Release v0.23.0

.claude/settings.json

@@ -0,0 +1,17 @@
+{
+  "attribution": false,
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "git config user.name 'J-Dog' && git config user.email 'j-dog@j-dog.net' || true",
+            "timeout": 10,
+            "statusMessage": "Setting the repo git identity"
+          }
+        ]
+      }
+    ]
+  }
+}

.env.example

@@ -19,14 +19,19 @@ ENCODER_API_PORT=3003
 UTXO_TRACKER_URL=127.0.0.1
 UTXO_TRACKER_API_PORT=3001
 
+# Optional: "remote" makes the tracker mandatory and fails closed. A missing
+# URL or port, an unreachable tracker, or a missing, halted, stale or not-ready
+# sync state each refuse with a typed error. Default keeps the lenient behaviour.
+# UTXO_TRACKER_PROFILE=remote
+
 # Optional: cap fee-rate estimates at this sat/kB ceiling.
 # MAX_FEE_RATE_KB=200000
 
 # Optional: relative fee-rate ceiling as a multiple of the node's
 # estimatesmartfee(1) estimate (default 100). Caps caller-supplied fee/feePerKb
 # so a hostile request cannot drain inputs into miner fee. Set to 0 to disable
-# (not recommended; a fixed 100x burn backstop still applies when
-# MAX_FEE_RATE_KB is unset); an unset/unparseable value keeps the default.
+# (not recommended; a fixed 100x burn backstop still applies whatever this
+# or MAX_FEE_RATE_KB says); an unset/unparseable value keeps the default.
 # MAX_FEE_RATE_MULTIPLIER=100
 
 # Optional: ceiling (base units) on the extra fee a transaction spending

CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.23.0] - 2026-10-11
+
+### Added
+- Added the remote tracker profile that fails closed.
+- Answered node rejections from broadcast_tx as error -32010 with the node code.
+
+### Changed
+- Bounded fragmented input selection at the transaction cap and refused capped unconfirmed selections.
+- Rounded fees up and shared one caller fee-rate cap with a node-anchored burn backstop.
+
+### Fixed
+- Returned retryable errors for capped dust selection and deferred capped selections that contain mempool inputs.
+- Mirrored exact PSBT fee totals past 2^53 from the SDK copy.
+
 ## [0.21.0] - 2026-09-29
 
 ### Added

CONTRIBUTING.md

@@ -105,6 +105,7 @@ CI is the smoke + unit gate. Before opening a PR:
 2. Update `CHANGELOG.md` with a terse entry for your change.
 3. Make sure `git status` is clean apart from intended changes (no `node_modules/`, no editor leftovers, no `.env`).
 4. Open the PR with a clear title and a description of what changed and why.
+5. Agree to the Contributor License Agreement when the CLA Assistant bot links it on your first PR. The bot records your signature once for every XChain Platform repository, and its `license/cla` check must pass before the PR can merge.
 
 For non-security bugs, open an issue at <https://github.com/XChain-Platform/xchain-encoder/issues/new>. For security bugs, see [`SECURITY.md`](./SECURITY.md).
 

NOTICE.md

@@ -21,8 +21,10 @@ For commercial licensing, contact **legal@dankest.llc**.
 
 ## Attribution
 
-Any redistribution or modification of this software must retain the following
-attribution, per the AGPL and the project's trademark policy:
+As an additional term under section 7(b) of the GNU Affero General Public
+License v3.0, any redistribution or modification of this software must preserve
+the following author attribution in its source and in the Appropriate Legal
+Notices displayed by any work containing it:
 
