@elisym/commerce 0.1.0

package/dist/index.js

@@ -0,0 +1,1444 @@
+import { chainByCaip2, isEvmWireAddress, assetsFor, isVirtualEvmAddress, parseAssetAmount } from '@elisym/pay-core';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { hex, base58 } from '@scure/base';
+import { ed25519 } from '@noble/curves/ed25519.js';
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+import * as nip192 from 'nostr-tools/nip19';
+import Decimal from 'decimal.js-light';
+import { z } from 'zod';
+import * as nip44 from 'nostr-tools/nip44';
+import * as nip59 from 'nostr-tools/nip59';
+import { getEventHash, getPublicKey, verifyEvent } from 'nostr-tools/pure';
+
+// src/constants.ts
+var KIND_STORE_PROFILE = 0;
+var KIND_PAYTO = 10133;
+var KIND_STORE_AUTH = 30490;
+var KIND_PRODUCT = 30402;
+var KIND_INBOX_RELAYS = 10050;
+var KIND_ORDER_MESSAGE = 16;
+var KIND_PAYMENT_RECEIPT = 17;
+var KIND_DELETION = 5;
+var KIND_SEAL = 13;
+var KIND_GIFT_WRAP = 1059;
+var ELISYM_NETWORK_TAG = "elisym";
+var PAYTO_PROOF_PREFIX = "elisym-payto:v1";
+var DELIVERY_METHODS = ["download", "license", "access", "webhook", "api"];
+var ORDER_STATUSES = ["pending", "confirmed", "completed", "cancelled"];
+var PURCHASABLE_VISIBILITIES = ["on-sale", "pre-order"];
+var PAYOUT_COOLDOWN_SECS = 72 * 60 * 60;
+var MAX_FUTURE_SKEW_SECS = 15 * 60;
+var LIMITS = {
+  MAX_ORDER_ID_LENGTH: 64,
+  MAX_TAG_VALUE_LENGTH: 1024,
+  MAX_CONTENT_LENGTH: 64 * 1024,
+  MAX_ITEMS_PER_ORDER: 50,
+  MAX_NIP05_DOCUMENT_BYTES: 64 * 1024
+};
+var SOLANA_ADDRESS_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+var CAIP19_RE = /^([a-z0-9-]{3,8}:[-_a-zA-Z0-9]{1,32})\/(token|erc20):([-.%a-zA-Z0-9]{1,128})$/;
+var SOLANA_PUBLIC_KEY_BYTES = 32;
+var SOLANA_ZERO_KEY = "1".repeat(32);
+var EVM_ZERO_ADDRESS = `0x${"0".repeat(40)}`;
+var UTF8 = new TextEncoder();
+function isSolanaPublicKey(address) {
+  try {
+    return base58.decode(address).length === SOLANA_PUBLIC_KEY_BYTES;
+  } catch {
+    return false;
+  }
+}
+function parseCaip19(id) {
+  const match = CAIP19_RE.exec(id);
+  const caip2 = match?.[1];
+  const namespace = match?.[2];
+  const reference = match?.[3];
+  if (!caip2 || !namespace || !reference) {
+    return void 0;
+  }
+  const chain = chainByCaip2(caip2);
+  if (!chain) {
+    return void 0;
+  }
+  const expectedNamespace = chain.family === "solana" ? "token" : "erc20";
+  if (namespace !== expectedNamespace) {
+    return void 0;
+  }
+  if (chain.family === "evm" && !isEvmWireAddress(reference)) {
+    return void 0;
+  }
+  const asset = assetsFor(chain.slug, chain.network).find((coin) => coin.mint === reference);
+  if (!asset) {
+    return void 0;
+  }
+  return { id, caip2, chain, asset };
+}
+function hasValidEvmChecksum(address) {
+  const body = address.slice(2);
+  if (body === body.toLowerCase() || body === body.toUpperCase()) {
+    return true;
+  }
+  const digest = hex.encode(keccak_256(UTF8.encode(body.toLowerCase())));
+  for (let i = 0; i < body.length; i++) {
+    const char = body[i] ?? "";
+    const nibble = Number.parseInt(digest[i] ?? "0", 16);
+    const expected = nibble >= 8 ? char.toUpperCase() : char.toLowerCase();
+    if (char !== expected) {
+      return false;
+    }
+  }
+  return true;
+}
+function canonicalPayoutAddress(chain, address) {
+  if (chain.family === "solana") {
+    return SOLANA_ADDRESS_RE.test(address) && isSolanaPublicKey(address) && address !== SOLANA_ZERO_KEY ? address : void 0;
+  }
+  const lowered = address.toLowerCase();
+  if (!isEvmWireAddress(lowered) || isVirtualEvmAddress(lowered) || lowered === EVM_ZERO_ADDRESS) {
+    return void 0;
+  }
+  return lowered;
+}
+var EVM_SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
+var ED25519_SIGNATURE_BYTES = 64;
+var ED25519_PUBLIC_KEY_BYTES = 32;
+var UTF82 = new TextEncoder();
+function paytoProofMessage(ownerPubkey, caip19) {
+  return `${PAYTO_PROOF_PREFIX}:${ownerPubkey}:${caip19}`;
+}
+function verifyPaytoProof(params) {
+  const message = UTF82.encode(paytoProofMessage(params.ownerPubkey, params.caip19));
+  try {
+    return params.chain.family === "solana" ? verifyEd25519(message, params.signature, params.address) : verifyEip191(message, params.signature, params.address);
+  } catch {
+    return false;
+  }
+}
+function verifyEd25519(message, signature, address) {
+  const signatureBytes = base58.decode(signature);
+  const publicKey = base58.decode(address);
+  if (signatureBytes.length !== ED25519_SIGNATURE_BYTES || publicKey.length !== ED25519_PUBLIC_KEY_BYTES) {
+    return false;
+  }
+  return ed25519.verify(signatureBytes, message, publicKey, { zip215: false });
+}
+function eip191Hash(message) {
+  const prefix = UTF82.encode(`Ethereum Signed Message:
+${message.length}`);
+  const payload = new Uint8Array(prefix.length + message.length);
+  payload.set(prefix, 0);
+  payload.set(message, prefix.length);
+  return keccak_256(payload);
+}
+function verifyEip191(message, signature, address) {
+  if (!EVM_SIGNATURE_RE.test(signature)) {
+    return false;
+  }
+  const bytes = hex.decode(signature.slice(2).toLowerCase());
+  const recoveryByte = bytes[64];
+  if (recoveryByte === void 0) {
+    return false;
+  }
+  const recovery = recoveryByte >= 27 ? recoveryByte - 27 : recoveryByte;
+  if (recovery !== 0 && recovery !== 1) {
+    return false;
+  }
+  const recovered = new Uint8Array(65);
+  recovered[0] = recovery;
+  recovered.set(bytes.subarray(0, 64), 1);
+  const publicKey = secp256k1.recoverPublicKey(recovered, eip191Hash(message), {
+    prehash: false
+  });
+  return evmAddressOf(publicKey) === address.toLowerCase();
+}
+function evmAddressOf(publicKey) {
+  const uncompressed = secp256k1.Point.fromBytes(publicKey).toBytes(false);
+  const digest = keccak_256(uncompressed.subarray(1));
+  return `0x${hex.encode(digest.subarray(12))}`;
+}
+
+// src/tags.ts
+var HEX_PUBKEY_RE = /^[0-9a-f]{64}$/;
+function tagValue(tags, name) {
+  return tags.find((tag) => tag[0] === name)?.[1];
+}
+function tagsNamed(tags, name) {
+  return tags.filter((tag) => tag[0] === name);
+}
+function tagValues(tags, name) {
+  return tagsNamed(tags, name).map((tag) => tag[1]).filter((value) => value !== void 0);
