@openreceive/http 0.2.1

package/dist/chunk-5S24YV7E.js

@@ -0,0 +1,2228 @@
+// src/errors.ts
+import {
+  isErrorCode,
+  isRetryableErrorCode
+} from "@openreceive/core";
+var HttpError = class extends Error {
+  status;
+  code;
+  retryable;
+  details;
+  /** Emitted as a `Retry-After` header so clients can back off with a hint. */
+  retryAfterSeconds;
+  constructor(status, code, message, options = {}) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+    this.code = code;
+    if (options.retryable !== void 0) this.retryable = options.retryable;
+    if (options.details !== void 0) this.details = options.details;
+    if (options.retryAfterSeconds !== void 0) this.retryAfterSeconds = options.retryAfterSeconds;
+  }
+};
+function isServiceErrorShape(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const candidate = error;
+  if (typeof candidate.status !== "number") return false;
+  if (typeof candidate.body !== "object" || candidate.body === null) return false;
+  const body = candidate.body;
+  return isErrorCode(body.code) && typeof body.message === "string";
+}
+function isWalletErrorShape(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const candidate = error;
+  if (candidate.status !== void 0) return false;
+  return isErrorCode(candidate.code) && typeof candidate.message === "string";
+}
+function walletErrorStatus(code, retryable) {
+  return retryable || isRetryableErrorCode(code) ? 503 : 502;
+}
+var HostError = class extends Error {
+  status;
+  body;
+  constructor(status, body) {
+    super(body.message);
+    this.name = "HostError";
+    this.status = status;
+    this.body = body;
+  }
+};
+function hostError(message, status = 400, code = "INVALID_REQUEST") {
+  return new HostError(status, {
+    code,
+    message,
+    ...isRetryableErrorCode(code) ? { retryable: false } : {}
+  });
+}
+function mapHostRouteError(error) {
+  if (error instanceof HostError || isServiceErrorShape(error)) {
+    return { status: error.status, body: error.body };
+  }
+  if (isWalletErrorShape(error)) {
+    const retryable = error.retryable ?? isRetryableErrorCode(error.code);
+    return {
+      status: walletErrorStatus(error.code, retryable),
+      body: { code: error.code, message: error.message, retryable }
+    };
+  }
+  return null;
+}
+function bigintToJsonNumber(value) {
+  if (value > BigInt(Number.MAX_SAFE_INTEGER) || value < -BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new HttpError(500, "INTERNAL", "Numeric value exceeds the JSON safe integer range.");
+  }
+  return Number(value);
+}
+function createRequestId() {
+  return `req_${globalThis.crypto.randomUUID()}`;
+}
+function jsonResponse(status, body, requestId, extraHeaders) {
+  const headers = new Headers({
+    "content-type": "application/json; charset=utf-8",
+    "x-request-id": requestId
+  });
+  if (extraHeaders !== void 0) {
+    for (const [name, value] of extraHeaders) {
+      headers.append(name, value);
+    }
+  }
+  return new Response(
+    JSON.stringify(
+      body,
+      (_key, value) => typeof value === "bigint" ? bigintToJsonNumber(value) : value
+    ),
+    { status, headers }
+  );
+}
+function errorResponse(error, requestId) {
+  if (error instanceof HttpError) {
+    return jsonResponse(
+      error.status,
+      {
+        code: error.code,
+        message: error.message,
+        ...error.retryable === void 0 ? {} : { retryable: error.retryable },
+        request_id: requestId,
+        ...error.details === void 0 ? {} : { details: error.details }
+      },
+      requestId,
+      error.retryAfterSeconds === void 0 ? void 0 : [["retry-after", String(Math.max(1, Math.ceil(error.retryAfterSeconds)))]]
+    );
+  }
+  if (isServiceErrorShape(error)) {
+    return jsonResponse(
+      error.status,
+      { ...error.body, request_id: error.body.request_id ?? requestId },
+      requestId
+    );
+  }
+  if (isWalletErrorShape(error)) {
+    const retryable = error.retryable ?? isRetryableErrorCode(error.code);
+    return jsonResponse(
+      walletErrorStatus(error.code, retryable),
+      { code: error.code, message: error.message, retryable, request_id: requestId },
+      requestId
+    );
+  }
+  return jsonResponse(
+    500,
+    { code: "INTERNAL", message: "Internal server error.", request_id: requestId },
+    requestId
+  );
+}
+
+// src/router.ts
+function normalizePrefix(prefix) {
+  const trimmed = prefix.trim();
+  const value = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+  const withoutTrailing = value.length > 1 && value.endsWith("/") ? value.slice(0, -1) : value;
+  return withoutTrailing === "/" ? "" : withoutTrailing;
+}
+var ROUTES = {
+  "POST /checkouts/prepare": { kind: "checkout.prepare" },
+  "POST /checkouts": { kind: "checkout.create" },
+  "POST /payments/check": { kind: "payment.check" },
+  "POST /swaps/quote": { kind: "swap.quote" },
+  "POST /swaps": { kind: "swap.create" },
+  "POST /swaps/status": { kind: "swap.read" },
+  "POST /swaps/refunds": { kind: "swap.refund" },
+  "GET /rates": { kind: "rates" }
+};
+var KNOWN_PATHS = new Set(Object.keys(ROUTES).map((key) => key.split(" ")[1]));
+function routePath(prefix, pathname) {
+  const path = pathname === prefix ? "/" : pathname.slice(prefix.length);
+  return path.replace(/\/$/, "") || "/";
+}
+function claimsPath(prefix, pathname) {
+  if (prefix === "") return KNOWN_PATHS.has(routePath(prefix, pathname));
+  return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+function matchRoute(prefix, method, pathname) {
+  if (!claimsPath(prefix, pathname)) return null;
+  const normalizedPath = routePath(prefix, pathname);
+  const route = ROUTES[`${method.toUpperCase()} ${normalizedPath}`];
+  if (route === void 0) {
+    if (KNOWN_PATHS.has(normalizedPath)) {
+      throw new HttpError(
+        405,
+        "INVALID_REQUEST",
+        "This OpenReceive route does not support that HTTP method."
+      );
+    }
+    throw new HttpError(404, "NOT_FOUND", "No OpenReceive route matched this method and path.");
+  }
+  return route;
+}
+
+// src/adapter-bridge.ts
+var SKIP_REQUEST_HEADERS = /* @__PURE__ */ new Set(["content-length", "transfer-encoding", "connection"]);
+function webRequest(parts) {
+  const rawHost = parts.headers.host;
+  const host = (Array.isArray(rawHost) ? rawHost[0] : rawHost) ?? "localhost";
+  const protocol = parts.protocol !== void 0 && parts.protocol.length > 0 ? parts.protocol : "http";
+  const url = `${protocol}://${host}${parts.url.length > 0 ? parts.url : "/"}`;
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(parts.headers)) {
+    if (SKIP_REQUEST_HEADERS.has(key.toLowerCase())) continue;
+    if (typeof value === "string") headers.set(key, value);
+    else if (Array.isArray(value)) headers.set(key, value.join(", "));
+  }
+  const method = parts.method.toUpperCase();
+  let body;
+  if (method !== "GET" && method !== "HEAD") {
+    const parsed = parts.parsedBody;
+    assertBodyWasParsed(parts, parsed);
+    if (typeof parsed === "string") {
+      body = parsed;
+    } else if (parsed !== void 0 && parsed !== null && Object.keys(parsed).length > 0) {
+      body = JSON.stringify(parsed);
+      if (!headers.has("content-type")) headers.set("content-type", "application/json");
+    }
+  }
+  return new Request(url, { method, headers, body });
+}
+function assertBodyWasParsed(parts, parsed) {
+  if (parsed !== void 0) return;
+  const header = (name) => {
+    const value = parts.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+  };
+  const declaresBody = Number(header("content-length") ?? "0") > 0 || header("transfer-encoding") !== void 0;
+  if (!declaresBody || !(header("content-type") ?? "").includes("json")) return;
+  throw new HttpError(
+    500,
+    "INTERNAL",
+    "OpenReceive received a JSON request body that no body parser had read. Mount your framework's JSON body parser (Express: app.use(express.json())) before the OpenReceive middleware."
+  );
+}
+function isUnderPrefix(pathname, prefix) {
+  return claimsPath(prefix, pathname);
+}
+
+// src/handler.ts
+import { compact as compact2, unixSeconds as unixSeconds7 } from "@openreceive/core";
+
+// src/reconcile-gate.ts
+import { compact, unixSeconds as unixSeconds5 } from "@openreceive/core";
+
+// src/host-payments.ts
+import { unixSeconds as unixSeconds3 } from "@openreceive/core";
+import { sanitizeEvent } from "@openreceive/node";
+
+// src/payment-repository.ts
+import {
+  unixSeconds
+} from "@openreceive/core";
+var OPENRECEIVE_ATTEMPT_REUSE_BUFFER_SECONDS = 60;
+var OPENRECEIVE_ATTEMPT_EXPIRY_GRACE_SECONDS = 900;
+function isReusablePaymentAttempt(expiresAt, now = unixSeconds()) {
+  return expiresAt - now > OPENRECEIVE_ATTEMPT_REUSE_BUFFER_SECONDS;
+}
+function liveAttemptCommitDecision(live, incoming, now = unixSeconds()) {
+  if (!sameRailAndAsset(live, incoming)) return "ignore";
+  return isReusablePaymentAttempt(live.expiresAt, now) ? "conflict" : "supersede";
+}
+function sameRailAndAsset(left, right) {
+  const leftSwap = left.swapData ?? null;
+  const rightSwap = right.swapData ?? null;
+  if (leftSwap === null && rightSwap === null) return true;
+  if (leftSwap === null || rightSwap === null) return false;
+  return leftSwap.providerOrder.pay_in_asset === rightSwap.providerOrder.pay_in_asset;
+}
+function reconciliationTransition(attempt, status, observedAt, transactionState) {
+  const paymentHash = attempt.paymentHash.toLowerCase();
+  if (status === "failed") {
+    return { paymentHash, status: "failed", observedAt, reason: "wallet_reported_failed" };
+  }
+  if (status === "expired") {
+    return { paymentHash, status: "expired", observedAt, reason: "wallet_reported_expired" };
+  }
+  if (observedAt < attempt.expiresAt + OPENRECEIVE_ATTEMPT_EXPIRY_GRACE_SECONDS) return null;
+  if (status === "not_found") {
+    return { paymentHash, status: "expired", observedAt, reason: "not_found_after_expiry" };
+  }
+  if (transactionState === "pending" || transactionState === "accepted") {
+    return { paymentHash, status: "attention", observedAt, reason: "unsettled_after_expiry" };
+  }
+  return { paymentHash, status: "expired", observedAt, reason: "no_finality_after_expiry" };
+}
+function paymentInsert(input) {
+  return {
+    reference: input.reference,
+    paymentHash: input.paymentHash.toLowerCase(),
+    createdAt: input.checkout.createdAt,
+    checkout: structuredClone(input.checkout),
+    expiresAt: input.swapData?.providerOrder.expires_at ?? input.checkout.expiresAt,
+    ...input.swapData === void 0 ? {} : { swapData: input.swapData },
+    ...input.clientIp === void 0 ? {} : { clientIp: input.clientIp }
+  };
+}
+
+// src/sql-payments.ts
+import { randomUUID } from "crypto";
+import {
+  OPENRECEIVE_PAYMENTS_SCHEMA_VERSION,
+  paymentsDdlStatements,
+  unixSeconds as unixSeconds2
+} from "@openreceive/core";
+
+// src/sql-adapters.ts
+var SQLITE_BUSY_TIMEOUT_MS = 5e3;
+function resolveSqlAdapter(db) {
+  if (isSqlAdapter(db)) return db;
+  if (isSqliteLike(db)) return sqliteAdapter(db);
+  if (isPgLike(db)) return pgAdapter(db);
+  throw new TypeError(
+    "Unsupported database handle. Pass a pg Pool/Client, a SQLite database (node:sqlite or better-sqlite3), or an SqlAdapter."
