@bopen-io/wallet-toolbox 2.1.21-parity-fix.2 → 2.6.2-brc153.2

package/out/src/storage/methods/internalizeAction.js

@@ -1,12 +1,102 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.markUserInputsSpent = markUserInputsSpent;
+exports.restoreInputsToSpendable = restoreInputsToSpendable;
 exports.internalizeAction = internalizeAction;
 const sdk_1 = require("@bsv/sdk");
 const processAction_1 = require("./processAction");
 const WERR_errors_1 = require("../../sdk/WERR_errors");
 const utilityHelpers_1 = require("../../utility/utilityHelpers");
+const brc153ReferenceLabels_1 = require("../../utility/brc153ReferenceLabels");
 const EntityProvenTxReq_1 = require("../schema/entities/EntityProvenTxReq");
 const blockHeaderUtilities_1 = require("../../services/chaintracker/chaintracks/util/blockHeaderUtilities");
+const managedChange_1 = require("./managedChange");
+/**
+ * Mark every storage row at each consumed-input outpoint as spent — across
+ * all users that track that outpoint. An on-chain spend invalidates the UTXO
+ * for every wallet that references it, not just the wallet that called
+ * `internalizeAction`. Returns the per-row transitions so the caller can
+ * roll back via {@link restoreInputsToSpendable} on broadcast failure.
+ *
+ * Cross-user semantics:
+ *   - For rows owned by `userId` (the internalizing user) we also set
+ *     `spentBy=transactionId`. They own the corresponding transaction
+ *     record; the FK target exists in their scope.
+ *   - For rows owned by other users we set `spendable=false` and leave
+ *     `spentBy` untouched. `spentBy` references the owning user's
+ *     `transactions.transactionId`, and that user has no record of our
+ *     transaction yet — they'd need to internalize it themselves to get
+ *     one. Leaving `spentBy` undefined keeps the field consistent with
+ *     "this UTXO is spent, but my wallet didn't witness the spend".
+ *
+ * Mirrors what `createAction` does for wallet-originated transactions and
+ * what `TaskUnFail.unfailReq` does when reviving a previously-failed tx.
+ * Without this, an externally-broadcast tx that consumed user UTXOs would
+ * leave those UTXOs as phantom spendable rows, picked up by subsequent
+ * `createAction` fund selection.
+ *
+ * Idempotent: rows already `spendable=false` are skipped. Rows already
+ * `spentBy` a different transaction are also skipped (a competing spend
+ * has been recorded; do not overwrite).
+ */
+async function markUserInputsSpent(storage, userId, tx, transactionId) {
+    const outpoints = tx.inputs
+        .map(i => ({ txid: i.sourceTXID ?? '', vout: i.sourceOutputIndex ?? 0 }))
+        .filter(o => o.txid !== '');
+    if (outpoints.length === 0)
+        return [];
+    const transitioned = [];
+    await storage.transaction(async (trx) => {
+        for (const op of outpoints) {
+            const matches = await storage.findOutputs({
+                partial: { txid: op.txid, vout: op.vout },
+                noScript: true,
+                trx
+            });
+            for (const o of matches) {
+                if (!o.spendable)
+                    continue;
+                if (o.spentBy != null && o.spentBy !== transactionId)
+                    continue;
+                const setSpentBy = o.userId === userId;
+                const update = setSpentBy
+                    ? { spendable: false, spentBy: transactionId }
+                    : { spendable: false };
+                await storage.updateOutput((0, utilityHelpers_1.verifyId)(o.outputId), update, trx);
+                transitioned.push({ outputId: (0, utilityHelpers_1.verifyId)(o.outputId), setSpentBy });
+            }
+        }
+    });
+    return transitioned;
+}
+/**
+ * Revert the spendable=true → false transitions performed by
+ * {@link markUserInputsSpent}. Used when an internalize call's downstream
+ * broadcast fails non-fatally so the caller can retry with the same UTXOs.
