@elisym/merchant-node 0.1.0 → 0.3.0

package/dist/cli.js

@@ -1,16 +1,18 @@
 #!/usr/bin/env node
-import { existsSync, writeFileSync, readFileSync, statSync, renameSync, linkSync, rmSync, utimesSync, mkdirSync, chmodSync } from 'node:fs';
-import { LIMITS, DELIVERY_METHODS, splitNip05, parseCaip19, canonicalPayoutAddress, priceInSubunits, isPublicHostname, KIND_PAYTO, KIND_PRODUCT, KIND_INBOX_RELAYS, buildProductEvent, buildStoreProfileEvent, buildPaytoEvent, buildStoreAuthEvent, encodeProductNaddr, MAX_FUTURE_SKEW_SECS, unwrapOrderMessage, productAddress, wrapOrderMessage, buildOrderMessage, KIND_GIFT_WRAP, deriveOrderPaymentReference, parsePayto, parseProduct } from '@elisym/commerce';
-import { createSolanaRpc, address, isSignature } from '@solana/kit';
+import { existsSync, writeFileSync, readFileSync, renameSync, statSync, linkSync, rmSync, utimesSync, mkdirSync, chmodSync } from 'node:fs';
+import { createInterface } from 'node:readline/promises';
+import { LIMITS, DELIVERY_METHODS, splitNip05, parseCaip19, canonicalPayoutAddress, priceInSubunits, isPublicHostname, KIND_PAYTO, KIND_PRODUCT, KIND_INBOX_RELAYS, buildOrderMessage, wrapOrderMessage, buildProductEvent, buildStoreProfileEvent, buildPaytoEvent, buildStoreAuthEvent, encodeProductNaddr, MAX_FUTURE_SKEW_SECS, unwrapOrderMessage, productAddress, KIND_GIFT_WRAP, deriveOrderPaymentReference, parsePayto, parseProduct } from '@elisym/commerce';
+import { createSolanaRpc, isSignature, address } from '@solana/kit';
 import { SimplePool } from 'nostr-tools/pool';
 import { getPublicKey, generateSecretKey, finalizeEvent } from 'nostr-tools/pure';
+import { EVM_ASSETS, chainByCaip2, composeSolanaPaymentRequest, verifyDirectSolanaPayment, listReferenceSignatures, directInstructionsFromRpcTransaction, ELISYM_PROTOCOL_TAG, boundTransferAmount } from '@elisym/pay-core';
+import { TEMPO_UNPAYABLE_ADDRESSES, createJsonRpcClient, readTempoReceiptLegs, listTempoLogs, composeTempoPaymentRequest, verifyTempoPayment, readFinalizedBlock, readBlockByNumber } from '@elisym/pay-core/evm';
 import Decimal from 'decimal.js-light';
 import { z } from 'zod';
 import { randomBytes } from 'node:crypto';
 import { homedir } from 'node:os';
 import { resolve, join } from 'node:path';
 import { hexToBytes, bytesToHex } from 'nostr-tools/utils';
-import { composeSolanaPaymentRequest, verifyDirectSolanaPayment, listReferenceSignatures, directInstructionsFromRpcTransaction, ELISYM_PROTOCOL_TAG, boundTransferAmount } from '@elisym/pay-core';
 import { findAssociatedTokenPda, TOKEN_PROGRAM_ADDRESS } from '@solana-program/token';
 
 // src/constants.ts
@@ -153,13 +155,13 @@ async function checkDomain(domain, expected, fetcher = fetch) {
   }
   return { url, ok: true };
 }
-function offersNotHonoured(listing, payoutList, network, standing) {
+function offersNotHonoured(listing, payoutList, network, standing, tempoNetwork) {
   if (listing === void 0 && payoutList === void 0) {
     return void 0;
   }
   const targets = payoutList === void 0 ? [] : parsePayto(payoutList).targets;
   const found = targets.filter(
-    (target) => target.caip19.chain.family !== "solana" || target.caip19.chain.network !== network || !standing.some(
+    (target) => (target.caip19.chain.family === "solana" ? target.caip19.chain.network !== network : target.caip19.chain.family !== "evm" || tempoNetwork === void 0 || target.caip19.chain.network !== tempoNetwork) || !standing.some(
       (terms) => terms.caip19 === target.caip19.id && terms.payout === target.address
     )
   ).map((target) => `${target.caip19.id} ${target.address}`);
@@ -200,14 +202,20 @@ function inboxRelaysNotRead(inboxList, read) {
   }
   return listed.slice(0, CHECKOUT_INBOX_CAP).filter((relay) => !reading.includes(relay));
 }
-function offerProblems(views, inboxRelays, network, standing) {
+function offerProblems(views, inboxRelays, network, standing, tempoNetwork) {
   const problems = /* @__PURE__ */ new Set();
   let served = false;
   for (const view of views) {
     for (const relay of inboxRelaysNotRead(view.inboxList, inboxRelays) ?? []) {
       problems.add(`orders sent to ${relay}, which this node does not read`);
     }
-    const notHonoured = offersNotHonoured(view.listing, view.payoutList, network, standing);
+    const notHonoured = offersNotHonoured(
+      view.listing,
+      view.payoutList,
+      network,
+      standing,
+      tempoNetwork
+    );
     served ||= notHonoured !== void 0;
     for (const offer of notHonoured ?? []) {
       problems.add(offer);
@@ -279,7 +287,11 @@ var configSchema = z.object({
     message: 'cannot use the name "owner" (it names the owner key)'
   }).optional(),
   network: z.enum(["mainnet", "devnet"]),
-  rpcUrl: urlWith("https:", "http:"),
+  rpcUrl: urlWith("https:", "http:").optional(),
+  tempo: z.object({
+    network: z.enum(["mainnet", "moderato"]),
+    rpcUrl: urlWith("https:", "http:").optional()
+  }).strict().optional(),
   inboxRelays: z.array(
     urlWith("wss:", "ws:").refine(
       (value) => value.startsWith("ws:") || checkoutRelaySpelling(value) !== void 0,
@@ -320,30 +332,58 @@ var configSchema = z.object({
     }
   });
   const seen = /* @__PURE__ */ new Set();
+  let solanaPayouts = 0;
   config.payouts.forEach((payout, index) => {
     const path = ["payouts", index];
     const caip19 = parseCaip19(payout.caip19);
-    if (caip19 === void 0 || caip19.chain.family !== "solana") {
+    if (caip19 === void 0) {
       context.addIssue({
         code: "custom",
         path: [...path, "caip19"],
