@elisym/merchant-node 0.1.0

package/dist/cli.js

@@ -0,0 +1,1818 @@
+#!/usr/bin/env node
+import { existsSync, writeFileSync, readFileSync, statSync, renameSync, linkSync, rmSync, utimesSync, mkdirSync, chmodSync } from 'node:fs';
+import { LIMITS, DELIVERY_METHODS, splitNip05, parseCaip19, canonicalPayoutAddress, priceInSubunits, isPublicHostname, KIND_PAYTO, KIND_PRODUCT, KIND_INBOX_RELAYS, buildProductEvent, buildStoreProfileEvent, buildPaytoEvent, buildStoreAuthEvent, encodeProductNaddr, MAX_FUTURE_SKEW_SECS, unwrapOrderMessage, productAddress, wrapOrderMessage, buildOrderMessage, KIND_GIFT_WRAP, deriveOrderPaymentReference, parsePayto, parseProduct } from '@elisym/commerce';
+import { createSolanaRpc, address, isSignature } from '@solana/kit';
+import { SimplePool } from 'nostr-tools/pool';
+import { getPublicKey, generateSecretKey, finalizeEvent } from 'nostr-tools/pure';
+import Decimal from 'decimal.js-light';
+import { z } from 'zod';
+import { randomBytes } from 'node:crypto';
+import { homedir } from 'node:os';
+import { resolve, join } from 'node:path';
+import { hexToBytes, bytesToHex } from 'nostr-tools/utils';
+import { composeSolanaPaymentRequest, verifyDirectSolanaPayment, listReferenceSignatures, directInstructionsFromRpcTransaction, ELISYM_PROTOCOL_TAG, boundTransferAmount } from '@elisym/pay-core';
+import { findAssociatedTokenPda, TOKEN_PROGRAM_ADDRESS } from '@solana-program/token';
+
+// src/constants.ts
+var TERMS_WINDOW_SECS = 45 * 60;
+var ORDER_SCAN_MARGIN_SECS = 30 * 60;
+var CATCH_UP_SECS = 3 * 24 * 60 * 60;
+var WRAP_BACKDATE_SECS = 2 * 24 * 60 * 60;
+var CATCH_UP_INTERVAL_MS = 6e4;
+var SOLANA_MEDIUMS = { mainnet: "solana", devnet: "solana-devnet" };
+var OFFER_RELAYS = [
+  "wss://relay.elisym.network",
+  "wss://relay.damus.io",
+  "wss://nos.lol",
+  "wss://relay.nostr.band"
+];
+var PUBLISH_DEADLINE_MS = 2e4;
+var EARLIEST_ORDER_SECS = 16e8;
+var MAX_RECEIPTS_PER_ORDER = 5;
+var MAX_RECHECKS_PER_SWEEP = 20;
+var RESUBSCRIBE_BACKOFF_MS = [1e3, 5e3, 15e3, 6e4];
+var MAX_LIVE_CHECKS_PER_MINUTE = 20;
+var ASK_AGAIN_DELAYS_MS = [3e3, 1e4, 3e4];
+var RESEND_EVERY_SECS = 10 * 60;
+var MAX_REPEATS_IN_FLIGHT = 4;
+var DELIVERY_RELAYS_WANTED = 2;
+var DELIVERY_SETTLE_SECS = 60 * 60;
+var TERMS_CLOCK_MARGIN_SECS = 60;
+
+// src/publish.ts
+function errorText(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function publishOne(pool, url, event, auth) {
+  const relay = await pool.ensureRelay(url);
+  try {
+    await relay.publish(event);
+  } catch (error) {
+    if (!errorText(error).startsWith("auth-required")) {
+      throw error;
+    }
+    await relay.auth(auth);
+    await relay.publish(event);
+  }
+}
+async function publishToRelays(pool, relays, event, auth, log2, deadlineMs = PUBLISH_DEADLINE_MS) {
+  const accepted = [];
+  await Promise.all(
+    relays.map(async (url) => {
+      let timer;
+      const deadline = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error("timed out")), deadlineMs);
+      });
+      try {
+        await Promise.race([publishOne(pool, url, event, auth), deadline]);
+        accepted.push(url);
+      } catch (error) {
+        log2(`publish to ${url} failed: ${errorText(error)}`);
+      } finally {
+        clearTimeout(timer);
+      }
+    })
+  );
+  return accepted;
+}
+var MAX_RELAY_URL_LENGTH = 256;
+function checkoutRelaySpelling(value) {
+  if (value === void 0 || value.length > MAX_RELAY_URL_LENGTH || !URL.canParse(value)) {
+    return void 0;
+  }
+  const url = new URL(value);
+  if (url.protocol !== "wss:" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || !isPublicHostname(url.hostname)) {
+    return void 0;
+  }
+  return `wss://${url.host}${url.pathname.replace(/\/+/g, "/").replace(/\/$/, "")}`;
+}
+
+// src/checks.ts
+var READ_WAIT_MS = 1e4;
+async function checkInboxRelays(writer, reader, relays, storeSecretKey, storeAuth2, log2, now) {
+  const recipientSecretKey = generateSecretKey();
+  const recipient = getPublicKey(recipientSecretKey);
+  const probe = wrapOrderMessage(
+    buildOrderMessage(
+      {
+        type: "status",
+        buyerPubkey: recipient,
+        orderId: `probe-${now.toString(36)}`,
+        status: "pending"
+      },
+      now
+    ),
+    storeSecretKey,
+    recipient
+  ).recipientWrap;
+  const recipientAuth = async (template) => finalizeEvent(template, recipientSecretKey);
+  return await Promise.all(
+    relays.map(async (relay) => {
+      const accepted = await publishToRelays(writer, [relay], probe, storeAuth2, log2);
+      if (accepted.length === 0) {
+        return { relay, accepts: false, serves: false };
+      }
+      const found = await reader.querySync(
+        [relay],
+        { kinds: [KIND_GIFT_WRAP], "#p": [recipient], ids: [probe.id] },
+        { maxWait: READ_WAIT_MS, onauth: recipientAuth }
+      ).catch(() => []);
+      return { relay, accepts: true, serves: found.some((event) => event.id === probe.id) };
+    })
+  );
+}
+async function checkDomain(domain, expected, fetcher = fetch) {
+  const url = `https://${domain}/.well-known/nostr.json?name=_`;
+  let response;
+  try {
+    response = await fetcher(url, { redirect: "error", signal: AbortSignal.timeout(READ_WAIT_MS) });
+  } catch (error) {
+    return { url, ok: false, problem: `not reachable (${errorText2(error)})` };
+  }
+  if (!response.ok) {
+    return { url, ok: false, problem: `answered ${response.status}` };
+  }
+  if (response.headers.get("access-control-allow-origin") !== "*") {
+    return { url, ok: false, problem: 'no "Access-Control-Allow-Origin: *" header' };
+  }
+  let served;
+  try {
+    const text = await response.text();
+    if (text.length > LIMITS.MAX_NIP05_DOCUMENT_BYTES) {
+      return { url, ok: false, problem: "the document is too large" };
+    }
+    served = JSON.parse(text);
+  } catch {
+    return { url, ok: false, problem: "not JSON" };
+  }
+  const names = typeof served === "object" && served !== null && "names" in served ? served.names : void 0;
+  for (const [name, pubkey] of Object.entries(expected.names)) {
+    if (names?.[name] !== pubkey) {
+      return { url, ok: false, problem: `"${name}" is not ${pubkey}` };
+    }
+  }
+  return { url, ok: true };
+}
+function offersNotHonoured(listing, payoutList, network, standing) {
+  if (listing === void 0 && payoutList === void 0) {
+    return void 0;
+  }
+  const targets = payoutList === void 0 ? [] : parsePayto(payoutList).targets;
+  const found = targets.filter(
+    (target) => target.caip19.chain.family !== "solana" || target.caip19.chain.network !== network || !standing.some(
+      (terms) => terms.caip19 === target.caip19.id && terms.payout === target.address
+    )
+  ).map((target) => `${target.caip19.id} ${target.address}`);
+  const product = listing === void 0 ? void 0 : parseProduct(listing);
+  for (const id of product?.accept ?? []) {
+    const caip19 = parseCaip19(id);
+    const target = targets.find((candidate) => candidate.caip19.id === caip19?.id);
+    if (caip19 === void 0 || target === void 0 || product === void 0) {
+      continue;
+    }
+    let amount;
+    try {
+      amount = priceInSubunits(product.price, caip19.asset).toString();
+    } catch {
+      continue;
+    }
+    const honoured = standing.some(
+      (terms) => terms.caip19 === caip19.id && terms.payout === target.address && terms.amount === amount
+    );
+    if (!honoured) {
+      found.push(`${caip19.id} at ${amount}`);
+    }
+  }
+  return [...new Set(found)];
+}
+var CHECKOUT_INBOX_CAP = 8;
+function inboxRelaysNotRead(inboxList, read) {
+  if (inboxList === void 0) {
+    return void 0;
+  }
+  const reading = read.map(checkoutRelaySpelling);
+  const listed = [];
+  for (const tag of inboxList.tags) {
+    const relay = tag[0] === "relay" ? checkoutRelaySpelling(tag[1]) : void 0;
+    if (relay !== void 0 && !listed.includes(relay)) {
+      listed.push(relay);
+    }
+  }
