lightning: quote the routing fee up front and add a max-send quote endpoint

Users trying to empty their balance over lightning had to guess a maxfee
that covered both an unknown routing fee and the platform fee, and the
0.5% floor we imposed on that guess made an exact "send everything"
impossible. xpay routes with askrene's getroutes, so ask askrene the same
question before we debit and the fee is known exactly.

lib/lnquote.ts mirrors what xpay does in plugins/xpay/xpay.c (v26.06):
a throwaway private layer carrying the invoice's route hints (bolt11) or
blinded paths via xpay's fake destination node (bolt12), then getroutes
over the same layer stack in the same order. The fee is the sum of what
leaves our node minus what the destination receives, rounded up to a
whole sat since that is what xpay's maxfee reserves.

POST /lightning/quote returns the routing fee, the platform fee exactly
as debit() charges it (free-tier credit, ln:nofree rate, none on
sub-accounts) and the total. With `max` it iterates quote / subtract
fees / requote so amount + both fees lands exactly on the balance; an
offer gets a probe invoice then the real one for the solved amount, and
an LNURL caller can pass `ceiling` and a probe invoice the same way.

sendLightning now quotes for every send. With no explicit fee the quote
becomes the maxfee; an explicit fee below the quote is rejected before
any debit instead of failing inside xpay after one; the old 0.5% floor
on explicit fees is gone. If the quote itself fails we fall back to the
heuristic and let xpay try.

finalize rounds the settled fee up to the whole sat that was quoted and
reserved; rounding a 301 msat fee to 0 refunded a sat that the quote had
already accounted for and stranded it in the account.

The prefer-kappa layer is only passed to xpay when it exists on the node;
getroutes rejects unknown layers outright, which broke every regtest send.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

1 files changed, 37 insertions, 8 deletions

diff --git a/lib/payments.ts b/lib/payments.ts
index bd706b71..2c18f399 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -20,6 +20,7 @@ const isWithdrawLocked = (type: string): string | null => {
 };
 import { generate } from "$lib/invoices";
 import ln from "$lib/ln";
+import { quoteRoutingFee, xpayLayers } from "$lib/lnquote";
 import { err, l, shortError, warn } from "$lib/logging";
 import { handleZap } from "$lib/nostr";
 import { notify, nwcNotify } from "$lib/notifications";
@@ -965,12 +966,35 @@ export const sendLightning = async ({
   }
 
   const amt = amount_msat ? Math.round(amount_msat / 1000) : amount;
-  let minfee = Math.max(5, Math.round(amt * 0.005));
-  const { channels } = await ln.listpeerchannels();
-  if (channels.some((c) => c.peer_id === payee)) minfee = 0;
 
-  fee = Math.max(Number.parseInt(fee) || minfee, minfee);
-  if (fee < 0) fail("Fee cannot be negative");
+  // Ask askrene up front what routing this will cost — the same query xpay
+  // runs — so the maxfee we reserve is the real fee, not a guess. A caller
+  // that names its own cap keeps it (finalize refunds whatever xpay doesn't
+  // spend), but a cap below the quoted fee is rejected here, before any
+  // debit, instead of failing inside xpay after one. If the quote itself
+  // fails (askrene unavailable, no route) fall back to the old heuristic and
+  // let xpay have a go.
+  let quoted: number | undefined;
+  try {
+    ({ fee: quoted } = await quoteRoutingFee({ pr, amount: amt }));
+  } catch (e: any) {
+    warn("route quote failed", pr.substr(-8), shortError(e?.message));
+  }
+
+  const explicit = Number.parseInt(fee);
+  if (Number.isFinite(explicit)) {
+    if (explicit < 0) fail("Fee cannot be negative");
+    if (quoted !== undefined && explicit < quoted)
+      fail(`Routing fee of ⚡️${quoted} required, max fee is ⚡️${explicit}`);
+    fee = explicit;
+  } else if (quoted !== undefined) {
+    fee = quoted;
+  } else {
+    let minfee = Math.max(5, Math.round(amt * 0.005));
+    const { channels } = await ln.listpeerchannels();
+    if (channels.some((c) => c.peer_id === payee)) minfee = 0;
+    fee = minfee;
+  }
 
   const { pays } = await ln.listpays(pr);
   if (pays.find((p) => p.status === "complete"))
@@ -1028,7 +1052,7 @@ export const sendLightning = async ({
       // still driving and we refund one that settles (the LEAKED DEBIT
       // losses). Change both together.
       retry_for: 60,
-      layers: ["prefer-kappa"],
+      layers: await xpayLayers(),
     });
 
     // Only log the xpay response when there's a real concern — no preimage
@@ -1425,7 +1449,12 @@ const finalize = async (r, p) => {
   const decoded = await ln.decode(p.hash);
   const invMsat = Number(decoded.amount_msat ?? r.amount_msat);
   const sentMsat = Number(r.amount_sent_msat);
-  const computedFee = Math.round((sentMsat - invMsat) / 1000);
+  // Round UP: the routing fee was quoted and reserved in whole sats (a
+  // 301 msat route is a 1 sat maxfee — xpay's cap is exact and a few msat
+  // short fails the payment), so charge the sat that was quoted rather than
+  // rounding 301 msat to 0 and refunding it. Otherwise a "send everything"
+  // computed from the quote strands a single sat in the account.
+  const computedFee = Math.ceil((sentMsat - invMsat) / 1000);
   if (!Number.isFinite(computedFee)) {
     warn("finalize: non-finite fee compute, keeping reserved maxfee", p.id,
          "sent_msat=", r.amount_sent_msat, "inv_msat=", decoded.amount_msat ?? r.amount_msat);
@@ -1469,7 +1498,7 @@ const finalizeKeysend = async (r, p, preimage) => {
 
   const maxfee = p.fee;
   const sentMsat = Number(r.amount_sent_msat);
-  const actualFee = Math.round((sentMsat - Math.abs(p.amount) * 1000) / 1000);
+  const actualFee = Math.ceil((sentMsat - Math.abs(p.amount) * 1000) / 1000);
   p.fee = Number.isFinite(actualFee) && actualFee >= 0 ? actualFee : maxfee;
   p.ref = preimage;
   p.confirmed = true;