forge_script/

broadcast.rs

use std::{cmp::Ordering, num::NonZeroU64, sync::Arc, time::Duration};

use crate::{
    ScriptArgs, ScriptConfig,
    build::LinkedBuildData,
    progress::ScriptProgress,
    receipts::is_mined_receipt_for,
    recovery::{AttemptKind, DelegatedStatus},
    sequence::{
        ScriptSequenceKind, blocked_pending, completed_transaction_prefix, operation_ordinal,
    },
    session::{
        SignerScope, insert_session_access_key_for_remaining_transactions,
        script_session_expected_sender_if_configured,
    },
    verify::BroadcastedState,
};
use alloy_chains::{Chain, NamedChain};
use alloy_consensus::{SignableTransaction, Signed, transaction::SignerRecoverable};
use alloy_eips::eip2718::{Decodable2718, Encodable2718};
use alloy_network::{
    EthereumWallet, Network, NetworkTransactionBuilder, ReceiptResponse, TransactionBuilder,
    TransactionResponse,
};
use alloy_primitives::{
    Address, Bytes, TxHash, TxKind, U256, keccak256,
    map::{AddressHashMap, AddressHashSet, HashMap, HashSet},
    utils::format_units,
};
use alloy_provider::{
    Provider, RootProvider,
    transport::{RpcError, TransportError},
    utils::Eip1559Estimation,
};
use alloy_rpc_types::TransactionRequest;
use alloy_signer::Signature;
use eyre::{Context, ContextCompat, Result, bail};
use forge_script_sequence::{ScriptSequence, TransactionWithMetadata};
use foundry_cheatcodes::Wallets;
use foundry_cli::utils::{has_batch_support, has_different_gas_calc};
use foundry_common::{
    FoundryTransactionBuilder, TransactionMaybeSigned,
    provider::{
        ProviderBuilder,
        fee::{estimate_eip1559_fees, resolve_broadcast_eip1559_fees},
    },
    shell,
    tempo::{
        TempoSponsor, active_tempo_hardfork, maybe_print_fee_token, resolve_and_set_fee_token,
    },
};
use foundry_config::Config;
use foundry_evm::{
    core::{
        constants::DEFAULT_CREATE2_DEPLOYER_CODEHASH,
        evm::{FoundryEvmNetwork, TempoEvmNetwork},
    },
    hardfork::TempoHardfork,
    traces::CallKind,
};
use foundry_wallets::{
    TempoAccountsWallet,
    wallet_browser::{error::BrowserWalletError, signer::BrowserSigner},
};
use futures::{FutureExt, StreamExt, future::join_all, stream::FuturesUnordered};
use itertools::Itertools;
use tempo_alloy::{
    TempoNetwork,
    rpc::{TempoTransactionReceipt, TempoTransactionRequest},
};
use tempo_primitives::transaction::{Call, TEMPO_EXPIRING_NONCE_KEY, TempoTxEnvelope};

/// Represents how to send a single transaction.
#[derive(Clone)]
pub enum SendTransactionKind<'a, N: Network> {
    Unlocked(N::TransactionRequest),
    Raw(N::TransactionRequest, &'a EthereumWallet),
    Browser(N::TransactionRequest, &'a BrowserSigner<N>),
    Signed(N::TxEnvelope),
    AccessKey(N::TransactionRequest, Box<TempoAccountsWallet>),
    PreparedRaw(Bytes, TxHash),
}

impl<'a, N: Network> SendTransactionKind<'a, N>
where
    N::TxEnvelope: From<Signed<N::UnsignedTx>>,
    N::UnsignedTx: SignableTransaction<Signature>,
    N::TransactionRequest: FoundryTransactionBuilder<N>,
{
    /// Prepares the transaction for broadcasting by synchronizing nonce and estimating gas.
    ///
    /// This method performs two key operations:
    /// 1. Nonce synchronization: Waits for the provider's nonce to catch up to the expected
    ///    transaction nonce when doing sequential broadcast
    /// 2. Gas estimation: Re-estimates gas right before broadcasting for chains that require it
    #[allow(clippy::too_many_arguments)]
    pub async fn prepare(
        &mut self,
        provider: &RootProvider<N>,
        sequential_broadcast: bool,
        is_fixed_gas_limit: bool,
        estimate_via_rpc: bool,
        estimate_multiplier: u64,
        tempo_sponsor: Option<&TempoSponsor>,
    ) -> Result<()> {
        let browser = matches!(self, Self::Browser(..));
        let (tx, tempo_wallet) = match self {
            Self::Raw(tx, _) | Self::Unlocked(tx) | Self::Browser(tx, _) => (tx, None),
            Self::AccessKey(tx, wallet) => (tx, Some(wallet)),
            Self::Signed(_) | Self::PreparedRaw(..) => return Ok(()),
        };

        reject_access_key_create::<N>(tx, tempo_wallet.is_some())?;

        // An expiring nonce is a TIP-1106 discriminator rather than a position in the sender's
        // nonce sequence, so there is no provider nonce to wait for.
        if sequential_broadcast && tx.nonce_key() != Some(TEMPO_EXPIRING_NONCE_KEY) {
            let from = tx.from().expect("no sender");

            let tx_nonce = tx.nonce().expect("no nonce");
            for attempt in 0..5 {
                let nonce = provider.get_transaction_count(from).await?;
                match nonce.cmp(&tx_nonce) {
                    Ordering::Greater => {
                        bail!(
                            "EOA nonce changed unexpectedly while sending transactions. Expected {tx_nonce} got {nonce} from provider."
                        );
                    }
                    Ordering::Less => {
                        if attempt == 4 {
                            bail!(
                                "After 5 attempts, provider nonce ({nonce}) is still behind expected nonce ({tx_nonce})."
                            );
                        }
                        warn!(
                            "Expected nonce ({tx_nonce}) is ahead of provider nonce ({nonce}). Retrying in 1 second..."
                        );
                        tokio::time::sleep(std::time::Duration::from_millis(1000)).await;
                    }
                    Ordering::Equal => {
                        // Nonces are equal, we can proceed.
                        break;
                    }
                }
            }
        }

        if let Some(wallet) = tempo_wallet {
            **wallet = tx.prepare_with_tempo_wallet(provider, wallet).await?;
        }

        let fee_token = if let Some(sponsor) = tempo_sponsor {
            sponsor.resolve_and_set_fee_token(Some(provider), tx).await?;
            None
        } else {
            resolve_and_set_fee_token(Some(provider), tx, tx.from()).await?
        };

        // A fee token, sponsor, validity window, or other Tempo field selects
        // the AA transaction type. AA requests carry CREATE as their first
        // call rather than as the Ethereum transaction `to` field.
        convert_tempo_aa_create::<N>(tx);

        // Chains which use `eth_estimateGas` are being sent sequentially and require their
        // gas to be re-estimated right before broadcasting.
        if !is_fixed_gas_limit && estimate_via_rpc {
            estimate_gas(tx, provider, estimate_multiplier, browser).await?;
        }

        if let Some(sponsor) = tempo_sponsor {
            let from = tx.from().expect("no sender");
            sponsor.attach_and_print::<N>(tx, from).await?;
        } else {
            maybe_print_fee_token(Some(provider), fee_token).await?;
        }

        Ok(())
    }

    #[allow(clippy::too_many_arguments)]
    async fn prepare_for_durable_send(
        mut self,
        provider: &RootProvider<N>,
        sequential_broadcast: bool,
        is_fixed_gas_limit: bool,
        estimate_via_rpc: bool,
        estimate_multiplier: u64,
        tempo_sponsor: Option<&TempoSponsor>,
    ) -> Result<PreparedTransaction<'a, N>> {
        self.prepare(
            provider,
            sequential_broadcast,
            is_fixed_gas_limit,
            estimate_via_rpc,
            estimate_multiplier,
            tempo_sponsor,
        )
        .await?;
        if let Self::Unlocked(tx) = &mut self {
            tx.prep_for_submission();
        }
        Ok(match self {
            Self::Raw(tx, signer) => {
                let signed = tx.build(signer).await?;
                PreparedTransaction::Raw(Bytes::from(signed.encoded_2718()), signed.trie_hash())
            }
            Self::Signed(tx) => {
                let hash = tx.trie_hash();
                PreparedTransaction::Raw(Bytes::from(tx.encoded_2718()), hash)
            }
            Self::AccessKey(tx, wallet) => {
                let payload = Bytes::from(tx.sign_with_tempo_wallet(&wallet).await?);
                let envelope = N::TxEnvelope::decode_2718_exact(&payload)?;
                PreparedTransaction::Raw(payload, envelope.trie_hash())
            }
            Self::PreparedRaw(payload, hash) => PreparedTransaction::Raw(payload, hash),
            Self::Unlocked(request) => PreparedTransaction::Unlocked(request),
            Self::Browser(request, signer) => PreparedTransaction::Browser(request, signer),
        })
    }

    /// CREATE uses the protocol account nonce even when the signed nonce is a discriminator.
    async fn validate_expiring_create_nonce(
        &self,
        provider: &RootProvider<N>,
        planned: &TransactionWithMetadata<N>,
    ) -> Result<()> {
        if planned.tx().to().is_some() {
            return Ok(());
        }
        let nonce_key = match self {
            Self::Raw(tx, _)
            | Self::Unlocked(tx)
            | Self::Browser(tx, _)
            | Self::AccessKey(tx, _) => tx.nonce_key(),
            Self::Signed(tx) => {
                <N::TransactionRequest as From<N::TxEnvelope>>::from(tx.clone()).nonce_key()
            }
            Self::PreparedRaw(payload, _) => <N::TransactionRequest as From<N::TxEnvelope>>::from(
                N::TxEnvelope::decode_2718_exact(payload)?,
            )
            .nonce_key(),
        };
        if nonce_key == Some(TEMPO_EXPIRING_NONCE_KEY) {
            let sender = planned.tx().from().context("CREATE is missing its planned sender")?;
            let expected = match planned.tx() {
                TransactionMaybeSigned::Signed { .. } => {
                    planned.contract_address.context("CREATE is missing its planned address")?
                }
                TransactionMaybeSigned::Unsigned(tx) => sender
                    .create(tx.nonce().context("CREATE is missing its planned account nonce")?),
            };
            let actual = sender.create(provider.get_transaction_count(sender).await?);
            if actual != expected {
                bail!(
                    "CREATE address changed unexpectedly while sending transactions. Expected {expected} got {actual} from provider nonce."
                );
            }
        }
        Ok(())
    }
}

/// A prepared submission, with local signatures fixed before checkpointing and sending.
#[derive(Clone)]
enum PreparedTransaction<'a, N: Network> {
    Raw(Bytes, TxHash),
    Unlocked(N::TransactionRequest),
    Browser(N::TransactionRequest, &'a BrowserSigner<N>),
}

impl<N: Network> PreparedTransaction<'_, N>
where
    N::TransactionRequest: FoundryTransactionBuilder<N>,
{
    const fn delegated_request(&self) -> Option<&N::TransactionRequest> {
        match self {
            Self::Unlocked(request) | Self::Browser(request, _) => Some(request),
            _ => None,
        }
    }

    fn validate_delegated_submission(&self) -> Result<()> {
        let Self::Browser(request, signer) = self else { return Ok(()) };
        if request.from().is_some_and(|from| from != signer.address()) {
            bail!("Transaction `from` address does not match connected wallet address");
        }
        if request.chain_id().is_some_and(|chain_id| chain_id != signer.chain_id()) {
            bail!("Transaction `chainId` does not match connected wallet chain ID");
        }
        Ok(())
    }

    fn is_definite_non_submission(&self, error: &eyre::Report) -> bool {
        match self {
            Self::Browser(..) => is_definite_browser_non_submission(error),
            Self::Unlocked(_) => is_definite_unlocked_non_submission(error),
            _ => false,
        }
    }

    async fn send(self, provider: Arc<RootProvider<N>>) -> Result<TxHash> {
        match self {
            Self::Raw(payload, _) => {
                let pending = provider.send_raw_transaction(&payload).await?;
                Ok(*pending.tx_hash())
            }
            Self::Unlocked(tx) => {
                debug!("sending transaction from unlocked account {:?}", tx);
                let pending = provider.send_transaction(tx).await?;
                Ok(*pending.tx_hash())
            }
            Self::Browser(tx, signer) => {
                debug!("sending transaction: {:?}", tx);
                Ok(signer.send_transaction_via_browser(tx).await?)
            }
        }
    }
}

