@bananapus/nana-sdk-core 2.26.0 → 2.27.0

package/dist/cjs/review/contractWrite.d.ts

@@ -1,5 +1,12 @@
 import type { Address } from "viem";
 export type ReviewedWritePhase = "review" | "simulating" | "signing";
+/** The wallet returned a hash, but the application's submission handoff failed. */
+export declare class SubmittedContractWriteError<THash = unknown> extends Error {
+    readonly hash: THash;
+    readonly name = "SubmittedContractWriteError";
+    readonly cause: unknown;
+    constructor(hash: THash, cause: unknown);
+}
 /**
  * Whether a wallet error proves that nothing was broadcast. Only an explicit
  * rejection does: EIP-1193 code 4001, or viem's `UserRejectedRequestError`,
@@ -26,6 +33,10 @@ export type ReviewedContractWriteOptions<TRequest extends {
     onBeforeWriteAborted?: () => unknown | Promise<unknown>;
     /** Clear that intent only when the wallet explicitly rejects the write. */
     onWriteRejected?: () => unknown | Promise<unknown>;
+    /** The invoked wallet may have broadcast without returning its identity. */
+    onWriteUncertain?: (error: unknown) => unknown | Promise<unknown>;
+    /** Persist the returned identity before following its receipt. */
+    onWriteSubmitted?: (hash: THash) => unknown | Promise<unknown>;
     write: (simulated: TSimulated) => Promise<THash>;
     onPhase?: (phase: ReviewedWritePhase) => void;
     /**
@@ -50,5 +61,5 @@ export type ReviewedContractWriteOptions<TRequest extends {
  */
 export declare function submitReviewedContractWrite<TRequest extends {
     chainId: number;
-}, TSimulated, THash>({ request, expectedAccount, review, switchChain, currentAccount, simulate, reverify, beforeWrite, beforeSend, onBeforeWriteAborted, onWriteRejected, write, onPhase, accountChangedError, guard, }: ReviewedContractWriteOptions<TRequest, TSimulated, THash>): Promise<THash>;
+}, TSimulated, THash>({ request, expectedAccount, review, switchChain, currentAccount, simulate, reverify, beforeWrite, beforeSend, onBeforeWriteAborted, onWriteRejected, onWriteUncertain, onWriteSubmitted, write, onPhase, accountChangedError, guard, }: ReviewedContractWriteOptions<TRequest, TSimulated, THash>): Promise<THash>;
 //# sourceMappingURL=contractWrite.d.ts.map

package/dist/cjs/review/contractWrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contractWrite.d.ts","sourceRoot":"","sources":["../../../src/review/contractWrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;AAErE;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAcjE;AAED,MAAM,MAAM,4BAA4B,CACtC,QAAQ,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EACpC,UAAU,EACV,KAAK,IACH;IACF,OAAO,EAAE,QAAQ,CAAC;IAClB,eAAe,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC9C;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EACpC,UAAU,EACV,KAAK,EACL,EACA,OAAO,EACP,eAAe,EACf,MAAM,EACN,WAAW,EACX,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,KAAK,EACL,OAAO,EACP,mBAAoE,EACpE,KAAK,GACN,EAAE,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CA0C5E"}
+{"version":3,"file":"contractWrite.d.ts","sourceRoot":"","sources":["../../../src/review/contractWrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;AAErE,mFAAmF;AACnF,qBAAa,2BAA2B,CAAC,KAAK,GAAG,OAAO,CAAE,SAAQ,KAAK;IAKnE,QAAQ,CAAC,IAAI,EAAE,KAAK;IAJtB,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,SAAiB,KAAK,EAAE,OAAO,CAAC;gBAGrB,IAAI,EAAE,KAAK,EACpB,KAAK,EAAE,OAAO;CAOjB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAmBjE;AAED,MAAM,MAAM,4BAA4B,CACtC,QAAQ,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EACpC,UAAU,EACV,KAAK,IACH;IACF,OAAO,EAAE,QAAQ,CAAC;IAClB,eAAe,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC9C;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EACpC,UAAU,EACV,KAAK,EACL,EACA,OAAO,EACP,eAAe,EACf,MAAM,EACN,WAAW,EACX,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACL,OAAO,EACP,mBAAoE,EACpE,KAAK,GACN,EAAE,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAoD5E"}

package/dist/cjs/review/contractWrite.js

@@ -1,7 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubmittedContractWriteError = void 0;
 exports.isDefiniteWalletRejection = isDefiniteWalletRejection;
 exports.submitReviewedContractWrite = submitReviewedContractWrite;
+/** The wallet returned a hash, but the application's submission handoff failed. */
+class SubmittedContractWriteError extends Error {
+    constructor(hash, cause) {
+        super("The wallet returned a transaction identity, but recording it failed. Keep this transaction pending.");
+        this.hash = hash;
+        this.name = "SubmittedContractWriteError";
+        Object.defineProperty(this, "cause", { value: cause, configurable: true });
+    }
+}
+exports.SubmittedContractWriteError = SubmittedContractWriteError;
 /**
  * Whether a wallet error proves that nothing was broadcast. Only an explicit
  * rejection does: EIP-1193 code 4001, or viem's `UserRejectedRequestError`,
@@ -13,6 +24,9 @@ function isDefiniteWalletRejection(error) {
     let current = error;
     for (let depth = 0; depth < 8 && current && typeof current === "object"; depth += 1) {
         const item = current;
+        if (item.name === "SubmittedContractWriteError" ||
+            item.name === "SubmittedWritePersistenceError")
+            return false;
         if (item.code === 4001 || item.name === "UserRejectedRequestError") {
             return true;
         }
@@ -29,7 +43,7 @@ function isDefiniteWalletRejection(error) {
  * before the review opens, after a chain switch and again immediately before
  * signing.
