@qntx/nostr 0.7.0 → 0.8.0

package/dist/{relay-CvxPiQ_m.mjs → relay-quCs7MHD.mjs}

@@ -1,11 +1,12 @@
-import { _ as MessageError, b as WasmPoisonedError, u as normalizeURL, v as NostrError } from "./util-yFYzlbrm.mjs";
-import { n as verifyEvent } from "./verifier-BTLOpo1n.mjs";
+import { _ as MessageError, b as WasmPoisonedError, u as normalizeURL, v as NostrError } from "./util-DMF9AIO0.mjs";
+import { n as verifyEvent } from "./verifier-B51Wkt5H.mjs";
 import { n as canonicalizeFilters, r as filterFingerprint, t as canonicalizeFilter } from "./filter-BQl3GlHt.mjs";
-import { n as createSubscriptionId, r as encodeClientMessage, s as parseRelayMessage, t as assertSubscriptionId } from "./message-CWLcFTQ1.mjs";
-import { t as NoSignerError } from "./error-gtJvV6YS.mjs";
+import { n as createSubscriptionId, r as encodeClientMessage, s as parseRelayMessage, t as assertSubscriptionId } from "./message-oNr7t0SJ.mjs";
+import { t as NoSignerError } from "./error-DlhGW4mJ.mjs";
 import { t as invokeSafely } from "./report-CHld4uWj.mjs";
 import { isAuthRequired, makeAuthEvent } from "./nips/nip42.mjs";
 import { i as throwIfAborted, n as onAbort, r as raceSignal, t as abortReason } from "./abort-DBq2STPj.mjs";
+import { t as Emitter } from "./emitter-DkCY6NkU.mjs";
 import { Nip77Error, runNegSession } from "./nips/nip77.mjs";
 //#region src/relay/error.ts
 /** Base class for relay errors; carries the relay URL when known. */
@@ -62,6 +63,513 @@ function getWebSocketImplementation() {
 	return impl;
 }
 //#endregion
+//#region src/relay/auth.ts
+var RelayAuth = class {
+	#challenge;
+	#authedChallenge;
+	/** Challenge value already answered on this connection; duplicates are not re-signed. */
+	#answeredChallenge;
+	/** Settled OK verdict for `#answeredChallenge`; set only once the relay replies. */
+	#answeredResult;
+	#authPromise;
+	#url;
+	#isOpen;
+	#sendAuth;
+	#defaultTimeoutMs;
+	constructor(deps) {
+		this.#url = deps.url;
+		this.#isOpen = deps.isOpen;
+		this.#sendAuth = deps.sendAuth;
+		this.#defaultTimeoutMs = deps.defaultTimeoutMs;
+	}
+	/** Latest NIP-42 challenge, if any. */
+	get challenge() {
+		return this.#challenge;
+	}
+	/**
+	* A re-sent identical challenge keeps the in-flight/settled dedupe; only a new challenge value
+	* resets the answer state.
+	*/
+	handleChallenge(challenge) {
+		if (challenge !== this.#challenge) {
+			this.#authPromise = void 0;
+			this.#authedChallenge = void 0;
+			this.#answeredChallenge = void 0;
+			this.#answeredResult = void 0;
+		}
+		this.#challenge = challenge;
+	}
+	/** New connection: challenge and answer state belong to the old socket. */
+	resetConnection() {
+		this.#challenge = void 0;
+		this.#authPromise = void 0;
+		this.#authedChallenge = void 0;
+		this.#answeredChallenge = void 0;
+		this.#answeredResult = void 0;
+	}
+	/** Sign the current challenge and wait for OK. */
+	async auth(sign, opts) {
+		const challenge = this.#challenge;
+		if (challenge === void 0 || challenge === "") throw new RelayError("no AUTH challenge received from relay", this.#url);
+		if (this.#authPromise) return this.#authPromise;
+		if (this.#answeredChallenge === challenge && this.#answeredResult !== void 0) return this.#answeredResult;
+		const pending = (async () => {
+			const template = makeAuthEvent(this.#url, challenge);
+			let event;
+			try {
+				event = await sign(template);
+			} catch (error) {
+				if (error instanceof NoSignerError) return {
+					ok: false,
+					message: "auth: no signer"
+				};
+				throw error;
+			}
+			if (!this.#isOpen()) throw new RelayClosedError("not connected", this.#url);
+			const result = await this.#sendAuth(event, opts?.timeoutMs ?? this.#defaultTimeoutMs);
+			if (this.#challenge === challenge) {
+				this.#answeredChallenge = challenge;
+				this.#answeredResult = result;
+			}
+			return result;
+		})();
+		this.#authPromise = pending;
+		try {
+			const result = await pending;
+			if (result.ok && this.#challenge === challenge) this.#authedChallenge = challenge;
+			return result;
+		} finally {
+			if (this.#authPromise === pending) this.#authPromise = void 0;
+		}
+	}
+	async ensureAuthed(signer) {
+		if (!signer) return false;
+		for (let i = 0; i < 3; i++) {
+			if (this.#challenge === void 0 || this.#challenge === "") return false;
+			if (this.#authedChallenge === this.#challenge) return true;
+			const signed = this.#challenge;
+			const result = await this.auth(signer);
+			if (this.#authedChallenge === this.#challenge) return true;
+			if (!result.ok) {
+				if (this.#challenge === void 0 || this.#challenge === "" || this.#challenge === signed) return false;
+				continue;
+			}
+		}
+		return this.#authedChallenge === this.#challenge;
+	}
+	/**
+	* Clear a cached AUTH rejection for the current challenge (a successful auth and in-flight
+	* answers are kept) and return the unanswered challenge to re-emit, if any.
+	*/
+	resetRejection() {
+		if (this.#answeredResult !== void 0 && !this.#answeredResult.ok) {
+			this.#answeredChallenge = void 0;
+			this.#answeredResult = void 0;
+		}
+		if (this.#challenge !== void 0 && this.#challenge !== this.#authedChallenge) return this.#challenge;
+	}
+};
+//#endregion
+//#region src/relay/count-tracker.ts
+/**
+* COUNT request correlation: one waiter per request id with a timeout, abort cleanup and a re-send
+* after AUTH.
+*/
+var CountTracker = class {
+	#entries = /* @__PURE__ */ new Map();
+	get size() {
+		return this.#entries.size;
+	}
+	get(id) {
+		return this.#entries.get(id);
+	}
+	/**
+	* Register a waiter, wire the abort listener, arm its timeout and call `send`. A send throw
+	* rejects (`sendError` when the throw is not an Error). resolve/reject unwind the timer, abort
+	* listener and map entry.
+	*/
+	async track(id, opts) {
+		return new Promise((resolve, reject) => {
+			const waiter = {
+				id,
+				resolve: (result) => {
+					this.#finish(waiter);
+					cleanup();
+					resolve(result);
+				},
+				reject: (err) => {
+					this.#finish(waiter);
+					cleanup();
+					reject(err);
+				},
+				timer: void 0,
+				filters: opts.filters,
+				authRetried: false,
+				timeoutMs: opts.timeoutMs,
+				timeoutError: opts.timeoutError
+			};
+			const cleanup = onAbort(opts.signal, () => {
+				if (opts.signal !== void 0) waiter.reject(abortReason(opts.signal));
+			});
+			waiter.timer = setTimeout(() => {
+				waiter.reject(opts.timeoutError());
+			}, opts.timeoutMs);
+			this.#entries.set(id, waiter);
+			try {
+				opts.send();
+			} catch (error) {
+				waiter.reject(error instanceof Error ? error : opts.sendError());
+			}
+		});
+	}
+	/** Stop a waiter's timeout without settling (AUTH retry window). */
+	clearTimer(waiter) {
+		if (waiter.timer !== void 0) {
+			clearTimeout(waiter.timer);
+			waiter.timer = void 0;
+		}
+	}
+	/** Re-arm the timeout for a re-sent COUNT (after an AUTH retry). */
+	restartTimer(id) {
+		const waiter = this.#entries.get(id);
+		if (waiter === void 0) return;
+		waiter.timer = setTimeout(() => {
+			waiter.reject(waiter.timeoutError());
+		}, waiter.timeoutMs);
+	}
+	/**
+	* Re-send a COUNT after the relay demanded AUTH: pause the timeout through the AUTH window,
+	* re-arm it and re-send on success, reject on failure.
