@bopen-io/wallet-toolbox 2.6.2-brc153.5 → 2.15.0-bopen.1

package/out/src/storage/methods/internalizeAction.js

@@ -3,9 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.markUserInputsSpent = markUserInputsSpent;
 exports.restoreInputsToSpendable = restoreInputsToSpendable;
 exports.internalizeAction = internalizeAction;
+const validationHelpers_1 = require("@bsv/sdk/wallet/validationHelpers");
 const sdk_1 = require("@bsv/sdk");
+const utils_1 = require("@bsv/sdk/primitives/utils");
 const processAction_1 = require("./processAction");
 const WERR_errors_1 = require("../../sdk/WERR_errors");
+const canonicalizeAtomicBeef_1 = require("../../utility/canonicalizeAtomicBeef");
 const utilityHelpers_1 = require("../../utility/utilityHelpers");
 const EntityProvenTxReq_1 = require("../schema/entities/EntityProvenTxReq");
 const blockHeaderUtilities_1 = require("../../services/chaintracker/chaintracks/util/blockHeaderUtilities");
@@ -38,7 +41,7 @@ const managedChange_1 = require("./managedChange");
  * `spentBy` a different transaction are also skipped (a competing spend
  * has been recorded; do not overwrite).
  */
-async function markUserInputsSpent(storage, userId, tx, transactionId) {
+async function markUserInputsSpent(storage, userId, tx, transactionId, trx) {
     const outpoints = tx.inputs
         .map(i => ({ txid: i.sourceTXID ?? '', vout: i.sourceOutputIndex ?? 0 }))
         .filter(o => o.txid !== '');
@@ -65,7 +68,7 @@ async function markUserInputsSpent(storage, userId, tx, transactionId) {
                 transitioned.push({ outputId: (0, utilityHelpers_1.verifyId)(o.outputId), setSpentBy });
             }
         }
-    });
+    }, trx);
     return transitioned;
 }
 /**
@@ -84,17 +87,15 @@ async function markUserInputsSpent(storage, userId, tx, transactionId) {
  * covers cross-user rows and any path where the downstream restore did not
  * run, and is a no-op when the downstream restore already happened.
  */
-async function restoreInputsToSpendable(storage, transitions) {
+async function restoreInputsToSpendable(storage, transitions, trx) {
     if (transitions.length === 0)
         return;
     await storage.transaction(async (trx) => {
         for (const t of transitions) {
-            const update = t.setSpentBy
-                ? { spendable: true, spentBy: undefined }
-                : { spendable: true };
+            const update = t.setSpentBy ? { spendable: true, spentBy: undefined } : { spendable: true };
             await storage.updateOutput((0, utilityHelpers_1.verifyId)(t.outputId), update, trx);
         }
-    });
+    }, trx);
 }
 /**
  * Internalize Action allows a wallet to take ownership of outputs in a pre-existing transaction.