  */
-async function submitReviewedContractWrite({ request, expectedAccount, review, switchChain, currentAccount, simulate, reverify, beforeWrite, beforeSend, onBeforeWriteAborted, onWriteRejected, write, onPhase, accountChangedError = "The connected account changed. Review again.", guard, }) {
+async function submitReviewedContractWrite({ request, expectedAccount, review, switchChain, currentAccount, simulate, reverify, beforeWrite, beforeSend, onBeforeWriteAborted, onWriteRejected, onWriteUncertain, onWriteSubmitted, write, onPhase, accountChangedError = "The connected account changed. Review again.", guard, }) {
     guard?.();
     if (!expectedAccount)
         throw new Error("Connect a wallet first.");
@@ -58,16 +72,28 @@ async function submitReviewedContractWrite({ request, expectedAccount, review, s
         throw error;
     }
     // No await or caller callback may separate the final synchronous gates from write.
+    let hash;
     try {
-        return await write(simulated);
+        hash = await write(simulated);
     }
     catch (error) {
         // The same-looking error from review/simulation never reaches this catch.
         // An RPC timeout or ambiguous submission must preserve the recovery lock.
         if (isDefiniteWalletRejection(error))
             await onWriteRejected?.();
+        else
+            await onWriteUncertain?.(error);
         throw error;
     }
+    // A persistence failure after the wallet returned a hash is never a wallet
+    // rejection, even if a callback happens to throw a rejection-shaped error.
+    try {
+        await onWriteSubmitted?.(hash);
+    }
+    catch (cause) {
+        throw new SubmittedContractWriteError(hash, cause);
+    }
+    return hash;
 }
 function assertExpectedAccount(current, expected, message) {
     if (!current || current.toLowerCase() !== expected.toLowerCase()) {

package/dist/cjs/review/contractWrite.js.map

@@ -1 +1 @@
-{"version":3,"file":"contractWrite.js","sourceRoot":"","sources":["../../../src/review/contractWrite.ts"],"names":[],"mappings":";;AAWA,8DAcC;AA6CD,kEA8DC;AAhID;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,CAAC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EACnD,KAAK,IAAI,CAAC,EACV,CAAC;QACD,MAAM,IAAI,GAAG,OAA8D,CAAC;QAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAoCD;;;;;;;;GAQG;AACI,KAAK,UAAU,2BAA2B,CAI/C,EACA,OAAO,EACP,eAAe,EACf,MAAM,EACN,WAAW,EACX,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,KAAK,EACL,OAAO,EACP,mBAAmB,GAAG,8CAA8C,EACpE,KAAK,GACqD;IAC1D,KAAK,EAAE,EAAE,CAAC;IACV,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACjE,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAE9E,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;IACpB,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;IAEtB,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IACxB,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAC9E,MAAM,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1B,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAE9E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAE9E,IAAI,WAAW;QAAE,MAAM,WAAW,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACrB,qBAAqB,CACnB,cAAc,EAAE,EAChB,eAAe,EACf,mBAAmB,CACpB,CAAC;QACF,UAAU,EAAE,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,WAAW;YAAE,MAAM,oBAAoB,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,mFAAmF;IACnF,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,yBAAyB,CAAC,KAAK,CAAC;YAAE,MAAM,eAAe,EAAE,EAAE,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA4B,EAC5B,QAAiB,EACjB,OAAe;IAEf,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"contractWrite.js","sourceRoot":"","sources":["../../../src/review/contractWrite.ts"],"names":[],"mappings":";;;AA2BA,8DAmBC;AAiDD,kEA0EC;AArKD,mFAAmF;AACnF,MAAa,2BAA6C,SAAQ,KAAK;IAIrE,YACW,IAAW,EACpB,KAAc;QAEd,KAAK,CACH,qGAAqG,CACtG,CAAC;QALO,SAAI,GAAJ,IAAI,CAAO;QAJb,SAAI,GAAG,6BAA6B,CAAC;QAU5C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF;AAbD,kEAaC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,CAAC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EACnD,KAAK,IAAI,CAAC,EACV,CAAC;QACD,MAAM,IAAI,GAAG,OAA8D,CAAC;QAC5E,IACE,IAAI,CAAC,IAAI,KAAK,6BAA6B;YAC3C,IAAI,CAAC,IAAI,KAAK,gCAAgC;YAE9C,OAAO,KAAK,CAAC;QACf,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAwCD;;;;;;;;GAQG;AACI,KAAK,UAAU,2BAA2B,CAI/C,EACA,OAAO,EACP,eAAe,EACf,MAAM,EACN,WAAW,EACX,