fn is_definite_browser_non_submission(error: &eyre::Report) -> bool {
    let Some(alloy_signer::Error::Other(error)) = error.downcast_ref::<alloy_signer::Error>()
    else {
        return false;
    };
    matches!(
        error.downcast_ref::<BrowserWalletError>(),
        Some(BrowserWalletError::Rejected { .. } | BrowserWalletError::NotConnected)
    )
}

fn is_definite_unlocked_non_submission(error: &eyre::Report) -> bool {
    matches!(
        error.downcast_ref::<TransportError>(),
        Some(RpcError::ErrorResp(error))
            if is_unlocked_non_submission(error.code, &error.message)
    )
}

fn is_unlocked_non_submission(code: i64, message: &str) -> bool {
    code == -32602 && message == "No Signer available"
}

fn tempo_batch_calls(
    sequence: &ScriptSequence<TempoNetwork>,
    first_operation: usize,
) -> Result<Vec<Call>> {
    sequence
        .transactions()
        .skip(first_operation)
        .enumerate()
        .map(|(call_index, tx)| {
            if tx.authorization_list().is_some_and(|list| !list.is_empty()) {
                bail!(
                    "--batch does not support EIP-7702 authorization lists \
                     (found at transaction {}); use regular broadcast instead.",
                    call_index + first_operation + 1
                );
            }
            if let TransactionMaybeSigned::Unsigned(inner) = tx
                && inner.blob_sidecar().is_some()
            {
                bail!(
                    "--batch does not support blob (EIP-4844) transactions \
                     (found at transaction {}); use regular broadcast instead.",
                    call_index + first_operation + 1
                );
            }
            let to = tx.to().map(TxKind::Call).ok_or_else(|| {
                eyre::eyre!(
                    "Unexpected raw CREATE in --batch mode at position {} — \
                     this is a bug; CREATEs should have been rewritten by the inspector.",
                    call_index + first_operation + 1
                )
            })?;
            Ok(Call {
                to,
                value: tx.value().unwrap_or(U256::ZERO),
                input: tx.input().cloned().unwrap_or_default(),
            })
        })
        .collect()
}

fn validate_tempo_batch_request(
    request: &TempoTransactionRequest,
    sender: Address,
    chain: u64,
    calls: &[Call],
) -> Result<()> {
    if request.inner.from != Some(sender) {
        bail!("batch request does not match its planned sender");
    }
    let expected = request
        .clone()
        .build_aa()
        .map_err(|error| eyre::eyre!("invalid persisted batch request: {error}"))?;
    if expected.chain_id != chain || expected.calls != calls {
        bail!("batch request does not match its planned operations");
    }
    Ok(())
}

fn validate_tempo_batch_payload(
    request: &TempoTransactionRequest,
    payload: &[u8],
    sender: Address,
    chain: u64,
    calls: &[Call],
) -> Result<TxHash> {
    validate_tempo_batch_request(request, sender, chain, calls)?;
    let expected = request
        .clone()
        .build_aa()
        .map_err(|error| eyre::eyre!("invalid persisted batch request: {error}"))?;
    let envelope = TempoTxEnvelope::decode_2718_exact(payload)
        .wrap_err("recovery plan contains an invalid signed batch payload")?;
    validate_tempo_batch_envelope(&envelope, sender, chain, calls)?;
    let TempoTxEnvelope::AA(signed) = &envelope else {
        unreachable!();
    };
    if signed.tx() != &expected {
        bail!("signed batch payload does not match its persisted request");
    }
    Ok(envelope.trie_hash())
}

fn validate_tempo_batch_envelope(
    envelope: &TempoTxEnvelope,
    sender: Address,
    chain: u64,
    calls: &[Call],
) -> Result<()> {
    let TempoTxEnvelope::AA(signed) = envelope else {
        bail!("recovered batch transaction is not a Tempo transaction");
    };
    if signed.recover_signer().wrap_err("recovered batch transaction has an invalid signature")?
        != sender
    {
        bail!("recovered batch transaction does not match its planned sender");
    }
    if signed.tx().chain_id != chain || signed.tx().calls != calls {
        bail!("recovered batch transaction does not match its planned operations");
    }
    Ok(())
}

pub(crate) fn remaining_unsigned_transactions_for_recovery<N: Network>(
    sequence: &ScriptSequenceKind<N>,
) -> Vec<SignerScope>
where
    N::TxEnvelope: for<'de> serde::Deserialize<'de> + serde::Serialize,
{
    sequence
        .sequences()
        .iter()
        .enumerate()
        .filter(|(sequence_index, _)| sequence.batch_attempt(*sequence_index).is_none())
        .flat_map(|(sequence_index, deployment)| {
            remaining_operation_indices(sequence, sequence_index).into_iter().filter_map(
                move |index| {
                    let tx = deployment.transactions[index].tx();
                    (tx.is_unsigned() && sequence.signed_payload(sequence_index, index).is_none())
                        .then(|| SignerScope {
                            chain: deployment.chain,
                            sender: tx.from().expect("missing from"),
                        })
                },
            )
        })
        .collect()
}

fn remaining_operation_indices<N: Network>(
    sequence: &ScriptSequenceKind<N>,
    sequence_index: usize,
) -> Vec<usize>
where
    N::TxEnvelope: for<'de> serde::Deserialize<'de> + serde::Serialize,
{
    (0..sequence.sequences()[sequence_index].transactions.len())
        .filter(|&index| !is_operation_completed(sequence, sequence_index, index))
        .collect()
}

/// Returns true if the operation has a receipt or a recorded revert for its own hash.
fn is_operation_completed<N: Network>(
    sequence: &ScriptSequenceKind<N>,
    sequence_index: usize,
    index: usize,
) -> bool
where
    N::TxEnvelope: for<'de> serde::Deserialize<'de> + serde::Serialize,
{
    let deployment = &sequence.sequences()[sequence_index];
    let transaction = &deployment.transactions[index];
    let hash = sequence
        .signed_payload(sequence_index, index)
        .map(|signed| signed.hash)
        .or_else(|| match sequence.delegated_status(sequence_index, index) {
            Some(DelegatedStatus::Pending { hash }) => Some(hash),
            _ => None,
        })
        .or(transaction.hash)
        .or_else(|| match transaction.tx() {
            TransactionMaybeSigned::Signed { tx, .. } => Some(tx.trie_hash()),
            TransactionMaybeSigned::Unsigned(_) => None,
        });
    hash.is_some_and(|hash| {
        deployment.reverted.contains(&hash)
            || deployment.receipts.iter().any(|receipt| receipt.transaction_hash() == hash)
    })
}

fn remaining_sender_addresses<N: Network>(sequence: &ScriptSequenceKind<N>) -> AddressHashSet
where
    N::TxEnvelope: for<'de> serde::Deserialize<'de> + serde::Serialize,
{
    sequence
        .sequences()
        .iter()
        .enumerate()
        .flat_map(|(sequence_index, deployment)| {
            remaining_operation_indices(sequence, sequence_index)
                .into_iter()
                .filter_map(|index| deployment.transactions[index].tx().from())
        })
        .collect()
}

/// Rejects preparing new transactions without the Tempo sponsor recorded when the deployment was
/// created, so that resume never changes who pays.
fn ensure_recorded_sponsor(recorded: Option<Address>, current: Option<Address>) -> Result<()> {
    if let Some(recorded) = recorded
        && current != Some(recorded)
    {
        eyre::bail!(
            "this deployment is sponsored by {recorded}; pass `--tempo.sponsor {recorded}` with `--tempo.sponsor-signer` or `--tempo.sponsor-sig` to prepare its remaining transactions"
        );
    }
    Ok(())
}

const fn should_broadcast_sequentially(
    estimate_via_rpc: bool,
    slow: bool,
    required_signers: usize,
    ordering_senders: usize,
    batch_supported: bool,
) -> bool {
    estimate_via_rpc || slow || required_signers == 0 || ordering_senders != 1 || !batch_supported
}

/// Represents how to send _all_ transactions
pub enum SendTransactionsKind<N: Network> {
    /// Send via `eth_sendTransaction` and rely on the  `from` address being unlocked.
    Unlocked(AddressHashSet),
    /// Send a signed transaction via `eth_sendRawTransaction`, or via browser
    Raw {
        eth_wallets: AddressHashMap<EthereumWallet>,
        browser: Option<BrowserSigner<N>>,
        access_keys: HashMap<SignerScope, TempoAccountsWallet>,
    },
}

impl<N: Network> SendTransactionsKind<N> {
    /// Returns the [`SendTransactionKind`] for the given address
    ///
    /// Returns an error if no matching signer is found or the address is not unlocked
    pub fn for_sender(
        &self,
        chain: u64,
        addr: &Address,
        tx: N::TransactionRequest,
    ) -> Result<SendTransactionKind<'_, N>> {
        match self {
            Self::Unlocked(unlocked) => {
                if !unlocked.contains(addr) {
                    bail!("Sender address {:?} is not unlocked", addr);
                }
                Ok(SendTransactionKind::Unlocked(tx))
            }
            Self::Raw { eth_wallets, browser, access_keys } => {
                if let Some(wallet) = access_keys.get(&SignerScope::new(chain, *addr)) {
                    Ok(SendTransactionKind::AccessKey(tx, Box::new(wallet.clone())))
                } else if let Some(wallet) = eth_wallets.get(addr) {
                    Ok(SendTransactionKind::Raw(tx, wallet))
                } else if let Some(b) = browser
                    && b.address() == *addr
                {
                    Ok(SendTransactionKind::Browser(tx, b))
                } else {
                    bail!("No matching signer for {:?} found", addr);
                }
            }
        }
    }
}

/// State after we have bundled all
/// [`TransactionWithMetadata`] objects into a single [`ScriptSequenceKind`] object containing one
/// or more script sequences.
pub struct BundledState<FEN: FoundryEvmNetwork> {
    pub args: ScriptArgs,
    pub script_config: ScriptConfig<FEN>,
    pub script_wallets: Wallets,
    pub browser_wallet: Option<BrowserSigner<FEN::Network>>,
    pub build_data: LinkedBuildData,
    pub sequence: ScriptSequenceKind<FEN::Network>,
    /// Error from the script run that `--resume` performed to collect missing signers.
    pub resume_script_error: Option<String>,
}

impl<FEN: FoundryEvmNetwork> BundledState<FEN> {
    pub async fn wait_for_pending(mut self) -> Result<Self> {
        let progress = ScriptProgress::default();
        let progress_ref = &progress;
        let config = &self.script_config.config;
        let submission_hashes = (0..self.sequence.sequences().len())
            .map(|sequence| {
                (
                    self.sequence.submission_hashes(sequence),
                    blocked_pending(self.sequence.sequences(), sequence),
                )
            })
            .collect::<Vec<_>>();
        let rpc_urls = (0..self.sequence.sequences().len())
            .map(|sequence| self.sequence.rpc_url(sequence).to_owned())
            .collect::<Vec<_>>();
        let rpc_urls = &rpc_urls;
        let futs = self
            .sequence
            .sequences_mut()
            .iter_mut()
            .zip(submission_hashes)
            .enumerate()
            .map(|(sequence_idx, (sequence, ((durable_hashes, replayable_hashes), blocked)))| async move {
                let rpc_url = &rpc_urls[sequence_idx];
                let provider =
                    Arc::new(ProviderBuilder::from_config_with_url(config, rpc_url)?.build()?);
                progress_ref
                    .wait_for_pending(
                        sequence_idx,
                        sequence,
                        &provider,
                        self.script_config.config.transaction_timeout,
                        self.args.confirmations,
                        (&durable_hashes, &replayable_hashes),
                        &blocked,
                    )
                    .await
            })
            .collect::<Vec<_>>();

        let errors = join_all(futs)
            .await
            .into_iter()
            .enumerate()
            .filter_map(|(sequence_idx, result)| {
                result.err().map(|err| self.sequence.label_error(sequence_idx, err))
            })
            .collect::<Vec<_>>();

        self.sequence.save(true, false)?;

        if !errors.is_empty() {
            return Err(eyre::eyre!("{}", errors.iter().format("\n")));
        }