+	*/
+	async authRetry(waiter, deps) {
+		this.clearTimer(waiter);
+		try {
+			const ok = await deps.ensureAuthed();
+			if (this.#entries.get(waiter.id) !== waiter) return;
+			if (!ok || !deps.isOpen()) {
+				waiter.reject(deps.failError());
+				return;
+			}
+			this.restartTimer(waiter.id);
+			deps.send();
+		} catch (error) {
+			if (this.#entries.get(waiter.id) === void 0) return;
+			waiter.reject(error instanceof Error ? error : deps.failError());
+		}
+	}
+	rejectAll(err) {
+		for (const waiter of this.#entries.values()) {
+			this.clearTimer(waiter);
+			waiter.reject(err);
+		}
+		this.#entries.clear();
+	}
+	#finish(waiter) {
+		this.clearTimer(waiter);
+		this.#entries.delete(waiter.id);
+	}
+};
+//#endregion
+//#region src/relay/subscription.ts
+/**
+* Internal REQ runtime: owns its lifecycle flags, watermark bookkeeping and handler dispatch.
+* `onLocalClose` is supplied by the registry — it sends CLOSE / detaches from a live group — and is
+* invoked by {@link close} only, never by {@link end}.
+*/
+var Subscription = class {
+	id;
+	filters;
+	closeOnEose;
+	#handlers;
+	#onLocalClose;
+	#abortDispose;
+	#eoseTimer;
+	#closed = false;
+	#eosed = false;
+	/** True after one CLOSED `auth-required:` retry. */
+	#authRetried = false;
+	/** Inclusive NIP-01 `since` watermark from verified EVENTs. */
+	#lastCreatedAt;
+	/** Event ids at `lastCreatedAt` (same-second reconnect dedup). Not all seen ids. */
+	#idsAtWatermark = /* @__PURE__ */ new Set();
+	constructor(filters, opts, onLocalClose) {
+		this.#onLocalClose = onLocalClose;
+		this.id = createSubscriptionId(opts.id);
+		this.filters = filters;
+		this.closeOnEose = opts.closeOnEose === true;
+		this.#handlers = {
+			onevent: opts.onevent,
+			oneose: opts.oneose,
+			onclose: opts.onclose,
+			alreadyHaveEvent: opts.alreadyHaveEvent,
+			receivedEvent: opts.receivedEvent
+		};
+		if (opts.eoseTimeoutMs !== void 0) this.#eoseTimer = setTimeout(() => {
+			this.#eoseTimer = void 0;
+			this.markEose();
+		}, opts.eoseTimeoutMs);
+		if (opts.signal) {
+			if (opts.signal.aborted) this.close("aborted");
+			else this.#abortDispose = onAbort(opts.signal, () => this.close("aborted"));
+		}
+	}
+	get closed() {
+		return this.#closed;
+	}
+	get eosed() {
+		return this.#eosed;
+	}
+	get lastCreatedAt() {
+		return this.#lastCreatedAt;
+	}
+	get idsAtWatermark() {
+		return this.#idsAtWatermark;
+	}
+	/**
+	* Local close: idempotent; clears the EOSE timer and abort listener, detaches via `onLocalClose`
+	* (sends CLOSE / leaves the live group), then fires `onclose`.
+	*/
+	close(reason = "closed by client") {
+		if (this.#closed) return;
+		this.#closed = true;
+		this.#teardown();
+		this.#onLocalClose(this);
+		invokeSafely(() => this.#handlers.onclose?.(reason));
+	}
+	/** Remote/transport termination: like {@link close} but `onLocalClose` is not called. */
+	end(reason) {
+		if (this.#closed) return;
+		this.#closed = true;
+		this.#teardown();
+		invokeSafely(() => this.#handlers.onclose?.(reason));
+	}
+	#teardown() {
+		if (this.#eoseTimer !== void 0) {
+			clearTimeout(this.#eoseTimer);
+			this.#eoseTimer = void 0;
+		}
+		this.#abortDispose?.();
+		this.#abortDispose = void 0;
+	}
+	/** Mark EOSE: fires `oneose`, then closes when `closeOnEose`. No-op when closed or EOSE'd. */
+	markEose() {
+		if (this.#closed || this.#eosed) return;
+		this.#eosed = true;
+		if (this.#eoseTimer !== void 0) {
+			clearTimeout(this.#eoseTimer);
+			this.#eoseTimer = void 0;
+		}
+		invokeSafely(() => this.#handlers.oneose?.());
+		if (this.closeOnEose) this.close("eose");
+	}
+	/** Clear `eosed` for a replayed REQ (AUTH retry / reconnect). */
+	rearm() {
+		this.#eosed = false;
+	}
+	/** First `auth-required:` retry wins; later calls report false without side effects. */
+	beginAuthRetry() {
+		if (this.#authRetried) return false;
+		this.#authRetried = true;
+		return true;
+	}
+	resetAuthRetry() {
+		this.#authRetried = false;
+	}
+	/** `receivedEvent` for every EVENT id, before watermark/alreadyHaveEvent/verify. */
+	notifyReceived(id) {
+		invokeSafely(() => this.#handlers.receivedEvent?.(id));
+	}
+	alreadyHas(id) {
+		let have = false;
+		invokeSafely(() => {
+			have = Boolean(this.#handlers.alreadyHaveEvent?.(id));
+		});
+		return have;
+	}
+	isAtWatermark(id) {
+		return this.#idsAtWatermark.has(id);
+	}
+	/** Verified event: advance the watermark, then fire `onevent`. */
+	deliver(event) {
+		this.noteVerified(event);
+		invokeSafely(() => this.#handlers.onevent?.(event));
+	}
+	/** Advance the reconnect watermark after a verified EVENT. */
+	noteVerified(event) {
+		if (this.#lastCreatedAt === void 0 || event.created_at > this.#lastCreatedAt) {
+			this.#lastCreatedAt = event.created_at;
+			this.#idsAtWatermark.clear();
+			this.#idsAtWatermark.add(event.id);
+			return;
+		}
+		if (event.created_at === this.#lastCreatedAt) this.#idsAtWatermark.add(event.id);
+	}
+	/**
+	* Filters for re-REQ. Original `filters` stay unchanged. NIP-01 `since` is inclusive — never
+	* `lastCreatedAt + 1`.
+	*/
+	replayFilters() {
+		const since = this.#lastCreatedAt;
+		if (since === void 0) return [...this.filters];
+		return this.filters.map((f) => ({
+			...f,
+			since: f.since === void 0 ? since : Math.max(f.since, since)
+		}));
+	}
+};
+/** AsyncIterable wrapper over a subscription's events until EOSE or close. */
+function subscriptionToAsyncIterable(start, opts) {
+	const queue = [];
+	let head = 0;
+	let done = false;
+	let error;
+	let wake;
+	let closer;
+	let localClose = false;
+	let disposeAbort;
+	const notify = () => {
+		wake?.();
+		wake = void 0;
+	};
+	const waitForWake = async () => new Promise((resolve) => {
+		wake = resolve;
+	});
+	const closeLocal = (reason) => {
+		localClose = true;
+		disposeAbort?.();
+		closer?.close(reason);
+		done = true;
+		notify();
+	};
+	closer = start({
+		onevent(event) {
+			queue.push(event);
+			notify();
+		},
+		oneose() {
+			if (opts?.includeEose === false) closeLocal("eose");
+		},
+		onclose(reason) {
+			if (opts?.signal?.aborted === true) localClose = true;
+			if (!localClose && reason) error = new RelayClosedError(reason);
+			done = true;
+			notify();
+		}
+	});
+	if (opts?.signal) {
+		if (opts.signal.aborted) closeLocal("aborted");
+		else {
+			disposeAbort = onAbort(opts.signal, () => closeLocal("aborted"));
+			if (done) disposeAbort();
+		}
+	}
+	return {
+		close(reason) {
+			closeLocal(reason ?? "closed by client");
+		},
+		[Symbol.asyncIterator]() {
+			return {
+				async next() {
+					while (true) {
+						const value = head < queue.length ? queue[head] : void 0;
+						if (value !== void 0) {
+							head += 1;
+							if (head === queue.length) {
+								queue.length = 0;
+								head = 0;
+							}
+							return {
+								value,
+								done: false
+							};
+						}
+						if (error !== void 0) throw error;
+						if (done) return {
+							value: void 0,
+							done: true
+						};
+						await waitForWake();
+					}
+				},
+				async return() {
+					closeLocal("iterator returned");
+					return {
+						value: void 0,
+						done: true
+					};
+				}
+			};
+		}
+	};
+}
+//#endregion
+//#region src/relay/fetch.ts
+function streamFilters(subscribe, filters, opts) {
+	return subscriptionToAsyncIterable((handlers) => subscribe(filters, {
+		...handlers,
+		id: opts?.id,
+		signal: opts?.signal
+	}), { signal: opts?.signal });
+}
+async function fetchFilters(subscribe, filters, opts) {
+	throwIfAborted(opts.signal);
+	const events = [];
+	const seen = /* @__PURE__ */ new Set();
+	let end = { type: "timeout" };
+	await new Promise((resolve, reject) => {
+		let settled = false;
+		const done = (err) => {
+			if (settled) return;
+			settled = true;
+			disposeAbort();
+			clearTimeout(timer);
+			let reason = "aborted";
+			if (err instanceof Error) reason = err.message;
