@gibs/bridge-indexer 1.13.0

package/dist/transfers.js

@@ -0,0 +1,711 @@
+import { gql } from 'graphql-request';
+import { sortBy } from 'lodash-es';
+import { indexerClient } from './endpoint.js';
+import { getStoreKey, getTokenMetadata, loadTokenMetadata as loadTokenMetadataFromCache, parseTokenKey, } from '@gibs/bridge-client/token-metadata';
+/**
+ * Every request in this module goes through {@link indexerClient}, which is a
+ * FUNCTION rather than a held client on purpose: a consumer configures the
+ * address during startup, and a client captured at module-evaluation time would
+ * have frozen the default before they ever got the chance.
+ */
+const client = () => indexerClient();
+// The rate this transfer's own fee manager had in force at index time.
+// deriveDeliveredAmount (tracked-transfer/deliveredAmount.ts) reads
+// feeUpdate.fee to reconstruct a delivered figure for a record whose
+// amountOut was never written, and until this join was added that read
+// always saw undefined because nothing had asked the indexer for it. A
+// single foreign-key lookup per row costs nothing measurable -- ten rows
+// with and without this field both land under 0.8 second against the live
+// indexer -- so it is worth carrying even while feeUpdateOrderId is null on
+// every currently deployed record (see deliveredAmount.ts): the join starts
+// paying for itself the moment the pending re-index backfills it, with no
+// second interface deploy needed.
+const fragment = gql `{
+    messageHash
+    messageId
+    type
+    orderId
+    blockHash
+    chainId
+    transactionHash
+    from
+    to
+    amountIn
+    amountOut
+    encodedData
+    logIndex
+    requiredSignatureOrderId
+    confirmedSignatures
+    finishedSigning
+    originationChainId
+    originationAmbAddress
+    destinationChainId
+    destinationAmbAddress
+    originationOmnibridgeAddress
+    destinationOmnibridgeAddress
+    originationTokenAddress
+    destinationTokenAddress
+    handlingNative
+    deliveringNative
+    signatures
+    finishedSigning
+    delivered
+    feeUpdate {
+      fee
+      feeType
+    }
+    block {
+      chainId
+      hash
+      number
+      timestamp
+      baseFeePerGas
+    }
+    transaction {
+      chainId
+      hash
+      blockHash
+      index
+      from
+      to
+      value
+      gas
+      gasPrice
+      nonce
+      type
+    }
+    originationAMBBridge {
+      chainId
+      address
+      provider
+      side
+    }
+    destinationAMBBridge {
+      chainId
+      address
+      provider
+      side
+    }
+    requiredSignatures {
+      orderId
+      chainId
+      value
+      transactionHash
+      logIndex
+    }
+    completion {
+      messageHash
+      orderId
+      chainId
+      transactionHash
+      # WHEN the row landed, which is a different fact on each direction and is
+      # wanted on both. Going into the home chain this block is the release;
+      # going out of it the indexer writes the row on the ORIGIN chain when the
+      # validators finish, so the same timestamp is when the signature round
+      # closed. historyTransferView.ts reads the chain to decide which step
+      # the time belongs to.
+      block {
+        timestamp
+      }
+    }
+    delivery {
+      messageHash
+      orderId
+      chainId
+      transactionHash
+      deliverer
+      logIndex
+      # When the delivery landed on the destination chain.
+      block {
+        timestamp
+      }
+    }
+    originationToken {
+      address
+      chainId
+      ambAddress
+      originationAddress
+      originationChainId
+      destinationAddress
+      destinationChainId
+    }
+    destinationToken {
+      address
+      chainId
+      ambAddress
+      originationAddress
+      destinationAddress
+    }
+    feeDirector {
+      messageHash
+      recipient
+      settings
+      limit
+      multiplier
+      feeType
+      unwrapped
+    }
+  }`;
+// GraphQL fragments for bridge data
+const BRIDGE_CORE_FRAGMENT = gql `
+  fragment BridgeCore on UserRequest ${fragment}
+`;
+const PAGE_INFO_FRAGMENT = gql `
+totalCount
+pageInfo {
+  hasNextPage
+  hasPreviousPage
+  startCursor
+  endCursor
+}`;
+/**
+ * How many fee updates one archive query folds in. The table holds ten rows
+ * today, and the whole of it costs about 0.12 second of the query's 0.4 second —
+ * measured against the production indexer, with and without the field.