-        message: "must be a Solana coin this node can verify"
+        message: "must be a coin this node can verify"
       });
       return;
     }
-    if (caip19.chain.network !== config.network) {
-      context.addIssue({
-        code: "custom",
-        path: [...path, "caip19"],
-        message: `is on ${caip19.chain.network}, the node runs on ${config.network}`
-      });
-    }
-    if (canonicalPayoutAddress(caip19.chain, payout.address) !== payout.address) {
-      context.addIssue({
-        code: "custom",
-        path: [...path, "address"],
-        message: "is not a Solana address"
-      });
+    if (caip19.chain.family === "evm") {
+      if (config.tempo === void 0) {
+        context.addIssue({
+          code: "custom",
+          path: [...path, "caip19"],
+          message: 'is a Tempo coin: add a "tempo" block for the node to verify it'
+        });
+        return;
+      }
+      const wanted = tempoRegistryNetwork(config.tempo.network);
+      if (caip19.chain.network !== wanted) {
+        context.addIssue({
+          code: "custom",
+          path: [...path, "caip19"],
+          message: `is not on Tempo ${config.tempo.network}`
+        });
+      }
+      if (canonicalPayoutAddress(caip19.chain, payout.address) !== payout.address || !isPayableTempoAddress(payout.address)) {
+        context.addIssue({
+          code: "custom",
+          path: [...path, "address"],
+          message: "is not a Tempo address a payment can go to (lowercase 0x, not a system or coin address)"
+        });
+      }
+    } else {
+      solanaPayouts += 1;
+      if (caip19.chain.network !== config.network) {
+        context.addIssue({
+          code: "custom",
+          path: [...path, "caip19"],
+          message: `is on ${caip19.chain.network}, the node runs on ${config.network}`
+        });
+      }
+      if (canonicalPayoutAddress(caip19.chain, payout.address) !== payout.address) {
+        context.addIssue({
+          code: "custom",
+          path: [...path, "address"],
+          message: "is not a Solana address"
+        });
+      }
     }
     const price = config.product.priceUsd;
     if (PRICE_RE.test(price) && new Decimal(price).gt(0)) {
@@ -366,7 +406,30 @@ var configSchema = z.object({
     }
     seen.add(caip19.id);
   });
+  if (config.tempo !== void 0 && tempoRegistryNetwork(config.tempo.network) !== config.network) {
+    context.addIssue({
+      code: "custom",
+      path: ["tempo", "network"],
+      message: `is ${config.tempo.network}, the node runs on ${config.network}: use network "mainnet" with Tempo "mainnet", or network "devnet" with Tempo "moderato"`
+    });
+  }
+  if (solanaPayouts > 0 && config.rpcUrl === void 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["rpcUrl"],
+      message: "is required with a Solana payout"
+    });
+  }
 });
+function tempoRegistryNetwork(network) {
+  return network === "mainnet" ? "mainnet" : "devnet";
+}
+function isPayableTempoAddress(address2) {
+  const coins = EVM_ASSETS.flatMap(
+    (coin) => coin.mint === void 0 ? [] : [coin.mint.toLowerCase()]
+  );
+  return !TEMPO_UNPAYABLE_ADDRESSES.includes(address2) && !coins.includes(address2);
+}
 function parseConfig(value) {
   const parsed = configSchema.safeParse(value);
   if (parsed.success) {
@@ -414,6 +477,155 @@ function configTemplate(network) {
     payouts: [{ caip19: usdc, address: "<your Solana wallet address>" }]
   };
 }
+function emptyLedger() {
+  return { version: 1, orders: {}, seenRumors: {}, claims: {}, terms: [], scans: {} };
+}
+function orderKey(buyerPubkey, orderId) {
+  return `${buyerPubkey}:${orderId}`;
+}
+function claimPayment(state, signature, key) {
+  const holder = state.claims[signature];
+  if (holder !== void 0 && holder !== key) {
+    return false;
+  }
+  state.claims[signature] = key;
+  return true;
+}
+function openOrders(state, now, catchUpSecs) {
+  return Object.values(state.orders).filter(
+    (order) => order.paid === void 0 && now - order.createdAt <= catchUpSecs
+  );
+}
+function undeliveredOrders(state) {
+  return Object.values(state.orders).filter(
+    (order) => order.paid !== void 0 && order.deliveredAt === void 0
+  );
+}
+function pruneExpiredOrders(state, now) {
+  for (const [key, order] of Object.entries(state.orders)) {
+    if (order.paid === void 0 && now - order.createdAt > CATCH_UP_SECS + MAX_FUTURE_SKEW_SECS) {
+      delete state.orders[key];
+      (state.closedOrders ??= {})[key] = true;
+    }
+  }
+}
+function recordReport(order, tx, arrivedAt) {
+  order.reportedTxs.push(tx);
+  order.recheckedAt = { ...order.recheckedAt, [tx]: arrivedAt };
+}
+function loadLedger(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return emptyLedger();
+  }
+  const state = JSON.parse(text);
+  if (state.version !== 1 && state.version !== 2) {
+    throw new Error(`Unknown ledger version in ${path}`);
+  }
+  state.scans ??= {};
+  return state;
+}
+function markTempo(state) {
+  state.version = 2;
+}
+function saveLedger(path, state) {
+  const temporary = `${path}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+  renameSync(temporary, path);
+}
+function isSolanaSignature(value) {
+  try {
+    return isSignature(value);
+  } catch {
+    return false;
+  }
+}
+
+// src/hand.ts
+var TEMPO_HASH_RE = /^0x[0-9a-f]{64}$/;
+var POSITIVE_SUBUNITS_RE = /^[1-9]\d{0,38}$/;
+function isRefundTx(tx) {
+  return TEMPO_HASH_RE.test(tx) || isSolanaSignature(tx);
+}
+function planHandAnswer(state, key, request) {
+  const [buyerPubkey, orderId] = key.split(":");