+			else if (err === void 0) reason = "fetch complete";
+			sub.close(reason);
+			if (err === void 0) resolve();
+			else reject(err);
+		};
+		const disposeAbort = onAbort(opts.signal, () => {
+			if (opts.signal !== void 0) done(abortReason(opts.signal));
+		});
+		const timer = setTimeout(() => {
+			end = { type: "timeout" };
+			done();
+		}, opts.timeoutMs);
+		const sub = subscribe(filters, {
+			id: opts.id,
+			signal: opts.signal,
+			closeOnEose: true,
+			onevent(event) {
+				if (seen.has(event.id)) return;
+				seen.add(event.id);
+				events.push(event);
+			},
+			oneose() {
+				end = { type: "eose" };
+				done();
+			},
+			onclose(reason) {
+				if (settled) return;
+				if (opts.signal?.aborted === true) {
+					done(abortReason(opts.signal));
+					return;
+				}
+				end = {
+					type: "closed",
+					reason
+				};
+				done();
+			}
+		});
+	});
+	return {
+		events,
+		end
+	};
+}
+//#endregion
 //#region src/relay/neg-session.ts
 function createNegSession() {
 	return {
@@ -88,6 +596,21 @@ function failNegSession(session, err) {
 function failNegErr(session, reason) {
 	failNegSession(session, new Nip77Error(reason));
 }
+/** Route a NEG-MSG/NEG-ERR frame to its session; unknown ids are ignored. */
+function dispatchNegMessage(sessions, msg) {
+	const session = sessions.get(msg[1]);
+	if (session === void 0) return;
+	if (msg[0] === "NEG-MSG") {
+		pushNegMsg(session, msg[2]);
+		return;
+	}
+	failNegErr(session, msg[2]);
+}
+/** Fail every tracked session (socket teardown). */
+function failAllNegSessions(sessions, err) {
+	for (const session of sessions.values()) failNegSession(session, err);
+	sessions.clear();
+}
 /** Wire queue/timeout/abort around `runNegSession`. Not a second session class. */
 async function runWiredNegSession(opts) {
 	const { session, storage, filter, id, timeoutMs, signal, send, url } = opts;
@@ -144,6 +667,175 @@ async function runWiredNegSession(opts) {
 		next
 	});
 }
+/**
+* Drive a NIP-77 reconcile session against the session map: fail a same-id predecessor, register,
+* wire queue/timeout/abort, and send NEG-CLOSE on exit.
+*/
+async function runTrackedNegSession(opts) {
+	const { sessions, id, send } = opts;
+	const prev = sessions.get(id);
+	if (prev) failNegSession(prev, new Nip77Error("closed: replaced by new NEG-OPEN"));
+	const session = createNegSession();
+	sessions.set(id, session);
+	try {
+		return await runWiredNegSession({
+			session,
+			storage: opts.storage,
+			filter: opts.filter,
+			id,
+			timeoutMs: opts.timeoutMs,
+			signal: opts.signal,
+			send,
+			url: opts.url
+		});
+	} finally {
+		if (sessions.get(id) === session) {
+			sessions.delete(id);
+			try {
+				send(["NEG-CLOSE", id]);
+			} catch {}
+		}
+	}
+}
+//#endregion
+//#region src/relay/ok-tracker.ts
+var OkTracker = class {
+	#entries = /* @__PURE__ */ new Map();
+	get size() {
+		return this.#entries.size;
+	}
+	get(eventId) {
+		return this.#entries.get(eventId);
+	}
+	/** Joiner's view: only publish waiters (carrying an `event`) are joinable. */
+	inFlight(eventId) {
+		const waiter = this.#entries.get(eventId);
+		return waiter?.event === void 0 ? void 0 : waiter.promise;
+	}
+	/**
+	* Register a waiter, arm its timeout and call `send`. A send throw removes the entry and rejects
+	* (`sendError` when the throw is not an Error). The timer only rejects while this waiter still
+	* owns the id.
+	*/
+	async track(eventId, opts) {
+		const promise = new Promise((resolve, reject) => {
+			const waiter = {
+				id: eventId,
+				resolve,
+				reject,
+				timer: setTimeout(() => {
+					if (this.#entries.get(eventId) === waiter) {
+						this.#entries.delete(eventId);
+						reject(opts.timeoutError());
+					}
+				}, opts.timeoutMs),
+				event: opts.event,
+				authRetried: false,
+				timeoutMs: opts.timeoutMs,
+				timeoutError: opts.timeoutError,
+				get promise() {
+					return promise;
+				}
+			};
+			this.#entries.set(eventId, waiter);
+			try {
+				opts.send();
+			} catch (error) {
+				this.#finish(waiter);
+				reject(error instanceof Error ? error : opts.sendError());
+			}
+		});
+		return promise;
+	}
+	/**
+	* An OK reply arrived: `retry` is the caller's auth-required policy — a kept waiter is returned
+	* unsettled for the retry path; otherwise the entry is settled and undefined is returned.
+	*/
+	handleOk(eventId, ok, message, retry) {
+		const waiter = this.#entries.get(eventId);
+		if (waiter === void 0) return;
+		if (!retry(waiter)) {
+			this.settle(waiter, {
+				ok,
+				message
+			});
+			return;
+		}
+		return waiter;
+	}
+	/** Settle a waiter: stop its timer, drop the entry it still owns, then resolve. */
+	settle(waiter, result) {
+		this.#finish(waiter);
+		waiter.resolve(result);
+	}
+	/** Stop a waiter's timeout without settling (AUTH retry window). */
+	clearTimer(waiter) {
+		if (waiter.timer !== void 0) {
+			clearTimeout(waiter.timer);
+			waiter.timer = void 0;
+		}
+	}
+	/** Re-arm the timeout for a re-sent frame (after an AUTH retry). */
+	restartTimer(eventId) {
+		const waiter = this.#entries.get(eventId);
+		if (waiter === void 0) return;
+		waiter.timer = setTimeout(() => {
+			if (this.#entries.get(eventId) === waiter) {
+				this.#entries.delete(eventId);
+				waiter.reject(waiter.timeoutError());
+			}
+		}, waiter.timeoutMs);
+	}
+	/**
+	* Re-send a tracked EVENT after the relay demanded AUTH: pause the timeout through the AUTH
+	* window, re-arm it and re-send on success, settle `{ok:false,message}` on failure. AUTH waiters
+	* (no `event`) settle immediately.
+	*/
+	async authRetry(waiter, message, deps) {
+		this.clearTimer(waiter);
+		const finish = (result) => {
+			this.settle(waiter, result);
+		};
+		try {
+			const { event } = waiter;
+			if (event === void 0) {
+				finish({
+					ok: false,
+					message
+				});
+				return;
+			}
+			const ok = await deps.ensureAuthed();
+			if (this.#entries.get(waiter.id) !== waiter) return;
+			if (!ok || !deps.isOpen()) {
+				finish({
+					ok: false,
+					message
+				});
+				return;
+			}
+			this.restartTimer(waiter.id);
+			deps.send(event);
+		} catch {
+			if (this.#entries.get(waiter.id) === void 0) return;
+			finish({
+				ok: false,
+				message
+			});
+		}
+	}
+	rejectAll(err) {
+		for (const waiter of this.#entries.values()) {
+			this.clearTimer(waiter);
+			waiter.reject(err);
+		}
+		this.#entries.clear();
+	}
+	#finish(waiter) {
+		this.clearTimer(waiter);
+		if (this.#entries.get(waiter.id) === waiter) this.#entries.delete(waiter.id);
+	}
+};
 const PING_DUMMY_FILTER = {
 	ids: ["a".repeat(64)],
 	limit: 0
@@ -266,458 +958,252 @@ var PingLoop = class {
 	}
 };
 //#endregion
-//#region src/relay/subscription.ts
-var Subscription = class {
-	id;
-	filters;
-	handlers;
-	closeOnEose;
-	eosed = false;
-	closed = false;
-	/** True after one CLOSED `auth-required:` retry. */
-	authRetried = false;
-	/** Inclusive NIP-01 `since` watermark from verified EVENTs. */
-	lastCreatedAt;
-	/** Event ids at `lastCreatedAt` (same-second reconnect dedup). Not all seen ids. */
-	idsAtWatermark = /* @__PURE__ */ new Set();
-	#sendClose;
-	#abort;
-	constructor(filters, opts, sendClose) {
-		this.#sendClose = sendClose;
-		this.id = createSubscriptionId(opts.id);
-		this.filters = filters;
-		this.closeOnEose = opts.closeOnEose === true;
-		this.handlers = {
-			onevent: opts.onevent,
-			oneose: opts.oneose,
-			onclose: opts.onclose,
-			alreadyHaveEvent: opts.alreadyHaveEvent,
-			receivedEvent: opts.receivedEvent
-		};
-		if (opts.signal) {
-			if (opts.signal.aborted) this.close("aborted");
-			else this.#abort = onAbort(opts.signal, () => this.close("aborted"));
-		}
+//#region src/relay/subscription-registry.ts
+/**
+* Owns every open REQ of a relay: exclusive subscriptions keyed by id, and live coalescing groups
+* (one wire REQ plus per-subscriber handles) keyed by fingerprint and wire id.
