@bopen-io/wallet-toolbox 2.1.21-parity-fix.2 → 2.6.2-brc153.2

package/out/src/storage/StorageProvider.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.StorageProvider = void 0;
 exports.validateStorageFeeModel = validateStorageFeeModel;
 const sdk_1 = require("@bsv/sdk");
+const storageProviderHelpers_1 = require("./storageProviderHelpers");
 const getBeefForTransaction_1 = require("./methods/getBeefForTransaction");
 const processAction_1 = require("./methods/processAction");
 const attemptToPostReqsToNetwork_1 = require("./methods/attemptToPostReqsToNetwork");
@@ -15,13 +16,24 @@ const WERR_errors_1 = require("../sdk/WERR_errors");
 const utilityHelpers_1 = require("../utility/utilityHelpers");
 const WalletError_1 = require("../sdk/WalletError");
 const utilityHelpers_noBuffer_1 = require("../utility/utilityHelpers.noBuffer");
+const actionBatch_1 = require("./methods/actionBatch");
+const actionBatchBlobs_1 = require("./methods/actionBatchBlobs");
+const availableManagedChange_1 = require("./methods/availableManagedChange");
 class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
+    isDirty = false;
+    _services;
+    feeModel;
+    commissionSatoshis;
+    commissionPubKeyHex;
+    maxRecursionDepth;
+    scriptVerifier;
     static defaultOptions() {
-        return {
-            feeModel: { model: 'sat/kb', value: 1 },
+        const opts = {
+            feeModel: { model: 'sat/kb', value: 100 },
             commissionSatoshis: 0,
             commissionPubKeyHex: undefined
         };
+        return opts;
     }
     static createStorageBaseOptions(chain) {
         const options = {
@@ -32,17 +44,183 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
     }
     constructor(options) {
         super(options);
-        this.isDirty = false;
         this.feeModel = options.feeModel;
         this.commissionPubKeyHex = options.commissionPubKeyHex;
         this.commissionSatoshis = options.commissionSatoshis;
         this.maxRecursionDepth = 12;
+        this.scriptVerifier = options.scriptVerifier;
+    }
+    /** Mark a planned set of change inputs spent within the caller's transaction. */
+    async markChangeInputsSpent(outputIds, transactionId, trx) {
+        let updated = 0;
+        const current = await this.findOutputsByIds(outputIds, trx);
+        for (const outputId of outputIds) {
+            const output = current[outputId];
+            if (output == null || !output.spendable || output.spentBy != null)
+                continue;
+            updated += await this.updateOutput(outputId, { spendable: false, spentBy: transactionId }, trx);
+        }
+        return updated;
+    }
+    /**
+     * Insert outputs that do not need their generated ids returned to the
+     * caller. Engines with a multi-row insert override this common-path helper;
+     * the fallback preserves existing storage implementations unchanged.
+     */
+    async insertOutputs(outputs, trx) {
+        for (const output of outputs)
+            await this.insertOutput(output, trx);
+    }
+    /** Return unreserved wallet-managed outputs eligible for automatic funding. */
+    async findAvailableManagedChangeInputs(userId, basketId, excludeSending, trx) {
+        return await (0, availableManagedChange_1.availableManagedChange)(this, userId, basketId, excludeSending, trx);
+    }
+    /** Read only the fields needed by the in-memory funding planner. */
+    async findAvailableManagedChangeInputCandidates(userId, basketId, excludeSending, trx) {
+        return (await this.findAvailableManagedChangeInputs(userId, basketId, excludeSending, trx))
+            .map(({ outputId, transactionId, satoshis, txid, vout }) => ({
+            outputId,
+            transactionId,
+            satoshis,
+            txid,
+            vout
+        }));
+    }
+    /** Read the current status of a set of source transactions without loading raw transaction bytes. */
+    async findTransactionStatusesByIds(userId, transactionIds, trx) {
+        const statuses = new Map();
+        for (const transactionId of new Set(transactionIds)) {
+            const transaction = await this.findTransactionById(transactionId, trx, true);
+            if (transaction?.userId === userId)
+                statuses.set(transactionId, transaction.status);
+        }
+        return statuses;
+    }
+    /**
+     * Lock and return the selected funding rows whose source transaction and
+     * action-batch reservation state still permit allocation.
+     */
+    async findFundingOutputsForUpdate(userId, outputIds, statuses, trx) {
+        const rows = await this.findOutputsByIds(outputIds, trx);
+        const reserved = new Set(await this.findReservedActionBatchOutputIds(outputIds, trx));
+        const transactionIds = [...new Set(Object.values(rows).map(output => output.transactionId))];
+        const transactionStatuses = await this.findTransactionStatusesByIds(userId, transactionIds, trx);
+        const eligible = {};
+        for (const output of Object.values(rows)) {
+            if (output.userId === userId &&
+                !reserved.has(output.outputId) &&
+                statuses.includes(transactionStatuses.get(output.transactionId)))
+                eligible[output.outputId] = output;
+        }
+        return eligible;
+    }
+    /**
+     * Resolve several transaction proofs in one storage operation when the
+     * backend supports it. The default preserves compatibility for custom
+     * providers; SQL and IndexedDB providers override this hot path.