+ *
+ * IT IS A CAP, SO REACHING IT IS REPORTED. A limit that silently truncates hands
+ * the amount-out estimate a fee table that is quietly short.
+ */
+const FEE_UPDATES_LIMIT = 1000;
+// Query to get bridge transactions and fee data (optionally filtered by user account)
+const GET_BRIDGES_QUERY = gql `
+  query GetBridges($where: UserRequestFilter, $limit: Int = 10, $after: String, $before: String) {
+    userRequests(where: $where, limit: $limit, after: $after, before: $before, orderBy: "orderId", orderDirection: "desc") {
+      items {
+        ...BridgeCore
+      }
+      ${PAGE_INFO_FRAGMENT}
+    }
+    latestFeeUpdates(limit: ${FEE_UPDATES_LIMIT}) {
+      items {
+        tokenAddress
+        feeManagerContract {
+          chainId
+          address
+          omnibridgeAddress
+        }
+        feeUpdate {
+          feeType
+          fee
+        }
+      }
+    }
+  }
+  ${BRIDGE_CORE_FRAGMENT}
+`;
+/**
+ * Hard cap on how many "released for someone else" message hashes are folded into a
+ * single history query. A normal account releases a handful; this bounds the OR-list
+ * for the pathological case. When an account exceeds it, the oldest deliveries past
+ * the cap are omitted from history (and the omission is logged).
+ */
+const DELIVERED_HASHES_LIMIT = 500;
+// Resolves the message hashes of bridges an account RELEASED for others (the on-chain
+// `deliverer`). The deliverer lives only on the Delivery table, so this feeds
+// buildBridgeFilter to widen history beyond the from/to scope.
+const GET_DELIVERIES_BY_DELIVERER_QUERY = gql `
+  query GetDeliveriesByDeliverer($deliverer: String!, $limit: Int = 500) {
+    deliverys(
+      where: { deliverer: $deliverer }
+      limit: $limit
+      orderBy: "orderId"
+      orderDirection: "desc"
+    ) {
+      items {
+        messageHash
+      }
+      totalCount
+    }
+  }
+`;
+/**
+ * Loads token metadata for unique token/chain combinations found in a set of bridges.
+ * Exported for independent testability.
+ */
+export async function loadTokenMetadataForBridges(bridges) {
+    const tokenMetadata = new Map();
+    // Extract unique token/chain combinations
+    const uniqueTokens = [];
+    const uniqueTokenKeys = new Set();
+    bridges.forEach((bridge) => {
+        // Try to use token relations first, fallback to individual fields
+        // Add origination token
+        let originationAddress = null;
+        let originationChainId = null;
+        if (bridge.originationToken?.address && bridge.originationToken?.chainId) {
+            originationAddress = bridge.originationToken.address;
+            originationChainId = Number(bridge.originationToken.chainId);
+        }
+        else if (bridge.originationTokenAddress && bridge.originationChainId) {
+            originationAddress = bridge.originationTokenAddress;
+            originationChainId = Number(bridge.originationChainId);
+        }
+        if (originationAddress && originationChainId) {
+            const key = getStoreKey(originationChainId, originationAddress);
+            if (!uniqueTokenKeys.has(key)) {
+                uniqueTokenKeys.add(key);
+                uniqueTokens.push({ chainId: originationChainId, address: originationAddress });
+                if (originationChainId === 56) {
+                    // BSC chain ID
+                    console.log(`Found BSC origination token:`, {
+                        address: originationAddress,
+                        chainId: originationChainId,
+                        key,
+                    });
+                }
+            }
+        }
+        // Add destination token if it exists and is different
+        let destinationAddress = null;
+        let destinationChainId = null;
+        if (bridge.destinationToken?.address && bridge.destinationToken?.chainId) {
+            destinationAddress = bridge.destinationToken.address;
+            destinationChainId = Number(bridge.destinationToken.chainId);
+        }
+        else if (bridge.destinationTokenAddress && bridge.destinationChainId) {
+            destinationAddress = bridge.destinationTokenAddress;
+            destinationChainId = Number(bridge.destinationChainId);
+        }
+        if (destinationAddress && destinationChainId && destinationAddress !== originationAddress) {
+            const key = getStoreKey(destinationChainId, destinationAddress);
+            if (!uniqueTokenKeys.has(key)) {
+                uniqueTokenKeys.add(key);
+                uniqueTokens.push({ chainId: destinationChainId, address: destinationAddress });
+                // if (destinationChainId === 56) { // BSC chain ID
+                //   console.log(`Found BSC destination token:`, { address: destinationAddress, chainId: destinationChainId, key })
+                // }
+            }
+        }
+    });
+    // Ask the RPC-backed loader only for tokens the in-memory store does not have
+    // yet. A token's symbol/name/decimals never change once fetched, so a token
+    // already in the store is a cache HIT, not a reason to re-run its multicall.