+*/
+var SubscriptionRegistry = class {
+	#subs = /* @__PURE__ */ new Map();
+	#liveByFp = /* @__PURE__ */ new Map();
+	#liveBySubId = /* @__PURE__ */ new Map();
+	#isOpen;
+	#enableReconnect;
+	#send;
+	#scheduleReconnect;
+	#acceptEvent;
+	constructor(deps) {
+		this.#isOpen = deps.isOpen;
+		this.#enableReconnect = deps.enableReconnect;
+		this.#send = deps.send;
+		this.#scheduleReconnect = deps.scheduleReconnect;
+		this.#acceptEvent = deps.acceptEvent;
 	}
-	/** Drop the signal listener. Terminal paths that mark `closed` without `close()` run this too. */
-	dispose() {
-		this.#abort?.();
+	/** User subscriptions only; dummy ping REQs are not counted. */
+	get size() {
+		return this.#subs.size;
 	}
-	close(reason = "closed by client") {
-		if (this.closed) return;
-		this.closed = true;
-		this.dispose();
-		this.#sendClose(this.id);
-		invokeSafely(() => this.handlers.onclose?.(reason));
+	get(subId) {
+		return this.#subs.get(subId);
 	}
-	/** Advance the reconnect watermark after a verified EVENT. */
-	noteVerified(event) {
-		if (this.lastCreatedAt === void 0 || event.created_at > this.lastCreatedAt) {
-			this.lastCreatedAt = event.created_at;
-			this.idsAtWatermark.clear();
-			this.idsAtWatermark.add(event.id);
+	/** Exclusive one-shot REQ when `closeOnEose`, live coalescing otherwise. */
+	open(filters, opts) {
+		if (opts.closeOnEose === true) return this.#openExclusive(filters, opts);
+		return this.#openLive(filters, opts);
+	}
+	handleEvent(subId, event) {
+		const sub = this.#subs.get(subId);
+		if (!sub || sub.closed) return;
+		const group = this.#liveBySubId.get(subId);
+		if (group) {
+			this.#deliverLiveEvent(group, event);
 			return;
 		}
-		if (event.created_at === this.lastCreatedAt) this.idsAtWatermark.add(event.id);
-	}
-	/**
-	* Filters for re-REQ. Original `filters` stay unchanged. NIP-01 `since` is inclusive — never
-	* `lastCreatedAt + 1`.
-	*/
-	replayFilters() {
-		const since = this.lastCreatedAt;
-		if (since === void 0) return this.filters;
-		return this.filters.map((f) => ({
-			...f,
-			since: f.since === void 0 ? since : Math.max(f.since, since)
-		}));
-	}
-};
-/** AsyncIterable wrapper over a subscription's events until EOSE or close. */
-function subscriptionToAsyncIterable(start, opts) {
-	const queue = [];
-	let done = false;
-	let error;
-	let wake;
-	let closer;
-	let localClose = false;
-	let disposeAbort;
-	const notify = () => {
-		wake?.();
-		wake = void 0;
-	};
-	const waitForWake = async () => new Promise((resolve) => {
-		wake = resolve;
-	});
-	const closeLocal = (reason) => {
-		localClose = true;
-		disposeAbort?.();
-		closer?.close(reason);
-		done = true;
-		notify();
-	};
-	closer = start({
-		onevent(event) {
-			queue.push(event);
-			notify();
-		},
-		oneose() {
-			if (opts?.includeEose === false) closeLocal("eose");
-		},
-		onclose(reason) {
-			if (opts?.signal?.aborted === true) localClose = true;
-			if (!localClose && reason) error = new RelayClosedError(reason);
-			done = true;
-			notify();
+		sub.notifyReceived(event.id);
+		if (sub.isAtWatermark(event.id)) return;
+		if (sub.alreadyHas(event.id)) return;
+		if (!this.#acceptEvent(event)) return;
+		sub.deliver(event);
+	}
+	handleEose(subId) {
+		const sub = this.#subs.get(subId);
+		if (!sub || sub.closed || sub.eosed) return;
+		const group = this.#liveBySubId.get(subId);
+		if (group) {
+			sub.markEose();
+			this.#deliverLiveEose(group);
+			return;
 		}
-	});
-	if (opts?.signal) {
-		if (opts.signal.aborted) closeLocal("aborted");
-		else {
-			disposeAbort = onAbort(opts.signal, () => closeLocal("aborted"));
-			if (done) disposeAbort();
+		sub.markEose();
+	}
+	/** Remote/transport termination of a REQ (CLOSED, auth-retry failure). */
+	drop(sub, reason) {
+		const group = this.#liveBySubId.get(sub.id);
+		if (group) {
+			this.#endLiveGroup(group, {
+				sendClose: false,
+				reason
+			});
+			return;
 		}
+		this.#subs.delete(sub.id);
+		sub.end(reason);
 	}
-	return {
-		close(reason) {
-			closeLocal(reason ?? "closed by client");
-		},
-		[Symbol.asyncIterator]() {
-			return {
-				async next() {
-					while (true) {
-						const value = queue.shift();
-						if (value !== void 0) return {
-							value,
-							done: false
-						};
-						if (error !== void 0) throw error;
-						if (done) return {
-							value: void 0,
-							done: true
-						};
-						await waitForWake();
-					}
-				},
-				async return() {
-					closeLocal("iterator returned");
-					return {
-						value: void 0,
-						done: true
-					};
-				}
-			};
-		}
-	};
-}
-//#endregion
-//#region src/relay/subscribe.ts
-/** REQ subscription runtime: exclusive one-shot, live coalescing, dispatch, reconnect replay. */
-function openExclusive(ctx, filters, opts) {
-	const sub = new Subscription(filters, opts, (id) => {
-		ctx.subs.delete(id);
+	/**
+	* Re-REQ after the relay demanded AUTH: drop the subscription when auth fails or the
+	* socket/subscription died during the AUTH window, replay the REQ on success.