+}
+var EXPIRATION_RE = /^\d{1,12}$/;
+function expirationState(tags, now) {
+  const expirationTags = tagsNamed(tags, "expiration");
+  if (expirationTags.length === 0) {
+    return "none";
+  }
+  const expiration = expirationTags[0]?.[1] ?? "";
+  if (expirationTags.length > 1 || !EXPIRATION_RE.test(expiration)) {
+    return "malformed";
+  }
+  return Number(expiration) <= now ? "expired" : "active";
+}
+function nowSecs() {
+  return Math.floor(Date.now() / 1e3);
+}
+
+// src/domain.ts
+var HOSTNAME_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var LOCAL_PART_RE = /^[a-z0-9._-]{1,64}$/;
+var MAX_HOSTNAME_LENGTH = 253;
+var SPECIAL_USE_TOP_LEVELS = [
+  "localhost",
+  "local",
+  "internal",
+  "arpa",
+  "test",
+  "invalid",
+  "onion",
+  "lan",
+  "home",
+  "corp",
+  "intranet",
+  "private"
+];
+var OWNER_NAME = "owner";
+var TXT_PREFIX = "v=elisym1";
+var DEFAULT_TIMEOUT_MS = 5e3;
+var DEFAULT_DOH_ENDPOINT = "https://cloudflare-dns.com/dns-query";
+var DNS_TYPE_TXT = 16;
+function isPublicHostname(hostname) {
+  if (hostname.length === 0 || hostname.length > MAX_HOSTNAME_LENGTH) {
+    return false;
+  }
+  const labels = hostname.split(".");
+  if (labels.length < 2 || !labels.every((label) => HOSTNAME_LABEL_RE.test(label))) {
+    return false;
+  }
+  const topLevel = labels[labels.length - 1] ?? "";
+  return !/^(\d+|0x[0-9a-f]*)$/.test(topLevel) && !SPECIAL_USE_TOP_LEVELS.includes(topLevel);
+}
+function splitNip05(identifier) {
+  const lowered = identifier.trim().toLowerCase();
+  const at = lowered.lastIndexOf("@");
+  const local = at === -1 ? "_" : lowered.slice(0, at);
+  const domain = at === -1 ? lowered : lowered.slice(at + 1);
+  if (!LOCAL_PART_RE.test(local) || !isPublicHostname(domain)) {
+    return void 0;
+  }
+  return { local, domain };
+}
+function readHexKey(value) {
+  return typeof value === "string" && HEX_PUBKEY_RE.test(value) ? value : void 0;
+}
+function readNostrJson(document, local) {
+  const names = fieldOf(document, "names");
+  if (typeof names !== "object" || names === null) {
+    return {};
+  }
+  const entries = { ...names };
+  const keys = {};
+  const storePubkey = readHexKey(entries[local]);
+  const ownerPubkey = readHexKey(entries[OWNER_NAME]);
+  if (storePubkey) {
+    keys.storePubkey = storePubkey;
+  }
+  if (ownerPubkey) {
+    keys.ownerPubkey = ownerPubkey;
+  }
+  return keys;
+}
+function npubToHex(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (HEX_PUBKEY_RE.test(value)) {
+    return value;
+  }
+  try {
+    const decoded = nip192.decode(value);
+    return decoded.type === "npub" ? decoded.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readElisymTxt(record) {
+  const parts = record.split(";").map((part) => part.trim());
+  if (parts[0] !== TXT_PREFIX) {
+    return {};
+  }
+  const fields = /* @__PURE__ */ new Map();
+  for (const part of parts.slice(1)) {
+    const eq = part.indexOf("=");
+    if (eq > 0) {
+      const name = part.slice(0, eq).trim();
+      if (fields.has(name)) {
+        return {};
+      }
+      fields.set(name, part.slice(eq + 1).trim());
+    }
+  }
+  const keys = {};
+  const storePubkey = npubToHex(fields.get("store"));
+  const ownerPubkey = npubToHex(fields.get("owner"));
+  if (storePubkey) {
+    keys.storePubkey = storePubkey;
+  }
+  if (ownerPubkey) {
+    keys.ownerPubkey = ownerPubkey;
+  }
+  return keys;
+}
+async function readCappedJson(response) {
+  const reader = response.body?.getReader();
+  if (!reader) {
+    return void 0;
+  }
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    total += value.byteLength;
+    if (total > LIMITS.MAX_NIP05_DOCUMENT_BYTES) {
+      await reader.cancel();
+      return void 0;
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    return void 0;
+  }
+}
+function fieldOf(value, name) {
+  if (typeof value !== "object" || value === null) {
+    return void 0;
+  }
+  const record = { ...value };
+  return record[name];
+}
+function timeoutSignal(timeoutMs) {
+  return AbortSignal.timeout(timeoutMs);
+}
+async function fetchNostrJson(name, domain, fetchImpl, timeoutMs) {
+  const url = `https://${domain}/.well-known/nostr.json?name=${encodeURIComponent(name)}`;
+  const response = await fetchImpl(url, {
+    redirect: "error",
+    signal: timeoutSignal(timeoutMs),
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) {
+    await response.body?.cancel();
+    return {};
+  }
+  return readNostrJson(await readCappedJson(response), name);
+}
+async function fetchNostrJsonKeys(local, domain, fetchImpl, timeoutMs) {
+  const keys = await fetchNostrJson(local, domain, fetchImpl, timeoutMs);
+  if (!keys.storePubkey) {
+    return void 0;
+  }
+  if (!keys.ownerPubkey && local === "_") {
+    try {
+      const owner = await fetchNostrJson(OWNER_NAME, domain, fetchImpl, timeoutMs);
+      if (owner.ownerPubkey) {
+        keys.ownerPubkey = owner.ownerPubkey;
+      }
+    } catch {
+    }
+  }
+  return { domain, name: local, source: "nostr.json", ...keys };
+}
+async function fetchTxtKeys(domain, name, fetchImpl, timeoutMs, dohEndpoint) {
+  const url = new URL(dohEndpoint);
+  url.searchParams.set("name", `_elisym.${domain}`);
+  url.searchParams.set("type", "TXT");
+  const response = await fetchImpl(url.toString(), {
+    signal: timeoutSignal(timeoutMs),
+    headers: { accept: "application/dns-json" }
+  });
+  if (!response.ok) {
+    await response.body?.cancel();
+    return void 0;
+  }
+  const answers = fieldOf(await readCappedJson(response), "Answer");
+  if (!Array.isArray(answers)) {
+    return void 0;
+  }
+  let found;
+  for (const answer of answers) {
+    const type = fieldOf(answer, "type");
+    const data = fieldOf(answer, "data");
+    if (type !== DNS_TYPE_TXT || typeof data !== "string") {
+      continue;
+    }
+    const record = data.replace(/"\s*"/g, "").replace(/^"|"$/g, "");
+    const keys = readElisymTxt(record);
+    if (!keys.storePubkey) {
+      continue;
+    }
+    if (found !== void 0 && (found.storePubkey !== keys.storePubkey || found.ownerPubkey !== keys.ownerPubkey)) {
+      return void 0;