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACL,OAAO,EACP,mBAAmB,GAAG,8CAA8C,EACpE,KAAK,GACqD;IAC1D,KAAK,EAAE,EAAE,CAAC;IACV,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACjE,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAE9E,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;IACpB,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;IAEtB,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IACxB,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAC9E,MAAM,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1B,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAE9E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAE9E,IAAI,WAAW;QAAE,MAAM,WAAW,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACrB,qBAAqB,CACnB,cAAc,EAAE,EAChB,eAAe,EACf,mBAAmB,CACpB,CAAC;QACF,UAAU,EAAE,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,WAAW;YAAE,MAAM,oBAAoB,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,mFAAmF;IACnF,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,yBAAyB,CAAC,KAAK,CAAC;YAAE,MAAM,eAAe,EAAE,EAAE,CAAC;;YAC3D,MAAM,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,CAAC;QACH,MAAM,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA4B,EAC5B,QAAiB,EACjB,OAAe;IAEf,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/cjs/review/index.d.ts

@@ -4,4 +4,5 @@ export * from "./receipt.js";
 export * from "./simulation.js";
 export * from "./transactionReview.js";
 export * from "./transaction-message.js";
+export * from "./writeRecovery.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/review/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/review/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/review/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC"}

package/dist/cjs/review/index.js

@@ -20,4 +20,5 @@ __exportStar(require("./receipt.js"), exports);
 __exportStar(require("./simulation.js"), exports);
 __exportStar(require("./transactionReview.js"), exports);
 __exportStar(require("./transaction-message.js"), exports);
+__exportStar(require("./writeRecovery.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/review/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/review/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,2CAAyB;AACzB,+CAA6B;AAC7B,kDAAgC;AAChC,yDAAuC;AACvC,2DAAyC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/review/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,2CAAyB;AACzB,+CAA6B;AAC7B,kDAAgC;AAChC,yDAAuC;AACvC,2DAAyC;AACzC,qDAAmC"}

package/dist/cjs/review/writeRecovery.d.ts

@@ -0,0 +1,106 @@
+import { type Address, type Hex, type PublicClient, type TransactionReceipt } from "viem";
+import { type SafeServiceOptions } from "../safeService.js";
+export type ReviewedWriteRecoveryInput = {
+    chainId: number;
+    account: Address;
+    safe: boolean;
+    call: {
+        to: Address;
+        data: Hex;
+        value?: bigint | string;
+    };
+};
+export type ReviewedWriteRecoveryRecord = Omit<ReviewedWriteRecoveryInput, "call"> & {
+    version: 1;
+    id: string;
+    call: {
+        to: Address;
+        data: Hex;
+        value: string;
+    };
+    /** The identity returned by the wallet, never an inferred historical match. */
+    hash?: Hex;
+};
+type RecoveryStorage = Pick<Storage, "getItem" | "setItem" | "removeItem">;
+type RecoveryLocks = Pick<LockManager, "request">;
+/** The wallet returned this identity, but storing it failed. Keep it in memory and retry submitted(hash, record). */
+export declare class SubmittedWritePersistenceError extends Error {
+    readonly name = "SubmittedWritePersistenceError";
+    readonly record: ReviewedWriteRecoveryRecord;
+    readonly cause: unknown;
+    constructor(record: ReviewedWriteRecoveryRecord, cause: unknown);
+}
+declare function recordOf(value: unknown): ReviewedWriteRecoveryRecord;
+/** Validate an existing domain journal's recovered record with the shared storage rules. */
+export { recordOf as parseReviewedWriteRecoveryRecord };
+/** Exact reviewed evidence, independent of the reservation and submission identities. */
+export declare function sameReviewedWrite(record: ReviewedWriteRecoveryRecord, input: ReviewedWriteRecoveryInput): boolean;
+/**
+ * One ordinary-write reservation per account/chain/target/selector. Use the
+ * existing domain journal instead when an action already has one. There is no
+ * expiry or nonce-based release: an unknown broadcast remains unknown.