@@ -175,7 +176,7 @@ class InternalizeActionContext {
         this.storage = storage;
         this.auth = auth;
         this.args = args;
-        this.vargs = sdk_1.Validation.validateInternalizeActionArgs(args);
+        this.vargs = (0, validationHelpers_1.validateInternalizeActionArgs)(args);
         this.userId = auth.userId;
         this.r = {
             accepted: true,
@@ -210,14 +211,14 @@ class InternalizeActionContext {
     set satoshis(v) {
         this.r.satoshis = v;
     }
-    async getBasket(basketName) {
+    async getBasket(basketName, trx) {
         if (basketName === 'default') {
             throw new WERR_errors_1.WERR_INVALID_PARAMETER('insertionRemittance.basket', 'a non-default basket');
         }
         let b = this.baskets[basketName];
         if (b)
             return b;
-        b = await this.storage.findOrInsertOutputBasket(this.userId, basketName);
+        b = await this.storage.findOrInsertOutputBasket(this.userId, basketName, trx);
         this.baskets[basketName] = b;
         return b;
     }
@@ -257,12 +258,7 @@ class InternalizeActionContext {
         this.etx = (0, utilityHelpers_1.verifyOneOrNone)(await this.storage.findTransactions({
             partial: { userId: this.userId, txid: this.txid }
         }));
-        const allowedStatuses = [
-            'completed',
-            'unproven',
-            'sending',
-            'nosend'
-        ];
+        const allowedStatuses = ['completed', 'unproven', 'sending', 'nosend'];
         if (this.etx != null && !allowedStatuses.includes(this.etx.status)) {
             throw new WERR_errors_1.WERR_INVALID_PARAMETER('tx', `target transaction of internalizeAction has invalid status ${this.etx.status}.`);
         }
@@ -286,13 +282,45 @@ class InternalizeActionContext {
                 payment.eo = existing;
         }
     }
-    validateBasketMerges() {
+    /**
+     * Rejects a basket-insertion merge that would silently move an existing
+     * output between baskets. Without this, an app with insertion permission on
+     * basket X only (checked at the WalletPermissionsManager layer against the
+     * *requested* basket) could internalize an already-known transaction and
+     * reclassify another app's output from basket Y into X, then spend it.
+     *
+     * An output currently sitting in the wallet's own 'default'/change basket
+     * without being wallet-managed change is not a real, app-claimed basket
+     * assignment — it is the documented legacy-recovery state (see
+     * `internalizeActionManagedChangePolicy.test.ts`), and 'default' can never
+     * be requested as an insertion destination (see `getBasket`), so it is
+     * exempt from this check and remains sweepable into a real basket.
+     *
+     * The requested basket is resolved with a plain, non-inserting lookup
+     * (`findOutputBaskets`) so that a request which is then rejected never
+     * creates the named basket as a side effect.
+     */
+    async validateBasketMerges() {
         if (!this.isMerge)
             return;
         for (const basket of this.basketInsertions) {
-            if (basket.eo != null && (0, managedChange_1.isManagedChangeOutput)(basket.eo)) {
+            const eo = basket.eo;
+            if (eo == null)
+                continue;
+            // Widened so the type guard's false branch does not narrow `eo` to never.
+            if ((0, managedChange_1.isManagedChangeOutput)(eo)) {
                 throw new WERR_errors_1.WERR_INVALID_PARAMETER('outputs', `output ${basket.vout} is wallet-managed change and cannot be reclassified as a basket insertion`);
             }
+            const currentBasketId = eo.basketId;
+            if (currentBasketId == null || currentBasketId === this.changeBasket.basketId)
+                continue;
+            const requestedBasket = (0, utilityHelpers_1.verifyOneOrNone)(await this.storage.findOutputBaskets({ partial: { userId: this.userId, name: basket.basket } }));
+            if (requestedBasket?.basketId !== currentBasketId) {
+                throw new WERR_errors_1.WERR_INVALID_PARAMETER('outputs', `output ${basket.vout} is already assigned to a different basket and cannot be reclassified as a basket insertion into ${basket.basket}`);
+            }
+            // Same basket already: cache it so mergeBasketInsertionForOutput's later
+            // getBasket call reuses this lookup instead of repeating it.
