined)
+        return false;
+    if (!Array.isArray(records))
+        return true;
+    return records.some((record) => {
+        if (!record || typeof record !== "object" || Array.isArray(record))
+            return true;
+        const status = record.status;
+        if (status === undefined)
+            return false;
+        if (!status || typeof status !== "object" || Array.isArray(status))
+            return true;
+        const data = status.data;
+        if (data !== undefined &&
+            data !== null &&
+            (typeof data !== "object" || Array.isArray(data)))
+            return true;
+        const transaction = data?.transaction;
+        if (transaction !== undefined &&
+            (transaction === null ||
+                typeof transaction !== "object" ||
+                Array.isArray(transaction)))
+            return true;
+        if (status.data?.hash !== undefined ||
+            status.data?.transaction?.hash !== undefined)
+            return true;
+        return status.state !== undefined && !(0, relayr_js_1.relayrStateIsPending)(status.state);
+    });
+}
+function hasObservedFunding(session) {
+    return ((session.fundingObserved !== undefined &&
+        session.fundingObserved !== false) ||
+        hasFundingRecords(session.records) ||
+        hasFundingRecords(session.quote?.transactions));
+}
+/**
+ * Safe signatures already authorize a nonce-protected call. Publishing or losing
+ * an unused quote is not a funding attempt. Only this Safe-specific owner may
+ * replace such a quote; raw/forwarded authorizations keep their existing rules.
+ */
+function canReplaceSafeRelayrQuote(session) {
+    if ((session.state !== "publishing" && session.state !== "active") ||
+        session.paymentStatus !== "unfunded" ||
+        !Array.isArray(session.payments) ||
+        session.payments.length !== 0 ||
+        (session.reservationKeys !== undefined &&
+            !Array.isArray(session.reservationKeys)) ||
+        hasObservedFunding(session))
+        return false;
+    try {
+        validateExecutions(session.executions);
+        const identities = new Set(session.executions.map(safeRelayrReservationKey));
+        return !session.reservationKeys?.some((key) => !identities.has(key.toLowerCase()));
+    }
+    catch {
+        return false;
+    }
+}
 class SafeRelayrRecoveryError extends Error {
     constructor(session, message = "This Safe execution has an existing Relayr bundle. Check the existing bundle before submitting another payment.", recovery) {
         super(message);
@@ -172,6 +232,13 @@ function requireSafeRelayrRecords(bindings, records) {
             throw new Error("Relayr's record does not match the saved Safe transaction binding.");
     }
 }
+function requireSafeLanding(execution, { receipt }) {
+    const { safe, safeTxHash } = execution;
+    (0, safeService_js_1.requireSafeExecutionSuccess)(receipt, safe, safeTxHash);
+    const event = (0, safeService_js_1.safeExecutionResult)(receipt, safe, safeTxHash);
+    if (event.status !== "success" || event.payment !== 0n)
+        throw new Error("The Safe execution reimbursed its executor. Keep the existing bundle for verification.");
+}
 /** Canonical exact destination receipts plus matching, refund-free Safe success events. */
 async function verifySafeRelayrLanding(clientFor, { executions, bindings, records, }) {
     validateExecutions(executions);
@@ -184,13 +251,7 @@ async function verifySafeRelayrLanding(clientFor, { executions, bindings, record
         bindings,
         records,
     });
-    verified.forEach(({ receipt }, index) => {
-        const { safe, safeTxHash } = executions[index];
-        (0, safeService_js_1.requireSafeExecutionSuccess)(receipt, safe, safeTxHash);
-        const event = (0, safeService_js_1.safeExecutionResult)(receipt, safe, safeTxHash);
-        if (event.status !== "success" || event.payment !== 0n)
-            throw new Error("The Safe execution reimbursed its executor. Keep the existing bundle for verification.");
-    });
+    verified.forEach((item, index) => requireSafeLanding(executions[index], item));
     return verified;
 }
 /** Validate persisted bindings again; local storage is not authenticated evidence. */
@@ -216,6 +277,49 @@ function requireSessionQuote(session) {
 function createSafeRelayrController(options) {
     const { store } = options;
     const fetchRelayr = options.fetch ?? globalThis.fetch;
+    const displayedExecutions = new Map();
+    const notify = (progress, rechecking = false) => {
+        if (progress.type === "execution") {
+            const key = `${progress.session.id}:${progress.index}`;
+            const display = JSON.stringify([
+                progress.status,
+                progress.hash,
+                progress.message,
+            ]);
+            const previous = displayedExecutions.get(key);
+            // Rechecking does not undo a proven display result. A later unavailable,
+            // contradictory, or changed-hash result explicitly updates it below.