+    }
+    found = keys;
+  }
+  return found === void 0 ? void 0 : { domain, name, source: "dns", ...found };
+}
+async function resolveDomainKeys(nip05, options = {}) {
+  const parts = splitNip05(nip05);
+  if (!parts) {
+    return void 0;
+  }
+  const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  try {
+    const fromJson = await fetchNostrJsonKeys(parts.local, parts.domain, fetchImpl, timeoutMs);
+    if (fromJson) {
+      return fromJson;
+    }
+  } catch {
+  }
+  try {
+    return await fetchTxtKeys(
+      parts.domain,
+      parts.local,
+      fetchImpl,
+      timeoutMs,
+      options.dohEndpoint ?? DEFAULT_DOH_ENDPOINT
+    );
+  } catch {
+    return void 0;
+  }
+}
+
+// src/events/payto.ts
+function buildPaytoEvent(input) {
+  const tags = [];
+  for (const entry of input.payto ?? []) {
+    tags.push(["payto", entry.type, entry.authority]);
+  }
+  for (const entry of input.accept) {
+    const caip19 = parseCaip19(entry.caip19);
+    if (!caip19) {
+      throw new Error(`Not a payable CAIP-19 asset: ${entry.caip19}`);
+    }
+    const address = canonicalPayoutAddress(caip19.chain, entry.address);
+    if (!address) {
+      throw new Error(`Not a ${caip19.chain.family} address: ${entry.address}`);
+    }
+    if (caip19.chain.family === "evm" && !hasValidEvmChecksum(entry.address)) {
+      throw new Error(`EIP-55 checksum mismatch, likely a typo: ${entry.address}`);
+    }
+    if (entry.signature !== void 0) {
+      if (input.ownerPubkey === void 0 || !HEX_PUBKEY_RE.test(input.ownerPubkey)) {
+        throw new Error("A wallet signature needs ownerPubkey as 64 lowercase hex characters");
+      }
+      const proven = verifyPaytoProof({
+        chain: caip19.chain,
+        address,
+        ownerPubkey: input.ownerPubkey,
+        caip19: caip19.id,
+        signature: entry.signature
+      });
+      if (!proven) {
+        throw new Error(`The wallet signature does not prove ${address} for this owner and asset`);
+      }
+    }
+    tags.push(
+      entry.signature === void 0 ? ["accept", entry.caip19, address] : ["accept", entry.caip19, address, entry.signature]
+    );
+  }
+  return { kind: KIND_PAYTO, created_at: input.createdAt ?? nowSecs(), tags, content: "" };
+}
+function parsePayto(event) {
+  const candidates = /* @__PURE__ */ new Map();
+  const badProof = /* @__PURE__ */ new Set();
+  const rejected = [];
+  for (const tag of tagsNamed(event.tags, "accept")) {
+    const [, caip19Id, rawAddress, signature] = tag;
+    const caip19 = caip19Id === void 0 ? void 0 : parseCaip19(caip19Id);
+    if (!caip19) {
+      rejected.push({ tag, reason: "unknown_asset" });
+      continue;
+    }
+    const address = rawAddress === void 0 ? void 0 : canonicalPayoutAddress(caip19.chain, rawAddress);
+    if (!address) {
+      rejected.push({ tag, reason: "bad_address" });
+      continue;
+    }
+    const key = `${caip19.id}|${address}`;
+    let walletSigned = false;
+    if (signature !== void 0 && signature !== "") {
+      walletSigned = verifyPaytoProof({
+        chain: caip19.chain,
+        address,
+        ownerPubkey: event.pubkey,
+        caip19: caip19.id,
+        signature
+      });
+      if (!walletSigned) {
+        rejected.push({ tag, reason: "bad_proof" });
+        badProof.add(key);
+        continue;
+      }
+    }
+    const earlier = candidates.get(key);
+    if (earlier === void 0) {
+      candidates.set(key, { caip19, address, walletSigned });
+    } else if (walletSigned) {
+      earlier.walletSigned = true;
+    }
+  }
+  const targets = [...candidates.entries()].filter(([key]) => !badProof.has(key)).map(([, target]) => target);
+  return { targets, rejected };
+}
+
+// src/events/store-auth.ts
+var STORE_AUTH_MODES = ["self-host", "hosted", "revoked"];
+var MAX_EXPIRATION_SECS = 1e12;
+function isStoreAuthMode(value) {
+  return value !== void 0 && STORE_AUTH_MODES.includes(value);
+}
+function storeAuthAddress(ownerPubkey, storePubkey) {
+  return `${KIND_STORE_AUTH}:${ownerPubkey}:${storePubkey}`;
+}
+function buildStoreAuthEvent(input) {
+  if (!HEX_PUBKEY_RE.test(input.storePubkey)) {
+    throw new Error("storePubkey must be 64 lowercase hex characters");
+  }
+  if (input.mode !== "self-host" && input.mode !== "hosted") {
+    throw new Error(`Invalid store mode: ${String(input.mode)}`);
+  }
+  const tags = [
+    ["d", input.storePubkey],
+    ["p", input.storePubkey],
+    input.operator === void 0 ? ["mode", input.mode] : ["mode", input.mode, input.operator]
+  ];
+  if (input.expiresAt !== void 0) {
+    if (!Number.isSafeInteger(input.expiresAt) || input.expiresAt <= 0 || input.expiresAt >= MAX_EXPIRATION_SECS) {
+      throw new Error("expiresAt must be a unix time in whole seconds");
+    }
+    tags.push(["expiration", String(input.expiresAt)]);
+  }
+  return { kind: KIND_STORE_AUTH, created_at: input.createdAt ?? nowSecs(), tags, content: "" };
+}
+function buildStoreRevocationEvent(storePubkey, createdAt) {
+  if (!HEX_PUBKEY_RE.test(storePubkey)) {
+    throw new Error("storePubkey must be 64 lowercase hex characters");
+  }
+  return {
+    kind: KIND_STORE_AUTH,
+    created_at: createdAt ?? nowSecs(),
+    tags: [
+      ["d", storePubkey],
+      ["p", storePubkey],
+      ["mode", "revoked"]
+    ],
+    content: ""
+  };
+}
+function readStoreAuth(event, storePubkey, now = nowSecs()) {
+  const tags = event.tags;
+  if (event.kind !== KIND_STORE_AUTH || tagValue(tags, "d") !== storePubkey) {
+    return { status: "malformed" };
+  }
+  const modeTags = tagsNamed(tags, "mode");
+  if (modeTags.length !== 1) {
+    return { status: "malformed" };
+  }
+  const modeTag = modeTags[0];
+  const mode = modeTag?.[1];
+  if (!isStoreAuthMode(mode)) {
+    return { status: "malformed" };
+  }
+  if (mode === "revoked") {
+    return { status: "revoked" };
+  }
+  if (!tagsNamed(tags, "p").some((tag) => tag[1] === storePubkey)) {
+    return { status: "malformed" };
+  }
+  const expiration = expirationState(tags, now);
+  if (expiration === "malformed") {
+    return { status: "malformed" };
+  }
+  if (expiration === "expired") {
+    return { status: "expired" };
