@bsv/wallet-toolbox-client 2.1.24 → 3.0.0-alpha.0

package/out/src/storage/methods/attemptToPostReqsToNetwork.d.ts

@@ -9,6 +9,88 @@ import * as sdk from '../../sdk';
  * @param reqs
  */
 export declare function attemptToPostReqsToNetwork(storage: StorageProvider, reqs: EntityProvenTxReq[], trx?: sdk.TrxToken, logger?: WalletLoggerInterface): Promise<PostReqsToNetworkResult>;
+/**
+ * For each txid in submitted `txids`:
+ *
+ *   Based on its aggregate status, and whether broadcast happening in background (isDelayed) or immediately (!isDelayed),
+ *   and iff current req.status is not 'unproven' or 'completed':
+ *
+ *     'success':
+ *       req.status => 'unmined', tx.status => 'unproven'
+ *     'doubleSpend':
+ *       req.status => 'doubleSpend', tx.status => 'failed'
+ *     'invalidTx':
+ *       req.status => 'invalid', tx.status => 'failed'
+ *     'serviceError':
+ *       increment req.attempts
+ *
+ * @param txids
+ * @param apbrs
+ * @param storage
+ * @param services if valid, doubleSpend results will be verified (but only if not within a trx. e.g. trx must be undefined)
+ * @param trx
+ */
+export declare function updateReqsFromAggregateResults(txids: string[], r: PostReqsToNetworkResult, apbrs: Record<string, AggregatePostBeefTxResult>, storage: StorageProvider, services?: sdk.WalletServices, trx?: sdk.TrxToken, logger?: WalletLoggerInterface): Promise<void>;
+/**
+ * After any failed broadcast (doubleSpend, invalidTx, etc.), query each
+ * consumed-input outpoint of the failed transaction against on-chain
+ * UTXO state. For inputs the chain authoritatively confirms are spent
+ * (i.e. NOT a UTXO), update the corresponding wallet basket entry to
+ * spendable=false.
+ *
+ * Background: `updateTransactionStatus(failed)` optimistically restores
+ * all consumed-input outputs to spendable=true so the user can retry
+ * with the same inputs. For some failures (genuine doubleSpend, or any
+ * 'missing-inputs' outcome where the input has been spent on chain by
+ * a different transaction), restoration is incorrect — the input is
+ * gone and restoring it produces an infinite missing-inputs loop on
+ * the next createAction → broadcast cycle. Apps cannot evict from the
+ * default basket on app-isolated wallets (admin-only policy), so this
+ * self-heal must run inside the wallet.
+ *
+ * Different broadcasters classify the same on-chain reality differently
+ * (ARC → doubleSpend, WhatsOnChain/Bitails → invalidTx via
+ * 'missing-inputs'); this helper is broadcaster-agnostic because its
+ * decision is based on services.isUtxo, not the aggregate failure
+ * classification.
+ *
+ * Pre-broadcast races where concurrent createActions reach the same
+ * UTXO across separate app processes are out of scope; see PR
+ * description.
+ *
+ * Conservatively scoped:
+ *   - Only inputs found in the failing user's basket are touched.
+ *   - Inputs whose on-chain UTXO status cannot be determined (service
+ *     error / inconclusive) are left spendable=true. Eviction is opt-in
+ *     based on positive evidence of stale state.
+ *   - Inputs the chain confirms are still UTXOs (e.g. a competing tx
+ *     itself failed, or a malformed/fee failure where inputs are intact)
+ *     are left spendable=true — preserving the existing transient-retry
+ *     semantics callers depend on.
+ *
+ * Returns counts for instrumentation and the set of stale outpoints
+ * that were actually evicted (added to history note for diagnostics).