+            if (previous === display ||
+                (rechecking &&
+                    previous === JSON.stringify(["executed", progress.hash, undefined])))
+                return;
+            displayedExecutions.set(key, display);
+        }
+        try {
+            // A view must not mutate frozen calls or turn a submitted payment into a
+            // rejected operation. Also consume rejection from an async UI callback.
+            void Promise.resolve(options.onProgress?.(structuredClone(progress))).catch(() => undefined);
+        }
+        catch {
+            // Display observers cannot change the durable execution lifecycle.
+        }
+    };
+    const phase = (phase, session, signal) => {
+        if (!signal?.aborted)
+            notify({ type: "phase", phase, session });
+    };
+    const savedPhase = (session, signal) => {
+        if (session.state === "released")
+            return;
+        if (session.state === "complete")
+            phase("complete", session, signal);
+        else if (session.paymentStatus === "confirmed" ||
+            hasObservedFunding(session))
+            phase("executing", session, signal);
+        else if (session.paymentStatus === "submitted" ||
+            session.paymentStatus === "sending")
+            phase("payment-confirming", session, signal);
+    };
     const checkAccount = (account, signal) => {
         signal?.throwIfAborted();
         if (!(0, viem_1.isAddress)(account) ||
@@ -273,10 +377,12 @@ function createSafeRelayrController(options) {
     };
     const unidentified = (session) => !session.executions.length && !session.reservationKeys?.length;
     const unresolved = (session) => session.state !== "complete" && session.state !== "released";
+    const reserves = (session, executions) => unresolved(session) &&
+        (store.scope === "single-session" ||
+            unidentified(session) ||
+            overlap(session, executions));
     const assertUnreserved = async (account, executions, exceptId) => {
-        const conflict = (await store.list(account)).find((session) => session.id !== exceptId &&
-            unresolved(session) &&
-            (unidentified(session) || overlap(session, executions)));
+        const conflict = (await store.list(account)).find((session) => session.id !== exceptId && reserves(session, executions));
         if (conflict)
             throw new SafeRelayrRecoveryError(conflict);
     };
@@ -349,7 +455,8 @@ function createSafeRelayrController(options) {
             // session per Safe and replacing it would erase the unresolved evidence.
             if (session.paymentStatus !== "unfunded" ||
                 !Array.isArray(session.payments) ||
-                session.payments.length)
+                session.payments.length ||
+                hasObservedFunding(session))
                 return pending({
                     reason: "funding-unresolved",
                     message: "Every saved Safe nonce has been used, but this selection still has unresolved payment evidence. Inspect the original Safe proposals and funding transactions before replacing it. No refund or successful execution has been confirmed.",
@@ -392,77 +499,256 @@ function createSafeRelayrController(options) {
             checks,
         });
     }
-    async function inspect(session) {
-        if (session.state === "released")
-            return result("released", session);
-        if (session.state === "complete")
-            return result("complete", session);
-        if (!session.bundleUuid || !session.quote)
-            return inspectMissingQuote(session);
-        const quote = requireSessionQuote(session);
-        const chains = session.executions.map(({ entry }) => entry.chain);
-        const bundle = await (0, relayr_js_1.readRelayrBundle)(session.bundleUuid, {
-            fetch: fetchRelayr,
-        });
-        if (!Array.isArray(bundle.transactions))
-            throw new SafeRelayrRecoveryError(session, "Relayr has not returned this bundle's transactions. Check the existing bundle again.");
-        const records = bundle.transactions;
-        requireSafeRelayrRecords(quote.expectedTransactions, records);
-        session = { ...session, records };
-        await store.save(session);
-        // A reported hash is only a pointer. Completion requires canonical exact
-        // calldata/value receipts AND the matching Safe ExecutionSuccess event.