+  }
+  const operator = modeTag?.[2];
+  return operator === void 0 ? { status: "active", mode } : { status: "active", mode, operator };
+}
+
+// src/events/store-profile.ts
+var PROFILE_FIELDS = ["name", "about", "picture", "website", "nip05"];
+var URL_FIELDS = ["picture", "website"];
+var PROFILE_FIELD_LIMITS = {
+  name: LIMITS.MAX_TAG_VALUE_LENGTH,
+  about: LIMITS.MAX_CONTENT_LENGTH,
+  picture: LIMITS.MAX_TAG_VALUE_LENGTH,
+  website: LIMITS.MAX_TAG_VALUE_LENGTH,
+  nip05: LIMITS.MAX_TAG_VALUE_LENGTH
+};
+function isReadableField(key, value) {
+  return value.length <= PROFILE_FIELD_LIMITS[key] && (!URL_FIELDS.includes(key) || value.startsWith("https://"));
+}
+function buildStoreProfileEvent(input) {
+  if (!HEX_PUBKEY_RE.test(input.ownerPubkey)) {
+    throw new Error("ownerPubkey must be 64 lowercase hex characters");
+  }
+  const content = {};
+  for (const key of PROFILE_FIELDS) {
+    const value = input[key];
+    if (value === void 0) {
+      continue;
+    }
+    if (!isReadableField(key, value)) {
+      throw new Error(`Profile ${key} is too long or, for a link, not https`);
+    }
+    content[key] = value;
+  }
+  return {
+    kind: KIND_STORE_PROFILE,
+    created_at: input.createdAt ?? nowSecs(),
+    tags: [["owner", input.ownerPubkey]],
+    content: JSON.stringify(content)
+  };
+}
+function parseStoreProfile(event) {
+  let raw;
+  try {
+    raw = JSON.parse(event.content);
+  } catch {
+    return void 0;
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return void 0;
+  }
+  const fields = { ...raw };
+  const owner = tagValue(event.tags, "owner");
+  const profile = {};
+  for (const key of PROFILE_FIELDS) {
+    const value = Object.hasOwn(fields, key) ? fields[key] : void 0;
+    if (typeof value === "string" && isReadableField(key, value)) {
+      profile[key] = value;
+    }
+  }
+  if (owner !== void 0 && HEX_PUBKEY_RE.test(owner)) {
+    profile.ownerPubkey = owner;
+  }
+  return profile;
+}
+var PRICE_AMOUNT_RE = /^(0|[1-9]\d{0,11})(\.\d{1,18})?$/;
+var CURRENCY_RE = /^[A-Z]{3}$/;
+var D_TAG_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+var FREQUENCIES = ["hour", "day", "week", "month", "year"];
+var ENDPOINT_TYPES = ["x402", "mpp"];
+var USD_STABLE_TOKENS = ["usdc", "usdce", "pathusd"];
+var ProductInputSchema = z.object({
+  d: z.string().regex(D_TAG_RE),
+  title: z.string().min(1).max(LIMITS.MAX_TAG_VALUE_LENGTH),
+  summary: z.string().max(LIMITS.MAX_TAG_VALUE_LENGTH).optional(),
+  description: z.string().max(LIMITS.MAX_CONTENT_LENGTH),
+  price: z.object({
+    amount: z.string().regex(PRICE_AMOUNT_RE),
+    currency: z.string().regex(CURRENCY_RE),
+    frequency: z.enum(FREQUENCIES).optional()
+  }),
+  images: z.array(z.string().url().startsWith("https://").max(LIMITS.MAX_TAG_VALUE_LENGTH)).default([]),
+  topics: z.array(z.string().min(1).max(64)).default([]),
+  visibility: z.string().min(1).max(32).default("on-sale"),
+  delivery: z.enum(DELIVERY_METHODS).optional(),
+  listedOnElisym: z.boolean().default(false),
+  endpoints: z.array(z.object({ type: z.enum(ENDPOINT_TYPES), url: z.string().url().startsWith("https://") })).default([]),
+  accept: z.array(z.string()).min(1),
+  createdAt: z.number().int().positive().optional()
+});
+function buildProductEvent(input) {
+  const product = ProductInputSchema.parse(input);
+  for (const caip19 of product.accept) {
+    if (!parseCaip19(caip19)) {
+      throw new Error(`Not a payable CAIP-19 asset: ${caip19}`);
+    }
+  }
+  const tags = [
+    ["d", product.d],
+    ["title", product.title]
+  ];
+  if (product.summary !== void 0) {
+    tags.push(["summary", product.summary]);
+  }
+  tags.push(
+    product.price.frequency === void 0 ? ["price", product.price.amount, product.price.currency] : ["price", product.price.amount, product.price.currency, product.price.frequency]
+  );
+  for (const image of product.images) {
+    tags.push(["image", image]);
+  }
+  for (const topic of product.topics) {
+    tags.push(["t", topic]);
+  }
+  tags.push(["visibility", product.visibility]);
+  if (product.delivery !== void 0) {
+    tags.push(["delivery", product.delivery]);
+  }
+  if (product.listedOnElisym) {
+    tags.push(["network", ELISYM_NETWORK_TAG]);
+  }
+  for (const endpoint of product.endpoints) {
+    tags.push(["endpoint", endpoint.type, endpoint.url]);
+  }
+  for (const caip19 of product.accept) {
+    tags.push(["accept", caip19]);
+  }
+  return {
+    kind: KIND_PRODUCT,
+    created_at: product.createdAt ?? nowSecs(),
+    tags,
+    content: product.description
+  };
+}
+function parsePrice(tags) {
+  const tag = tagsNamed(tags, "price")[0];
+  const amount = tag?.[1];
+  const currency = tag?.[2];
+  const frequency = tag?.[3];
+  if (!amount || !PRICE_AMOUNT_RE.test(amount) || !currency || !CURRENCY_RE.test(currency)) {
+    return void 0;
+  }
+  if (frequency === void 0 || frequency === "") {
+    return { amount, currency };
+  }
+  const known = FREQUENCIES.find((candidate) => candidate === frequency);
+  return known ? { amount, currency, frequency: known } : void 0;
+}
+function parseProduct(event) {
+  if (event.kind !== KIND_PRODUCT || event.content.length > LIMITS.MAX_CONTENT_LENGTH) {
+    return void 0;
+  }
+  const tags = event.tags;
+  const d = tagValue(tags, "d");
+  const title = tagValue(tags, "title");
+  const price = parsePrice(tags);
+  if (d === void 0 || !D_TAG_RE.test(d) || !title || !price) {
+    return void 0;
+  }
+  const deliveryValue = tagValue(tags, "delivery");
+  const delivery = DELIVERY_METHODS.find((method) => method === deliveryValue);
+  const endpoints = [];
+  for (const tag of tagsNamed(tags, "endpoint")) {
+    const type = ENDPOINT_TYPES.find((candidate) => candidate === tag[1]);
+    const url = tag[2];
+    if (type && url?.startsWith("https://")) {
+      endpoints.push({ type, url });
+    }
+  }
+  const summary = tagValue(tags, "summary");
+  const product = {
+    storePubkey: event.pubkey,
+    d,
+    title,
+    description: event.content,
+    price,
+    // Only `https:` images, as the builder writes: never a `javascript:` or `data:` URL to render.