+ */
+export declare function markStaleInputsAsSpent(ar: AggregatePostBeefTxResult, storage: StorageProvider, services: sdk.WalletServices, trx?: sdk.TrxToken, logger?: WalletLoggerInterface): Promise<{
+    checked: number;
+    staleConfirmed: number;
+    staleOutpoints: string[];
+}>;
+type AggregateStatus = 'success' | 'doubleSpend' | 'invalidTx' | 'serviceError';
+export interface AggregatePostBeefTxResult {
+    txid: string;
+    txidResults: sdk.PostTxResultForTxid[];
+    status: AggregateStatus;
+    vreq: PostReqsToNetworkDetails;
+    successCount: number;
+    doubleSpendCount: number;
+    statusErrorCount: number;
+    serviceErrorCount: number;
+    /**
+     * Any competing double spend txids reported for this txid
+     */
+    competingTxs: string[];
+}
 /**
  * Indicates status of a new Action following a `createAction` or `signAction` in immediate mode:
  * When `acceptDelayedBroadcast` is falses.
@@ -38,4 +120,5 @@ export interface PostReqsToNetworkResult {
     details: PostReqsToNetworkDetails[];
     log: string;
 }
+export {};
 //# sourceMappingURL=attemptToPostReqsToNetwork.d.ts.map

package/out/src/storage/methods/attemptToPostReqsToNetwork.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attemptToPostReqsToNetwork.d.ts","sourceRoot":"","sources":["../../../../../src/storage/methods/attemptToPostReqsToNetwork.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAe,qBAAqB,EAAE,MAAM,UAAU,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAA;AAIhC;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,iBAAiB,EAAE,EACzB,GAAG,CAAC,EAAE,GAAG,CAAC,QAAQ,EAClB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAoBlC;AA+TD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,8BAA8B,GACtC,SAAS,GACT,aAAa,GACb,SAAS,GACT,SAAS,GACT,cAAc,GACd,WAAW,CAAA;AAEf,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,iBAAiB,CAAA;IACtB,MAAM,EAAE,8BAA8B,CAAA;IACtC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAA;IAC3B,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,wBAAwB,EAAE,CAAA;IACnC,GAAG,EAAE,MAAM,CAAA;CACZ"}
+{"version":3,"file":"attemptToPostReqsToNetwork.d.ts","sourceRoot":"","sources":["../../../../../src/storage/methods/attemptToPostReqsToNetwork.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAe,qBAAqB,EAAE,MAAM,UAAU,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAA;AAmDhC;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,iBAAiB,EAAE,EACzB,GAAG,CAAC,EAAE,GAAG,CAAC,QAAQ,EAClB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAoBlC;AAyLD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,MAAM,EAAE,EACf,CAAC,EAAE,uBAAuB,EAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,EAChD,OAAO,EAAE,eAAe,EACxB,QAAQ,CAAC,EAAE,GAAG,CAAC,cAAc,EAC7B,GAAG,CAAC,EAAE,GAAG,CAAC,QAAQ,EAClB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA+Jf;AAgFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,yBAAyB,EAC7B,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,GAAG,CAAC,cAAc,EAC5B,GAAG,CAAC,EAAE,GAAG,CAAC,QAAQ,EAClB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAsGhF;AAED,KAAK,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAA;AAE/E,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAA;IACtC,MAAM,EAAE,eAAe,CAAA;IACvB,IAAI,EAAE,wBAAwB,CAAA;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,8BAA8B,GACtC,SAAS,GACT,aAAa,GACb,SAAS,GACT,SAAS,GACT,cAAc,GACd,WAAW,CAAA;AAEf,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,iBAAiB,CAAA;IACtB,MAAM,EAAE,8BAA8B,CAAA;IACtC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAA;IAC3B,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,wBAAwB,EAAE,CAAA;IACnC,GAAG,EAAE,MAAM,CAAA;CACZ"}

package/out/src/storage/methods/attemptToPostReqsToNetwork.js

@@ -34,9 +34,51 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.attemptToPostReqsToNetwork = attemptToPostReqsToNetwork;
+exports.updateReqsFromAggregateResults = updateReqsFromAggregateResults;
+exports.markStaleInputsAsSpent = markStaleInputsAsSpent;
 const sdk_1 = require("@bsv/sdk");
 const sdk = __importStar(require("../../sdk"));
 const utilityHelpers_1 = require("../../utility/utilityHelpers");
+// ---------------------------------------------------------------------------
+// new-schema wiring helpers
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the new-schema `transactionId` for a given txid.