+  return listed.slice(0, CHECKOUT_INBOX_CAP).filter((relay) => !reading.includes(relay));
+}
+function offerProblems(views, inboxRelays, network, standing) {
+  const problems = /* @__PURE__ */ new Set();
+  let served = false;
+  for (const view of views) {
+    for (const relay of inboxRelaysNotRead(view.inboxList, inboxRelays) ?? []) {
+      problems.add(`orders sent to ${relay}, which this node does not read`);
+    }
+    const notHonoured = offersNotHonoured(view.listing, view.payoutList, network, standing);
+    served ||= notHonoured !== void 0;
+    for (const offer of notHonoured ?? []) {
+      problems.add(offer);
+    }
+  }
+  return { problems: [...problems], served };
+}
+async function newestInboxList(pool, relays, storePubkey) {
+  const events = await pool.querySync(
+    [...relays],
+    { kinds: [KIND_INBOX_RELAYS], authors: [storePubkey] },
+    { maxWait: READ_WAIT_MS }
+  ).catch(() => []);
+  return newest(
+    events.filter((event) => event.pubkey === storePubkey && event.kind === KIND_INBOX_RELAYS)
+  );
+}
+async function newestListing(pool, relays, storePubkey, d) {
+  const events = await pool.querySync(
+    [...relays],
+    { kinds: [KIND_PRODUCT], authors: [storePubkey], "#d": [d] },
+    { maxWait: READ_WAIT_MS }
+  ).catch(() => []);
+  return newest(
+    events.filter(
+      (event) => event.pubkey === storePubkey && event.kind === KIND_PRODUCT && event.tags.some((tag) => tag[0] === "d" && tag[1] === d)
+    )
+  );
+}
+function newest(events) {
+  return events.reduce(
+    (best, event) => best === void 0 || event.created_at > best.created_at || event.created_at === best.created_at && event.id < best.id ? event : best,
+    void 0
+  );
+}
+async function newestPayoutList(pool, relays, ownerPubkey) {
+  const events = await pool.querySync(
+    [...relays],
+    { kinds: [KIND_PAYTO], authors: [ownerPubkey] },
+    { maxWait: READ_WAIT_MS }
+  ).catch(() => []);
+  return newest(
+    events.filter((event) => event.pubkey === ownerPubkey && event.kind === KIND_PAYTO)
+  );
+}
+function errorText2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var MAX_INBOX_RELAYS = 5;
+function isLocalHost(host) {
+  return host === "localhost" || host === "127.0.0.1";
+}
+function urlWith(secure, insecure) {
+  return z.string().refine(
+    (value) => {
+      if (!URL.canParse(value)) {
+        return false;
+      }
+      const url = new URL(value);
+      return url.protocol === secure || url.protocol === insecure && isLocalHost(url.hostname);
+    },
+    { message: `must be a ${secure}// URL` }
+  );
+}
+var PRICE_RE = /^\d{1,9}(\.\d{1,6})?$/;
+var configSchema = z.object({
+  name: z.string().trim().min(1).max(100),
+  nip05: z.string().refine((value) => splitNip05(value) !== void 0, { message: "is not a nip05 address" }).refine((value) => splitNip05(value)?.local !== "owner", {
+    message: 'cannot use the name "owner" (it names the owner key)'
+  }).optional(),
+  network: z.enum(["mainnet", "devnet"]),
+  rpcUrl: urlWith("https:", "http:"),
+  inboxRelays: z.array(
+    urlWith("wss:", "ws:").refine(
+      (value) => value.startsWith("ws:") || checkoutRelaySpelling(value) !== void 0,
+      { message: "must be a relay the checkout contacts: wss: on a public DNS name" }
+    )
+  ).min(1).max(MAX_INBOX_RELAYS),
+  product: z.object({
+    d: z.string().regex(/^[A-Za-z0-9._-]{1,64}$/, "use 1-64 letters, digits, dots, dashes or underscores"),
+    title: z.string().trim().min(1).max(200),
+    description: z.string().max(LIMITS.MAX_CONTENT_LENGTH),
+    summary: z.string().max(LIMITS.MAX_TAG_VALUE_LENGTH).optional(),
+    priceUsd: z.string().refine((value) => PRICE_RE.test(value) && new Decimal(value).gt(0), {
+      message: 'must be a USD amount above 0, such as "49" or "0.50"'
+    }),
+    delivery: z.object({
+      method: z.enum(DELIVERY_METHODS),
+      value: z.string().min(1).max(LIMITS.MAX_TAG_VALUE_LENGTH)
+    })
+  }),
+  payouts: z.array(
+    z.object({
+      caip19: z.string(),
+      address: z.string(),
+      signature: z.string().optional()
+    })
+  ).min(1)
+}).strict().superRefine((config, context) => {
+  const spellings = config.inboxRelays.map(
+    (relay) => checkoutRelaySpelling(relay) ?? relay.replace(/\/+$/, "")
+  );
+  spellings.forEach((spelling, index) => {
+    if (spellings.indexOf(spelling) !== index) {
+      context.addIssue({
+        code: "custom",
+        path: ["inboxRelays", index],
+        message: "is listed twice"
+      });
+    }
+  });
+  const seen = /* @__PURE__ */ new Set();
+  config.payouts.forEach((payout, index) => {
+    const path = ["payouts", index];
+    const caip19 = parseCaip19(payout.caip19);
+    if (caip19 === void 0 || caip19.chain.family !== "solana") {
+      context.addIssue({
+        code: "custom",
+        path: [...path, "caip19"],
+        message: "must be a Solana coin this node can verify"
+      });
+      return;
+    }
+    if (caip19.chain.network !== config.network) {
+      context.addIssue({
+        code: "custom",
+        path: [...path, "caip19"],
+        message: `is on ${caip19.chain.network}, the node runs on ${config.network}`
+      });
+    }
+    if (canonicalPayoutAddress(caip19.chain, payout.address) !== payout.address) {
+      context.addIssue({
+        code: "custom",
+        path: [...path, "address"],
+        message: "is not a Solana address"
+      });
+    }
+    const price = config.product.priceUsd;
+    if (PRICE_RE.test(price) && new Decimal(price).gt(0)) {
+      try {
+        priceInSubunits({ amount: price, currency: "USD" }, caip19.asset);
+      } catch {
+        context.addIssue({
+          code: "custom",
+          path: [...path, "caip19"],
+          message: `${caip19.asset.symbol} cannot be paid a USD price`
+        });
+      }
+    }
+    if (seen.has(caip19.id)) {
+      context.addIssue({
+        code: "custom",
+        path: [...path, "caip19"],
+        message: "is listed twice: one payout per coin"
+      });
+    }
+    seen.add(caip19.id);
+  });
+});
+function parseConfig(value) {
+  const parsed = configSchema.safeParse(value);
+  if (parsed.success) {
+    const config = parsed.data;
+    config.inboxRelays = config.inboxRelays.map((relay) => checkoutRelaySpelling(relay) ?? relay);
+    return { ok: true, config };
+  }
+  return {
+    ok: false,
+    problems: parsed.error.issues.map(
+      (issue) => `${issue.path.length === 0 ? "config" : issue.path.join(".")}: ${issue.message}`
+    )
+  };
+}
+function loadConfig(path) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new Error(
+      `cannot read ${path}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  const parsed = parseConfig(value);
+  if (!parsed.ok) {
+    throw new Error(`${path} is not usable:
+- ${parsed.problems.join("\n- ")}`);
+  }
+  return parsed.config;
+}
+function configTemplate(network) {
+  const usdc = network === "mainnet" ? "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp/token:EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v" : "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1/token:4zMMC9srt5Ri5X14GAgXhaHii3GnPAEERYPJgZJDncDU";
+  return {
+    name: "My store",
+    network,
+    rpcUrl: network === "mainnet" ? "https://mainnet.helius-rpc.com/?api-key=<a server-side key>" : "https://api.devnet.solana.com",
+    inboxRelays: ["wss://relay.elisym.network", "wss://nos.lol"],
+    product: {
+      d: "my-product",
+      title: "My product",
+      description: "What the buyer gets.",
+      priceUsd: "10",
+      delivery: { method: "access", value: "https://example.com/<the link the buyer gets>" }
+    },
+    payouts: [{ caip19: usdc, address: "<your Solana wallet address>" }]
+  };
+}
+var HOME_ENV = "ELISYM_MERCHANT_HOME";
+var DEFAULT_HOME_NAME = ".elisym-merchant";
+function merchantHome(flag, env = process.env) {
+  const chosen = flag ?? env[HOME_ENV];
+  const dir = resolve(
+    chosen === void 0 || chosen === "" ? join(homedir(), DEFAULT_HOME_NAME) : chosen