+    images: tagValues(tags, "image").filter((image) => image.startsWith("https://")),
+    topics: tagValues(tags, "t"),
+    visibility: tagValue(tags, "visibility") ?? "on-sale",
+    listedOnElisym: tagValues(tags, "network").includes(ELISYM_NETWORK_TAG),
+    endpoints,
+    accept: tagValues(tags, "accept"),
+    createdAt: event.created_at
+  };
+  if (summary !== void 0) {
+    product.summary = summary;
+  }
+  if (delivery !== void 0) {
+    product.delivery = delivery;
+  }
+  return product;
+}
+function isPurchasable(product) {
+  return PURCHASABLE_VISIBILITIES.some((visibility) => visibility === product.visibility);
+}
+function productAddress(product) {
+  return `${KIND_PRODUCT}:${product.storePubkey}:${product.d}`;
+}
+function encodeProductNaddr(product, relays = []) {
+  return nip192.naddrEncode({
+    kind: KIND_PRODUCT,
+    pubkey: product.storePubkey,
+    identifier: product.d,
+    relays
+  });
+}
+function decodeProductNaddr(naddr) {
+  try {
+    const decoded = nip192.decode(naddr);
+    if (decoded.type !== "naddr" || decoded.data.kind !== KIND_PRODUCT || !HEX_PUBKEY_RE.test(decoded.data.pubkey) || !D_TAG_RE.test(decoded.data.identifier)) {
+      return void 0;
+    }
+    return {
+      storePubkey: decoded.data.pubkey,
+      d: decoded.data.identifier,
+      relays: decoded.data.relays ?? []
+    };
+  } catch {
+    return void 0;
+  }
+}
+function priceInSubunits(price, asset) {
+  if (price.frequency !== void 0) {
+    throw new Error("A subscription price has no one-off amount");
+  }
+  if (price.currency !== "USD" || !USD_STABLE_TOKENS.includes(asset.token)) {
+    throw new Error(`A ${price.currency} price cannot be paid in ${asset.symbol} without a quote`);
+  }
+  return parseAssetAmount(asset, new Decimal(price.amount).toFixed());
+}
+
+// src/orders/messages.ts
+var ORDER_ID_RE = new RegExp(`^[A-Za-z0-9-]{8,${LIMITS.MAX_ORDER_ID_LENGTH}}$`);
+var ITEM_ADDRESS_RE = new RegExp(`^${KIND_PRODUCT}:[0-9a-f]{64}:[A-Za-z0-9._:-]{1,128}$`);
+var QUANTITY_RE = /^[1-9]\d{0,3}$/;
+var AMOUNT_RE = /^(0|[1-9]\d{0,11})(\.\d{1,18})?$/;
+var SUBUNITS_RE = /^(0|[1-9]\d{0,38})$/;
+var CURRENCY_RE2 = /^[A-Z]{3}$/;
+var MEDIUM_RE = /^[a-z0-9-]{1,32}$/;
+var TX_RE = /^[A-Za-z0-9]{1,128}$/;
+var EMAIL_RE = /^[^\s@]{1,64}@[^\s@]{1,255}$/;
+var ORDER_MESSAGE_TYPES = ["order", "payment_request", "status", "receipt"];
+var TYPE_ORDER = "1";
+var TYPE_PAYMENT_REQUEST = "2";
+var TYPE_STATUS = "3";
+function assertPubkey(value, name) {
+  if (!HEX_PUBKEY_RE.test(value)) {
+    throw new Error(`${name} must be 64 lowercase hex characters`);
+  }
+}
+function assertMatches(value, pattern, name) {
+  if (!pattern.test(value)) {
+    throw new Error(`Invalid ${name}: ${value}`);
+  }
+}
+function assertMoney(money) {
+  assertMatches(money.amount, AMOUNT_RE, "amount");
+  assertMatches(money.currency, CURRENCY_RE2, "currency");
+}
+function buildOrderMessage(message, createdAt = nowSecs()) {
+  if (!ORDER_MESSAGE_TYPES.some((known) => known === message.type)) {
+    throw new Error(`Unknown order message type: ${String(message.type)}`);
+  }
+  assertMatches(message.orderId, ORDER_ID_RE, "order id");
+  switch (message.type) {
+    case "order": {
+      assertPubkey(message.storePubkey, "storePubkey");
+      assertMoney(message.total);
+      if (message.items.length === 0 || message.items.length > LIMITS.MAX_ITEMS_PER_ORDER) {
+        throw new Error(`An order holds 1 to ${LIMITS.MAX_ITEMS_PER_ORDER} items`);
+      }
+      const tags = [
+        ["p", message.storePubkey],
+        ["subject", "order"],
+        ["type", TYPE_ORDER],
+        ["order", message.orderId]
+      ];
+      for (const item of message.items) {
+        assertMatches(item.product, ITEM_ADDRESS_RE, "item");
+        assertMatches(String(item.quantity), QUANTITY_RE, "quantity");
+        tags.push(["item", item.product, String(item.quantity)]);
+      }
+      tags.push(["amount", message.total.amount, message.total.currency]);
+      if (message.email !== void 0) {
+        assertMatches(message.email, EMAIL_RE, "email");
+        tags.push(["email", message.email]);
+      }
+      return { kind: KIND_ORDER_MESSAGE, created_at: createdAt, tags, content: "" };
+    }
+    case "payment_request": {
+      assertPubkey(message.buyerPubkey, "buyerPubkey");
+      assertMoney(message.total);
+      if (message.options.length === 0) {
+        throw new Error("A payment request offers at least one way to pay");
+      }
+      const tags = [
+        ["p", message.buyerPubkey],
+        ["type", TYPE_PAYMENT_REQUEST],
+        ["order", message.orderId],
+        ["amount", message.total.amount, message.total.currency]
+      ];
+      for (const option of message.options) {
+        assertMatches(option.medium, MEDIUM_RE, "payment medium");
+        if (option.payload.length === 0 || option.payload.length > LIMITS.MAX_TAG_VALUE_LENGTH * 4) {
+          throw new Error("Payment payload is empty or too long");
+        }
+        tags.push(["payment", option.medium, option.payload]);
+      }
+      return { kind: KIND_ORDER_MESSAGE, created_at: createdAt, tags, content: "" };
+    }
+    case "status": {
+      assertPubkey(message.buyerPubkey, "buyerPubkey");
+      if (!ORDER_STATUSES.some((status) => status === message.status)) {
+        throw new Error(`Invalid order status: ${message.status}`);
+      }
+      const tags = [
+        ["p", message.buyerPubkey],
+        ["type", TYPE_STATUS],
+        ["order", message.orderId],
+        ["status", message.status]
+      ];
+      if (message.delivery !== void 0) {
+        const { method, value } = message.delivery;
+        if (!DELIVERY_METHODS.some((known) => known === method)) {
+          throw new Error(`Invalid delivery method: ${method}`);
+        }
+        if (value.length === 0 || value.length > LIMITS.MAX_TAG_VALUE_LENGTH) {
+          throw new Error("Delivery value is empty or too long");
+        }
+        tags.push(["delivery", message.delivery.method, message.delivery.value]);
+      }
+      if (message.receipt !== void 0) {
+        assertMatches(message.receipt.medium, MEDIUM_RE, "receipt medium");
+        assertMatches(message.receipt.tx, TX_RE, "receipt tx");
+        assertMatches(message.receipt.amount, SUBUNITS_RE, "receipt amount");
+        assertMatches(message.receipt.fee, SUBUNITS_RE, "receipt fee");
+        tags.push([
+          "receipt",
+          message.receipt.medium,
+          message.receipt.tx,
+          message.receipt.amount,
+          message.receipt.fee
+        ]);
+      }
+      if (message.refund !== void 0) {
+        assertMatches(message.refund.tx, TX_RE, "refund tx");
+        assertMatches(message.refund.amount, SUBUNITS_RE, "refund amount");
+        tags.push(["refund", message.refund.tx, message.refund.amount]);
+      }
