rust-lightning

Add newline to fuzz log statements

This regressed at some point, making the logs harder to parse on a
failed test run.

Time out incomplete MPP payments in chanmon_consistency

This requires calling `timer_tick_occurred`. As a result, when
`timer_tick_occurred` is called, disabled/enabled updates and
`WarnAndDisconnect` events may be triggered.

Consider probe events for stuck payments check in chanmon_consistency

Even though we don't explicitly send probes, because probes are detected
based on hashing the payment hash+preimage, it's rather trivial for the
fuzzer to build payments that accidentally end up looking like probes.

Use channel_id over short_channel_id for payments in chanmon_consistency

The `short_channel_id` is no longer guaranteed to be stable with
splicing now that the fuzzer can actually lock splices.

Drive splices to completion in chanmon_consistency

This commit adds support for locking splices. This required confirming
transactions, which this target previously didn't consider.

It also fixes a `serial_id` collision, due to its generation using
the first 4 bytes of `get_secure_random_bytes`, that was preventing
splices from negotiating up to the `tx_signatures` exchange.

Support async signing in chanmon_consistency

This commit adds new opcodes to enable/disable signer operations one by
one. Note that this only covers signer operations post-funding.

Split CI test script into parallel jobs

Split the monolithic ci-tests.sh into six focused scripts that run as
separate parallel jobs via a reusable workflow (ci-build.yml):

- ci-tests-workspace.sh: workspace checks, tests, docs, and downstream compat
- ci-tests-features.sh: crate feature/flag combinations (dnssec, tokio, backtrace, test vectors, serde)
- ci-tests-bindings.sh: c_bindings builds and tests
- ci-tests-nostd.sh: no_std builds and compatibility checks
- ci-tests-cfg-flags.sh: experimental gated cfg flags (taproot, simple_close, lsps1_service, peer_storage)
- ci-tests-sync.sh: block sync and transaction sync clients

Shared setup (MSRV pins, backtrace) is extracted into ci-tests-common.sh.
The ci-tests.sh script now delegates to the sub-scripts for local use.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Allow intercepting HTLCs based on the source channel

It may be useful in some situations to select HTLCs for
interception based on the source channel in addition to the sink.
Here we add the ability to do so by adding new flags to
`HTLCInterceptionFlags`.

Pass constructed `PendingAddHTLCInfo` to chanman `forward_htlcs`

We jump through some hoops in order to pass a small list of objects
to `forward_htlcs` on a per-channel basis rather than per-HTLC.
Then, `forward_htlcs` builds a `PendingAddHTLCInfo` for each HTLC
for insertion. Worse, in some `forward_htlcs` callsites we're
actually starting with a `PendingAddHTLCInfo`, converting it to a
tuple, then back inside `forward_htlcs`.

Instead, here we just pass a list of built `PendingAddHTLCInfo`s to
`forward_htlcs`, cleaning up a good bit of code and even avoiding
an allocation of the HTLCs vec in many cases.

Make FundingContribution::net_value() infallible

Split FundingContribution::net_value() (which returned
Result<SignedAmount, String>) into a separate validate() method and an
infallible net_value() that returns SignedAmount directly. The validate()
method checks prevtx sizes and input sufficiency, while net_value()
computes the net contribution amount.

To make net_value() safe to call without error handling, add MAX_MONEY
bounds checks in the build_funding_contribution! macro before coin
selection. This ensures FundingContribution is valid by construction:
value_added and the sum of outputs are each bounded by MAX_MONEY
(~2.1e15 sat), so the worst-case net_value() computation (-2 * MAX_MONEY
~= -4.2e15) is well within i64 range (~-9.2e18).

Update callers in channel.rs to use the new separate methods, simplifying
error handling at call sites where net_value() previously required
unwrapping a Result.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Free holding cell upon tx_signatures exchange

After cad88af, a few code paths that also lead to a quiescence exit were
not accounted for. This commit addresses the last remaining path where
we exit quiescence when we exchange `tx_signatures` with the
counterparty.