        Ok(self)
    }

    /// Broadcasts transactions from all sequences.
    pub async fn broadcast(mut self) -> Result<BroadcastedState<FEN>> {
        if self.script_config.tempo.expiring_nonce {
            reject_expiring_call_before_create(self.sequence.sequences())?;
        }
        // Only operations without a saved or delegated attempt are sponsored again.
        let needs_sponsorship =
            self.sequence.sequences().iter().enumerate().any(|(sequence_index, deployment)| {
                remaining_operation_indices(&self.sequence, sequence_index).into_iter().any(
                    |index| {
                        deployment.transactions[index].tx().is_unsigned()
                            && self.sequence.signed_payload(sequence_index, index).is_none()
                            && self.sequence.delegated_status(sequence_index, index).is_none()
                    },
                )
            });
        if needs_sponsorship {
            ensure_recorded_sponsor(self.sequence.sponsor(), self.script_config.tempo.sponsor)?;
        }
        let remaining_transactions = remaining_unsigned_transactions_for_recovery(&self.sequence);
        let ordering_addresses = remaining_sender_addresses(&self.sequence);
        let has_unprepared_transactions =
            self.sequence.sequences().iter().enumerate().any(|(sequence_index, _)| {
                remaining_operation_indices(&self.sequence, sequence_index)
                    .into_iter()
                    .any(|index| self.sequence.signed_payload(sequence_index, index).is_none())
            });
        let required_addresses =
            remaining_transactions.iter().map(|tx| tx.sender).collect::<AddressHashSet>();

        if required_addresses.contains(&Config::DEFAULT_SENDER) {
            eyre::bail!(
                "You seem to be using Foundry's default sender. Be sure to set your own --sender."
            );
        }

        let send_kind = if required_addresses.is_empty() {
            SendTransactionsKind::Raw {
                eth_wallets: AddressHashMap::default(),
                browser: None,
                access_keys: HashMap::default(),
            }
        } else if self.args.unlocked {
            SendTransactionsKind::Unlocked(required_addresses.clone())
        } else {
            let expected_session_sender = script_session_expected_sender_if_configured(
                &self.script_config.tempo,
                &required_addresses,
            )?;

            // For addresses without an explicit signer, try the Tempo Accounts store.
            let mut access_keys: HashMap<SignerScope, TempoAccountsWallet> = HashMap::default();
            if let Some(expected_session_sender) = expected_session_sender
                && let Some(session) =
                    self.script_config.tempo.session_signer_for_multi_wallet_any_chain(
                        &self.args.wallets,
                        Some(expected_session_sender),
                    )?
            {
                insert_session_access_key_for_remaining_transactions(
                    &mut access_keys,
                    session,
                    &remaining_transactions,
                )?;
            }

            let signers: Vec<Address> = self
                .script_wallets
                .signers()
                .map_err(|e| eyre::eyre!("{e}"))?
                .into_iter()
                .chain(self.browser_wallet.as_ref().map(|b| b.address()))
                .collect();

            let mut missing_addresses = Vec::new();
            let accounts_wallet = self
                .script_config
                .evm_opts
                .networks
                .is_tempo()
                .then(TempoAccountsWallet::try_from_default_store)
                .transpose()?
                .flatten();

            for tx in &remaining_transactions {
                let scope = *tx;
                if !signers.contains(&tx.sender) && !access_keys.contains_key(&scope) {
                    if let Some(wallet) = accounts_wallet.as_ref()
                        && wallet.has_account(tx.sender)?
                    {
                        access_keys.insert(scope, wallet.clone().with_chain_id(tx.chain));
                    } else {
                        missing_addresses.push(tx.sender);
                    }
                }
            }

            missing_addresses.sort_unstable();
            missing_addresses.dedup();

            if !missing_addresses.is_empty() {
                let mut message = format!(
                    "No associated wallet for addresses: {missing_addresses:?}. Unlocked wallets: {signers:?}"
                );
                if let Some(error) = &self.resume_script_error {
                    message = format!("{message}\n{}", resume_script_failure(error));
                }
                eyre::bail!(message);
            }

            let signers = self.script_wallets.into_multi_wallet().into_signers()?;
            let eth_wallets: AddressHashMap<EthereumWallet> =
                signers.into_iter().map(|(addr, signer)| (addr, signer.into())).collect();

            SendTransactionsKind::Raw { eth_wallets, browser: self.browser_wallet, access_keys }
        };
        if let Some(error) = &self.resume_script_error {
            sh_warn!("{}", resume_script_failure(error))?;
        }

        let tempo_sponsor = if has_unprepared_transactions {
            self.script_config.tempo.sponsor_config().await?.map(Arc::new)
        } else {
            None
        };
        if tempo_sponsor.is_some()
            && self.script_config.tempo.sponsor_sig.is_some()
            && remaining_transactions.len() > 1
        {
            eyre::bail!(
                "--tempo.sponsor-sig can only sponsor one remaining script transaction; use --tempo.sponsor-signer for multi-transaction scripts"
            );
        }

        let progress = ScriptProgress::default();

        for i in 0..self.sequence.sequences().len() {
            // In multichain runs, errors from a sequence are prefixed with its chain.
            let broadcast_sequence = async {
                let sequence_offset = operation_ordinal(self.sequence.sequences(), i, 0);
                let remaining_indices = remaining_operation_indices(&self.sequence, i);
                let signed_payloads = (0..self.sequence.sequences()[i].transactions.len())
                    .map(|index| {
                        self.sequence
                            .signed_payload(i, index)
                            .map(|signed| (signed.payload.clone(), signed.hash))
                    })
                    .collect::<Vec<_>>();
                let rpc_url = self.sequence.rpc_url(i).to_owned();
                let mut sequence = self.sequence.sequences_mut().get_mut(i).unwrap();

                let provider = Arc::new(
                    ProviderBuilder::from_config_with_url(&self.script_config.config, &rpc_url)?
                        .build()?,
                );
                let unlocked_submission_provider = Arc::new(
                    ProviderBuilder::from_config_with_url(&self.script_config.config, &rpc_url)?
                        .max_retry(0)
                        .build()?,
                );

                let seq_progress = progress.get_sequence_progress(i, sequence);

                if !remaining_indices.is_empty() {
                    let is_legacy = Chain::from(sequence.chain).is_legacy() || self.args.legacy;
                    // Make a one-time gas price estimation
                    let all_signed =
                        remaining_indices.iter().all(|index| signed_payloads[*index].is_some());
                    let (gas_price, eip1559_fees) = match (
                        all_signed,
                        is_legacy,
                        self.args.with_gas_price,
                        self.args.priority_gas_price,
                    ) {
                        (true, _, _, _) => (None, None),
                        (false, true, Some(gas_price), _) => (Some(gas_price.to()), None),
                        (false, true, None, _) => (Some(provider.get_gas_price().await?), None),
                        (false, false, Some(max_fee_per_gas), Some(max_priority_fee_per_gas)) => {
                            let max_fee: u128 = max_fee_per_gas.to();
                            let max_priority: u128 = max_priority_fee_per_gas.to();
                            if max_priority > max_fee {
                                eyre::bail!(
                                    "--priority-gas-price ({max_priority}) cannot be higher than --with-gas-price ({max_fee})"
                                );
                            }
                            (
                                None,
                                Some(Eip1559Estimation {
                                    max_fee_per_gas: max_fee,
                                    max_priority_fee_per_gas: max_priority,
                                }),
                            )
                        }
                        (false, false, _, _) => {
                            let fees = estimate_eip1559_fees(
                                &provider,
                                self.script_config.config.eip1559_fee_estimate,
                            )
                            .await
                            .wrap_err("Failed to estimate EIP1559 fees. This chain might not support EIP1559, try adding --legacy to your command.")?;

                            // Browser wallets may suggest their own tip; query it best-effort.
                            let browser_suggested_tip = if matches!(
                                &send_kind,
                                SendTransactionsKind::Raw { browser: Some(_), .. }
                            ) {
                                provider.get_max_priority_fee_per_gas().await.ok()
                            } else {
                                None
                            };

                            let fees = resolve_broadcast_eip1559_fees(
                                fees,
                                self.args.with_gas_price.map(|p| p.to()),
                                self.args.priority_gas_price.map(|p| p.to()),
                                browser_suggested_tip,
                            )?;

                            (None, Some(fees.estimation()))
                        }
                    };

                    // TIP-1106: from T12 the nonce of an expiring nonce transaction is an opaque
                    // discriminator. Each transaction gets its ordinal in the complete script plan,
                    // which is monotonic and stable across `--resume`, so that
                    // otherwise identical transactions keep distinct signing and replay
                    // hashes. Earlier hardforks only accept 0, which is also the
                    // fallback when the hardfork cannot be determined.
                    let tempo_hardfork = if self.script_config.evm_opts.networks.is_tempo() {
                        active_tempo_hardfork(provider.as_ref()).await.ok()
                    } else {
                        None
                    };
                    let expiring_nonce_discriminators = self.script_config.tempo.expiring_nonce
                        && tempo_hardfork.is_some_and(|fork| fork >= TempoHardfork::T12);

                    // Iterate through transactions, matching the `from` field with the associated
                    // wallet. Then send the transaction. Panics if we find a unknown `from`
                    let sequence_chain = sequence.chain;
                    let mut transactions = Vec::with_capacity(remaining_indices.len());
                    for index in remaining_indices {
                        let tx_with_metadata = &sequence.transactions[index];
                        let is_fixed_gas_limit = tx_with_metadata.is_fixed_gas_limit;

                        let kind = match (&signed_payloads[index], tx_with_metadata.tx().clone()) {
                            (Some((payload, hash)), _) => {
                                SendTransactionKind::PreparedRaw(payload.clone(), *hash)
                            }
                            (None, TransactionMaybeSigned::Signed { tx, .. }) => {
                                if tempo_sponsor.is_some() {
                                    eyre::bail!(
                                        "cannot attach Tempo sponsor signature to an already signed script transaction"
                                    );
                                }
                                SendTransactionKind::Signed(tx)
                            }
                            (None, TransactionMaybeSigned::Unsigned(mut tx)) => {
                                let from = tx.from().expect("No sender for onchain transaction!");

                                tx.set_chain_id(sequence_chain);

                                // Set TxKind::Create explicitly to satisfy `check_reqd_fields` in
                                // alloy
                                if tx.kind().is_none() {
                                    tx.set_create();
                                }

                                if let Some(gas_price) = gas_price {
                                    tx.set_gas_price(gas_price);
                                } else {
                                    let eip1559_fees = eip1559_fees.expect("was set above");
                                    tx.set_max_priority_fee_per_gas(
                                        eip1559_fees.max_priority_fee_per_gas,
                                    );
                                    tx.set_max_fee_per_gas(eip1559_fees.max_fee_per_gas);
                                }

                                // `vm.attachBlob` transactions also need a blob fee.
                                if tx.blob_sidecar().is_some()
                                    && tx.max_fee_per_blob_gas().is_none()
                                {
                                    tx.set_max_fee_per_blob_gas(
                                        provider.get_blob_base_fee().await?,
                                    );
                                }

                                self.script_config.tempo.apply::<FEN::Network>(
                                    &mut tx,
                                    expiring_nonce_discriminators
                                        .then_some((sequence_offset + index) as u64),
                                );

                                send_kind.for_sender(sequence_chain, &from, tx)?
                            }
                        };
                        transactions.push((kind, is_fixed_gas_limit, index));
                    }

                    let estimate_via_rpc = has_different_gas_calc(sequence.chain)
                        || self.script_config.evm_opts.networks.is_tempo()
                        || self.args.skip_simulation;

                    // We only wait for a transaction receipt before sending the next transaction,
                    // if there is more than one signer. There would be no way of assuring their
                    // order otherwise.
                    // Or if the chain does not support batched transactions (eg. Arbitrum).
                    // Or if we need to invoke eth_estimateGas before sending transactions.
                    let sequential_broadcast = should_broadcast_sequentially(
                        estimate_via_rpc,
                        self.args.slow,
                        required_addresses.len(),
                        ordering_addresses.len(),
                        has_batch_support(sequence.chain),
                    ) || transactions.iter().any(|(kind, _, _)| {
                        matches!(
                            kind,
                            SendTransactionKind::Browser(..) | SendTransactionKind::Unlocked(..)
                        )
                    });

                    // We send transactions and wait for receipts in batches of 100, since some
                    // networks cannot handle more than that.
                    let batch_size = if sequential_broadcast { 1 } else { 100 };

                    for (batch_number, batch) in transactions.chunks(batch_size).enumerate() {
                        seq_progress.inner.write().set_status(&format!(
                            "Sending transactions [{} - {}]",
                            batch_number * batch_size,
                            batch_number * batch_size + std::cmp::min(batch_size, batch.len()) - 1
                        ));