+  if (buyerPubkey === void 0 || orderId === void 0 || key.split(":").length !== 2) {
+    return { ok: false, problem: `${key} is not <buyer>:<orderId>` };
+  }
+  if (request.kind === "refunded") {
+    if (!isRefundTx(request.tx)) {
+      return { ok: false, problem: "the refund tx is neither a Solana signature nor a Tempo hash" };
+    }
+    if (!POSITIVE_SUBUNITS_RE.test(request.amount)) {
+      return {
+        ok: false,
+        problem: "the refund amount must be subunits above 0 (an unpaid order is released with deliver, never a zero refund)"
+      };
+    }
+  }
+  const stored = state.answeredByHand?.[key];
+  if (stored !== void 0) {
+    if (stored.kind !== request.kind) {
+      return {
+        ok: false,
+        problem: `${key} was already answered as ${stored.kind}: the other answer is refused`
+      };
+    }
+    return { ok: true, answer: stored, buyerPubkey, orderId, rerun: true };
+  }
+  const order = state.orders[key];
+  if (order === void 0 && state.closedOrders?.[key] !== true) {
+    return { ok: false, problem: `no order ${key} in the ledger` };
+  }
+  if (order?.paid !== void 0) {
+    return {
+      ok: false,
+      problem: `${key} is paid: the node delivers it itself (a refund of a delivered order is not handled here)`
+    };
+  }
+  const answer = {
+    kind: request.kind,
+    ...request.kind === "delivered" ? { delivery: { ...request.delivery } } : { tx: request.tx, amount: request.amount },
+    reportedTxs: [...order?.reportedTxs ?? []],
+    refusedTxs: [...order?.refusedTxs ?? []],
+    noLegTxs: [...order?.noLegTxs ?? []]
+  };
+  return { ok: true, answer, buyerPubkey, orderId, rerun: false };
+}
+function applyHandAnswer(state, key, answer) {
+  delete state.orders[key];
+  (state.closedOrders ??= {})[key] = true;
+  (state.answeredByHand ??= {})[key] = answer;
+  if (answer.tx !== void 0 && TEMPO_HASH_RE.test(answer.tx)) {
+    markTempo(state);
+  }
+}
+function buildHandAnswer(plan, storeSecretKey, createdAt) {
+  const { answer } = plan;
+  if (answer.kind === "delivered" && answer.delivery === void 0) {
+    throw new Error("A hand delivery carries what was delivered");
+  }
+  const rumor = buildOrderMessage(
+    answer.kind === "delivered" ? {
+      type: "status",
+      buyerPubkey: plan.buyerPubkey,
+      orderId: plan.orderId,
+      status: "completed",
+      ...answer.delivery === void 0 ? {} : { delivery: answer.delivery }
+    } : {
+      type: "status",
+      buyerPubkey: plan.buyerPubkey,
+      orderId: plan.orderId,
+      status: "cancelled",
+      refund: { tx: answer.tx ?? "", amount: answer.amount ?? "" }
+    },
+    createdAt
+  );
+  return wrapOrderMessage(rumor, storeSecretKey, plan.buyerPubkey);
+}
 var HOME_ENV = "ELISYM_MERCHANT_HOME";
 var DEFAULT_HOME_NAME = ".elisym-merchant";
 function merchantHome(flag, env = process.env) {
@@ -551,68 +763,401 @@ function takeLock(home, options = {}) {
   process.once("exit", release);
   return release;
 }
-function emptyLedger() {
-  return { version: 1, orders: {}, seenRumors: {}, claims: {}, terms: [], scans: {} };
-}
-function orderKey(buyerPubkey, orderId) {
-  return `${buyerPubkey}:${orderId}`;
+
+// src/terms.ts
+function sameTerms(left, right) {
+  return left.caip19 === right.caip19 && left.payout === right.payout && left.amount === right.amount;
 }
-function claimPayment(state, signature, key) {
-  const holder = state.claims[signature];
-  if (holder !== void 0 && holder !== key) {
-    return false;
+function publishTerms(periods, terms, at) {
+  const standing = periods.find(
+    (period) => period.until === void 0 && period.terms.caip19 === terms.caip19
+  );
+  if (standing !== void 0 && sameTerms(standing.terms, terms)) {
+    return [...periods];
   }
-  state.claims[signature] = key;
-  return true;
+  return [
+    ...periods.map(
+      (period) => period === standing ? { ...period, until: Math.max(at, period.from) } : period
+    ),
+    { terms, from: at }
+  ];
 }
-function openOrders(state, now, catchUpSecs) {
-  return Object.values(state.orders).filter(
-    (order) => order.paid === void 0 && now - order.createdAt <= catchUpSecs
+function retireTerms(periods, offered, at) {
+  return periods.map(
+    (period) => period.until === void 0 && !offered.includes(period.terms.caip19) ? { ...period, until: Math.max(at, period.from) } : period
   );
 }
-function undeliveredOrders(state) {
-  return Object.values(state.orders).filter(
-    (order) => order.paid !== void 0 && order.deliveredAt === void 0
-  );
+function termsAt(periods, blockTime2) {
+  const earliest = blockTime2 - TERMS_WINDOW_SECS;
+  const found = [];
+  for (const period of periods) {
+    const offered = period.from <= blockTime2 && (period.until === void 0 || period.until > earliest);
+    if (offered && !found.some((terms) => sameTerms(terms, period.terms))) {
+      found.push(period.terms);
+    }
+  }
+  return found;
 }
-function pruneExpiredOrders(state, now) {
-  for (const [key, order] of Object.entries(state.orders)) {
-    if (order.paid === void 0 && now - order.createdAt > CATCH_UP_SECS + MAX_FUTURE_SKEW_SECS) {
-      delete state.orders[key];
-      (state.closedOrders ??= {})[key] = true;
+function termsSince(periods, since) {
+  const earliest = since - TERMS_WINDOW_SECS;
+  const found = [];
+  for (const period of periods) {
+    if ((period.until === void 0 || period.until > earliest) && !found.some((terms) => sameTerms(terms, period.terms))) {
+      found.push(period.terms);
     }
   }
+  return found;
 }
-function recordReport(order, tx, arrivedAt) {