+ *
+ * Returns `undefined` when:
+ *  - `service` is undefined (pre-cutover / IDB path)
+ *  - The txid is not yet in the new `transactions` table (bridge period)
+ *  - Any unexpected error (we swallow and return undefined to avoid
+ *    disrupting the legacy broadcast path)
+ */
+async function resolveTransactionId(service, txid) {
+    if (service == null)
+        return undefined;
+    try {
+        const row = await service.findByTxid(txid);
+        return row === null || row === void 0 ? void 0 : row.transactionId;
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+/**
+ * Map the aggregate broadcast outcome to the new-schema `ProcessingStatus` to record.
+ *
+ * Mapping:
+ *  success   → 'sent'       (broadcast accepted; waiting for on-chain proof)
+ *  doubleSpend → 'doubleSpend' (terminal)
+ *  invalidTx → 'invalid'    (terminal)
+ *  serviceError → 'sending' (retry; attempts counter also incremented)
+ */
+function aggregateStatusToProcessing(status) {
+    switch (status) {
+        case 'success': return 'sent';
+        case 'doubleSpend': return 'doubleSpend';
+        case 'invalidTx': return 'invalid';
+        case 'serviceError': return 'sending';
+    }
+}
 /**
  * Attempt to post one or more `ProvenTxReq` with status 'unsent'
  * to the bitcoin network.
@@ -46,7 +88,7 @@ const utilityHelpers_1 = require("../../utility/utilityHelpers");
 async function attemptToPostReqsToNetwork(storage, reqs, trx, logger) {
     // initialize results, validate reqs ready to post, txids are of the transactions in the beef that we care about.
     const { r, vreqs, txids } = await validateReqsAndMergeBeefs(storage, reqs, trx);
-    logger === null || logger === void 0 ? void 0 : logger.log(`validated request and merged beefs`);
+    logger === null || logger === void 0 ? void 0 : logger.log('validated request and merged beefs');
     const services = storage.getServices();
     const pbrs = await services.postBeef(r.beef, txids, logger);
     // post beef results (pbrs) is an array by service provider
@@ -64,56 +106,116 @@ async function validateReqsAndMergeBeefs(storage, reqs, trx) {
         log: ''
     };
     const vreqs = [];
+    // the transaction service — undefined on pre-cutover / IDB paths; all transaction-service calls are gated.
+    const txSvc = storage.getTransactionService();
     for (const req of reqs) {
+        // Resolve the new transactionId for this req (by txid). Cached per req so
+        // subsequent transaction-service calls within the same loop body reuse it.
+        const newTxId = await resolveTransactionId(txSvc, req.txid);
         try {
             const noRawTx = !req.rawTx;
-            const noTxIds = !req.notify.transactionIds || req.notify.transactionIds.length < 1;
-            const noInputBEEF = !req.inputBEEF;
+            const noTxIds = (req.notify.transactionIds == null) || req.notify.transactionIds.length < 1;
+            const noInputBEEF = req.inputBEEF == null;
             if (noRawTx || noTxIds || noInputBEEF) {
                 // This should have happened earlier...
-                req.addHistoryNote({ when: new Date().toISOString(), what: 'validateReqFailed', noRawTx, noTxIds, noInputBEEF });
+                const note = { when: new Date().toISOString(), what: 'validateReqFailed', noRawTx, noTxIds, noInputBEEF };
+                req.addHistoryNote(note);
                 req.status = 'invalid';
                 await req.updateStorageDynamicProperties(storage, trx);
                 r.details.push({ txid: req.txid, req, status: 'invalid' });
+                // new-schema additive: record history note + transition to invalid
+                if (newTxId != null) {
+                    await txSvc.recordHistoryNote(newTxId, note);
+                    await txSvc.recordBroadcastResult({
+                        transactionId: newTxId,
+                        txid: req.txid,
+                        status: 'invalid',
+                        provider: 'validateReqsAndMergeBeefs',
+                        details: { reason: 'validateReqFailed' }
+                    });
+                }
             }
             else {
                 const vreq = { txid: req.txid, req, status: 'unknown' };
                 await storage.mergeReqToBeefToShareExternally(req.api, r.beef, [], trx);
+                // new-schema additive: also merge raw tx / proof bytes from new transactions table into the
+                // shared beef so post-cutover callers get the same merged payload.
