keychat-save 1.4.1 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keychat-save",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "Save sessions, files and whole git repositories to the BSV blockchain via KeyChat",
   "type": "module",
   "bin": {

package/repo.mjs

@@ -286,6 +286,39 @@ function addP2PKHInput (tx, k, lockingScript, utxo) {
 const INPUT_BYTES = 148 // 36 outpoint + 1 len + ~107 script + 4 sequence
 const OUTPUT_P2PKH_BYTES = 34
 
+// Every KeyChat tx leaves a 3-sat output at the sender's own address, so a wallet
+// rebuilds its history by scanning its own dust rather than trusting a server's
+// watch list. RepoChain was the worst offender: the funding path built a payload
+// tx whose ONLY output was the 0-sat OP_RETURN — verified on chain, b8f8b337 has
+// exactly one output — so every full snapshot and every large delta was invisible
+// to output-keyed indexing. That is the same defect that hid 301 of this wallet's
+// transactions, sitting in the tool that writes our backups.
+const SELF_MARKER_SATS = 3
+
+const varIntSize = n => n < 0xfd ? 1 : n <= 0xffff ? 3 : n <= 0xffffffff ? 5 : 9
+
+// An output is 8 satoshi bytes + the script's length prefix + the script. That prefix
+// is 3 bytes past 252 and 5 past 65,535; this was estimated at a flat 9 (i.e. a 1-byte
+// prefix), so EVERY repo tx was sized 2-4 bytes short of what it actually serialises to.
+const outputBytes = scriptLen => 8 + varIntSize(scriptLen) + scriptLen
+
+// The charge is always rounded up to the 0.25-Compute sub-unit — that is deliberate and
+// unchanged. What matters is that the ROUNDING INPUT be the real byte count: when the
+// estimate ran short and the raw fee happened to land just above a 125-sat boundary, the
+// round-up added ~nothing and the tx went out below 100 sats/KB. Under that floor a tx is
+// accepted, given a txid, never mined, and gone hours later (pt31 killed saves pt27/pt28;
+// RepoChain link 7294a683 died the same way and took the keychat-save chain with it).
+function assertFeeRate (tx, fee, label) {
+  const bytes = tx.toHex().length / 2
+  const rate = fee / (bytes / 1000)
+  if (rate < FEE_PER_KB) {
+    throw new Error(`${label} fee too low: ${fee} sats for ${bytes} bytes = ` +
+      `${rate.toFixed(2)} sats/KB, floor is ${FEE_PER_KB}. Refusing to broadcast — ` +
+      `under the floor a tx is accepted, never mined, and silently lost.`)
+  }
+  return { bytes, rate }
+}
+
 /**
  * Consolidate small Compute UTXOs into one output worth exactly `target` sats.
  * Its own miner fee grows with each input added, so the pick converges rather
@@ -295,7 +328,7 @@ function planFunding (utxos, target) {
   let n = 0
   let sum = 0
   for (;;) {
-    const bytes = 10 + n * INPUT_BYTES + OUTPUT_P2PKH_BYTES * 2
+    const bytes = 10 + varIntSize(n) - 1 + n * INPUT_BYTES + OUTPUT_P2PKH_BYTES * 2
     const need = target + roundToSubUnit(feeFor(bytes))
     if (sum >= need && n > 0) return { picked: utxos.slice(0, n), sum, need }
     if (n >= utxos.length) {
@@ -327,7 +360,13 @@ async function publish (scriptHex, k, address, lockingScript, { dry = false } =
   let sum = 0
   let fee = 0
   while (n < DIRECT_MAX_INPUTS) {
-    fee = roundToSubUnit(feeFor(10 + n * INPUT_BYTES + 9 + scriptBytes + OUTPUT_P2PKH_BYTES))
+    // Two P2PKH outputs: change and the self-marker. `spend` is everything that
+    // leaves as fee-or-marker; the marker's 3 sats are INSIDE the 125-sat
+    // round-up, not added on top of it — adding on top would leave change at
+    // -3 mod 125, which is not a Compute denomination and so unspendable.
+    // Miner still clears the rate: round-up >= feeFor + 3, so spend - 3 >= feeFor.
+    fee = roundToSubUnit(feeFor(10 + varIntSize(n) - 1 + n * INPUT_BYTES +
+      outputBytes(scriptBytes) + OUTPUT_P2PKH_BYTES * 2) + SELF_MARKER_SATS)
     if (sum >= fee && n > 0) break
     if (n >= utxos.length) throw new Error('insufficient Compute')
     sum += utxos[n].satoshis
@@ -335,13 +374,34 @@ async function publish (scriptHex, k, address, lockingScript, { dry = false } =
   }
 