 > Based on XChain Platform by Dankest, LLC - https://dankest.llc
 

README.md

@@ -23,7 +23,7 @@ PSBT encoding service for the XChain Platform. Takes an ACTION string, a set of
 - **Two-transaction P2SH/P2WSH**: automatic tx1 (fund) -> tx2 (spend/reveal) orchestration with marker OP_RETURN
 - **UTXO selection**: largest-first selection, duplicate removal, optional unconfirmed filtering, automatic change output
 - **Fee estimation**: byte-accurate transaction size estimation per format via `TxSizeEstimator`; dust floor enforcement
-- **Fee rate caps**: caller-supplied `fee`/`feePerKb` is capped at `MAX_FEE_RATE_MULTIPLIER` x the node's own fee estimate (default 100x), so a hostile or buggy request cannot drain inputs into miner fee; `MAX_FEE_RATE_KB` adds an optional absolute cap. The envelope cancel (`create_envelope_cancel_tx`) applies the same caps, and both anchor on the node's relayfee when it has no fee estimate
+- **Fee rate caps**: caller-supplied `fee`/`feePerKb` is capped at `MAX_FEE_RATE_MULTIPLIER` x the node's own fee estimate (default 100x), so a hostile or buggy request cannot drain inputs into miner fee; `MAX_FEE_RATE_KB` adds an optional absolute cap, and a fixed 100x burn backstop holds even when either cap is looser or disabled. The envelope cancel (`create_envelope_cancel_tx`) applies the same caps, and both anchor on the node's relayfee when it has no fee estimate
 - **Input validation**: centralized parameter validation (`validator.js`) with typed errors for all 15 `createTransaction` parameters
 - **Multi-chain support**: Bitcoin, Litecoin, and Dogecoin today on mainnet, testnet, and regtest (9 network configs)
 - **Replace-By-Fee**: optional RBF signaling via sequence number
@@ -77,12 +77,12 @@ npm run api
 | `NODE_USER` | Yes | (none) | RPC username |
 | `NODE_PASSWORD` | Yes | (none) | RPC password |
 | `ENCODER_API_PORT` | No | `3000` | JSON-RPC API port |
-| `NODE_RPC_TIMEOUT` | No | `30000` | Coin-node RPC call timeout in milliseconds |
+| `NODE_RPC_TIMEOUT` | No | `30000` | Coin-node RPC call timeout in milliseconds; must be a positive integer, and an empty or invalid value falls back to `30000` with a warning |
 | `UTXO_TRACKER_URL` | No | (none) | xchain-utxo-tracker service host |
 | `UTXO_TRACKER_API_PORT` | No | (none) | xchain-utxo-tracker service port |
 | `UTXO_TRACKER_MAX_LAG_BLOCKS` | No | `2` | Max blocks the utxo-tracker's reported sync lag may be before `create_tx` refuses to select UTXOs from it. `GET /status` publishes the effective value as `tracker_max_lag_blocks`, so a status board can rank lag against the other unready causes without mirroring a constant it cannot see (the tracker's own `SYNCED_THRESHOLD` is looser and is not this gate) |
 | `MAX_FEE_RATE_KB` | No | Uncapped | Absolute maximum fee rate in sat/kB |
-| `MAX_FEE_RATE_MULTIPLIER` | No | `100` | Caps caller-supplied fee/feePerKb at this multiple of the node's fee estimate (`0` disables this cap; with `MAX_FEE_RATE_KB` also unset, a fixed 100x burn backstop still clamps feePerKb and refuses an explicit fee) |
+| `MAX_FEE_RATE_MULTIPLIER` | No | `100` | Caps caller-supplied fee/feePerKb at this multiple of the node's fee estimate (`0` disables this cap). Whatever this and `MAX_FEE_RATE_KB` are set to, a fixed 100x burn backstop still clamps feePerKb and refuses an explicit fee, so a value above `100` loosens nothing past 100x |
 | `MAX_CPFP_UPLIFT_SAT` | No | `10000000` | Most a transaction spending unconfirmed inputs may add to its fee so the whole mempool package reaches the target rate (`0` disables package-aware sizing) |
 | `FEE_NO_ESTIMATE_RELAY_MULTIPLIER` | No | `10` | Multiple of the node's relay floor charged on a non-mainnet chain when `estimatesmartfee` has no data. Raise it where miners ignore the documented rate (`100` gives 0.1 DOGE/kB). Mainnet is unaffected |
 | `DUST_AMOUNT` | No | Coin default | Floor in base units on every value output the encoder authors (funding legs, data outputs, change). Only raises the floor: the coin's consensus dust threshold and its relay-policy soft-dust floor (Dogecoin: 0.01 DOGE, below which each output adds the whole limit to the required relay fee) already apply |