+                if (newTxId != null) {
+                    await txSvc.mergeBeefForTxids(r.beef, [req.txid]);
+                }
                 vreqs.push(vreq);
                 r.details.push(vreq);
             }
         }
-        catch (eu) {
-            const { code, message } = sdk.WalletError.fromUnknown(eu);
-            req.addHistoryNote({ when: new Date().toISOString(), what: 'validateReqError', txid: req.txid, code, message });
+        catch (error_) {
+            const { code, message } = sdk.WalletError.fromUnknown(error_);
+            const errNote = { when: new Date().toISOString(), what: 'validateReqError', txid: req.txid, code, message };
+            req.addHistoryNote(errNote);
             req.attempts++;
             if (req.attempts > 6 || message.startsWith('The txid parameter must be known to storage')) {
                 req.status = 'invalid';
                 r.details.push({ txid: req.txid, req, status: 'invalid' });
             }
             await req.updateStorageDynamicProperties(storage, trx);
+            // new-schema additive: record history note + increment attempts
+            if (newTxId != null) {
+                await txSvc.recordHistoryNote(newTxId, errNote);
+                await txSvc.incrementAttempts(newTxId);
+            }
         }
     }
     return { r, vreqs, txids: vreqs.map(r => r.txid) };
 }
 async function transferNotesToReqHistories(txids, vreqs, pbrs, storage, trx) {
+    // the transaction service — gated; undefined means legacy-only path.
+    const txSvc = storage.getTransactionService();
     for (const txid of txids) {
         const vreq = vreqs.find(r => r.txid === txid);
-        if (!vreq)
+        if (vreq == null)
             throw new sdk.WERR_INTERNAL();
+        // Resolve new transactionId once per txid (cheap SELECT by txid).
+        const newTxId = await resolveTransactionId(txSvc, txid);
         const notes = [];
         for (const pbr of pbrs) {
             notes.push(...(pbr.notes || []));
             const r = pbr.txidResults.find(tr => tr.txid === txid);
-            if (r)
+            if (r != null)
                 notes.push(...(r.notes || []));
         }
         for (const n of notes) {
             vreq.req.addHistoryNote(n);
+            // new-schema additive: mirror each provider note into tx_audit.
+            if (newTxId != null) {
+                await txSvc.recordHistoryNote(newTxId, n);
+            }
         }
         await vreq.req.updateStorageDynamicProperties(storage, trx);
     }
 }
+function tallyTxidResults(ar, pbrs) {
+    for (const pbr of pbrs) {
+        const tr = pbr.txidResults.find(tr => tr.txid === ar.txid);
+        if (tr == null)
+            continue;
+        ar.txidResults.push(tr);
+        if (tr.status === 'success') {
+            ar.successCount++;
+        }
+        else if (tr.doubleSpend) {
+            ar.doubleSpendCount++;
+            if (tr.competingTxs != null)
+                ar.competingTxs = [...tr.competingTxs];
+        }
+        else if (tr.serviceError) {
+            ar.serviceErrorCount++;
+        }
+        else {
+            ar.statusErrorCount++;
+        }
+    }
+    if (ar.competingTxs.length > 1)
+        ar.competingTxs = [...new Set(ar.competingTxs)];
+}
 /**
  * For each txid, decide on the aggregate success or failure of attempting to broadcast it to the bitcoin processing network.