+  );
+}
+function isSqlAdapter(db) {
+  const candidate = db;
+  return (candidate.dialect === "postgres" || candidate.dialect === "sqlite") && typeof candidate.transaction === "function" && typeof candidate.query === "function";
+}
+function isSqliteLike(db) {
+  const candidate = db;
+  return typeof candidate.prepare === "function" && typeof candidate.exec === "function";
+}
+function isPgLike(db) {
+  return typeof db.query === "function";
+}
+function createSerialQueue() {
+  let tail = Promise.resolve();
+  return (task) => {
+    const result = tail.then(task, task);
+    tail = result.then(
+      () => void 0,
+      () => void 0
+    );
+    return result;
+  };
+}
+function sqliteAdapter(db) {
+  try {
+    db.exec(`PRAGMA busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS}`);
+  } catch {
+  }
+  const query = async (sql, params = []) => {
+    const statement = db.prepare(sql);
+    if (sqliteStatementReturnsRows(sql, statement)) {
+      return statement.all(...params);
+    }
+    statement.run(...params);
+    return [];
+  };
+  const enqueue = createSerialQueue();
+  return {
+    dialect: "sqlite",
+    query: (sql, params) => enqueue(() => query(sql, params)),
+    transaction(run) {
+      return enqueue(async () => {
+        db.exec("BEGIN IMMEDIATE");
+        try {
+          const result = await run({ query });
+          db.exec("COMMIT");
+          return result;
+        } catch (error) {
+          try {
+            db.exec("ROLLBACK");
+          } catch {
+          }
+          throw error;
+        }
+      });
+    }
+  };
+}
+function sqliteStatementReturnsRows(sql, statement) {
+  const reader = statement.reader;
+  if (typeof reader === "boolean") return reader;
+  return /^\s*(?:select|values|with)\b/i.test(sql) || /\breturning\b/i.test(sql);
+}
+function isPooledClient(value) {
+  return typeof value === "object" && value !== null && typeof value.query === "function" && typeof value.release === "function";
+}
+function pgAdapter(db) {
+  const queryOn = (client) => async (sql, params = []) => {
+    const result = await client.query(sql, [...params]);
+    return result.rows;
+  };
+  const directQuery = queryOn(db);
+  const enqueue = createSerialQueue();
+  let mode = db.connect === void 0 ? "single" : typeof db.totalCount === "number" ? "pool" : void 0;
+  let probe;
+  const probeConnect = async () => {
+    try {
+      const client = await db.connect?.();
+      if (isPooledClient(client)) {
+        mode = "pool";
+        return client;
+      }
+      mode = "single";
+      return void 0;
+    } catch (error) {
+      if (error instanceof Error && /already been connected/i.test(error.message)) {
+        mode = "single";
+        return void 0;
+      }
+      throw error;
+    }
+  };
+  const checkoutPooledClient = async () => {
+    while (mode === void 0) {
+      if (probe === void 0) {
+        probe = probeConnect();
+        try {
+          return await probe;
+        } finally {
+          if (mode === void 0) probe = void 0;
+        }
+      }
+      const pending = probe;
+      await pending.then(
+        () => void 0,
+        () => void 0
+      );
+      if (probe === pending && mode === void 0) probe = void 0;
+    }
+    if (mode === "single") return void 0;
+    const client = await db.connect?.();
+    return isPooledClient(client) ? client : void 0;
+  };
+  const ensureMode = async () => {
+    if (mode !== void 0) return;
+    const client = await checkoutPooledClient();
+    client?.release();
+  };
+  const runTransaction = async (query, run) => {
+    await query("BEGIN");
+    try {
+      const result = await run({ query });
+      await query("COMMIT");
+      return result;
+    } catch (error) {
+      try {
+        await query("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+  };
+  return {
+    dialect: "postgres",
+    // Pooled reads are isolated per checked-out connection; single-connection
+    // reads join the transaction queue so they never see uncommitted state.
+    query: async (sql, params) => {
+      await ensureMode();
+      return mode === "pool" ? directQuery(sql, params) : enqueue(() => directQuery(sql, params));
+    },
+    async transaction(run) {
+      const client = await checkoutPooledClient();
+      if (client !== void 0) {
+        try {
+          return await runTransaction(queryOn(client), run);
+        } finally {
+          client.release();
+        }
+      }
+      return enqueue(() => runTransaction(directQuery, run));
+    }
+  };
+}
+function toPgPlaceholders(sql) {
+  let index = 0;
+  return sql.replaceAll("?", () => {
+    index += 1;
+    return `$${index}`;
+  });
+}
+
+// src/sql-payments.ts
+import { OPENRECEIVE_PAYMENTS_SCHEMA_VERSION as OPENRECEIVE_PAYMENTS_SCHEMA_VERSION2 } from "@openreceive/core";
+var ADVISORY_LOCK_SEED = 8210223;
+var RECONCILE_GATE_META_KEY = "transaction_scan_gate";
+var RECONCILE_GATE_CAS_RETRIES = 6;
+var META_CLOCK_SKEW_SECONDS = 60;
+var SCHEMA_VERSION_META_KEY = "schema_version";
+var OPENRECEIVE_RECONCILE_BATCH_SIZE = 200;
+function parseClaimedAt(value) {
+  try {
+    const parsed = JSON.parse(String(value));
+    return typeof parsed.claimed_at === "number" && Number.isFinite(parsed.claimed_at) ? parsed.claimed_at : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function paymentsSchemaSql(dialect, tableName = "openreceive_payments", metaTableName = "openreceive_meta") {
+  return paymentsDdlStatements({ dialect, tableName, metaTableName }).map((statement) => `${statement};`).join("\n");
+}
+function createSqlPayments(db, options = {}) {
+  const adapter = resolveSqlAdapter(db);
+  const table = options.tableName ?? "openreceive_payments";
+  assertSafeIdentifier(table);
+  const metaTable = options.metaTableName ?? "openreceive_meta";
+  assertSafeIdentifier(metaTable);
+  const clock = options.clock ?? unixSeconds2;
+  const statement = (sql) => adapter.dialect === "postgres" ? toPgPlaceholders(sql) : sql;
+  const lockReference = async (tx, reference) => {
+    if (adapter.dialect === "postgres") {
+      await tx.query(statement("SELECT pg_advisory_xact_lock(hashtextextended(?, ?))"), [
+        reference,
+        ADVISORY_LOCK_SEED
+      ]);
+    }
+  };
+  const rowsForReference = async (tx, reference) => {
+    const rows = await tx.query(
+      statement(
+        `SELECT * FROM ${table} WHERE reference = ? ORDER BY created_at DESC, payment_hash DESC`
+      ),
+      [reference]
+    );
+    return rows.map(recordFromRow);
+  };
+  let schemaVersionChecked;
+  const assertSupportedSchema = () => {
+    schemaVersionChecked ??= (async () => {
+      let stored;
+      try {
+        const rows = await adapter.query(
+          statement(`SELECT value FROM ${metaTable} WHERE key = ? LIMIT 1`),
+          [SCHEMA_VERSION_META_KEY]
+        );
+        const value = rows[0]?.value;
+        stored = value === void 0 ? void 0 : Number(asString(value, "value"));
+      } catch {
+        return;
+      }
+      if (stored === void 0 || !Number.isInteger(stored)) return;
+      if (stored > OPENRECEIVE_PAYMENTS_SCHEMA_VERSION) {
+        throw new TypeError(
+          `${metaTable} reports openreceive schema version ${stored}, newer than this library's ${OPENRECEIVE_PAYMENTS_SCHEMA_VERSION}. Upgrade @openreceive/http before serving this database.`
+        );
+      }
+    })();
+    return schemaVersionChecked;
+  };
+  return {
+    async listForReference(reference) {
+      await assertSupportedSchema();
+      return rowsForReference(adapter, reference);
+    },
+    async listReconcilableAttempts() {
+      await assertSupportedSchema();
+      const rows = await adapter.query(
+        statement(
+          `SELECT payment_hash, created_at, expires_at FROM ${table} WHERE status = 'pending' ORDER BY created_at ASC LIMIT ?`
+        ),
+        [OPENRECEIVE_RECONCILE_BATCH_SIZE]
+      );
+      return rows.map(
+        (row) => ({
+          paymentHash: asString(row.payment_hash, "payment_hash"),
+          createdAt: asInteger(row.created_at, "created_at"),
+          expiresAt: asInteger(row.expires_at, "expires_at")
+        })
+      );
+    },
+    async findPendingAttempt(paymentHash) {
+      await assertSupportedSchema();
+      const rows = await adapter.query(
+        statement(
+          `SELECT payment_hash, created_at, expires_at FROM ${table} WHERE payment_hash = ? AND status = 'pending'`
+        ),
+        [paymentHash.toLowerCase()]
+      );
+      const row = rows[0];
+      if (row === void 0) return void 0;
+      return {
+        paymentHash: asString(row.payment_hash, "payment_hash"),
+        createdAt: asInteger(row.created_at, "created_at"),
+        expiresAt: asInteger(row.expires_at, "expires_at")
+      };
+    },
+    async claimReconcileGate({ now, intervalSeconds }) {
+      await assertSupportedSchema();
+      const token = randomUUID();
+      const claimValue = JSON.stringify({ claimed_at: now, token });
+      const insertIfAbsent = adapter.dialect === "postgres" ? `INSERT INTO ${metaTable} (key, value, rev) VALUES (?, ?, 0) ON CONFLICT (key) DO NOTHING` : `INSERT OR IGNORE INTO ${metaTable} (key, value, rev) VALUES (?, ?, 0)`;
+      for (let attempt = 0; attempt < RECONCILE_GATE_CAS_RETRIES; attempt += 1) {
+        const rows = await adapter.query(
+          statement(`SELECT value, rev FROM ${metaTable} WHERE key = ? LIMIT 1`),
+          [RECONCILE_GATE_META_KEY]
+        );
+        const current = rows[0];
+        if (current === void 0) {
+          await adapter.query(statement(insertIfAbsent), [RECONCILE_GATE_META_KEY, claimValue]);
+        } else {
+          const claimedAt = parseClaimedAt(current.value);