+            this.baskets[basket.basket] = requestedBasket;
         }
     }
     computeWalletPaymentBalance() {
@@ -301,8 +329,7 @@ class InternalizeActionContext {
                 this.satoshis += payment.txo.satoshis;
                 continue;
             }
-            if ((0, managedChange_1.isManagedChangeOutput)(payment.eo) &&
-                payment.eo.basketId === this.changeBasket.basketId) {
+            if ((0, managedChange_1.isManagedChangeOutput)(payment.eo) && payment.eo.basketId === this.changeBasket.basketId) {
                 payment.ignore = true;
                 continue;
             }
@@ -320,7 +347,7 @@ class InternalizeActionContext {
         this.baskets = {};
         await this.loadExistingTransaction();
         await this.linkExistingOutputs();
-        this.validateBasketMerges();
+        await this.validateBasketMerges();
         this.computeWalletPaymentBalance();
     }
     /**
@@ -339,7 +366,7 @@ class InternalizeActionContext {
      * @returns
      */
     async validateAtomicBeef(atomicBeef) {
-        const ab = atomicBeef instanceof Uint8Array ? sdk_1.Beef.fromBinaryView(atomicBeef) : sdk_1.Beef.fromBinary(atomicBeef);
+        const ab = (0, canonicalizeAtomicBeef_1.canonicalizeAtomicBeef)(atomicBeef);
         const txValid = await ab.verify(await this.storage.getServices().getChainTracker(), false);
         if (!txValid || !ab.atomicTxid)
             throw new WERR_errors_1.WERR_INVALID_PARAMETER('tx', 'valid AtomicBEEF');
@@ -350,10 +377,10 @@ class InternalizeActionContext {
         const tx = btx.tx;
         return { ab, tx, txid };
     }
-    async findOrInsertTargetTransaction(satoshis, provenTx) {
+    async findOrInsertTargetTransaction(satoshis, provenTx, trx) {
         const now = new Date();
         const provenTxId = provenTx?.provenTxId;
-        const status = (provenTx != null) ? 'completed' : 'unproven';
+        const status = provenTx != null ? 'completed' : 'unproven';
         const newTx = {
             created_at: now,
             updated_at: now,
@@ -371,7 +398,7 @@ class InternalizeActionContext {
             txid: this.txid,
             rawTx: undefined
         };
-        const tr = await this.storage.findOrInsertTransaction(newTx);
+        const tr = await this.storage.findOrInsertTransaction(newTx, trx);
         if (!tr.isNew) {
             if (!this.isMerge) 
             // For now, only allow transaction record to pre-exist if it was there at the start.
@@ -383,11 +410,11 @@ class InternalizeActionContext {
                 update.provenTxId = provenTxId;
                 update.status = status;
             }
-            await this.storage.updateTransaction(tr.tx.transactionId, update);
+            await this.storage.updateTransaction(tr.tx.transactionId, update, trx);
         }
         return tr.tx;
     }
-    async findOrInsertProvenTxFromBump(bump, btx) {
+    async findOrInsertProvenTxFromBump(bump, btx, trx) {
         const now = new Date();
         const merkleRoot = bump.computeRoot(this.txid);
         const indexEntry = bump.path[0].find(p => p.hash === this.txid);
@@ -411,106 +438,108 @@ class InternalizeActionContext {
             rawTx: btx.rawTx,
             blockHash: hash,
             merkleRoot
-        });
+        }, trx);
         return provenTxR.proven;
     }
-    async mergeWalletPayments(transactionId) {
+    async mergeWalletPayments(transactionId, trx) {
         for (const payment of this.walletPayments) {
             if (payment.ignore)
                 continue;
             if (payment.eo != null) {
-                await this.mergeWalletPaymentForOutput(transactionId, payment);
+                await this.mergeWalletPaymentForOutput(transactionId, payment, trx);
             }
             else {
-                await this.storeNewWalletPaymentForOutput(transactionId, payment);
+                await this.storeNewWalletPaymentForOutput(transactionId, payment, trx);
             }
         }
     }
-    async mergeBasketInsertions(transactionId) {
+    async mergeBasketInsertions(transactionId, trx) {
         for (const basket of this.basketInsertions) {
             if (basket.eo != null) {
-                await this.mergeBasketInsertionForOutput(transactionId, basket);
+                await this.mergeBasketInsertionForOutput(transactionId, basket, trx);
             }
             else {
-                await this.storeNewBasketInsertionForOutput(transactionId, basket);
+                await this.storeNewBasketInsertionForOutput(transactionId, basket, trx);