  *
@@ -145,26 +247,7 @@ function aggregatePostBeefResultsByTxid(txids, vreqs, pbrs) {
             competingTxs: []
         };
         r[txid] = ar;
-        for (const pbr of pbrs) {
-            const tr = pbr.txidResults.find(tr => tr.txid === txid);
-            if (tr) {
-                ar.txidResults.push(tr);
-                if (tr.status === 'success')
-                    ar.successCount++;
-                else if (tr.doubleSpend) {
-                    ar.doubleSpendCount++;
-                    if (tr.competingTxs) {
-                        ar.competingTxs = [...tr.competingTxs];
-                    }
-                }
-                else if (tr.serviceError)
-                    ar.serviceErrorCount++;
-                else
-                    ar.statusErrorCount++;
-            }
-            if (ar.competingTxs.length > 1)
-                ar.competingTxs = [...new Set(ar.competingTxs)]; // Remove duplicates
-        }
+        tallyTxidResults(ar, pbrs);
         if (ar.successCount > 0 && ar.doubleSpendCount === 0)
             ar.status = 'success';
         else if (ar.doubleSpendCount > 0)
@@ -199,10 +282,14 @@ function aggregatePostBeefResultsByTxid(txids, vreqs, pbrs) {
  */
 async function updateReqsFromAggregateResults(txids, r, apbrs, storage, services, trx, logger) {
     logger === null || logger === void 0 ? void 0 : logger.group('update storage from aggregate results');
+    // the transaction service — undefined on pre-cutover / IDB paths; all transaction-service calls are gated.
+    const txSvc = storage.getTransactionService();
     for (const txid of txids) {
         const ar = apbrs[txid];
         const req = ar.vreq.req;
         await req.refreshFromStorage(storage, trx);
+        // Resolve new transactionId once per txid for this iteration.
+        const newTxId = await resolveTransactionId(txSvc, txid);
         const { successCount, doubleSpendCount, statusErrorCount, serviceErrorCount } = ar;
         const note = {
             when: new Date().toISOString(),
@@ -215,17 +302,21 @@ async function updateReqsFromAggregateResults(txids, r, apbrs, storage, services
             statusErrorCount,
             serviceErrorCount
         };
-        if (['completed', 'unmined'].indexOf(req.status) >= 0)
-            // However it happened, don't degrade status if it is somehow already beyond broadcast stage
+        if (['completed', 'unmined'].includes(req.status)) 
+        // However it happened, don't degrade status if it is somehow already beyond broadcast stage
+        {
             continue;
-        if (ar.status === 'doubleSpend' && services && !trx)
+        }
+        if (ar.status === 'doubleSpend' && (services != null) && (trx == null))
             await confirmDoubleSpend(ar, r.beef, storage, services, logger);
-        let newReqStatus = undefined;
-        let newTxStatus = undefined;
+        let newReqStatus;
+        let newTxStatus;
         switch (ar.status) {
             case 'success':
                 newReqStatus = 'unmined';
                 newTxStatus = 'unproven';
+                // Mark as broadcast so proof-timeout resets to rebroadcast rather than invalid
+                req.wasBroadcast = true;
                 break;
             case 'doubleSpend':
                 newReqStatus = 'doubleSpend';
@@ -250,13 +341,84 @@ async function updateReqsFromAggregateResults(txids, r, apbrs, storage, services
             req.status = newReqStatus;
         req.addHistoryNote(note);
         await req.updateStorageDynamicProperties(storage, trx);
+        // new-schema additive: record aggregateResults history note, then record the
+        // broadcast outcome (transitions processing state + sets wasBroadcast).
+        if (newTxId != null) {
+            await txSvc.recordHistoryNote(newTxId, note);
+            const processingStatus = aggregateStatusToProcessing(ar.status);
+            if (ar.status === 'serviceError') {
+                // serviceError: increment attempts in new-schema and leave processing in 'sending'.
+                await txSvc.incrementAttempts(newTxId);
+            }
+            else {
+                // success / doubleSpend / invalidTx: record broadcast result with final status.
+                await txSvc.recordBroadcastResult({
+                    transactionId: newTxId,
+                    txid,
+                    status: processingStatus,
+                    provider: 'aggregatePostBeef',
+                    wasBroadcast: ar.status === 'success',
+                    details: {
+                        aggStatus: ar.status,
+                        successCount,
+                        doubleSpendCount,
+                        statusErrorCount,
+                        serviceErrorCount
+                    }
+                });
+            }
+        }
         if (newTxStatus) {
             const ids = req.notify.transactionIds;
-            if (ids) {
+            if (ids != null) {
                 // Also set generated outputs to spendable false and consumed input outputs to spendable true (and clears their spentBy).
                 await storage.updateTransactionsStatus(ids, newTxStatus, trx);
             }
         }
+        // For ANY failed-broadcast result (doubleSpend, invalidTx,
+        // serviceError-resolved-to-failure), override the optimistic
+        // "restore inputs spendable" behavior of updateTransactionStatus
+        // for inputs that on-chain state confirms are actually spent.