+          if (claimedAt !== void 0 && isFreshTimestamp(now, claimedAt, intervalSeconds)) {
+            return false;
+          }
+          await adapter.query(
+            statement(`UPDATE ${metaTable} SET value = ?, rev = rev + 1 WHERE key = ? AND rev = ?`),
+            [claimValue, RECONCILE_GATE_META_KEY, asInteger(current.rev, "rev")]
+          );
+        }
+        const readback = await adapter.query(
+          statement(`SELECT value FROM ${metaTable} WHERE key = ? LIMIT 1`),
+          [RECONCILE_GATE_META_KEY]
+        );
+        if (readback[0] !== void 0 && String(readback[0].value) === claimValue) return true;
+      }
+      return false;
+    },
+    async commitAttempt(input) {
+      await assertSupportedSchema();
+      const insert = paymentInsert(input);
+      const now = clock();
+      await adapter.transaction(async (tx) => {
+        await lockReference(tx, insert.reference);
+        const existing = await rowsForReference(tx, insert.reference);
+        if (existing.some((row) => row.paymentHash === insert.paymentHash)) return;
+        if (existing.some((row) => row.status === "settled")) {
+          throw hostError("This reference is already paid.", 409, "CONFLICT");
+        }
+        const live = existing.filter(
+          (row) => row.status === "pending" && row.expiresAt > now && row.statusReason !== "superseded"
+        );
+        for (const row of live) {
+          const decision = liveAttemptCommitDecision(row, insert, now);
+          if (decision === "conflict") {
+            throw hostError(
+              "An unpaid checkout for this payment method is already in progress for this reference.",
+              409,
+              "CONFLICT"
+            );
+          }
+          if (decision === "supersede") {
+            await tx.query(
+              statement(
+                `UPDATE ${table} SET status_reason = 'superseded', updated_at = ? WHERE payment_hash = ? AND status = 'pending'`
+              ),
+              [now, row.paymentHash]
+            );
+          }
+        }
+        await tx.query(
+          statement(
+            `INSERT INTO ${table} (reference, payment_hash, status, paid_at, expires_at, created_at, updated_at, inserted_at, checkout_data, swap_data, client_ip)
+           VALUES (?, ?, 'pending', NULL, ?, ?, ?, ?, ?, ?, ?)`
+          ),
+          [
+            insert.reference,
+            insert.paymentHash,
+            insert.expiresAt,
+            insert.createdAt,
+            now,
+            now,
+            JSON.stringify(insert.checkout),
+            insert.swapData === void 0 ? null : JSON.stringify(insert.swapData),
+            insert.clientIp ?? null
+          ]
+        );
+      });
+    },
+    async countAttemptsFromIp(clientIp, sinceUnixSeconds) {
+      const rows = await adapter.query(
+        statement(`SELECT COUNT(*) AS n FROM ${table} WHERE client_ip = ? AND inserted_at >= ?`),
+        [clientIp, sinceUnixSeconds]
+      );
+      return asInteger(rows[0]?.n ?? 0, "n");
+    },
+    async recordReconciliation(transition) {
+      await assertSupportedSchema();
+      await adapter.transaction(async (tx) => {
+        await tx.query(
+          statement(
+            `UPDATE ${table} SET status = ?, status_reason = ?, updated_at = ? WHERE payment_hash = ? AND status = 'pending'`
+          ),
+          [
+            transition.status,
+            transition.reason,
+            transition.observedAt,
+            transition.paymentHash.toLowerCase()
+          ]
+        );
+      });
+    },
+    // Same write-once claim as markPaidOnce, without a fulfillment hook: in
+    // custom-repository mode the host's own handler runs outside this
+    // transaction, so it is handed no transactional query.
+    recordSettlement: (settlement) => markPaidOnce(settlement, () => void 0),
+    markPaidOnce
+  };
+  async function markPaidOnce(input, fulfill) {
+    await assertSupportedSchema();
+    const paymentHash = input.paymentHash.toLowerCase();
+    return adapter.transaction(async (tx) => {
+      const preliminary = await tx.query(
+        statement(`SELECT reference FROM ${table} WHERE payment_hash = ?`),
+        [paymentHash]
+      );
+      const reference = preliminary[0]?.reference;
+      if (reference === void 0) return false;
+      await lockReference(tx, asString(reference, "reference"));
+      const rows = await rowsForReference(tx, asString(reference, "reference"));
+      const row = rows.find((candidate) => candidate.paymentHash === paymentHash);
+      if (row === void 0 || row.status === "settled") return false;
+      const firstForReference = !rows.some((candidate) => candidate.status === "settled");
+      const now = clock();
+      await tx.query(
+        statement(
+          `UPDATE ${table} SET status = 'settled', status_reason = ?, paid_at = ?, updated_at = ? WHERE payment_hash = ?`
+        ),
+        [firstForReference ? null : "duplicate_settlement", input.paidAt, now, paymentHash]
+      );
+      if (firstForReference) {
+        await fulfill({
+          reference: row.reference,
+          paymentHash,
+          paidAt: input.paidAt,
+          ...input.details === void 0 ? {} : { details: input.details },
+          query: tx.query
+        });
+      }
+      return firstForReference;
+    });
+  }
+}
+function isFreshTimestamp(now, timestamp, windowSeconds) {
+  const age = now - timestamp;
+  if (age < -META_CLOCK_SKEW_SECONDS) return false;
+  return age < windowSeconds;
+}
+function recordFromRow(row) {
+  const swapData = row.swap_data;
+  const paymentHash = asString(row.payment_hash, "payment_hash");
+  return {
+    reference: asString(row.reference, "reference"),
+    paymentHash,
+    status: asStatus(row.status),
+    statusReason: row.status_reason === void 0 ? null : row.status_reason,
+    paidAt: row.paid_at === null || row.paid_at === void 0 ? null : asInteger(row.paid_at, "paid_at"),
+    expiresAt: asInteger(row.expires_at, "expires_at"),
+    createdAt: asInteger(row.created_at, "created_at"),
+    checkout: parseRowJson(
+      asString(row.checkout_data, "checkout_data"),
+      "checkout_data",
+      paymentHash
+    ),
+    swapData: swapData === null || swapData === void 0 ? null : parseRowJson(asString(swapData, "swap_data"), "swap_data", paymentHash)
+  };
+}
+function parseRowJson(value, column, paymentHash) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    throw new TypeError(
+      `Corrupt ${column} JSON on openreceive payment attempt ${paymentHash}; the row cannot be read.`
+    );
+  }
+}
+var ATTEMPT_STATUSES = [
+  "pending",
+  "settled",
+  "expired",
+  "failed",
+  "attention"
+];
+function asStatus(value) {
+  if (typeof value === "string" && ATTEMPT_STATUSES.includes(value)) {
+    return value;
+  }
+  throw new TypeError(`Unexpected openreceive_payments status: ${String(value)}`);
+}
+function asString(value, field) {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "bigint") return String(value);
+  throw new TypeError(`Expected ${field} to be a string.`);
+}
+function asInteger(value, field) {
+  if (typeof value === "number" && Number.isSafeInteger(value)) return value;
+  if (typeof value === "bigint") {
+    if (value < BigInt(Number.MIN_SAFE_INTEGER) || value > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new TypeError(`Expected ${field} to fit a safe integer.`);
+    }
+    return Number(value);
+  }
+  if (typeof value === "string" && /^\s*-?\d+\s*$/.test(value)) {
+    const parsed = Number(value.trim());
+    if (Number.isSafeInteger(parsed)) return parsed;
+  }
+  throw new TypeError(`Expected ${field} to be an integer.`);
+}
+function assertSafeIdentifier(name) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new RangeError(`Unsafe SQL identifier: ${name}`);
+  }
+}
+
+// src/host-payments.ts
+function warnFailure(event, prefix, error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const sanitized = sanitizeEvent({ level: "warn", event, message });
+  console.warn(`[openreceive] ${prefix}: ${String(sanitized.message)}`);
+}
+function createHost(options) {
+  if (options?.amountFor === void 0) {
+    throw new TypeError("OpenReceive host requires amountFor.");
+  }
+  if (options.onPaid === void 0) {
+    throw new TypeError(
+      "OpenReceive host requires onPaid (per-reference settlement context in db mode; the raw settlement event in custom repository mode)."
+    );
+  }
+  let payments;
+  let onPaid;
+  if (options.db !== void 0) {
+    const repository = createSqlPayments(options.db, {
+      ...options.tableName === void 0 ? {} : { tableName: options.tableName },
+      ...options.clock === void 0 ? {} : { clock: options.clock }
+    });
+    payments = repository;
+    const fulfill = options.onPaid;
+    onPaid = async (input) => {
+      await repository.markPaidOnce(input, fulfill);
+    };
+  } else {
+    if (options.payments?.listForReference === void 0) {
+      throw new TypeError("OpenReceive host requires db or payments.listForReference.");
+    }
+    if (options.payments.commitAttempt === void 0) {
+      throw new TypeError("OpenReceive host requires payments.commitAttempt.");
+    }
+    if (options.payments.listReconcilableAttempts === void 0) {
+      throw new TypeError("OpenReceive host requires payments.listReconcilableAttempts.");
+    }
+    if (options.payments.recordReconciliation === void 0) {
+      throw new TypeError("OpenReceive host requires payments.recordReconciliation.");
+    }
+    if (typeof options.payments.recordSettlement !== "function") {
+      throw new TypeError(
+        "OpenReceive host requires payments.recordSettlement (the write-once settlement claim)."