-  order.reportedTxs.push(tx);
-  order.recheckedAt = { ...order.recheckedAt, [tx]: arrivedAt };
+function standingTerms(periods) {
+  return periods.filter((period) => period.until === void 0).map((period) => period.terms);
 }
-function loadLedger(path) {
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch {
-    return emptyLedger();
+function visibleTerms(standing, next, listingOut, payoutsOut) {
+  const listed = listingOut ? next : standing;
+  const payouts = payoutsOut ? next : standing;
+  const visible = [];
+  for (const { caip19, amount } of listed) {
+    const payout = payouts.find((terms) => terms.caip19 === caip19)?.payout;
+    if (payout !== void 0) {
+      visible.push({ caip19, payout, amount });
+    }
   }
-  const state = JSON.parse(text);
-  if (state.version !== 1) {
-    throw new Error(`Unknown ledger version in ${path}`);
+  return visible;
+}
+
+// src/tempo.ts
+function tempoContextFor(config, storePubkey) {
+  if (config.tempo === void 0) {
+    return void 0;
   }
-  state.scans ??= {};
-  return state;
+  const chain = chainByCaip2(config.tempo.network === "mainnet" ? "eip155:4217" : "eip155:42431");
+  const url = config.tempo.rpcUrl ?? chain?.rpcUrls[0];
+  if (chain === void 0 || url === void 0) {
+    return void 0;
+  }
+  return {
+    client: createJsonRpcClient(url),
+    chain,
+    medium: config.tempo.network === "mainnet" ? "tempo" : "tempo-moderato",
+    storePubkey
+  };
 }
-function saveLedger(path, state) {
-  const temporary = `${path}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(state, null, 2)}
-`, { mode: 384 });
-  renameSync(temporary, path);
+var MAX_BLOCK_SAMPLES = 1e4;
+var TEMPO_HASH_RE2 = /^0x[0-9a-f]{64}$/;
+var FLOOR_MARGIN_SECS = Math.max(ORDER_SCAN_MARGIN_SECS, 900);
+function tempoMemo(order, storePubkey) {
+  return deriveOrderPaymentReference({
+    storePubkey,
+    buyerPubkey: order.buyerPubkey,
+    orderId: order.orderId
+  }).tempo;
+}
+function tempoTerms(terms, context) {
+  return terms.flatMap((each) => {
+    const caip19 = parseCaip19(each.caip19);
+    const mint = caip19?.asset.mint;
+    if (caip19?.chain.caip2 !== context.chain.caip2 || mint === void 0) {
+      return [];
+    }
+    return [{ terms: each, token: mint.toLowerCase() }];
+  });
 }
-function isSolanaSignature(value) {
-  try {
-    return isSignature(value);
-  } catch {
-    return false;
+async function blockTime(context, number) {
+  const cached = context.samples?.get(number);
+  if (cached !== void 0) {
+    return cached;
+  }
+  const block = await readBlockByNumber(context.client, number);
+  if (block === null) {
+    return void 0;
+  }
+  const samples = context.samples ??= /* @__PURE__ */ new Map();
+  if (samples.size >= MAX_BLOCK_SAMPLES) {
+    samples.clear();
+  }
+  samples.set(number, block.timestamp);
+  return block.timestamp;
+}
+async function blockAtTime(context, time) {
+  const head = await readFinalizedBlock(context.client);
+  if (head === null) {
+    return void 0;
+  }
+  const target = Math.max(time, head.timestamp - CATCH_UP_SECS - FLOOR_MARGIN_SECS);
+  if (head.timestamp <= target) {
+    return head;
+  }
+  let low = 0;
+  let high = head.number;
+  let found = { number: 0, timestamp: 0 };
+  for (const [number, at] of context.samples ?? []) {
+    if (number > high || number < low) {
+      continue;
+    }
+    if (at <= target && number >= low) {
+      low = number;
+      found = { number, timestamp: at };
+    } else if (at > target && number <= high) {
+      high = number;
+    }
+  }
+  while (low <= high) {
+    const middle = Math.floor((low + high) / 2);
+    const at = await blockTime(context, middle);
+    if (at === void 0) {
+      return void 0;
+    }
+    if (at <= target) {
+      found = { number: middle, timestamp: at };
+      low = middle + 1;
+    } else {
+      high = middle - 1;
+    }
+  }
+  return found;
+}
+function orderFloor(context, order) {
+  return blockAtTime(context, order.createdAt - FLOOR_MARGIN_SECS);
+}
+async function verifyTerms(state, order, hash, context, candidates, floor, satisfies) {
+  const memo = tempoMemo(order, context.storePubkey);
+  const verdicts = [];
+  for (const candidate of candidates) {
+    const caip19 = parseCaip19(candidate.terms.caip19);
+    if (caip19 === void 0) {
+      continue;
+    }
+    let request;
+    try {
+      request = composeTempoPaymentRequest({
+        chain: context.chain,
+        asset: caip19.asset,
+        recipient: candidate.terms.payout,
+        amount: BigInt(candidate.terms.amount),
+        feeBps: 0,
+        treasury: candidate.terms.payout,
+        memo,
+        createdAt: floor.timestamp
+      });
+    } catch {
+      continue;
+    }
+    const result = await verifyTempoPayment(context.client, request, {
+      txSignature: hash,
+      fromBlock: floor.number,
+      pollBudgetMs: 0
+    });
+    if (result.outcome === "verified") {
+      const leg = result.providerLeg;
+      const at = await blockTime(context, leg.blockNumber);
+      if (at === void 0) {
+        verdicts.push("ask");
+        continue;
+      }
+      const offered = termsAt(state.terms, at).some(
+        (standing) => standing.caip19 === candidate.terms.caip19 && standing.payout === candidate.terms.payout && standing.amount === candidate.terms.amount
+      );
+      if (leg.blockNumber < floor.number || !offered) {
+        verdicts.push("refused");
+        continue;
+      }
+      if (!claimPayment(state, result.settlementId, order.key)) {
+        return "claimed";
+      }
+      markTempo(state);
