fix: resume a signed transaction instead of signing it again (JUMEMB-79)

.changeset/bump-bigmi-core.md

@@ -0,0 +1,5 @@
+---
+"@lifi/sdk-provider-bitcoin": patch
+---
+
+Require `@bigmi/core` 0.9.3, which fixes `waitForTransaction`. A wait whose block budget ran out no longer stops the shared block watcher, so a resumed Bitcoin route, and every later wait on the same client, can no longer wait forever. Finished waits release their observers and timers. A transaction that a lagging node still reports as unconfirmed is no longer reported as its own replacement, and a replacement is always compared with the awaited transaction, so a fee bump of a cancel is still reported as cancelled.

.changeset/resume-without-resign-bitcoin.md

@@ -0,0 +1,5 @@
+---
+"@lifi/sdk-provider-bitcoin": patch
+---
+
+Mark a cancelled replacement as final so "Try again" signs a new transaction; any other failure after broadcast is re-checked instead. The sign task refuses to sign while the step has an open transaction. It checks the action again after the wallet returns: if a stopped run's transaction merged into it while the prompt was open, the step fails with `TransactionConflict` and the new signature is neither stored nor sent. The signed transaction (`txHex`, `txHash`, `signedAt`) is now stored before it is sent, so a reload during the send resumes it instead of signing again. A first send that every configured node refuses for a reason that proves none of them holds it (bytes that do not decode, consensus or standardness rules, a fee above the cap or below the floor, or a full mempool), and that no node knows by txid, clears it, so "Try again" signs anew; any other send failure is re-checked, and the stored transaction is resent on a resume (a reload or "Try again") only within two minutes of signing. If the first send's outcome stays unknown and no resend happens within two minutes of signing, a resume only waits; the wait ends after about ten blocks with an error that is not final, and the exit is to delete the route.

.changeset/resume-without-resign-ethereum.md

@@ -0,0 +1,5 @@
+---
+"@lifi/sdk-provider-ethereum": patch
+---
+
+Mark reverted, cancelled, replaced and relayed-failed transactions as final so "Try again" signs a new transaction, while any other failure after broadcast is re-checked instead. The sign task refuses to sign while the step has an open transaction. The relayed sign task checks the action again after the wallet returns: if a stopped run's transaction merged into it while the prompt was open, the step fails with `TransactionConflict` and the new signature is not relayed. The wait for a relayed transaction now ends after 24 hours (before, a task that stayed PENDING was polled every 5 seconds forever) and at once after `stopRouteExecution`; neither end is a final outcome, so the action keeps its task id and "Try again" waits for the same task instead of signing again. After `stopRouteExecution`, the wait ends without a write to the route, and the run's `executeRoute` promise resolves with the route, as for the `/status` wait. A resume waits on the lane that sent the open transaction, as stored in the action's `txType`, so a relayed step without a `transactionRequest` waits for its relayer task again, not for a transaction receipt or a wallet call bundle. A Safe wallet is not covered: the hash is stored only after the Safe transaction executes, so a resume during that wait, or after its 24-hour timeout, still creates a second proposal (unchanged).