+      return { kind: KIND_ORDER_MESSAGE, created_at: createdAt, tags, content: "" };
+    }
+    case "receipt": {
+      assertPubkey(message.storePubkey, "storePubkey");
+      assertMatches(message.payment.medium, MEDIUM_RE, "payment medium");
+      assertMatches(message.payment.reference, TX_RE, "payment reference");
+      assertMatches(message.payment.tx, TX_RE, "payment tx");
+      return {
+        kind: KIND_PAYMENT_RECEIPT,
+        created_at: createdAt,
+        tags: [
+          ["p", message.storePubkey],
+          ["order", message.orderId],
+          ["payment", message.payment.medium, message.payment.reference, message.payment.tx]
+        ],
+        content: ""
+      };
+    }
+  }
+}
+function readMoney(tags) {
+  const tag = tagsNamed(tags, "amount")[0];
+  const amount = tag?.[1];
+  const currency = tag?.[2];
+  if (!amount || !AMOUNT_RE.test(amount) || !currency || !CURRENCY_RE2.test(currency)) {
+    return void 0;
+  }
+  return { amount, currency };
+}
+function readPubkey(tags) {
+  const value = tagValue(tags, "p");
+  return value !== void 0 && HEX_PUBKEY_RE.test(value) ? value : void 0;
+}
+function readOrderRequest(tags, orderId) {
+  const storePubkey = readPubkey(tags);
+  const total = readMoney(tags);
+  const itemTags = tagsNamed(tags, "item");
+  if (!storePubkey || !total || itemTags.length === 0 || itemTags.length > LIMITS.MAX_ITEMS_PER_ORDER) {
+    return void 0;
+  }
+  const items = [];
+  for (const tag of itemTags) {
+    const product = tag[1];
+    const quantity = tag[2] ?? "1";
+    if (!product || !ITEM_ADDRESS_RE.test(product) || !QUANTITY_RE.test(quantity)) {
+      return void 0;
+    }
+    items.push({ product, quantity: Number(quantity) });
+  }
+  const order = { type: "order", storePubkey, orderId, items, total };
+  const email = tagValue(tags, "email");
+  if (email !== void 0 && EMAIL_RE.test(email)) {
+    order.email = email;
+  }
+  return order;
+}
+function readPaymentRequest(tags, orderId) {
+  const buyerPubkey = readPubkey(tags);
+  const total = readMoney(tags);
+  if (!buyerPubkey || !total) {
+    return void 0;
+  }
+  const options = [];
+  for (const tag of tagsNamed(tags, "payment")) {
+    const medium = tag[1];
+    const payload = tag[2];
+    if (medium && MEDIUM_RE.test(medium) && payload) {
+      options.push({ medium, payload });
+    }
+  }
+  if (options.length === 0) {
+    return void 0;
+  }
+  return { type: "payment_request", buyerPubkey, orderId, total, options };
+}
+function readStatus(tags, orderId) {
+  const buyerPubkey = readPubkey(tags);
+  const statusValue = tagValue(tags, "status");
+  const status = ORDER_STATUSES.find((candidate) => candidate === statusValue);
+  if (!buyerPubkey || !status) {
+    return void 0;
+  }
+  const message = { type: "status", buyerPubkey, orderId, status };
+  const deliveryTag = tagsNamed(tags, "delivery")[0];
+  const method = DELIVERY_METHODS.find((candidate) => candidate === deliveryTag?.[1]);
+  const deliveryValue = deliveryTag?.[2];
+  if (method && deliveryValue && deliveryValue.length <= LIMITS.MAX_TAG_VALUE_LENGTH) {
+    message.delivery = { method, value: deliveryValue };
+  }
+  const receiptTag = tagsNamed(tags, "receipt")[0];
+  const [, medium, tx, amount, fee] = receiptTag ?? [];
+  if (medium && MEDIUM_RE.test(medium) && tx && TX_RE.test(tx) && amount && SUBUNITS_RE.test(amount) && fee && SUBUNITS_RE.test(fee)) {
+    message.receipt = { medium, tx, amount, fee };
+  }
+  const refundTag = tagsNamed(tags, "refund")[0];
+  const [, refundTx, refundAmount] = refundTag ?? [];
+  if (refundTx && TX_RE.test(refundTx) && refundAmount && SUBUNITS_RE.test(refundAmount)) {
+    message.refund = { tx: refundTx, amount: refundAmount };
+  }
+  return message;
+}
+function readReceipt(tags, orderId) {
+  const storePubkey = readPubkey(tags);
+  const [, medium, reference, tx] = tagsNamed(tags, "payment")[0] ?? [];
+  if (!storePubkey || !medium || !MEDIUM_RE.test(medium) || !reference || !TX_RE.test(reference) || !tx || !TX_RE.test(tx)) {
+    return void 0;
+  }
+  return { type: "receipt", storePubkey, orderId, payment: { medium, reference, tx } };
+}
+function parseOrderMessage(rumor) {
+  const orderId = tagValue(rumor.tags, "order");
+  if (orderId === void 0 || !ORDER_ID_RE.test(orderId)) {
+    return void 0;
+  }
+  if (rumor.kind === KIND_PAYMENT_RECEIPT) {
+    return readReceipt(rumor.tags, orderId);
+  }
+  if (rumor.kind !== KIND_ORDER_MESSAGE) {
+    return void 0;
+  }
+  switch (tagValue(rumor.tags, "type")) {
+    case TYPE_ORDER:
+      return readOrderRequest(rumor.tags, orderId);
+    case TYPE_PAYMENT_REQUEST:
+      return readPaymentRequest(rumor.tags, orderId);
+    case TYPE_STATUS:
+      return readStatus(rumor.tags, orderId);
+    default:
+      return void 0;
+  }
+}
+function isGenuineEvent(event) {
+  if (!isEventShaped(event)) {
+    return false;
+  }
+  return verifyEvent({
+    id: event.id,
+    pubkey: event.pubkey,
+    created_at: event.created_at,
+    kind: event.kind,
+    tags: event.tags,
+    content: event.content,
+    sig: event.sig
+  });
+}
+function isEventShaped(event) {
+  if (typeof event !== "object" || event === null) {
+    return false;
+  }
+  const record = { ...event };
+  const { id, pubkey, created_at: createdAt, kind, tags, content, sig } = record;
+  return typeof id === "string" && typeof pubkey === "string" && typeof createdAt === "number" && Number.isInteger(createdAt) && typeof kind === "number" && Number.isInteger(kind) && typeof content === "string" && typeof sig === "string" && Array.isArray(tags) && tags.every((tag) => Array.isArray(tag) && tag.every((item) => typeof item === "string"));
+}
+
+// src/orders/gift-wrap.ts
+function wrapOrderMessage(rumor, senderSecretKey, recipientPubkey) {
+  if (!HEX_PUBKEY_RE.test(recipientPubkey)) {
+    throw new Error("recipientPubkey must be 64 lowercase hex characters");
+  }
+  if (rumor.kind !== KIND_ORDER_MESSAGE && rumor.kind !== KIND_PAYMENT_RECEIPT) {
+    throw new Error(`Not an order message kind: ${rumor.kind}`);
+  }
+  const wraps = nip59.wrapManyEvents(rumor, senderSecretKey, [recipientPubkey]);
+  const selfWrap = wraps[0];
+  const recipientWrap = wraps[1];
+  if (!selfWrap || !recipientWrap) {
+    throw new Error("Unexpected wrap count from nip59.wrapManyEvents");
+  }
+  const rumorId = getEventHash({ ...rumor, pubkey: getPublicKey(senderSecretKey) });
+  return { recipientWrap, selfWrap, rumorId };
+}
+function isStringArrayArray(value) {
+  return Array.isArray(value) && value.every((entry) => Array.isArray(entry) && entry.every((item) => typeof item === "string"));
+}
+function parseEventJson(json) {
+  let shape;
+  try {
+    shape = JSON.parse(json);
+  } catch {
+    return void 0;
+  }
+  if (typeof shape !== "object" || shape === null) {
+    return void 0;
+  }
+  const record = { ...shape };