+      );
+    }
+    payments = options.payments;
+    const custom = options.payments;
+    const notify = options.onPaid;
+    onPaid = async (settlement) => {
+      const claimed = await custom.recordSettlement({
+        paymentHash: settlement.paymentHash,
+        paidAt: settlement.paidAt,
+        ...settlement.details === void 0 ? {} : { details: settlement.details }
+      });
+      if (claimed) await notify(settlement);
+    };
+  }
+  const clock = options.clock ?? unixSeconds3;
+  const priceFor = async (context) => {
+    const amount = await options.amountFor(context.reference, context);
+    if (amount === null) throw hostError("Unknown reference.", 404, "NOT_FOUND");
+    return amount;
+  };
+  const resolveCheckout = async (context) => {
+    if (context.action === "swap.quote" || context.action === "checkout.prepare") {
+      return { amount: await priceFor(context) };
+    }
+    const isCreate = context.action === "checkout.create" || context.action === "swap.create";
+    const amount = isCreate ? await priceFor(context) : void 0;
+    const attempts = normalizePayments(await payments.listForReference(context.reference));
+    const requestedHash = paymentHashHint(context.input);
+    if (requestedHash !== void 0) {
+      const selected = attempts.find((payment) => payment.paymentHash === requestedHash);
+      if (selected === void 0) {
+        throw hostError("Payment attempt not found for this reference.", 404, "NOT_FOUND");
+      }
+      if (context.action === "checkout.create" || context.action === "swap.create") {
+        if (attempts.some((payment) => payment.status === "settled")) {
+          throw hostError("This reference is already paid.", 409, "CONFLICT");
+        }
+        const now = clock();
+        if (!isLivePaymentAttempt(selected, now) || !isReusablePaymentAttempt(selected.expiresAt, now) || !matchesCreateAction(selected, context.action, context.payInAsset)) {
+          throw hostError(
+            "The selected payment attempt is not a reusable pending checkout.",
+            409,
+            "CONFLICT"
+          );
+        }
+      }
+      return resolvedPayment(amount, selected);
+    }
+    if (context.action === "checkout.create" || context.action === "swap.create") {
+      if (attempts.some((payment) => payment.status === "settled")) {
+        throw hostError("This reference is already paid.", 409, "CONFLICT");
+      }
+      const now = clock();
+      const matching = attempts.filter(
+        (payment) => isLivePaymentAttempt(payment, now) && matchesCreateAction(payment, context.action, context.payInAsset)
+      );
+      if (matching.length > 1) {
+        throw hostError(
+          "This reference has multiple unpaid checkouts in progress for this payment method; wait for them to expire before creating another.",
+          409,
+          "CONFLICT"
+        );
+      }
+      const selected = matching[0];
+      if (selected === void 0) return { amount };
+      if (!isReusablePaymentAttempt(selected.expiresAt, now)) return { amount };
+      return resolvedPayment(amount, selected);
+    }
+    throw hostError("payment_hash is required for this action.", 400, "INVALID_REQUEST");
+  };
+  return {
+    resolveCheckout,
+    onCheckoutCreated: (input) => payments.commitAttempt(input),
+    onPaid,
+    payments
+  };
+}
+function resolvedPayment(amount, payment) {
+  return {
+    ...amount === void 0 ? {} : { amount },
+    paymentHash: payment.paymentHash,
+    checkout: structuredClone(payment.checkout),
+    // Carried so `payments/check` can serve the row path without re-listing
+    // the rows this resolver just read.
+    attemptStatus: { status: payment.status, paidAt: payment.paidAt },
+    ...payment.swapData === void 0 || payment.swapData === null ? {} : { swapData: payment.swapData }
+  };
+}
+function isLivePaymentAttempt(payment, now) {
+  return payment.status === "pending" && payment.statusReason !== "superseded" && payment.expiresAt > now;
+}
+function matchesCreateAction(payment, action, payInAsset) {
+  const isSwap = payment.swapData !== void 0 && payment.swapData !== null;
+  if (action === "checkout.create") return !isSwap;
+  if (action !== "swap.create") return false;
+  if (!isSwap) return false;
+  if (payInAsset === void 0) return true;
+  return payment.swapData?.providerOrder.pay_in_asset === payInAsset;
+}
+function normalizePayments(values) {
+  return values.map((payment) => ({
+    ...payment,
+    paymentHash: storedPaymentHash(payment.paymentHash)
+  })).sort(
+    (left, right) => right.createdAt - left.createdAt || right.paymentHash.localeCompare(left.paymentHash)
+  );
+}
+function paymentHashHint(input) {
+  const value = input.payment_hash;
+  if (value === void 0) return void 0;
+  if (typeof value !== "string") {
+    throw hostError("payment_hash must be a string.", 400, "INVALID_REQUEST");
+  }
+  return normalizePaymentHash(value);
+}
+function normalizePaymentHash(value) {
+  const normalized = value.trim().toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(normalized)) {
+    throw hostError("payment_hash must be 64 hexadecimal characters.", 400, "INVALID_REQUEST");
+  }
+  return normalized;
+}
+function storedPaymentHash(value) {
+  const normalized = value.trim().toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(normalized)) {
+    throw hostError(
+      "The payment repository returned a row with a malformed payment hash.",
+      500,
+      "INTERNAL"
+    );
+  }
+  return normalized;
+}
+
+// src/reconcile-loop.ts
+import { unixSeconds as unixSeconds4 } from "@openreceive/core";
+async function reconcileHostPayments(input) {
+  const clock = input.clock ?? unixSeconds4;
+  const attempts = input.attempts ?? await input.host.payments.listReconcilableAttempts();
+  if (attempts.length === 0) return [];
+  const byHash = new Map(
+    attempts.map((attempt) => [attempt.paymentHash.toLowerCase(), attempt])
+  );
+  const scannedAt = clock();
+  const checks = await input.service.reconcilePayments({
+    attempts,
+    overlapSeconds: input.overlapSeconds,
+    ...input.maxPages === void 0 ? {} : { maxPages: input.maxPages }
+  });
+  const failures = [];
+  for (const checked of checks) {
+    try {
+      const attempt = byHash.get(checked.paymentHash.toLowerCase());
+      if (attempt === void 0) continue;
+      if (checked.status === "settled") {
+        if (checked.paidAt === void 0) {
+          failures.push(
+            new Error(
+              `settled reconcile result for ${checked.paymentHash} carried no paidAt; the attempt stays pending and will be retried`
+            )
+          );
+          continue;
+        }
+        await input.host.onPaid({
+          paymentHash: checked.paymentHash,
+          paidAt: checked.paidAt,
+          details: checked.details
+        });
+        continue;
+      }
+      const walletTransaction = checked.details?.transaction;
+      const transition = reconciliationTransition(
+        attempt,
+        checked.status,
+        scannedAt,
+        walletTransaction?.state ?? walletTransaction?.transaction_state
+      );
+      if (transition !== null) {
+        await input.host.payments.recordReconciliation(transition);
+      }
+    } catch (error) {
+      failures.push(error);
+    }
+  }
+  if (failures.length > 0) {
+    const first = failures[0];
+    throw new AggregateError(
+      failures,
+      `reconciliation failed for ${failures.length} of ${checks.length} checks: ` + (first instanceof Error ? first.message : String(first))
+    );
+  }
+  return checks;
+}
+async function startReconciler(input) {
+  const pollIntervalMs = input.pollIntervalMs ?? 5e3;
+  if (!Number.isSafeInteger(pollIntervalMs) || pollIntervalMs < 250) {
+    throw new RangeError("pollIntervalMs must be a safe integer of at least 250");
+  }
+  if (typeof input.host.payments.claimReconcileGate !== "function") {
+    throw new TypeError(
+      "The reconciler requires payments.claimReconcileGate (a durable CAS gate shared by every worker); implement it on the repository so all scan entry points stay within one budget."
+    );
+  }
+  const overlapSeconds = input.overlapSeconds ?? 60;
+  const controller = new AbortController();
+  const stop = () => controller.abort();
+  input.signal?.addEventListener("abort", stop, { once: true });
+  let lastWarnedMessage;
+  const reportError = (error) => {
+    if (input.onError !== void 0) {
+      try {
+        input.onError(error);
+      } catch {
+      }
+      return;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    if (message === lastWarnedMessage) return;
+    lastWarnedMessage = message;
+    warnFailure("payment.reconcile.failed", "reconciliation pass failed (will retry)", error);
+  };
+  const done = (async () => {
+    try {
+      while (!controller.signal.aborted) {
+        const result = await maybeReconcilePayments({
+          service: input.service,
+          host: input.host,
+          overlapSeconds,
+          onError: reportError,
+          ...input.clock === void 0 ? {} : { clock: input.clock }
+        });
+        if (result.reason === "ran") lastWarnedMessage = void 0;
+        await abortableDelay(pollIntervalMs, controller.signal);
+      }
+    } finally {
+      input.signal?.removeEventListener("abort", stop);
+    }
+  })();
+  return { stop, done };
+}
+function abortableDelay(milliseconds, signal) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const timer = setTimeout(done, milliseconds);
+    signal.addEventListener("abort", done, { once: true });
+    function done() {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve();
+    }
+  });
+}
+
+// src/reconcile-gate.ts
+var OPENRECEIVE_MIN_RECONCILE_INTERVAL_SECONDS = 2;
+var OPENRECEIVE_RECONCILE_SCAN_TIMEOUT_MS = 9e3;
+var OPENRECEIVE_RECONCILE_SCAN_MAX_PAGES = 50;
+var EARLY_INVOICE_INTERVAL_SECONDS = 2;
+var MID_INVOICE_INTERVAL_SECONDS = 6;
+var LATE_INVOICE_INTERVAL_SECONDS = 12;
+var EARLY_INVOICE_WINDOW_SECONDS = 2 * 60;
+var MID_INVOICE_WINDOW_SECONDS = 5 * 60;
+function reconcileIntervalSeconds(attempts, now, minIntervalSeconds = OPENRECEIVE_MIN_RECONCILE_INTERVAL_SECONDS) {
+  const floor = Math.max(OPENRECEIVE_MIN_RECONCILE_INTERVAL_SECONDS, minIntervalSeconds);
+  if (attempts.length === 0) return floor;
+  const ageStretch = Math.min(
+    ...attempts.map((attempt) => intervalForInvoiceAge(Math.max(0, now - attempt.createdAt)))
+  );
+  return Math.max(floor, ageStretch);
+}
+function intervalForInvoiceAge(elapsedSeconds) {
+  if (elapsedSeconds < EARLY_INVOICE_WINDOW_SECONDS) return EARLY_INVOICE_INTERVAL_SECONDS;
+  if (elapsedSeconds < MID_INVOICE_WINDOW_SECONDS) return MID_INVOICE_INTERVAL_SECONDS;
+  return LATE_INVOICE_INTERVAL_SECONDS;
+}
+async function maybeReconcilePayments(input) {
+  const claimReconcileGate = input.host.payments.claimReconcileGate;
+  if (typeof claimReconcileGate !== "function") {
+    throw new TypeError(
+      "Opportunistic reconcile requires payments.claimReconcileGate (a durable CAS gate); implement it on the repository or disable with opportunisticReconcile: false."