.changeset/resume-without-resign-sdk.md

@@ -0,0 +1,21 @@
+---
+"@lifi/sdk": minor
+---
+
+Never sign a second transaction on resume while the first one may still land.
+
+- `prepareRestart` keeps a FAILED action with an unknown outcome and re-checks it on chain. Only a final outcome is dropped, so "Try again" signs anew.
+- After `stopRouteExecution`, `updateRouteHook` can still be called for a route whose task was running, but only for a write that changes `txHash`, `txHex`, `taskId` or `txFinal`. An integrator that deleted the route should ignore that call. An error the hook throws in such a late call does not reach the run; in development it is logged with `console.debug`. If a new execution of the same route is running, a late transaction that may still land is merged into its action instead, so it does not sign again unless its wallet call has already started. If a newer execution already ended, the late transaction is merged into the route of the last ended execution, and that execution's `updateRouteHook` is called.
+- The new `ExecutionAction.txFinal` flags a final outcome.
+- `TransactionError` takes a new `final` option. Every `TransactionError` now has an own `final` property (`false` unless set), which changes its JSON shape.
+- `resumeRoute` no longer mutates the route it is given. A restart keeps `execution.signedAt` while a transaction is open.
+- In the EVM relayed lane and in the Solana, Sui, Tron, Bitcoin and Stellar providers, the SDK sends the transaction and checks the action again after the wallet returns. A prompt that was already open can still be signed, but when the late transaction merged first, those bytes are never sent or stored. A caught merge makes the newer run fail with `TransactionConflict`, and "Try again" then resumes and waits for the transaction. A step that asks for a replay (`ExecuteStepRetryError`) after such a merge also fails with `TransactionConflict`.
+- An older run no longer stops or ends a newer execution of the same route.
+- After `stopRouteExecution`, a run that waits for `/status` stops polling. Before, it polled every few seconds until the API answered DONE, and forever on FAILED, INVALID, NOT_FOUND or HTTP/network errors. The wait ends at once without a write to the route, so the step stays PENDING, and the run's `executeRoute` promise resolves with the route. A resume waits for the outcome of the same transaction.
+- A stop during the first attempt of a step that then asks for a replay (`ExecuteStepRetryError`) also ends the run. The step does not run again, so the replay's re-quote, chain reads and integrator callbacks do not run after the stop, and `executeRoute` resolves with the route.
+- `waitForResult` and `StepExecutor.executeStep` take an optional `signal`. Provider authors get it as `StepExecutorBaseContext.signal`, which aborts on `stopRouteExecution`. Give it only to a wait that starts after the transaction is broadcast, never to a sign, send or wallet call.
+- New `hasOpenTransaction`. `assertNoOpenTransaction`, `isKnownToStatusApi`, `isFinalTransactionError`, `isResendAllowed`, `isOldEnoughToDrop`, `CLEARED_TRANSACTION_FIELDS`, `MAX_RESEND_AGE_MS`, `DROPPED_FALLBACK_AGE_MS` and `CLOCK_SKEW_MARGIN_MS` are exported for provider packages; they are not part of the integrator API (`@internal`).
+- Remaining limits:
+  - In the lanes where the SDK sends, if the newer prompt is approved before the older run stores its transaction (in the EVM relayed lane, before the older run's relay request returns), nothing is merged yet, and both transactions can be sent.
+  - In the EVM standard and batched lanes the wallet sends, so a wallet call that has already started can still send a second transaction.
+  - A FAILED route from before the upgrade, or one resumed after node history no longer covers its signing time, can stay unknown. The exit is to delete the route.

.changeset/resume-without-resign-solana.md

@@ -0,0 +1,5 @@
+---
+"@lifi/sdk-provider-solana": patch
+---
+
+Resume a signed or broadcast transaction instead of signing again. The signed transaction is stored in `txHex` and resent after a reload until it confirms or its blockhash expires (a durable-nonce transaction only within two minutes of signing); a transaction is declared dropped only when it can no longer land, an RPC whose history covers the signing time does not find it, and the LI.FI status API does not know it. It can no longer land when its blockhash expired or, without a blockhash verdict (an RPC without `isBlockhashValid`, a probe error, no RPC answering, a route stored without `txHex`, or a durable-nonce transaction past its two-minute resend window), about 5 minutes after signing (`isOldEnoughToDrop`). The sign task checks the action again after the wallet returns: if a stopped run's transaction merged into it while the prompt was open, the step fails with `TransactionConflict` and the new signature is neither stored nor sent. The wallet account is resolved only when signing. An expired blockhash after the SDK stopped waiting now reports `TransactionExpired` instead of `RpcUnavailable` when an RPC answered.