+ *
+ * Every mutation must run inside withLock, including receipt-based clearing.
+ * Storage and native cross-tab exclusion are mandatory before opening a wallet.
+ */
+export declare function createBrowserWriteRecovery(input: ReviewedWriteRecoveryInput, options?: {
+    storage?: RecoveryStorage;
+    locks?: RecoveryLocks;
+}): {
+    read: () => ReviewedWriteRecoveryRecord | null;
+    reserve(actualCall?: ReviewedWriteRecoveryInput["call"]): ReviewedWriteRecoveryRecord;
+    submitted(hash: Hex, expected?: ReviewedWriteRecoveryRecord | undefined): ReviewedWriteRecoveryRecord;
+    rejected: () => void;
+    clear: (expected: ReviewedWriteRecoveryRecord) => void;
+    withLock<T>(work: () => Promise<T>, wait?: boolean): Promise<T>;
+};
+/** Minimal RPC reads; PublicClient instances for any chain satisfy this shape. */
+export type ReviewedWriteReceiptClient = {
+    getChainId(): Promise<number>;
+    getTransaction(args: {
+        hash: Hex;
+    }): Promise<{
+        hash: Hex;
+        chainId?: number;
+        from: Address;
+        to: Address | null;
+        input: Hex;
+        blockHash: Hex | null;
+        blockNumber: bigint | null;
+        transactionIndex: number | null;
+    }>;
+    getTransactionReceipt(args: {
+        hash: Hex;
+    }): Promise<TransactionReceipt>;
+    getBlock(args: {
+        blockNumber: bigint;
+    }): Promise<{
+        hash: Hex | null;
+        number: bigint | null;
+    }>;
+    getBlock(args: {
+        blockTag: "finalized";
+    }): Promise<{
+        number: bigint | null;
+        hash: Hex | null;
+        timestamp: bigint;
+    }>;
+};
+/**
+ * Authenticate the saved wallet identity, canonical inclusion and Safe effect.
+ * Ordinary wallet wrappers are allowed: the wallet's returned hash binds their
+ * execution. A wallet-returned Safe proposal hash authenticates its execution
+ * event even through a wrapper; an immediate execution hash additionally needs
+ * exact reviewed calldata. A failure releases only after finality.
+ * Throws on missing or inconsistent evidence; the caller retains its record.
+ */
+export declare function verifyReviewedWriteReceipt(client: ReviewedWriteReceiptClient, saved: ReviewedWriteRecoveryRecord, receipt: TransactionReceipt, proof?: {
+    calls: readonly ReviewedWriteRecoveryInput["call"][];
+    batch?: boolean;
+}): Promise<"success" | "failed">;
+/**
+ * Prove a stamped Safe call expired before execution. An advanced nonce, stale
+ * service result, UI phase or local clock never releases a saved write.