+  );
+  return {
+    dir,
+    config: join(dir, "config.json"),
+    keys: join(dir, "keys.json"),
+    ledger: join(dir, "ledger.json"),
+    lock: join(dir, "run.lock"),
+    nostrJson: join(dir, "nostr.json")
+  };
+}
+function ensureHome(home) {
+  mkdirSync(home.dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(home.dir, 448);
+  } catch {
+  }
+}
+function isMissing(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function loadOrCreateKeys(home, create) {
+  let text;
+  try {
+    text = readFileSync(home.keys, "utf8");
+  } catch (error) {
+    if (!isMissing(error)) {
+      throw error;
+    }
+  }
+  if (text !== void 0) {
+    const stored = JSON.parse(text);
+    return { storeSecretKey: hexToBytes(stored.store), ownerSecretKey: hexToBytes(stored.owner) };
+  }
+  if (!create) {
+    throw new Error(`no store keys in ${home.dir}: run init first`);
+  }
+  const keys = { storeSecretKey: generateSecretKey(), ownerSecretKey: generateSecretKey() };
+  ensureHome(home);
+  writeFileSync(
+    home.keys,
+    `${JSON.stringify({ store: bytesToHex(keys.storeSecretKey), owner: bytesToHex(keys.ownerSecretKey) })}
+`,
+    { mode: 384, flag: "wx" }
+  );
+  return keys;
+}
+var LOCK_STALE_MS = 9e4;
+var LOCK_HEARTBEAT_MS = 2e4;
+function heldByRunningMerchant(home, now = Date.now()) {
+  try {
+    return now - statSync(home.lock).mtimeMs < LOCK_STALE_MS;
+  } catch {
+    return false;
+  }
+}
+function createLock(home, token) {
+  try {
+    writeFileSync(home.lock, token, { flag: "wx", mode: 384 });
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "EEXIST") {
+      return false;
+    }
+    throw error;
+  }
+}
+function heldError(home) {
+  return new Error(
+    `another merchant holds ${home.lock}; a node that stopped without releasing it frees it ${LOCK_STALE_MS / 1e3} s after its last refresh`
+  );
+}
+function takeLock(home, options = {}) {
+  ensureHome(home);
+  const token = `${process.pid}-${randomBytes(8).toString("hex")}`;
+  if (!createLock(home, token)) {
+    if (heldByRunningMerchant(home, options.judgedAt)) {
+      throw heldError(home);
+    }
+    const aside = `${home.lock}.${token}`;
+    try {
+      renameSync(home.lock, aside);
+    } catch {
+      throw heldError(home);
+    }
+    if (Date.now() - statSync(aside).mtimeMs < LOCK_STALE_MS) {
+      try {
+        linkSync(aside, home.lock);
+      } catch {
+      }
+      rmSync(aside, { force: true });
+      throw heldError(home);
+    }
+    rmSync(aside, { force: true });
+    if (!createLock(home, token)) {
+      throw heldError(home);
+    }
+  }
+  const ours = () => {
+    try {
+      return readFileSync(home.lock, "utf8") === token;
+    } catch {
+      return false;
+    }
+  };
+  const onLost = options.onLost ?? (() => {
+    console.error(`error: ${home.lock} was taken by another process; stopping`);
+    process.exit(1);
+  });
+  const heartbeat = setInterval(() => {
+    try {
+      if (!ours()) {
+        clearInterval(heartbeat);
+        onLost();
+        return;
+      }
+      const now = /* @__PURE__ */ new Date();
+      utimesSync(home.lock, now, now);
+    } catch {
+    }
+  }, LOCK_HEARTBEAT_MS);
+  heartbeat.unref();
+  const release = () => {
+    clearInterval(heartbeat);
+    process.removeListener("exit", release);
+    if (ours()) {
+      rmSync(home.lock, { force: true });
+    }
+  };
+  process.once("exit", release);
+  return release;
+}
+function emptyLedger() {
+  return { version: 1, orders: {}, seenRumors: {}, claims: {}, terms: [], scans: {} };
+}
+function orderKey(buyerPubkey, orderId) {
+  return `${buyerPubkey}:${orderId}`;
+}
+function claimPayment(state, signature, key) {
+  const holder = state.claims[signature];
+  if (holder !== void 0 && holder !== key) {
+    return false;
+  }
+  state.claims[signature] = key;
+  return true;
+}
+function openOrders(state, now, catchUpSecs) {
+  return Object.values(state.orders).filter(
+    (order) => order.paid === void 0 && now - order.createdAt <= catchUpSecs
+  );
+}
+function undeliveredOrders(state) {
+  return Object.values(state.orders).filter(
+    (order) => order.paid !== void 0 && order.deliveredAt === void 0
+  );
+}
+function pruneExpiredOrders(state, now) {
+  for (const [key, order] of Object.entries(state.orders)) {
+    if (order.paid === void 0 && now - order.createdAt > CATCH_UP_SECS + MAX_FUTURE_SKEW_SECS) {
+      delete state.orders[key];
+      (state.closedOrders ??= {})[key] = true;
+    }
+  }
+}
+function recordReport(order, tx, arrivedAt) {
+  order.reportedTxs.push(tx);
+  order.recheckedAt = { ...order.recheckedAt, [tx]: arrivedAt };
+}
+function loadLedger(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return emptyLedger();
+  }
+  const state = JSON.parse(text);
+  if (state.version !== 1) {
+    throw new Error(`Unknown ledger version in ${path}`);
+  }
+  state.scans ??= {};
+  return state;
+}
+function saveLedger(path, state) {
+  const temporary = `${path}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+  renameSync(temporary, path);
+}
+function isSolanaSignature(value) {
+  try {
+    return isSignature(value);
+  } catch {
+    return false;
+  }
+}
+
+// src/intake.ts
+function storeIdentity(storePubkey, d, mediums) {
+  return { storePubkey, productAddress: productAddress({ storePubkey, d }), mediums };
+}
+function intake(state, unwrapped, store, now = Math.floor(Date.now() / 1e3)) {
+  if (state.seenRumors[unwrapped.rumorId] === true) {
+    return { kind: "ignored", reason: "seen" };
+  }
+  const { message } = unwrapped;
+  if (unwrapped.recipientPubkey !== store.storePubkey) {
+    return { kind: "ignored", reason: "not_for_this_store" };
+  }
+  if (message.type === "order") {
+    if (message.storePubkey !== store.storePubkey) {
+      return { kind: "ignored", reason: "not_for_this_store" };
+    }
+    const [item, ...rest] = message.items;
+    if (unwrapped.createdAt < EARLIEST_ORDER_SECS || item === void 0 || rest.length > 0 || item.product !== store.productAddress || item.quantity !== 1) {
+      return { kind: "ignored", reason: "not_a_direct_order" };
+    }
+    const key = orderKey(unwrapped.senderPubkey, message.orderId);
+    state.seenRumors[unwrapped.rumorId] = true;
+    if (state.orders[key] !== void 0 || state.closedOrders?.[key] === true) {
+      return { kind: "ignored", reason: "order_id_reused" };
+    }
+    const reference = deriveOrderPaymentReference({
+      storePubkey: store.storePubkey,
+      buyerPubkey: unwrapped.senderPubkey,
+      orderId: message.orderId
+    });
+    const order = {
+      key,
+      buyerPubkey: unwrapped.senderPubkey,
+      orderId: message.orderId,
+      rumorId: unwrapped.rumorId,
+      createdAt: unwrapped.createdAt,
+      reference: reference.solana,
+      reportedTxs: [],
+      ...message.email === void 0 ? {} : { email: message.email }
+    };
+    state.orders[key] = order;
+    return { kind: "order", order };
+  }
+  if (message.type === "receipt") {
+    if (message.storePubkey !== store.storePubkey) {
+      return { kind: "ignored", reason: "not_for_this_store" };
+    }
+    const order = state.orders[orderKey(unwrapped.senderPubkey, message.orderId)];
+    if (order === void 0) {
+      return { kind: "ignored", reason: "unknown_order" };
+    }
+    const { medium, reference, tx } = message.payment;
+    if (reference !== order.reference || !store.mediums.includes(medium) || !isSolanaSignature(tx)) {
+      return { kind: "ignored", reason: "foreign_payment" };
+    }
+    if (!order.reportedTxs.includes(tx) && order.reportedTxs.length >= MAX_RECEIPTS_PER_ORDER) {
+      return { kind: "ignored", reason: "too_many_receipts" };
+    }
+    state.seenRumors[unwrapped.rumorId] = true;
+    const isNew = !order.reportedTxs.includes(tx);
+    if (isNew) {
+      recordReport(order, tx, now);
+    }
+    return { kind: "receipt", order, tx, isNew };
+  }