+        // Without this, the wallet picks the same stale UTXO on the next
+        // createAction — an infinite missing-inputs loop. Apps cannot
+        // self-heal because the default basket is admin-only on
+        // app-isolated wallets (e.g. metanet-desktop).
+        //
+        // Why broaden beyond doubleSpend (Codex review 51331f6e035a7ed0):
+        // different broadcasters classify the same on-chain reality
+        // differently. ARC reports SEEN_IN_ORPHAN_MEMPOOL → doubleSpend.
+        // WoC + Bitails report 'Missing inputs' / 'missing-inputs' →
+        // invalidTx. Both mean the same root cause (referenced UTXO is
+        // gone). The helper is conservatively opt-in on positive
+        // isUtxo===false evidence: malformed/fee/script failures whose
+        // inputs are still UTXOs are LEFT spendable=true, preserving
+        // the existing transient-retry semantics. So broadening is safe.
+        //
+        // Gate: services available + not in a nested transaction (chain
+        // queries are async I/O — same gate as confirmDoubleSpend).
+        if (newTxStatus === 'failed' &&
+            services != null &&
+            trx == null) {
+            const stale = await markStaleInputsAsSpent(ar, storage, services, trx, logger);
+            if (stale.checked > 0) {
+                const staleNote = {
+                    when: new Date().toISOString(),
+                    what: 'markStaleInputsAsSpent',
+                    aggStatus: ar.status,
+                    checked: stale.checked,
+                    confirmed: stale.staleConfirmed,
+                    ...(stale.staleOutpoints.length > 0
+                        ? { outpoints: stale.staleOutpoints.join(',') }
+                        : {})
+                };
+                req.addHistoryNote(staleNote);
+                await req.updateStorageDynamicProperties(storage, trx);
+                // new-schema additive: mirror stale-inputs note into tx_audit.
+                if (newTxId != null) {
+                    await txSvc.recordHistoryNote(newTxId, staleNote);
+                }
+            }
+        }
         // Transfer critical results to details going back to the user
         const details = r.details.find(d => d.txid === txid);
         details.status = ar.status;
@@ -265,6 +427,33 @@ async function updateReqsFromAggregateResults(txids, r, apbrs, storage, services
     }
     logger === null || logger === void 0 ? void 0 : logger.group('update storage from aggregate results');
 }
+async function gatherCompetingTxids(ar, beef, services, note, logger) {
+    var _a;
+    const req = ar.vreq.req;
+    const tx = sdk_1.Transaction.fromBinary(req.rawTx);
+    const competingTxids = new Set(ar.competingTxs);
+    for (const input of tx.inputs) {
+        const sourceTx = (_a = beef.findTxid(input.sourceTXID)) === null || _a === void 0 ? void 0 : _a.tx;
+        if (sourceTx == null) {
+            let s = note.missingSourceTx || '';
+            s += input.sourceTXID + ' ';
+            note.missingSourceTx = s;
+            continue;
+        }
+        const lockingScript = sourceTx.outputs[input.sourceOutputIndex].lockingScript.toHex();
+        const hash = services.hashOutputScript(lockingScript);
+        const shhrs = await services.getScriptHashHistory(hash, undefined, logger);
+        if (shhrs.status === 'success') {
+            for (const h of shhrs.history) {
+                // Neither the source of the input nor the current transaction are competition.