+	*/
+	async authRetry(sub, reason, ensureAuthed) {
 		try {
-			if (ctx.connected()) ctx.send(["CLOSE", id]);
-		} catch {}
-	});
-	ctx.subs.set(sub.id, sub);
-	if (ctx.connected()) ctx.send([
-		"REQ",
-		sub.id,
-		...filters
-	]);
-	else if (ctx.enableReconnect()) ctx.scheduleReconnect();
-	if (opts.eoseTimeoutMs !== void 0) ctx.armEoseTimeout(sub, opts.eoseTimeoutMs);
-	return sub;
-}
-function subscribeLive(ctx, filters, opts) {
-	const fp = filterFingerprint(filters);
-	let group = ctx.liveByFp.get(fp);
-	if (group?.sub.eosed === true) group = void 0;
-	let created = false;
-	if (!group) {
-		created = true;
-		const slot = { group: void 0 };
-		const wire = new Subscription(filters, { id: opts.id }, () => {
-			const g = slot.group;
-			if (g) endLiveGroup(ctx, g, {
-				sendClose: true,
-				reason: "closed by client"
-			});
-		});
-		group = {
-			fp,
-			sub: wire,
-			attachments: /* @__PURE__ */ new Set()
-		};
-		slot.group = group;
-		ctx.liveByFp.set(fp, group);
-		ctx.liveBySubId.set(wire.id, group);
-		ctx.subs.set(wire.id, wire);
-	}
-	const slot = { handle: void 0 };
-	const attached = group;
-	const handle = new Subscription(filters, {
-		...opts,
-		id: group.sub.id
-	}, () => {
-		const current = slot.handle;
-		if (!current) return;
-		detachLive(ctx, attached, current);
-	});
-	slot.handle = handle;
-	if (handle.closed) {
-		if (created && group.attachments.size === 0) forgetLiveGroup(ctx, group);
-		return handle;
+			if (!await ensureAuthed() || sub.closed || !this.#isOpen()) {
+				this.drop(sub, reason);
+				return;
+			}
+			this.replay(sub);
+		} catch {
+			this.drop(sub, reason);
+		}
 	}
-	group.attachments.add(handle);
-	if (created) {
-		if (ctx.connected()) ctx.send([
+	/** Re-REQ after AUTH: rearm the wire and its handles, then send the replayed filters. */
+	replay(sub) {
+		sub.rearm();
+		const group = this.#liveBySubId.get(sub.id);
+		if (group) for (const att of group.attachments) att.rearm();
+		this.#send([
 			"REQ",
-			group.sub.id,
-			...filters
+			sub.id,
+			...sub.replayFilters()
 		]);
-		else if (ctx.enableReconnect()) ctx.scheduleReconnect();
-	}
-	if (opts.eoseTimeoutMs !== void 0) ctx.armEoseTimeout(handle, opts.eoseTimeoutMs);
-	return handle;
-}
-function forgetLiveGroup(ctx, group) {
-	if (ctx.liveByFp.get(group.fp) === group) ctx.liveByFp.delete(group.fp);
-	ctx.liveBySubId.delete(group.sub.id);
-	ctx.subs.delete(group.sub.id);
-	group.sub.closed = true;
-	group.sub.dispose();
-}
-function detachLive(ctx, group, handle) {
-	if (!group.attachments.delete(handle)) return;
-	if (group.attachments.size > 0) return;
-	endLiveGroup(ctx, group, {
-		sendClose: true,
-		reason: "closed by client"
-	});
-}
-function endLiveGroup(ctx, group, opts) {
-	const { id } = group.sub;
-	const remaining = [...group.attachments];
-	group.attachments.clear();
-	forgetLiveGroup(ctx, group);
-	if (opts.sendClose) try {
-		if (ctx.connected()) ctx.send(["CLOSE", id]);
-	} catch {}
-	for (const att of remaining) invokeSafely(() => {
-		att.close(opts.reason);
-	});
-}
-function deliverLiveEvent(ctx, group, event) {
-	const { sub } = group;
-	const attachments = [...group.attachments];
-	for (const att of attachments) invokeSafely(() => {
-		att.handlers.receivedEvent?.(event.id);
-	});
-	if (sub.idsAtWatermark.has(event.id)) return;
-	const recipients = [];
-	for (const att of attachments) {
-		if (att.closed) continue;
-		let skip = false;
-		invokeSafely(() => {
-			skip = Boolean(att.handlers.alreadyHaveEvent?.(event.id));
-		});
-		if (!skip) recipients.push(att);
-	}
-	if (recipients.length === 0) return;
-	if (!ctx.acceptEvent(event)) return;
-	sub.noteVerified(event);
-	for (const att of recipients) att.noteVerified(event);
-	for (const att of recipients) invokeSafely(() => {
-		att.handlers.onevent?.(event);
-	});
-}
-function deliverLiveEose(group) {
-	const attachments = [...group.attachments];
-	for (const att of attachments) {
-		if (att.closed || att.eosed) continue;
-		att.eosed = true;
-		invokeSafely(() => {
-			att.handlers.oneose?.();
-		});
-	}
-}
-function closeAllSubscriptions(ctx, reason) {
-	const groups = [...ctx.liveBySubId.values()];
-	for (const group of groups) invokeSafely(() => {
-		endLiveGroup(ctx, group, {
-			sendClose: false,
-			reason
-		});
-	});
-	for (const sub of ctx.subs.values()) if (!sub.closed) {
-		sub.closed = true;
-		sub.dispose();
-		invokeSafely(() => {
-			sub.handlers.onclose?.(reason);
-		});
-	}
-	ctx.subs.clear();
-	ctx.liveByFp.clear();
-	ctx.liveBySubId.clear();
-}
-function dropSubscription(ctx, sub, reason) {
-	const group = ctx.liveBySubId.get(sub.id);
-	if (group) {
-		endLiveGroup(ctx, group, {
-			sendClose: false,
-			reason
-		});
-		return;
-	}
-	ctx.subs.delete(sub.id);
-	sub.closed = true;
-	sub.dispose();
-	invokeSafely(() => {
-		sub.handlers.onclose?.(reason);
-	});
-}
-function onSubEvent(ctx, subId, event) {
-	const sub = ctx.subs.get(subId);
-	if (!sub || sub.closed) return;
-	const group = ctx.liveBySubId.get(subId);
-	if (group) {
-		deliverLiveEvent(ctx, group, event);
-		return;
-	}
-	invokeSafely(() => {
-		sub.handlers.receivedEvent?.(event.id);
-	});
-	if (sub.idsAtWatermark.has(event.id)) return;
-	let have = false;
-	invokeSafely(() => {
-		have = Boolean(sub.handlers.alreadyHaveEvent?.(event.id));
-	});
-	if (have) return;
-	if (!ctx.acceptEvent(event)) return;
-	sub.noteVerified(event);
-	invokeSafely(() => {
-		sub.handlers.onevent?.(event);
-	});
-}
-function onSubEose(ctx, subId) {
-	const sub = ctx.subs.get(subId);
-	if (!sub || sub.closed) return;
-	if (sub.eosed) return;
-	sub.eosed = true;
-	const group = ctx.liveBySubId.get(subId);
-	if (group) deliverLiveEose(group);
-	else {
-		invokeSafely(() => {
-			sub.handlers.oneose?.();
-		});
-		if (sub.closeOnEose) sub.close("eose");
 	}
-}
-function resubscribeAll(ctx) {
-	for (const sub of ctx.subs.values()) {
-		if (sub.closed) continue;
-		sub.eosed = false;
-		sub.authRetried = false;
-		const group = ctx.liveBySubId.get(sub.id);
-		if (group) for (const att of group.attachments) att.eosed = false;
-		try {
-			ctx.send([
-				"REQ",
-				sub.id,
-				...sub.replayFilters()
-			]);
-		} catch {
-			return false;
+	/** Reconnect path: rearm every open REQ and re-send; false on send failure. */
+	replayAll() {
+		for (const sub of this.#subs.values()) {
+			if (sub.closed) continue;
+			sub.rearm();
+			sub.resetAuthRetry();
+			const group = this.#liveBySubId.get(sub.id);
+			if (group) for (const att of group.attachments) {
+				att.rearm();
+				att.resetAuthRetry();
+			}
+			try {
+				this.#send([
+					"REQ",
+					sub.id,
+					...sub.replayFilters()
+				]);
+			} catch {
+				return false;
+			}
 		}
+		return true;
 	}
-	return true;
-}
-function streamFilters(subscribe, filters, opts) {
-	return subscriptionToAsyncIterable((handlers) => subscribe(filters, {
-		...handlers,
-		id: opts?.id,
-		signal: opts?.signal
-	}), { signal: opts?.signal });
-}
-async function fetchFilters(subscribe, filters, opts) {
-	throwIfAborted(opts.signal);
-	const events = [];
-	const seen = /* @__PURE__ */ new Set();
-	let end = { type: "timeout" };
-	await new Promise((resolve, reject) => {
-		let settled = false;
-		const done = (err) => {
-			if (settled) return;
-			settled = true;
-			disposeAbort();
-			clearTimeout(timer);
-			let reason = "aborted";
-			if (err instanceof Error) reason = err.message;
-			else if (err === void 0) reason = "fetch complete";
-			sub.close(reason);
-			if (err === void 0) resolve();
-			else reject(err);
-		};
-		const disposeAbort = onAbort(opts.signal, () => {
-			if (opts.signal !== void 0) done(abortReason(opts.signal));
+	closeAll(reason) {
+		const groups = [...this.#liveBySubId.values()];
+		for (const group of groups) invokeSafely(() => {
+			this.#endLiveGroup(group, {
+				sendClose: false,
+				reason
+			});
 		});
-		const timer = setTimeout(() => {
-			end = { type: "timeout" };
-			done();