+    );
+  }
+  const report = input.onError ?? ((error) => {
+    warnFailure(
+      "payment.reconcile.opportunistic.failed",
+      "opportunistic reconcile failed (will retry)",
+      error
+    );
+  });
+  try {
+    const attempts = await input.host.payments.listReconcilableAttempts();
+    if (attempts.length === 0) return { reason: "no_pending" };
+    const clock = input.clock ?? unixSeconds5;
+    const now = clock();
+    const intervalSeconds = reconcileIntervalSeconds(attempts, now, input.minIntervalSeconds);
+    const claimed = await claimReconcileGate.call(input.host.payments, { now, intervalSeconds });
+    if (!claimed) return { reason: "gate_busy" };
+    const checks = await withScanTimeout(
+      reconcileHostPayments({
+        service: input.service,
+        host: input.host,
+        // Already read above to size the gate interval; the pass scans that
+        // exact batch rather than repeating the query on the request path.
+        attempts,
+        overlapSeconds: input.overlapSeconds,
+        maxPages: input.maxPages ?? OPENRECEIVE_RECONCILE_SCAN_MAX_PAGES,
+        ...compact({ clock: input.clock })
+      }),
+      input.scanTimeoutMs ?? OPENRECEIVE_RECONCILE_SCAN_TIMEOUT_MS
+    );
+    return { reason: "ran", checks };
+  } catch (error) {
+    report(error);
+    return { reason: "scan_failed" };
+  }
+}
+function withScanTimeout(work, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`reconcile scan exceeded ${timeoutMs}ms`));
+    }, timeoutMs);
+    work.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error);
+      }
+    );
+  });
+}
+
+// src/http-request.ts
+import { isRecord, nonEmptyString } from "@openreceive/core";
+var MAX_REFERENCE_LENGTH = 200;
+var MAX_MEMO_LENGTH = 500;
+var MAX_BODY_BYTES = 64 * 1024;
+var ROUTE_BODY_FIELDS = {
+  "checkout.prepare": ["reference"],
+  "checkout.create": ["reference", "memo", "metadata"],
+  "payment.check": ["reference", "payment_hash"],
+  "swap.quote": ["reference", "pay_in_asset"],
+  "swap.create": ["reference", "pay_in_asset", "memo", "metadata"],
+  "swap.read": ["reference", "payment_hash"],
+  "swap.refund": ["reference", "payment_hash", "refund_address"]
+};
+function assertDeclaredFields(routeKind, body) {
+  const allowed = ROUTE_BODY_FIELDS[routeKind];
+  if (allowed === void 0) return;
+  for (const key of Object.keys(body)) {
+    if (!allowed.includes(key)) {
+      throw new HttpError(
+        400,
+        "INVALID_REQUEST",
+        `Unexpected request field for this route: ${key}.`
+      );
+    }
+  }
+}
+function rejectPayerAmount(body) {
+  if (body.amount !== void 0 || body.amount_msats !== void 0) {
+    throw new HttpError(
+      400,
+      "INVALID_REQUEST",
+      "This route does not accept a payer-supplied amount; the host resolves its order price."
+    );
+  }
+}
+function assertJsonContentType(request) {
+  const contentType = (request.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase();
+  if (contentType !== "application/json") {
+    throw new HttpError(415, "INVALID_REQUEST", "Request content type must be application/json.");
+  }
+}
+function assertNotCrossSite(request) {
+  if (request.headers.get("sec-fetch-site")?.trim().toLowerCase() === "cross-site") {
+    throw new HttpError(403, "FORBIDDEN", "Cross-site requests are not accepted.");
+  }
+}
+async function readJsonBody(request) {
+  assertNotCrossSite(request);
+  assertJsonContentType(request);
+  const declaredLength = Number(request.headers.get("content-length") ?? "0");
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_BODY_BYTES) {
+    throw new HttpError(413, "INVALID_REQUEST", "Request body is too large.");
+  }
+  const text = await readCappedBodyText(request);
+  try {
+    const value = text.trim() === "" ? {} : JSON.parse(text);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error();
+    return value;
+  } catch {
+    throw new HttpError(400, "INVALID_REQUEST", "Request body must be a JSON object.");
+  }
+}
+async function readCappedBodyText(request) {
+  const stream = request.body;
+  if (stream === null) return "";
+  const reader = stream.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    let result;
+    try {
+      result = await reader.read();
+    } catch {
+      throw new HttpError(400, "INVALID_REQUEST", "Request body must be a JSON object.");
+    }
+    if (result.done) break;
+    total += result.value.byteLength;
+    if (total > MAX_BODY_BYTES) {
+      await reader.cancel().catch(() => void 0);
+      throw new HttpError(413, "INVALID_REQUEST", "Request body is too large.");
+    }
+    chunks.push(result.value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(body);
+}
+function ratesCurrencies(raw) {
+  if (raw === null) return void 0;
+  const currencies = raw.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  if (currencies.length === 0 || currencies.some((value) => !/^[A-Za-z]{3}$/.test(value))) {
+    throw new HttpError(
+      400,
+      "INVALID_REQUEST",
+      "currencies must be a comma-separated list of three-letter currency codes."
+    );
+  }
+  return currencies;
+}
+function optionalCheckoutFields(body) {
+  const memo = trimmedField(body.memo);
+  if (memo !== void 0 && memo.length > MAX_MEMO_LENGTH) {
+    throw new HttpError(
+      400,
+      "INVALID_REQUEST",
+      `memo must be ${MAX_MEMO_LENGTH} characters or fewer.`
+    );
+  }
+  const metadata = readRecord(body.metadata);
+  return {
+    ...memo === void 0 ? {} : { memo },
+    ...metadata === void 0 ? {} : { metadata }
+  };
+}
+function requiredPaymentHash(value) {
+  const hash = requiredString(value, "payment_hash").toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(hash)) {
+    throw new HttpError(400, "INVALID_REQUEST", "payment_hash must be 64 hexadecimal characters.");
+  }
+  return hash;
+}
+function requiredString(value, field, maxLength) {
+  const result = trimmedField(value);
+  if (result === void 0) throw new HttpError(400, "INVALID_REQUEST", `${field} is required.`);
+  if (maxLength !== void 0 && result.length > maxLength) {
+    throw new HttpError(
+      400,
+      "INVALID_REQUEST",
+      `${field} must be ${maxLength} characters or fewer.`
+    );
+  }
+  return result;
+}
+function trimmedField(value) {
+  return typeof value === "string" ? nonEmptyString(value.trim()) : void 0;
+}
+function readRecord(value) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) {
+    throw new HttpError(400, "INVALID_REQUEST", "metadata must be an object.");
+  }
+  return value;
+}
+
+// src/http-response.ts
+function toSnakeCase(value) {
+  if (Array.isArray(value)) return value.map(toSnakeCase);
+  if (typeof value === "bigint") return bigintToJsonNumber(value);
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [
+      key.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`),
+      toSnakeCase(item)
+    ])
+  );
+}
+function httpCheckout(checkout) {
+  return {
+    reference: checkout.reference,
+    payment_hash: checkout.paymentHash,
+    bolt11: checkout.bolt11,
+    amount_msats: checkout.amountMsats,
+    created_at: checkout.createdAt,
+    expires_at: checkout.expiresAt,
+    fiat_quote: checkout.fiatQuote === null ? null : toSnakeCase(checkout.fiatQuote)
+  };
+}
+function httpSwap(swap) {
+  const { checkout, swapData: _swapData, ...rest } = swap;
+  return {
+    ...toSnakeCase(rest),
+    checkout: httpCheckout(checkout)
+  };
+}
+function paymentCheckFromReconcilePass(checked) {
+  const { details, ...checkedPublic } = checked;
+  return {
+    ...toSnakeCase(checkedPublic),
+    ...details === void 0 ? {} : { details: publicPaymentDetails(details) }
+  };
+}
+async function paymentCheckFromStoredAttempt(payments, reference, paymentHash, resolvedStatus) {
+  const record = resolvedStatus ?? (await payments.listForReference(reference)).find(
+    (row) => row.paymentHash.toLowerCase() === paymentHash.toLowerCase()
+  );
+  if (record === void 0) {
+    throw new HttpError(404, "NOT_FOUND", "Payment attempt not found for this reference.");
+  }
+  return {
+    payment_hash: paymentHash.toLowerCase(),
+    status: record.status === "attention" ? "pending" : record.status,
+    ...record.paidAt === null ? {} : { paid_at: record.paidAt }
+  };
+}
+function publicPaymentDetails(details) {
+  const transaction = details.transaction;
+  const pick = (keys) => Object.fromEntries(
+    keys.flatMap(
+      (key) => transaction?.[key] === void 0 ? [] : [[key, transaction[key]]]
+    )
+  );
+  return {
+    ...transaction === void 0 ? {} : {
+      // `transaction_state` only: the NWC client normalizes every wallet
+      // spelling to it at the boundary, so no row here ever carries a bare
+      // `state`. Ruby's PUBLIC_TRANSACTION_FIELDS already omitted it.