                        let mut prepared = Vec::with_capacity(batch.len());
                        for (kind, is_fixed_gas_limit, index) in batch {
                            // A pending operation can be confirmed while waiting on an earlier
                            // batch.
                            if is_operation_completed(&self.sequence, i, *index) {
                                continue;
                            }
                            kind.validate_expiring_create_nonce(
                                &provider,
                                &self.sequence.sequences()[i].transactions[*index],
                            )
                            .await?;
                            let mut kind = kind
                                .clone()
                                .prepare_for_durable_send(
                                    &provider,
                                    sequential_broadcast,
                                    *is_fixed_gas_limit,
                                    estimate_via_rpc,
                                    self.args.gas_estimate_multiplier,
                                    tempo_sponsor.as_deref(),
                                )
                                .await?;
                            if let PreparedTransaction::Raw(payload, hash) = &mut kind {
                                *hash = self.sequence.persist_signed_payload(
                                    i,
                                    *index,
                                    payload.clone(),
                                    tempo_hardfork.is_none_or(|fork| fork >= TempoHardfork::T1B),
                                )?;
                            }
                            prepared.push((kind, *index));
                        }

                        let mut buffer = FuturesUnordered::new();
                        for (kind, index) in prepared {
                            if let Some(request) = kind.delegated_request() {
                                kind.validate_delegated_submission()?;
                                self.sequence.persist_delegated_request(
                                    i,
                                    index,
                                    request.clone(),
                                )?;
                            }
                            let provider = if matches!(kind, PreparedTransaction::Unlocked(_)) {
                                unlocked_submission_provider.clone()
                            } else {
                                provider.clone()
                            };
                            let mut pending = async move {
                                let res = kind.clone().send(provider).await;
                                (res, kind, 0, None, index)
                            }
                            .boxed();
                            if let Some(result) = pending.as_mut().now_or_never() {
                                buffer.push(futures::future::ready(result).boxed());
                            } else {
                                buffer.push(pending);
                            }
                        }

                        'send: while let Some((mut res, kind, attempt, original_res, index)) =
                            buffer.next().await
                        {
                            if res.is_err()
                                && let PreparedTransaction::Raw(_, hash) = kind
                                && provider
                                    .get_transaction_by_hash(hash)
                                    .await
                                    .is_ok_and(|transaction| transaction.is_some())
                            {
                                res = Ok(hash);
                            }
                            if kind.delegated_request().is_some()
                                && let Err(error) = res
                            {
                                if kind.is_definite_non_submission(&error) {
                                    self.sequence.clear_delegated_request(i, index)?;
                                    return Err(error);
                                }
                                self.sequence.persist_delegated_status(
                                    i,
                                    index,
                                    DelegatedStatus::OutcomeUnknown,
                                )?;
                                bail!(
                                    "submission outcome for delegated operation {index} is unknown; refusing to risk a duplicate transaction"
                                );
                            }
                            if res.is_err() && attempt <= 3 {
                                // Try to resubmit the transaction
                                let provider = provider.clone();
                                let progress = seq_progress.inner.clone();
                                buffer.push(Box::pin(async move {
                                    debug!(err=?res, ?attempt, "retrying transaction ");
                                    let attempt = attempt + 1;
                                    progress.write().set_status(&format!(
                                        "retrying transaction {res:?} (attempt {attempt})"
                                    ));
                                    tokio::time::sleep(Duration::from_millis(1000 * attempt)).await;
                                    let r = kind.clone().send(provider).await;
                                    (r, kind, attempt, original_res.or(Some(res)), index)
                                }));

                                continue 'send;
                            }

                            // Preserve the original error if any
                            let tx_hash = res.wrap_err_with(|| {
                                    if let Some(original_res) = original_res {
                                        format!(
                                            "Failed to send transaction after {attempt} attempts {original_res:?}"
                                        )
                                    } else {
                                        "Failed to send transaction".to_string()
                                    }
                                })?;
                            if let PreparedTransaction::Raw(_, expected) = kind
                                && expected != tx_hash
                            {
                                bail!("RPC returned hash {tx_hash} for signed payload {expected}");
                            }
                            if kind.delegated_request().is_some() {
                                self.sequence.persist_delegated_status(
                                    i,
                                    index,
                                    DelegatedStatus::Pending { hash: tx_hash },
                                )?;
                            }
                            sequence = self.sequence.sequences_mut().get_mut(i).unwrap();
                            sequence.add_pending(index, tx_hash);

                            // Checkpoint save
                            self.sequence.save(true, false)?;

                            seq_progress.inner.write().tx_sent(tx_hash);
                        }

                        // Checkpoint save
                        self.sequence.save(true, false)?;
                        let (durable_hashes, replayable_hashes) =
                            self.sequence.submission_hashes(i);
                        let blocked = blocked_pending(self.sequence.sequences(), i);
                        sequence = self.sequence.sequences_mut().get_mut(i).unwrap();

                        let result = progress
                            .wait_for_pending(
                                i,
                                sequence,
                                &provider,
                                self.script_config.config.transaction_timeout,
                                self.args.confirmations,
                                (&durable_hashes, &replayable_hashes),
                                &blocked,
                            )
                            .await;
                        // Checkpoint save, including reverts recorded before a failure.
                        self.sequence.save(true, false)?;
                        result?;
                        self.sequence.ensure_delegated_outcomes_known(i)?;
                        sequence = self.sequence.sequences_mut().get_mut(i).unwrap();
                    }
                }

                let (total_gas, avg_gas_price, total_paid) = fee_totals(
                    sequence.receipts.iter().map(|r| (r.gas_used(), r.effective_gas_price())),
                );
                let paid = format_units(total_paid, 18).unwrap_or_else(|_| "N/A".to_string());
                let avg_gas_price = avg_gas_price
                    .and_then(|avg| format_units(avg, 9).ok())
                    .unwrap_or_else(|| "N/A".to_string());

                let token_symbol = NamedChain::try_from(sequence.chain)
                    .unwrap_or_default()
                    .native_currency_symbol()
                    .unwrap_or("ETH");
                // Reverted transactions have no stored receipt, so their fees are not included.
                let excluded = match sequence.reverted.len() {
                    0 => String::new(),
                    1 => ", excluding 1 reverted transaction".to_string(),
                    n => format!(", excluding {n} reverted transactions"),
                };
                seq_progress.inner.write().set_status(&format!(
                    "Total Paid: {} {} ({} gas * avg {} gwei{excluded})\n",
                    paid.trim_end_matches('0'),
                    token_symbol,
                    total_gas,
                    avg_gas_price.trim_end_matches('0').trim_end_matches('.')
                ));
                seq_progress.inner.write().finish();
                Ok::<_, eyre::Report>(())
            };
            broadcast_sequence.await.map_err(|err| self.sequence.label_error(i, err))?;
        }

        // Submitted operations can lack a receipt when the endpoint stopped returning them.
        let unresolved = self
            .sequence
            .sequences()
            .iter()
            .enumerate()
            .filter_map(|(i, deployment)| {
                let hashes = remaining_operation_indices(&self.sequence, i)
                    .into_iter()
                    .filter_map(|index| deployment.transactions[index].hash)
                    .collect::<Vec<_>>();
                (!hashes.is_empty())
                    .then(|| format!("chain {}: {}", deployment.chain, hashes.iter().format(", ")))
            })
            .collect::<Vec<_>>();
        if !shell::is_json() {
            sh_println!("\n\n==========================")?;
        }
        // Resume skips recorded reverts, so completing the remaining work is not a success.
        let reverted = self
            .sequence
            .sequences()
            .iter()
            .filter(|deployment| !deployment.reverted.is_empty())
            .map(|deployment| {
                format!("chain {}: {}", deployment.chain, deployment.reverted.iter().format(", "))
            })
            .collect::<Vec<_>>();
        if !unresolved.is_empty() {
            sh_warn!(
                "ONCHAIN EXECUTION INCOMPLETE: submitted transactions have no receipt:\n{}\nAdd `--resume` to your command to check them again and replay dropped signed transactions.",
                unresolved.join("\n")
            )?;
        } else if !reverted.is_empty() {
            sh_warn!(
                "ONCHAIN EXECUTION COMPLETE WITH REVERTED TRANSACTIONS:\n{}",
                reverted.join("\n")
            )?;
        } else if !shell::is_json() {
            sh_println!("\nONCHAIN EXECUTION COMPLETE & SUCCESSFUL.")?;
        }

        Ok(BroadcastedState {
            args: self.args,
            script_config: self.script_config,
            build_data: self.build_data,
            sequence: self.sequence,
        })
    }

    pub async fn verify_preflight_check(&self) -> Result<()> {
        if self.args.verify_external && self.script_config.config.offline {
            bail!("External contract verification is unavailable in offline mode");
        }

        for sequence in self.sequence.sequences() {
            let chain: Chain = sequence.chain.into();
            // Resolve the API key: CLI arg first, then per-chain config, then global fallback.
            let etherscan_key = self
                .script_config
                .config
                .get_etherscan_api_key(Some(chain))
                .or_else(|| self.script_config.config.etherscan_api_key.clone());
            let api_key =
                self.args.verifier.resolve_api_key(etherscan_key.as_deref()).map(str::to_owned);
            let has_url = self.args.verifier.verifier_url.is_some();
            let is_explicit = self.args.verifier.is_explicitly_set();
            // Presence check: use the fully-resolved provider type so that implicit Etherscan
            // selection (key from env/config, no explicit --verifier flag) is validated too.
            self.args
                .verifier
                .resolve(api_key.as_deref(), Some(chain))
                .client(api_key.as_deref(), Some(chain), has_url, is_explicit)
                .wrap_err_with(|| {
                    format!("Verification preflight check failed for chain {}", sequence.chain)
                })?;
            // Connectivity check: validates credentials are actually accepted by the verifier.
            self.args
                .verifier
                .check_credentials(api_key.as_deref(), chain, &self.script_config.config)
                .await
                .wrap_err_with(|| {
                    format!("Verification preflight check failed for chain {}", sequence.chain)
                })?;
        }

        Ok(())
    }
}

impl BundledState<TempoEvmNetwork> {
    /// Broadcasts all transactions as a single Tempo batch transaction (type 0x76).
    ///
    /// This method collects all individual transactions from the script and combines them
    /// into a single batch transaction for atomic execution on Tempo.
    pub async fn broadcast_batch(mut self) -> Result<BroadcastedState<TempoEvmNetwork>> {
        // Batch mode only supports single chain for now
        if self.sequence.sequences().len() != 1 {
            bail!(
                "--batch mode only supports single-chain scripts. \
                 Use --multi without --batch for multi-chain."
            );
        }

        let batch_resolution = if self.args.resume_tx_hash.is_some() {
            self.sequence
                .restore_delegated_pending(
                    self.args.resume_attempt,
                    self.args.resume_tx_hash,
                    false,
                )?
                .map(|(_, _, attempt, hash)| (attempt, hash))
        } else {
            None
        };
        let mut recovered_batch = self
            .sequence
            .batch_attempt(0)
            .map(|(first, attempt, kind)| (first, attempt, kind.clone()));

        let sequence = self.sequence.sequences().first().unwrap();
        let total_transactions = sequence.transactions.len();
        let completed_prefix = completed_transaction_prefix(sequence)?;
        let batch_start =
            recovered_batch.as_ref().map(|(first, _, _)| *first).unwrap_or(completed_prefix);

        if batch_start == total_transactions {
            sh_println!("No transactions to broadcast in batch mode.")?;
            return Ok(BroadcastedState {
                args: self.args,
                script_config: self.script_config,
                build_data: self.build_data,
                sequence: self.sequence,
            });
        }

        // Reject pre-signed transactions: a batch is a single atomic tx from one sender,
        // so any tx already signed by another key would silently be re-attributed.
        if let Some((idx, _)) =
            sequence.transactions().enumerate().find(|(_, tx)| !tx.is_unsigned())
        {
            bail!(
                "--batch cannot include pre-signed transactions (found at position {}); \
                 batch mode signs a single atomic transaction from one sender.",
                idx + 1
            );
        }