-        if (records.length &&
-            records.every((record) => record.status?.data?.hash || record.status?.data?.transaction?.hash)) {
-            const verified = await verifySafeRelayrLanding(options.clientFor, {
-                executions: session.executions,
-                bindings: quote.expectedTransactions,
-                records,
+    async function inspect(session, signal) {
+        const report = (progress, rechecking = false) => {
+            if (!signal?.aborted)
+                notify(progress, rechecking);
+        };
+        try {
+            savedPhase(session, signal);
+            if (session.state === "released")
+                return result("released", session);
+            if (session.state === "complete")
+                return result("complete", session);
+            if (hasObservedFunding(session) && session.fundingObserved !== true) {
+                session = { ...session, fundingObserved: true };
+                await store.save(session);
+            }
+            if (!session.bundleUuid || !session.quote)
+                return inspectMissingQuote(session);
+            const quote = requireSessionQuote(session);
+            const chains = session.executions.map(({ entry }) => entry.chain);
+            const bundle = await (0, relayr_js_1.readRelayrBundle)(session.bundleUuid, {
+                fetch: fetchRelayr,
             });
-            await Promise.all(session.executions.map((execution, index) => options.afterVerified?.(execution, verified[index])));
-            session = { ...session, state: "complete" };
+            if (hasObservedFunding(session) ||
+                bundle.payment_received === true ||
+                hasFundingRecords(bundle.transactions)) {
+                session = { ...session, fundingObserved: true };
+                await store.save(session);
+            }
+            if (!Array.isArray(bundle.transactions))
+                throw new SafeRelayrRecoveryError(session, "Relayr has not returned this bundle's transactions. Check the existing bundle again.");
+            const records = bundle.transactions;
+            requireSafeRelayrRecords(quote.expectedTransactions, records);
+            session = { ...session, records };
             await store.save(session);
-            return result("complete", session);
-        }
-        if (session.paymentStatus === "sending")
-            return result("pending", session);
-        if (session.payments.some((payment) => payment.bundleUuid !== session.bundleUuid))
-            throw new SafeRelayrRecoveryError(session, "A saved payment belongs to another bundle. Keep the existing bundle for verification.");
-        if (session.payments.length) {
-            let everyReverted = true;
-            for (const payment of session.payments) {
-                const client = options.clientFor(payment.chainId);
-                if (!client)
-                    return result("pending", session);
+            savedPhase(session, signal);
+            // Each hash is only a pointer. Check available chains independently, using
+            // the same complete binding validator and exact receipt proof as completion.
