keychat-save 1.4.2 → 1.4.3

package/index.mjs

@@ -75,8 +75,8 @@ async function getUnspent (address) {
 // The bridge answers in its own shape when our node can serve the tx:
 //     { outputs: [ { satoshis, script, index } ] }
 // When it CANNOT — the node is pruned with no -txindex, so getrawtransaction fails for
-// any confirmed tx in a discarded block — the web proxy falls back to WhatsOnChain and
-// returns WoC's body untouched:
+// any confirmed tx in a discarded block — the bridge falls through to GorillaPool and
+// the body comes back in the other shape:
 //     { vout: [ { value, n, scriptPubKey: { hex } } ] }
 //
 // Callers looked only at `tx.outputs`, so on the WoC shape they iterated an empty array

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keychat-save",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Save sessions, files and whole git repositories to the BSV blockchain via KeyChat",
   "type": "module",
   "bin": {

package/repo.mjs

@@ -48,6 +48,14 @@ import { createHash } from 'node:crypto'
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
+import { installFileLedger } from './spent-ledger-fs.js'
+import { markSpentOutpoints, withoutSpent, pruneConfirmed, rebuildFromNode } from '../src/wallet/spent-ledger.js'
+
+// Share one spent-ledger with keychat-save and every other Node writer on this
+// machine. A repo snapshot and a session save draw from the SAME wallet; a
+// snapshot can spend many seconds building a multi-MB tx, and without this a
+// save started in that window picks the same inputs and dies as a double-spend.
+installFileLedger()
 
 const CONFIG_DIR = path.join(os.homedir(), '.keychat')
 const WIF_PATH = path.join(CONFIG_DIR, 'identity.wif')
@@ -75,14 +83,36 @@ function key () {
 }
 
 // ── bridge ───────────────────────────────────────────────────────
-async function getUnspent (address) {
+async function getUnspent (address, { skipLedger = false } = {}) {
   const res = await fetch(`${BRIDGE}/api/address/${address}/unspent`)
   if (!res.ok) throw new Error(`unspent ${res.status}`)
-  return (await res.json()).map(u => ({
+  const mapped = (await res.json()).map(u => ({
     txid: u.tx_hash || u.txid,
     vout: u.tx_pos ?? u.vout,
     satoshis: u.value ?? u.satoshis
   }))
+  if (skipLedger) return mapped
+  // The node says what exists; the ledger only subtracts coins another writer
+  // has already claimed. Prune each load so it stays the size of what is in
+  // flight rather than growing forever.
+  pruneConfirmed(mapped)
+  return withoutSpent(mapped)
+}
+
+/**
+ * A snapshot that never reached the network still holds its coins. Re-derive
+ * from a fresh node scan rather than un-marking by hand — the node is
+ * authoritative at this moment, and a hand-rolled release can be wrong in the
+ * direction that double-spends. Failure path only.
+ */
+async function releaseLedgerAfterFailure (address) {
+  try {
+    const fresh = await getUnspent(address, { skipLedger: true })
+    const r = rebuildFromNode(fresh)
+    console.warn(`  ledger rebuilt from node: ${r.released} released, ${r.dropped} dropped`)
+  } catch (err) {
+    console.warn(`  could not rebuild ledger: ${err.message}`)
+  }
 }
 