        // Collect sender addresses - batch mode requires single sender
        let senders: AddressHashSet = sequence
            .transactions()
            .skip(batch_start)
            .filter(|tx| tx.is_unsigned())
            .filter_map(|tx| tx.from())
            .collect();

        if senders.len() != 1 {
            bail!(
                "--batch mode requires all transactions to have the same sender. \
                 Found {} unique senders: {:?}",
                senders.len(),
                senders
            );
        }

        let sender = *senders.iter().next().unwrap();
        let chain_id = sequence.chain;
        let calls = tempo_batch_calls(sequence, batch_start)?;
        if let Some((_, _, kind)) = &recovered_batch {
            match kind {
                AttemptKind::Signed { request: Some(request), payload } => {
                    let hash = validate_tempo_batch_payload(
                        request,
                        &payload.payload,
                        sender,
                        chain_id,
                        &calls,
                    )?;
                    if hash != payload.hash {
                        bail!("recovery plan batch payload does not match its hash");
                    }
                }
                AttemptKind::Delegated { request, .. } => {
                    validate_tempo_batch_request(request, sender, chain_id, &calls)?;
                }
                AttemptKind::Legacy { .. } => {}
                AttemptKind::Signed { request: None, .. } => {
                    bail!("recovery plan batch payload has no persisted request");
                }
            }
        }

        let rpc_url = self.sequence.rpc_url(0).to_owned();
        if let Some((attempt_id, hash)) = batch_resolution {
            let provider = ProviderBuilder::<TempoNetwork>::from_config_with_url(
                &self.script_config.config,
                &rpc_url,
            )?
            .build()?;
            let transaction = provider
                .get_transaction_by_hash(hash)
                .await?
                .context("resolved transaction is not available from the recovery endpoint")?;
            self.sequence.resolve_delegated_hash(attempt_id, hash, &transaction)?;
            recovered_batch = self
                .sequence
                .batch_attempt(0)
                .map(|(first, attempt, kind)| (first, attempt, kind.clone()));
        }

        let recovered_hash = recovered_batch.as_ref().and_then(|(_, _, kind)| match kind {
            AttemptKind::Signed { payload, .. } => Some(payload.hash),
            AttemptKind::Delegated { status: DelegatedStatus::Pending { hash }, .. }
            | AttemptKind::Legacy { hash } => Some(*hash),
            AttemptKind::Delegated { .. } => None,
        });
        if completed_prefix == total_transactions
            || recovered_hash
                .is_some_and(|hash| self.sequence.sequences()[0].reverted.contains(&hash))
        {
            sh_println!("No transactions to broadcast in batch mode.")?;
            return Ok(BroadcastedState {
                args: self.args,
                script_config: self.script_config,
                build_data: self.build_data,
                sequence: self.sequence,
            });
        }

        if matches!(
            recovered_batch,
            Some((_, _, AttemptKind::Delegated { status: DelegatedStatus::OutcomeUnknown, .. }))
        ) {
            bail!(
                "submission outcome for delegated Tempo batch is unknown; refusing to risk a duplicate transaction"
            );
        }

        let sequence = self.sequence.sequences_mut().get_mut(0).unwrap();

        if sender == Config::DEFAULT_SENDER {
            bail!(
                "You seem to be using Foundry's default sender. Be sure to set your own --sender."
            );
        }

        let provider = Arc::new(
            ProviderBuilder::<TempoNetwork>::from_config_with_url(
                &self.script_config.config,
                &rpc_url,
            )?
            .build()?,
        );

        if let Some((_, _, AttemptKind::Legacy { hash })) = &recovered_batch {
            let transaction = provider
                .get_transaction_by_hash(*hash)
                .await?
                .context("legacy batch transaction is not available for validation")?;
            if transaction.tx_hash() != *hash {
                bail!("legacy batch endpoint returned a transaction with the wrong hash");
            }
            validate_tempo_batch_envelope(transaction.as_ref(), sender, chain_id, &calls)?;
        }

        // Resume detection happens before signer resolution, gas estimation, and sponsor attachment
        // so that recovering an already-submitted batch tx never requires the original
        // signer/sponsor or a fresh estimate.
        if recovered_batch.is_none()
            && (!sequence.pending.is_empty()
                || sequence.transactions.iter().skip(batch_start).any(|tx| tx.hash.is_some()))
        {
            bail!("batch progress exists without a durable submission attempt");
        }

        if let Some(hash) = recovered_hash {
            let mut changed = false;
            for tx in sequence.transactions.iter_mut().skip(batch_start) {
                if tx.hash != Some(hash) {
                    tx.hash = Some(hash);
                    changed = true;
                }
            }
            if !sequence.receipts.iter().any(|receipt| receipt.transaction_hash() == hash)
                && !sequence.pending.contains(&hash)
            {
                sequence.pending.push(hash);
                changed = true;
            }
            if changed {
                self.sequence.save(true, false)?;
            }
        }

        if let Some((_, _, AttemptKind::Signed { payload, .. })) = &recovered_batch
            && provider.get_transaction_receipt(payload.hash).await?.is_none()
            && provider.get_transaction_by_hash(payload.hash).await?.is_none()
        {
            send_tempo_batch_payload(provider.as_ref(), &payload.payload, payload.hash).await?;
        }

        if let Some(tx_hash) = recovered_hash {
            sh_println!(
                "Resuming batch: tx {tx_hash:#x} already submitted, waiting for receipt..."
            )?;

            let timeout = self.script_config.config.transaction_timeout;
            let receipt_result = tokio::time::timeout(
                Duration::from_secs(timeout),
                wait_for_batch_receipt(provider.as_ref(), tx_hash, self.args.confirmations),
            )
            .await;

            match receipt_result {
                Ok(Ok(Some(receipt))) => {
                    Self::finish_batch(&mut self.sequence, receipt, tx_hash, batch_start, true)?;
                    return Ok(BroadcastedState {
                        args: self.args,
                        script_config: self.script_config,
                        build_data: self.build_data,
                        sequence: self.sequence,
                    });
                }
                Ok(Ok(None)) => {
                    bail!(
                        "Tempo batch {tx_hash:#x} is not currently visible; its pending hash remains checkpointed"
                    );
                }
                Ok(Err(e)) => return Err(e),
                Err(_) => {
                    return Err(eyre::eyre!(
                        "Timeout waiting for batch transaction receipt (tx: {tx_hash:#x}). \
                         The transaction hash remains checkpointed; run with --resume to retry."
                    ));
                }
            }
        }

        ensure_recorded_sponsor(self.sequence.sponsor(), self.script_config.tempo.sponsor)?;

        // Reborrow after the potential save above.
        let sequence = self.sequence.sequences_mut().get_mut(0).unwrap();

        let tempo_sponsor = self.script_config.tempo.sponsor_config().await?;

        // Get wallet for signing
        enum BatchSigner {
            Unlocked,
            Wallet(EthereumWallet),
            TempoKeychain(Box<TempoAccountsWallet>),
        }

        let mut batch_signer = if self.args.unlocked {
            BatchSigner::Unlocked
        } else if let Some(session) = self.script_config.tempo.session_signer_for_multi_wallet(
            &self.args.wallets,
            Some(sender),
            chain_id,
        )? {
            BatchSigner::TempoKeychain(Box::new(session.access_key))
        } else {
            let mut signers = self.script_wallets.into_multi_wallet().into_signers()?;
            if let Some(signer) = signers.remove(&sender) {
                BatchSigner::Wallet(EthereumWallet::new(signer))
            } else {
                // Try the Tempo Accounts store only for Tempo broadcasts.
                if self.script_config.evm_opts.networks.is_tempo()
                    && let Some(wallet) = TempoAccountsWallet::try_from_default_store()?
                    && wallet.has_account(sender)?
                {
                    BatchSigner::TempoKeychain(Box::new(wallet.with_chain_id(chain_id)))
                } else {
                    let mut message = format!("No wallet found for sender {sender}");
                    if let Some(error) = &self.resume_script_error {
                        message = format!("{message}\n{}", resume_script_failure(error));
                    }
                    bail!(message);
                }
            }
        };
        if let Some(error) = &self.resume_script_error {
            sh_warn!("{}", resume_script_failure(error))?;
        }

        // CREATE2 deployer must exist on-chain for any rewritten CREATEs.
        let create2_deployer = self.script_config.evm_opts.create2_deployer;
        let needs_factory =
            sequence.transactions.iter().skip(batch_start).any(|tx| tx.call_kind.is_any_create());
        if needs_factory {
            let code = provider.get_code_at(create2_deployer).await?;
            if keccak256(&code) != DEFAULT_CREATE2_DEPLOYER_CODEHASH {
                bail!(
                    "CREATE2 deployer {create2_deployer:#x} is not deployed on this Tempo network; \
                     --batch requires it. Deploy it first and retry."
                );
            }
        }

        sh_println!(
            "\n## Broadcasting batch transaction with {} call(s) to chain {}...",
            calls.len(),
            sequence.chain
        )?;

        // Build the batch transaction request
        let nonce = provider.get_transaction_count(sender).await?;

        // Batch transactions are Tempo-only and always use EIP-1559 style fees.
        let fees = estimate_eip1559_fees(&provider, self.script_config.config.eip1559_fee_estimate)
            .await?;
        let fees = resolve_broadcast_eip1559_fees(
            fees,
            self.args.with_gas_price.map(|p| p.to()),
            self.args.priority_gas_price.map(|p| p.to()),
            None,
        )?;
        let max_fee_per_gas = fees.max_fee_per_gas;
        let max_priority_fee_per_gas = fees.max_priority_fee_per_gas;

        let mut batch_tx = TempoTransactionRequest {
            inner: TransactionRequest {
                from: Some(sender),
                to: None,
                value: None,
                input: Default::default(),
                nonce: Some(nonce),
                chain_id: Some(chain_id),
                max_fee_per_gas: Some(max_fee_per_gas),
                max_priority_fee_per_gas: Some(max_priority_fee_per_gas),
                ..Default::default()
            },
            // Keep the fee token recorded with the remaining calls; `apply` overrides it with
            // `--tempo.fee-token`.
            fee_token: match sequence.transactions[batch_start].tx() {
                TransactionMaybeSigned::Unsigned(tx) => tx.fee_token,
                TransactionMaybeSigned::Signed { .. } => None,
            },
            calls: calls.clone(),
            nonce_key: self.script_config.tempo.expiring_nonce.then_some(U256::MAX),
            valid_before: self.script_config.tempo.valid_before.and_then(NonZeroU64::new),
            ..Default::default()
        };
        self.script_config.tempo.apply::<TempoNetwork>(&mut batch_tx, None);
        let fee_token = if let Some(sponsor) = &tempo_sponsor {
            sponsor.resolve_and_set_fee_token(Some(provider.as_ref()), &mut batch_tx).await?;
            None
        } else {
            resolve_and_set_fee_token(Some(provider.as_ref()), &mut batch_tx, Some(sender)).await?
        };

        if let BatchSigner::TempoKeychain(wallet) = &mut batch_signer {
            **wallet = batch_tx.prepare_with_tempo_wallet(provider.as_ref(), wallet).await?;
        }

        // Estimate gas for the batch transaction
        estimate_gas(&mut batch_tx, provider.as_ref(), self.args.gas_estimate_multiplier, false)
            .await?;

        sh_println!("Estimated gas: {}", batch_tx.inner.gas.unwrap_or(0))?;

        if let Some(sponsor) = &tempo_sponsor {
            sponsor.attach_and_print::<TempoNetwork>(&mut batch_tx, sender).await?;
        } else {
            maybe_print_fee_token(Some(provider.as_ref()), fee_token).await?;
        }
        batch_tx.prep_for_submission();

        let _ = sequence;

        // Sign and send.
        let signed_payload = match &batch_signer {
            BatchSigner::Wallet(wallet) => {
                Some(Bytes::from(batch_tx.clone().build(wallet).await?.encoded_2718()))
            }
            BatchSigner::TempoKeychain(wallet) => {
                Some(Bytes::from(batch_tx.clone().sign_with_tempo_wallet(wallet).await?))
            }
            BatchSigner::Unlocked => None,
        };
        let tx_hash = if let Some(payload) = signed_payload {
            validate_tempo_batch_payload(&batch_tx, &payload, sender, chain_id, &calls)?;
            let expected = self.sequence.persist_batch_signed_payload(
                0,
                batch_start,
                batch_tx,
                payload.clone(),
            )?;
            send_tempo_batch_payload(provider.as_ref(), &payload, expected).await?;
            expected
        } else {
            let provider = ProviderBuilder::<TempoNetwork>::from_config_with_url(
                &self.script_config.config,
                &rpc_url,
            )?
            .max_retry(0)
            .build()?;
            self.sequence.persist_batch_delegated_request(0, batch_start, batch_tx.clone())?;
            let (_, attempt_id, _) = self.sequence.batch_attempt(0).unwrap();
            let pending = match provider.send_transaction(batch_tx).await {
                Ok(pending) => pending,
                Err(error) => {
                    let error = eyre::Report::from(error);
                    if is_definite_unlocked_non_submission(&error) {
                        self.sequence.clear_delegated_request(0, batch_start)?;
                        return Err(error);
                    }
                    self.sequence.persist_delegated_status(
                        0,
                        batch_start,
                        DelegatedStatus::OutcomeUnknown,
                    )?;
                    return Err(error.wrap_err(format!(
                        "submission outcome for delegated Tempo batch attempt {attempt_id} is unknown; resolve it with --resume-attempt and --resume-tx-hash, or use --resume-retry only after proving it was not submitted"
                    )));
                }
            };
            let hash = *pending.tx_hash();
            self.sequence.persist_delegated_status(
                0,
                batch_start,
                DelegatedStatus::Pending { hash },
            )?;
            hash
        };

        sh_println!("Batch transaction sent: {:#x}", tx_hash)?;