+    //
+    // Before this filter, every unique token referenced by the current page was
+    // sent through unconditionally on every call — and this function runs on the
+    // initial load, on each 15-second background poll, and on every page turn or
+    // filter change. A page whose tokens never change still repeated the same
+    // multicall roughly four times a minute for as long as History stayed
+    // mounted. The alias this loader is imported under (`loadTokenMetadataFromCache`)
+    // already promised cache-first behaviour; the underlying function never
+    // checked the store, so the name was ahead of what it did.
+    const uncachedTokens = uniqueTokens.filter((token) => getTokenMetadata(token.chainId, token.address) === null);
+    if (uncachedTokens.length > 0) {
+        await loadTokenMetadataFromCache(uncachedTokens.map((token) => ({
+            chainId: token.chainId,
+            address: token.address,
+        })));
+    }
+    // Now get metadata from the populated cache
+    Array.from(uniqueTokenKeys).forEach((key) => {
+        try {
+            const { chainId, address } = parseTokenKey(key);
+            const metadata = getTokenMetadata(chainId, address);
+            if (metadata) {
+                tokenMetadata.set(key, metadata);
+            }
+        }
+        catch (error) {
+            console.error(`Failed to load metadata for ${key}:`, error);
+        }
+    });
+    return tokenMetadata;
+}
+// Cache for bridge transactions with 5-second invalidation
+const bridgeCache = new Map();
+const BRIDGE_CACHE_TTL = 5 * 1000; // 5 seconds
+/**
+ * Builds the GraphQL filter for user request queries from bridge loading params.
+ * Pure function — no side effects, exported for independent testability.
+ */
+export function buildBridgeFilter(params, deliveredMessageHashes = []) {
+    const { address, hash, filterMode = 'pending', hiddenChainIds = [] } = params;
+    let filter;
+    // A hash is a precise, globally-unique lookup. When present it overrides
+    // address scoping entirely — never AND-combine it with the from/to filter,
+    // or you could only resolve transactions owned by the connected account.
+    if (hash) {
+        const normalizedHash = hash.toLowerCase();
+        filter = {
+            OR: [
+                { transactionHash: normalizedHash },
+                { messageId: normalizedHash },
+                { messageHash: normalizedHash },
+            ],
+        };
+    }
+    if (!hash && address) {
+        // Scope to the connected account. Beyond bridges it SENT (`from`) or RECEIVED
+        // (`to`), include bridges it RELEASED on behalf of someone else — the on-chain
+        // `deliverer`. That party is recorded only on the separate Delivery table
+        // (UserRequestFilter has no `deliverer` field), so the caller resolves the
+        // delivered message hashes first and the OR is widened to match them here.
+        //
+        // Lowercase HERE rather than trusting callers. Ponder stores hex columns
+        // lowercased and does not normalize the query side, so a checksummed address
+        // matches nothing — silently, with no error. The one current caller already
+        // lowercases, but a funnel-level invariant that every future call site has to
+        // remember is the same defect waiting on the next deep link or cross-surface
+        // action. Compare `fetchDeliveredMessageHashes`, which normalizes internally.