-		}, opts.timeoutMs);
-		const sub = subscribe(filters, {
-			id: opts.id,
-			signal: opts.signal,
-			closeOnEose: true,
-			onevent(event) {
-				if (seen.has(event.id)) return;
-				seen.add(event.id);
-				events.push(event);
-			},
-			oneose() {
-				end = { type: "eose" };
-				done();
-			},
-			onclose(reason) {
-				if (settled) return;
-				if (opts.signal?.aborted === true) {
-					done(abortReason(opts.signal));
-					return;
-				}
-				end = {
-					type: "closed",
-					reason
-				};
-				done();
-			}
+		for (const sub of this.#subs.values()) sub.end(reason);
+		this.#subs.clear();
+		this.#liveByFp.clear();
+		this.#liveBySubId.clear();
+	}
+	#openExclusive(filters, opts) {
+		const sub = new Subscription(filters, opts, (closed) => {
+			this.#subs.delete(closed.id);
+			try {
+				if (this.#isOpen()) this.#send(["CLOSE", closed.id]);
+			} catch {}
+		});
+		this.#subs.set(sub.id, sub);
+		if (this.#isOpen()) this.#send([
+			"REQ",
+			sub.id,
+			...filters
+		]);
+		else if (this.#enableReconnect) this.#scheduleReconnect();
+		return sub;
+	}
+	#openLive(filters, opts) {
+		const fp = filterFingerprint(filters);
+		let group = this.#liveByFp.get(fp);
+		if (group?.sub.eosed === true) group = void 0;
+		let created = false;
+		if (!group) {
+			created = true;
+			const slot = { group: void 0 };
+			const wire = new Subscription(filters, { id: opts.id }, () => {
+				const g = slot.group;
+				if (g) this.#endLiveGroup(g, {
+					sendClose: true,
+					reason: "closed by client"
+				});
+			});
+			group = {
+				fp,
+				sub: wire,
+				attachments: /* @__PURE__ */ new Set()
+			};
+			slot.group = group;
+			this.#liveByFp.set(fp, group);
+			this.#liveBySubId.set(wire.id, group);
+			this.#subs.set(wire.id, wire);
+		}
+		const slot = { handle: void 0 };
+		const attached = group;
+		const handle = new Subscription(filters, {
+			...opts,
+			id: group.sub.id
+		}, () => {
+			const current = slot.handle;
+			if (!current) return;
+			this.#detachLive(attached, current);
 		});
-	});
-	return {
-		events,
-		end
-	};
-}
-function armEoseTimeout(sub, eoseTimeoutMs) {
-	const timer = setTimeout(() => {
-		if (sub.eosed || sub.closed) return;
-		sub.eosed = true;
-		invokeSafely(() => {
-			sub.handlers.oneose?.();
+		slot.handle = handle;
+		if (handle.closed) {
+			if (created && group.attachments.size === 0) this.#forgetLiveGroup(group, "closed by client");
+			return handle;
+		}
+		group.attachments.add(handle);
+		if (created) {
+			if (this.#isOpen()) this.#send([
+				"REQ",
+				group.sub.id,
+				...filters
+			]);
+			else if (this.#enableReconnect) this.#scheduleReconnect();
+		}
+		return handle;
+	}
+	#forgetLiveGroup(group, reason) {
+		if (this.#liveByFp.get(group.fp) === group) this.#liveByFp.delete(group.fp);
+		this.#liveBySubId.delete(group.sub.id);
+		this.#subs.delete(group.sub.id);
+		group.sub.end(reason);
+	}
+	#detachLive(group, handle) {
+		if (!group.attachments.delete(handle)) return;
+		if (group.attachments.size > 0) return;
+		this.#endLiveGroup(group, {
+			sendClose: true,
+			reason: "closed by client"
 		});
-	}, eoseTimeoutMs);
-	const prevClose = sub.handlers.onclose;
-	sub.handlers.onclose = (reason) => {
-		clearTimeout(timer);
-		prevClose?.(reason);
-	};
-	const prevEose = sub.handlers.oneose;
-	sub.handlers.oneose = () => {
-		clearTimeout(timer);
-		prevEose?.();
-	};
-}
+	}
+	#endLiveGroup(group, opts) {
+		const { id } = group.sub;
+		const remaining = [...group.attachments];
+		group.attachments.clear();
+		this.#forgetLiveGroup(group, opts.reason);
+		if (opts.sendClose) try {
+			if (this.#isOpen()) this.#send(["CLOSE", id]);
+		} catch {}
+		for (const att of remaining) invokeSafely(() => {
+			att.close(opts.reason);
+		});
+	}
+	#deliverLiveEvent(group, event) {
+		const { sub } = group;
+		const attachments = [...group.attachments];
+		for (const att of attachments) att.notifyReceived(event.id);
+		if (sub.isAtWatermark(event.id)) return;
+		const recipients = [];
+		for (const att of attachments) {
+			if (att.closed) continue;
+			if (!att.alreadyHas(event.id)) recipients.push(att);
+		}
+		if (recipients.length === 0) return;
+		if (!this.#acceptEvent(event)) return;
+		sub.noteVerified(event);
+		for (const att of recipients) att.deliver(event);
+	}
+	#deliverLiveEose(group) {
+		const attachments = [...group.attachments];
+		for (const att of attachments) att.markEose();
+	}
+};
 //#endregion
 //#region src/relay/relay.ts
 /**
@@ -762,12 +1248,11 @@ var Relay = class Relay {
 	#connectFinish;
 	#connectTimer;
 	#socketHandlers;
-	#subs = /* @__PURE__ */ new Map();
-	#liveByFp = /* @__PURE__ */ new Map();
-	#liveBySubId = /* @__PURE__ */ new Map();
-	#live;
-	#publishes = /* @__PURE__ */ new Map();
-	#counts = /* @__PURE__ */ new Map();
+	#subscriptions;
+	#ok = new OkTracker();
+	#countRequests = new CountTracker();
+	#authState;
+	#ensureAuthed;
 	#neg = /* @__PURE__ */ new Map();
 	#WS;
 	#verify;
@@ -777,13 +1262,6 @@ var Relay = class Relay {
 	#enableReconnect;
 	#backoff;
 	#serial = 0;
-	#challenge;
-	#authedChallenge;
-	/** Challenge value already answered on this connection; duplicates are not re-signed. */
-	#answeredChallenge;
-	/** Settled OK verdict for `#answeredChallenge`; set only once the relay replies. */
-	#answeredResult;
-	#authPromise;
 	#authSigner;
 	/** `close()`/`disconnect()` was called; cleared by the next `connect()`. */
 	#manualStop = false;
@@ -791,13 +1269,7 @@ var Relay = class Relay {
 	#reconnectTimer;
 	#enablePing;
 	#ping;
-	#listeners = {
-		notice: /* @__PURE__ */ new Set(),
-		close: /* @__PURE__ */ new Set(),
-		auth: /* @__PURE__ */ new Set(),
-		reconnect: /* @__PURE__ */ new Set(),
-		invalidevent: /* @__PURE__ */ new Set()
-	};
+	#events = new Emitter();
 	constructor(url, opts = {}) {
 		this.url = normalizeURL(url);
 		this.#WS = opts.websocketImplementation ?? getWebSocketImplementation();
@@ -821,21 +1293,29 @@ var Relay = class Relay {
 			pingIntervalMs: opts.pingIntervalMs ?? 29e3,
 			pingTimeoutMs: opts.pingTimeoutMs ?? 2e4
 		});
-		this.#live = {
-			liveByFp: this.#liveByFp,
-			liveBySubId: this.#liveBySubId,
-			subs: this.#subs,
-			connected: () => this.#isOpen(),
-			enableReconnect: () => this.#enableReconnect,
+		this.#subscriptions = new SubscriptionRegistry({
+			isOpen: () => this.#isOpen(),
+			enableReconnect: this.#enableReconnect,
 			send: (message) => this.#send(message),
 			scheduleReconnect: () => this.#scheduleReconnect(),
-			acceptEvent: (event) => this.#acceptEvent(event),
-			armEoseTimeout
-		};
+			acceptEvent: (event) => this.#acceptEvent(event)
+		});
+		this.#authState = new RelayAuth({
+			url: this.url,
+			isOpen: () => this.#isOpen(),
+			sendAuth: (event, timeoutMs) => this.#ok.track(event.id, {
+				timeoutMs,
+				timeoutError: () => new RelayTimeoutError("auth timed out", this.url),
+				sendError: () => new RelayPublishError("auth send failed", this.url),
+				send: () => this.#send(["AUTH", event])
+			}),
+			defaultTimeoutMs: this.#publishTimeoutMs
+		});
+		this.#ensureAuthed = this.#authState.ensureAuthed.bind(this.#authState, this.#authSigner);
 	}
 	/** Latest NIP-42 challenge, if any. */
 	get challenge() {
-		return this.#challenge;
+		return this.#authState.challenge;
 	}
 	get connected() {
 		return this.#isOpen();
@@ -857,11 +1337,11 @@ var Relay = class Relay {
 	}
 	/** User subscriptions only; dummy ping REQs are not counted. */
 	get subscriptionCount() {
-		return this.#subs.size;
+		return this.#subscriptions.size;
 	}
 	/** One-shot requests still awaiting a relay reply (EVENT ACK, COUNT, NEG). */
 	get inFlightCount() {
-		return this.#publishes.size + this.#counts.size + this.#neg.size;
+		return this.#ok.size + this.#countRequests.size + this.#neg.size;
 	}
 	/**
 	* Listen for a relay event. Multiple listeners per type are allowed and fire in registration
@@ -869,14 +1349,7 @@ var Relay = class Relay {
 	* function.