+  const { id, pubkey, created_at: createdAt, kind, tags, content, sig } = record;
+  if (typeof id !== "string" || typeof pubkey !== "string" || typeof createdAt !== "number" || !Number.isInteger(createdAt) || createdAt < 0 || typeof kind !== "number" || typeof content !== "string" || content.length > LIMITS.MAX_CONTENT_LENGTH || !isStringArrayArray(tags)) {
+    return void 0;
+  }
+  const parsed = { id, pubkey, created_at: createdAt, kind, tags, content };
+  if (typeof sig === "string") {
+    parsed.sig = sig;
+  }
+  return parsed;
+}
+function decrypt(payload, secretKey, senderPubkey) {
+  return nip44.v2.decrypt(payload, nip44.v2.utils.getConversationKey(secretKey, senderPubkey));
+}
+function unwrapOrderMessage(wrap, recipientSecretKey) {
+  try {
+    if (wrap.kind !== KIND_GIFT_WRAP || !isGenuineEvent(wrap)) {
+      return void 0;
+    }
+    const seal = parseEventJson(decrypt(wrap.content, recipientSecretKey, wrap.pubkey));
+    if (!seal || seal.kind !== KIND_SEAL || seal.sig === void 0 || seal.tags.length > 0) {
+      return void 0;
+    }
+    const signedSeal = { ...seal, sig: seal.sig };
+    if (!isGenuineEvent(signedSeal)) {
+      return void 0;
+    }
+    const rumor = parseEventJson(decrypt(seal.content, recipientSecretKey, seal.pubkey));
+    if (!rumor || rumor.sig !== void 0 || rumor.pubkey !== seal.pubkey || rumor.id !== getEventHash(rumor)) {
+      return void 0;
+    }
+    if (rumor.created_at > nowSecs() + MAX_FUTURE_SKEW_SECS) {
+      return void 0;
+    }
+    const recipientPubkey = tagValue(rumor.tags, "p");
+    const message = parseOrderMessage(rumor);
+    if (recipientPubkey === void 0 || !message) {
+      return void 0;
+    }
+    return {
+      rumorId: rumor.id,
+      senderPubkey: rumor.pubkey,
+      recipientPubkey,
+      createdAt: rumor.created_at,
+      message
+    };
+  } catch {
+    return void 0;
+  }
+}
+
+// src/verify-offer.ts
+function refuse(refusal, message) {
+  return { ok: false, refusal, message };
+}
+function newestSigned(events, kind, author, now, d) {
+  let newest;
+  for (const event of events) {
+    if (!isEventShaped(event) || event.kind !== kind || event.pubkey !== author || event.created_at > now + MAX_FUTURE_SKEW_SECS || d !== void 0 && tagValue(event.tags, "d") !== d) {
+      continue;
+    }
+    if (newest && (event.created_at < newest.created_at || event.created_at === newest.created_at && event.id >= newest.id)) {
+      continue;
+    }
+    if (isGenuineEvent(event)) {
+      newest = event;
+    }
+  }
+  return newest;
+}
+var NO_FUTURE_LIMIT = Number.POSITIVE_INFINITY;
+function newestDeletion(events, address, author, now) {
+  return newestSigned(
+    events.filter((event) => isEventShaped(event) && tagValues(event.tags, "a").includes(address)),
+    KIND_DELETION,
+    author,
+    now
+  );
+}
+function isLapsed(event, now) {
+  const state = expirationState(event.tags, now);
+  return state === "expired" || state === "malformed";
+}
+function originMatchesDomain(pageOrigin, domain) {
+  let url;
+  try {
+    url = new URL(pageOrigin);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return host === domain || host.endsWith(`.${domain}`);
+}
+function resolveAnchor(storePubkey, profile, bundle, options) {
+  const warnings = [];
+  const nip05 = profile.nip05 === void 0 ? void 0 : splitNip05(profile.nip05);
+  const hosted = nip05 !== void 0 && (options.hostedDomains ?? []).includes(nip05.domain);
+  const keys = typeof bundle.domain === "object" ? bundle.domain : void 0;
+  let hostedDomain;
+  const txtForAnotherName = nip05 !== void 0 && keys !== void 0 && keys.source === "dns" && nip05.local !== "_" && keys.storePubkey !== storePubkey;
+  if (nip05 && keys && keys.domain === nip05.domain && keys.name === nip05.local && keys.storePubkey !== void 0 && !txtForAnotherName) {
+    if (keys.storePubkey !== storePubkey) {
+      return refuse("domain_mismatch", `${nip05.domain} does not name this store`);
+    }
+    const domainWide = nip05.local === "_" || keys.source === "dns";
+    if (!hosted && domainWide && keys.ownerPubkey && profile.ownerPubkey !== void 0) {
+      if (profile.ownerPubkey !== keys.ownerPubkey) {
+        return refuse("owner_mismatch", "The store profile and its domain name different owners");
+      }
+      return {
+        level: "A",
+        domain: nip05.domain,
+        ownerPubkey: keys.ownerPubkey,
+        ownerFromDomain: true,
+        warnings
+      };
+    }
+    if (hosted) {
+      hostedDomain = nip05.domain;
+    } else {
+      warnings.push("domain_unverified");
+    }
+  } else if (profile.nip05 !== void 0) {
+    warnings.push("domain_unverified");
+  }
+  if (!profile.ownerPubkey) {
+    return refuse("owner_unknown", "The store profile names no owner");
+  }
+  if (hostedDomain !== void 0) {
+    return {
+      level: "B",
+      domain: hostedDomain,
+      ownerPubkey: profile.ownerPubkey,
+      ownerFromDomain: false,
+      warnings
+    };
+  }
+  return { level: "C", ownerPubkey: profile.ownerPubkey, ownerFromDomain: false, warnings };
+}
+function evaluateOffer(pointer, bundle, options = {}) {
+  const now = options.now ?? nowSecs();
+  const { storePubkey } = pointer;
+  const productEvent = newestSigned(bundle.events, KIND_PRODUCT, storePubkey, now, pointer.d);
+  const product = productEvent && !isLapsed(productEvent, now) ? parseProduct(productEvent) : void 0;
+  if (!product) {
+    return refuse("product_missing", "No valid, unexpired listing signed by the store");
+  }
+  const productDeletion = newestDeletion(
+    bundle.events,
+    productAddress(product),
+    storePubkey,
+    NO_FUTURE_LIMIT
+  );
+  if (productDeletion !== void 0 && productDeletion.created_at >= product.createdAt) {
+    return refuse("product_missing", "The store deleted this listing");
+  }
+  if (!isPurchasable(product)) {
+    return refuse("product_not_on_sale", `The listing is ${product.visibility}`);
+  }
+  const profileEvent = newestSigned(bundle.events, KIND_STORE_PROFILE, storePubkey, now);
+  const profile = profileEvent && !isLapsed(profileEvent, now) ? parseStoreProfile(profileEvent) : void 0;
+  if (!profile) {
+    return refuse("store_profile_missing", "No valid, unexpired profile signed by the store");
+  }
+  const anchor = resolveAnchor(storePubkey, profile, bundle, options);
+  if ("ok" in anchor) {
+    return anchor;
+  }
+  const { ownerPubkey } = anchor;
+  const warnings = [...anchor.warnings];
+  if (options.pinnedOwnerPubkey !== void 0 && options.pinnedOwnerPubkey !== ownerPubkey) {
+    return refuse(
+      "owner_pin_mismatch",
+      "The store now names a different owner than at the first purchase"
+    );
+  }
+  if (options.pinnedOwnerPubkey === void 0) {
+    warnings.push("owner_unpinned");
+  }
+  const authEvent = newestSigned(bundle.events, KIND_STORE_AUTH, ownerPubkey, now, storePubkey);