             }
         }
     }
-    async retireNoSendWithProof(transactionId, bump) {
+    async retireNoSendWithProof(transactionId, bump, trx) {
         const beefTx = this.ab.findTxid(this.txid);
         if (beefTx == null) {
             throw new WERR_errors_1.WERR_INTERNAL(`Could not find transaction ${this.txid} in AtomicBEEF`);
         }
-        const proven = await this.findOrInsertProvenTxFromBump(bump, beefTx);
+        const proven = await this.findOrInsertProvenTxFromBump(bump, beefTx, trx);
         await this.storage.updateTransaction(transactionId, {
             provenTxId: proven.provenTxId,
             status: 'completed'
-        });
-        const req = await EntityProvenTxReq_1.EntityProvenTxReq.fromStorageTxid(this.storage, this.txid);
+        }, trx);
+        const req = await EntityProvenTxReq_1.EntityProvenTxReq.fromStorageTxid(this.storage, this.txid, trx);
         if (req?.status !== 'nosend')
             return;
         req.addHistoryNote({ what: 'internalizeAction-bumpRetire', userId: this.userId });
         req.provenTxId = proven.provenTxId;
         req.status = 'completed';
-        await req.updateStorageDynamicProperties(this.storage);
+        await req.updateStorageDynamicProperties(this.storage, trx);
     }
-    async retireNoSendWithoutProof(transactionId) {
-        await this.storage.updateTransaction(transactionId, { status: 'unproven' });
-        const req = await EntityProvenTxReq_1.EntityProvenTxReq.fromStorageTxid(this.storage, this.txid);
+    async retireNoSendWithoutProof(transactionId, trx) {
+        await this.storage.updateTransaction(transactionId, { status: 'unproven' }, trx);
+        const req = await EntityProvenTxReq_1.EntityProvenTxReq.fromStorageTxid(this.storage, this.txid, trx);
         if (req?.status !== 'nosend')
             return;
         req.addHistoryNote({ what: 'internalizeAction-nosendRetire', userId: this.userId });
         req.status = 'unmined';
-        await req.updateStorageDynamicProperties(this.storage);
+        await req.updateStorageDynamicProperties(this.storage, trx);
     }
-    async retireNoSendTransaction(transactionId) {
+    async retireNoSendTransaction(transactionId, trx) {
         const bump = this.ab.findBump(this.txid);
         if (bump != null) {
-            await this.retireNoSendWithProof(transactionId, bump);
+            await this.retireNoSendWithProof(transactionId, bump, trx);
         }
         else {
-            await this.retireNoSendWithoutProof(transactionId);
+            await this.retireNoSendWithoutProof(transactionId, trx);
         }
     }
     async mergedInternalize() {
         const transactionId = this.etx.transactionId;
         const wasNoSend = this.etx.status === 'nosend';
-        await this.addLabels(transactionId);
-        // Externally-broadcast txs internalized into a pre-existing storage
-        // record (typically a nosend created by this wallet) still need their
-        // consumed user UTXOs marked spent. createAction marks them when the
-        // tx is wallet-originated, but a nosend can be merged from a sender
-        // that doesn't share storage. Idempotent for the wallet-originated
-        // case — already-spent outputs are skipped.
-        await this.markInputsSpent(transactionId);
-        await this.mergeWalletPayments(transactionId);
-        await this.mergeBasketInsertions(transactionId);
-        // Lifecycle advance when merging into a tx that was 'nosend'.
-        //
-        // Background: an internalizeAction call against an existing tx in
-        // 'nosend' status is the caller asserting the tx has now been
-        // externally broadcast (and potentially mined if the BEEF includes
-        // a BUMP). Before this advance, mergedInternalize only updated
-        // labels + per-output ownership records and left transactions.status
-        // and proven_tx_reqs.status unchanged. The nosend state then had no
-        // reliable retirement path: TaskCheckNoSends's default daily cadence
-        // combined with intermittent wallet uptime meant the req could sit
-        // in 'nosend' indefinitely, and a subsequent abortAction call would
-        // unconditionally invalidate the on-chain tx — orphaning every
-        // output the tx produced.
-        //
-        // BUMP-present path: mirror newInternalize's findOrInsertProvenTx
-        // path, then promote the existing transaction record to 'completed'
-        // with the new provenTxId and retire the proven_tx_req to
-        // 'completed' too.