+ *
+ * Only undoes what was changed: `spendable=true` always; `spentBy=undefined`
+ * only when the original transition set it. Avoids clobbering a competing
+ * spent-by on cross-user rows.
+ *
+ * The downstream `attemptToPostReqsToNetwork` path also calls
+ * `updateTransactionStatus('failed')` on doubleSpend/invalidTx outcomes,
+ * which independently restores same-user inputs (via
+ * `EntityTransaction.getInputs` filtered by userId). This explicit rollback
+ * covers cross-user rows and any path where the downstream restore did not
+ * run, and is a no-op when the downstream restore already happened.
+ */
+async function restoreInputsToSpendable(storage, transitions) {
+    if (transitions.length === 0)
+        return;
+    await storage.transaction(async (trx) => {
+        for (const t of transitions) {
+            const update = t.setSpentBy
+                ? { spendable: true, spentBy: undefined }
+                : { spendable: true };
+            await storage.updateOutput((0, utilityHelpers_1.verifyId)(t.outputId), update, trx);
+        }
+    });
+}
 /**
  * Internalize Action allows a wallet to take ownership of outputs in a pre-existing transaction.
  * The transaction may, or may not already be known to both the storage and user.
@@ -20,18 +110,32 @@ const blockHeaderUtilities_1 = require("../../services/chaintracker/chaintracks/
  * Processing starts with simple validation and then checks for a pre-existing transaction.
  * If the transaction is already known to the user, then the outputs are reviewed against the existing outputs treatment,
  * and merge rules are added to the arguments passed to the storage layer.
- * The existing transaction must be in the 'unproven' or 'completed' status. Any other status is an error.
+ *
+ * The existing transaction's `status` determines what the merge path does next:
+ *  - `'unproven'`, `'completed'`, or `'sending'`: outputs are merged into the existing record. The transaction status is left as-is.
+ *    The `'sending'` case covers a transaction this wallet already signed and handed to broadcast processing, but
+ *    whose proven_tx_req has not yet been advanced by the normal monitor/posting flow.
+ *  - `'nosend'`: an ambiguous case. The transaction was created with `noSend: true` and may have been externally
+ *    broadcast, may be sitting in a sendWith chain, or may be stuck mid-flight. The merge path treats the
+ *    `internalizeAction` call as explicit authorization to advance the lifecycle. Specifically: `transactions.status`
+ *    is promoted to `'completed'` (when a BUMP is included in the BEEF) or `'unproven'` (otherwise), and the
+ *    `proven_tx_req` is moved out of `'nosend'` so Monitor's standard proof-fetching flow can finalize it.
+ *    This makes the `internalizeAction` semantics consistent regardless of whether the originator shares the
+ *    same storage as the internalizer or not.
+ *  - Any other status: an error.
  *
  * When the transaction already exists, the description is updated. The isOutgoing sense is not changed.
  *
  * "basket insertion" Merge Rules:
  * 1. The "default" basket may not be specified as the insertion basket.
- * 2. A change output in the "default" basket may not be target of an insertion into a different basket.
- * 3. These baskets do not affect the wallet's balance and are typed "custom".
+ * 2. Managed change may not be reclassified as a basket insertion.
+ * 3. Basket insertions do not affect wallet balance and are typed "custom".
  *
  * "wallet payment" Merge Rules:
- * 1. Targetting an existing change "default" basket output results in a no-op. No error. No alterations made.
- * 2. Targetting a previously "custom" non-change output converts it into a change output. This alters the transaction's `satoshis`, and the wallet balance.
+ * 1. Targeting an existing managed output is idempotent.
+ * 2. Targeting an existing custom output converts it to managed BRC-29
+ *    change and increases wallet balance. This includes verified recovery of
+ *    a legacy custom row that was incorrectly placed in the default basket.