+            const indexed = quote.expectedTransactions.map((binding, index) => ({
+                binding,
+                index,
+                record: records.find((record) => record.tx_uuid?.toLowerCase() === binding.txUuid.toLowerCase()),
+            }));
+            const known = indexed.filter(({ record }) => record.status?.data?.hash !== undefined ||
+                record.status?.data?.transaction?.hash !== undefined);
+            if (known.length) {
                 try {
-                    await (0, relayr_js_1.verifyRelayrPayment)(client, {
-                        hash: payment.hash,
-                        from: session.account,
-                        payment,
+                    (0, relayr_js_1.relayrDestinationHashes)({
+                        bindings: known.map(({ binding }) => binding),
+                        records: known.map(({ record }) => record),
                     });
-                    session = { ...session, paymentStatus: "confirmed" };
-                    await store.save(session);
-                    return result("pending", session);
                 }
                 catch (error) {
-                    if (!(error instanceof relayr_js_1.RelayrPaymentRevertedError))
-                        everyReverted = false;
+                    for (const { index, record } of known)
+                        report({
+                            type: "execution",
+                            session,
+                            index,
+                            execution: session.executions[index],
+                            status: "failed",
+                            hash: (0, relayr_js_1.relayrDestinationHash)(record) ?? undefined,
+                            message: error instanceof Error
+                                ? error.message
+                                : "The destination records do not match this quote.",
+                        });
+                    throw new SafeRelayrRecoveryError(session, error instanceof Error ? error.message : undefined);
                 }
+                phase("executing", session, signal);
             }
-            if (!everyReverted)
-                return result("pending", session);
-            session = { ...session, paymentStatus: "reverted" };
-            await store.save(session);
-            const disposition = await (0, relayr_js_1.revertedRelayrQuote)(options.clientFor, {
-                bundleUuid: quote.bundle_uuid,
-                payments: session.payments,
-                options: quote.payment_info,
-                destinationChainIds: chains,
-                account: session.account,
-            }, { fetch: fetchRelayr });
-            if (disposition.state === "funded")
+            if (known.length ||
+                session.paymentStatus !== "unfunded" ||
+                session.fundingObserved) {
+                for (const { index, record } of indexed) {
+                    const hash = (0, relayr_js_1.relayrDestinationHash)(record) ?? undefined;
+                    report({
+                        type: "execution",
+                        session,
+                        index,
+                        execution: session.executions[index],
+                        status: hash
+                            ? "confirming"
+                            : (0, relayr_js_1.relayrStateIsFailed)(record.status?.state)
+                                ? "failed"
+                                : "pending",
+                        hash,
+                        ...(!hash && (0, relayr_js_1.relayrStateIsFailed)(record.status?.state)
+                            ? {
+                                message: "Relayr reported this execution failed. Its onchain result has not been verified.",
+                            }
+                            : {}),
+                    }, true);
+                }
+            }
+            const landed = await Promise.allSettled(known.map(async ({ binding, index, record }) => {
+                const execution = session.executions[index];
+                const hash = (0, relayr_js_1.relayrDestinationHash)(record);
+                const client = options.clientFor(binding.chain);
+                if (!client) {
+                    report({
+                        type: "execution",
+                        session,
+                        index,
+                        execution,
+                        status: "confirming",
+                        hash,
+                        message: "Waiting for a connection to this network.",
+                    });
+                    return false;
+                }
+                try {
+                    const receipt = await (0, relayr_js_1.verifyRelayrDestination)(client, {
+                        entry: binding.entry,
+                        hash,
+                    });
+                    const verified = {
+                        txUuid: binding.txUuid,
+                        chainId: binding.chain,
+                        receipt,
+                    };
+                    requireSafeLanding(execution, verified);
+                    await options.afterVerified?.(execution, verified);
+                    report({
+                        type: "execution",
+                        session,
+                        index,
+                        execution,
+                        status: "executed",
+                        hash,
+                    });
+                    return true;
+                }
+                catch (error) {
+                    if (error instanceof relayr_js_1.RelayrProofUnavailableError) {
+                        report({
+                            type: "execution",
+                            session,
+                            index,
+                            execution,
+                            status: "confirming",
+                            hash,
+                            message: "Waiting for the network to confirm this transaction.",