-        //
-        // BUMP-absent path: promote transactions.status to 'unproven' (so
-        // listOutputs filters the tx's outputs into the spendable set
-        // immediately) and transition the proven_tx_req to 'unmined' so
-        // TaskCheckForProofs picks it up on its next nudge cycle. This
-        // hands off to Monitor's standard proof-fetching flow.
-        if (wasNoSend)
-            await this.retireNoSendTransaction(transactionId);
+        await this.storage.transaction(async (trx) => {
+            await this.addLabels(transactionId, trx);
+            // Externally-broadcast txs internalized into a pre-existing storage
+            // record (typically a nosend created by this wallet) still need their
+            // consumed user UTXOs marked spent. createAction marks them when the
+            // tx is wallet-originated, but a nosend can be merged from a sender
+            // that doesn't share storage. Idempotent for the wallet-originated
+            // case — already-spent outputs are skipped.
+            await this.markInputsSpent(transactionId, trx);
+            await this.mergeWalletPayments(transactionId, trx);
+            await this.mergeBasketInsertions(transactionId, trx);
+            // Lifecycle advance when merging into a tx that was 'nosend'.
+            //
+            // Background: an internalizeAction call against an existing tx in
+            // 'nosend' status is the caller asserting the tx has now been
+            // externally broadcast (and potentially mined if the BEEF includes
+            // a BUMP). Before this advance, mergedInternalize only updated
+            // labels + per-output ownership records and left transactions.status
+            // and proven_tx_reqs.status unchanged. The nosend state then had no
+            // reliable retirement path: TaskCheckNoSends's default daily cadence
+            // combined with intermittent wallet uptime meant the req could sit
+            // in 'nosend' indefinitely, and a subsequent abortAction call would
+            // unconditionally invalidate the on-chain tx — orphaning every
+            // output the tx produced.
+            //
+            // BUMP-present path: mirror newInternalize's findOrInsertProvenTx
+            // path, then promote the existing transaction record to 'completed'
+            // with the new provenTxId and retire the proven_tx_req to
+            // 'completed' too.
+            //
+            // BUMP-absent path: promote transactions.status to 'unproven' (so
+            // listOutputs filters the tx's outputs into the spendable set
+            // immediately) and transition the proven_tx_req to 'unmined' so
+            // TaskCheckForProofs picks it up on its next nudge cycle. This
+            // hands off to Monitor's standard proof-fetching flow.
+            if (wasNoSend)
+                await this.retireNoSendTransaction(transactionId, trx);
+        });
     }
     /**
      * internalize output(s) from a transaction with txid unknown to storage.
@@ -522,31 +551,34 @@ class InternalizeActionContext {
             throw new WERR_errors_1.WERR_INTERNAL(`Could not find transaction ${this.txid} in AtomicBEEF`);
         const bump = this.ab.findBump(this.txid);
         let pr = { isNew: false, proven: undefined, req: undefined };
-        if (bump != null) {
-            // The presence bump indicates the transaction has already been mined.
-            // Verify a provenTx record exist before creating a new transaction with completed status...
-            // Which normally means creating a new provenTx record.
-            pr.proven = await this.findOrInsertProvenTxFromBump(bump, btx);
-        }
-        this.etx = await this.findOrInsertTargetTransaction(this.satoshis, pr.proven);
+        await this.storage.transaction(async (trx) => {
+            if (bump != null) {
+                // The presence bump indicates the transaction has already been mined.
+                // Verify a provenTx record exist before creating a new transaction with completed status...
+                // Which normally means creating a new provenTx record.
+                pr.proven = await this.findOrInsertProvenTxFromBump(bump, btx, trx);
+            }
+            this.etx = await this.findOrInsertTargetTransaction(this.satoshis, pr.proven, trx);
+            const transactionId = this.etx.transactionId;
+            // Mark any user-owned outputs the incoming tx consumes as spent BEFORE
+            // attempting broadcast. If broadcast fails we restore them below.