  */
 async function internalizeAction(storage, auth, args) {
     const ctx = new InternalizeActionContext(storage, auth, args);
@@ -43,6 +147,31 @@ async function internalizeAction(storage, auth, args) {
     return ctx.r;
 }
 class InternalizeActionContext {
+    storage;
+    auth;
+    args;
+    /** result to be returned */
+    r;
+    /** the parsed input AtomicBEEF */
+    ab;
+    /** the incoming transaction extracted from AtomicBEEF */
+    tx;
+    /** the user's change basket */
+    changeBasket;
+    /** cached baskets referenced by basket insertions */
+    baskets;
+    /** existing storage transaction for this txid and userId */
+    etx;
+    /** existing outputs */
+    eos;
+    /** all the basket insertions from incoming outputs array */
+    basketInsertions;
+    /** all the wallet payments from incoming outputs array */
+    walletPayments;
+    /** outputs this call transitioned spendable=true → false (for rollback) */
+    spentInputs;
+    userId;
+    vargs;
     constructor(storage, auth, args) {
         this.storage = storage;
         this.auth = auth;
@@ -62,6 +191,7 @@ class InternalizeActionContext {
         this.basketInsertions = [];
         this.walletPayments = [];
         this.eos = [];
+        this.spentInputs = [];
     }
     get isMerge() {
         return this.r.isMerge;
@@ -82,6 +212,9 @@ class InternalizeActionContext {
         this.r.satoshis = v;
     }
     async getBasket(basketName) {
+        if (basketName === 'default') {
+            throw new WERR_errors_1.WERR_INVALID_PARAMETER('insertionRemittance.basket', 'a non-default basket');
+        }
         let b = this.baskets[basketName];
         if (b)
             return b;
@@ -89,99 +222,108 @@ class InternalizeActionContext {
         this.baskets[basketName] = b;
         return b;
     }
-    async asyncSetup() {
-        ;
-        ({ ab: this.ab, tx: this.tx, txid: this.txid } = await this.validateAtomicBeef(sdk_1.Utils.toArray(this.args.tx)));
-        for (const o of this.args.outputs) {
-            if (o.outputIndex < 0 || o.outputIndex >= this.tx.outputs.length)
-                throw new WERR_errors_1.WERR_INVALID_PARAMETER('outputIndex', `a valid output index in range 0 to ${this.tx.outputs.length - 1}`);
-            const txo = this.tx.outputs[o.outputIndex];
-            switch (o.protocol) {
-                case 'basket insertion':
-                    {
-                        if (!o.insertionRemittance || o.paymentRemittance)
-                            throw new WERR_errors_1.WERR_INVALID_PARAMETER('basket insertion', 'valid insertionRemittance and no paymentRemittance');
-                        this.basketInsertions.push({
-                            ...o.insertionRemittance,
-                            txo,
-                            vout: o.outputIndex
-                        });
-                    }
-                    break;
-                case 'wallet payment':
-                    {
-                        if (o.insertionRemittance || !o.paymentRemittance)
-                            throw new WERR_errors_1.WERR_INVALID_PARAMETER('wallet payment', 'valid paymentRemittance and no insertionRemittance');
-                        this.walletPayments.push({
-                            ...o.paymentRemittance,
-                            txo,
-                            vout: o.outputIndex,
-                            ignore: false
-                        });
-                    }
-                    break;
-                default:
-                    throw new WERR_errors_1.WERR_INTERNAL(`unexpected protocol ${o.protocol}`);
+    classifyRequestedOutput(output) {
+        if (output.outputIndex < 0 || output.outputIndex >= this.tx.outputs.length) {
+            throw new WERR_errors_1.WERR_INVALID_PARAMETER('outputIndex', `a valid output index in range 0 to ${this.tx.outputs.length - 1}`);
+        }
+        const txo = this.tx.outputs[output.outputIndex];
+        if (output.protocol === 'basket insertion') {
+            if (output.insertionRemittance == null || output.paymentRemittance != null) {
+                throw new WERR_errors_1.WERR_INVALID_PARAMETER('basket insertion', 'valid insertionRemittance and no paymentRemittance');
             }
+            if (output.insertionRemittance.basket === 'default') {
+                throw new WERR_errors_1.WERR_INVALID_PARAMETER('insertionRemittance.basket', 'a non-default basket');
+            }