+     */
+    async getProvenOrRawTxs(txids, trx) {
+        const results = new Map();
+        const unique = [...new Set(txids)];
+        let cursor = 0;
+        await Promise.all(Array.from({ length: Math.min(8, unique.length) }, async () => {
+            while (cursor < unique.length) {
+                const txid = unique[cursor++];
+                results.set(txid, await this.getProvenOrRawTx(txid, trx));
+            }
+        }));
+        return results;
+    }
+    async insertActionBatch(_batch, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async findActionBatch(_userId, _batchId, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async findActionBatchForUpdate(userId, batchId, trx) {
+        return await this.findActionBatch(userId, batchId, trx);
+    }
+    async findExpiredActionBatches(_now, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async updateActionBatch(_actionBatchId, _update, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async deleteActionBatch(_actionBatchId, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async reserveActionBatchOutputs(_reservations, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async findActionBatchOutputIds(_actionBatchId, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async findReservedActionBatchOutputIds(_outputIds, _trx) {
+        return [];
+    }
+    async deleteActionBatchOutputReservations(_actionBatchId, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async putActionBatchBlobRecord(_blob, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async findActionBatchBlobRecord(_actionBatchId, _digest, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async findActionBatchBlobRecords(actionBatchId, digests, trx) {
+        return (await Promise.all(digests.map(async (digest) => await this.findActionBatchBlobRecord(actionBatchId, digest, trx)))).filter((blob) => blob != null);
+    }
+    async putActionBatchBlobRecords(blobs, trx) {
+        for (const blob of blobs)
+            await this.putActionBatchBlobRecord(blob, trx);
+    }
+    async deleteActionBatchBlobRecords(_actionBatchId, _trx) {
+        throw new WERR_errors_1.WERR_NOT_IMPLEMENTED();
+    }
+    async getCapabilities() {
+        return this.supportsActionBatchPersistence() ? (0, actionBatch_1.getActionBatchCapabilities)() : {};
+    }
+    supportsActionBatchPersistence() {
+        return false;
+    }
+    /** Custom providers may require physical expiry cleanup before reservations are queried. */
+    requiresActionBatchCleanupBeforeCreateAction() {
+        return true;
+    }
+    async beginActionBatch(auth, args) {
+        if (!this.supportsActionBatchPersistence())
+            throw new WERR_errors_1.WERR_NOT_IMPLEMENTED('actionBatch capability is not available');
+        return await (0, actionBatch_1.beginActionBatch)(this, auth, args);
+    }
+    async extendActionBatch(auth, args) {
+        return await (0, actionBatch_1.extendActionBatch)(this, auth, args);
+    }
+    async renewActionBatch(auth, batchId) {
+        return await (0, actionBatch_1.renewActionBatch)(this, auth, batchId);
+    }
+    async prepareActionBatchCommit(auth, manifest) {
+        return await (0, actionBatchBlobs_1.prepareActionBatchCommit)(this, auth, manifest);
+    }
+    async putActionBatchBlob(auth, args) {
+        return await (0, actionBatchBlobs_1.putActionBatchBlob)(this, auth, args);
+    }
+    async putActionBatchPack(auth, args) {
+        return await (0, actionBatchBlobs_1.putActionBatchPack)(this, auth, args);
+    }
+    async commitActionBatch(auth, manifest) {
+        return await (0, actionBatch_1.commitActionBatch)(this, auth, manifest);
+    }
+    async commitActionBatchByDigest(auth, args) {
+        return await (0, actionBatch_1.commitActionBatchByDigest)(this, auth, args);
+    }
+    async abortActionBatch(auth, batchId) {
+        return await (0, actionBatch_1.abortActionBatch)(this, auth, batchId);
     }
     async findOutputsByIds(outputIds, trx) {
         const byId = {};
         for (const outputId of outputIds) {
             const o = (0, utilityHelpers_1.verifyOneOrNone)(await this.findOutputs({ partial: { outputId }, trx }));
-            if ((o === null || o === void 0 ? void 0 : o.outputId) !== undefined)
+            if (o?.outputId !== undefined)
                 byId[o.outputId] = o;
         }
         return byId;
@@ -50,18 +228,23 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
     async findStaleMerkleRoots(args) {
         let provenTxs = await this.findProvenTxs({ partial: { height: args.height } });
         provenTxs = provenTxs.filter(ptx => ptx.merkleRoot !== args.merkleRoot);
-        let roots = Array.from(new Set(provenTxs.map(ptx => ptx.merkleRoot)));
+        const roots = Array.from(new Set(provenTxs.map(ptx => ptx.merkleRoot)));
         return roots;
     }
     async findOutputsByOutpoints(userId, outpoints, trx) {
         const byOutpoint = {};
         for (const { txid, vout } of outpoints) {
             const o = (0, utilityHelpers_1.verifyOneOrNone)(await this.findOutputs({ partial: { userId, txid, vout }, trx }));
-            if ((o === null || o === void 0 ? void 0 : o.txid) !== undefined && o.vout !== undefined)
+            if (o?.txid !== undefined && o.vout !== undefined)
                 byOutpoint[`${o.txid}.${o.vout}`] = o;
         }
         return byOutpoint;
     }
+    async findOutputsByOutpointsForUpdate(userId, outpoints, trx, _noScript = false) {
+        // Backends that cannot skip hydration remain correct; optimized backends may
+        // use _noScript to keep raw-transaction I/O outside the write lock.
+        return await this.findOutputsByOutpoints(userId, outpoints, trx);
+    }
     async findOrInsertOutputBasketsBulk(userId, names, trx) {
         const byName = {};
         for (const name of names)
@@ -74,6 +257,12 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
             byTag[tag] = await this.findOrInsertOutputTag(userId, tag, trx);
         return byTag;
     }
+    async findOrInsertTxLabelsBulk(userId, labels, trx) {
+        const byLabel = {};
+        for (const label of labels)
+            byLabel[label] ??= await this.findOrInsertTxLabel(userId, label, trx);
+        return byLabel;
+    }
     async sumSpendableSatoshisInBasket(userId, basketId, excludeSending, trx) {
         const status = ['completed', 'unproven'];
         if (!excludeSending)
@@ -84,7 +273,7 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
             noScript: true,
             trx
         });
-        return rows.reduce((a, r) => a + Number(r.satoshis || 0), 0);
+        return rows.filter(r => r.spentBy == null).reduce((a, r) => a + (r.satoshis ?? 0), 0);
     }
     async recentlyActiveUsers(limit = 50, trx) {
         const outputs = await this.findOutputs({
@@ -98,7 +287,7 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
                 continue;
             const createdAt = this.validateDate(output.created_at);
             const prior = latestByUserId.get(output.userId);
-            if (!prior || createdAt > prior) {
+            if (prior == null || createdAt > prior) {
                 latestByUserId.set(output.userId, createdAt);
             }
         }
@@ -106,8 +295,8 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
             .sort((a, b) => b[1].getTime() - a[1].getTime())
             .slice(0, limit)
             .map(([userId]) => userId);
-        const users = await Promise.all(sortedUserIds.map(userId => this.findUserById(userId, trx)));
-        return users.filter((user) => !!user);
+        const users = await Promise.all(sortedUserIds.map(async (userId) => await this.findUserById(userId, trx)));
+        return users.filter((user) => user != null);
     }
     isStorageProvider() {
         return true;
@@ -116,49 +305,129 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
         this._services = v;
     }
     getServices() {
-        if (!this._services)
+        if (this._services == null)
             throw new WERR_errors_1.WERR_INVALID_OPERATION('Must setServices first.');
         return this._services;