        // Checkpoint: stamp the batch hash on all remaining transactions (so that resume
        // detection finds it regardless of which tx it inspects first), register one entry
        // in sequence.pending for drop/timeout tracking, then save.
        let sequence = self.sequence.sequences_mut().get_mut(0).unwrap();
        for tx in sequence.transactions.iter_mut().skip(batch_start) {
            tx.hash = Some(tx_hash);
        }
        if !sequence.pending.contains(&tx_hash) {
            sequence.pending.push(tx_hash);
        }
        self.sequence.save(true, false)?;

        // Wait for receipt
        let timeout = self.script_config.config.transaction_timeout;
        let receipt = tokio::time::timeout(
            Duration::from_secs(timeout),
            wait_for_batch_receipt(provider.as_ref(), tx_hash, self.args.confirmations),
        )
        .await
        .map_err(|_| eyre::eyre!("Timeout waiting for batch transaction receipt (tx: {tx_hash:#x}). Run with --resume to retry."))??
        .ok_or_else(|| eyre::eyre!("Batch transaction {tx_hash:#x} was dropped from the mempool. Run with --resume to retry."))?;

        Self::finish_batch(&mut self.sequence, receipt, tx_hash, batch_start, false)?;
        Ok(BroadcastedState {
            args: self.args,
            script_config: self.script_config,
            build_data: self.build_data,
            sequence: self.sequence,
        })
    }

    fn finish_batch(
        sequences: &mut ScriptSequenceKind<TempoNetwork>,
        receipt: TempoTransactionReceipt,
        tx_hash: TxHash,
        batch_start: usize,
        resumed: bool,
    ) -> Result<()> {
        let sequence = sequences.sequences_mut().get_mut(0).unwrap();
        sequence.remove_pending(tx_hash);
        if !receipt.status() {
            if !sequence.reverted.contains(&tx_hash) {
                sequence.reverted.push(tx_hash);
            }
            sequences.save(true, false)?;
            bail!("Batch transaction failed (reverted)");
        }
        sh_println!("Batch transaction confirmed in block {}", receipt.block_number.unwrap_or(0))?;

        // Receipts are pushed 1:1 with the remaining (not-yet-receipted) transactions.
        let remaining_len = sequence.transactions.len() - batch_start;
        // Only carry through contract_address for actual deployments; plain calls also
        // store the callee in `contract_address`, which would otherwise be copied into
        // the receipt and treated as a fresh deployment by downstream consumers
        // (broadcast JSON, verifier).
        let per_tx_addresses: Vec<Option<Address>> = sequence
            .transactions
            .iter()
            .skip(batch_start)
            .map(|tx| match tx.call_kind {
                CallKind::Create | CallKind::Create2 => tx.contract_address,
                _ => None,
            })
            .collect();

        for (idx, addr) in per_tx_addresses.iter().enumerate() {
            if let Some(addr) = addr {
                sh_println!("  call[{idx}] deployed at: {addr:#x}")?;
            }
        }

        // gasUsed reflects the whole batch; per-call attribution is unavailable from the receipt.
        for addr in &per_tx_addresses {
            let mut tx_receipt = receipt.clone();
            tx_receipt.contract_address = *addr;
            sequence.receipts.push(tx_receipt);
        }

        let chain = sequence.chain;
        let _ = sequence;

        sequences.save(true, false)?;

        let total_gas = receipt.gas_used();
        let gas_price = receipt.effective_gas_price();
        let total_paid = u128::from(total_gas).saturating_mul(gas_price);
        let paid = format_units(total_paid, 18).unwrap_or_else(|_| "N/A".to_string());
        let gas_price_gwei = format_units(gas_price, 9).unwrap_or_else(|_| "N/A".to_string());

        let token_symbol = NamedChain::try_from(chain)
            .unwrap_or_default()
            .native_currency_symbol()
            .unwrap_or("ETH");
        let resumed =
            resumed.then(|| format!("\n(resumed from previous run, {remaining_len} tx(s))"));
        sh_println!(
            "\nTotal Paid: {} {} ({} gas * {} gwei){}",
            paid.trim_end_matches('0'),
            token_symbol,
            total_gas,
            gas_price_gwei.trim_end_matches('0').trim_end_matches('.'),
            resumed.as_deref().unwrap_or_default(),
        )?;

        if !shell::is_json() {
            sh_println!("\n\n==========================")?;
            sh_println!("\nBATCH EXECUTION COMPLETE & SUCCESSFUL.")?;
            sh_println!(
                "All {} calls executed atomically in a single transaction.",
                remaining_len
            )?;
        }

        Ok(())
    }
}

async fn send_tempo_batch_payload(
    provider: &RootProvider<TempoNetwork>,
    payload: &[u8],
    expected: TxHash,
) -> Result<()> {
    match provider.send_raw_transaction(payload).await {
        Ok(pending) if *pending.tx_hash() == expected => Ok(()),
        Ok(pending) => {
            bail!("RPC returned hash {} for signed batch payload {expected}", pending.tx_hash())
        }
        Err(error) => {
            if provider.get_transaction_receipt(expected).await.ok().flatten().is_some()
                || provider.get_transaction_by_hash(expected).await.ok().flatten().is_some()
            {
                Ok(())
            } else {
                Err(error.into())
            }
        }
    }
}

async fn wait_for_batch_receipt<N: Network>(
    provider: &RootProvider<N>,
    tx_hash: TxHash,
    confirmations: u64,
) -> Result<Option<N::ReceiptResponse>> {
    loop {
        if let Some(receipt) = provider.get_transaction_receipt(tx_hash).await?
            && is_mined_receipt_for(&receipt, tx_hash)
            && let Some(receipt_block) = receipt.block_number()
        {
            let latest_block = provider.get_block_number().await?;
            if latest_block >= receipt_block.saturating_add(confirmations.saturating_sub(1)) {
                return Ok(Some(receipt));
            }
        }

        if provider.get_transaction_by_hash(tx_hash).await?.is_none() {
            return Ok(None);
        }

        tokio::time::sleep(Duration::from_millis(500)).await;
    }
}

pub async fn estimate_gas<N: Network, P: Provider<N>>(
    tx: &mut N::TransactionRequest,
    provider: &P,
    estimate_multiplier: u64,
    browser: bool,
) -> Result<()>
where
    N::TransactionRequest: FoundryTransactionBuilder<N>,
{
    // if already set, some RPC endpoints might simply return the gas value that is already
    // set in the request and omit the estimate altogether, so we remove it here
    tx.reset_gas_limit();

    let request = if browser { tx.browser_wallet_gas_estimation_request() } else { tx.clone() };
    tx.set_gas_limit(
        provider.estimate_gas(request).await.wrap_err("Failed to estimate gas for tx")?
            * estimate_multiplier
            / 100,
    );
    Ok(())
}

fn reject_access_key_create<N: Network>(
    tx: &N::TransactionRequest,
    uses_access_key: bool,
) -> Result<()>
where
    N::TransactionRequest: FoundryTransactionBuilder<N>,
{
    if uses_access_key && tx.tempo_calls().iter().any(|(to, _)| to.is_create()) {
        bail!("Tempo access-key transactions cannot use CREATE");
    }
    Ok(())
}

fn convert_tempo_aa_create<N: Network>(tx: &mut N::TransactionRequest)
where
    N::TransactionRequest: FoundryTransactionBuilder<N>,
{
    if tx.is_tempo_aa() {
        tx.convert_create_to_call();
    }
}

/// Collection increments the sender's protocol nonce for CALLs, but expiring CALLs do not.
/// Reject a subsequent CREATE before submitting anything, since its simulated address is stale.
/// Called only when expiring nonce mode is enabled.
fn reject_expiring_call_before_create<N: Network>(sequences: &[ScriptSequence<N>]) -> Result<()>
where
    N::TransactionRequest: FoundryTransactionBuilder<N>,
{
    let mut called = HashSet::new();
    for sequence in sequences {
        for transaction in &sequence.transactions {
            let tx = transaction.tx();
            if let Some(sender) = tx.from() {
                let scope = (sequence.chain, sender);
                if tx.to().is_none() && called.contains(&scope) {
                    bail!(
                        "Tempo expiring nonce scripts cannot use CREATE after a CALL from the same sender on the same chain; use CREATE2 or disable --tempo.expiring-nonce"
                    );
                }
                let expiring = match tx {
                    TransactionMaybeSigned::Unsigned(request) => request.supports_fee_token(),
                    TransactionMaybeSigned::Signed { tx, .. } => {
                        <N::TransactionRequest as From<N::TxEnvelope>>::from(tx.clone()).nonce_key()
                            == Some(TEMPO_EXPIRING_NONCE_KEY)
                    }
                };
                if expiring && tx.to().is_some() {
                    called.insert(scope);
                }
            }
        }
    }
    Ok(())
}

/// Returns the total gas used, the average gas price and the total fee paid in wei for the given
/// `(gas_used, effective_gas_price)` receipt pairs.
fn fee_totals(receipts: impl IntoIterator<Item = (u64, u128)>) -> (u64, Option<u128>, u128) {
    let (count, total_gas, total_gas_price, total_paid) =
        receipts.into_iter().fold((0u128, 0u64, 0u128, 0u128), |acc, (gas_used, gas_price)| {
            (
                acc.0 + 1,
                acc.1 + gas_used,
                acc.2.saturating_add(gas_price),
                acc.3.saturating_add(u128::from(gas_used).saturating_mul(gas_price)),
            )
        });
    (total_gas, total_gas_price.checked_div(count), total_paid)
}

/// Describes the failed script run that `--resume` performed to collect missing signers.
fn resume_script_failure(error: &str) -> String {
    format!("Resume re-ran the script to collect signers, but it failed: {error}")
}

#[cfg(test)]
mod tests {
    use super::*;
    use alloy_consensus::{Eip658Value, Receipt, ReceiptEnvelope, ReceiptWithBloom, TxEnvelope};
    use alloy_network::Ethereum;
    use alloy_primitives::{B256, Bloom, address, hex};
    use alloy_provider::mock::Asserter;
    use alloy_rpc_types::TransactionReceipt;
    use alloy_signer::Signer;
    use foundry_common::tempo::PATH_USD_ADDRESS;
    use foundry_evm::{backend::Backend, core::evm::EthEvmNetwork, opts::EvmOpts};

    const ROOT_PRIVATE_KEY: &str =
        "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";
    const ACCESS_KEY_PRIVATE_KEY: &str =
        "0x59c6995e998f97a5a004497e5da3b5d2b2b66a87f064d39c44da0b6d6e4f8ff0";
    const SIGNED_TX: &[u8] = &hex!(
        "02f86b0180843b9aca008502540be4008252089400000000000000000000000000000000000000016480c001a070d55e79ed3ac9fc8f51e78eb91fd054720d943d66633f2eb1bc960f0126b0eca052eda05a792680de3181e49bab4093541f75b49d1ecbe443077b3660c836016a"
    );
    const OTHER_SIGNED_TX: &[u8] = &hex!(
        "02f86b0180843b9aca008502540be4008252089400000000000000000000000000000000000000018080c001a0cce9a61187b5d18a89ecd27ec675e3b3f10d37f165627ef89a15a7fe76395ce8a07537f5bffb358ffbef22cda84b1c92f7211723f9e09ae037e81686805d3e5505"
    );