+            await this.markInputsSpent(transactionId, trx);
+            if (pr.proven == null) {
+                // beef doesn't include proof of mining for the transaction (etx).
+                // the new transaction record has been added to storage, but (baring race conditions)
+                // there should be no provenTx or provenTxReq records for this txid.
+                //
+                // Attempt to create a provenTxReq record for the txid to obtain a proof,
+                // while allowing for possible race conditions...
+                const newReq = EntityProvenTxReq_1.EntityProvenTxReq.fromTxid(this.txid, this.tx.toBinary(), (0, utils_1.toArray)(this.args.tx));
+                newReq.status = 'unsent';
+                // this history and notify will be merged into an existing req if it exists.
+                newReq.addHistoryNote({ what: 'internalizeAction', userId: this.userId });
+                newReq.addNotifyTransactionId(transactionId);
+                pr = await this.storage.getProvenOrReq(this.txid, newReq.toApi(), trx);
+            }
+        });
         const transactionId = this.etx.transactionId;
-        // Mark any user-owned outputs the incoming tx consumes as spent BEFORE
-        // attempting broadcast. If broadcast fails we restore them below.
-        await this.markInputsSpent(transactionId);
-        if (pr.proven == null) {
-            // beef doesn't include proof of mining for the transaction (etx).
-            // the new transaction record has been added to storage, but (baring race conditions)
-            // there should be no provenTx or provenTxReq records for this txid.
-            //
-            // Attempt to create a provenTxReq record for the txid to obtain a proof,
-            // while allowing for possible race conditions...
-            const newReq = EntityProvenTxReq_1.EntityProvenTxReq.fromTxid(this.txid, this.tx.toBinary(), sdk_1.Utils.toArray(this.args.tx));
-            newReq.status = 'unsent';
-            // this history and notify will be merged into an existing req if it exists.
-            newReq.addHistoryNote({ what: 'internalizeAction', userId: this.userId });
-            newReq.addNotifyTransactionId(transactionId);
-            pr = await this.storage.getProvenOrReq(this.txid, newReq.toApi());
-        }
         if (pr.isNew) {
             // This storage didn't know about this txid and the beef didn't include a mining proof.
             // Assume the transaction has never been broadcast.
@@ -572,34 +604,40 @@ class InternalizeActionContext {
                 return;
             }
         }
-        await this.addLabels(transactionId);
-        for (const payment of this.walletPayments) {
-            await this.storeNewWalletPaymentForOutput(transactionId, payment);
-        }
-        for (const basket of this.basketInsertions) {
-            await this.storeNewBasketInsertionForOutput(transactionId, basket);
-        }
+        // Network publication cannot safely run while a database transaction is
+        // held open. Persist all post-broadcast wallet ownership state as one
+        // atomic phase after publication succeeds (or when no publication was
+        // necessary).