   if (sum >= fee && n > 0 && n < DIRECT_MAX_INPUTS) {
-    const tx = new Transaction()
-    for (const u of utxos.slice(0, n)) addP2PKHInput(tx, k, lockingScript, u)
-    tx.addOutput({ lockingScript: opReturn, satoshis: 0 })
-    if (sum - fee > 0) tx.addOutput({ lockingScript, satoshis: sum - fee })
-    await tx.sign()
-    console.log(`payload tx    ${(tx.toHex().length / 2 / 1024).toFixed(1)} KB, ${n} inputs, ` +
-      `fee ${fee} sats = ${fee / SATS_PER_COMPUTE} Compute (single tx)`)
+    const build = async () => {
+      const t = new Transaction()
+      for (const u of utxos.slice(0, n)) addP2PKHInput(t, k, lockingScript, u)
+      t.addOutput({ lockingScript: opReturn, satoshis: 0 })
+      // SELF-MARKER, UNCONDITIONAL — the change output below is conditional and
+      // a snapshot that lands exactly would otherwise leave nothing at our address.
+      t.addOutput({ lockingScript, satoshis: SELF_MARKER_SATS })
+      if (sum - fee > 0) t.addOutput({ lockingScript, satoshis: sum - fee })
+      await t.sign()
+      return t
+    }
+    // Price off the SIGNED bytes, not the estimate, then round up to 0.25 Compute as
+    // usual. Converges in one pass in practice; the loop is there because raising the
+    // fee shrinks change, which can drop the change output and change the size again.
+    let tx = await build()
+    for (let i = 0; i < 4; i++) {
+      const want = roundToSubUnit(feeFor(tx.toHex().length / 2) + SELF_MARKER_SATS)
+      if (want <= fee) break
+      while (sum < want && n < utxos.length && n < DIRECT_MAX_INPUTS) sum += utxos[n++].satoshis
+      if (sum < want) throw new Error(`insufficient Compute for corrected fee ${want} sats`)
+      fee = want
+      tx = await build()
+    }
+    // The marker is an OUTPUT, not fee — the miner receives fee minus the marker,
+    // and that is the number the floor must be checked against.
+    const { bytes, rate } = assertFeeRate(tx, fee - SELF_MARKER_SATS, 'payload tx')
+    console.log(`payload tx    ${(bytes / 1024).toFixed(1)} KB, ${n} inputs, ` +
+      `fee ${fee} sats = ${fee / SATS_PER_COMPUTE} Compute (single tx, ${rate.toFixed(2)} sats/KB)`)
     if (dry) return { txid: tx.id('hex'), funding: null, cost: fee / SATS_PER_COMPUTE, dry: true }
     process.stdout.write('broadcasting ... ')
     const txid = await broadcast(tx.toHex())
@@ -358,11 +418,20 @@ async function publish (scriptHex, k, address, lockingScript, { dry = false } =
   // bought nothing and it ate two repo snapshots anyway. What actually protects this output
   // is the splitter being deposits-only (src/messages/split.js) — it reads the parent tx,
   // sees we signed it, and leaves our change alone.
-  const payloadFee = roundToSubUnit(feeFor(10 + INPUT_BYTES + 9 + scriptBytes))
-  const fundingValue = payloadFee
+  // The payload tx is single-input with no change, so its fee IS this funding output —
+  // it cannot be topped up after the fact without rebuilding both txs. So the estimate
+  // has to be right the first time: real output framing, and the input sized at its
+  // maximum (a low-S DER signature caps the unlocking script at 107 bytes).
+  const payloadBytes = 10 + INPUT_BYTES + outputBytes(scriptBytes) + OUTPUT_P2PKH_BYTES
+  const payloadFee = roundToSubUnit(feeFor(payloadBytes))
+  // The funding output is the payload tx's ENTIRE input, so it must cover the
+  // miner fee AND the self-marker. Without the marker the payload tx had exactly
+  // one output — a 0-sat OP_RETURN — and nothing at our address, which made every
+  // large snapshot invisible to output-keyed indexing.
+  const fundingValue = payloadFee + SELF_MARKER_SATS
   const { picked, sum: fsum, need } = planFunding(utxos, fundingValue)
   const fundFee = need - fundingValue
-  console.log(`payload tx    ${((10 + INPUT_BYTES + 9 + scriptBytes) / 1048576).toFixed(2)} MB, ` +
+  console.log(`payload tx    ${(payloadBytes / 1048576).toFixed(2)} MB, ` +
     `fee ${payloadFee} sats = ${payloadFee / SATS_PER_COMPUTE} Compute`)
   console.log(`funding tx    ${picked.length} inputs, fee ${fundFee} sats`)
   console.log(`total cost    ${(fundingValue + fundFee) / SATS_PER_COMPUTE} Compute\n`)
@@ -381,11 +450,19 @@ async function publish (scriptHex, k, address, lockingScript, { dry = false } =
   const payTx = new Transaction()
   addP2PKHInput(payTx, k, lockingScript, { txid: fundTx.id('hex'), vout: 0, satoshis: fundingValue })
   payTx.addOutput({ lockingScript: opReturn, satoshis: 0 })
+  payTx.addOutput({ lockingScript, satoshis: SELF_MARKER_SATS })
   process.stdout.write('signing payload tx ... ')
   t = Date.now()
   await payTx.sign()
   console.log(`${((Date.now() - t) / 1000).toFixed(1)}s`)
 
+  // Both must clear the floor BEFORE either goes out. Broadcasting the funding tx and
+  // then discovering the payload is underpaid strands the fee in a spent output.
+  assertFeeRate(fundTx, fundFee, 'funding tx')
+  // Miner receives the funding value MINUS the marker — check the floor against
+  // what the miner actually gets, not against what the tx consumes.
+  assertFeeRate(payTx, fundingValue - SELF_MARKER_SATS, 'payload tx')
+
   if (dry) {
     return { txid: payTx.id('hex'), funding: fundTx.id('hex'), cost: (fundingValue + fundFee) / SATS_PER_COMPUTE, dry: true }
   }
@@ -414,7 +491,7 @@ function measure (repoPath) {
   // ECIES adds an ephemeral pubkey, IV, PKCS#7 padding and an HMAC.
   const cipherBytes = tar.length + 200
   const scriptBytes = cipherBytes + 60
-  const repoTxBytes = 10 + INPUT_BYTES + 9 + scriptBytes
+  const repoTxBytes = 10 + INPUT_BYTES + outputBytes(scriptBytes)
   const repoFee = roundToSubUnit(feeFor(repoTxBytes))
   return { name, abs, tar, repoTxBytes, repoFee }
 }