     }
-    async abortAction(auth, args) {
-        if (!auth.userId)
-            throw new WERR_errors_1.WERR_INVALID_PARAMETER('auth.userId', 'valid');
-        const userId = auth.userId;
+    async findAbortableTransaction(userId, args, trx) {
         let reference = args.reference;
-        let txid = undefined;
-        const r = await this.transaction(async (trx) => {
-            let tx = (0, utilityHelpers_1.verifyOneOrNone)(await this.findTransactions({
-                partial: { reference, userId },
+        let tx = (0, utilityHelpers_1.verifyOneOrNone)(await this.findTransactions({
+            partial: { reference, userId },
+            noRawTx: true,
+            trx
+        }));
+        if (tx == null && args.reference.length === 64) {
+            reference = undefined;
+            tx = (0, utilityHelpers_1.verifyOneOrNone)(await this.findTransactions({
+                partial: { txid: args.reference, userId },
                 noRawTx: true,
                 trx
             }));
-            if (!tx && args.reference.length === 64) {
-                // reference may also be a txid
-                txid = reference;
-                reference = undefined;
-                tx = (0, utilityHelpers_1.verifyOneOrNone)(await this.findTransactions({
-                    partial: { txid, userId },
-                    noRawTx: true,
-                    trx
-                }));
+        }
+        const unAbortableStatus = ['completed', 'failed', 'sending', 'unproven'];
+        if (tx == null || !tx.isOutgoing || unAbortableStatus.includes(tx.status)) {
+            throw new WERR_errors_1.WERR_INVALID_PARAMETER('reference', 'an inprocess, outgoing action that has not been signed and shared to the network.');
+        }
+        return { tx, reference };
+    }
+    async checkAbortChainProtection(tx, args, trx) {
+        if (tx.txid == null || tx.txid === '' || tx.status !== 'nosend') {
+            return { skipped: false, serviceUnreachable: false };
+        }
+        let serviceUnreachable = false;
+        let chainStatus;
+        try {
+            const result = await this.getServices().getStatusForTxids([tx.txid]);
+            if (result.status !== 'success') {
+                serviceUnreachable = true;
             }
-            const unAbortableStatus = ['completed', 'failed', 'sending', 'unproven'];
-            if (!tx || !tx.isOutgoing || -1 < unAbortableStatus.findIndex(s => s === tx.status))
-                throw new WERR_errors_1.WERR_INVALID_PARAMETER('reference', 'an inprocess, outgoing action that has not been signed and shared to the network.');
-            await this.updateTransactionStatus('failed', tx.transactionId, userId, reference, trx);
-            if (tx.txid) {
-                const req = await entities_1.EntityProvenTxReq.fromStorageTxid(this, tx.txid, trx);
-                if (req) {
-                    req.addHistoryNote({ what: 'abortAction', reference: args.reference });
-                    req.status = 'invalid';
-                    await req.updateStorageDynamicProperties(this, trx);
-                }
+            else {
+                chainStatus = result.results.find(item => item.txid === tx.txid)?.status;
             }
-            const r = {
-                aborted: true
-            };
-            return r;
+        }
+        catch {
+            serviceUnreachable = true;
+        }
+        if (chainStatus !== 'mined' && chainStatus !== 'known') {
+            return { skipped: false, serviceUnreachable };
+        }
+        const req = await entities_1.EntityProvenTxReq.fromStorageTxid(this, tx.txid, trx);
+        if (req != null) {
+            req.addHistoryNote({
+                what: 'abortAction-skipped-onchain',
+                reference: args.reference,
+                chainStatus
+            });
+            await req.updateStorageDynamicProperties(this, trx);
+        }
+        return { skipped: true, serviceUnreachable };
+    }
+    async invalidateAbortedTransaction(tx, userId, reference, originalReference, serviceUnreachable, trx) {
+        await this.updateTransactionStatus('failed', tx.transactionId, userId, reference, trx);
+        if (tx.txid != null && tx.txid !== '') {
+            const req = await entities_1.EntityProvenTxReq.fromStorageTxid(this, tx.txid, trx);
+            if (req != null) {
+                req.addHistoryNote(serviceUnreachable
+                    ? { what: 'abortAction-offline-fallback', reference: originalReference }
+                    : { what: 'abortAction', reference: originalReference });
+                req.status = 'invalid';
+                await req.updateStorageDynamicProperties(this, trx);
+            }
+        }
+        return { aborted: true };
+    }
+    async abortAction(auth, args) {
+        if (auth.userId == null)
+            throw new WERR_errors_1.WERR_INVALID_PARAMETER('auth.userId', 'valid');
+        const userId = auth.userId;
+        const r = await this.transaction(async (trx) => {
+            const { tx, reference } = await this.findAbortableTransaction(userId, args, trx);
+            // Chain-status protection for signed nosend txs.
+            //
+            // Background: a nosend tx (created via createAction({noSend:true}))
+            // can be externally broadcast by the caller and reach 'mined' or
+            // mempool-'known' status before any internalizeAction or Monitor
+            // cycle has retired its 'nosend' status in storage. If abortAction
+            // is invoked on it in that window, the destructive transitions
+            // below (transactions.status='failed' + proven_tx_reqs.status='invalid')
+            // orphan every output the tx produced — including auto-fund change
+            // outputs the wallet itself emitted — because listOutputs filters
+            // them out of the spendable set on parent-tx 'failed' status.
+            //
+            // Protection: if the tx has a txid AND status is 'nosend', ask
+            // the network whether it already knows about the tx before
+            // invalidating. getStatusForTxids returns 'mined' | 'known' |
+            // 'unknown' per StatusForTxidResult (WalletServices.interfaces.ts).
+            // Refuse the abort for 'mined' OR 'known' — a tx that's broadcast
+            // and propagating in mempool returns 'known' (depth===0) and
+            // protecting it avoids orphaning during the propagation window.
+            //
+            // Service-unreachable handling: proceed with abort. Refusal is
+            // reserved for positive on-chain confirmation. When the network
+            // confirmation pathway is itself unavailable (services throw or
+            // gracefully return r.status !== 'success'), confirmation is not
+            // possible — and per the BRC-100 contract callers retain the
+            // ability to abort offline. The fallback writes a forensic
+            // history note ('abortAction-offline-fallback') so an operator
+            // can grep for aborts that proceeded under uncertainty. This
+            // hole can never be 100% closed against externally-broadcast
+            // chain-confirmed txs while offline; the audit trail makes it
+            // recoverable.
+            const protection = await this.checkAbortChainProtection(tx, args, trx);
+            if (protection.skipped) {
+                // Commit the audit note before translating this sentinel to aborted:false.
+                return { __abortAction: 'skipped-onchain' };
+            }
+            return await this.invalidateAbortedTransaction(tx, userId, reference, args.reference, protection.serviceUnreachable, trx);
         });
+        if ('__abortAction' in r) {
+            // Tone Engel review feedback (PR #122 comment 4444566147 item 3):
+            // do not throw on chain-confirmed refusal — surface it via the
+            // return value so callers can branch on it. Refusal is positive
+            // chain confirmation only; service-unreachable proceeds with
+            // abort and returns aborted:true with an audit-trail note.