+        const normalizedAddress = address.toLowerCase();
+        const scopes = [{ from: normalizedAddress }, { to: normalizedAddress }];
+        if (deliveredMessageHashes.length > 0) {
+            scopes.push({ messageHash_in: deliveredMessageHashes });
+        }
+        filter = { OR: scopes };
+    }
+    // The status toggle narrows a BROWSE. A hash lookup is not a browse — it is the
+    // user naming one transaction, and it already overrides address scoping three
+    // lines up for exactly that reason. Intersecting it with a delivered filter meant
+    // searching a transaction that had just completed returned nothing, because a
+    // toggle set earlier for an unrelated purpose was still on. Zero rows for a hash
+    // the indexer holds reads as "the bridge lost my transaction".
+    //
+    // `all` carries NO delivered filter — not a third value of one. Every request
+    // is either pending or completed, so asking for both means asking for neither
+    // half, and an `AND` clause naming one of them would silently halve the
+    // answer. The old three-state all/pending toggle was incoherent for a
+    // different reason: its pair was not a partition, so "all" and "pending"
+    // showed the same newest-first rows and the control read as broken.
+    if (!hash && filterMode !== 'all') {
+        const statusFilter = { AND: [{ delivered: filterMode === 'completed' }] };
+        filter = filter ? { AND: [filter, statusFilter] } : statusFilter;
+    }
+    // THE NETWORK FILTER NARROWS A BROWSE, AND A HASH LOOKUP IS NOT A BROWSE.
+    // Same reasoning as the status toggle two blocks up: the reader has named one
+    // transaction, and intersecting that with a filter they set earlier for an
+    // unrelated purpose returns nothing for a transaction the indexer holds. Zero
+    // rows for a hash reads as "the bridge lost my transfer".
+    //
+    // BOTH ENDS, BECAUSE A TRANSFER HAS TWO. Excluding only the origination chain
+    // would leave every crossing INTO a hidden network on screen — half a filter,
+    // which is worse than none because it looks like it worked. Both columns are
+    // `notNull` in the indexer's schema (`UserRequest.originationChainId`,
+    // `UserRequest.destinationChainId`), so `_not_in` cannot swallow a row on a
+    // null the way it would on a nullable column, where SQL's `NOT IN` yields
+    // unknown and drops the row.
+    //
+    // The identifiers are sent as strings. The column is a `bigint` and the schema
+    // types it `Scalars['BigInt']`, which this client serialises from a string;
+    // sending a JavaScript number would be a silent precision hazard the day a
+    // chain id passes the safe-integer range.
+    if (!hash && hiddenChainIds.length > 0) {
+        const excluded = hiddenChainIds.map((chainId) => String(chainId));
+        const networkFilter = {
+            AND: [
+                { originationChainId_not_in: excluded },
+                { destinationChainId_not_in: excluded },
+            ],
+        };
+        filter = filter ? { AND: [filter, networkFilter] } : networkFilter;
+    }
+    return filter;
+}
+/** Nothing released, and nothing left out. The answer for every account with no address. */
+const NO_DELIVERED_HASHES = { hashes: [], omitted: 0 };
+/**
+ * How long one account's resolved delivered-hash list is reused, in milliseconds.
+ *
+ * WHY A CACHE OF ITS OWN, AND WHY IT IS LONGER THAN THE PAGE CACHE. The list
+ * answers "which bridges did this account release for somebody else". That is a
+ * property of the ACCOUNT, and it changes only when the reader releases another
+ * one. It is not a property of the page — yet it was resolved again in front of
+ * EVERY archive page: on arrival, on each fifteen-second poll, on every page
+ * turn and on every status or search change. For a delivery account that is up
+ * to five hundred delivery records fetched to draw ten rows, four times a
+ * minute, plus a request body of thirty-seven kilobytes carrying every one of
+ * those hashes back to the indexer.
+ *
+ * Measured against the production indexer, the two busiest delivery accounts
+ * hold 8,598 and 13,561 releases; both return the full five hundred every time.
+ * That is the "loading hundreds of bridges to show ten" the reader can see in a
+ * network panel, and it is the reason this cache exists.
+ *
+ * A minute is the compromise. The reader's OWN release does not have to wait for
+ * it: {@link forgetDeliveredMessageHashes} drops the entry the moment their
+ * transaction lands, which is the only event that can make this list stale for
+ * the person looking at it.
+ */
+const DELIVERED_HASHES_CACHE_TTL = 60 * 1000;
+/** Resolved delivered-hash lists, keyed by lowercased address. */
+const deliveredHashesCache = new Map();
+/**
+ * Drops one account's cached delivered-hash list, so the next history fetch
+ * resolves it again.