+                if (h.txid !== input.sourceTXID && h.txid !== ar.txid)
+                    competingTxids.add(h.txid);
+            }
+        }
+    }
+    ar.competingTxs = [...competingTxids].slice(-24); // keep at most 24, if they were sorted by time, keep newest
+    note.competingTxs = ar.competingTxs.join(',');
+}
 /**
  * Requires ar.status === 'doubleSpend'
  *
@@ -277,19 +466,20 @@ async function updateReqsFromAggregateResults(txids, r, apbrs, storage, services
  * @param services
  */
 async function confirmDoubleSpend(ar, beef, storage, services, logger) {
-    var _a, _b;
+    var _a;
     const req = ar.vreq.req;
     const note = { when: new Date().toISOString(), what: 'confirmDoubleSpend' };
     let known = false;
     for (let retry = 0; retry < 3; retry++) {
         const gsr = await services.getStatusForTxids([req.txid]);
-        note[`getStatus${retry}`] = `${gsr.status}${gsr.error ? `${gsr.error.code}` : ''},${(_a = gsr.results[0]) === null || _a === void 0 ? void 0 : _a.status}`;
-        if (gsr.status === 'success' && gsr.results[0].status !== 'unknown') {
-            known = true;
-            break;
+        const errCode = gsr.error != null ? gsr.error.code : '';
+        note[`getStatus${retry}`] = `${gsr.status}${errCode},${(_a = gsr.results[0]) === null || _a === void 0 ? void 0 : _a.status}`;
+        if (gsr.status !== 'success' || gsr.results[0].status === 'unknown') {
+            await (0, utilityHelpers_1.wait)(1000);
         }
         else {
-            await (0, utilityHelpers_1.wait)(1000);
+            known = true;
+            break;
         }
     }
     if (known) {
@@ -299,31 +489,116 @@ async function confirmDoubleSpend(ar, beef, storage, services, logger) {
     }
     else {
         // Confirmed double spend, get txids of possible competing transactions.
-        const tx = sdk_1.Transaction.fromBinary(req.rawTx);
-        const competingTxids = new Set(ar.competingTxs);
-        for (const input of tx.inputs) {
-            const sourceTx = (_b = beef.findTxid(input.sourceTXID)) === null || _b === void 0 ? void 0 : _b.tx;
-            if (!sourceTx) {
-                let s = note['missingSourceTx'] || '';
-                s += input.sourceTXID + ' ';
-                note['missingSourceTx'] = s;
+        await gatherCompetingTxids(ar, beef, services, note, logger);
+    }
+    req.addHistoryNote(note);
+}
+/**
+ * After any failed broadcast (doubleSpend, invalidTx, etc.), query each
+ * consumed-input outpoint of the failed transaction against on-chain
+ * UTXO state. For inputs the chain authoritatively confirms are spent
+ * (i.e. NOT a UTXO), update the corresponding wallet basket entry to
+ * spendable=false.
+ *
+ * Background: `updateTransactionStatus(failed)` optimistically restores
+ * all consumed-input outputs to spendable=true so the user can retry
+ * with the same inputs. For some failures (genuine doubleSpend, or any
+ * 'missing-inputs' outcome where the input has been spent on chain by
+ * a different transaction), restoration is incorrect — the input is
+ * gone and restoring it produces an infinite missing-inputs loop on
+ * the next createAction → broadcast cycle. Apps cannot evict from the
+ * default basket on app-isolated wallets (admin-only policy), so this
+ * self-heal must run inside the wallet.
+ *
+ * Different broadcasters classify the same on-chain reality differently
+ * (ARC → doubleSpend, WhatsOnChain/Bitails → invalidTx via
+ * 'missing-inputs'); this helper is broadcaster-agnostic because its
+ * decision is based on services.isUtxo, not the aggregate failure
+ * classification.
+ *
+ * Pre-broadcast races where concurrent createActions reach the same
+ * UTXO across separate app processes are out of scope; see PR
+ * description.
+ *
+ * Conservatively scoped:
+ *   - Only inputs found in the failing user's basket are touched.
+ *   - Inputs whose on-chain UTXO status cannot be determined (service
+ *     error / inconclusive) are left spendable=true. Eviction is opt-in
+ *     based on positive evidence of stale state.
+ *   - Inputs the chain confirms are still UTXOs (e.g. a competing tx
+ *     itself failed, or a malformed/fee failure where inputs are intact)
+ *     are left spendable=true — preserving the existing transient-retry
+ *     semantics callers depend on.