+  return { kind: "ignored", reason: "not_handled" };
+}
+var EOSE_CLOSE_REASON = "closed automatically on eose";
+var PAGE_WAIT_MS = 3e4;
+var LIBRARY_WAIT_MS = PAGE_WAIT_MS + 15e3;
+var BACKFILL_RETRY_MS = 3e4;
+function resumePointAfterSweep(allLive, queuedAt, current) {
+  return allLive ? queuedAt : current;
+}
+var SeenWraps = class {
+  seen = /* @__PURE__ */ new Map();
+  /** True the first time a wrap id is offered, false after. */
+  admit(wrap) {
+    if (this.seen.has(wrap.id)) {
+      return false;
+    }
+    this.seen.set(wrap.id, wrap.created_at);
+    return true;
+  }
+  /** Let a wrap be offered again (one that could not be acted on yet). */
+  forget(id) {
+    this.seen.delete(id);
+  }
+  /** Forget wraps dated before `oldestReadable`: no read reaches them any more. */
+  prune(oldestReadable) {
+    for (const [id, createdAt] of this.seen) {
+      if (createdAt < oldestReadable) {
+        this.seen.delete(id);
+      }
+    }
+  }
+  get size() {
+    return this.seen.size;
+  }
+};
+function readSince(from) {
+  return from - WRAP_BACKDATE_SECS - MAX_FUTURE_SKEW_SECS;
+}
+function wrapFilter(storePubkey, since, until) {
+  return {
+    kinds: [KIND_GIFT_WRAP],
+    "#p": [storePubkey],
+    since,
+    ...until === void 0 ? {} : { until }
+  };
+}
+function nextPageUntil(since, until, received, oldest) {
+  if (received === 0 || oldest <= since) {
+    return void 0;
+  }
+  const next = oldest < until ? oldest : until - 1;
+  return next > since ? next : void 0;
+}
+var InboxListener = class {
+  constructor(options) {
+    this.options = options;
+    this.setTimer = options.setTimer ?? ((task, ms) => {
+      const handle = setTimeout(task, ms);
+      return () => clearTimeout(handle);
+    });
+  }
+  live = /* @__PURE__ */ new Set();
+  attempts = /* @__PURE__ */ new Map();
+  setTimer;
+  /** Whether every one of `relays` is currently read through and listening. */
+  allLive(relays) {
+    return relays.every((relay) => this.live.has(relay));
+  }
+  isLive(relay) {
+    return this.live.has(relay);
+  }
+  /** Listen on `relay` for every wrap sent since `from`. */
+  listen(relay, from) {
+    const { pool, storePubkey, auth, onWrap, log: log2, now } = this.options;
+    const since = readSince(from);
+    const openedAt = now();
+    let closed = false;
+    let readThrough = false;
+    const runBackfill = () => {
+      if (closed) {
+        return;
+      }
+      void this.backfill(relay, since, openedAt).then((done) => {
+        if (closed) {
+          return;
+        }
+        if (done) {
+          readThrough = true;
+          this.attempts.set(relay, 0);
+          this.live.add(relay);
+          return;
+        }
+        log2(`could not read the stored wraps of ${relay}; trying again`);
+        this.setTimer(runBackfill, BACKFILL_RETRY_MS);
+      });
+    };
+    pool.subscribe([relay], wrapFilter(storePubkey, since), {
+      onauth: auth,
+      onevent: onWrap,
+      // nostr-tools also calls this right before `onclose` when a subscription
+      // fails: the backfill starts on the next turn, and only if still open.
+      oneose: () => this.setTimer(runBackfill, 0),
+      onclose: (reasons) => {
+        closed = true;
+        this.live.delete(relay);
+        const attempt = this.attempts.get(relay) ?? 0;
+        this.attempts.set(relay, attempt + 1);
+        const pause = RESUBSCRIBE_BACKOFF_MS[Math.min(attempt, RESUBSCRIBE_BACKOFF_MS.length - 1)] ?? 6e4;
+        const resumeFrom = readThrough ? now() : from;
+        log2(`subscription on ${relay} closed (${reasons.join(", ")}); again in ${pause} ms`);
+        this.setTimer(() => this.listen(relay, resumeFrom), pause);
+      }
+    });
+  }
+  /** Page backwards through `relay`'s stored wraps in `[since, until]`; true only when read to the end. */
+  backfill(relay, since, until) {
+    const { pool, storePubkey, auth, onWrap } = this.options;
+    return new Promise((resolve2) => {
+      let received = 0;
+      let oldest = until;
+      let timedOut = false;
+      let cancelTimer;
+      const subscription = pool.subscribeEose([relay], wrapFilter(storePubkey, since, until), {
+        maxWait: LIBRARY_WAIT_MS,
+        onauth: auth,
+        onevent: (wrap) => {
+          received += 1;
+          oldest = Math.min(oldest, wrap.created_at);
+          onWrap(wrap);
+        },
+        onclose: (reasons) => {
+          cancelTimer?.();
+          if (timedOut || !reasons.every((reason) => reason === EOSE_CLOSE_REASON)) {
+            resolve2(false);
+            return;
+          }
+          const next = nextPageUntil(since, until, received, oldest);
+          if (next === void 0) {
+            resolve2(true);
+          } else {
+            void this.backfill(relay, since, next).then(resolve2);
+          }
+        }
+      });
+      cancelTimer = this.setTimer(() => {
+        timedOut = true;
+        subscription.close();
+      }, PAGE_WAIT_MS);
+    });
+  }
+};
+function buildDeliveryReply(order, delivery, storeSecretKey, createdAt) {
+  if (order.paid === void 0) {
+    throw new Error("Only a paid order is delivered");
+  }
+  const rumor = buildOrderMessage(
+    {
+      type: "status",
+      buyerPubkey: order.buyerPubkey,
+      orderId: order.orderId,
+      status: "completed",
+      delivery,
+      receipt: {
+        medium: order.paid.medium,
+        tx: order.paid.signature,
+        amount: order.paid.amount,
+        fee: "0"
+      }
+    },
+    createdAt
+  );
+  return wrapOrderMessage(rumor, storeSecretKey, order.buyerPubkey);
+}
+function deliveryDone(accepted, relays, paidAgeSecs) {
+  if (accepted === 0) {
+    return false;
+  }
+  return accepted >= Math.min(DELIVERY_RELAYS_WANTED, relays) || paidAgeSecs >= DELIVERY_SETTLE_SECS;
+}
+
+// src/terms.ts
+function sameTerms(left, right) {
+  return left.caip19 === right.caip19 && left.payout === right.payout && left.amount === right.amount;
+}
+function publishTerms(periods, terms, at) {
+  const standing = periods.find(
+    (period) => period.until === void 0 && period.terms.caip19 === terms.caip19
+  );
+  if (standing !== void 0 && sameTerms(standing.terms, terms)) {
+    return [...periods];
+  }
+  return [
+    ...periods.map(
+      (period) => period === standing ? { ...period, until: Math.max(at, period.from) } : period
+    ),
+    { terms, from: at }
+  ];
+}
+function retireTerms(periods, offered, at) {
+  return periods.map(
+    (period) => period.until === void 0 && !offered.includes(period.terms.caip19) ? { ...period, until: Math.max(at, period.from) } : period
+  );
+}
+function termsAt(periods, blockTime) {
+  const earliest = blockTime - TERMS_WINDOW_SECS;
+  const found = [];
+  for (const period of periods) {
+    const offered = period.from <= blockTime && (period.until === void 0 || period.until > earliest);
+    if (offered && !found.some((terms) => sameTerms(terms, period.terms))) {
+      found.push(period.terms);
+    }
+  }
+  return found;
+}
+function termsSince(periods, since) {
+  const earliest = since - TERMS_WINDOW_SECS;
+  const found = [];
+  for (const period of periods) {
+    if ((period.until === void 0 || period.until > earliest) && !found.some((terms) => sameTerms(terms, period.terms))) {
+      found.push(period.terms);
+    }
+  }
+  return found;
+}
+function standingTerms(periods) {
+  return periods.filter((period) => period.until === void 0).map((period) => period.terms);
+}
+function visibleTerms(standing, next, listingOut, payoutsOut) {
+  const listed = listingOut ? next : standing;
+  const payouts = payoutsOut ? next : standing;
+  const visible = [];
+  for (const { caip19, amount } of listed) {
+    const payout = payouts.find((terms) => terms.caip19 === caip19)?.payout;
+    if (payout !== void 0) {
+      visible.push({ caip19, payout, amount });
+    }
+  }
+  return visible;
+}
+
+// src/solana.ts
+function solanaAsset(terms, network) {
+  const caip19 = parseCaip19(terms.caip19);