+ *
+ * Called when the reader's own transaction is mined. A release the READER just
+ * made is the one change this list can undergo while they are watching it, and
+ * making them wait out the cache to see it would defeat the burst poll that
+ * exists for exactly that moment.
+ *
+ * @param address - the account whose list to forget. No address forgets nothing.
+ */
+export const forgetDeliveredMessageHashes = (address) => {
+    if (!address)
+        return;
+    deliveredHashesCache.delete(address.toLowerCase());
+};
+/** Clears every cached delivered-hash list. Exported for test isolation. */
+export const _clearDeliveredHashesCache = () => deliveredHashesCache.clear();
+/**
+ * One account's delivered-hash list IF it is already resolved and still fresh,
+ * without starting a fetch for it.
+ *
+ * WHY LOOKING IS A DIFFERENT QUESTION FROM ASKING. `fetchBridgeTransactions`
+ * needs to know whether waiting for this list is free before it decides whether
+ * to run the archive query alongside it or after it. A cached list costs
+ * nothing to wait for, so the archive query can be built widened straight away;
+ * an unresolved one costs a whole round trip, and that is the round trip the
+ * page used to sit through before it asked for a single transfer.
+ *
+ * A STALE ENTRY READS AS ABSENT. `fetchDeliveredMessageHashes` sweeps expired
+ * entries on its way past, so an entry can outlive its window between sweeps.
+ * Returning one would hand the caller a list it believes is current.
+ *
+ * @param address - the account to look up. No address has no list.
+ * @returns the resolved list's promise, or null when there is no fresh one.
+ */
+export const peekDeliveredMessageHashes = (address) => {
+    if (!address)
+        return null;
+    const entry = deliveredHashesCache.get(address.toLowerCase());
+    if (!entry)
+        return null;
+    if (entry.timestamp < Date.now() - DELIVERED_HASHES_CACHE_TTL)
+        return null;
+    return entry.result;
+};
+/**
+ * Fetches the message hashes of bridges this account RELEASED on behalf of others —
+ * the on-chain `deliverer` (the account that submitted the release transaction).
+ * Those bridges never match the history query's from/to scope, so without this they
+ * are invisible in the account's history.
+ *
+ * Ponder stores hex columns lowercase but does not normalize the query side, so the
+ * deliverer is queried lowercased to match (the same normalization the from/to scope
+ * relies on). Returns lowercased message hashes; nothing when no address.
+ *
+ * The answer is cached per account for {@link DELIVERED_HASHES_CACHE_TTL}. See
+ * that constant for why: this is the query that was reading hundreds of records
+ * in front of every ten-row page.
+ *
+ * Resilient by design: a failure here returns an empty list rather than throwing, so
+ * a deliveries-query problem degrades history to the from/to scope instead of blanking
+ * the whole panel. A failure is NEVER cached — a reader whose network blipped once
+ * would otherwise lose their released bridges for the full minute.
+ */
+export async function fetchDeliveredMessageHashes(address) {
+    if (!address) {
+        return NO_DELIVERED_HASHES;
+    }
+    const deliverer = address.toLowerCase();
+    const now = Date.now();
+    for (const [key, entry] of deliveredHashesCache) {
+        if (entry.timestamp < now - DELIVERED_HASHES_CACHE_TTL) {
+            deliveredHashesCache.delete(key);
+        }
+    }
+    const cached = deliveredHashesCache.get(deliverer);
+    if (cached) {
+        return cached.result;
+    }
+    // Set by the catch below and read once the promise settles. A flag rather than
+    // a self-reference inside the async body, which would be in its own temporal
+    // dead zone if `client().request` ever threw synchronously.
