Keep transfer write capabilities durable

[sidhujag]

Summary

• retain each active transfer write capability in page memory instead of silently rotating it when local storage becomes unavailable
• refresh an HttpOnly, SameSite=Strict backup cookie scoped to that transfer API path after every authorized write
• accept the original cookie capability when a regenerated bearer is invalid, while preserving the existing hashed server-side authorization boundary
• reuse the same recovery transport for sponsored UTXO requests and surface the actual API error

Evidence

The three supplied UTXO-side transfers successfully persisted their initial and burn updates, then all failed their later confirmation PATCH about 57 minutes later with 401. There was no deployment during that interval. Public GET remains intentionally unauthenticated and is not evidence of write access.

Verification

• yarn lint
• yarn test --runInBand (36 suites, 182 tests)
• yarn build

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
bridge-testnet	Ready	Preview	Aug 17, 2026 8:32pm
syscoin-bridge	Ready	Preview	Aug 17, 2026 8:32pm