 async function broadcast (rawHex) {
@@ -103,24 +133,36 @@ async function broadcast (rawHex) {
 // 68 MB of hex in the live web server to satisfy a restore is not worth it. A query
 // string makes its isTxBody regex miss, so the request passes straight through.
 //
-// But that same regex miss also skips its WhatsOnChain fallback, which is the only
-// second source we have once a tx is mined. So fall back to the plain path on
-// failure — retrievability beats keeping the proxy cache tidy.
+// The plain path is still tried on failure — retrievability beats keeping the
+// proxy cache tidy. (It used to also carry the proxy's WhatsOnChain fallback;
+// that was removed 2026-08-28, so the third source below is now the only
+// second opinion once a tx is mined.)
 async function getRawHex (txid) {
   // Three sources, in order of sovereignty:
   //   1. bridge ?raw=1  — our node, bypassing the web proxy's forever-cache.
-  //   2. bridge plain   — same node, but with the proxy's WoC fallback behind it.
-  //   3. WoC direct     — last resort, and it earns its place: our node is PRUNED
-  //      with no -txindex, so getrawtransaction CANNOT return a confirmed tx at
-  //      all. Every mined snapshot is therefore unfetchable from us, and with
-  //      only the first two sources a rate-limited proxy made the whole delta
-  //      chain unreplayable — which breaks restore, not just new deltas.
-  // 429 gets a backoff rather than being treated as absence; hammering a closed
-  // limiter is what turned a transient failure into a hard one.
+  //   2. bridge plain   — same node; the bridge itself falls through to GP.
+  //   3. GorillaPool raw — last resort, and it earns its place: our node is
+  //      PRUNED with no -txindex, so getrawtransaction CANNOT return a
+  //      confirmed tx at all. Every mined snapshot is unfetchable from us
+  //      directly, and without a third source a rate-limited proxy made the
+  //      whole delta chain unreplayable — which breaks restore, not just new
+  //      deltas.
+  //
+  // WAS WhatsOnChain until 2026-08-28. WoC TRUNCATES LARGE SCRIPTS, and this
+  // function fetches repo snapshots — the multi-MB transactions most likely to
+  // be cut short. A truncated body does not error; it decrypts to garbage or
+  // fails a hash check, so the failure surfaces as a corrupt restore rather
+  // than a fetch error. It also throttled at ~3 req/s, and the responses that
+  // lost were the biggest ones. GP serves the same transactions whole and
+  // faster — measured: a 4.8 MB snapshot in 3.4s.
+  //
+  // GP returns raw BYTES, so convert rather than reading text as hex.
+  // 429 still gets a backoff rather than being treated as absence; hammering a
+  // closed limiter is what turned a transient failure into a hard one.
   const urls = [
     `${BRIDGE}/api/tx/${txid}/hex?raw=1`,
     `${BRIDGE}/api/tx/${txid}/hex`,
-    `https://api.whatsonchain.com/v1/bsv/main/tx/${txid}/hex`
+    `https://ordinals.gorillapool.io/api/tx/${txid}/raw`
   ]
   let wait = 500
   for (let attempt = 0; attempt < 3; attempt++) {
@@ -129,6 +171,15 @@ async function getRawHex (txid) {
       try { res = await fetch(url) } catch { continue }
       if (res.status === 429) { await new Promise(r => setTimeout(r, wait)); continue }
       if (!res.ok) continue
+      // GP's /raw returns BINARY tx bytes, not hex text. Reading it with
+      // .text() yields mojibake that fails the hex test below, so the source
+      // would silently never work — a fallback that is present but dead is
+      // worse than no fallback, because nothing tells you.
+      if (url.endsWith('/raw')) {
+        const h = Buffer.from(await res.arrayBuffer()).toString('hex')
+        if (h && /^[0-9a-f]+$/i.test(h)) return h
+        continue
+      }
       const ct = res.headers.get('content-type') || ''
       const data = ct.includes('json') ? await res.json() : await res.text()
       const h = (typeof data === 'string' ? data.replace(/"/g, '').trim() : data.hex)
@@ -137,7 +188,7 @@ async function getRawHex (txid) {
     wait = Math.min(wait * 4, 8000)
     await new Promise(r => setTimeout(r, wait))
   }
-  throw new Error(`cannot fetch raw tx ${txid} from node, bridge or WoC`)
+  throw new Error(`cannot fetch raw tx ${txid} from node, bridge or GorillaPool`)
 }
 
 // ── OP_RETURN ────────────────────────────────────────────────────
@@ -431,6 +482,11 @@ async function publish (scriptHex, k, address, lockingScript, { dry = false } =
   const fundingValue = payloadFee + SELF_MARKER_SATS
   const { picked, sum: fsum, need } = planFunding(utxos, fundingValue)
   const fundFee = need - fundingValue
+  // Claim the inputs before signing. A multi-MB payload can spend tens of
+  // seconds in sign(), and any save started in that window would otherwise
+  // pick the very same coins. Released below on every path that does not
+  // broadcast the funding tx.
+  markSpentOutpoints(picked)
   console.log(`payload tx    ${(payloadBytes / 1048576).toFixed(2)} MB, ` +
     `fee ${payloadFee} sats = ${payloadFee / SATS_PER_COMPUTE} Compute`)
   console.log(`funding tx    ${picked.length} inputs, fee ${fundFee} sats`)
@@ -458,18 +514,35 @@ async function publish (scriptHex, k, address, lockingScript, { dry = false } =
 
   // Both must clear the floor BEFORE either goes out. Broadcasting the funding tx and
   // then discovering the payload is underpaid strands the fee in a spent output.
-  assertFeeRate(fundTx, fundFee, 'funding tx')
-  // Miner receives the funding value MINUS the marker — check the floor against
-  // what the miner actually gets, not against what the tx consumes.
-  assertFeeRate(payTx, fundingValue - SELF_MARKER_SATS, 'payload tx')
+  try {
+    assertFeeRate(fundTx, fundFee, 'funding tx')
+    // Miner receives the funding value MINUS the marker — check the floor against
+    // what the miner actually gets, not against what the tx consumes.
+    assertFeeRate(payTx, fundingValue - SELF_MARKER_SATS, 'payload tx')
+  } catch (err) {
+    await releaseLedgerAfterFailure(address)
+    throw err
+  }
 
   if (dry) {
+    // Nothing goes to the network on a dry run, so the coins are still ours.
+    await releaseLedgerAfterFailure(address)
     return { txid: payTx.id('hex'), funding: fundTx.id('hex'), cost: (fundingValue + fundFee) / SATS_PER_COMPUTE, dry: true }
   }
   process.stdout.write('broadcasting funding tx ... ')
-  const ftx = await broadcast(fundTx.toHex())
+  let ftx
+  try {
+    ftx = await broadcast(fundTx.toHex())
+  } catch (err) {
+    // Funding never left, so `picked` is still ours.
+    await releaseLedgerAfterFailure(address)
+    throw err
+  }
   console.log(ftx)
   process.stdout.write('broadcasting payload tx ... ')
+  // Deliberately NO release if the payload fails: the funding tx is already on
+  // the network, so `picked` is genuinely spent. Releasing here would hand the
+  // picker coins that are gone — the one direction that double-spends.
   const ptx = await broadcast(payTx.toHex())
   console.log(ptx)
   return { txid: ptx, funding: ftx, cost: (fundingValue + fundFee) / SATS_PER_COMPUTE }