+            this.basketInsertions.push({
+                ...output.insertionRemittance,
+                txo,
+                vout: output.outputIndex
+            });
+            return;
         }
-        this.changeBasket = (0, utilityHelpers_1.verifyOne)(await this.storage.findOutputBaskets({
-            partial: { userId: this.userId, name: 'default' }
-        }));
-        this.baskets = {};
+        if (output.protocol !== 'wallet payment') {
+            throw new WERR_errors_1.WERR_INTERNAL(`unexpected protocol ${output.protocol}`);
+        }
+        if (output.insertionRemittance != null || output.paymentRemittance == null) {
+            throw new WERR_errors_1.WERR_INVALID_PARAMETER('wallet payment', 'valid paymentRemittance and no insertionRemittance');
+        }
+        this.walletPayments.push({
+            ...output.paymentRemittance,
+            txo,
+            vout: output.outputIndex,
+            ignore: false
+        });
+    }
+    async loadExistingTransaction() {
         this.etx = (0, utilityHelpers_1.verifyOneOrNone)(await this.storage.findTransactions({
             partial: { userId: this.userId, txid: this.txid }
         }));
-        if (this.etx && !(this.etx.status == 'completed' || this.etx.status === 'unproven' || this.etx.status === 'nosend'))
+        const allowedStatuses = [
+            'completed',
+            'unproven',
+            'sending',
+            'nosend'
+        ];
+        if (this.etx != null && !allowedStatuses.includes(this.etx.status)) {
             throw new WERR_errors_1.WERR_INVALID_PARAMETER('tx', `target transaction of internalizeAction has invalid status ${this.etx.status}.`);
-        this.isMerge = !!this.etx;
-        if (this.isMerge) {
-            this.eos = await this.storage.findOutputs({
-                partial: { userId: this.userId, txid: this.txid }
-            }); // It is possible for a transaction to have no outputs, or less outputs in storage than in the transaction itself.
-            for (const eo of this.eos) {
-                const bi = this.basketInsertions.find(b => b.vout === eo.vout);
-                const wp = this.walletPayments.find(b => b.vout === eo.vout);
-                if (bi && wp)
-                    throw new WERR_errors_1.WERR_INVALID_PARAMETER('outputs', `unique outputIndex values`);
-                if (bi)
-                    bi.eo = eo;
-                if (wp)
-                    wp.eo = eo;
+        }
+        this.isMerge = this.etx != null;
+    }
+    async linkExistingOutputs() {
+        if (!this.isMerge)
+            return;
+        this.eos = await this.storage.findOutputs({
+            partial: { userId: this.userId, txid: this.txid }
+        });
+        for (const existing of this.eos) {
+            const basket = this.basketInsertions.find(candidate => candidate.vout === existing.vout);
+            const payment = this.walletPayments.find(candidate => candidate.vout === existing.vout);
+            if (basket != null && payment != null) {
+                throw new WERR_errors_1.WERR_INVALID_PARAMETER('outputs', 'unique outputIndex values');
             }
+            if (basket != null)
+                basket.eo = existing;
+            if (payment != null)
+                payment.eo = existing;
         }
+    }
+    validateBasketMerges() {
+        if (!this.isMerge)
+            return;
         for (const basket of this.basketInsertions) {
-            if (this.isMerge && basket.eo) {
-                // merging with an existing user output
-                if (basket.eo.basketId === this.changeBasket.basketId) {
-                    // converting a change output to a user basket custom output
-                    this.satoshis -= basket.txo.satoshis;
-                }
+            if (basket.eo != null && (0, managedChange_1.isManagedChangeOutput)(basket.eo)) {
+                throw new WERR_errors_1.WERR_INVALID_PARAMETER('outputs', `output ${basket.vout} is wallet-managed change and cannot be reclassified as a basket insertion`);
             }
         }
+    }
+    computeWalletPaymentBalance() {
         for (const payment of this.walletPayments) {
-            if (this.isMerge) {
-                if (payment.eo) {
-                    // merging with an existing user output
-                    if (payment.eo.basketId === this.changeBasket.basketId) {
-                        // ignore attempts to internalize an existing change output.