+  if (caip19 === void 0 || caip19.chain.family !== "solana" || caip19.chain.network !== network) {
+    return void 0;
+  }
+  return caip19.asset;
+}
+var ASK_AGAIN_REASONS = ["rpc_error", "unreadable", "not_found"];
+async function checkPayment(state, order, signature, context) {
+  const holder = state.claims[signature];
+  if (holder !== void 0 && holder !== order.key) {
+    return { kind: "refused", reason: "claimed_by_another_order" };
+  }
+  if (order.paid !== void 0) {
+    return order.paid.signature === signature ? { kind: "paid", order } : { kind: "refused", reason: "order_already_paid" };
+  }
+  const candidates = termsSince(state.terms, order.createdAt - ORDER_SCAN_MARGIN_SECS);
+  let askAgain = false;
+  for (const terms of candidates) {
+    const asset = solanaAsset(terms, context.network);
+    if (asset === void 0) {
+      continue;
+    }
+    const request = composeSolanaPaymentRequest({
+      recipient: terms.payout,
+      amount: BigInt(terms.amount),
+      asset,
+      network: context.network,
+      reference: order.reference,
+      createdAt: order.createdAt
+    });
+    const verdict = await verifyDirectSolanaPayment(context.rpc, request, signature);
+    if (!verdict.verified) {
+      askAgain ||= ASK_AGAIN_REASONS.includes(verdict.reason);
+      continue;
+    }
+    if (verdict.blockTime === null) {
+      askAgain = true;
+      continue;
+    }
+    const offered = termsAt(state.terms, verdict.blockTime).some(
+      (standing) => standing.caip19 === terms.caip19 && standing.payout === terms.payout && standing.amount === terms.amount
+    );
+    if (!offered) {
+      continue;
+    }
+    if (!claimPayment(state, signature, order.key)) {
+      return { kind: "refused", reason: "claimed_by_another_order" };
+    }
+    order.paid = {
+      signature,
+      amount: verdict.amount.toString(),
+      blockTime: verdict.blockTime,
+      caip19: terms.caip19,
+      medium: SOLANA_MEDIUMS[context.network]
+    };
+    return { kind: "paid", order };
+  }
+  return askAgain ? { kind: "ask_again" } : { kind: "refused", reason: "not_a_payment_for_this_order" };
+}
+async function receivingAccount(terms, asset) {
+  if (asset.mint === void 0) {
+    return terms.payout;
+  }
+  const [account] = await findAssociatedTokenPda({
+    owner: address(terms.payout),
+    mint: address(asset.mint),
+    tokenProgram: asset.tokenProgram === void 0 ? TOKEN_PROGRAM_ADDRESS : address(asset.tokenProgram)
+  });
+  return account;
+}
+async function boundReferences(instructions, terms, asset) {
+  const candidates = /* @__PURE__ */ new Set();
+  for (const instruction of instructions) {
+    const { accounts } = instruction;
+    const tag = accounts[accounts.length - 1];
+    const reference = accounts[accounts.length - 2];
+    if (tag?.address === ELISYM_PROTOCOL_TAG && reference !== void 0) {
+      candidates.add(reference.address);
+    }
+  }
+  const bound = [];
+  for (const reference of candidates) {
+    const amount = await boundTransferAmount(instructions, {
+      reference,
+      recipient: terms.payout,
+      asset
+    });
+    if (amount > 0n) {
+      bound.push(reference);
+    }
+  }
+  return bound;
+}
+async function scanTransaction(signature, terms, asset, context) {
+  let transaction;
+  try {
+    transaction = await context.rpc.getTransaction(signature, {
+      commitment: "confirmed",
+      encoding: "json",
+      maxSupportedTransactionVersion: 0
+    }).send();
+  } catch {
+    return void 0;
+  }
+  if (transaction === null || typeof transaction !== "object") {
+    return void 0;
+  }
+  const blockTime = Reflect.get(transaction, "blockTime");
+  if (typeof blockTime !== "number" && typeof blockTime !== "bigint") {
+    return void 0;
+  }
+  let instructions;
+  try {
+    instructions = directInstructionsFromRpcTransaction(transaction);
+  } catch {
+    return void 0;
+  }
+  return {
+    blockTime: Number(blockTime),
+    references: await boundReferences(instructions, terms, asset)
+  };
+}
+async function catchUp(state, context, now) {
+  const result = { paid: [], incomplete: [] };
+  const open = openOrders(state, now, CATCH_UP_SECS);
+  forgetOldScans(state, now);
+  if (open.length === 0) {
+    return result;
+  }
+  const byReference = new Map(open.map((order) => [order.reference, order]));
+  const credit = async (order, signature) => {
+    if (order.paid !== void 0 || order.refusedTxs?.includes(signature) === true || state.claims[signature] !== void 0) {
+      return;
+    }
+    const check2 = await checkPayment(state, order, signature, context);
+    if (check2.kind === "paid") {
+      result.paid.push(order);
+    } else if (check2.kind === "refused") {
+      order.refusedTxs = [...order.refusedTxs ?? [], signature];
+    }
+  };
+  const pending = [];
+  for (const order of open) {
+    for (const signature of order.reportedTxs) {
+      if (order.paid === void 0 && order.refusedTxs?.includes(signature) !== true && state.claims[signature] === void 0) {
+        pending.push({ order, signature, checkedAt: order.recheckedAt?.[signature] ?? 0 });
+      }
+    }
+  }
+  pending.sort((left, right) => left.checkedAt - right.checkedAt);
+  for (const { order, signature } of pending.slice(0, MAX_RECHECKS_PER_SWEEP)) {
+    order.recheckedAt = { ...order.recheckedAt, [signature]: now };
+    await credit(order, signature);
+  }
+  let oldest = Number.POSITIVE_INFINITY;
+  for (const order of open) {
+    oldest = Math.min(oldest, order.createdAt);
+  }
+  oldest -= ORDER_SCAN_MARGIN_SECS;
+  const scannedAccounts = /* @__PURE__ */ new Set();
+  for (const terms of termsSince(state.terms, oldest)) {
+    const asset = solanaAsset(terms, context.network);
+    if (asset === void 0) {
+      continue;
+    }
+    const account = await receivingAccount(terms, asset);
+    if (scannedAccounts.has(account)) {
+      continue;
+    }
+    scannedAccounts.add(account);
+    const listing = await listReferenceSignatures(context.rpc, account, {
+      notBefore: oldest,
+      commitment: "confirmed"
+    });
+    if (!listing.complete) {
+      result.incomplete.push(account);
+    }
+    for (const entry of listing.signatures) {
+      if (entry.failed || !isSolanaSignature(entry.signature) || entry.blockTime !== null && entry.blockTime < oldest) {
+        continue;
+      }
+      const memo = `${account}:${entry.signature}`;
+      let scan = state.scans[memo];
+      if (scan === void 0) {
+        scan = await scanTransaction(entry.signature, terms, asset, context);
+        if (scan === void 0) {
+          continue;
+        }
+        state.scans[memo] = scan;
+      }
+      for (const reference of scan.references) {
+        const order = byReference.get(reference);
+        if (order !== void 0) {
+          await credit(order, entry.signature);
+        }
+      }
+    }
+  }
+  return result;
+}
+function forgetOldScans(state, now) {
+  const horizon = now - CATCH_UP_SECS - ORDER_SCAN_MARGIN_SECS - TERMS_WINDOW_SECS;
+  for (const [memo, scan] of Object.entries(state.scans)) {
+    if (scan.blockTime < horizon) {
+      delete state.scans[memo];
+    }
+  }
+}
+
+// src/runtime.ts
+var MerchantRuntime = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.check = deps.checkPayment ?? checkPayment;
+    this.sweepCatchUp = deps.catchUp ?? catchUp;
+  }
+  seenWraps = new SeenWraps();
+  check;
+  /** Live checks in the current minute: `[minute, count]`. */
+  liveChecks = [0, 0];
+  sweepCatchUp;
+  /** When each delivered order's status was last sent again (this run only). */
+  resentAt = /* @__PURE__ */ new Map();
+  repeatsInFlight = 0;
+  /**
+   * Whether a wrap goes on the queue: not one dated further ahead than any
+   * genuine wrap can be (NIP-59 only back-dates; nothing would ever prune it),
+   * and not one already handed on (the live burst overlapping the backfill, a
+   * reconnect re-reading its window).