+      transaction: pick([
+        "payment_hash",
+        "transaction_state",
+        "amount_msats",
+        "fees_paid_msats",
+        "created_at",
+        "settled_at",
+        "expires_at"
+      ])
+    },
+    observed_at: details.observed_at,
+    ...details.paid_at_source === void 0 ? {} : { paid_at_source: details.paid_at_source }
+  };
+}
+
+// src/rate-limit.ts
+import { unixSeconds as unixSeconds6 } from "@openreceive/core";
+var OPENRECEIVE_DEFAULT_IP_RATE_LIMIT_PER_HOUR = 60;
+var HOUR_SECONDS = 3600;
+var DAY_SECONDS = 86400;
+var MINT_ACTIONS = /* @__PURE__ */ new Set(["checkout.create", "swap.create"]);
+var DEFAULT_ACTIONS = ["checkout.create", "swap.create"];
+var DEFAULT_MESSAGE = "Too many payment attempts. Please try again later.";
+function createIpRateLimit(config = {}) {
+  const limitPerHour = config.limitPerHour ?? OPENRECEIVE_DEFAULT_IP_RATE_LIMIT_PER_HOUR;
+  const limitPerDay = config.limitPerDay;
+  if (!Number.isSafeInteger(limitPerHour) || limitPerHour < 1) {
+    throw new TypeError("rateLimiting limitPerHour must be an integer >= 1.");
+  }
+  if (limitPerDay !== void 0 && (!Number.isSafeInteger(limitPerDay) || limitPerDay < 1)) {
+    throw new TypeError("rateLimiting limitPerDay must be an integer >= 1.");
+  }
+  const actions = new Set(config.actions ?? DEFAULT_ACTIONS);
+  for (const action of actions) {
+    if (!MINT_ACTIONS.has(action)) {
+      throw new TypeError(
+        `rateLimiting actions only accept the invoice-minting actions (checkout.create, swap.create); got "${action}". Attempt-row counting counts mints, so a throttle on other actions could never trigger. Use a custom rateLimitHook to police other actions.`
+      );
+    }
+  }
+  const count = config.countAttemptsFromIp;
+  if (count === void 0) {
+    throw new TypeError(
+      "rateLimiting requires persistent counting. Implement countAttemptsFromIp on the payment repository (the built-in SQL repository already does), pass countAttemptsFromIp in the rateLimiting config, or disable rateLimiting and use a custom rateLimitHook backed by your own store. There is deliberately no in-memory fallback: per-process counts reset on restart and multiply per instance behind a load balancer."
+    );
+  }
+  const message = config.message ?? DEFAULT_MESSAGE;
+  const extractIp = config.ip ?? resolveClientIp;
+  const now = config.now ?? unixSeconds6;
+  let warnedUnattributable = false;
+  return async (context) => {
+    if (!actions.has(context.action)) return true;
+    const extracted = extractIp(context);
+    const ip = extracted === void 0 ? void 0 : clientIpBucket(extracted);
+    if (ip === void 0 || ip.length === 0) {
+      if (!warnedUnattributable) {
+        warnedUnattributable = true;
+        console.warn(
+          "[openreceive] rateLimiting allowed a request with no attributable client IP (fail-open). If every request logs no IP, the adapter is not supplying one and rate limiting is inactive \u2014 see the rate limiting guide."
+        );
+      }
+      return true;
+    }
+    const at = now();
+    if (await count(ip, at - HOUR_SECONDS) >= limitPerHour) {
+      throw tooManyAttempts(message);
+    }
+    if (limitPerDay !== void 0 && await count(ip, at - DAY_SECONDS) >= limitPerDay) {
+      throw tooManyAttempts(message);
+    }
+    return true;
+  };
+}
+function createProxyRateLimitingConfig(rateLimiting, trustProxyIpHeader, options = {}) {
+  if (rateLimiting === void 0 || rateLimiting === false) return {};
+  const headerName = trustProxyIpHeader === true ? "x-forwarded-for" : typeof trustProxyIpHeader === "string" ? trustProxyIpHeader.toLowerCase() : void 0;
+  const headerIp = headerName === void 0 ? void 0 : (context) => {
+    const value = context.request.headers.get(headerName);
+    const first = value?.split(",")[0]?.trim();
+    return first !== void 0 && first.length > 0 ? first : void 0;
+  };
+  const { requireIpSource } = options;
+  if (headerIp === void 0 && requireIpSource === void 0) return {};
+  const config = rateLimiting === true ? {} : rateLimiting;
+  if (headerIp === void 0 && config.ip === void 0 && requireIpSource !== void 0) {
+    throw new TypeError(
+      `rateLimiting on the ${requireIpSource} adapter needs a client IP source: a web Request has no socket IP. Pass trustProxyIpHeader: true to read x-forwarded-for (only behind your own reverse proxy), name another trusted header, or supply a custom rateLimiting.ip extractor.`
+    );
+  }
+  return { rateLimiting: { ...config, ip: config.ip ?? headerIp } };
+}
+function resolveClientIp(context) {
+  const native = context.native;
+  const ip = native?.ip;
+  return typeof ip === "string" && ip.length > 0 ? ip : void 0;
+}
+function clientIpBucket(ip) {
+  let value = ip.trim().toLowerCase();
+  if (value.startsWith("::ffff:") && value.includes(".")) value = value.slice("::ffff:".length);
+  if (!value.includes(":")) return value;
+  if (value.endsWith("/64")) return value;
+  const [address] = value.split("%");
+  const hextets = expandIpv6(address ?? "");
+  if (hextets === void 0) return value;
+  return `${hextets.slice(0, 4).join(":")}::/64`;
+}
+function expandIpv6(value) {
+  const parts = value.split("::");
+  if (parts.length > 2 || value.length === 0) return void 0;
+  const toHextets = (segment) => {
+    if (segment === "") return [];
+    const groups = [];
+    for (const group of segment.split(":")) {
+      if (/^[0-9a-f]{1,4}$/.test(group)) {
+        groups.push(group.replace(/^0+(?=.)/, ""));
+      } else if (/^\d{1,3}(\.\d{1,3}){3}$/.test(group)) {
+        const octets = group.split(".").map(Number);
+        if (octets.some((octet) => octet > 255)) return void 0;
+        groups.push(
+          (octets[0] << 8 | octets[1]).toString(16),
+          (octets[2] << 8 | octets[3]).toString(16)
+        );
+      } else {
+        return void 0;
+      }
+    }
+    return groups;
+  };
+  const head = toHextets(parts[0] ?? "");
+  const tail = parts.length === 2 ? toHextets(parts[1] ?? "") : [];
+  if (head === void 0 || tail === void 0) return void 0;
+  if (parts.length === 1) return head.length === 8 ? head : void 0;
+  const missing = 8 - head.length - tail.length;
+  if (missing < 1) return void 0;
+  return [...head, ...Array.from({ length: missing }, () => "0"), ...tail];
+}
+function tooManyAttempts(message) {
+  return new HttpError(429, "RATE_LIMITED", message, {
+    retryable: true,
+    retryAfterSeconds: 60
+  });
+}
+
+// src/handler.ts
+function createHttpHandler(options) {
+  if (options?.service === void 0) throw new TypeError("HTTP handler requires service.");
+  if (options.authorize === void 0) {
+    throw new TypeError("HTTP handler requires authorize; authentication belongs to the host.");
+  }
+  if (options.host === void 0) throw new TypeError("HTTP handler requires host.");
+  if (options.rateLimiting !== void 0 && options.rateLimiting !== false && options.rateLimitHook !== void 0) {
+    throw new TypeError("Pass either rateLimiting or a custom rateLimitHook, not both.");
+  }
+  const rateLimit = options.rateLimitHook ?? resolveRateLimiting(options);
+  const reconcile = options.opportunisticReconcile === false ? void 0 : typeof options.opportunisticReconcile === "object" ? options.opportunisticReconcile : {};
+  if (reconcile !== void 0 && typeof options.host.payments.claimReconcileGate !== "function") {
+    throw new TypeError(
+      "Opportunistic reconcile (on by default) requires payments.claimReconcileGate \u2014 a durable compare-and-set gate shared by every worker (the built-in SQL repository implements it over openreceive_meta). Implement it on the custom repository, or pass opportunisticReconcile: false and run your own settlement worker."
+    );
+  }
+  const rawExtractClientIp = (typeof options.rateLimiting === "object" ? options.rateLimiting.ip : void 0) ?? resolveClientIp;
+  const extractClientIp = (context) => {
+    const ip = rawExtractClientIp(context);
+    return ip === void 0 || ip.length === 0 ? void 0 : clientIpBucket(ip);
+  };
+  const runtime = {
+    ...options,
+    ...rateLimit === void 0 ? {} : { rateLimit },
+    extractClientIp,
+    reconcile,
+    paymentMethods: /* @__PURE__ */ new Map(),
+    prefix: normalizePrefix(options.prefix ?? "/openreceive")
+  };
+  const handle = async (request, extras) => {
+    const requestId = createRequestId();
+    try {
+      return await dispatch(runtime, request, requestId, extras?.native);
+    } catch (error) {
+      return errorResponse(error, requestId);
+    }
+  };
+  const handler = handle;
+  Object.defineProperties(handler, {
+    prefix: { value: runtime.prefix, enumerable: true },
+    handle: { value: handle, enumerable: true }
+  });
+  return handler;
+}
+async function dispatch(runtime, request, requestId, native) {
+  const url = new URL(request.url);
+  const route = matchRoute(runtime.prefix, request.method, url.pathname);
+  if (route === null)
+    throw new HttpError(404, "NOT_FOUND", "No OpenReceive route matched this method and path.");
+  if (route.kind === "rates") {
+    const currencies = ratesCurrencies(url.searchParams.get("currencies"));
+    return jsonResponse(
+      200,
+      await runtime.service.listRates(currencies === void 0 ? void 0 : { currencies }),
+      requestId
+    );
+  }
+  const body = await readJsonBody(request);
+  rejectPayerAmount(body);
+  assertDeclaredFields(route.kind, body);
+  const reference = requiredString(body.reference, "reference", MAX_REFERENCE_LENGTH);
+  const reconcilePass = runtime.reconcile === void 0 ? void 0 : await maybeReconcilePayments({
+    service: runtime.service,
+    host: runtime.host,
+    // `service`/`host` stay outside compact: it is recursive, and they
+    // are handles whose identity the reconcile pass relies on.