+            return { aborted: false };
+        }
         return r;
     }
     async internalizeAction(auth, args) {
@@ -190,43 +459,24 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
             r.details.push(d);
             try {
                 d.proven = (0, utilityHelpers_1.verifyOneOrNone)(await this.findProvenTxs({ partial: { txid }, trx }));
-                if (d.proven)
+                if (d.proven != null) {
                     d.status = 'alreadySent';
+                    continue;
+                }
+                d.req = (0, utilityHelpers_1.verifyOneOrNone)(await this.findProvenTxReqs({ partial: { txid }, trx }));
+                if (d.req == null) {
+                    d.status = 'error';
+                    d.error = `ERR_UNKNOWN_TXID: ${txid} was not found.`;
+                }
                 else {
-                    const alreadySentStatus = ['unmined', 'callback', 'unconfirmed', 'completed'];
-                    const readyToSendStatus = ['sending', 'unsent', 'nosend', 'unprocessed'];
-                    const errorStatus = ['unknown', 'nonfinal', 'invalid', 'doubleSpend'];
-                    d.req = (0, utilityHelpers_1.verifyOneOrNone)(await this.findProvenTxReqs({ partial: { txid }, trx }));
-                    if (!d.req) {
-                        d.status = 'error';
-                        d.error = `ERR_UNKNOWN_TXID: ${txid} was not found.`;
-                    }
-                    else if (errorStatus.indexOf(d.req.status) > -1) {
-                        d.status = 'error';
-                        d.error = `ERR_INVALID_PARAMETER: ${txid} is not ready to send.`;
-                    }
-                    else if (alreadySentStatus.indexOf(d.req.status) > -1) {
-                        d.status = 'alreadySent';
-                    }
-                    else if (readyToSendStatus.indexOf(d.req.status) > -1) {
-                        if (!d.req.rawTx || !d.req.inputBEEF) {
-                            d.status = 'error';
-                            d.error = `ERR_INTERNAL: ${txid} req is missing rawTx or beef.`;
-                        }
-                        else
-                            d.status = 'readyToSend';
-                    }
-                    else {
-                        d.status = 'error';
-                        d.error = `ERR_INTERNAL: ${txid} has unexpected req status ${d.req.status}`;
-                    }
-                    if (d.status === 'readyToSend') {
-                        await this.mergeReqToBeefToShareExternally(d.req, r.beef, knownTxids, trx);
-                    }
+                    (0, storageProviderHelpers_1.classifyReqStatus)(d, d.req);
+                }
+                if (d.status === 'readyToSend') {
+                    await this.mergeReqToBeefToShareExternally(d.req, r.beef, knownTxids, trx);
                 }
             }
-            catch (eu) {
-                const e = WalletError_1.WalletError.fromUnknown(eu);
+            catch (error_) {
+                const e = WalletError_1.WalletError.fromUnknown(error_);
                 d.error = `${e.name}: ${e.message}`;
             }
         }
@@ -234,23 +484,13 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
     }
     async mergeReqToBeefToShareExternally(req, mergeToBeef, knownTxids, trx) {
         const { rawTx, inputBEEF: beef } = req;
-        if (!rawTx || !beef)
-            throw new WERR_errors_1.WERR_INTERNAL(`req rawTx and beef must be valid.`);
+        if (rawTx == null || beef == null)
+            throw new WERR_errors_1.WERR_INTERNAL('req rawTx and beef must be valid.');
         mergeToBeef.mergeRawTx((0, utilityHelpers_noBuffer_1.asArray)(rawTx));
         mergeToBeef.mergeBeef((0, utilityHelpers_noBuffer_1.asArray)(beef));
-        const tx = sdk_1.Transaction.fromBinary((0, utilityHelpers_noBuffer_1.asArray)(rawTx));
-        for (const input of tx.inputs) {
-            if (!input.sourceTXID)
-                throw new WERR_errors_1.WERR_INTERNAL(`req all transaction inputs must have valid sourceTXID`);
-            const txid = input.sourceTXID;
-            const btx = mergeToBeef.findTxid(txid);
-            if (!btx) {
-                if (knownTxids && knownTxids.indexOf(txid) > -1)
-                    mergeToBeef.mergeTxidOnly(txid);
-                else
-                    await this.getValidBeefForKnownTxid(txid, mergeToBeef, undefined, knownTxids, trx);
-            }
-        }
+        await (0, storageProviderHelpers_1.mergeInputsIntoBeef)((0, utilityHelpers_noBuffer_1.asArray)(rawTx), mergeToBeef, knownTxids, trx, async (txid, beef, _trust, knownTxids, trx) => {
+            await this.getValidBeefForKnownTxid(txid, beef, undefined, knownTxids, trx);
+        });
     }
     /**
      * Checks if txid is a known valid ProvenTx and returns it if found.
@@ -266,33 +506,37 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
      * @param trx
      * @returns
      */
+    async upsertProvenTxReq(txid, newReq, trx) {
+        const existing = (0, utilityHelpers_1.verifyOneOrNone)(await this.findProvenTxReqs({ partial: { txid }, trx }));
+        if (existing == null && newReq == null)
+            return undefined;
+        if (existing == null) {
+            await this.insertProvenTxReq(newReq, trx);
+            return newReq;
+        }
+        if (newReq != null) {
+            const req1 = new entities_1.EntityProvenTxReq(existing);
+            req1.mergeHistory(newReq, undefined, true);
+            req1.mergeNotifyTransactionIds(newReq);
+            await req1.updateStorageDynamicProperties(this, trx);
+        }
+        return existing;
+    }
     async getProvenOrReq(txid, newReq, trx) {
-        if (newReq && txid !== newReq.txid)
-            throw new WERR_errors_1.WERR_INVALID_PARAMETER('newReq', `same txid`);
+        if (newReq != null && txid !== newReq.txid)
+            throw new WERR_errors_1.WERR_INVALID_PARAMETER('newReq', 'same txid');
         const r = { proven: undefined, req: undefined };
         r.proven = (0, utilityHelpers_1.verifyOneOrNone)(await this.findProvenTxs({ partial: { txid }, trx }));
-        if (r.proven)
+        if (r.proven != null)
             return r;
         for (let retry = 0;; retry++) {
             try {
-                r.req = (0, utilityHelpers_1.verifyOneOrNone)(await this.findProvenTxReqs({ partial: { txid }, trx }));
-                if (!r.req && !newReq)
-                    break;
-                if (!r.req && newReq) {
-                    await this.insertProvenTxReq(newReq, trx);
-                }
-                if (r.req && newReq) {
-                    // Merge history and notify into existing
-                    const req1 = new entities_1.EntityProvenTxReq(r.req);
-                    req1.mergeHistory(newReq, undefined, true);
-                    req1.mergeNotifyTransactionIds(newReq);
-                    await req1.updateStorageDynamicProperties(this, trx);
-                }
+                r.req = await this.upsertProvenTxReq(txid, newReq, trx);
                 break;
             }
-            catch (eu) {
+            catch (error_) {
                 if (retry > 0)
-                    throw eu;
+                    throw error_;
             }
         }
         return r;
@@ -304,10 +548,31 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
             }
         }, trx);
     }
+    async releaseInputsAllocatedToFailedTransaction(tx, trx) {
+        const t = new entities_1.EntityTransaction(tx);
+        const inputs = await t.getInputs(this, trx);
+        for (const input of inputs) {
+            // input is a prior output belonging to userId that references this transaction either by `spentBy`
+            // or by txid and vout.
+            await this.updateOutput((0, utilityHelpers_1.verifyId)(input.outputId), { spendable: true, spentBy: undefined }, trx);
+        }
+    }
+    async markFailedTransactionOutputsNotSpendable(tx, trx) {
+        const outputs = await this.findOutputs({
+            partial: { transactionId: (0, utilityHelpers_1.verifyId)(tx.transactionId) },
+            trx
+        });
+        for (const output of outputs) {
+            if (!output.spendable && output.spentBy == null)
+                continue;
+            await this.updateOutput((0, utilityHelpers_1.verifyId)(output.outputId), { spendable: false, spentBy: undefined }, trx);
+        }
+    }
     /**
      * For all `status` values besides 'failed', just updates the transaction records status property.
      *
-     * For 'status' of 'failed', attempts to make outputs previously allocated as inputs to this transaction usable again.
+     * For 'status' of 'failed', attempts to make outputs previously allocated as inputs to this transaction usable again
+     * and makes outputs generated by this transaction non-spendable.
      *
      * @param status
      * @param transactionId
@@ -316,39 +581,33 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
      * @param trx
      */
     async updateTransactionStatus(status, transactionId, userId, reference, trx) {
-        if (!transactionId && !(userId && reference))
+        if (transactionId == null && !(userId != null && reference != null && reference !== '')) {
             throw new WERR_errors_1.WERR_MISSING_PARAMETER('either transactionId or userId and reference');
+        }
         await this.transaction(async (trx) => {
             const where = {};
-            if (transactionId)
+            if (transactionId != null)
                 where.transactionId = transactionId;
-            if (userId)
+            if (userId != null)
                 where.userId = userId;
-            if (reference)
+            if (reference != null && reference !== '')
                 where.reference = reference;
             const tx = (0, utilityHelpers_1.verifyOne)(await this.findTransactions({ partial: where, noRawTx: true, trx }));
-            //if (tx.status === status)
+            // if (tx.status === status)
             // no change required. Assume inputs and outputs spendable and spentBy are valid for status.