+      order.paid = {
+        signature: leg.transactionHash,
+        amount: leg.amount.toString(),
+        blockTime: at,
+        caip19: candidate.terms.caip19,
+        medium: context.medium
+      };
+      return "paid";
+    }
+    if (result.outcome === "refused" && (result.code === "reverted" || result.code === "no_provider_leg")) {
+      verdicts.push(satisfies(candidate) ? "ask" : "no_leg");
+      continue;
+    }
+    verdicts.push("ask");
+  }
+  if (verdicts.includes("ask")) {
+    return "ask";
+  }
+  if (verdicts.length > 0 && verdicts.every((verdict) => verdict === "refused")) {
+    return "refused";
+  }
+  return "no_leg";
+}
+function asCheck(verdict, order) {
+  switch (verdict) {
+    case "paid":
+      return { kind: "paid", order };
+    case "claimed":
+      return { kind: "refused", reason: "claimed_by_another_order" };
+    case "refused":
+      return { kind: "refused", reason: "not_a_payment_for_this_order" };
+    case "no_leg":
+      return { kind: "no_leg" };
+    case "ask":
+      return { kind: "ask_again" };
+  }
+  return { kind: "ask_again" };
+}
+async function checkTempoPayment(state, order, hash, context) {
+  if (order.paid !== void 0) {
+    return order.paid.signature === hash ? { kind: "paid", order } : { kind: "refused", reason: "order_already_paid" };
   }
+  const candidates = tempoTerms(
+    termsSince(state.terms, order.createdAt - ORDER_SCAN_MARGIN_SECS),
+    context
+  );
+  if (candidates.length === 0) {
+    return { kind: "refused", reason: "not_a_payment_for_this_order" };
+  }
+  const minAmount = candidates.reduce(
+    (lowest, candidate) => BigInt(candidate.terms.amount) < lowest ? BigInt(candidate.terms.amount) : lowest,
+    BigInt(candidates[0]?.terms.amount ?? "0")
+  );
+  const pre = await readTempoReceiptLegs(context.client, hash, {
+    chain: context.chain,
+    tokens: [...new Set(candidates.map((candidate) => candidate.token))],
+    recipients: [...new Set(candidates.map((candidate) => candidate.terms.payout))],
+    memo: tempoMemo(order, context.storePubkey),
+    minAmount
+  });
+  if (pre.kind === "unreadable" || pre.kind === "absent") {
+    return { kind: "ask_again" };
+  }
+  if (pre.kind === "none") {
+    return { kind: "no_leg" };
+  }
+  const named = candidates.filter(
+    (candidate) => pre.transfers.some((leg) => leg.token === candidate.token && leg.to === candidate.terms.payout)
+  );
+  if (named.length === 0) {
+    if (pre.blocked.length > 0) {
+      order.blockedTx = hash;
+      markTempo(state);
+      return { kind: "blocked" };
+    }
+    return { kind: "no_leg" };
+  }
+  const floor = await orderFloor(context, order);
+  if (floor === void 0) {
+    return { kind: "ask_again" };
+  }
+  return asCheck(await verifyTerms(state, order, hash, context, named, floor, () => false), order);
+}
+function recordTempoCheck(state, order, hash, check2) {
+  if (check2.kind === "refused") {
+    order.refusedTxs = [...order.refusedTxs ?? [], hash];
+  } else if (check2.kind === "no_leg" && order.noLegTxs?.includes(hash) !== true) {
+    order.noLegTxs = [...order.noLegTxs ?? [], hash];
+  }
+  markTempo(state);
+}
+async function catchUpTempo(state, context, now) {
+  const result = { paid: [], incomplete: [] };
+  const open = openOrders(state, now, CATCH_UP_SECS);
+  if (open.length === 0) {
+    return result;
+  }
+  const reported = [];
+  for (const order of open) {
+    for (const hash of order.reportedTxs) {
+      if (TEMPO_HASH_RE2.test(hash) && order.refusedTxs?.includes(hash) !== true && order.noLegTxs?.includes(hash) !== true && order.blockedTx !== hash) {
+        reported.push({ order, hash, checkedAt: order.recheckedAt?.[hash] ?? 0 });
+      }
+    }
+  }
+  reported.sort((left, right) => left.checkedAt - right.checkedAt);
+  for (const { order, hash } of reported.slice(0, MAX_RECHECKS_PER_SWEEP)) {
+    if (order.paid !== void 0) {
+      continue;
+    }
+    order.recheckedAt = { ...order.recheckedAt, [hash]: now };
+    const check2 = await checkTempoPayment(state, order, hash, context);
+    recordTempoCheck(state, order, hash, check2);
+    if (check2.kind === "paid") {
+      result.paid.push(order);
+    }
+  }
+  const oldest = Math.min(...open.map((order) => order.createdAt));
+  const candidates = tempoTerms(termsSince(state.terms, oldest - ORDER_SCAN_MARGIN_SECS), context);
+  if (candidates.length === 0) {
+    return result;
+  }
+  const floor = await blockAtTime(context, oldest - FLOOR_MARGIN_SECS);
+  if (floor === void 0) {
+    return result;
+  }
+  const byMemo = new Map(open.map((order) => [tempoMemo(order, context.storePubkey), order]));
+  const matches = [];
+  const pairs = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    const key = `${candidate.token}:${candidate.terms.payout}`;
+    pairs.set(key, [...pairs.get(key) ?? [], candidate]);
+  }
+  for (const [key, terms] of pairs) {
+    const [token, payout] = key.split(":");
+    const minAmount = terms.reduce(
+      (lowest, each) => BigInt(each.terms.amount) < lowest ? BigInt(each.terms.amount) : lowest,
+      BigInt(terms[0]?.terms.amount ?? "0")
+    );
+    const scan = await listTempoLogs(context.client, {
+      token,
+      event: "TransferWithMemo",
+      to: payout,
+      fromBlock: floor.number,
+      minAmount
+    });
+    if (!scan.complete) {
+      result.incomplete.push(`${context.chain.caip2} ${token} ${payout}`);
+    }
+    for (const leg of scan.candidates) {
+      const order = leg.memo === void 0 ? void 0 : byMemo.get(leg.memo);