 	*/
 	on(type, listener) {
-		const set = this.#listeners[type];
-		set.add(listener);
-		return () => {
-			set.delete(listener);
-		};
-	}
-	#emit(type, payload) {
-		for (const listener of [...this.#listeners[type]]) invokeSafely(() => listener(payload));
+		return this.#events.on(type, listener);
 	}
 	static async connect(url, opts) {
 		const relay = new Relay(url, opts);
@@ -912,6 +1385,15 @@ var Relay = class Relay {
 			} catch {}
 			if (this.#ws === ws) this.#ws = void 0;
 		};
+		const guarded = (fn) => {
+			return () => {
+				if (gen !== this.#gen) {
+					release();
+					return;
+				}
+				fn();
+			};
+		};
 		const finish = (err) => {
 			if (settled) return;
 			settled = true;
@@ -924,18 +1406,14 @@ var Relay = class Relay {
 		};
 		this.#connecting = connecting;
 		this.#connectFinish = finish;
-		const timer = setTimeout(() => {
-			if (gen !== this.#gen) {
-				release();
-				return;
-			}
+		const timer = setTimeout(guarded(() => {
 			release();
 			finish(new RelayTimeoutError("connection timed out", this.url));
 			if (gen === this.#gen) this.#handleSocketDeath("connection timed out", {
 				fromConnectAttempt: true,
 				gen
 			});
-		}, timeoutMs);
+		}), timeoutMs);
 		this.#connectTimer = timer;
 		try {
 			ws = new this.#WS(this.url);
@@ -949,36 +1427,24 @@ var Relay = class Relay {
 			return;
 		}
 		this.#ws = ws;
-		const onOpen = () => {
-			if (gen !== this.#gen) {
-				release();
-				return;
-			}
+		const onOpen = guarded(() => {
 			this.#setStatus(RelayStatus.Connected);
 			const wasReconnect = this.#reconnectAttempts > 0;
-			this.#challenge = void 0;
-			this.#authPromise = void 0;
-			this.#authedChallenge = void 0;
-			this.#answeredChallenge = void 0;
-			this.#answeredResult = void 0;
-			if (!resubscribeAll(this.#live)) {
+			this.#authState.resetConnection();
+			if (!this.#subscriptions.replayAll()) {
 				this.#setStatus(RelayStatus.Disconnected);
 				release();
 				finish(new RelayConnectionError("connection failed", this.url));
-				if (this.#enableReconnect && !this.#manualStop && this.#subs.size > 0) this.#scheduleReconnect();
+				if (this.#enableReconnect && !this.#manualStop && this.#subscriptions.size > 0) this.#scheduleReconnect();
 				return;
 			}
 			this.#reconnectAttempts = 0;
 			if (this.#enablePing) this.#ping.start();
 			else this.#ping.stop();
-			if (wasReconnect) this.#emit("reconnect", void 0);
+			if (wasReconnect) this.#events.emit("reconnect", void 0);
 			finish();
-		};
-		const onError = () => {
-			if (gen !== this.#gen) {
-				release();
-				return;
-			}
+		});
+		const onError = guarded(() => {
 			const fromConnectAttempt = !settled;
 			release();
 			finish(new RelayConnectionError("connection failed", this.url));
@@ -986,12 +1452,8 @@ var Relay = class Relay {
 				fromConnectAttempt,
 				gen
 			});
-		};
-		const onClose = () => {
-			if (gen !== this.#gen) {
-				release();
-				return;
-			}
+		});
+		const onClose = guarded(() => {
 			const fromConnectAttempt = !settled;
 			release();
 			if (fromConnectAttempt) finish(new RelayConnectionError("websocket closed", this.url));
@@ -999,7 +1461,7 @@ var Relay = class Relay {
 				fromConnectAttempt,
 				gen
 			});
-		};
+		});
 		const onMessage = (ev) => {
 			if (gen !== this.#gen) return;
 			const data = typeof ev === "object" && ev !== null && "data" in ev ? ev.data : ev;
@@ -1046,12 +1508,12 @@ var Relay = class Relay {
 		this.#ping.stop();
 		this.#connectFinish?.(new RelayClosedError("relay closed", this.url));
 		try {
-			closeAllSubscriptions(this.#live, "relay closed");
+			this.#subscriptions.closeAll("relay closed");
 		} finally {
 			this.#failPending(new RelayClosedError("relay closed", this.url));
 			this.#detachSocketHandlers();
 			this.#teardownSocket();
-			this.#emit("close", void 0);
+			this.#events.emit("close", void 0);
 		}
 	}
 	/**
@@ -1086,28 +1548,10 @@ var Relay = class Relay {
 			this.#reconnectTimer = void 0;
 		}
 	}
-	#rejectPublishes(err) {
-		for (const [, waiter] of this.#publishes) {
-			clearTimeout(waiter.timer);
-			waiter.reject(err);
-		}
-		this.#publishes.clear();
-	}
-	#rejectCounts(err) {
-		for (const [, waiter] of this.#counts) {
-			clearTimeout(waiter.timer);
-			waiter.reject(err);
-		}
-		this.#counts.clear();
-	}
-	#rejectNeg(err) {
-		for (const session of this.#neg.values()) failNegSession(session, err);
-		this.#neg.clear();
-	}
 	#failPending(err) {
-		this.#rejectPublishes(err);
-		this.#rejectCounts(err);
-		this.#rejectNeg(err);
+		this.#ok.rejectAll(err);
+		this.#countRequests.rejectAll(err);
+		failAllNegSessions(this.#neg, err);
 	}
 	/** Unexpected socket death. Keep subscriptions if reconnecting. */
 	#handleSocketDeath(reason, opts) {
@@ -1117,15 +1561,15 @@ var Relay = class Relay {
 		this.#detachSocketHandlers();
 		this.#ws = void 0;
 		this.#failPending(new RelayClosedError(reason, this.url));
-		if (this.#enableReconnect && !this.#manualStop && this.#subs.size > 0) {
+		if (this.#enableReconnect && !this.#manualStop && this.#subscriptions.size > 0) {
 			this.#setStatus(RelayStatus.Disconnected);
 			this.#scheduleReconnect();
 			return;
 		}
 		this.#setStatus(RelayStatus.Disconnected);
-		if (opts.fromConnectAttempt !== true || this.#subs.size > 0) {
-			closeAllSubscriptions(this.#live, reason);
-			if (!this.#manualStop) this.#emit("close", void 0);
+		if (opts.fromConnectAttempt !== true || this.#subscriptions.size > 0) {
+			this.#subscriptions.closeAll(reason);
+			if (!this.#manualStop) this.#events.emit("close", void 0);
 		}
 		this.#setStatus(RelayStatus.Closed);
 	}
@@ -1141,7 +1585,7 @@ var Relay = class Relay {
 				try {
 					await this.connect();
 				} catch {
-					if (this.#enableReconnect && !this.#manualStop && this.#subs.size > 0 && !this.#isOpen()) this.#scheduleReconnect();
+					if (this.#enableReconnect && !this.#manualStop && this.#subscriptions.size > 0 && !this.#isOpen()) this.#scheduleReconnect();
 				}
 			})();
 		}, delay);
@@ -1162,91 +1606,78 @@ var Relay = class Relay {
 			case "EVENT": {
 				const [, subId, event] = msg;
 				if (this.#ping.hasWaiter(subId)) return;
-				onSubEvent(this.#live, subId, event);
+				this.#subscriptions.handleEvent(subId, event);
 				break;
 			}
 			case "EOSE": {
 				const [, subId] = msg;
 				if (this.#ping.finishDummyPing(subId)) return;
-				onSubEose(this.#live, subId);
+				this.#subscriptions.handleEose(subId);
 				break;
 			}
 			case "CLOSED": {
 				const [, subId, reason] = msg;
 				if (this.#ping.finishDummyPing(subId)) return;
-				const countWaiter = this.#counts.get(subId);
+				const countWaiter = this.#countRequests.get(subId);
 				if (countWaiter) {
 					if (isAuthRequired(reason) && this.#authSigner && !countWaiter.authRetried) {
 						countWaiter.authRetried = true;
-						this.#authThenRecount(subId, countWaiter, reason);
+						this.#countRequests.authRetry(countWaiter, {
+							ensureAuthed: this.#ensureAuthed,
+							isOpen: () => this.#isOpen(),
+							failError: () => new RelayClosedError(reason || "COUNT closed", this.url),
+							send: () => this.#send([
+								"COUNT",
+								subId,
+								...countWaiter.filters
+							])
+						});
 						return;
 					}
 					countWaiter.reject(new RelayClosedError(reason || "COUNT closed", this.url));
 					return;
 				}
-				const sub = this.#subs.get(subId);
+				const sub = this.#subscriptions.get(subId);