-            //return
+            // return
             // Once completed, this method cannot be used to "uncomplete" transaction.
-            if ((status !== 'completed' && tx.status === 'completed') || tx.provenTxId)
+            if ((status !== 'completed' && tx.status === 'completed') || tx.provenTxId != null) {
                 throw new WERR_errors_1.WERR_INVALID_OPERATION('The status of a "completed" transaction cannot be changed.');
+            }
             // It is not possible to un-fail a transaction. Information is lost and not recoverable.
-            if (status !== 'failed' && tx.status === 'failed')
-                throw new WERR_errors_1.WERR_INVALID_OPERATION(`A "failed" transaction may not be un-failed by this method.`);
+            if (status !== 'failed' && tx.status === 'failed') {
+                throw new WERR_errors_1.WERR_INVALID_OPERATION('A "failed" transaction may not be un-failed by this method.');
+            }
             switch (status) {
                 case 'failed':
-                    {
-                        // Attempt to make outputs previously allocated as inputs to this transaction usable again.
-                        // Only clear input's spentBy and reset spendable = true if it references this transaction
-                        const t = new entities_1.EntityTransaction(tx);
-                        const inputs = await t.getInputs(this, trx);
-                        for (const input of inputs) {
-                            // input is a prior output belonging to userId that reference this transaction either by `spentBy`
-                            // or by txid and vout.
-                            await this.updateOutput((0, utilityHelpers_1.verifyId)(input.outputId), { spendable: true, spentBy: undefined }, trx);
-                        }
-                    }
+                    await this.releaseInputsAllocatedToFailedTransaction(tx, trx);
+                    await this.markFailedTransactionOutputsNotSpendable(tx, trx);
                     break;
                 case 'nosend':
                 case 'unsigned':
@@ -364,12 +623,15 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
         }, trx);
     }
     async createAction(auth, args) {
-        if (!auth.userId)
+        if (auth.userId == null)
             throw new WERR_errors_1.WERR_UNAUTHORIZED();
+        if (this.supportsActionBatchPersistence() && this.requiresActionBatchCleanupBeforeCreateAction()) {
+            await (0, actionBatch_1.cleanupExpiredActionBatches)(this);
+        }
         return await (0, createAction_1.createAction)(this, auth, args);
     }
     async processAction(auth, args) {
-        if (!auth.userId)
+        if (auth.userId == null)
             throw new WERR_errors_1.WERR_UNAUTHORIZED();
         return await (0, processAction_1.processAction)(this, auth, args);
     }
@@ -381,7 +643,7 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
     }
     async verifyKnownValidTransaction(txid, trx) {
         const { proven, rawTx } = await this.getProvenOrRawTx(txid, trx);
-        return proven != undefined || rawTx != undefined;
+        return proven !== undefined || rawTx !== undefined;
     }
     /**
      * Pulls data from storage to build a valid beef for a txid.
@@ -399,64 +661,72 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
      */
     async getValidBeefForKnownTxid(txid, mergeToBeef, trustSelf, knownTxids, trx, requiredLevels) {
         const beef = await this.getValidBeefForTxid(txid, mergeToBeef, trustSelf, knownTxids, trx, requiredLevels);
-        if (!beef)
+        if (beef == null)
             throw new WERR_errors_1.WERR_INVALID_PARAMETER('txid', `known to storage. ${txid} is not known.`);
         return beef;
     }
-    async getValidBeefForTxid(txid, mergeToBeef, trustSelf, knownTxids, trx, requiredLevels, chainTracker, skipInvalidProofs) {
-        const beef = mergeToBeef || new sdk_1.Beef();
-        const r = await this.getProvenOrRawTx(txid, trx);
-        if (r.proven) {
-            if (requiredLevels) {
-                r.rawTx = r.proven.rawTx;
-            }
-            else {
-                if (trustSelf === 'known')
-                    beef.mergeTxidOnly(txid);
-                else {
-                    const mp = new entities_1.EntityProvenTx(r.proven).getMerklePath();
-                    if (chainTracker) {
-                        const root = mp.computeRoot();
-                        const isValid = await chainTracker.isValidRootForHeight(root, r.proven.height);
-                        if (!isValid) {
-                            if (!skipInvalidProofs) {
-                                throw new WERR_errors_1.WERR_INVALID_MERKLE_ROOT(r.proven.blockHash, r.proven.height, root, txid);
-                            }
-                            // ignore this currently invalid proof and try to recurse deeper
-                            r.rawTx = r.proven.rawTx;
-                            r.proven = undefined;
-                        }
-                    }
-                    if (r.proven) {
-                        // If we still like this proof, merge it and return
-                        beef.mergeRawTx(r.proven.rawTx);
-                        beef.mergeBump(mp);
-                        return beef;
-                    }
-                }
+    /**
+     * Handles the proven-tx branch of getValidBeefForTxid.
+     *
+     * Returns the beef if the proof was merged and we can stop, or `undefined` to
+     * signal that the caller should fall through to the rawTx path.  May also
+     * populate `r.rawTx` so the rawTx path can proceed without re-fetching.