    #[tokio::test(flavor = "multi_thread")]
    async fn next_nonce_uses_exact_fork_hash() {
        let (_api, handle) = anvil::spawn(anvil::NodeConfig::test()).await;
        let provider = handle.http_provider();
        let sender = handle.dev_accounts().next().unwrap();
        let recipient = Address::with_last_byte(1);

        let receipt = provider
            .send_transaction(
                TransactionRequest::default().from(sender).to(recipient).value(U256::ONE).into(),
            )
            .await
            .unwrap()
            .get_receipt()
            .await
            .unwrap();
        let block_number = receipt.block_number.unwrap();
        let evm_opts = EvmOpts {
            fork_url: Some(handle.http_endpoint()),
            fork_block_number: Some(block_number),
            ..Default::default()
        };
        let backend =
            Backend::<EthEvmNetwork>::spawn(evm_opts.get_fork(&Config::default(), 31337, None))
                .unwrap();
        assert_eq!(backend.transaction_count(sender).await.unwrap(), 1);

        provider
            .raw_request::<_, ()>("anvil_reorg".into(), (1_u64, Vec::<serde_json::Value>::new()))
            .await
            .unwrap();
        assert_eq!(provider.get_transaction_count(sender).number(block_number).await.unwrap(), 0);

        match backend.transaction_count(sender).await {
            Ok(0) => panic!("the exact lookup fell back to the replacement block"),
            Ok(1) | Err(_) => {}
            Ok(nonce) => panic!("unexpected nonce: {nonce}"),
        }
    }

    #[test]
    fn access_key_signer_takes_precedence_over_same_sender_wallet() {
        let root = foundry_wallets::utils::create_private_key_signer(ROOT_PRIVATE_KEY).unwrap();
        let root_address = root.address();
        let access_key =
            foundry_wallets::utils::create_local_signer(ACCESS_KEY_PRIVATE_KEY).unwrap();
        let access_key_address = access_key.address();
        let mut eth_wallets = AddressHashMap::default();
        eth_wallets.insert(root_address, EthereumWallet::new(root));
        let mut access_keys = HashMap::default();
        access_keys.insert(
            SignerScope::new(4217, root_address),
            TempoAccountsWallet::from_secp256k1(root_address, access_key, None).with_chain_id(4217),
        );
        let send_kind =
            SendTransactionsKind::<Ethereum>::Raw { eth_wallets, browser: None, access_keys };

        let tx = TransactionRequest { from: Some(root_address), ..Default::default() };
        let sender = send_kind.for_sender(4217, &root_address, tx).unwrap();

        match sender {
            SendTransactionKind::AccessKey(_, wallet) => {
                assert_eq!(wallet.key_id().unwrap(), access_key_address);
                assert_eq!(wallet.account(), root_address);
            }
            _ => panic!("expected access key signer"),
        }
    }

    #[test]
    fn access_key_signer_is_scoped_to_chain() {
        let root = foundry_wallets::utils::create_private_key_signer(ROOT_PRIVATE_KEY).unwrap();
        let root_address = root.address();
        let access_key =
            foundry_wallets::utils::create_local_signer(ACCESS_KEY_PRIVATE_KEY).unwrap();
        let mut eth_wallets = AddressHashMap::default();
        eth_wallets.insert(root_address, EthereumWallet::new(root));
        let mut access_keys = HashMap::default();
        access_keys.insert(
            SignerScope::new(4217, root_address),
            TempoAccountsWallet::from_secp256k1(root_address, access_key, None).with_chain_id(4217),
        );
        let send_kind =
            SendTransactionsKind::<Ethereum>::Raw { eth_wallets, browser: None, access_keys };

        let tx = TransactionRequest { from: Some(root_address), ..Default::default() };
        let sender = send_kind.for_sender(1, &root_address, tx).unwrap();

        match sender {
            SendTransactionKind::Raw(_, wallet) => {
                assert_eq!(wallet.default_signer().address(), root_address);
            }
            _ => panic!("expected root wallet signer for non-session chain"),
        }
    }

    #[test]
    fn recovered_signed_payload_does_not_require_a_signer() {
        let dir = tempfile::tempdir().unwrap();
        let mut sequence = ScriptSequence::<Ethereum> {
            chain: 1,
            transactions: [planned_tx(SIGNED_TX)].into(),
            ..Default::default()
        };
        sequence.paths = Some((dir.path().join("broadcast.json"), dir.path().join("cache.json")));
        let mut sequence = ScriptSequenceKind::new_single(sequence, false, None).unwrap();
        let payload = Bytes::from_static(SIGNED_TX);
        sequence.persist_signed_payload(0, 0, payload, true).unwrap();

        assert!(remaining_unsigned_transactions_for_recovery(&sequence).is_empty());
    }

    #[test]
    fn recovered_batch_attempt_does_not_require_a_signer() {
        let dir = tempfile::tempdir().unwrap();
        let sender = Address::repeat_byte(0x22);
        let mut deployment = ScriptSequence::<Ethereum> {
            chain: 1,
            transactions: [script_tx(sender)].into(),
            ..Default::default()
        };
        deployment.paths = Some((dir.path().join("broadcast.json"), dir.path().join("cache.json")));
        let mut sequence = ScriptSequenceKind::new_single(deployment, true, None).unwrap();
        sequence.persist_batch_delegated_request(0, 0, Default::default()).unwrap();

        assert!(remaining_unsigned_transactions_for_recovery(&sequence).is_empty());
    }

    #[test]
    fn batch_retry_clears_the_shared_delegated_attempt() {
        let dir = tempfile::tempdir().unwrap();
        let recovery_path = dir.path().join("cache.json.recovery.json");
        let mut deployment = ScriptSequence::<Ethereum> {
            chain: 1,
            transactions: [script_tx(Address::ZERO), script_tx(Address::ZERO)].into(),
            ..Default::default()
        };
        deployment.paths = Some((dir.path().join("broadcast.json"), dir.path().join("cache.json")));
        let mut sequence = ScriptSequenceKind::new_single(deployment, true, None).unwrap();
        sequence.persist_batch_delegated_request(0, 0, Default::default()).unwrap();
        let (_, attempt, _) = sequence.batch_attempt(0).unwrap();

        sequence.restore_delegated_pending(Some(attempt), None, true).unwrap();

        assert!(sequence.batch_attempt(0).is_none());
        drop(sequence);
        let recovery: serde_json::Value =
            foundry_common::fs::read_json_file(&recovery_path).unwrap();
        assert_eq!(recovery["deployments"][0]["operations"].as_array().unwrap().len(), 2);
        assert!(recovery["deployments"][0].get("attempts").is_none());
    }

    #[test]
    fn recovered_sender_still_requires_sequential_ordering() {
        let dir = tempfile::tempdir().unwrap();
        let unsigned = Address::repeat_byte(0x22);
        let mut sequence = ScriptSequence::<Ethereum> {
            chain: 1,
            transactions: [planned_tx(SIGNED_TX), script_tx(unsigned)].into(),
            ..Default::default()
        };
        sequence.paths = Some((dir.path().join("broadcast.json"), dir.path().join("cache.json")));
        let mut sequence = ScriptSequenceKind::new_single(sequence, false, None).unwrap();
        sequence.persist_signed_payload(0, 0, Bytes::from_static(SIGNED_TX), true).unwrap();

        let required = remaining_unsigned_transactions_for_recovery(&sequence);
        assert_eq!(required.iter().map(|tx| tx.sender).collect::<Vec<_>>(), [unsigned]);
        assert_eq!(remaining_sender_addresses(&sequence).len(), 2);
    }

    #[test]
    fn signed_only_sequences_remain_sequential() {
        assert!(should_broadcast_sequentially(false, false, 0, 1, true));
        assert!(!should_broadcast_sequentially(false, false, 1, 1, true));
    }

    #[test]
    fn browser_rejections_are_definite_non_submissions() {
        let rejected =
            eyre::Report::new(alloy_signer::Error::other(BrowserWalletError::Rejected {
                operation: "Transaction",
                reason: "Rejected by user".to_string(),
            }));
        assert!(is_definite_browser_non_submission(&rejected));
        let send_error = eyre::Report::new(alloy_signer::Error::other(
            BrowserWalletError::ServerError("replacement transaction underpriced".to_string()),
        ));
        assert!(!is_definite_browser_non_submission(&send_error));
        let not_connected =
            eyre::Report::new(alloy_signer::Error::other(BrowserWalletError::NotConnected));
        assert!(is_definite_browser_non_submission(&not_connected));
        let timeout = eyre::Report::new(alloy_signer::Error::other(BrowserWalletError::Timeout {
            operation: "Transaction",
        }));
        assert!(!is_definite_browser_non_submission(&timeout));
    }

    #[test]
    fn only_anvil_no_signer_errors_are_definite_non_submissions() {
        assert!(is_unlocked_non_submission(-32602, "No Signer available"));
        assert!(!is_unlocked_non_submission(-32603, "No Signer available"));
        assert!(!is_unlocked_non_submission(-32602, "transaction rejected"));
    }

    #[test]
    fn recovered_completion_is_matched_by_hash() {
        let dir = tempfile::tempdir().unwrap();
        let mut deployment = ScriptSequence::<Ethereum> {
            chain: 1,
            transactions: [planned_tx(SIGNED_TX), planned_tx(OTHER_SIGNED_TX)].into(),
            ..Default::default()
        };
        deployment.paths = Some((dir.path().join("broadcast.json"), dir.path().join("cache.json")));
        let mut sequence = ScriptSequenceKind::new_single(deployment, false, None).unwrap();
        sequence.persist_signed_payload(0, 0, Bytes::from_static(SIGNED_TX), true).unwrap();
        let second_hash = sequence
            .persist_signed_payload(0, 1, Bytes::from_static(OTHER_SIGNED_TX), true)
            .unwrap();
        let mut second_receipt = receipt();
        second_receipt.transaction_hash = second_hash;
        sequence.sequences_mut()[0].receipts.push(second_receipt);

        assert_eq!(remaining_operation_indices(&sequence, 0), [0]);
    }

    #[test]
    fn externally_signed_completion_uses_the_persisted_hash() {
        let dir = tempfile::tempdir().unwrap();
        let sender = Address::repeat_byte(0x11);
        let mut deployment = ScriptSequence::<Ethereum> {
            chain: 1,
            transactions: [script_tx(sender), script_tx(sender)].into(),
            receipts: vec![receipt()],
            ..Default::default()
        };
        deployment.transactions[1].hash = Some(deployment.receipts[0].transaction_hash());
        deployment.paths = Some((dir.path().join("broadcast.json"), dir.path().join("cache.json")));
        let sequence = ScriptSequenceKind::new_single(deployment, false, None).unwrap();

        assert_eq!(remaining_operation_indices(&sequence, 0), [0]);
    }

    #[test]
    fn duplicate_receipts_do_not_complete_an_unsigned_operation() {
        let dir = tempfile::tempdir().unwrap();
        let mut deployment = ScriptSequence::<Ethereum> {
            chain: 1,
            transactions: [planned_tx(SIGNED_TX), planned_tx(OTHER_SIGNED_TX)].into(),
            ..Default::default()
        };
        deployment.paths = Some((dir.path().join("broadcast.json"), dir.path().join("cache.json")));
        let mut sequence = ScriptSequenceKind::new_single(deployment, false, None).unwrap();
        let first_hash =
            sequence.persist_signed_payload(0, 0, Bytes::from_static(SIGNED_TX), true).unwrap();
        let mut first_receipt = receipt();
        first_receipt.transaction_hash = first_hash;
        sequence.sequences_mut()[0].receipts = vec![first_receipt.clone(), first_receipt];

        assert_eq!(remaining_operation_indices(&sequence, 0), [1]);
    }

    #[test]
    fn completed_prefix_rejects_receipt_holes() {
        let hash = B256::repeat_byte(0x44);
        let mut later = script_tx(Address::ZERO);
        later.hash = Some(hash);
        let mut receipt = receipt();
        receipt.transaction_hash = hash;
        let sequence = ScriptSequence::<Ethereum> {
            transactions: [script_tx(Address::ZERO), later].into(),
            receipts: vec![receipt],
            ..Default::default()
        };

        assert!(completed_transaction_prefix(&sequence).is_err());
    }

    #[tokio::test]
    async fn access_key_sets_key_id_before_estimation() {
        let root_address = Address::repeat_byte(0x11);
        let access_key =
            foundry_wallets::utils::create_local_signer(ACCESS_KEY_PRIVATE_KEY).unwrap();
        let access_key_address = access_key.address();
        let access_key_wallet =
            TempoAccountsWallet::from_secp256k1(root_address, access_key, None).with_chain_id(4217);
        // An explicit fee token keeps preparation from querying the unreachable endpoint.
        let mut sender = SendTransactionKind::<TempoNetwork>::AccessKey(
            TempoTransactionRequest {
                inner: TransactionRequest { from: Some(root_address), ..Default::default() },
                fee_token: Some(PATH_USD_ADDRESS),
                ..Default::default()
            },
            Box::new(access_key_wallet),
        );
        let provider =
            RootProvider::<TempoNetwork>::new_http("http://localhost:8545".parse().unwrap());

        sender.prepare(&provider, false, true, false, 100, None).await.unwrap();

        match sender {
            SendTransactionKind::AccessKey(tx, _) => {
                assert_eq!(tx.key_id, Some(access_key_address));
            }
            _ => panic!("expected access key transaction"),
        }
    }