+   */
+  admit(wrap) {
+    if (wrap.created_at > this.deps.now() + MAX_FUTURE_SKEW_SECS) {
+      return false;
+    }
+    return this.seenWraps.admit(wrap);
+  }
+  /** Take one wrap in: an order is recorded; a receipt's transaction is checked. */
+  async handleWrap(wrap) {
+    const { state, store, storeSecretKey, save, log: log2 } = this.deps;
+    const unwrapped = unwrapOrderMessage(wrap, storeSecretKey);
+    if (unwrapped === void 0) {
+      return;
+    }
+    const result = intake(state, unwrapped, store, this.deps.now());
+    const { message } = unwrapped;
+    const again = result.kind === "ignored" && result.reason === "seen" || result.kind === "receipt";
+    if (again && (message.type === "order" || message.type === "receipt")) {
+      const known = state.orders[orderKey(unwrapped.senderPubkey, message.orderId)];
+      if (known?.deliveredAt !== void 0 && message.storePubkey === store.storePubkey) {
+        if (result.kind === "receipt") {
+          save();
+        }
+        this.resend(known);
+        return;
+      }
+    }
+    if (result.kind === "ignored") {
+      if (result.reason === "unknown_order") {
+        this.seenWraps.forget(wrap.id);
+      }
+      return;
+    }
+    save();
+    if (result.kind === "order") {
+      log2(`order ${result.order.key}`);
+      return;
+    }
+    if (!result.isNew || result.order.refusedTxs?.includes(result.tx) === true || !this.takeLiveCheck()) {
+      return;
+    }
+    await this.checkReported(result.order, result.tx, 0);
+  }
+  /** Check one reported transaction now; one the RPC does not see yet is tried again soon. */
+  async checkReported(order, tx, attempt) {
+    const { state, context, save, log: log2 } = this.deps;
+    const check2 = await this.check(state, order, tx, context);
+    log2(`receipt ${order.key} ${tx}: ${check2.kind}`);
+    if (check2.kind === "refused") {
+      order.refusedTxs = [...order.refusedTxs ?? [], tx];
+    }
+    save();
+    if (check2.kind === "paid") {
+      await this.deliverPending();
+    } else if (check2.kind === "ask_again") {
+      this.askAgain(order.key, tx, attempt);
+    }
+  }
+  askAgain(key, tx, attempt) {
+    const delay = ASK_AGAIN_DELAYS_MS[attempt];
+    if (delay === void 0 || this.deps.later === void 0) {
+      return;
+    }
+    this.deps.later(delay, async () => {
+      const order = this.deps.state.orders[key];
+      if (order === void 0 || order.paid !== void 0 || !order.reportedTxs.includes(tx) || order.refusedTxs?.includes(tx) === true || !this.takeLiveCheck()) {
+        return;
+      }
+      await this.checkReported(order, tx, attempt + 1);
+    });
+  }
+  /**
+   * Send a delivered order's status again, at most every `RESEND_EVERY_SECS`,
+   * off the queue (it changes no ledger state) and a few at a time: one skipped
+   * now is sent when the order is read again.
+   */
+  resend(order) {
+    const now = this.deps.now();
+    const last = this.resentAt.get(order.key);
+    if (last !== void 0 && now - last < RESEND_EVERY_SECS || this.repeatsInFlight >= MAX_REPEATS_IN_FLIGHT) {
+      return;
+    }
+    this.resentAt.set(order.key, now);
+    this.repeatsInFlight += 1;
+    const { deliver: deliver2, log: log2 } = this.deps;
+    void deliver2(order, []).then((taken) => {
+      log2(`delivery for ${order.key} sent again: taken by ${taken.length}`);
+    }).catch((error) => {
+      log2(`delivery for ${order.key} not sent again: ${String(error)}`);
+    }).finally(() => {
+      this.repeatsInFlight -= 1;
+    });
+  }
+  takeLiveCheck() {
+    const minute = Math.floor(this.deps.now() / 60);
+    const [current, count] = this.liveChecks;
+    const used = current === minute ? count : 0;
+    if (used >= MAX_LIVE_CHECKS_PER_MINUTE) {
+      return false;
+    }
+    this.liveChecks = [minute, used + 1];
+    return true;
+  }
+  /** One catch-up sweep; `allLive` and `queuedAt` were taken when it was queued. */
+  async sweep(allLive, queuedAt) {
+    const { state, context, save, log: log2, now } = this.deps;
+    state.resumeAt = resumePointAfterSweep(allLive, queuedAt, state.resumeAt);
+    pruneExpiredOrders(state, now());
+    this.seenWraps.prune(readSince(now()));
+    for (const [key, at] of this.resentAt) {
+      if (now() - at >= RESEND_EVERY_SECS) {
+        this.resentAt.delete(key);
+      }
+    }
+    try {
+      const result = await this.sweepCatchUp(state, context, now());
+      if (result.paid.length > 0) {
+        log2(`catch-up found ${result.paid.length} payment(s)`);
+      }
+      for (const account of result.incomplete) {
+        log2(`warning: the history of ${account} was cut short; older payments may be missed`);
+      }
+    } finally {
+      save();
+      await this.deliverPending();
+    }
+  }
+  /**
+   * Deliver every paid order not yet delivered, all at once (a hung relay costs
+   * one deadline, not one per order), each only to the relays that have not
+   * taken it yet (the buyer gets no pile of copies while one relay is down).
+   * An order counts as delivered per `deliveryDone`, and it is saved.
+   */
+  async deliverPending() {
+    const { state, save, log: log2, now, deliver: deliver2, inboxRelayCount } = this.deps;
+    const pending = undeliveredOrders(state);
+    if (pending.length === 0) {
+      return;
+    }
+    const taken = await Promise.all(
+      pending.map((order) => deliver2(order, order.deliveredTo ?? []).catch(() => []))
+    );
+    const at = now();
+    let changed = false;
+    pending.forEach((order, index) => {
+      const fresh = (taken[index] ?? []).filter(
+        (relay) => !(order.deliveredTo ?? []).includes(relay)
+      );
+      if (fresh.length > 0) {
+        changed = true;
+        order.deliveredTo = [...order.deliveredTo ?? [], ...fresh];
+      }
+      const paidAge = at - (order.paid?.blockTime ?? at);
+      if (deliveryDone(order.deliveredTo?.length ?? 0, inboxRelayCount, paidAge)) {
+        changed = true;
+        order.deliveredAt = at;
+        log2(`delivered ${order.key} (${order.paid?.signature ?? ""})`);
+      } else {
+        log2(`delivery for ${order.key} taken by ${order.deliveredTo?.length ?? 0}; will retry`);
+      }
+    });
+    if (changed) {
+      save();
+    }
+  }
+};
+
+// src/setup-ledger.ts
+function payoutListDate(state, payouts, newestOnRelays, now) {
+  const signed = state.payto;
+  return signed !== void 0 && signed.payouts === payouts && newestOnRelays === signed.createdAt ? signed.createdAt : now;
+}
+function setupRefusal(state, productD) {
+  if (state.productD !== void 0 && state.productD !== productD) {
+    return `the product id changed from "${state.productD}" to "${productD}": the old listing would stay payable with no one taking its orders. Keep the id, or give a new product its own home.`;
+  }
+  return void 0;
+}
+function recordPublished(state, next, outcome, at, payoutList, productD) {
+  const visible = visibleTerms(standingTerms(state.terms), next, outcome.listing, outcome.payouts);
+  state.terms = retireTerms(
+    state.terms,
+    visible.map((terms) => terms.caip19),
+    at
+  );
+  for (const terms of visible) {
+    state.terms = publishTerms(state.terms, terms, at);
+  }
+  if (outcome.payouts) {
+    state.payto = payoutList;
+  }
+  if (outcome.listing) {
+    state.productD = productD;
+  }
+}
+var NOSTR_JSON_OWNER_NAME = "owner";
+function buildStoreEvents(config, keys, createdAt, options = {}) {
+  const storePubkey = getPublicKey(keys.storeSecretKey);
+  const ownerPubkey = getPublicKey(keys.ownerSecretKey);
+  const price = { amount: config.product.priceUsd, currency: "USD" };
+  const terms = config.payouts.map((payout) => {
+    const caip19 = parseCaip19(payout.caip19);
+    if (caip19 === void 0) {
+      throw new Error(`Not a payable CAIP-19 asset: ${payout.caip19}`);