+        await this.storage.transaction(async (trx) => {
+            await this.addLabels(transactionId, trx);
+            for (const payment of this.walletPayments) {
+                await this.storeNewWalletPaymentForOutput(transactionId, payment, trx);
+            }
+            for (const basket of this.basketInsertions) {
+                await this.storeNewBasketInsertionForOutput(transactionId, basket, trx);
+            }
+        });
     }
-    async addLabels(transactionId) {
+    async addLabels(transactionId, trx) {
         for (const label of this.vargs.labels) {
-            const txLabel = await this.storage.findOrInsertTxLabel(this.userId, label);
-            await this.storage.findOrInsertTxLabelMap((0, utilityHelpers_1.verifyId)(transactionId), (0, utilityHelpers_1.verifyId)(txLabel.txLabelId));
+            const txLabel = await this.storage.findOrInsertTxLabel(this.userId, label, trx);
+            await this.storage.findOrInsertTxLabelMap((0, utilityHelpers_1.verifyId)(transactionId), (0, utilityHelpers_1.verifyId)(txLabel.txLabelId), trx);
         }
     }
-    async markInputsSpent(transactionId) {
-        const transitioned = await markUserInputsSpent(this.storage, this.userId, this.tx, transactionId);
+    async markInputsSpent(transactionId, trx) {
+        const transitioned = await markUserInputsSpent(this.storage, this.userId, this.tx, transactionId, trx);
         this.spentInputs.push(...transitioned);
     }
-    async restoreSpentInputs() {
-        await restoreInputsToSpendable(this.storage, this.spentInputs);
+    async restoreSpentInputs(trx) {
+        await restoreInputsToSpendable(this.storage, this.spentInputs, trx);
         this.spentInputs = [];
     }
-    async addBasketTags(basket, outputId) {
+    async addBasketTags(basket, outputId, trx) {
         for (const tag of basket.tags || []) {
-            await this.storage.tagOutput({ outputId, userId: this.userId }, tag);
+            await this.storage.tagOutput({ outputId, userId: this.userId }, tag, trx);
         }
     }
-    async storeNewWalletPaymentForOutput(transactionId, payment) {
+    async storeNewWalletPaymentForOutput(transactionId, payment, trx) {
         const now = new Date();
         const txOut = {
             created_at: now,
@@ -625,10 +663,10 @@ class InternalizeActionContext {
             outputDescription: '',
             spendingDescription: undefined
         };
-        txOut.outputId = await this.storage.insertOutput(txOut);
+        txOut.outputId = await this.storage.insertOutput(txOut, trx);
         payment.eo = txOut;
     }
-    async mergeWalletPaymentForOutput(transactionId, payment) {
+    async mergeWalletPaymentForOutput(transactionId, payment, trx) {
         const outputId = payment.eo.outputId;
         const update = {
             basketId: this.changeBasket.basketId,
@@ -641,13 +679,13 @@ class InternalizeActionContext {
             derivationPrefix: payment.derivationPrefix,
             derivationSuffix: payment.derivationSuffix
         };
-        await this.storage.updateOutput(outputId, update);
+        await this.storage.updateOutput(outputId, update, trx);
         payment.eo = { ...payment.eo, ...update };
     }
-    async mergeBasketInsertionForOutput(transactionId, basket) {
+    async mergeBasketInsertionForOutput(transactionId, basket, trx) {
         const outputId = basket.eo.outputId;
         const update = {
-            basketId: (await this.getBasket(basket.basket)).basketId,
+            basketId: (await this.getBasket(basket.basket, trx)).basketId,
             type: 'custom',
             customInstructions: basket.customInstructions,
             change: false,
@@ -657,10 +695,10 @@ class InternalizeActionContext {
             derivationPrefix: undefined,
             derivationSuffix: undefined
         };
-        await this.storage.updateOutput(outputId, update);
+        await this.storage.updateOutput(outputId, update, trx);
         basket.eo = { ...basket.eo, ...update };
     }
-    async storeNewBasketInsertionForOutput(transactionId, basket) {
+    async storeNewBasketInsertionForOutput(transactionId, basket, trx) {
         const now = new Date();
         const txOut = {
             created_at: now,
@@ -671,7 +709,7 @@ class InternalizeActionContext {
             spendable: true,
             lockingScript: basket.txo.lockingScript.toBinary(),
             vout: basket.vout,
-            basketId: (await this.getBasket(basket.basket)).basketId,
+            basketId: (await this.getBasket(basket.basket, trx)).basketId,
             satoshis: basket.txo.satoshis,
             txid: this.txid,
             type: 'custom',
@@ -686,8 +724,8 @@ class InternalizeActionContext {
             derivationPrefix: undefined,
             derivationSuffix: undefined
         };
-        txOut.outputId = await this.storage.insertOutput(txOut);
-        await this.addBasketTags(basket, txOut.outputId);
+        txOut.outputId = await this.storage.insertOutput(txOut, trx);
+        await this.addBasketTags(basket, txOut.outputId, trx);
         basket.eo = txOut;
     }
 }