    #[test]
    fn tempo_aa_create_moves_deployment_into_calls() {
        let mut tx = TempoTransactionRequest {
            inner: TransactionRequest { to: Some(TxKind::Create), ..Default::default() },
            fee_token: Some(address!("0x20c0000000000000000000000000000000000000")),
            ..Default::default()
        };

        convert_tempo_aa_create::<TempoNetwork>(&mut tx);

        assert!(tx.inner.to.is_none());
        assert_eq!(tx.calls.len(), 1);
        assert!(tx.calls[0].to.is_create());
    }

    #[tokio::test]
    async fn signed_tempo_batch_is_bound_to_its_calls() {
        let signer = foundry_wallets::utils::create_private_key_signer(ROOT_PRIVATE_KEY).unwrap();
        let sender = signer.address();
        let wallet = EthereumWallet::new(signer);
        let calls = vec![Call {
            to: TxKind::Call(Address::repeat_byte(0x11)),
            value: U256::ONE,
            input: Bytes::new(),
        }];
        let request = TempoTransactionRequest {
            inner: TransactionRequest {
                from: Some(sender),
                nonce: Some(0),
                chain_id: Some(4217),
                gas: Some(21_000),
                max_fee_per_gas: Some(1),
                max_priority_fee_per_gas: Some(1),
                ..Default::default()
            },
            calls: calls.clone(),
            ..Default::default()
        };
        let payload = request.clone().build(&wallet).await.unwrap().encoded_2718();

        assert!(validate_tempo_batch_payload(&request, &payload, sender, 4217, &calls).is_ok());
        let other_calls =
            vec![Call { to: TxKind::Call(Address::repeat_byte(0x22)), ..calls[0].clone() }];
        assert!(
            validate_tempo_batch_payload(&request, &payload, sender, 4217, &other_calls).is_err()
        );

        let other_signer =
            foundry_wallets::utils::create_private_key_signer(ACCESS_KEY_PRIVATE_KEY).unwrap();
        let mut other_request = request.clone();
        other_request.inner.from = Some(other_signer.address());
        let other_payload =
            other_request.build(&EthereumWallet::new(other_signer)).await.unwrap().encoded_2718();
        assert!(
            validate_tempo_batch_payload(&request, &other_payload, sender, 4217, &calls).is_err()
        );
        let other_envelope = TempoTxEnvelope::decode_2718_exact(&other_payload).unwrap();
        assert!(validate_tempo_batch_envelope(&other_envelope, sender, 4217, &calls).is_err());
    }

    #[test]
    fn tempo_access_key_create_is_rejected_before_preparation() {
        let tx = TempoTransactionRequest {
            inner: TransactionRequest { to: Some(TxKind::Create), ..Default::default() },
            ..Default::default()
        };

        let error = reject_access_key_create::<TempoNetwork>(&tx, true).unwrap_err();

        assert!(error.to_string().contains("Tempo access-key transactions cannot use CREATE"));
    }

    #[test]
    fn expiring_nonce_create_preflight_tracks_chain_and_sender_across_sequences() {
        let sender = Address::with_last_byte(1);
        let transaction = |sender, to| {
            TransactionWithMetadata::from_tx_request(TransactionMaybeSigned::<TempoNetwork>::new(
                TempoTransactionRequest {
                    inner: TransactionRequest { from: Some(sender), to, ..Default::default() },
                    ..Default::default()
                },
            ))
        };
        let mut sequences = [
            ScriptSequence {
                chain: 4217,
                transactions: [transaction(sender, Some(TxKind::Call(Address::with_last_byte(2))))]
                    .into(),
                ..Default::default()
            },
            ScriptSequence {
                chain: 4218,
                transactions: [transaction(sender, None)].into(),
                ..Default::default()
            },
            ScriptSequence {
                chain: 4217,
                transactions: [transaction(sender, None)].into(),
                ..Default::default()
            },
        ];
        assert_eq!(
            reject_expiring_call_before_create(&sequences).unwrap_err().to_string(),
            "Tempo expiring nonce scripts cannot use CREATE after a CALL from the same sender on the same chain; use CREATE2 or disable --tempo.expiring-nonce"
        );
        sequences[2].chain = 4219;
        reject_expiring_call_before_create(&sequences).unwrap();
        sequences[2].chain = 4217;
        sequences[2].transactions[0] = transaction(Address::with_last_byte(3), None);
        reject_expiring_call_before_create(&sequences).unwrap();
        sequences[2].transactions[0] =
            transaction(sender, Some(TxKind::Call(Address::with_last_byte(2))));
        reject_expiring_call_before_create(&sequences).unwrap();

        let mut ethereum = ScriptSequence::<Ethereum> {
            chain: 1,
            transactions: [script_tx(sender), script_tx(sender)].into(),
            ..Default::default()
        };
        ethereum.transactions[0]
            .tx_mut()
            .as_unsigned_mut()
            .unwrap()
            .set_to(Address::with_last_byte(2));
        reject_expiring_call_before_create(&[ethereum]).unwrap();
    }

    #[test]
    fn fee_totals_do_not_overflow_u64() {
        let gwei = 1_000_000_000;
        let receipts = [(30_000_000, 1_000 * gwei), (30_000_000, 2_000 * gwei)];

        assert_eq!(
            fee_totals(receipts),
            (60_000_000, Some(1_500 * gwei), 90_000_000_000_000_000_000)
        );
    }

    #[tokio::test]
    async fn batch_receipt_watcher_rejects_foreign_or_incomplete_receipts() {
        let hash = B256::repeat_byte(0x42);
        let receipt = |field: &str, value: serde_json::Value| {
            let mut receipt = serde_json::json!({
                "type": "0x02", "status": "0x1", "cumulativeGasUsed": "0x5208", "logs": [],
                "transactionHash": hash, "logsBloom": format!("{:#x}", Bloom::ZERO),
                "transactionIndex": "0x0", "blockHash": B256::ZERO, "blockNumber": "0x10",
                "gasUsed": "0x5208", "effectiveGasPrice": "0x1",
                "from": Address::ZERO, "to": Address::ZERO, "contractAddress": null
            });
            receipt[field] = value;
            receipt
        };
        // Bad receipts fall through to the transaction lookup; valid ones to the block number.
        let wait = async |receipt: serde_json::Value, next: serde_json::Value| {
            let asserter = Asserter::new();
            let provider: RootProvider<Ethereum> =
                alloy_provider::ProviderBuilder::default().connect_mocked_client(asserter.clone());
            asserter.push_success(&receipt);
            asserter.push_success(&next);
            wait_for_batch_receipt(&provider, hash, 1).await.unwrap()
        };

        for (field, value) in [
            ("transactionHash", serde_json::json!(B256::repeat_byte(0x99))),
            ("blockHash", serde_json::Value::Null),
            ("transactionIndex", serde_json::Value::Null),
            ("blockNumber", serde_json::Value::Null),
        ] {
            let result = wait(receipt(field, value), serde_json::Value::Null).await;
            assert!(result.is_none(), "accepted receipt with bad {field}");
        }
        let accepted =
            wait(receipt("status", serde_json::json!("0x1")), serde_json::json!("0x10")).await;
        let accepted = accepted.unwrap();
        assert_eq!(accepted.transaction_hash(), hash);
    }

    fn script_tx(from: Address) -> TransactionWithMetadata<Ethereum> {
        TransactionWithMetadata::from_tx_request(TransactionMaybeSigned::new(TransactionRequest {
            from: Some(from),
            ..Default::default()
        }))
    }

    fn planned_tx(payload: &[u8]) -> TransactionWithMetadata<Ethereum> {
        let envelope = TxEnvelope::decode_2718_exact(payload).unwrap();
        let from = envelope.recover_signer().unwrap();
        let mut request: TransactionRequest = envelope.into();
        request.from = Some(from);
        TransactionWithMetadata::from_tx_request(TransactionMaybeSigned::new(request))
    }

    fn receipt() -> TransactionReceipt {
        TransactionReceipt {
            inner: ReceiptEnvelope::Legacy(ReceiptWithBloom {
                receipt: Receipt {
                    status: Eip658Value::success(),
                    cumulative_gas_used: 0,
                    logs: vec![],
                },
                logs_bloom: Bloom::ZERO,
            }),
            transaction_hash: Default::default(),
            transaction_index: None,
            block_hash: None,
            block_number: None,
            gas_used: 0,
            effective_gas_price: 0,
            blob_gas_used: None,
            blob_gas_price: None,
            from: Address::ZERO,
            to: None,
            contract_address: None,
        }
    }

    #[tokio::test]
    async fn expiring_create_checks_planned_nonce_including_durable_payloads() {
        let request = TempoTransactionRequest {
            inner: TransactionRequest {
                from: Some(Address::with_last_byte(1)),
                to: Some(TxKind::Create),
                nonce: Some(7),
                chain_id: Some(4217),
                gas: Some(100_000),
                max_fee_per_gas: Some(10),
                max_priority_fee_per_gas: Some(1),
                ..Default::default()
            },
            nonce_key: Some(TEMPO_EXPIRING_NONCE_KEY),
            valid_before: NonZeroU64::new(100),
            ..Default::default()
        };
        let planned = TransactionWithMetadata::from_tx_request(TransactionMaybeSigned::<
            TempoNetwork,
        >::new(request.clone()));
        let mut request = request;
        // The discriminator differs from the planned protocol nonce.
        request.inner.nonce = Some(0);
        let envelope = TempoTxEnvelope::AA(
            request
                .clone()
                .build_aa()
                .unwrap()
                .into_signed(tempo_primitives::TempoSignature::default()),
        );
        let kinds = [
            SendTransactionKind::Unlocked(request.clone()),
            SendTransactionKind::Signed(envelope.clone()),
            SendTransactionKind::PreparedRaw(
                Bytes::from(envelope.encoded_2718()),
                envelope.trie_hash(),
            ),
        ];
        let sender = request.inner.from.unwrap();
        let mut signed_plan =
            TransactionWithMetadata::from_tx_request(TransactionMaybeSigned::Signed {
                tx: envelope,
                from: sender,
            });
        signed_plan.contract_address = Some(sender.create(7));
        for kind in kinds {
            for planned in [&planned, &signed_plan] {
                for actual in [6, 7, 8] {
                    let asserter = Asserter::new();
                    let provider = alloy_provider::ProviderBuilder::<_, _, TempoNetwork>::default()
                        .connect_mocked_client(asserter.clone());
                    asserter.push_success(&format!("{actual:#x}"));
                    let result = kind.validate_expiring_create_nonce(&provider, planned).await;
                    if actual == 7 {
                        result.unwrap();
                    } else {
                        let expected = format!(
                            "CREATE address changed unexpectedly while sending transactions. Expected {} got {} from provider nonce.",
                            sender.create(7),
                            sender.create(actual)
                        );
                        assert_eq!(result.unwrap_err().to_string(), expected);
                    }
                }
            }
        }
        // Expiring CALLs have no protocol nonce to synchronize.
        request.inner.to = Some(TxKind::Call(Address::with_last_byte(2)));
        let provider = alloy_provider::ProviderBuilder::<_, _, TempoNetwork>::default()
            .connect_mocked_client(Asserter::new());
        SendTransactionKind::Unlocked(request.clone())
            .validate_expiring_create_nonce(
                &provider,
                &TransactionWithMetadata::from_tx_request(TransactionMaybeSigned::new(request)),
            )
            .await
            .unwrap();
    }

    #[tokio::test]
    async fn preparation_preserves_signed_payload_without_rpc() {
        let envelope = TxEnvelope::decode_2718_exact(SIGNED_TX).unwrap();
        let hash = envelope.trie_hash();
        let provider = alloy_provider::ProviderBuilder::new()
            .disable_recommended_fillers()
            .connect_mocked_client(Asserter::new());
        for input in [
            SendTransactionKind::<Ethereum>::Signed(envelope),
            SendTransactionKind::PreparedRaw(Bytes::from_static(SIGNED_TX), hash),
        ] {
            let prepared = input
                .prepare_for_durable_send(&provider, true, false, true, 130, None)
                .await
                .unwrap();
            let PreparedTransaction::Raw(payload, prepared_hash) = prepared else {
                panic!("signed transactions must become fixed raw submissions");
            };
            assert_eq!(payload.as_ref(), SIGNED_TX);
            assert_eq!(prepared_hash, hash);
        }
    }
}