-                        payment.ignore = true;
-                    }
-                    else {
-                        // converting an existing non-change output to change... increases net satoshis
-                        this.satoshis += payment.txo.satoshis;
-                    }
-                }
-                else {
-                    // adding a previously untracked output of an existing transaction as change... increase net satoshis
-                    this.satoshis += payment.txo.satoshis;
-                }
-            }
-            else {
-                // If there are no existing outputs, all incoming wallet payment outputs add to net satoshis
+            if (!this.isMerge || payment.eo == null) {
                 this.satoshis += payment.txo.satoshis;
+                continue;
+            }
+            if ((0, managedChange_1.isManagedChangeOutput)(payment.eo) &&
+                payment.eo.basketId === this.changeBasket.basketId) {
+                payment.ignore = true;
+                continue;
             }
+            this.satoshis += payment.txo.satoshis;
         }
     }
+    async asyncSetup() {
+        ;
+        ({ ab: this.ab, tx: this.tx, txid: this.txid } = await this.validateAtomicBeef(this.args.tx));
+        for (const output of this.vargs.outputs)
+            this.classifyRequestedOutput(output);
+        this.changeBasket = (0, utilityHelpers_1.verifyOne)(await this.storage.findOutputBaskets({
+            partial: { userId: this.userId, name: 'default' }
+        }));
+        this.baskets = {};
+        await this.loadExistingTransaction();
+        await this.linkExistingOutputs();
+        this.validateBasketMerges();
+        this.computeWalletPaymentBalance();
+    }
     /**
      * This is the second time the atomic beef is validated against a chaintracker.
      * The first validation used the originating wallet's configured chaintracker.
@@ -198,33 +340,21 @@ class InternalizeActionContext {
      * @returns
      */
     async validateAtomicBeef(atomicBeef) {
-        const ab = sdk_1.Beef.fromBinary(atomicBeef);
+        const ab = atomicBeef instanceof Uint8Array ? sdk_1.Beef.fromBinaryView(atomicBeef) : sdk_1.Beef.fromBinary(atomicBeef);
         const txValid = await ab.verify(await this.storage.getServices().getChainTracker(), false);
         if (!txValid || !ab.atomicTxid)
             throw new WERR_errors_1.WERR_INVALID_PARAMETER('tx', 'valid AtomicBEEF');
         const txid = ab.atomicTxid;
         const btx = ab.findTxid(txid);
-        if (!btx)
+        if (btx == null)
             throw new WERR_errors_1.WERR_INVALID_PARAMETER('tx', `valid AtomicBEEF with newest txid of ${txid}`);
         const tx = btx.tx;
-        /*
-        for (const i of tx.inputs) {
-          if (!i.sourceTXID)
-            throw new WERR_INTERNAL('beef Transactions must have sourceTXIDs')
-          if (!i.sourceTransaction) {
-            const btx = ab.findTxid(i.sourceTXID)
-            if (!btx)
-              throw new WERR_INVALID_PARAMETER('tx', `valid AtomicBEEF and contain input transaction with txid ${i.sourceTXID}`);
-            i.sourceTransaction = btx.tx
-          }
-        }
-        */
         return { ab, tx, txid };
     }
     async findOrInsertTargetTransaction(satoshis, provenTx) {
         const now = new Date();
-        const provenTxId = provenTx === null || provenTx === void 0 ? void 0 : provenTx.provenTxId;
-        const status = provenTx ? 'completed' : 'unproven';
+        const provenTxId = provenTx?.provenTxId;
+        const status = (provenTx != null) ? 'completed' : 'unproven';
         const newTx = {
             created_at: now,
             updated_at: now,
@@ -244,11 +374,13 @@ class InternalizeActionContext {
         };
         const tr = await this.storage.findOrInsertTransaction(newTx);
         if (!tr.isNew) {
-            if (!this.isMerge)
-                // For now, only allow transaction record to pre-exist if it was there at the start.