+ */
+export declare function verifyReviewedWriteExpiry(client: Pick<PublicClient, "getChainId" | "getBlock" | "request">, saved: ReviewedWriteRecoveryRecord, service?: SafeServiceOptions): Promise<true>;
+//# sourceMappingURL=writeRecovery.d.ts.map

package/dist/cjs/review/writeRecovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeRecovery.d.ts","sourceRoot":"","sources":["../../../src/review/writeRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,GAAG,EACR,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,MAAM,CAAC;AACd,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAI3B,MAAM,MAAM,0BAA0B,GAAG;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC5C,0BAA0B,EAC1B,MAAM,CACP,GAAG;IACF,OAAO,EAAE,CAAC,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,+EAA+E;IAC/E,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC;AAEF,KAAK,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;AAC3E,KAAK,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAQlD,qHAAqH;AACrH,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,oCAAoC;IACjD,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,SAAiB,KAAK,EAAE,OAAO,CAAC;gBAEpB,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,OAAO;CAOhE;AA8BD,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,2BAA2B,CAqB7D;AAED,4FAA4F;AAC5F,OAAO,EAAE,QAAQ,IAAI,gCAAgC,EAAE,CAAC;AAOxD,yFAAyF;AACzF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,2BAA2B,EACnC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAIT;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,eAAe,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAAO;gBA2CjD,2BAA2B,GAAG,IAAI;yBAuDlC,0BAA0B,CAAC,MAAM,CAAC,GAC9C,2BAA2B;oBAkCtB,GAAG,aACC,2BAA2B,GAAG,SAAS,GAChD,2BAA2B;oBAlDX,IAAI;sBAjBA,2BAA2B,KAAG,IAAI;aAoH1C,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,mBAAiB,OAAO,CAAC,CAAC,CAAC;EAsBtE;AAED,kFAAkF;AAClF,MAAM,MAAM,0BAA0B,GAAG;IACvC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,cAAc,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC;QAC3C,IAAI,EAAE,GAAG,CAAC;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,CAAC;QACd,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,EAAE,GAAG,CAAC;QACX,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC;QACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,CAAC,CAAC;IACH,qBAAqB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxE,QAAQ,CAAC,IAAI,EAAE;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACzD,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC;QACjD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;CACJ,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,0BAA0B,EAClC,KAAK,EAAE,2BAA2B,EAClC,OAAO,EAAE,kBAAkB,EAC3B,KAAK,CAAC,EAAE;IACN,KAAK,EAAE,SAAS,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC;IACrD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GACA,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,CAoG/B;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,UAAU,GAAG,SAAS,CAAC,EACjE,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/dist/cjs/review/writeRecovery.js

@@ -0,0 +1,385 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubmittedWritePersistenceError = void 0;
+exports.parseReviewedWriteRecoveryRecord = recordOf;
+exports.sameReviewedWrite = sameReviewedWrite;
+exports.createBrowserWriteRecovery = createBrowserWriteRecovery;
+exports.verifyReviewedWriteReceipt = verifyReviewedWriteReceipt;
+exports.verifyReviewedWriteExpiry = verifyReviewedWriteExpiry;
+const viem_1 = require("viem");
+const safeService_js_1 = require("../safeService.js");
+const untrusted_js_1 = require("../untrusted.js");
+const relayr_js_1 = require("./relayr.js");
+// A returned hash must survive a component remount even when its durable update
+// failed. It is visible only while the exact durable reservation still exists.
+const unpersistedSubmissions = new WeakMap();
+/** The wallet returned this identity, but storing it failed. Keep it in memory and retry submitted(hash, record). */
+class SubmittedWritePersistenceError extends Error {
+    constructor(record, cause) {
+        super("The wallet returned a transaction identity, but recovery storage is unavailable. Keep this transaction pending.");
+        this.name = "SubmittedWritePersistenceError";
+        this.record = recordOf(record);
+        Object.defineProperty(this, "cause", { value: cause, configurable: true });
+    }
+}
+exports.SubmittedWritePersistenceError = SubmittedWritePersistenceError;
+function normalized(input) {
+    const value = (0, untrusted_js_1.uint256)(input?.call?.value ?? 0n);
+    if (!Number.isSafeInteger(input?.chainId) ||
+        input.chainId <= 0 ||
+        !(0, viem_1.isAddress)(input?.account, { strict: false }) ||
+        typeof input?.safe !== "boolean" ||
+        !(0, viem_1.isAddress)(input?.call?.to, { strict: false }) ||
+        !(0, untrusted_js_1.isHexBytes)(input?.call?.data) ||
+        value === null)
+        throw new Error("Invalid reviewed write recovery evidence.");
+    return {
+        chainId: input.chainId,
+        account: input.account.toLowerCase(),
+        safe: input.safe,
+        call: {
+            to: input.call.to.toLowerCase(),
+            data: input.call.data.toLowerCase(),
+            value: value.toString(),
+        },
+    };
+}
+function recordOf(value) {
+    const record = value;
+    if (record?.version !== 1 ||
+        typeof record.id !== "string" ||
+        !record.id ||
+        typeof record.call?.value !== "string" ||
+        !/^(0|[1-9]\d*)$/.test(record.call.value) ||
+        (record.hash !== undefined && !(0, untrusted_js_1.isBytes32)(record.hash)))
+        throw new Error("Invalid saved write recovery record. Keep this action pending.");
+    return {
+        version: 1,
+        id: record.id,
+        ...normalized(record),
+        ...(record.hash === undefined
+            ? {}
+            : { hash: record.hash.toLowerCase() }),
+    };
+}
+/** Amounts and quote changes must not evade an unresolved action. */
+function scope(input) {
+    return `nana-sdk:reviewed-write:v1:${input.chainId}:${input.account}:${input.call.to}:${input.call.data.slice(0, 10)}`;
+}
+/** Exact reviewed evidence, independent of the reservation and submission identities. */
+function sameReviewedWrite(record, input) {
+    return (JSON.stringify(normalized(record)) === JSON.stringify(normalized(input)));
+}
+/**
+ * One ordinary-write reservation per account/chain/target/selector. Use the
+ * existing domain journal instead when an action already has one. There is no
+ * expiry or nonce-based release: an unknown broadcast remains unknown.