+     */
+    async handleProvenTxBranch(txid, r, beef, trustSelf, requiredLevels, chainTracker, skipInvalidProofs) {
+        const proven = r.proven;
+        if (proven == null)
+            return undefined;
+        if ((requiredLevels ?? 0) > 0) {
+            // Need more levels — caller should proceed via rawTx path
+            r.rawTx = proven.rawTx;
+            return undefined;
+        }
+        if (trustSelf === 'known') {
+            beef.mergeTxidOnly(txid);
+            return beef;
+        }
+        const mp = new entities_1.EntityProvenTx(proven).getMerklePath();
+        if (chainTracker != null) {
+            const root = mp.computeRoot();
+            const isValid = await chainTracker.isValidRootForHeight(root, proven.height);
+            if (!isValid) {
+                if (skipInvalidProofs !== true)
+                    throw new WERR_errors_1.WERR_INVALID_MERKLE_ROOT(proven.blockHash, proven.height, root, txid);
+                // Proof is currently invalid — recurse deeper via rawTx path
+                r.rawTx = proven.rawTx;
+                r.proven = undefined;
+                return undefined;
             }
         }
-        if (!r.rawTx)
+        // Proof is good — merge and return
+        beef.mergeRawTx(proven.rawTx);
+        beef.mergeBump(mp);
+        return beef;
+    }
+    async getValidBeefForTxid(...[txid, mergeToBeef, trustSelf, knownTxids, trx, requiredLevels, chainTracker, skipInvalidProofs]) {
+        const beef = mergeToBeef ?? new sdk_1.Beef();
+        const r = await this.getProvenOrRawTx(txid, trx);
+        // --- proven-tx path ---
+        if (r.proven != null) {
+            const result = await this.handleProvenTxBranch(txid, r, beef, trustSelf, requiredLevels, chainTracker, skipInvalidProofs);
+            if (result != null || r.rawTx == null)
+                return result;
+        }
+        // --- rawTx path ---
+        if (r.rawTx == null)
             return undefined;
         if (trustSelf === 'known') {
             beef.mergeTxidOnly(txid);
         }
         else {
             beef.mergeRawTx(r.rawTx);
-            if (r.inputBEEF)
+            if (r.inputBEEF != null)
                 beef.mergeBeef(r.inputBEEF);
-            const tx = sdk_1.Transaction.fromBinary(r.rawTx);
-            if (requiredLevels)
-                requiredLevels--;
-            for (const input of tx.inputs) {
-                const btx = beef.findTxid(input.sourceTXID);
-                if (!btx) {
-                    if (!requiredLevels && knownTxids && knownTxids.indexOf(input.sourceTXID) > -1)
-                        beef.mergeTxidOnly(input.sourceTXID);
-                    else
-                        await this.getValidBeefForKnownTxid(input.sourceTXID, beef, trustSelf, knownTxids, trx, requiredLevels);
-                }
-            }
+            if ((requiredLevels ?? 0) > 0)
+                requiredLevels = requiredLevels - 1;
+            await (0, storageProviderHelpers_1.mergeInputBeefs)(r.rawTx, beef, trustSelf, knownTxids, trx, requiredLevels, async (sourceTXID, beef, trustSelf, knownTxids, trx, requiredLevels) => {
+                await this.getValidBeefForKnownTxid(sourceTXID, beef, trustSelf, knownTxids, trx, requiredLevels);
+            });
         }
         return beef;
     }
@@ -464,6 +734,9 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
         const beef = await (0, getBeefForTransaction_1.getBeefForTransaction)(this, txid, options);
         return beef;
     }
+    async getBeefForTransactions(txids, options) {
+        return await (0, getBeefForTransaction_1.getBeefForTransactions)(this, txids, options);
+    }
     async findMonitorEventById(id, trx) {
         return (0, utilityHelpers_1.verifyOneOrNone)(await this.findMonitorEvents({ partial: { id }, trx }));
     }
@@ -483,7 +756,7 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
     async relinquishOutput(auth, args) {
         const vargs = sdk_1.Validation.validateRelinquishOutputArgs(args);
         const { txid, vout } = sdk_1.Validation.parseWalletOutpoint(vargs.output);
-        const output = (0, utilityHelpers_1.verifyOne)(await this.findOutputs({ partial: { txid, vout } }));
+        const output = (0, utilityHelpers_1.verifyOne)(await this.findOutputs({ partial: { userId: auth.userId, txid, vout } }));
         return await this.updateOutput(output.outputId, { basketId: undefined });
     }
     async processSyncChunk(args, chunk) {
@@ -513,14 +786,18 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
     async updateProvenTxReqWithNewProvenTx(args) {
         const req = await entities_1.EntityProvenTxReq.fromStorageId(this, args.provenTxReqId);
         let proven;
-        if (req.provenTxId) {
+        if (req.provenTxId != null && req.provenTxId > 0) {
             // Someone beat us to it, grab what we need for results...
             proven = new entities_1.EntityProvenTx((0, utilityHelpers_1.verifyOne)(await this.findProvenTxs({ partial: { txid: args.txid } })));
+            if (req.status !== 'completed' || req.provenTxId !== proven.provenTxId) {
+                req.status = 'completed';
+                req.provenTxId = proven.provenTxId;
+                await req.updateStorageDynamicProperties(this);
+            }
         }
         else {
-            let isNew;
-            ({ proven, isNew } = await this.transaction(async (trx) => {
-                const { proven: api, isNew } = await this.findOrInsertProvenTx({
+            proven = await this.transaction(async (trx) => {
+                const { proven: api } = await this.findOrInsertProvenTx({
                     created_at: new Date(),
                     updated_at: new Date(),
                     provenTxId: 0,
@@ -532,43 +809,242 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
                     blockHash: args.blockHash,
                     merkleRoot: args.merkleRoot
                 }, trx);
-                proven = new entities_1.EntityProvenTx(api);
-                if (isNew) {
+                const found = new entities_1.EntityProvenTx(api);
+                if (req.status !== 'completed' || req.provenTxId !== found.provenTxId) {
                     req.status = 'completed';
-                    req.provenTxId = proven.provenTxId;
+                    req.provenTxId = found.provenTxId;
                     await req.updateStorageDynamicProperties(this, trx);
-                    // upate the transaction notifications outside of storage transaction....
-                }
-                return { proven, isNew };
-            }));
-            if (isNew) {
-                const ids = req.notify.transactionIds || [];
-                if (ids.length > 0) {
-                    for (const id of ids) {
-                        try {
-                            await this.updateTransaction(id, {
-                                provenTxId: proven.provenTxId,
-                                status: 'completed'
-                            });
-                            req.addHistoryNote({ what: 'notifyTxOfProof', transactionId: id });
-                        }
-                        catch (eu) {
-                            const { code, description } = WalletError_1.WalletError.fromUnknown(eu);
-                            const { provenTxId } = proven;
-                            req.addHistoryNote({ what: 'notifyTxOfProofError', id, provenTxId, code, description });
-                        }
-                    }
-                    await req.updateStorageDynamicProperties(this);
                 }
-            }
+                return found;
+            });
         }
+        await this.reconcileProvenTxReqTransactions(req, proven);
         const r = {
             status: req.status,
             history: req.apiHistory,
-            provenTxId: proven.provenTxId
+            provenTxId: proven.provenTxId,
+            notified: req.notified,
+            notify: req.apiNotify
         };
         return r;
     }
+    /**
+     * Reconcile completed proof requests whose transaction fan-out previously
+     * failed or whose durable notification state drifted.
+     *
+     * This is called by TaskReviewStatus so a completed request with
+     * `notified = false` is retried and can become eligible for normal purge.