+      if (order === void 0 || order.paid !== void 0 || order.refusedTxs?.includes(leg.transactionHash) === true || order.tempoNoLeg?.includes(leg.transactionHash) === true) {
+        continue;
+      }
+      matches.push({ order, leg, checkedAt: order.recheckedAt?.[leg.transactionHash] ?? 0 });
+    }
+  }
+  matches.sort((left, right) => left.checkedAt - right.checkedAt);
+  for (const { order, leg } of matches.slice(0, MAX_RECHECKS_PER_SWEEP)) {
+    if (order.paid !== void 0) {
+      continue;
+    }
+    const hash = leg.transactionHash;
+    order.recheckedAt = { ...order.recheckedAt, [hash]: now };
+    const orderFloorBlock = await orderFloor(context, order);
+    if (orderFloorBlock === void 0) {
+      continue;
+    }
+    const orderTerms = tempoTerms(
+      termsSince(state.terms, order.createdAt - ORDER_SCAN_MARGIN_SECS),
+      context
+    );
+    const verdict = await verifyTerms(
+      state,
+      order,
+      hash,
+      context,
+      orderTerms,
+      orderFloorBlock,
+      (candidate) => candidate.token === leg.token && candidate.terms.payout === leg.to && leg.amount >= BigInt(candidate.terms.amount)
+    );
+    markTempo(state);
+    if (order.noLegTxs?.includes(hash) === true) {
+      order.noLegTxs = order.noLegTxs.filter((each) => each !== hash);
+    }
+    if (verdict === "paid") {
+      result.paid.push(order);
+    } else if (verdict === "refused") {
+      order.refusedTxs = [...order.refusedTxs ?? [], hash];
+    } else if (verdict === "no_leg") {
+      order.tempoNoLeg = [...order.tempoNoLeg ?? [], hash];
+    }
+  }
+  return result;
 }
 
 // src/intake.ts
@@ -667,7 +1212,13 @@ function intake(state, unwrapped, store, now = Math.floor(Date.now() / 1e3)) {
       return { kind: "ignored", reason: "unknown_order" };
     }
     const { medium, reference, tx } = message.payment;
-    if (reference !== order.reference || !store.mediums.includes(medium) || !isSolanaSignature(tx)) {
+    const tempo = medium.startsWith("tempo");
+    const expected = tempo ? deriveOrderPaymentReference({
+      storePubkey: store.storePubkey,
+      buyerPubkey: order.buyerPubkey,
+      orderId: order.orderId
+    }).tempo : order.reference;
+    if (reference !== expected || !store.mediums.includes(medium) || !(tempo ? TEMPO_HASH_RE2.test(tx) : isSolanaSignature(tx))) {
       return { kind: "ignored", reason: "foreign_payment" };
     }
     if (!order.reportedTxs.includes(tx) && order.reportedTxs.length >= MAX_RECEIPTS_PER_ORDER) {
@@ -677,6 +1228,9 @@ function intake(state, unwrapped, store, now = Math.floor(Date.now() / 1e3)) {
     const isNew = !order.reportedTxs.includes(tx);
     if (isNew) {
       recordReport(order, tx, now);
+      if (tempo) {
+        markTempo(state);
+      }
     }
     return { kind: "receipt", order, tx, isNew };
   }
@@ -859,68 +1413,6 @@ function deliveryDone(accepted, relays, paidAgeSecs) {
   }
   return accepted >= Math.min(DELIVERY_RELAYS_WANTED, relays) || paidAgeSecs >= DELIVERY_SETTLE_SECS;
 }
-
-// src/terms.ts
-function sameTerms(left, right) {
-  return left.caip19 === right.caip19 && left.payout === right.payout && left.amount === right.amount;
-}
-function publishTerms(periods, terms, at) {
-  const standing = periods.find(
-    (period) => period.until === void 0 && period.terms.caip19 === terms.caip19
-  );
-  if (standing !== void 0 && sameTerms(standing.terms, terms)) {
-    return [...periods];
-  }
-  return [
-    ...periods.map(
-      (period) => period === standing ? { ...period, until: Math.max(at, period.from) } : period
-    ),
-    { terms, from: at }
-  ];
-}
-function retireTerms(periods, offered, at) {
-  return periods.map(
-    (period) => period.until === void 0 && !offered.includes(period.terms.caip19) ? { ...period, until: Math.max(at, period.from) } : period
-  );
-}
-function termsAt(periods, blockTime) {
-  const earliest = blockTime - TERMS_WINDOW_SECS;
-  const found = [];
-  for (const period of periods) {
-    const offered = period.from <= blockTime && (period.until === void 0 || period.until > earliest);
-    if (offered && !found.some((terms) => sameTerms(terms, period.terms))) {
-      found.push(period.terms);
-    }
-  }
-  return found;
-}
-function termsSince(periods, since) {
-  const earliest = since - TERMS_WINDOW_SECS;
-  const found = [];
-  for (const period of periods) {
-    if ((period.until === void 0 || period.until > earliest) && !found.some((terms) => sameTerms(terms, period.terms))) {
-      found.push(period.terms);
-    }
-  }
-  return found;
-}
-function standingTerms(periods) {
-  return periods.filter((period) => period.until === void 0).map((period) => period.terms);
-}
-function visibleTerms(standing, next, listingOut, payoutsOut) {
-  const listed = listingOut ? next : standing;
-  const payouts = payoutsOut ? next : standing;
-  const visible = [];
-  for (const { caip19, amount } of listed) {
-    const payout = payouts.find((terms) => terms.caip19 === caip19)?.payout;
-    if (payout !== void 0) {
-      visible.push({ caip19, payout, amount });
-    }
-  }
-  return visible;
-}
-
-// src/solana.ts
 function solanaAsset(terms, network) {
   const caip19 = parseCaip19(terms.caip19);
   if (caip19 === void 0 || caip19.chain.family !== "solana" || caip19.chain.network !== network) {
@@ -1029,8 +1521,8 @@ async function scanTransaction(signature, terms, asset, context) {
   if (transaction === null || typeof transaction !== "object") {
     return void 0;
   }
-  const blockTime = Reflect.get(transaction, "blockTime");