-                throw new WERR_errors_1.WERR_INVALID_PARAMETER('tx', `target transaction of internalizeAction is undergoing active changes.`);
+            if (!this.isMerge) 
+            // For now, only allow transaction record to pre-exist if it was there at the start.
+            {
+                throw new WERR_errors_1.WERR_INVALID_PARAMETER('tx', 'target transaction of internalizeAction is undergoing active changes.');
+            }
             const update = { satoshis: tr.tx.satoshis + satoshis };
-            if (provenTx) {
+            if (provenTx != null) {
                 update.provenTxId = provenTxId;
                 update.status = status;
             }
@@ -256,21 +388,130 @@ class InternalizeActionContext {
         }
         return tr.tx;
     }
-    async mergedInternalize() {
-        const transactionId = this.etx.transactionId;
-        await this.addLabels(transactionId);
+    async findOrInsertProvenTxFromBump(bump, btx) {
+        const now = new Date();
+        const merkleRoot = bump.computeRoot(this.txid);
+        const indexEntry = bump.path[0].find(p => p.hash === this.txid);
+        if (indexEntry == null) {
+            throw new WERR_errors_1.WERR_INTERNAL(`Could not determine transaction index for txid ${this.txid} in bump path. Expected to find txid in bump.path[0]: ${JSON.stringify(bump.path[0])}`);
+        }
+        const index = indexEntry.offset;
+        const header = await this.storage.getServices().getHeaderForHeight(bump.blockHeight);
+        if (!header) {
+            throw new WERR_errors_1.WERR_INTERNAL(`Block header not found for height ${bump.blockHeight}`);
+        }
+        const hash = (0, blockHeaderUtilities_1.blockHash)(header);
+        const provenTxR = await this.storage.findOrInsertProvenTx({
+            created_at: now,
+            updated_at: now,
+            provenTxId: 0,
+            txid: this.txid,
+            height: bump.blockHeight,
+            index,
+            merklePath: bump.toBinary(),
+            rawTx: btx.rawTx,
+            blockHash: hash,
+            merkleRoot
+        });
+        return provenTxR.proven;
+    }
+    async mergeWalletPayments(transactionId) {
         for (const payment of this.walletPayments) {
-            if (payment.eo && !payment.ignore)
+            if (payment.ignore)
+                continue;
+            if (payment.eo != null) {
                 await this.mergeWalletPaymentForOutput(transactionId, payment);
-            else if (!payment.ignore)
+            }
+            else {
                 await this.storeNewWalletPaymentForOutput(transactionId, payment);
+            }
         }
+    }
+    async mergeBasketInsertions(transactionId) {
         for (const basket of this.basketInsertions) {
-            if (basket.eo)
+            if (basket.eo != null) {
                 await this.mergeBasketInsertionForOutput(transactionId, basket);
-            else
+            }
+            else {
                 await this.storeNewBasketInsertionForOutput(transactionId, basket);
+            }
+        }
+    }
+    async retireNoSendWithProof(transactionId, bump) {
+        const beefTx = this.ab.findTxid(this.txid);
+        if (beefTx == null) {
+            throw new WERR_errors_1.WERR_INTERNAL(`Could not find transaction ${this.txid} in AtomicBEEF`);
+        }
+        const proven = await this.findOrInsertProvenTxFromBump(bump, beefTx);
+        await this.storage.updateTransaction(transactionId, {
+            provenTxId: proven.provenTxId,
+            status: 'completed'
+        });
+        const req = await EntityProvenTxReq_1.EntityProvenTxReq.fromStorageTxid(this.storage, this.txid);
+        if (req?.status !== 'nosend')
+            return;
+        req.addHistoryNote({ what: 'internalizeAction-bumpRetire', userId: this.userId });
+        req.provenTxId = proven.provenTxId;
+        req.status = 'completed';
+        await req.updateStorageDynamicProperties(this.storage);
+    }
+    async retireNoSendWithoutProof(transactionId) {