+     */
+    async reconcileCompletedProvenTxReqs() {
+        let log = '';
+        const reqs = await this.findProvenTxReqs({
+            partial: { status: 'completed', notified: false }
+        });
+        for (const reqApi of reqs) {
+            const req = new entities_1.EntityProvenTxReq(reqApi);
+            if (req.provenTxId == null || req.provenTxId <= 0) {
+                log += `completed req ${req.id} cannot reconcile without provenTxId\n`;
+                continue;
+            }
+            const provenApi = (0, utilityHelpers_1.verifyOneOrNone)(await this.findProvenTxs({
+                partial: { provenTxId: req.provenTxId }
+            }));
+            if (provenApi == null) {
+                log += `completed req ${req.id} cannot reconcile missing provenTx ${req.provenTxId}\n`;
+                continue;
+            }
+            await this.reconcileProvenTxReqTransactions(req, new entities_1.EntityProvenTx(provenApi));
+            if (req.notified)
+                log += `completed req ${req.id} transaction notifications reconciled\n`;
+        }
+        return { log };
+    }
+    async prepareProofRecoveryOutputVerdicts(transactions) {
+        const verdicts = new Map();
+        if (transactions.length === 0)
+            return verdicts;
+        const services = this.getServices();
+        for (const transaction of transactions) {
+            const outputs = await this.findOutputs({
+                partial: {
+                    userId: transaction.userId,
+                    transactionId: transaction.transactionId
+                }
+            });
+            for (const output of outputs) {
+                const outputId = (0, utilityHelpers_1.verifyId)(output.outputId);
+                await this.validateOutputScript(output);
+                verdicts.set(outputId, output.lockingScript == null ? undefined : await services.isUtxo(output));
+            }
+        }
+        return verdicts;
+    }
+    async restoreProofRecoveryInputs(tx, bsvtx, indent, trx) {
+        let log = '';
+        for (const [vin, input] of bsvtx.inputs.entries()) {
+            const sourceTXID = input.sourceTXID;
+            if (sourceTXID == null) {
+                log += ' '.repeat(indent + 2) + `input ${vin} has no source transaction id\n`;
+                continue;
+            }
+            const outputs = await this.findOutputs({
+                partial: {
+                    userId: tx.userId,
+                    txid: sourceTXID,
+                    vout: input.sourceOutputIndex
+                },
+                trx
+            });
+            if (outputs.length !== 1) {
+                log += ' '.repeat(indent + 2) + `input ${vin} not matched to user's outputs\n`;
+                continue;
+            }
+            const output = outputs[0];
+            log +=
+                ' '.repeat(indent + 2) +
+                    `input ${vin} matched to output ${output.outputId} updated spentBy ${tx.transactionId}\n`;
+            await this.updateOutput((0, utilityHelpers_1.verifyId)(output.outputId), { spendable: false, spentBy: tx.transactionId }, trx);
+        }
+        return log;
+    }
+    async restoreProofRecoveryOutputs(tx, outputVerdicts, indent, trx) {
+        let log = '';
+        const outputs = await this.findOutputs({
+            partial: { userId: tx.userId, transactionId: tx.transactionId },
+            trx
+        });
+        for (const output of outputs) {
+            const outputId = (0, utilityHelpers_1.verifyId)(output.outputId);
+            if (!outputVerdicts.has(outputId)) {
+                throw new WERR_errors_1.WERR_INTERNAL(`Output ${outputId} changed while preparing proof recovery.`);
+            }
+            const isUtxo = outputVerdicts.get(outputId);
+            if (isUtxo == null) {
+                log +=
+                    ' '.repeat(indent + 2) +
+                        `output ${output.outputId} does not have a valid locking script\n`;
+                continue;
+            }
+            if (isUtxo === output.spendable) {
+                log += ' '.repeat(indent + 2) + `output ${output.outputId} unchanged\n`;
+                continue;
+            }
+            log +=
+                ' '.repeat(indent + 2) +
+                    `output ${output.outputId} set to ${isUtxo ? 'spendable' : 'spent'}\n`;
+            await this.updateOutput(outputId, { spendable: isUtxo }, trx);
+        }
+        return log;
+    }
+    async restoreTransactionForProof(tx, bsvtx, preparedTransactionIds, outputVerdicts, indent, trx) {
+        if (bsvtx == null || !preparedTransactionIds.has(tx.transactionId)) {
+            throw new WERR_errors_1.WERR_INTERNAL(`Transaction ${tx.transactionId} changed while preparing proof recovery.`);
+        }
+        await this.updateTransaction(tx.transactionId, { status: 'unproven' }, trx);
+        let log = ' '.repeat(indent) +
+            `transaction ${tx.transactionId} status is now 'unproven'\n`;
+        log += await this.restoreProofRecoveryInputs(tx, bsvtx, indent, trx);
+        log += await this.restoreProofRecoveryOutputs(tx, outputVerdicts, indent, trx);
+        return log;
+    }
+    /**
+     * Restore every failed local copy of a transaction before proof completion.
+     * Also heals the request's notification set from the authoritative txid
+     * lookup so TaskUnFail cannot omit a local copy after notification drift.
+     */
+    async unfailTransactionsForProof(req, indent = 0, requestUpdate) {
+        const transactions = await this.findTransactions({
+            partial: { txid: req.txid },
+            noRawTx: true
+        });
+        const transactionsToRepair = transactions.filter(transaction => requestUpdate != null || transaction.status === 'failed');
+        // Proof completion is the hot path. If no failed transaction needs repair,
+        // notification reconciliation below will perform the required atomic work;
+        // avoid an otherwise empty refresh/write transaction here.
+        if (transactionsToRepair.length === 0 && requestUpdate == null)
+            return '';
+        // Refresh only after deciding recovery is required, while the caller has
+        // not yet applied an intended request transition. TaskUnFail passes that
+        // transition separately so it is persisted atomically with bookkeeping.
+        await req.refreshFromStorage(this);
+        const preparedTransactionIds = new Set(transactionsToRepair.map(transaction => transaction.transactionId));
+        const bsvtx = transactionsToRepair.length > 0 ? sdk_1.Transaction.fromBinary(req.rawTx) : undefined;
+        // UTXO checks can call external services. Complete every check before
+        // opening the write transaction so network latency never holds DB locks.
+        const outputVerdicts = await this.prepareProofRecoveryOutputVerdicts(transactionsToRepair);
+        return await this.transaction(async (trx) => {
+            let log = '';
+            await req.refreshFromStorage(this, trx);
+            const currentTransactions = await this.findTransactions({
+                partial: { txid: req.txid },
+                noRawTx: true,
+                trx
+            });
+            const knownNotificationIds = new Set(req.notify.transactionIds ?? []);
+            if (requestUpdate != null) {
+                req.status = requestUpdate.status;
+                req.attempts = requestUpdate.attempts;
+            }
+            for (const tx of currentTransactions) {
+                if (!knownNotificationIds.has(tx.transactionId)) {
+                    req.addNotifyTransactionId(tx.transactionId);
+                    knownNotificationIds.add(tx.transactionId);
+                }
+                const shouldRepair = requestUpdate != null || tx.status === 'failed';
+                if (!shouldRepair)
+                    continue;
+                log += await this.restoreTransactionForProof(tx, bsvtx, preparedTransactionIds, outputVerdicts, indent, trx);
+            }
+            await req.updateStorageDynamicProperties(this, trx);
+            return log;
+        });
+    }
+    async reconcileProvenTxReqTransactions(req, proven) {
+        // A transaction can be internalized concurrently by several users. Their
+        // transaction rows share a txid but race while merging the JSON notify
+        // list, so a last-writer-wins update can omit one local copy. A valid proof
+        // is authoritative for every local transaction with this txid: discover
+        // them from the indexed transaction table and atomically heal both the
+        // durable notify set and any row that missed the original completion.
+        // Keep the clean proof-completion path identical to the normal notification
+        // transaction. Only leave it when failed rows require external UTXO checks,
+        // which must run without an open transaction.