Free holding cell upon handling a counterparty tx_abort

After cad88af, a few code paths that also lead to a quiescence exit were
not accounted for. This commit addresses the path where we exit
quiescence due to processing a counterparty's `tx_abort` message.

Free holding cell upon handling an invalid interactive-tx message

After cad88af, a few code paths that also lead to a quiescence exit were
not accounted for. This commit addresses the path where we exit
quiescence due to a processing error on a counterparty's
`tx_add_input/output`, `tx_remove_input/output`, or `tx_complete`
message.

Remove PersistenceNotifierGuard from splice_channel

Now that ChannelManager::splice_channel only reads, there is no need to
notify listeners about event handling nor persistence.

Remove redundant is_initiator from FundingTemplate/FundingContribution

FundingTemplate is only ever created by the splice initiator, so
is_initiator is always true. The channel already knows who initiated
the splice from who won quiescence (is_holder_quiescence_initiator),
making the field on FundingTemplate and FundingContribution redundant.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove use of Deref with CoinSelectionSource

Instead of using Deref in APIs using CoinSelectionSource, implement
CoinSelectionSource for any Deref with a Target that implements
CoinSelectionSource.

Make ConfirmedUtxo the primary type

FundingTxInput was originally designed for channel funding but is now
used more broadly for coin selection and splicing. The name
ConfirmedUtxo better reflects its general-purpose nature as a confirmed
UTXO with previous transaction data. Make ConfirmedUtxo the real struct
in wallet_utils and alias FundingTxInput to it for backward
compatibility.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Move sync wallet utils to util::wallet_utils

Synchronous wallet utilities were coupled to bump_transaction::sync,
limiting their reusability for other features like channel funding and
splicing which need synchronous wallet operations. Consolidate all
wallet utilities in a single module for consistency and improved code
organization.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Move wallet utils to dedicated module

Wallet-related types were tightly coupled to bump_transaction, making
them less accessible for other use cases like channel funding and
splicing. Extract these utilities to a dedicated module for improved
code organization and reusability across the codebase.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Consistently log in propose_quiescence

Instead of logging both inside propose_quiescence and at the call site,
only log inside it. This simplifies the return type.

Use CoinSelection::change_output when splicing

Now that CoinSelection is used to fund a splice funding transaction, use
that for determining of a change output should be used. Previously, the
initiator could either provide a change script upfront or let LDK
generate one using SignerProvider::get_destination_script.

Since older versions may have serialized a SpliceInstruction without a
change script while waiting on quiescence, LDK must still generate a
change output in this case.

Split splice initiation into two phases

Previously, splice_channel required callers to manually construct
funding inputs and pass them directly, making coin selection the
caller's responsibility. This made the API difficult to use and
prevented reuse of the existing CoinSelectionSource trait.

Introduce a two-phase API: splice_channel now returns a FundingTemplate
that callers use to build a FundingContribution via wallet-backed
splice methods (e.g., splice_in_sync, splice_out_sync), which handle
coin selection automatically. The completed contribution is then passed
to a new funding_contributed method to begin quiescence and negotiation.

This also renames SpliceContribution to FundingContribution and moves
fee estimation and input validation into the funding module, co-located
with the types they operate on.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Run rustfmt on fuzz

Make ClaimId optional in coin selection

CoinSelectionSource is used for anchor bumping where a ClaimId is passed
in to avoid double spending other claims. To re-use this trait for
funding a splice, the ClaimId must be optional. And, if None, then any
locked UTXOs may be considered ineligible by an implementation.

Use FundingTxInput instead of Utxo in CoinSelection

In order to reuse CoinSelectionSource for splicing, the previous
transaction of each UTXO is needed. Update CoinSelection to use
FundingTxInput (renamed to ConfirmedUtxo) so that it is available.

This requires adding a method to WalletSource to look up a previous
transaction for a UTXO. Otherwise, Wallet's implementation of
CoinSelectionSource would need WalletSource to include the previous
transactions when listing confirmed UTXOs to select from. But this would
be inefficient since only some UTXOs are selected.