+    let didFail = false;
+    const resultPromise = (async () => {
+        try {
+            const data = await client().request(GET_DELIVERIES_BY_DELIVERER_QUERY, { deliverer, limit: DELIVERED_HASHES_LIMIT });
+            const omitted = Math.max(data.deliverys.totalCount - DELIVERED_HASHES_LIMIT, 0);
+            if (omitted > 0) {
+                console.warn(`Deliverer ${deliverer} has more than ${DELIVERED_HASHES_LIMIT} deliveries; ` +
+                    'older bridges released for others may be missing from history');
+            }
+            return {
+                hashes: data.deliverys.items.map((item) => item.messageHash.toLowerCase()),
+                omitted,
+            };
+        }
+        catch (error) {
+            console.error('Failed to fetch delivered message hashes:', error);
+            didFail = true;
+            return NO_DELIVERED_HASHES;
+        }
+    })();
+    deliveredHashesCache.set(deliverer, { timestamp: now, result: resultPromise });
+    // NEVER LEAVE A FAILURE IN THE CACHE. The empty list a failure degrades to is a
+    // fallback, not an answer, and holding it for a full minute would hide a
+    // reader's released bridges long after the indexer came back. The entry is
+    // dropped only while it is still this one, so a later fetch that already
+    // replaced it survives.
+    resultPromise.then(() => {
+        if (!didFail)
+            return;
+        if (deliveredHashesCache.get(deliverer)?.result !== resultPromise)
+            return;
+        deliveredHashesCache.delete(deliverer);
+    });
+    return resultPromise;
+}
+/** Clears the in-memory bridge cache. Exported for test isolation. */
+export const _clearBridgeCache = () => bridgeCache.clear();
+/**
+ * Turns one archive response into the shape the panel reads.
+ *
+ * Extracted because two call sites in {@link fetchBridgeTransactions} now
+ * produce that response — one for an account whose release list was already
+ * known, one for an account whose release list was resolved alongside the page.
+ * Two copies of the sort, the token-metadata load and the fee warning is two
+ * places for the ordering to drift.
+ *
+ * @param data - the archive query's response.
+ * @param released - what this account released for other people, and what did not fit.
+ * @param controller - the caller's abort controller; an aborted fetch yields null.
+ * @returns the page, or null when the caller gave up while token metadata loaded.
+ */
+async function toBridgeData(data, released, controller) {
+    if (controller.signal.aborted) {
+        return null;
+    }
+    const sortedUserRequests = sortBy(data.userRequests.items, [
+        (bridge) => -BigInt(bridge.orderId),
+    ]);
+    const tokenMetadata = await loadTokenMetadataForBridges(sortedUserRequests);
+    if (data.latestFeeUpdates.items.length >= FEE_UPDATES_LIMIT) {
+        console.warn('Latest fee updates limit reached, some fee updates may be missing');
+    }
+    return {
+        userRequests: sortedUserRequests,
+        tokenMetadata,
+        feeData: data.latestFeeUpdates.items,
+        pageInfo: data.userRequests.pageInfo,
+        totalCount: data.userRequests.totalCount,
+        releasedForOthersOmitted: released.omitted,
+    };
+}
+/**
+ * Inner fetching logic for loadBridgeTransactions.
+ * Exported so it can be tested independently of the Svelte loading store wrapper.
+ */
+export async function fetchBridgeTransactions(rawParams, controller) {
+    const params = rawParams || {};
+    const { limit = 10, after, before, filterMode = 'pending', address, hash, hiddenChainIds = [], } = params;
+    // Key on the NORMALIZED address and hash, the same forms `buildBridgeFilter`
+    // queries with, so a checksummed and a lowercased spelling of one account share
+    // a single cache entry rather than issuing two identical round trips.
+    //
+    // The hidden networks are SORTED into the key for the same reason. They change
+    // which rows come back, so leaving them out would serve one network selection's
+    // page under another's — and two orderings of one selection would split a
+    // single answer across two entries and two round trips.
+    const cacheKey = JSON.stringify({
+        address: address?.toLowerCase() ?? null,
+        hash: hash?.toLowerCase() ?? null,
+        limit,
+        after,
+        before,
+        filterMode,
+        hiddenChainIds: [...hiddenChainIds].sort((first, second) => first - second),
+    });
+    // Clean up stale cache entries
+    const now = Date.now();
+    for (const [key, value] of bridgeCache) {
+        if (value.timestamp < now - BRIDGE_CACHE_TTL) {
+            bridgeCache.delete(key);
+        }
+    }
+    // Return from cache when still fresh
+    const cached = bridgeCache.get(cacheKey);
+    if (cached && cached.timestamp > now - BRIDGE_CACHE_TTL) {
+        const result = await cached.result;
+        if (result) {
+            console.log('returning cached bridge data', cached);
+            return cached.result;
+        }
+    }
+    // One page of the archive, for a given set of released-for-others hashes.