+                        });
+                        return false;
+                    }
+                    report({
+                        type: "execution",
+                        session,
+                        index,
+                        execution,
+                        status: "failed",
+                        hash,
+                        message: error instanceof Error
+                            ? error.message
+                            : "The Safe execution could not be verified.",
+                    });
+                    throw error;
+                }
+            }));
+            const failure = landed.find((item) => item.status === "rejected");
+            if (failure?.status === "rejected")
+                throw new SafeRelayrRecoveryError(session, failure.reason instanceof Error ? failure.reason.message : undefined);
+            if (known.length === session.executions.length &&
+                landed.every((item) => item.status === "fulfilled" && item.value)) {
+                session = { ...session, state: "complete" };
+                await store.save(session);
+                phase("complete", session, signal);
+                return result("complete", session);
+            }
+            if (session.paymentStatus === "sending")
                 return result("pending", session);
-            if (disposition.state === "released") {
+            if (session.payments.some((payment) => payment.bundleUuid !== session.bundleUuid))
+                throw new SafeRelayrRecoveryError(session, "A saved payment belongs to another bundle. Keep the existing bundle for verification.");
+            if (session.payments.length) {
+                let everyReverted = true;
+                for (const payment of session.payments) {
+                    const client = options.clientFor(payment.chainId);
+                    if (!client)
+                        return result("pending", session);
+                    try {
+                        await (0, relayr_js_1.verifyRelayrPayment)(client, {
+                            hash: payment.hash,
+                            from: session.account,
+                            payment,
+                        });
+                        session = { ...session, paymentStatus: "confirmed" };
+                        await store.save(session);
+                        phase("executing", session, signal);
+                        return result("pending", session);
+                    }
+                    catch (error) {
+                        if (!(error instanceof relayr_js_1.RelayrPaymentRevertedError))
+                            everyReverted = false;
+                    }
+                }
+                if (!everyReverted)
+                    return result("pending", session);
+                session = { ...session, paymentStatus: "reverted" };
+                await store.save(session);
+                const disposition = await (0, relayr_js_1.revertedRelayrQuote)(options.clientFor, {
+                    bundleUuid: quote.bundle_uuid,
+                    payments: session.payments,
+                    options: quote.payment_info,
+                    destinationChainIds: chains,
+                    account: session.account,
+                }, { fetch: fetchRelayr });
+                if (disposition.state === "funded")
+                    return result("pending", session);
+                if (disposition.state === "released") {
+                    session = {
+                        ...session,
+                        state: "released",
+                        paymentStatus: "expired",
+                        releaseReason: "quote-expired",
+                    };
+                    await store.save(session);
+                    return result("released", session);
+                }
+            }
+            else if (session.paymentStatus !== "unfunded" ||
+                session.fundingObserved) {
+                // A wallet invocation without a known hash may still have broadcast.
+                return session.fundingObserved && !known.length
+                    ? {
+                        ...result("pending", session),
+                        recovery: {
+                            reason: "funding-unresolved",
+                            message: "This saved selection has reported funding or execution activity. Check the existing bundle and its funding transactions before submitting another payment.",
+                        },
+                    }
+                    : result("pending", session);
+            }
+            const quoted = (0, relayr_js_1.relayrQuotedOptions)(quote, chains);
+            if (!quoted.length)
+                return inspectMissingQuote(session);
+            const payments = (0, relayr_js_1.relayrPaymentOptions)(quote, chains);
+            const expired = payments.length
+                ? [false]
+                : await Promise.all(quoted.map(async ({ details }) => {
+                    const client = options.clientFor(details.chainId);
+                    return (!!client &&
+                        (await (0, relayr_js_1.relayrDeadlinePassed)(client, details.deadline).catch(() => false)));
+                }));
+            if (expired.every(Boolean)) {
+                try {
+                    await (0, relayr_js_1.requireRelayrBundleUnpaid)(quote.bundle_uuid, {
+                        fetch: fetchRelayr,
+                    });
+                }
+                catch {
+                    return result("pending", session);
+                }
                 session = {
                     ...session,
                     state: "released",
@@ -472,23 +758,6 @@ function createSafeRelayrController(options) {
                 await store.save(session);
                 return result("released", session);
             }
-        }
-        else if (session.paymentStatus !== "unfunded") {
-            // A wallet invocation without a known hash may still have broadcast.