.changeset/resume-without-resign-stellar.md

@@ -0,0 +1,5 @@
+---
+"@lifi/sdk-provider-stellar": patch
+---
+
+Mark a FAILED result, and a rejected submission that the network confirms it never applied, as final so "Try again" signs a new transaction; any other failure after signing is re-checked instead. The check that the network never applied a rejected submission gives each RPC 10 seconds to answer; a node that does not answer in time gives no information, as a failed request does, so a hung node cannot hold this check. The sign task refuses to sign while the step has an open transaction. It checks the action again after the wallet returns: if a stopped run's transaction merged into it while the prompt was open, the step fails with `TransactionConflict` and the new signature is neither stored nor submitted.

.changeset/resume-without-resign-sui.md

@@ -0,0 +1,5 @@
+---
+"@lifi/sdk-provider-sui": patch
+---
+
+Resume a signed or executed transaction instead of signing again. Signing and execution are split (same `signer.signTransaction` call), the signed bytes are stored in `txHex` before execution, and the digest is stored right after it, also for a failed execution. The sign task checks the action again after the wallet returns: if a stopped run's transaction merged into it while the prompt was open, the step fails with `TransactionConflict` and the new signature is neither stored nor executed. Stored bytes are re-executed only within two minutes of signing. After a node refuses the first execution, "Try again" cannot sign a new transaction until about 17 minutes after signing (the two-minute resend window, a 10-minute clock skew margin and a 5-minute head margin): no node can prove the transaction absent before then. The digest lookup and the absence-proof calls of a resume give each node 10 seconds to answer, so a hung node cannot hold the route: a node that does not answer in time counts as failed and the next node is asked; when no node answers, the outcome stays unknown. The final wait keeps its 60-second limit per node. A stored zkLogin signature cannot be verified offline, so such a route is never resent or declared dropped and stays unknown (the user deletes the route). A failed execution now reports the chain's error message instead of `[object Object]`. A wallet rejection is recognized at the signing call; a node message that contains "reject" is no longer reported as `SignatureRejected`, and an SDK error keeps its own code.

.changeset/resume-without-resign-tron.md

@@ -0,0 +1,5 @@
+---
+"@lifi/sdk-provider-tron": patch
+---
+
+Resume a signed or broadcast transaction instead of signing again. The sign task checks the action again after the wallet returns: if a stopped run's transaction merged into it while the prompt was open, the step fails with `TransactionConflict` and the new signature is neither stored nor broadcast. The signed transaction is stored in `txHex` and rebroadcast after a reload; it is declared dropped only after `raw_data.expiration` (by block time), when the node does not find it within the lookup window and the LI.FI status API does not know it. A route stored without `txHex` has no `raw_data.expiration`; its transaction counts as expired about 5 minutes after `signedAt` (`isOldEnoughToDrop`, on the device clock), and it can be declared dropped only once the chain's block time is past `signedAt` plus the clock-skew and head margins, about 16 minutes after signing. A confirmation timeout is no longer treated as a final failure.

packages/sdk-provider-bitcoin/package.json

@@ -44,7 +44,7 @@
     "watch": "tsdown --watch"
   },
   "dependencies": {
-    "@bigmi/core": "^0.9.2",
+    "@bigmi/core": "^0.9.3",
     "@bitcoinerlab/secp256k1": "^2.0.0",
     "@lifi/sdk": "workspace:*",
     "bech32": "^2.0.0",