+  const auth = authEvent ? readStoreAuth(authEvent, storePubkey, now) : void 0;
+  const deletion = newestDeletion(
+    bundle.events,
+    storeAuthAddress(ownerPubkey, storePubkey),
+    ownerPubkey,
+    NO_FUTURE_LIMIT
+  );
+  const revocation = newestSigned(
+    bundle.events.filter(
+      (event) => isEventShaped(event) && readStoreAuth(event, storePubkey, now).status === "revoked"
+    ),
+    KIND_STORE_AUTH,
+    ownerPubkey,
+    NO_FUTURE_LIMIT,
+    storePubkey
+  );
+  const revokedAfter = (event) => event !== void 0 && (!authEvent || event.created_at >= authEvent.created_at);
+  if (auth?.status === "revoked" || revokedAfter(deletion) || revokedAfter(revocation)) {
+    return refuse("store_auth_revoked", "The owner revoked this store key");
+  }
+  if (auth?.status === "expired") {
+    return refuse("store_auth_expired", "The owner's authorization of this store key expired");
+  }
+  if (auth?.status === "malformed") {
+    return refuse(
+      "store_auth_missing",
+      "The owner's newest authorization of this store key is malformed"
+    );
+  }
+  if (!anchor.ownerFromDomain && auth?.status !== "active") {
+    return refuse("store_auth_missing", "The owner has not authorized this store key");
+  }
+  if (options.strictOrigin && options.pageOrigin === void 0) {
+    return refuse("origin_mismatch", "Strict mode needs the origin of the embedding page");
+  }
+  if (options.pageOrigin !== void 0) {
+    if (anchor.level !== "A" || anchor.domain === void 0) {
+      if (options.strictOrigin) {
+        return refuse("origin_mismatch", "The store has no verified domain to match this page");
+      }
+      warnings.push("origin_unverifiable");
+    } else if (!originMatchesDomain(options.pageOrigin, anchor.domain)) {
+      if (options.strictOrigin) {
+        return refuse("origin_mismatch", `This page is not on ${anchor.domain}`);
+      }
+      warnings.push("origin_mismatch");
+    }
+  }
+  const paytoEvent = newestSigned(bundle.events, KIND_PAYTO, ownerPubkey, now);
+  if (!paytoEvent || isLapsed(paytoEvent, now)) {
+    return refuse("payto_missing", "The owner has no current payout addresses");
+  }
+  const accepted = new Set(product.accept);
+  const payouts = parsePayto(paytoEvent).targets.filter((target) => accepted.has(target.caip19.id));
+  if (payouts.length === 0) {
+    return refuse(
+      "no_payout_for_accepted_assets",
+      "The owner has no payout address for any asset this product accepts"
+    );
+  }
+  const paytoAge = now - Math.max(paytoEvent.created_at, options.paytoFirstSeenAt ?? 0);
+  if (paytoAge < (options.cooldownSecs ?? PAYOUT_COOLDOWN_SECS)) {
+    warnings.push("payout_recently_changed");
+  }
+  const knownPayouts = options.knownPayouts;
+  if (knownPayouts !== void 0 && payouts.some(
+    (target) => !knownPayouts.some(
+      (known) => known.caip19 === target.caip19.id && canonicalPayoutAddress(target.caip19.chain, known.address) === target.address
+    )
+  )) {
+    warnings.push("payout_changed");
+  }
+  if (payouts.some((target) => !target.walletSigned)) {
+    warnings.push("payout_unsigned");
+  }
+  const offer = {
+    level: anchor.level,
+    storePubkey,
+    ownerPubkey,
+    profile,
+    product,
+    payouts,
+    paytoCreatedAt: paytoEvent.created_at,
+    warnings
+  };
+  if (anchor.domain !== void 0) {
+    offer.domain = anchor.domain;
+  }
+  return { ok: true, offer };
+}
+function isOfferPayout(offer, caip19, recipient) {
+  const asset = parseCaip19(caip19);
+  if (!asset) {
+    return false;
+  }
+  const canonical = canonicalPayoutAddress(asset.chain, recipient);
+  return canonical !== void 0 && offer.payouts.some((target) => target.caip19.id === caip19 && target.address === canonical);
+}
+async function resolveOrUnreachable(resolve, nip05) {
+  try {
+    return await resolve(nip05);
+  } catch {
+    return void 0;
+  }
+}
+async function verifyOffer(naddr, deps, options = {}) {
+  const pointer = decodeProductNaddr(naddr);
+  if (!pointer) {
+    return refuse("bad_pointer", "Not a product naddr");
+  }
+  const { storePubkey, d } = pointer;
+  const storeEvents = await deps.fetchEvents([
+    { kinds: [KIND_PRODUCT], authors: [storePubkey], "#d": [d] },
+    { kinds: [KIND_STORE_PROFILE], authors: [storePubkey] },
+    { kinds: [KIND_DELETION], authors: [storePubkey], "#a": [productAddress({ storePubkey, d })] }
+  ]);
+  const now = options.now ?? nowSecs();
+  const profileEvent = newestSigned(storeEvents, KIND_STORE_PROFILE, storePubkey, now);
+  const profile = profileEvent ? parseStoreProfile(profileEvent) : void 0;
+  let domain;
+  if (profile?.nip05 !== void 0) {
+    const resolve = deps.resolveDomain ?? ((nip05) => resolveDomainKeys(nip05, deps));
+    domain = splitNip05(profile.nip05) === void 0 ? "unreachable" : await resolveOrUnreachable(resolve, profile.nip05) ?? "unreachable";
+  }
+  const owners = /* @__PURE__ */ new Set();
+  if (profile?.ownerPubkey) {
+    owners.add(profile.ownerPubkey);
+  }
+  if (typeof domain === "object" && domain.ownerPubkey) {
+    owners.add(domain.ownerPubkey);
+  }
+  const ownerEvents = owners.size === 0 ? [] : await deps.fetchEvents([
+    { kinds: [KIND_PAYTO], authors: [...owners] },
+    { kinds: [KIND_STORE_AUTH], authors: [...owners], "#d": [storePubkey] },
+    {
+      kinds: [KIND_DELETION],
+      authors: [...owners],
+      "#a": [...owners].map((owner) => storeAuthAddress(owner, storePubkey))
+    }
+  ]);
+  const ownerKinds = [KIND_PAYTO, KIND_STORE_AUTH, KIND_DELETION];
+  const ownerOnly = ownerEvents.filter(
+    (event) => isEventShaped(event) && owners.has(event.pubkey) && ownerKinds.includes(event.kind)
+  );
+  const bundle = { events: [...storeEvents, ...ownerOnly] };
+  if (domain !== void 0) {
+    bundle.domain = domain;
+  }
+  return evaluateOffer({ storePubkey, d }, bundle, { ...options, now });
+}
+
+export { DELIVERY_METHODS, ELISYM_NETWORK_TAG, KIND_DELETION, KIND_GIFT_WRAP, KIND_INBOX_RELAYS, KIND_ORDER_MESSAGE, KIND_PAYMENT_RECEIPT, KIND_PAYTO, KIND_PRODUCT, KIND_SEAL, KIND_STORE_AUTH, KIND_STORE_PROFILE, LIMITS, MAX_FUTURE_SKEW_SECS, ORDER_STATUSES, PAYOUT_COOLDOWN_SECS, PAYTO_PROOF_PREFIX, PURCHASABLE_VISIBILITIES, buildOrderMessage, buildPaytoEvent, buildProductEvent, buildStoreAuthEvent, buildStoreProfileEvent, buildStoreRevocationEvent, canonicalPayoutAddress, decodeProductNaddr, eip191Hash, encodeProductNaddr, evaluateOffer, hasValidEvmChecksum, isOfferPayout, isPublicHostname, isPurchasable, parseCaip19, parseOrderMessage, parsePayto, parseProduct, parseStoreProfile, paytoProofMessage, priceInSubunits, productAddress, readElisymTxt, readNostrJson, readStoreAuth, resolveDomainKeys, splitNip05, storeAuthAddress, unwrapOrderMessage, verifyOffer, verifyPaytoProof, wrapOrderMessage };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map