+        let repairAttempts = 0;
+        for (;;) {
+            const needsRepair = await this.transaction(async (trx) => {
+                await req.refreshFromStorage(this, trx);
+                const transactions = await this.findTransactions({ partial: { txid: req.txid }, trx });
+                if (transactions.some(transaction => transaction.status === 'failed'))
+                    return true;
+                const knownNotificationIds = new Set(req.notify.transactionIds ?? []);
+                for (const transaction of transactions) {
+                    if (!knownNotificationIds.has(transaction.transactionId)) {
+                        req.addNotifyTransactionId(transaction.transactionId);
+                        knownNotificationIds.add(transaction.transactionId);
+                    }
+                }
+                const transactionIdsNeedingProof = transactions
+                    .filter(transaction => transaction.status !== 'completed' || transaction.provenTxId !== proven.provenTxId)
+                    .map(transaction => transaction.transactionId);
+                const updatesSucceeded = await (0, storageProviderHelpers_1.notifyTransactionsOfProof)(transactionIdsNeedingProof, proven.provenTxId, note => req.addHistoryNote(note), async (id, update) => {
+                    await this.updateTransaction(id, update, trx);
+                });
+                const completedTransactions = await this.findTransactions({ partial: { txid: req.txid }, trx });
+                req.notified =
+                    updatesSucceeded &&
+                        completedTransactions.every(transaction => transaction.status === 'completed' && transaction.provenTxId === proven.provenTxId);
+                await req.updateStorageDynamicProperties(this, trx);
+                return false;
+            });
+            if (!needsRepair)
+                return;
+            if (repairAttempts >= 2) {
+                throw new WERR_errors_1.WERR_INTERNAL(`Transactions for ${req.txid} repeatedly changed to failed during proof recovery.`);
+            }
+            repairAttempts++;
+            await this.unfailTransactionsForProof(req);
+        }
+    }
     /**
      * For each spendable output in the 'default' basket of the authenticated user,
      * verify that the output script, satoshis, vout and txid match that of an output
@@ -579,56 +1055,56 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
     async confirmSpendableOutputs() {
         const invalidSpendableOutputs = [];
         const users = await this.findUsers({ partial: {} });
+        const services = this.getServices();
         for (const { userId } of users) {
             const defaultBasket = (0, utilityHelpers_1.verifyOne)(await this.findOutputBaskets({ partial: { userId, name: 'default' } }));
-            const where = {
-                userId,
-                basketId: defaultBasket.basketId,
-                spendable: true
-            };
-            const outputs = await this.findOutputs({ partial: where });
-            const services = this.getServices();
-            for (let i = outputs.length - 1; i >= 0; i--) {
-                const o = outputs[i];
-                const oid = (0, utilityHelpers_1.verifyId)(o.outputId);
-                if (o.spendable) {
-                    let ok = false;
-                    if (o.lockingScript && o.lockingScript.length > 0) {
-                        const hash = services.hashOutputScript((0, utilityHelpers_noBuffer_1.asString)(o.lockingScript));
-                        const r = await services.getUtxoStatus(hash, undefined, `${o.txid}.${o.vout}`);
-                        if (r.isUtxo === true)
-                            ok = true;
-                    }
-                    if (!ok)
-                        invalidSpendableOutputs.push(o);
-                }
+            const outputs = await this.findOutputs({
+                partial: { userId, basketId: defaultBasket.basketId, spendable: true }
+            });
+            for (const o of outputs) {
+                if (!o.spendable)
+                    continue;
+                const isUtxo = await this.checkOutputIsUtxo(o, services);
+                if (!isUtxo)
+                    invalidSpendableOutputs.push(o);
             }
         }
         return { invalidSpendableOutputs };
     }
+    async checkOutputIsUtxo(o, services) {
+        if (o.lockingScript == null || o.lockingScript.length === 0)
+            return false;
+        const hash = services.hashOutputScript((0, utilityHelpers_noBuffer_1.asString)(o.lockingScript));
+        const r = await services.getUtxoStatus(hash, undefined, `${o.txid ?? ''}.${o.vout ?? ''}`);
+        return r.isUtxo === true;
+    }
     async updateProvenTxReqDynamics(id, update, trx) {
         const partial = {};
-        if (update['updated_at'])
-            partial['updated_at'] = update['updated_at'];
-        if (update['provenTxId'])
-            partial['provenTxId'] = update['provenTxId'];
-        if (update['status'])
-            partial['status'] = update['status'];
-        if (Number.isInteger(update['attempts']))
-            partial['attempts'] = update['attempts'];
-        if (update['notified'] !== undefined)
-            partial['notified'] = update['notified'];
-        if (update['batch'])
-            partial['batch'] = update['batch'];
-        if (update['history'])
-            partial['history'] = update['history'];
-        if (update['notify'])
-            partial['notify'] = update['notify'];
+        if (update.updated_at != null)
+            partial.updated_at = update.updated_at;
+        if (update.provenTxId != null && update.provenTxId > 0)
+            partial.provenTxId = update.provenTxId;
+        if (update.status != null)
+            partial.status = update.status;
+        if (Number.isInteger(update.attempts))
+            partial.attempts = update.attempts;
+        if (update.notified !== undefined)
+            partial.notified = update.notified;
+        if (update.batch != null && update.batch !== '')
+            partial.batch = update.batch;
+        if (update.history != null && update.history !== '')
+            partial.history = update.history;
+        if (update.notify != null && update.notify !== '')
+            partial.notify = update.notify;
+        if (update.wasBroadcast !== undefined)
+            partial.wasBroadcast = update.wasBroadcast ?? false;
+        if (Number.isInteger(update.rebroadcastAttempts))
+            partial.rebroadcastAttempts = update.rebroadcastAttempts ?? 0;
         return await this.updateProvenTxReq(id, partial, trx);
     }
     async extendOutput(o, includeBasket = false, includeTags = false, trx) {
         const ox = o;
-        if (includeBasket && ox.basketId)
+        if (includeBasket && ox.basketId != null && ox.basketId > 0)
             ox.basket = await this.findOutputBasketById(o.basketId, trx);
         if (includeTags) {
             ox.tags = await this.getTagsForOutputId(o.outputId);
@@ -637,14 +1113,19 @@ class StorageProvider extends StorageReaderWriter_1.StorageReaderWriter {
     }
     async validateOutputScript(o, trx) {
         // without offset and length values return what we have (make no changes)
-        if (!o.scriptLength || !o.scriptOffset || !o.txid)
+        if (o.scriptLength == null ||
+            o.scriptLength === 0 ||
+            o.scriptOffset == null ||
+            o.scriptOffset === 0 ||
+            o.txid == null ||
+            o.txid === '')
             return;
         // if there is an outputScript and its length is the expected length return what we have.
-        if (o.lockingScript && o.lockingScript.length === o.scriptLength)
+        if (o.lockingScript?.length === o.scriptLength)
             return;
         // outputScript is missing or has incorrect length...
         const script = await this.getRawTxOfKnownValidTransaction(o.txid, o.scriptOffset, o.scriptLength, trx);
-        if (!script)
+        if (script == null)
             return;
         o.lockingScript = script;
     }
@@ -653,11 +1134,11 @@ exports.StorageProvider = StorageProvider;
 function validateStorageFeeModel(v) {
     const r = {
         model: 'sat/kb',
-        value: 1
+        value: 100
     };
     if (typeof v === 'object') {
         if (v.model !== 'sat/kb')
-            throw new WERR_errors_1.WERR_INVALID_PARAMETER('StorageFeeModel.model', `"sat/kb"`);
+            throw new WERR_errors_1.WERR_INVALID_PARAMETER('StorageFeeModel.model', '"sat/kb"');
         if (typeof v.value === 'number') {
             r.value = v.value;
         }