bin/ci-full.sh

@@ -80,6 +80,7 @@ ci_tier_deferred() {
 # >>> ci-tier timer (generated block; re-run the tier wirer to update) >>>
 run_tier() {
   ci_tier_deferred "$1" && return 0  # ci-tier guard (generated)
+  if [ "${CI_TIER:-full}" = "fast" ] && [ -n "${FAILED:-}" ]; then echo; echo "ci:full ===== $1 NOT RUN (a push stops at its first red tier, its verdict already red; the full sweep runs it) ====="; return 0; fi  # ci-tier stop (generated)
   local name="$1"; shift
   local __ci_tier_t0=$SECONDS
   echo; echo "ci:full ===== $name ====="

bin/pins/at1-identity.json

@@ -1,9 +1,9 @@
 {
-  "capturedAt": "2026-10-01T05:39:07.006Z",
+  "capturedAt": "2026-10-09T19:55:43.652Z",
   "coins": {
-    "src/coins/BTC.js": "92f1e7d143f844886700f40deb53cb02bb7c6c270ab4bb837488f5d8535629b6",
-    "src/coins/LTC.js": "d7cf410caea44a18c3c5cac07ab7f47507af8680ec3cbbec4f54ab8cd09fc0b9",
-    "src/coins/DOGE.js": "3b1aac3d95ca96fd6a7f53c4af169e4e845effb77d00058473bda4d4786e397b",
+    "src/coins/BTC.js": "182baf5173e3846b94a5edc1ae15913a54fb266addfc45a3cf9a013bd9ec16c6",
+    "src/coins/LTC.js": "6155195bfa5fdfeab77dec3802ce67b5cc47a77695e81a4a5545d980e4c421dd",
+    "src/coins/DOGE.js": "4659b45fb7a5c959ce2777ab9d5e7c193f3515f03cdd8cd23bb6b9c4d012fc11",
     "src/coins/index.js": "08b678d934fa647d3c7d14dc5ccdaeb86722ee32a3662de69e4a31cd7b09234c",
     "src/coins/consensus_pin.js": "342bf7af224a19ea0a98ff9cfb2c9a70b3fd5be75de7ecef2db05936f82baa63"
   },
@@ -13,7 +13,7 @@
     "src/observability/index.js": "6d29637dc3a815d896076642823393866e4f74a68b59dc363ff1cd828aff422a",
     "src/observability/logShipper.js": "fbb1e5b3f01229417117c718da24ee2d62fefd9740adbbec2a4e941a67dbd027",
     "src/observability/metrics.js": "b29a0f2855e0dc4d8d97dde22c36daa6ab0408391945eda1b47b47398c0cd261",
-    "test/fixtures/action-manifest.json": "e4b386bf166203f65d0cd8a246bc0820a2518ed570ab2112367169dd8a5c1e69",
+    "test/fixtures/action-manifest.json": "2be99c8a8adbcfbeb9d545e8dc42663323cdb15351a39373ccd38fabf48e58ff",
     "test/fixtures/roundtrip-conformance.json": "d9963ac7c35bdcfab99595fec040d7791d73119cb62fef20db136f8ea56236ed",
     "test/fixtures/utxo-record-conformance.json": "ca9051b2dcacbcdded68d53089eea4b6a2ba0d498d1ee14eb95342ab0f7da5ff",
     "tools/release/release-signing-fingerprint.txt": "a216bc460bc978da7011d8ed0a0e203d87f97d3bd14ef6c79283a05bb263d1db",