+    ...compact2({
+      minIntervalSeconds: runtime.reconcile.minIntervalSeconds,
+      clock: runtime.clock
+    })
+  });
+  if (route.kind === "checkout.prepare") {
+    await authorizeAndRateLimit(runtime, "checkout.prepare", request, { reference }, native);
+    const resolved2 = await resolveHostCheckout(
+      runtime,
+      "checkout.prepare",
+      request,
+      reference,
+      body
+    );
+    const prepared = await runtime.service.prepareCheckout({
+      amount: requireResolvedAmount(resolved2)
+    });
+    const swapOptions = await runtime.service.listSwapOptions({
+      amountMsats: prepared.amountMsats
+    });
+    return jsonResponse(
+      200,
+      {
+        reference,
+        amount_msats: prepared.amountMsats,
+        fiat_quote: prepared.fiatQuote === null ? null : toSnakeCase(prepared.fiatQuote),
+        payment_methods: toSnakeCase(swapOptions.options)
+      },
+      requestId
+    );
+  }
+  if (route.kind === "checkout.create") {
+    await enforceAuthorize(runtime, "checkout.create", request, { reference }, native);
+    const resolved2 = await resolveHostCheckout(
+      runtime,
+      "checkout.create",
+      request,
+      reference,
+      body
+    );
+    const checkout = await commitNewAttempt(
+      runtime,
+      "checkout.create",
+      request,
+      reference,
+      resolved2,
+      native,
+      {
+        mint: () => runtime.service.createCheckout({
+          reference,
+          amount: requireResolvedAmount(resolved2),
+          ...optionalCheckoutFields(body)
+        }),
+        recover: () => committedCheckout(reference, resolved2),
+        attempt: (minted) => ({ paymentHash: minted.paymentHash, checkout: minted })
+      }
+    );
+    return jsonResponse(201, { checkout: httpCheckout(checkout) }, requestId);
+  }
+  if (route.kind === "payment.check") {
+    const requestedPaymentHash2 = requiredPaymentHash(
+      requiredString(body.payment_hash, "payment_hash")
+    );
+    await authorizeAndRateLimit(
+      runtime,
+      "payment.check",
+      request,
+      { reference, paymentHash: requestedPaymentHash2 },
+      native
+    );
+    const resolved2 = await resolveHostCheckout(runtime, "payment.check", request, reference, body);
+    const paymentHash2 = selectedPaymentHash(resolved2, requestedPaymentHash2);
+    const fromPass = reconcilePass !== void 0 && reconcilePass.reason === "ran" ? reconcilePass.checks.find(
+      (check) => check.paymentHash.toLowerCase() === paymentHash2.toLowerCase()
+    ) : void 0;
+    const checkedBody = fromPass !== void 0 && fromPass.status !== "not_found" ? paymentCheckFromReconcilePass(fromPass) : await paymentCheckFromStoredAttempt(
+      runtime.host.payments,
+      reference,
+      paymentHash2,
+      resolved2.attemptStatus
+    );
+    const checkout = requireResolvedCheckout(resolved2);
+    return jsonResponse(
+      200,
+      {
+        ...checkedBody,
+        payment_methods: await checkPaymentMethods(runtime, checkout.amountMsats)
+      },
+      requestId
+    );
+  }
+  if (route.kind === "swap.quote") {
+    const payInAsset = requiredString(body.pay_in_asset, "pay_in_asset");
+    await authorizeAndRateLimit(runtime, "swap.quote", request, { reference }, native);
+    const resolved2 = await resolveHostCheckout(
+      runtime,
+      "swap.quote",
+      request,
+      reference,
+      body,
+      payInAsset
+    );
+    return jsonResponse(
+      200,
+      toSnakeCase(
+        await runtime.service.quoteSwap({
+          amount: requireResolvedAmount(resolved2),
+          payInAsset
+        })
+      ),
+      requestId
+    );
+  }
+  if (route.kind === "swap.create") {
+    const payInAsset = requiredString(body.pay_in_asset, "pay_in_asset");
+    await enforceAuthorize(runtime, "swap.create", request, { reference }, native);
+    const resolved2 = await resolveHostCheckout(
+      runtime,
+      "swap.create",
+      request,
+      reference,
+      body,
+      payInAsset
+    );
+    const swap = await commitNewAttempt(
+      runtime,
+      "swap.create",
+      request,
+      reference,
+      resolved2,
+      native,
+      {
+        mint: () => runtime.service.createSwap({
+          reference,
+          amount: requireResolvedAmount(resolved2),
+          payInAsset,
+          ...optionalCheckoutFields(body)
+        }),
+        recover: () => recoverCommittedSwap(runtime, reference, resolved2),
+        attempt: (minted) => ({
+          paymentHash: minted.paymentHash,
+          checkout: minted.checkout,
+          swapData: minted.swapData
+        })
+      }
+    );
+    return jsonResponse(201, { swap: httpSwap(swap) }, requestId);
+  }
+  const action = route.kind === "swap.read" ? "swap.read" : "swap.refund";
+  const requestedPaymentHash = requiredPaymentHash(
+    requiredString(body.payment_hash, "payment_hash")
+  );
+  await authorizeAndRateLimit(
+    runtime,
+    action,
+    request,
+    { reference, paymentHash: requestedPaymentHash },
+    native
+  );
+  const resolved = await resolveHostCheckout(runtime, action, request, reference, body);
+  const swapData = requireResolvedSwapData(resolved.swapData);
+  const paymentHash = selectedPaymentHash(resolved, requestedPaymentHash);
+  if (route.kind === "swap.read") {
+    return jsonResponse(
+      200,
+      toSnakeCase(
+        await runtime.service.getSwap({
+          reference,
+          paymentHash,
+          swapData
+        })
+      ),
+      requestId
+    );
+  }
+  const refundAddress = requiredString(body.refund_address, "refund_address");
+  return jsonResponse(
+    200,
+    toSnakeCase(
+      await runtime.service.refundSwap({
+        reference,
+        paymentHash,
+        swapData,
+        refundAddress
+      })
+    ),
+    requestId
+  );
+}
+async function commitNewAttempt(runtime, action, request, reference, resolved, native, arms) {
+  if (resolved.paymentHash !== void 0) return arms.recover();
+  await enforceRateLimit(runtime, action, request, { reference }, native);
+  const minted = await arms.mint();
+  const clientIp = runtime.extractClientIp({ action, request, resource: { reference }, native });
+  await persistCheckoutAttempt(runtime, {
+    reference,
+    ...arms.attempt(minted),
+    ...clientIp === void 0 ? {} : { clientIp }
+  });
+  return minted;
+}
+async function resolveHostCheckout(runtime, action, request, reference, input, payInAsset) {
+  return runtime.host.resolveCheckout({
+    action,
+    request,
+    reference,
+    ...payInAsset === void 0 ? {} : { payInAsset },
+    input
+  });
+}
+function resolveRateLimiting(options) {
+  if (options.rateLimiting === void 0 || options.rateLimiting === false) return void 0;
+  const config = options.rateLimiting === true ? {} : options.rateLimiting;
+  const payments = options.host.payments;
+  const countAttemptsFromIp = config.countAttemptsFromIp ?? payments.countAttemptsFromIp?.bind(payments);
+  return createIpRateLimit({
+    ...config,
+    ...countAttemptsFromIp === void 0 ? {} : { countAttemptsFromIp }
+  });
+}
+async function authorizeAndRateLimit(runtime, action, request, resource, native) {
+  await enforceRateLimit(runtime, action, request, resource, native);
+  await enforceAuthorize(runtime, action, request, resource, native);
+}
+async function enforceRateLimit(runtime, action, request, resource, native) {
+  if (runtime.rateLimit === void 0) return;
+  if (!await runtime.rateLimit({ action, request, resource, native })) {
+    throw new HttpError(429, "RATE_LIMITED", "Too many requests.", {
+      retryable: true,
+      retryAfterSeconds: 60
+    });
+  }
+}
+async function enforceAuthorize(runtime, action, request, resource, native) {
+  if (!await runtime.authorize({ action, request, resource, native })) {
+    throw new HttpError(403, "FORBIDDEN", "Not authorized for this action.");
+  }
+}
+async function persistCheckoutAttempt(runtime, input) {
+  try {
+    await runtime.host.onCheckoutCreated(input);
+  } catch (error) {
+    if (error instanceof HttpError || isServiceErrorShape(error)) throw error;
+    throw new HttpError(
+      503,
+      "INTERNAL",
+      "The host could not persist this payment attempt; payer instructions were withheld. Please retry.",
+      { retryable: true }
+    );
+  }
+}
+var PAYMENT_METHODS_CACHE_SECONDS = 60;
+var PAYMENT_METHODS_CACHE_MAX_ENTRIES = 256;
+async function checkPaymentMethods(runtime, amountMsats) {
+  const now = (runtime.clock ?? unixSeconds7)();
+  const cached = runtime.paymentMethods.get(amountMsats);
+  if (cached !== void 0 && now - cached.at < PAYMENT_METHODS_CACHE_SECONDS) {
+    return cached.methods;
+  }
+  const swapOptions = await runtime.service.listSwapOptions({ amountMsats });
+  const methods = toSnakeCase(swapOptions.options);
+  if (runtime.paymentMethods.size >= PAYMENT_METHODS_CACHE_MAX_ENTRIES) {
+    runtime.paymentMethods.clear();
+  }
+  runtime.paymentMethods.set(amountMsats, { at: now, methods });
+  return methods;
+}
+function selectedPaymentHash(resolved, requestedPaymentHash) {
+  const selected = hostPaymentHash(resolved.paymentHash);
+  if (selected !== requestedPaymentHash) {
+    throw new HttpError(
+      404,
+      "NOT_FOUND",
+      "The selected payment attempt does not belong to this order."
+    );
+  }
+  return selected;
+}
+function hostPaymentHash(value) {
+  if (typeof value === "string") {
+    const hash = value.trim().toLowerCase();
+    if (/^[0-9a-f]{64}$/.test(hash)) return hash;
+  }
+  throw new HttpError(
+    500,
+    "INTERNAL",
+    "The host resolver returned a missing or malformed payment hash for this reference."
+  );
+}
+function requireResolvedAmount(value) {
+  if (value.amount === void 0 || value.amount === null) {
+    throw new HttpError(500, "INTERNAL", "The host resolved this order without an amount.");
+  }
+  return value.amount;
+}
+function requireResolvedCheckout(value) {
+  if (value.checkout === void 0) {
+    throw new HttpError(409, "CONFLICT", "The host payment attempt has no checkout snapshot.");
+  }
+  return value.checkout;
+}
+function requireResolvedSwapData(value) {
+  if (value === void 0) {
+    throw new HttpError(404, "NOT_FOUND", "The host order has no swap data.");
+  }
+  return value;
+}
+function committedCheckout(reference, resolved) {
+  const paymentHash = hostPaymentHash(resolved.paymentHash);
+  const checkout = requireResolvedCheckout(resolved);
+  if (checkout.reference !== reference || checkout.paymentHash.toLowerCase() !== paymentHash) {
+    throw new HttpError(
+      409,
+      "CONFLICT",
+      "The selected payment attempt is not a reusable pending checkout."