+ *
+ * Every mutation must run inside withLock, including receipt-based clearing.
+ * Storage and native cross-tab exclusion are mandatory before opening a wallet.
+ */
+function createBrowserWriteRecovery(input, options = {}) {
+    const reviewed = normalized(input);
+    const key = scope(reviewed);
+    let owned;
+    let locked = false;
+    let lastStorage;
+    function storage() {
+        const store = options.storage ?? globalThis.localStorage;
+        if (!store)
+            throw new Error("Write recovery storage is unavailable.");
+        lastStorage = store;
+        return store;
+    }
+    function rememberSubmission(record, verifiedReservation = false) {
+        if (!lastStorage)
+            return;
+        let pending = unpersistedSubmissions.get(lastStorage);
+        const previous = pending?.get(key);
+        // An unreadable stale callback cannot replace another attempt's only hash.
+        if (previous &&
+            !verifiedReservation &&
+            JSON.stringify(previous) !== JSON.stringify(record))
+            return;
+        if (!pending)
+            unpersistedSubmissions.set(lastStorage, (pending = new Map()));
+        pending.set(key, recordOf(record));
+    }
+    function requireLock() {
+        if (!locked)
+            throw new Error("Write recovery changes require the browser lock.");
+    }
+    function readStored(raw) {
+        if (raw === null)
+            return null;
+        const record = recordOf(JSON.parse(raw));
+        if (scope(record) !== key)
+            throw new Error("Saved write recovery scope does not match.");
+        return record;
+    }
+    function read() {
+        const store = storage();
+        const record = readStored(store.getItem(key));
+        const memory = unpersistedSubmissions.get(store)?.get(key);
+        if (!record ||
+            !memory ||
+            JSON.stringify({ ...record, hash: undefined }) !==
+                JSON.stringify({ ...memory, hash: undefined }) ||
+            (record.hash && record.hash !== memory.hash)) {
+            // A readable durable snapshot also proves whether cached evidence is stale.
+            unpersistedSubmissions.get(store)?.delete(key);
+            return record;
+        }
+        if (record.hash)
+            unpersistedSubmissions.get(store)?.delete(key);
+        return recordOf(memory);
+    }
+    function persist(record) {
+        const raw = JSON.stringify(record);
+        const store = storage();
+        store.setItem(key, raw);
+        if (store.getItem(key) !== raw)
+            throw new Error("Write recovery storage did not retain the action.");
+    }
+    function clear(expected) {
+        requireLock();
+        // A volatile returned hash is useful for tracking, but is not a successful
+        // durable commit. submitted(hash, record) must retry that commit first.
+        const current = readStored(storage().getItem(key));
+        if (!current)
+            return;
+        if (JSON.stringify(current) !== JSON.stringify(recordOf(expected))) {
+            throw new Error("Write recovery changed. Keep the current action pending.");
+        }
+        const store = storage();
+        store.removeItem(key);
+        if (store.getItem(key) !== null)
+            throw new Error("Write recovery storage did not clear the action.");
+        unpersistedSubmissions.get(store)?.delete(key);
+    }
+    function rejected() {
+        requireLock();
+        // A rejection callback from another attempt must never release this one.
+        if (!owned || owned.hash)
+            return;
+        const current = read();
+        if (current?.id === owned.id && current.hash)
+            return;
+        clear(owned);
+        owned = undefined;
+    }
+    return {
+        read,
+        reserve(actualCall) {
+            requireLock();
+            // A reused Safe proposal may have a different, already verified deadline.