-  if (typeof blockTime !== "number" && typeof blockTime !== "bigint") {
+  const blockTime2 = Reflect.get(transaction, "blockTime");
+  if (typeof blockTime2 !== "number" && typeof blockTime2 !== "bigint") {
     return void 0;
   }
   let instructions;
@@ -1040,7 +1532,7 @@ async function scanTransaction(signature, terms, asset, context) {
     return void 0;
   }
   return {
-    blockTime: Number(blockTime),
+    blockTime: Number(blockTime2),
     references: await boundReferences(instructions, terms, asset)
   };
 }
@@ -1066,7 +1558,7 @@ async function catchUp(state, context, now) {
   const pending = [];
   for (const order of open) {
     for (const signature of order.reportedTxs) {
-      if (order.paid === void 0 && order.refusedTxs?.includes(signature) !== true && state.claims[signature] === void 0) {
+      if (order.paid === void 0 && isSolanaSignature(signature) && order.refusedTxs?.includes(signature) !== true && state.claims[signature] === void 0) {
         pending.push({ order, signature, checkedAt: order.recheckedAt?.[signature] ?? 0 });
       }
     }
@@ -1132,6 +1624,9 @@ function forgetOldScans(state, now) {
 }
 
 // src/runtime.ts
+function settled(order, tx) {
+  return order.refusedTxs?.includes(tx) === true || order.noLegTxs?.includes(tx) === true || order.blockedTx === tx;
+}
 var MerchantRuntime = class {
   constructor(deps) {
     this.deps = deps;
@@ -1189,7 +1684,7 @@ var MerchantRuntime = class {
       log2(`order ${result.order.key}`);
       return;
     }
-    if (!result.isNew || result.order.refusedTxs?.includes(result.tx) === true || !this.takeLiveCheck()) {
+    if (!result.isNew || settled(result.order, result.tx) || !this.takeLiveCheck()) {
       return;
     }
     await this.checkReported(result.order, result.tx, 0);
@@ -1197,11 +1692,26 @@ var MerchantRuntime = class {
   /** Check one reported transaction now; one the RPC does not see yet is tried again soon. */
   async checkReported(order, tx, attempt) {
     const { state, context, save, log: log2 } = this.deps;
-    const check2 = await this.check(state, order, tx, context);
-    log2(`receipt ${order.key} ${tx}: ${check2.kind}`);
-    if (check2.kind === "refused") {
-      order.refusedTxs = [...order.refusedTxs ?? [], tx];
+    let check2;
+    if (TEMPO_HASH_RE2.test(tx)) {
+      if (this.deps.tempo === void 0) {
+        log2(`receipt ${order.key} ${tx}: a Tempo payment, and this node has no tempo block`);
+        return;
+      }
+      check2 = await (this.deps.checkTempoPayment ?? checkTempoPayment)(
+        state,
+        order,
+        tx,
+        this.deps.tempo
+      );
+      recordTempoCheck(state, order, tx, check2);
+    } else {
+      check2 = await this.check(state, order, tx, context);
+      if (check2.kind === "refused") {
+        order.refusedTxs = [...order.refusedTxs ?? [], tx];
+      }
     }
+    log2(`receipt ${order.key} ${tx}: ${check2.kind}`);
     save();
     if (check2.kind === "paid") {
       await this.deliverPending();
@@ -1216,7 +1726,7 @@ var MerchantRuntime = class {
     }
     this.deps.later(delay, async () => {
       const order = this.deps.state.orders[key];
-      if (order === void 0 || order.paid !== void 0 || !order.reportedTxs.includes(tx) || order.refusedTxs?.includes(tx) === true || !this.takeLiveCheck()) {
+      if (order === void 0 || order.paid !== void 0 || !order.reportedTxs.includes(tx) || settled(order, tx) || !this.takeLiveCheck()) {
         return;
       }
       await this.checkReported(order, tx, attempt + 1);
@@ -1266,12 +1776,33 @@ var MerchantRuntime = class {
       }
     }
     try {
-      const result = await this.sweepCatchUp(state, context, now());
-      if (result.paid.length > 0) {
-        log2(`catch-up found ${result.paid.length} payment(s)`);
+      const tempo = this.deps.tempo;
+      const rails = [
+        { rail: "solana", run: () => this.sweepCatchUp(state, context, now()) }
+      ];
+      if (tempo !== void 0) {
+        rails.push({
+          rail: "tempo",
+          run: () => (this.deps.catchUpTempo ?? catchUpTempo)(state, tempo, now())
+        });
       }
-      for (const account of result.incomplete) {
-        log2(`warning: the history of ${account} was cut short; older payments may be missed`);
+      const results = [];
+      for (const { rail, run: run2 } of rails) {
+        try {
+          results.push(await run2());
+        } catch (error) {
+          log2(
+            `${rail} catch-up failed this time: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+      }
+      for (const result of results) {
+        if (result.paid.length > 0) {
+          log2(`catch-up found ${result.paid.length} payment(s)`);
+        }
+        for (const account of result.incomplete) {
+          log2(`warning: the history of ${account} was cut short; older payments may be missed`);
+        }
       }
     } finally {
       save();
@@ -1422,6 +1953,11 @@ var USAGE = `usage: elisym-merchant <command> [--home <dir>]
   run    take orders, verify payments, deliver
   orders list the orders: paid, delivered, the buyer's email
   check  check the inbox relays, the owner's payout list and the domain
+  deliver <buyer>:<orderId> [--yes]
+         answer an unpaid order by hand with the configured delivery
+  refund <buyer>:<orderId> --tx <refund tx> --amount <subunits> [--yes]
+         answer an unpaid order by hand with a refund you already sent
+         (both need the node stopped; --yes skips the confirmation)
 
 The home is --home, else $ELISYM_MERCHANT_HOME, else ~/.elisym-merchant.