+    // Named so the two call sites below cannot drift in what they ask for.
+    const askArchive = (deliveredMessageHashes) => {
+        const variables = {
+            where: buildBridgeFilter(params, deliveredMessageHashes),
+            limit,
+            after,
+            before,
+        };
+        return client().request(GET_BRIDGES_QUERY, variables);
+    };
+    const dataPromise = (async () => {
+        try {
+            // Bridges this account released for others (the on-chain `deliverer`) aren't
+            // matched by the from/to scope, so those message hashes widen the filter.
+            // A hash lookup is a global, account-independent search — skip it then (no
+            // account scoping applies).
+            const releasesAreRelevant = !hash && Boolean(address);
+            // THE RELEASE LIST USED TO GATE THE PAGE, AND THAT COST A WHOLE ROUND TRIP
+            // OF WAITING BEFORE THE ARCHIVE WAS ASKED FOR ANYTHING.
+            //
+            // The two requests ran in series: resolve every bridge this account
+            // released for other people, THEN ask for ten transfers. Measured against
+            // the production indexer the same query answers in 0.2 seconds when it is
+            // warm and in 4 to 8 seconds when it is not, so two in series was the
+            // difference between half a second and a quarter of a minute — with the
+            // reader looking at a loading line for all of it.
+            //
+            // A CACHED LIST IS FREE TO WAIT FOR, so it is still waited for: the widened
+            // query goes out immediately and nothing speculative is issued. That is the
+            // path every background poll and every page turn takes, because the list is
+            // held per account for a minute.
+            const cachedReleases = releasesAreRelevant ? peekDeliveredMessageHashes(address) : null;
+            if (cachedReleases !== null) {
+                const released = await cachedReleases;
+                if (controller.signal.aborted) {
+                    return null;
+                }
+                return await toBridgeData(await askArchive(released.hashes), released, controller);
+            }
+            // NOTHING CACHED, SO BOTH QUESTIONS GO OUT AT ONCE. The unwidened page is
+            // not a guess for most accounts — it is the FINAL answer, because an
+            // account that has released nothing for anybody produces exactly this
+            // filter. Only a delivery account pays for a second archive query here,
+            // and only once per minute, which is what the release cache is for.
+            const releaseRequest = releasesAreRelevant
+                ? fetchDeliveredMessageHashes(address)
+                : Promise.resolve(NO_DELIVERED_HASHES);
+            const unwidenedRequest = askArchive([]);
+            // A rejection nobody awaits is an unhandled rejection. This request is
+            // discarded whenever the release list turns out to be non-empty, so it
+            // needs a handler even though the `await` below still sees the real error
+            // on the path that does use it.
+            unwidenedRequest.catch(() => { });
+            const released = await releaseRequest;
+            if (controller.signal.aborted) {
+                return null;
+            }
+            const data = released.hashes.length === 0 ? await unwidenedRequest : await askArchive(released.hashes);
+            return await toBridgeData(data, released, controller);
+        }
+        catch (error) {
+            console.error('Failed to fetch bridge transactions:', error);
+            if (controller.signal.aborted) {
+                return null;
+            }
+            throw error;
+        }
+    })();
+    // Cache the promise to prevent duplicate in-flight requests
+    bridgeCache.set(cacheKey, { timestamp: now, result: dataPromise });
+    // Never serve a FAILURE from the cache. Without this, a rejected promise stayed
+    // cached for the full five seconds, so the error panel's Retry button — pressed
+    // immediately, which is the natural reaction — re-awaited the same rejection and
+    // reported the identical failure without touching the network, even after the
+    // indexer had recovered. TanStack Query's own backoff retries landed inside the
+    // same window. The chained `.catch` handles its own rejection, so this does not
+    // create an unhandled one; `dataPromise` is returned untouched and still rejects
+    // for the real consumer.
+    dataPromise.catch(() => {
+        if (bridgeCache.get(cacheKey)?.result === dataPromise) {
+            bridgeCache.delete(cacheKey);
+        }
+    });
+    return dataPromise;
+}