-            return result("pending", session);
-        }
-        const quoted = (0, relayr_js_1.relayrQuotedOptions)(quote, chains);
-        if (!quoted.length)
-            return inspectMissingQuote(session);
-        const payments = (0, relayr_js_1.relayrPaymentOptions)(quote, chains);
-        const expired = payments.length
-            ? [false]
-            : await Promise.all(quoted.map(async ({ details }) => {
-                const client = options.clientFor(details.chainId);
-                return (!!client &&
-                    (await (0, relayr_js_1.relayrDeadlinePassed)(client, details.deadline).catch(() => false)));
-            }));
-        if (expired.every(Boolean)) {
             try {
                 await (0, relayr_js_1.requireRelayrBundleUnpaid)(quote.bundle_uuid, {
                     fetch: fetchRelayr,
@@ -497,43 +766,35 @@ function createSafeRelayrController(options) {
             catch {
                 return result("pending", session);
             }
-            session = {
-                ...session,
-                state: "released",
-                paymentStatus: "expired",
-                releaseReason: "quote-expired",
-            };
-            await store.save(session);
-            return result("released", session);
-        }
-        try {
-            await (0, relayr_js_1.requireRelayrBundleUnpaid)(quote.bundle_uuid, {
-                fetch: fetchRelayr,
-            });
+            const allowed = session.payments.length && payments.length
+                ? [(0, relayr_js_1.relayrRetryOption)(session.payments, payments)]
+                : payments;
+            return allowed.length
+                ? result("ready", session, allowed)
+                : result("pending", session);
         }
-        catch {
-            return result("pending", session);
+        catch (error) {
+            if (error instanceof SafeRelayrRecoveryError)
+                throw error;
+            throw new SafeRelayrRecoveryError(session, error instanceof Error ? error.message : undefined);
         }
-        const allowed = session.payments.length && payments.length
-            ? [(0, relayr_js_1.relayrRetryOption)(session.payments, payments)]
-            : payments;
-        return allowed.length
-            ? result("ready", session, allowed)
-            : result("pending", session);
     }
     async function prepare({ account, executions: input, signal, onStatus, }) {
         const executions = structuredClone([...input]);
         validateExecutions(executions);
         return store.withLock(account, async () => {
             checkAccount(account, signal);
-            const reservations = (await store.list(account)).filter((session) => unresolved(session) &&
-                (unidentified(session) || overlap(session, executions)));
+            const reservations = (await store.list(account)).filter((session) => reserves(session, executions));
             for (const saved of reservations) {
+                if (canReplaceSafeRelayrQuote(saved))
+                    continue;
                 let checked;
                 try {
-                    checked = await inspect(saved);
+                    checked = await inspect(saved, signal);
                 }
                 catch (error) {
+                    if (error instanceof SafeRelayrRecoveryError)
+                        throw error;
                     throw new SafeRelayrRecoveryError(saved, error instanceof Error ? error.message : undefined);
                 }
                 if (checked.state === "released" &&
@@ -547,14 +808,29 @@ function createSafeRelayrController(options) {
                     throw new SafeRelayrRecoveryError(checked.session, checked.recovery?.message, checked.recovery);
                 await assertUnreserved(account, executions, saved.id);
                 await revalidate(saved.executions, account, onStatus, false, signal);
+                phase("reviewing", checked.session, signal);
                 await options.review(saved.executions, { resumed: true });
                 checkAccount(account, signal);
                 rememberReview(checked.session);
                 return { ...checked, state: "ready", resumed: true };
             }
             await revalidate(executions, account, onStatus, false, signal);
+            phase("reviewing", undefined, signal);
             await options.review(executions, { resumed: false });
             checkAccount(account, signal);
+            // Re-read under the shared lock after review. A rejected review leaves the
+            // old quote untouched; a recorded wallet invocation can never be retired.