+        await this.storage.updateTransaction(transactionId, { status: 'unproven' });
+        const req = await EntityProvenTxReq_1.EntityProvenTxReq.fromStorageTxid(this.storage, this.txid);
+        if (req?.status !== 'nosend')
+            return;
+        req.addHistoryNote({ what: 'internalizeAction-nosendRetire', userId: this.userId });
+        req.status = 'unmined';
+        await req.updateStorageDynamicProperties(this.storage);
+    }
+    async retireNoSendTransaction(transactionId) {
+        const bump = this.ab.findBump(this.txid);
+        if (bump != null) {
+            await this.retireNoSendWithProof(transactionId, bump);
         }
+        else {
+            await this.retireNoSendWithoutProof(transactionId);
+        }
+    }
+    async mergedInternalize() {
+        const transactionId = this.etx.transactionId;
+        const wasNoSend = this.etx.status === 'nosend';
+        await this.addLabels(transactionId);
+        // Externally-broadcast txs internalized into a pre-existing storage
+        // record (typically a nosend created by this wallet) still need their
+        // consumed user UTXOs marked spent. createAction marks them when the
+        // tx is wallet-originated, but a nosend can be merged from a sender
+        // that doesn't share storage. Idempotent for the wallet-originated
+        // case — already-spent outputs are skipped.
+        await this.markInputsSpent(transactionId);
+        await this.mergeWalletPayments(transactionId);
+        await this.mergeBasketInsertions(transactionId);
+        // Lifecycle advance when merging into a tx that was 'nosend'.
+        //
+        // Background: an internalizeAction call against an existing tx in
+        // 'nosend' status is the caller asserting the tx has now been
+        // externally broadcast (and potentially mined if the BEEF includes
+        // a BUMP). Before this advance, mergedInternalize only updated
+        // labels + per-output ownership records and left transactions.status
+        // and proven_tx_reqs.status unchanged. The nosend state then had no
+        // reliable retirement path: TaskCheckNoSends's default daily cadence
+        // combined with intermittent wallet uptime meant the req could sit
+        // in 'nosend' indefinitely, and a subsequent abortAction call would
+        // unconditionally invalidate the on-chain tx — orphaning every
+        // output the tx produced.
+        //
+        // BUMP-present path: mirror newInternalize's findOrInsertProvenTx
+        // path, then promote the existing transaction record to 'completed'
+        // with the new provenTxId and retire the proven_tx_req to
+        // 'completed' too.
+        //
+        // BUMP-absent path: promote transactions.status to 'unproven' (so
+        // listOutputs filters the tx's outputs into the spendable set
+        // immediately) and transition the proven_tx_req to 'unmined' so
+        // TaskCheckForProofs picks it up on its next nudge cycle. This
+        // hands off to Monitor's standard proof-fetching flow.
+        if (wasNoSend)
+            await this.retireNoSendTransaction(transactionId);
     }
     /**
      * internalize output(s) from a transaction with txid unknown to storage.
@@ -278,43 +519,22 @@ class InternalizeActionContext {
     async newInternalize() {
         // Check if the transaction has a merkle path proof (BUMP)
         const btx = this.ab.findTxid(this.txid);
-        if (!btx)
+        if (btx == null)
             throw new WERR_errors_1.WERR_INTERNAL(`Could not find transaction ${this.txid} in AtomicBEEF`);
         const bump = this.ab.findBump(this.txid);
         let pr = { isNew: false, proven: undefined, req: undefined };
-        if (bump) {
+        if (bump != null) {
             // The presence bump indicates the transaction has already been mined.
             // Verify a provenTx record exist before creating a new transaction with completed status...
             // Which normally means creating a new provenTx record.