+            // Retain its actual call, without widening the unresolved-action scope.
+            const actual = actualCall
+                ? normalized({ ...reviewed, call: actualCall })
+                : reviewed;
+            if (scope(actual) !== key)
+                throw new Error("The adopted write has a different recovery scope.");
+            if (read())
+                throw new Error("An earlier wallet write is still unresolved. Check it before trying again.");
+            const record = {
+                version: 1,
+                id: globalThis.crypto.randomUUID(),
+                ...actual,
+            };
+            owned = recordOf(record);
+            try {
+                persist(record);
+            }
+            catch (error) {
+                // The wallet has not been invoked. A failed readback may still have
+                // stored this marker; clean only our exact reservation if readable.
+                try {
+                    rejected();
+                }
+                catch {
+                    /* Retain ownership for a later cleanup. */
+                }
+                throw error;
+            }
+            return recordOf(record);
+        },
+        submitted(hash, expected = owned) {
+            requireLock();
+            if (!(0, untrusted_js_1.isBytes32)(hash))
+                throw new Error("The wallet returned an invalid transaction identity.");
+            const previous = expected && recordOf(expected);
+            const submittedHash = hash.toLowerCase();
+            if (!previous ||
+                scope(previous) !== key ||
+                (previous.hash && previous.hash !== submittedHash)) {
+                throw new Error("Write recovery changed before submission was recorded.");
+            }
+            const submitted = { ...previous, hash: submittedHash };
+            let raw;
+            try {
+                raw = storage().getItem(key);
+            }
+            catch (cause) {
+                owned = submitted;
+                rememberSubmission(submitted);
+                throw new SubmittedWritePersistenceError(submitted, cause);
+            }
+            const current = readStored(raw);
+            if (!current ||
+                JSON.stringify({ ...current, hash: undefined }) !==
+                    JSON.stringify({ ...previous, hash: undefined }) ||
+                (current.hash && current.hash !== submittedHash)) {
+                throw new Error("Write recovery changed before submission was recorded.");
+            }
+            owned = recordOf(submitted);
+            if (!current.hash) {
+                try {
+                    persist(submitted);
+                }
+                catch (cause) {
+                    rememberSubmission(submitted, true);
+                    throw new SubmittedWritePersistenceError(submitted, cause);
+                }
+            }
+            if (lastStorage)
+                unpersistedSubmissions.get(lastStorage)?.delete(key);
+            return submitted;
+        },
+        rejected,
+        clear,
+        async withLock(work, wait = false) {
+            const locks = options.locks ?? globalThis.navigator?.locks;
+            if (!locks)
+                throw new Error("This browser cannot safely coordinate wallet writes.");
+            return locks.request(key, { mode: "exclusive", ...(!wait && { ifAvailable: true }) }, async (lock) => {
+                if (!lock)
+                    throw new Error("This wallet action is already open in another tab.");
+                locked = true;
+                try {
+                    return await work();
+                }
+                finally {
+                    locked = false;
+                }
+            });
+        },
+    };
+}
+/**
+ * Authenticate the saved wallet identity, canonical inclusion and Safe effect.
+ * Ordinary wallet wrappers are allowed: the wallet's returned hash binds their
+ * execution. A wallet-returned Safe proposal hash authenticates its execution
+ * event even through a wrapper; an immediate execution hash additionally needs
+ * exact reviewed calldata. A failure releases only after finality.
+ * Throws on missing or inconsistent evidence; the caller retains its record.