+            for (const saved of await store.list(account)) {
+                if (!reserves(saved, executions))
+                    continue;
+                if (!canReplaceSafeRelayrQuote(saved))
+                    throw new SafeRelayrRecoveryError(saved);
+                await store.save({
+                    ...saved,
+                    state: "released",
+                    releaseReason: "quote-replaced",
+                });
+            }
             await assertUnreserved(account, executions);
             let session = {
                 id: options.createId?.() ?? globalThis.crypto.randomUUID(),
@@ -565,8 +841,8 @@ function createSafeRelayrController(options) {
                 payments: [],
                 createdAt: Date.now(),
             };
-            // Persist before POST. An interrupted response may have published the Safe
-            // signatures; loss of the bundle ID is never permission to publish twice.
+            // Persist before POST so the quote can be recovered or retired later.
+            // Safe publication alone is not evidence that the wallet funded it.
             await store.save(session);
             try {
                 checkAccount(account, signal);
@@ -576,6 +852,7 @@ function createSafeRelayrController(options) {
                 throw error;
             }
             const request = (0, relayr_js_1.relayrBundleRequest)(executions.map(({ entry }) => entry));
+            phase("quoting", session, signal);
             const response = await fetchRelayr(`${relayr_js_1.RELAYR_API}/v1/bundle/prepaid`, {
                 method: "POST",
                 headers: { "content-type": "application/json" },
@@ -604,14 +881,18 @@ function createSafeRelayrController(options) {
             return { state: "ready", session, payments, resumed: false };
         });
     }
-    async function check({ account, sessionId, }) {
-        return store.withLock(account, async () => inspect(await load(account, sessionId)));
+    async function check({ account, sessionId, signal, }) {
+        return store.withLock(account, async () => {
+            signal?.throwIfAborted();
+            const session = await load(account, sessionId);
+            return inspect(session, signal);
+        });
     }
     async function fund({ account, sessionId, paymentChainId, signal, onStatus, }) {
         return store.withLock(account, async () => {
             checkAccount(account, signal);
             let session = await load(account, sessionId);
-            const checked = await inspect(session);
+            const checked = await inspect(session, signal);
             session = checked.session;
             if (checked.state !== "ready")
                 throw new SafeRelayrRecoveryError(session, checked.recovery?.message, checked.recovery);
@@ -622,6 +903,7 @@ function createSafeRelayrController(options) {
                 throw new Error("Choose a current payment option from this saved quote.");
             await assertUnreserved(account, session.executions, session.id);
             if (!reviewedIntents.has(reviewKey(session))) {
+                phase("reviewing", session, signal);
                 await options.review(session.executions, { resumed: true });
                 checkAccount(account, signal);
                 rememberReview(session);
@@ -669,6 +951,7 @@ function createSafeRelayrController(options) {
                     throw error;
                 }
                 sending = true;
+                phase("payment-submitting", session, signal);
             };
             const onSent = async (payments) => {
                 const snapshot = (0, relayr_js_1.relayrSentPaymentsSnapshot)(payments);
@@ -706,8 +989,10 @@ function createSafeRelayrController(options) {
                     paymentStatus: "submitted",
                 };
                 await store.save(session);
+                phase("payment-confirming", session, signal);
             };
             try {
+                phase("payment-review", session, signal);
                 const sent = await options.sendPayment({
                     session: structuredClone(session),
                     payment,
@@ -728,10 +1013,14 @@ function createSafeRelayrController(options) {
                         paymentStatus: checked.session.paymentStatus,
                     };
                     await store.save(session);
+                    throw error;
                 }
+                if (sending ||
+                    session.payments.length > checked.session.payments.length)
+                    throw new SafeRelayrRecoveryError(session, error instanceof Error ? error.message : undefined);
                 throw error;
             }
-            return inspect(session);
+            return inspect(session, signal);
         });
     }
     /** Read-only progress polling; each read releases its lock before the wait. */
@@ -744,7 +1033,7 @@ function createSafeRelayrController(options) {
         const started = Date.now();
         while (true) {
             signal?.throwIfAborted();
-            const next = await check({ account, sessionId });
+            const next = await check({ account, sessionId, signal });
             signal?.throwIfAborted();
             await onUpdate?.(next);
             const remaining = timeoutMs - (Date.now() - started);