-            const now = new Date();
-            const merkleRoot = bump.computeRoot(this.txid);
-            const indexEntry = bump.path[0].find(p => p.hash === this.txid);
-            if (!indexEntry) {
-                throw new WERR_errors_1.WERR_INTERNAL(`Could not determine transaction index for txid ${this.txid} in bump path. Expected to find txid in bump.path[0]: ${JSON.stringify(bump.path[0])}`);
-            }
-            const index = indexEntry.offset;
-            const header = await this.storage.getServices().getHeaderForHeight(bump.blockHeight);
-            if (!header) {
-                throw new WERR_errors_1.WERR_INTERNAL(`Block header not found for height ${bump.blockHeight}`);
-            }
-            const hash = (0, blockHeaderUtilities_1.blockHash)(header);
-            const provenTxR = await this.storage.findOrInsertProvenTx({
-                created_at: now,
-                updated_at: now,
-                provenTxId: 0,
-                txid: this.txid,
-                height: bump.blockHeight,
-                index,
-                merklePath: bump.toBinary(),
-                rawTx: btx.rawTx,
-                blockHash: hash,
-                merkleRoot: merkleRoot
-            });
-            pr.proven = provenTxR.proven;
+            pr.proven = await this.findOrInsertProvenTxFromBump(bump, btx);
         }
         this.etx = await this.findOrInsertTargetTransaction(this.satoshis, pr.proven);
         const transactionId = this.etx.transactionId;
-        if (!pr.proven) {
+        // Mark any user-owned outputs the incoming tx consumes as spent BEFORE
+        // attempting broadcast. If broadcast fails we restore them below.
+        await this.markInputsSpent(transactionId);
+        if (pr.proven == null) {
             // beef doesn't include proof of mining for the transaction (etx).
             // the new transaction record has been added to storage, but (baring race conditions)
             // there should be no provenTx or provenTxReq records for this txid.
@@ -337,11 +557,16 @@ class InternalizeActionContext {
             // The beef may contain additional unbroadcast transactions which
             // we don't care about.
             const r = {
-                beef: sdk_1.Beef.fromBinary(this.args.tx),
+                beef: this.ab,
                 details: [{ txid: this.txid, status: 'readyToSend', req: pr.req }]
             };
             const { swr, ndr } = await (0, processAction_1.shareReqsWithWorld)(this.storage, this.userId, [], false, r);
             if (ndr[0].status !== 'success') {
+                // Roll back the spendable=true → false transitions performed above
+                // so the caller can retry with the same UTXOs. Idempotent w.r.t.
+                // attemptToPostReqsToNetwork's own updateTransactionStatus('failed')
+                // restore on doubleSpend/invalidTx outcomes.
+                await this.restoreSpentInputs();
                 this.r.sendWithResults = swr;
                 this.r.notDelayedResults = ndr;
                 // abort the internalize action, WERR_REVIEW_ACTIONS exception will be thrown
@@ -357,11 +582,19 @@ class InternalizeActionContext {
         }
     }
     async addLabels(transactionId) {
-        for (const label of this.vargs.labels) {
+        for (const label of (0, brc153ReferenceLabels_1.stripBrc153ReferenceLabels)(this.vargs.labels)) {
             const txLabel = await this.storage.findOrInsertTxLabel(this.userId, label);
             await this.storage.findOrInsertTxLabelMap((0, utilityHelpers_1.verifyId)(transactionId), (0, utilityHelpers_1.verifyId)(txLabel.txLabelId));
         }
     }
+    async markInputsSpent(transactionId) {
+        const transitioned = await markUserInputsSpent(this.storage, this.userId, this.tx, transactionId);
+        this.spentInputs.push(...transitioned);
+    }
+    async restoreSpentInputs() {
+        await restoreInputsToSpendable(this.storage, this.spentInputs);
+        this.spentInputs = [];
+    }
     async addBasketTags(basket, outputId) {
         for (const tag of basket.tags || []) {
             await this.storage.tagOutput({ outputId, userId: this.userId }, tag);