+    }
+    return {
+      caip19: caip19.id,
+      payout: payout.address,
+      amount: priceInSubunits(price, caip19.asset).toString()
+    };
+  });
+  const byStore = (template) => finalizeEvent(template, keys.storeSecretKey);
+  const byOwner = (template) => finalizeEvent(template, keys.ownerSecretKey);
+  const events = [
+    byStore(
+      buildProductEvent({
+        d: config.product.d,
+        title: config.product.title,
+        description: config.product.description,
+        ...config.product.summary === void 0 ? {} : { summary: config.product.summary },
+        price,
+        accept: config.payouts.map((payout) => payout.caip19),
+        createdAt
+      })
+    ),
+    byStore(
+      buildStoreProfileEvent({
+        name: config.name,
+        ownerPubkey,
+        createdAt,
+        ...config.nip05 === void 0 ? {} : { nip05: config.nip05 }
+      })
+    ),
+    byStore({
+      kind: KIND_INBOX_RELAYS,
+      created_at: createdAt,
+      tags: config.inboxRelays.map((relay) => ["relay", relay]),
+      content: ""
+    }),
+    byOwner(
+      buildPaytoEvent({
+        ownerPubkey,
+        accept: config.payouts,
+        createdAt: options.paytoCreatedAt ?? createdAt
+      })
+    ),
+    byOwner(buildStoreAuthEvent({ storePubkey, mode: "self-host", createdAt }))
+  ];
+  const local = config.nip05 === void 0 ? "_" : splitNip05(config.nip05)?.local ?? "_";
+  if (local === NOSTR_JSON_OWNER_NAME) {
+    throw new Error(
+      `The store's nip05 name cannot be "${NOSTR_JSON_OWNER_NAME}": it names the owner`
+    );
+  }
+  return {
+    events,
+    naddr: encodeProductNaddr({ storePubkey, d: config.product.d }, [...options.hints ?? []]),
+    terms,
+    nostrJson: { names: { [local]: storePubkey, [NOSTR_JSON_OWNER_NAME]: ownerPubkey } }
+  };
+}
+
+// src/cli.ts
+var USAGE = `usage: elisym-merchant <command> [--home <dir>]
+
+  init [--network devnet|mainnet]
+         make the home: a config.json to edit and the store's keys
+  setup  check the inbox relays and publish the store (after editing config.json)
+  run    take orders, verify payments, deliver
+  orders list the orders: paid, delivered, the buyer's email
+  check  check the inbox relays, the owner's payout list and the domain
+
+The home is --home, else $ELISYM_MERCHANT_HOME, else ~/.elisym-merchant.
+It holds the store's secret keys: keep it private and back it up.`;
+function storeAuth(keys) {
+  return async (template) => finalizeEvent(template, keys.storeSecretKey);
+}
+function nowSecs() {
+  return Math.floor(Date.now() / 1e3);
+}
+function log(message) {
+  console.log(`${(/* @__PURE__ */ new Date()).toISOString()} ${message}`);
+}
+function errorText3(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function parseArgs(argv) {
+  const args = { command: void 0, home: void 0, network: void 0 };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--home" || arg === "--network") {
+      const value = argv[index + 1];
+      if (value === void 0 || value.startsWith("--")) {
+        throw new Error(`${arg} needs a value`);
+      }
+      args[arg === "--home" ? "home" : "network"] = value;
+      index += 1;
+    } else if (args.command === void 0 && arg !== void 0 && !arg.startsWith("--")) {
+      args.command = arg;
+    } else {
+      throw new Error(`unknown argument ${arg ?? ""}`);
+    }
+  }
+  return args;
+}
+function init(home, network) {
+  if (network !== void 0 && network !== "devnet" && network !== "mainnet") {
+    throw new Error("--network is devnet or mainnet");
+  }
+  ensureHome(home);
+  if (existsSync(home.config)) {
+    console.log(`config  ${home.config} (kept)`);
+  } else {
+    writeFileSync(
+      home.config,
+      `${JSON.stringify(configTemplate(network === "mainnet" ? "mainnet" : "devnet"), null, 2)}
+`,
+      { mode: 384, flag: "wx" }
+    );
+    console.log(`config  ${home.config} (edit it)`);
+  }
+  const keys = loadOrCreateKeys(home, true);
+  console.log(`store   ${getPublicKey(keys.storeSecretKey)}`);
+  console.log(`owner   ${getPublicKey(keys.ownerSecretKey)}`);
+  console.log("next    edit config.json, then run setup");
+}
+async function reportInboxRelays(pool, config, keys) {
+  const reader = new SimplePool();
+  let verdicts;
+  try {
+    verdicts = await checkInboxRelays(
+      pool,
+      reader,
+      config.inboxRelays,
+      keys.storeSecretKey,
+      storeAuth(keys),
+      log,
+      nowSecs()
+    );
+  } finally {
+    reader.destroy();
+  }
+  for (const verdict of verdicts) {
+    let state = "refuses gift wraps for any key";
+    if (verdict.serves) {
+      state = "ok";
+    } else if (verdict.accepts) {
+      state = "takes gift wraps but does not serve them back";
+    }
+    console.log(`relay   ${verdict.relay}: ${state}`);
+  }
+  console.log(
+    "note    each inbox relay must keep gift wraps (kind 1059) for at least two days past their date"
+  );
+  return verdicts.filter((verdict) => !verdict.serves).map((verdict) => verdict.relay);
+}
+async function reportDomain(home, config, nostrJson) {
+  const split = config.nip05 === void 0 ? void 0 : splitNip05(config.nip05);
+  if (split === void 0) {
+    console.log("level   C (no nip05)");
+    return;
+  }
+  if (split.local !== "_") {
+    console.log("level   C: a named nip05 is not domain-wide; use _@domain or a bare domain for A");
+    return;
+  }
+  writeFileSync(home.nostrJson, `${JSON.stringify(nostrJson)}
+`);
+  console.log(
+    `nostr   serve ${home.nostrJson} at https://${split.domain}/.well-known/nostr.json with "Access-Control-Allow-Origin: *"`
+  );
+  const verdict = await checkDomain(split.domain, nostrJson);
+  console.log(
+    verdict.ok ? `level   A: ${verdict.url} serves it` : `level   C until ${verdict.url} serves it: ${verdict.problem ?? ""}`
+  );
+}
+async function setup(home) {
+  takeLock(home);
+  const config = loadConfig(home.config);
+  const keys = loadOrCreateKeys(home, false);
+  const state = loadLedger(home.ledger);
+  const refusal = setupRefusal(state, config.product.d);
+  if (refusal !== void 0) {
+    throw new Error(refusal);
+  }
+  const pool = new SimplePool();
+  try {
+    const failing = await reportInboxRelays(pool, config, keys);
+    if (failing.length > 0) {
+      throw new Error(
+        `these inbox relays do not take and serve gift wraps for any key: ${failing.join(", ")}. Replace them in config.json.`
+      );
+    }
+    const relays = [.../* @__PURE__ */ new Set([...OFFER_RELAYS, ...config.inboxRelays])];
+    const now = nowSecs();
+    const payouts = JSON.stringify(config.payouts);
+    const newest2 = await newestPayoutList(pool, relays, getPublicKey(keys.ownerSecretKey));
+    const paytoCreatedAt = payoutListDate(state, payouts, newest2?.created_at, now);
+    const built = buildStoreEvents(config, keys, now, {
+      hints: config.inboxRelays.slice(0, 2),
+      paytoCreatedAt
+    });
+    const acceptedKinds = /* @__PURE__ */ new Set();
+    const everywhereKinds = /* @__PURE__ */ new Set();
+    for (const event of built.events) {
+      const accepted = await publishToRelays(pool, relays, event, storeAuth(keys), log);
+      log(`kind ${event.kind}: accepted by ${accepted.length}/${relays.length}`);
+      if (accepted.length > 0) {
+        acceptedKinds.add(event.kind);
+      }
+      if (accepted.some((relay) => OFFER_RELAYS.includes(relay))) {
+        everywhereKinds.add(event.kind);
+      }
+    }
+    const outcome = {
+      listing: acceptedKinds.has(KIND_PRODUCT),
+      payouts: acceptedKinds.has(KIND_PAYTO)
+    };
+    if (!outcome.listing && !outcome.payouts) {
+      throw new Error(
+        "neither the listing nor the payout list reached a relay: the ledger is left as it was"
+      );
+    }
+    recordPublished(
+      state,
+      built.terms,
+      outcome,