+ *
+ * Returns counts for instrumentation and the set of stale outpoints
+ * that were actually evicted (added to history note for diagnostics).
+ */
+async function markStaleInputsAsSpent(ar, storage, services, trx, logger) {
+    const result = { checked: 0, staleConfirmed: 0, staleOutpoints: [] };
+    const req = ar.vreq.req;
+    // Resolve the user owning the failing tx so we only touch THIS user's
+    // basket entries. Multiple txids share a userId; first is sufficient.
+    const txIds = req.notify.transactionIds;
+    if (txIds == null || txIds.length === 0)
+        return result;
+    const txRecord = (await storage.findTransactions({
+        partial: { transactionId: txIds[0] },
+        noRawTx: true,
+        trx
+    }))[0];
+    if (txRecord == null)
+        return result;
+    const userId = txRecord.userId;
+    // Walk the failed tx's inputs to find which user-owned UTXOs were
+    // consumed and need on-chain verification.
+    const tx = sdk_1.Transaction.fromBinary(req.rawTx);
+    const outpoints = tx.inputs
+        .map(i => { var _a, _b; return ({ txid: (_a = i.sourceTXID) !== null && _a !== void 0 ? _a : '', vout: (_b = i.sourceOutputIndex) !== null && _b !== void 0 ? _b : 0 }); })
+        .filter(o => o.txid !== '');
+    if (outpoints.length === 0)
+        return result;
+    const byOutpoint = await storage.findOutputsByOutpoints(userId, outpoints, trx);
+    const checks = await Promise.all(outpoints.map(async (outpoint) => {
+        const localOutput = byOutpoint[`${outpoint.txid}.${outpoint.vout}`];
+        if (localOutput == null)
+            return { kind: 'skipped' };
+        // services.isUtxo requires the lockingScript; load it lazily.
+        if (localOutput.lockingScript == null) {
+            try {
+                await storage.validateOutputScript(localOutput, trx);
             }
-            else {
-                const lockingScript = sourceTx.outputs[input.sourceOutputIndex].lockingScript.toHex();
-                const hash = services.hashOutputScript(lockingScript);
-                const shhrs = await services.getScriptHashHistory(hash, undefined, logger);
-                if (shhrs.status === 'success') {
-                    for (const h of shhrs.history) {
-                        // Neither the source of the input nor the current transaction are competition.
-                        if (h.txid !== input.sourceTXID && h.txid !== ar.txid)
-                            competingTxids.add(h.txid);
-                    }
-                }
+            catch (_a) {
+                return { kind: 'skipped' };
             }
         }
-        ar.competingTxs = [...competingTxids].slice(-24); // keep at most 24, if they were sorted by time, keep newest
-        note.competingTxs = ar.competingTxs.join(',');
+        let isStillUtxo;
+        try {
+            isStillUtxo = await services.isUtxo(localOutput);
+        }
+        catch (_b) {
+            // Service error — preserve current behavior (keep spendable=true).
+            // Eviction requires positive evidence of stale state.
+            return { kind: 'service-error', localOutput };
+        }
+        return isStillUtxo
+            ? { kind: 'still-utxo', localOutput }
+            : { kind: 'stale', localOutput, outpoint };
+    }));
+    for (const c of checks) {
+        if (c.kind === 'skipped')
+            continue;
+        result.checked++;
+        if (c.kind === 'stale') {
+            // Authoritative on-chain evidence the input is spent. Override
+            // the optimistic restore from updateTransactionStatus(failed).
+            await storage.updateOutput(c.localOutput.outputId, { spendable: false }, trx);
+            result.staleConfirmed++;
+            result.staleOutpoints.push(`${c.outpoint.txid}.${c.outpoint.vout}`);
+        }
     }
-    req.addHistoryNote(note);
+    if (result.staleConfirmed > 0) {
+        logger === null || logger === void 0 ? void 0 : logger.log(`markStaleInputsAsSpent: ${result.staleConfirmed} of ${result.checked} input(s) confirmed-spent on chain for txid=${req.txid}`);
+    }
+    return result;
 }
 //# sourceMappingURL=attemptToPostReqsToNetwork.js.map