+    );
+  }
+  return structuredClone(checkout);
+}
+async function recoverCommittedSwap(runtime, reference, resolved) {
+  const paymentHash = hostPaymentHash(resolved.paymentHash);
+  const swapData = requireResolvedSwapData(resolved.swapData);
+  const status = await runtime.service.getSwap({ reference, paymentHash, swapData });
+  const checkout = committedCheckout(reference, resolved);
+  return { ...status, checkout, swapData };
+}
+
+// src/notifications.ts
+import {
+  classifyTransactionSettlement,
+  OpenReceiveError,
+  unixSeconds as unixSeconds8
+} from "@openreceive/core";
+async function startNotificationListener(input) {
+  const subscribe = input.service.subscribeWalletNotifications?.bind(input.service);
+  if (subscribe === void 0) {
+    throw new OpenReceiveError({
+      code: "UNSUPPORTED_METHOD",
+      message: "OpenReceive service does not support wallet notifications (subscribeWalletNotifications). Keep polling reconciliation.",
+      retryable: false
+    });
+  }
+  if (typeof input.host.payments.claimReconcileGate !== "function") {
+    throw new TypeError(
+      "The notification listener requires payments.claimReconcileGate (a durable CAS gate shared by every worker); implement it on the repository so all scan entry points stay within one budget."
+    );
+  }
+  const reportError = (error) => {
+    if (input.onError === void 0) {
+      warnFailure(
+        "payment.notification.failed",
+        "notification listener failed (polling remains the safety net)",
+        error
+      );
+      return;
+    }
+    try {
+      input.onError(error);
+    } catch {
+    }
+  };
+  let stopped = false;
+  let running = false;
+  let queued = false;
+  let inFlight = Promise.resolve();
+  let settling = Promise.resolve();
+  const wakeReconciliation = () => {
+    if (stopped) return;
+    if (running) {
+      queued = true;
+      return;
+    }
+    running = true;
+    inFlight = (async () => {
+      try {
+        do {
+          queued = false;
+          await maybeReconcilePayments({
+            service: input.service,
+            host: input.host,
+            onError: reportError,
+            ...input.overlapSeconds === void 0 ? {} : { overlapSeconds: input.overlapSeconds }
+          });
+        } while (queued && !stopped);
+      } finally {
+        running = false;
+      }
+    })();
+  };
+  const isPendingAttempt = async (paymentHash) => {
+    const payments = input.host.payments;
+    if (payments.findPendingAttempt !== void 0) {
+      return await payments.findPendingAttempt(paymentHash) !== void 0;
+    }
+    const attempts = await payments.listReconcilableAttempts();
+    return attempts.some((attempt) => attempt.paymentHash.toLowerCase() === paymentHash);
+  };
+  const settleDirectly = async (transaction, notifiedHash) => {
+    if (stopped) return;
+    try {
+      const detection = classifyTransactionSettlement(transaction);
+      const paymentHash = (transaction.payment_hash ?? notifiedHash)?.toLowerCase();
+      if (!detection.settled || paymentHash === void 0) {
+        wakeReconciliation();
+        return;
+      }
+      if (!await isPendingAttempt(paymentHash)) {
+        wakeReconciliation();
+        return;
+      }
+      const observedAt = unixSeconds8();
+      await input.host.onPaid({
+        paymentHash,
+        paidAt: transaction.settled_at ?? observedAt,
+        details: {
+          transaction,
+          observed_at: observedAt,
+          paid_at_source: transaction.settled_at === void 0 ? "observed_at" : "settled_at"
+        }
+      });
+    } catch (error) {
+      reportError(error);
+      wakeReconciliation();
+    }
+  };
+  const unsubscribe = await subscribe((notification) => {
+    if (notification.type !== "payment_received") return;
+    const transaction = notification.transaction;
+    if (transaction === void 0) {
+      wakeReconciliation();
+      return;
+    }
+    settling = settling.then(() => settleDirectly(transaction, notification.payment_hash));
+  });
+  return {
+    async stop() {
+      if (stopped) return;
+      stopped = true;
+      try {
+        await unsubscribe();
+      } catch (error) {
+        reportError(error);
+      }
+      await settling;
+      await inFlight;
+    }
+  };
+}
+async function startNotificationWorker(input) {
+  const reconciler = await startReconciler({
+    service: input.service,
+    host: input.host,
+    pollIntervalMs: input.pollIntervalMs ?? 15e3,
+    ...input.overlapSeconds === void 0 ? {} : { overlapSeconds: input.overlapSeconds },
+    ...input.onError === void 0 ? {} : { onError: input.onError }
+  });
+  let listener;
+  try {
+    listener = await startNotificationListener({
+      service: input.service,
+      host: input.host,
+      ...input.overlapSeconds === void 0 ? {} : { overlapSeconds: input.overlapSeconds },
+      ...input.onError === void 0 ? {} : { onError: input.onError }
+    });
+  } catch (error) {
+    if (error instanceof OpenReceiveError && error.code === "UNSUPPORTED_METHOD") {
+      if (input.onError === void 0) {
+        warnFailure(
+          "payment.notification.unsupported",
+          "wallet lacks NWC notifications; running the periodic pass alone",
+          error
+        );
+      } else {
+        input.onError(error);
+      }
+    } else {
+      reconciler.stop();
+      await reconciler.done;
+      throw error;
+    }
+  }
+  return {
+    async stop() {
+      await listener?.stop();
+      reconciler.stop();
+      await reconciler.done;
+    },
+    done: reconciler.done
+  };
+}
+
+// src/orm-adapters.ts
+function knexDb(knex, dialect) {
+  const queryOn = (executor) => async (sql, params = []) => {
+    const result = await executor.raw(sql, [...params]);
+    return dialect === "sqlite" ? result : result.rows ?? [];
+  };
+  return {
+    dialect,
+    query: queryOn(knex),
+    transaction: (run) => knex.transaction((trx) => run({ query: queryOn(trx) }))
+  };
+}
+function prismaStatementReturnsRows(sql) {
+  return /^\s*(?:select|values|with)\b/i.test(sql) || /\breturning\b/i.test(sql);
+}
+function prismaDb(prisma, dialect) {
+  const queryOn = (tx) => async (sql, params = []) => {
+    if (prismaStatementReturnsRows(sql)) {
+      return await tx.$queryRawUnsafe(sql, ...params);
+    }
+    await tx.$executeRawUnsafe(sql, ...params);
+    return [];
+  };
+  return {
+    dialect,
+    query: queryOn(prisma),
+    transaction: (run) => prisma.$transaction((tx) => run({ query: queryOn(tx) }))
+  };
+}
+function typeOrmDb(dataSource, dialect) {
+  const queryOn = (runner) => async (sql, params = []) => await runner.query(sql, [...params]) ?? [];
+  return {
+    dialect,
+    query: queryOn(dataSource),
+    transaction: (run) => dataSource.transaction((manager) => run({ query: queryOn(manager) }))
+  };
+}
+function sequelizeDb(sequelize, dialect) {
+  const queryOn = (transaction) => async (sql, params = []) => {
+    const result = await sequelize.query(sql, {
+      bind: [...params],
+      ...transaction === void 0 ? {} : { transaction }
+    });
+    const rows = Array.isArray(result) ? result[0] : void 0;
+    return Array.isArray(rows) ? rows : [];
+  };
+  return {
+    dialect,
+    query: queryOn(),
+    transaction: (run) => sequelize.transaction((transaction) => run({ query: queryOn(transaction) }))
+  };
+}
+
+// src/stack.ts
+import { compact as compact3 } from "@openreceive/core";
+import { createOpenReceive } from "@openreceive/node";
+function createStack(options) {
+  const { wallet, storage, amountFor, clock, onBootFailure, ...handlerOptions } = options;
+  const host = createHost({
+    ...storage,
+    amountFor,
+    ...compact3({ clock })
+  });
+  const prefix = normalizePrefix(options.prefix ?? "/openreceive");
+  let ownedService;
+  const boot = (async () => {
+    const resolved = wallet.service !== void 0 ? await wallet.service : await createOpenReceive({ nwc: wallet.nwc });
+    if (wallet.service === void 0) ownedService = resolved;
+    return createHttpHandler({
+      ...handlerOptions,
+      ...compact3({ clock }),
+      service: resolved,
+      host
+    });
+  })();
+  boot.catch((error) => {
+    const message = `OpenReceive stack failed to start: ${error instanceof Error ? error.message : String(error)}`;
+    if (onBootFailure === void 0) console.error(message);
+    else onBootFailure(message);
+  });
+  const handle = async (request, extras) => {
+    let booted;
+    try {
+      booted = await boot;
+    } catch {
+      return errorResponse(
+        new HttpError(
+          503,
+          "WALLET_UNAVAILABLE",
+          "The payment service is not available. Please try again shortly.",
+          { retryable: true }
+        ),
+        createRequestId()
+      );
+    }
+    return booted(request, extras);
+  };
+  const handler = handle;
+  Object.defineProperties(handler, {
+    prefix: { value: prefix, enumerable: true },
+    handle: { value: handle, enumerable: true }
+  });
+  return {
+    handler,
+    ready: boot.then(() => void 0),
+    async close() {
+      await boot.catch(() => {
+      });
+      await ownedService?.close();
+    }
+  };
+}
+function isStackOptions(options) {
+  if (options.host !== void 0) return false;
+  const flat = options;
+  if (flat.wallet !== void 0 || flat.storage !== void 0 || flat.amountFor !== void 0) {
+    return true;
+  }
+  throw new TypeError(
+    "OpenReceive composed options require host: pass { service, host, authorize }, or use the all-in-one form with wallet/storage/amountFor."
+  );
+}
+
+export {
+  HttpError,
+  isServiceErrorShape,
+  HostError,
+  hostError,
+  mapHostRouteError,
+  createRequestId,
+  jsonResponse,
+  errorResponse,
+  webRequest,
+  isUnderPrefix,
+  OPENRECEIVE_ATTEMPT_EXPIRY_GRACE_SECONDS,
+  OPENRECEIVE_RECONCILE_BATCH_SIZE,
+  paymentsSchemaSql,
+  createSqlPayments,
+  OPENRECEIVE_PAYMENTS_SCHEMA_VERSION2 as OPENRECEIVE_PAYMENTS_SCHEMA_VERSION,
+  createHost,
+  reconcileHostPayments,
+  startReconciler,
+  OPENRECEIVE_MIN_RECONCILE_INTERVAL_SECONDS,
+  OPENRECEIVE_RECONCILE_SCAN_TIMEOUT_MS,
+  OPENRECEIVE_RECONCILE_SCAN_MAX_PAGES,
+  reconcileIntervalSeconds,
+  maybeReconcilePayments,
+  createIpRateLimit,
+  createProxyRateLimitingConfig,
+  resolveClientIp,
+  createHttpHandler,
+  startNotificationListener,
+  startNotificationWorker,
+  knexDb,
+  prismaDb,
+  typeOrmDb,
+  sequelizeDb,
+  createStack,
+  isStackOptions
+};