+      now - TERMS_CLOCK_MARGIN_SECS,
+      { createdAt: paytoCreatedAt, payouts },
+      config.product.d
+    );
+    state.resumeAt ??= now;
+    saveLedger(home.ledger, state);
+    console.log(`store   ${getPublicKey(keys.storeSecretKey)}`);
+    console.log(`owner   ${getPublicKey(keys.ownerSecretKey)}`);
+    console.log(`naddr   ${built.naddr}`);
+    await reportDomain(home, config, built.nostrJson);
+    const missing = [
+      [KIND_PRODUCT, "the listing"],
+      [KIND_PAYTO, "the payout list"],
+      [KIND_INBOX_RELAYS, "the inbox list"]
+    ].filter(([kind]) => !everywhereKinds.has(kind)).map(([, name]) => name);
+    if (missing.length > 0) {
+      throw new Error(
+        `${missing.join(", ")} reached none of the default relays: buyers may see part of the change (the ledger follows what they see). Run setup again.`
+      );
+    }
+  } finally {
+    pool.destroy();
+  }
+}
+async function refuseOffersNotHonoured(pool, config, keys, state) {
+  const storePubkey = getPublicKey(keys.storeSecretKey);
+  const views = [OFFER_RELAYS, [.../* @__PURE__ */ new Set([...OFFER_RELAYS, ...config.inboxRelays])]];
+  const read = await Promise.all(
+    views.map(async (relays) => {
+      const [listing, payoutList, inboxList] = await Promise.all([
+        newestListing(pool, relays, storePubkey, config.product.d),
+        newestPayoutList(pool, relays, getPublicKey(keys.ownerSecretKey)),
+        newestInboxList(pool, relays, storePubkey)
+      ]);
+      return { listing, payoutList, inboxList };
+    })
+  );
+  const { problems, served } = offerProblems(
+    read,
+    config.inboxRelays,
+    config.network,
+    standingTerms(state.terms)
+  );
+  if (problems.length > 0) {
+    throw new Error(
+      `the relays offer buyers what this node does not honour: ${problems.join("; ")}. Run setup (it publishes what the config names and records it) before taking orders.`
+    );
+  }
+  if (!served) {
+    log(
+      "warning: no relay served the listing or the payout list; run setup if the store is not published"
+    );
+  }
+}
+var SIGNAL_EXIT_CODES = { SIGINT: 130, SIGTERM: 143 };
+function stopOnSignals() {
+  for (const [signal, code] of Object.entries(SIGNAL_EXIT_CODES)) {
+    process.once(signal, () => process.exit(code));
+  }
+}
+function deferSignals() {
+  let requested;
+  for (const [signal, code] of Object.entries(SIGNAL_EXIT_CODES)) {
+    process.on(signal, () => {
+      if (requested !== void 0) {
+        process.exit(code);
+      }
+      requested = code;
+      console.error("stopping once the ledger is written (again to stop now)");
+    });
+  }
+  return () => requested;
+}
+async function deliver(pool, order, skip, config, keys) {
+  const reply = buildDeliveryReply(order, config.product.delivery, keys.storeSecretKey, nowSecs());
+  return await publishToRelays(
+    pool,
+    config.inboxRelays.filter((relay) => !skip.includes(relay)),
+    reply.recipientWrap,
+    storeAuth(keys),
+    log
+  );
+}
+async function run(home) {
+  const config = loadConfig(home.config);
+  const keys = loadOrCreateKeys(home, false);
+  const storePubkey = getPublicKey(keys.storeSecretKey);
+  takeLock(home);
+  const pool = new SimplePool({ enablePing: true });
+  const state = loadLedger(home.ledger);
+  await refuseOffersNotHonoured(pool, config, keys, state);
+  let queue = Promise.resolve();
+  const enqueue = (task) => {
+    queue = queue.then(task).catch((error) => {
+      log(`error: ${errorText3(error)}`);
+    });
+  };
+  const runtime = new MerchantRuntime({
+    state,
+    store: storeIdentity(storePubkey, config.product.d, [SOLANA_MEDIUMS[config.network]]),
+    storeSecretKey: keys.storeSecretKey,
+    context: { rpc: createSolanaRpc(config.rpcUrl), network: config.network },
+    save: () => saveLedger(home.ledger, state),
+    deliver: (order, skip) => deliver(pool, order, skip, config, keys),
+    inboxRelayCount: config.inboxRelays.length,
+    log,
+    now: nowSecs,
+    later: (ms, task) => {
+      setTimeout(() => enqueue(task), ms);
+    }
+  });
+  const startedAt = nowSecs();
+  const listener = new InboxListener({
+    pool,
+    storePubkey,
+    auth: storeAuth(keys),
+    onWrap: (wrap) => {
+      if (runtime.admit(wrap)) {
+        enqueue(() => runtime.handleWrap(wrap));
+      }
+    },
+    log,
+    now: nowSecs
+  });
+  state.resumeAt = Math.min(state.resumeAt ?? startedAt, startedAt);
+  saveLedger(home.ledger, state);
+  const resumeFrom = state.resumeAt;
+  for (const relay of config.inboxRelays) {
+    listener.listen(relay, resumeFrom);
+  }
+  log(`store ${storePubkey} listening on ${config.inboxRelays.join(", ")}`);
+  let sweepQueued = false;
+  const sweep = () => {
+    if (sweepQueued) {
+      return;
+    }
+    sweepQueued = true;
+    const allLive = listener.allLive(config.inboxRelays);
+    const queuedAt = nowSecs();
+    enqueue(async () => {
+      sweepQueued = false;
+      await runtime.sweep(allLive, queuedAt);
+    });
+  };
+  sweep();
+  setInterval(sweep, CATCH_UP_INTERVAL_MS);
+}
+function orderStatus(order) {
+  if (order.paid === void 0) {
+    return "open";
+  }
+  return order.deliveredAt === void 0 ? "paid, delivering" : "delivered";
+}
+function listOrders(home) {
+  const state = loadLedger(home.ledger);
+  const all = Object.values(state.orders).sort((left, right) => left.createdAt - right.createdAt);
+  for (const order of all) {
+    const when = new Date(order.createdAt * 1e3).toISOString();
+    const paid = order.paid === void 0 ? "" : ` ${order.paid.amount} ${order.paid.signature}`;
+    const email = order.email === void 0 ? "" : ` email=${order.email}`;
+    console.log(`${when} ${orderStatus(order)} ${order.key}${paid}${email}`);
+  }
+  console.log(`${all.length} order(s)`);
+}
+async function check(home) {
+  const config = loadConfig(home.config);
+  const keys = loadOrCreateKeys(home, false);
+  if (heldByRunningMerchant(home)) {
+    console.log("note    a merchant is running on this home");
+  }
+  const pool = new SimplePool();
+  try {
+    const failing = await reportInboxRelays(pool, config, keys);
+    let offers;
+    try {
+      await refuseOffersNotHonoured(pool, config, keys, loadLedger(home.ledger));
+    } catch (error) {
+      offers = error;
+    }
+    await reportDomain(home, config, buildStoreEvents(config, keys, nowSecs()).nostrJson);
+    if (offers !== void 0) {
+      throw offers;
+    }
+    if (failing.length > 0) {
+      throw new Error(
+        `these inbox relays do not take and serve gift wraps for any key: ${failing.join(", ")}`
+      );
+    }
+  } finally {
+    pool.destroy();
+  }
+}
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.network !== void 0 && args.command !== "init") {
+    throw new Error("--network is for init; the config names the network");
+  }
+  const home = merchantHome(args.home);
+  switch (args.command) {
+    case "init":
+      init(home, args.network);
+      return;
+    case "setup": {
+      const stopRequested = deferSignals();
+      let failed = false;
+      try {
+        await setup(home);
+      } catch (error) {
+        console.error(`error: ${errorText3(error)}`);
+        failed = true;
+      }
+      process.exit(stopRequested() ?? (failed ? 1 : 0));
+      return;
+    }
+    case "run":
+      stopOnSignals();
+      await run(home);
+      return;
+    case "orders":
+      listOrders(home);
+      return;
+    case "check":
+      await check(home);
+      process.exit(0);
+      return;
+    default:
+      console.log(USAGE);
+      process.exit(args.command === void 0 || args.command === "help" ? 0 : 1);
+  }
+}
+try {
+  await main();
+} catch (error) {
+  console.error(`error: ${errorText3(error)}`);
+  process.exit(1);
+}
+//# sourceMappingURL=cli.js.map
+//# sourceMappingURL=cli.js.map