 It holds the store's secret keys: keep it private and back it up.`;
@@ -1437,19 +1973,40 @@ function log(message) {
 function errorText3(error) {
   return error instanceof Error ? error.message : String(error);
 }
+var VALUE_FLAGS = {
+  "--home": "home",
+  "--network": "network",
+  "--tx": "tx",
+  "--amount": "amount"
+};
+function isValueFlag(arg) {
+  return arg in VALUE_FLAGS;
+}
 function parseArgs(argv) {
-  const args = { command: void 0, home: void 0, network: void 0 };
+  const args = {
+    command: void 0,
+    target: void 0,
+    home: void 0,
+    network: void 0,
+    tx: void 0,
+    amount: void 0,
+    yes: false
+  };
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
-    if (arg === "--home" || arg === "--network") {
+    if (arg !== void 0 && isValueFlag(arg)) {
       const value = argv[index + 1];
       if (value === void 0 || value.startsWith("--")) {
         throw new Error(`${arg} needs a value`);
       }
-      args[arg === "--home" ? "home" : "network"] = value;
+      args[VALUE_FLAGS[arg]] = value;
       index += 1;
+    } else if (arg === "--yes") {
+      args.yes = true;
     } else if (args.command === void 0 && arg !== void 0 && !arg.startsWith("--")) {
       args.command = arg;
+    } else if ((args.command === "deliver" || args.command === "refund") && args.target === void 0 && arg !== void 0 && !arg.startsWith("--")) {
+      args.target = arg;
     } else {
       throw new Error(`unknown argument ${arg ?? ""}`);
     }
@@ -1619,7 +2176,8 @@ async function refuseOffersNotHonoured(pool, config, keys, state) {
     read,
     config.inboxRelays,
     config.network,
-    standingTerms(state.terms)
+    standingTerms(state.terms),
+    config.tempo === void 0 ? void 0 : tempoRegistryNetwork(config.tempo.network)
   );
   if (problems.length > 0) {
     throw new Error(
@@ -1675,11 +2233,23 @@ async function run(home) {
       log(`error: ${errorText3(error)}`);
     });
   };
+  const tempo = tempoContextFor(config, storePubkey);
+  const mediums = [
+    ...config.rpcUrl === void 0 ? [] : [SOLANA_MEDIUMS[config.network]],
+    ...tempo === void 0 ? [] : [tempo.medium]
+  ];
   const runtime = new MerchantRuntime({
     state,
-    store: storeIdentity(storePubkey, config.product.d, [SOLANA_MEDIUMS[config.network]]),
+    store: storeIdentity(storePubkey, config.product.d, mediums),
     storeSecretKey: keys.storeSecretKey,
-    context: { rpc: createSolanaRpc(config.rpcUrl), network: config.network },
+    // With no Solana payout the Solana catch-up has no terms to scan and reads nothing.
+    context: {
+      rpc: createSolanaRpc(config.rpcUrl ?? "https://api.devnet.solana.com"),
+      network: config.network
+    },
+    ...tempo === void 0 ? {} : { tempo },
+    // No Solana payout configured: the Solana sweep reads nothing (no cluster to guess).
+    ...config.rpcUrl === void 0 ? { catchUp: async () => ({ paid: [], incomplete: [] }) } : {},
     save: () => saveLedger(home.ledger, state),
     deliver: (order, skip) => deliver(pool, order, skip, config, keys),
     inboxRelayCount: config.inboxRelays.length,
@@ -1741,6 +2311,10 @@ function listOrders(home) {
     console.log(`${when} ${orderStatus(order)} ${order.key}${paid}${email}`);
   }
   console.log(`${all.length} order(s)`);
+  for (const [key, answer] of Object.entries(state.answeredByHand ?? {})) {
+    const detail = answer.kind === "delivered" ? answer.delivery?.value ?? "" : `${answer.amount ?? ""} in ${answer.tx ?? ""}`;
+    console.log(`answered by hand: ${key} ${answer.kind} ${detail}`);
+  }
 }
 async function check(home) {
   const config = loadConfig(home.config);
@@ -1770,6 +2344,72 @@ async function check(home) {
     pool.destroy();
   }
 }
+async function confirmed(question, yes) {
+  if (yes) {
+    return true;
+  }
+  if (!process.stdin.isTTY) {
+    throw new Error("no terminal to confirm on: pass --yes to answer without asking");
+  }
+  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await prompt.question(`${question} [y/N] `);
+    return answer.trim().toLowerCase() === "y";
+  } finally {
+    prompt.close();
+  }
+}
+async function answerByHand(home, args) {
+  const key = args.target;
+  if (key === void 0) {
+    throw new Error(`${args.command ?? ""} needs the order: <buyer>:<orderId> (see orders)`);
+  }
+  const config = loadConfig(home.config);
+  const keys = loadOrCreateKeys(home, false);
+  takeLock(home);
+  const state = loadLedger(home.ledger);
+  const request = args.command === "deliver" ? { kind: "delivered", delivery: config.product.delivery } : { kind: "refunded", tx: args.tx ?? "", amount: args.amount ?? "" };
+  const plan = planHandAnswer(state, key, request);
+  if (!plan.ok) {
+    throw new Error(plan.problem);
+  }
+  const order = state.orders[key];
+  const held = order ?? plan.answer;
+  console.log(`order    ${key}${order === void 0 ? " (closed)" : ""}`);
+  console.log(`reported ${held.reportedTxs.join(", ") || "-"}`);
+  console.log(`refused  ${(held.refusedTxs ?? []).join(", ") || "-"}`);
+  console.log(`no leg   ${(held.noLegTxs ?? []).join(", ") || "-"}`);
+  if (order?.blockedTx !== void 0) {
+    console.log(`blocked  ${order.blockedTx}`);
+  }
+  const what = plan.answer.kind === "delivered" ? `deliver "${plan.answer.delivery?.value ?? ""}"` : `report a refund of ${plan.answer.amount ?? ""} in ${plan.answer.tx ?? ""}`;
+  if (!await confirmed(`${plan.rerun ? "Send again" : "Close the order and"} ${what}?`, args.yes)) {
+    throw new Error("not confirmed: nothing was sent");
+  }
+  if (!plan.rerun) {
+    applyHandAnswer(state, key, plan.answer);
+    saveLedger(home.ledger, state);
+  }
+  const pool = new SimplePool();
+  try {
+    const wrap = buildHandAnswer(plan, keys.storeSecretKey, nowSecs());
+    const taken = await publishToRelays(
+      pool,
+      config.inboxRelays,
+      wrap.recipientWrap,
+      storeAuth(keys),
+      log
+    );
+    console.log(
+      `taken by ${taken.length} of ${config.inboxRelays.length}: ${taken.join(", ") || "-"}`
+    );
+    if (!deliveryDone(taken.length, config.inboxRelays.length, 0)) {
+      throw new Error("too few inbox relays took it: run the same command again to send it again");
+    }
+  } finally {
+    pool.destroy();
+  }
+}
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (args.network !== void 0 && args.command !== "init") {
@@ -1803,6 +2443,11 @@ async function main() {
       await check(home);
       process.exit(0);
       return;
+    case "deliver":
+    case "refund":
+      await answerByHand(home, args);
+      process.exit(0);
+      return;
     default:
       console.log(USAGE);
       process.exit(args.command === void 0 || args.command === "help" ? 0 : 1);