+ */
+async function verifyReviewedWriteReceipt(client, saved, receipt, proof) {
+    const record = recordOf(saved);
+    const pending = () => new Error("The saved wallet write is not yet proven. Keep this action pending.");
+    let calls = [record.call];
+    if (proof) {
+        if (!record.safe ||
+            !Array.isArray(proof.calls) ||
+            !proof.calls.length ||
+            (proof.batch !== undefined && typeof proof.batch !== "boolean"))
+            throw pending();
+        calls = proof.calls.map((call) => normalized({ ...record, call }).call);
+        if (JSON.stringify(calls[0]) !== JSON.stringify(record.call))
+            throw pending();
+    }
+    if (!record.hash ||
+        !(0, untrusted_js_1.isBytes32)(receipt?.transactionHash) ||
+        (!record.safe && record.hash !== receipt.transactionHash.toLowerCase()))
+        throw pending();
+    const hash = receipt.transactionHash;
+    const [chainId, transaction, canonical] = await Promise.all([
+        client.getChainId(),
+        client.getTransaction({ hash }),
+        client.getTransactionReceipt({ hash }),
+    ]);
+    if (chainId !== record.chainId ||
+        (transaction.chainId !== undefined &&
+            transaction.chainId !== record.chainId) ||
+        transaction.hash?.toLowerCase() !== hash.toLowerCase() ||
+        canonical.transactionHash?.toLowerCase() !== hash.toLowerCase() ||
+        !(0, untrusted_js_1.isBytes32)(canonical.blockHash) ||
+        canonical.blockHash.toLowerCase() !== receipt.blockHash?.toLowerCase() ||
+        canonical.blockHash.toLowerCase() !==
+            transaction.blockHash?.toLowerCase() ||
+        typeof canonical.blockNumber !== "bigint" ||
+        canonical.blockNumber < 0n ||
+        canonical.blockNumber !== receipt.blockNumber ||
+        canonical.blockNumber !== transaction.blockNumber ||
+        !(0, viem_1.isAddress)(transaction.from, { strict: false }) ||
+        transaction.from.toLowerCase() !== canonical.from?.toLowerCase() ||
+        transaction.to?.toLowerCase() !== canonical.to?.toLowerCase() ||
+        !Number.isSafeInteger(transaction.transactionIndex) ||
+        transaction.transactionIndex < 0 ||
+        transaction.transactionIndex !== canonical.transactionIndex ||
+        canonical.status !== receipt.status ||
+        (canonical.status !== "success" && canonical.status !== "reverted"))
+        throw pending();
+    let status = canonical.status === "success" ? "success" : "failed";
+    if (record.safe) {
+        if (!Array.isArray(canonical.logs) ||
+            canonical.logs.some((log) => log.removed !== false ||
+                log.transactionHash?.toLowerCase() !== hash.toLowerCase() ||
+                log.blockHash?.toLowerCase() !== canonical.blockHash.toLowerCase() ||
+                log.blockNumber !== canonical.blockNumber ||
+                log.transactionIndex !== canonical.transactionIndex))
+            throw pending();
+        const result = await (0, safeService_js_1.readSafeAppExecution)({
+            client: { getTransaction: async () => transaction },
+            receipt: canonical,
+            safe: record.account,
+            proposalHash: record.hash,
+            calls,
+            batch: proof?.batch,
+        });
+        // A reverted outer executor has not consumed the Safe proposal's nonce.
+        if (result.status !== "success" && result.status !== "failed")
+            throw pending();
+        status = result.status;
+    }
+    const isCanonical = async () => {
+        const block = await client.getBlock({ blockNumber: canonical.blockNumber });
+        return (block.number === canonical.blockNumber &&
+            block.hash?.toLowerCase() === canonical.blockHash.toLowerCase());
+    };
+    if (status === "failed") {
+        const finalized = await (0, relayr_js_1.atCanonicalFinalizedBlock)(client, async (number) => number >= canonical.blockNumber && (await isCanonical()));
+        if (!finalized?.value)
+            throw pending();
+    }
+    else if (!(await isCanonical()))
+        throw pending();
+    return status;
+}
+/**
+ * Prove a stamped Safe call expired before execution. An advanced nonce, stale
+ * service result, UI phase or local clock never releases a saved write.
+ */
+async function verifyReviewedWriteExpiry(client, saved, service) {
+    const record = recordOf(saved);
+    const pending = () => new Error("The saved Safe proposal is not proven expired. Keep this action pending.");
+    if (!record.safe ||
+        !record.hash ||
+        (await client.getChainId()) !== record.chainId)
+        throw pending();
+    const proposal = await (0, safeService_js_1.readSafeTransaction)(record.chainId, record.account, record.hash, service);
+    if (!(0, safeService_js_1.safeTransactionMatchesCall)(proposal, {
+        ...record.call,
+        value: BigInt(record.call.value),
+    }))
+        throw pending();
+    const proof = await (0, relayr_js_1.atCanonicalFinalizedBlock)(client, async (blockNumber) => {
+        const block = await client.getBlock({ blockNumber });
+        if (block.number !== blockNumber)
+            return false;
+        return ((await (0, safeService_js_1.lookAtSafeProposal)({ request: client.request, getBlock: async () => block }, record.chainId, record.account, record.hash, service)) === "expired");
+    });
+    if (!proof?.value)
+        throw pending();
+    return true;
+}
+//# sourceMappingURL=writeRecovery.js.map