packages/sdk-provider-bitcoin/src/client/publicClient.unit.spec.ts

@@ -0,0 +1,93 @@
+import {
+  AllTransportsFailedError,
+  HttpRequestError,
+  RpcRequestError,
+} from '@bigmi/core'
+import { ChainId, type SDKClient } from '@lifi/sdk'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { DECODE_FAILED } from '../core/tasks/bitcoinRpcErrors.unit.mock.js'
+import { classifyBitcoinSendFailure } from '../core/tasks/classifyBitcoinSendFailure.js'
+import { getBitcoinPublicClient } from './publicClient.js'
+
+const URL_A = 'https://btc-a.example/'
+const URL_B = 'https://btc-b.example/'
+const TX_HEX = '0200000000010100'
+
+/** Only what `getBitcoinPublicClient` reads from the SDK client. */
+const sdkClient = {
+  getRpcUrlsByChainId: async () => [URL_A, URL_B],
+  getChainById: async () => ({
+    id: ChainId.BTC,
+    metamask: {
+      chainId: String(ChainId.BTC),
+      chainName: 'Bitcoin',
+      rpcUrls: [URL_A, URL_B],
+      blockExplorerUrls: ['https://mempool.space/'],
+      nativeCurrency: { name: 'Bitcoin', symbol: 'BTC', decimals: 8 },
+    },
+  }),
+} as unknown as SDKClient
+
+/**
+ * Every URL refuses the bytes. URL A answers as a JSON-RPC 2.0 node (HTTP
+ * 200 with an `error` member), URL B as a legacy node (HTTP 500 with the
+ * same body). A new `Response` per call: a body can be read only once.
+ */
+const stubRefusingNodes = (): ReturnType<typeof vi.fn> => {
+  const fetchMock = vi.fn(async (url: string | URL, init?: RequestInit) => {
+    const { id } = JSON.parse(String(init?.body)) as { id: number }
+    return new Response(
+      JSON.stringify({
+        jsonrpc: '2.0',
+        id,
+        result: null,
+        error: DECODE_FAILED,
+      }),
+      {
+        status: String(url) === URL_A ? 200 : 500,
+        headers: { 'Content-Type': 'application/json' },
+      }
+    )
+  })
+  vi.stubGlobal('fetch', fetchMock)
+  return fetchMock
+}
+
+const fetchesTo = (fetchMock: ReturnType<typeof vi.fn>): string[] =>
+  fetchMock.mock.calls.map(([url]) => String(url))
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('getBitcoinPublicClient sendrawtransaction', () => {
+  // The sign task's one-round proof rests on bigmi internals: the fallback
+  // gives each URL `retryCount: 0`, and the override stops the retry of the
+  // whole round. A bigmi release that changes either breaks this test.
+  it('sends one round with one fetch per URL and keeps one error per URL', async () => {
+    const fetchMock = stubRefusingNodes()
+    const client = await getBitcoinPublicClient(sdkClient, ChainId.BTC)
+
+    // The same call as BitcoinSignAndExecuteTask.
+    const thrown = await client
+      .request(
+        { method: 'sendrawtransaction', params: [TX_HEX] },
+        { retryCount: 0 }
+      )
+      .catch((error: unknown) => error)
+
+    expect(fetchesTo(fetchMock)).toEqual([URL_A, URL_B])
+    expect(thrown).toBeInstanceOf(AllTransportsFailedError)
+    // One entry per URL, in URL order: A's JSON-RPC error, B's HTTP 500.
+    expect(
+      (thrown as AllTransportsFailedError).errors.map(({ error }) =>
+        error instanceof RpcRequestError
+          ? 'rpc'
+          : error instanceof HttpRequestError
+            ? `http ${error.status}`
+            : 'other'
+      )
+    ).toEqual(['rpc', 'http 500'])
+    expect(classifyBitcoinSendFailure(thrown)).toBe('refused')
+  })
+})

packages/sdk-provider-bitcoin/src/core/BitcoinStepExecutor.ts

@@ -3,6 +3,7 @@ import {
   BaseStepExecutor,
   CheckBalanceTask,
   type ExecutionAction,
+  hasOpenTransaction,
   LiFiErrorCode,
   type LiFiStepExtended,
   PrepareTransactionTask,
@@ -61,7 +62,9 @@ export class BitcoinStepExecutor extends BaseStepExecutor {
       isBridgeExecution ? 'CROSS_CHAIN' : 'SWAP'
     )
 
-    const firstTask = swapOrBridgeAction?.txHash
+    // Same predicate as the pre-sign guard: an open transaction is waited
+    // for, a FAILED action with a final outcome signs again.
+    const firstTask = hasOpenTransaction(swapOrBridgeAction)
       ? swapOrBridgeAction?.status === 'DONE'
         ? WaitForTransactionStatusTask
         : BitcoinWaitForTransactionTask