 				if (!sub) return;
-				if (isAuthRequired(reason) && this.#authSigner && !sub.authRetried) {
-					sub.authRetried = true;
-					this.#authThenResubscribe(sub, reason);
+				if (isAuthRequired(reason) && this.#authSigner && sub.beginAuthRetry()) {
+					this.#subscriptions.authRetry(sub, reason, this.#ensureAuthed);
 					return;
 				}
-				dropSubscription(this.#live, sub, reason);
+				this.#subscriptions.drop(sub, reason);
 				break;
 			}
 			case "OK": {
 				const [, eventId, ok, message] = msg;
-				const waiter = this.#publishes.get(eventId);
+				const waiter = this.#ok.handleOk(eventId, ok, message, (w) => !ok && isAuthRequired(message) && w.event !== void 0 && !w.authRetried && this.#authSigner !== void 0);
 				if (!waiter) return;
-				if (!ok && isAuthRequired(message) && waiter.event !== void 0 && waiter.authRetried !== true && this.#authSigner) {
-					waiter.authRetried = true;
-					this.#authThenRepublish(waiter, eventId, message);
-					return;
-				}
-				clearTimeout(waiter.timer);
-				this.#publishes.delete(eventId);
-				waiter.resolve({
-					ok,
-					message
+				waiter.authRetried = true;
+				this.#ok.authRetry(waiter, message, {
+					ensureAuthed: this.#ensureAuthed,
+					isOpen: () => this.#isOpen(),
+					send: (event) => this.#send(["EVENT", event])
 				});
-				break;
+				return;
 			}
 			case "COUNT": {
 				const [, countId, payload] = msg;
-				const waiter = this.#counts.get(countId);
+				const waiter = this.#countRequests.get(countId);
 				if (!waiter) return;
 				waiter.resolve(payload);
 				break;
 			}
-			case "NEG-MSG": {
-				const [, negId, hex] = msg;
-				const session = this.#neg.get(negId);
-				if (!session) return;
-				pushNegMsg(session, hex);
-				break;
-			}
-			case "NEG-ERR": {
-				const [, negId, reason] = msg;
-				const session = this.#neg.get(negId);
-				if (!session) return;
-				failNegErr(session, reason);
+			case "NEG-MSG":
+			case "NEG-ERR":
+				dispatchNegMessage(this.#neg, msg);
 				break;
-			}
 			case "NOTICE": {
 				const [, notice] = msg;
-				this.#emit("notice", notice);
+				this.#events.emit("notice", notice);
 				break;
 			}
 			case "AUTH": {
 				const [, authChallenge] = msg;
-				if (authChallenge !== this.#challenge) {
-					this.#authPromise = void 0;
-					this.#authedChallenge = void 0;
-					this.#answeredChallenge = void 0;
-					this.#answeredResult = void 0;
-				}
-				this.#challenge = authChallenge;
-				this.#emit("auth", authChallenge);
+				this.#authState.handleChallenge(authChallenge);
+				this.#events.emit("auth", authChallenge);
 				break;
 			}
 		}
@@ -1256,19 +1687,18 @@ var Relay = class Relay {
 		if (filters.length === 0) throw new MessageError("REQ requires at least one filter");
 		if (!this.#isOpen() && !this.#enableReconnect) throw new RelayClosedError("not connected", this.url);
 		const canonical = canonicalizeFilters(filters);
-		if (opts.closeOnEose === true) return openExclusive(this.#live, canonical, opts);
-		return subscribeLive(this.#live, canonical, opts);
+		return this.#subscriptions.open(canonical, opts);
 	}
 	#acceptEvent(event) {
 		if (this.#verifyDead) return false;
 		try {
 			const ok = this.#verify(event);
-			if (!ok) this.#emit("invalidevent", void 0);
+			if (!ok) this.#events.emit("invalidevent", void 0);
 			return ok;
 		} catch (error) {
 			if (error instanceof WasmPoisonedError) {
 				this.#verifyDead = true;
-				this.#emit("notice", "wasm-poisoned: instance aborted");
+				this.#events.emit("notice", "wasm-poisoned: instance aborted");
 				return false;
 			}
 			throw error;
@@ -1299,35 +1729,16 @@ var Relay = class Relay {
 	*/
 	async publish(event, opts) {
 		if (!this.#isOpen()) throw new RelayClosedError("not connected", this.url);
-		const existing = this.#publishes.get(event.id);
-		if (existing?.event !== void 0) return existing.promise;
+		const existing = this.#ok.inFlight(event.id);
+		if (existing !== void 0) return existing;
 		const timeoutMs = opts?.timeoutMs ?? this.#publishTimeoutMs;
-		const promise = new Promise((resolve, reject) => {
-			const waiter = {
-				resolve,
-				reject,
-				timer: setTimeout(() => {
-					if (this.#publishes.get(event.id) === waiter) {
-						this.#publishes.delete(event.id);
-						reject(new RelayTimeoutError("publish timed out", this.url));
-					}
-				}, timeoutMs),
-				event,
-				timeoutMs,
-				get promise() {
-					return promise;
-				}
-			};
-			this.#publishes.set(event.id, waiter);
-			try {
-				this.#send(["EVENT", event]);
-			} catch (error) {
-				clearTimeout(waiter.timer);
-				if (this.#publishes.get(event.id) === waiter) this.#publishes.delete(event.id);
-				reject(error instanceof Error ? error : new RelayPublishError("publish failed", this.url));
-			}
+		return this.#ok.track(event.id, {
+			timeoutMs,
+			timeoutError: () => new RelayTimeoutError("publish timed out", this.url),
+			sendError: () => new RelayPublishError("publish failed", this.url),
+			event,
+			send: () => this.#send(["EVENT", event])
 		});
-		return promise;
 	}
 	/**
 	* NIP-45 COUNT: ask the relay how many events match `filters`. Resolves with the COUNT payload
@@ -1340,105 +1751,22 @@ var Relay = class Relay {
 		const canonical = canonicalizeFilters(filters);
 		const id = opts?.id === void 0 ? this.nextSubId("count") : createSubscriptionId(opts.id);
 		const timeoutMs = opts?.timeoutMs ?? this.#publishTimeoutMs;
-		return new Promise((resolve, reject) => {
-			const waiter = {
-				resolve: (result) => {
-					if (waiter.timer !== void 0) clearTimeout(waiter.timer);
-					waiter.timer = void 0;
-					this.#counts.delete(id);
-					cleanup();
-					resolve(result);
-				},
-				reject: (err) => {
-					if (waiter.timer !== void 0) clearTimeout(waiter.timer);
-					waiter.timer = void 0;
-					this.#counts.delete(id);
-					cleanup();
-					reject(err);
-				},
-				timer: void 0,
-				filters: [...canonical],
-				authRetried: false,
-				timeoutMs
-			};
-			const cleanup = onAbort(opts?.signal, () => {
-				if (opts?.signal) waiter.reject(abortReason(opts.signal));
-			});
-			waiter.timer = setTimeout(() => {
-				waiter.reject(new RelayTimeoutError("count timed out", this.url));
-			}, timeoutMs);
-			this.#counts.set(id, waiter);
-			try {
-				this.#send([
-					"COUNT",
-					id,
-					...canonical
-				]);
-			} catch (error) {
-				waiter.reject(error instanceof Error ? error : new RelayPublishError("count failed", this.url));
-			}
+		return this.#countRequests.track(id, {
+			timeoutMs,
+			timeoutError: () => new RelayTimeoutError("count timed out", this.url),
+			sendError: () => new RelayPublishError("count failed", this.url),
+			filters: [...canonical],
+			signal: opts?.signal,
+			send: () => this.#send([
+				"COUNT",
+				id,
+				...canonical
+			])
 		});
 	}
 	/** NIP-42 AUTH: sign the current challenge and wait for OK. */
 	async auth(sign, opts) {
-		const challenge = this.#challenge;
-		if (challenge === void 0 || challenge === "") throw new RelayError("no AUTH challenge received from relay", this.url);
-		if (this.#authPromise) return this.#authPromise;
-		if (this.#answeredChallenge === challenge && this.#answeredResult !== void 0) return this.#answeredResult;
-		const pending = (async () => {
-			const template = makeAuthEvent(this.url, challenge);
-			let event;
-			try {
-				event = await sign(template);
-			} catch (error) {
-				if (error instanceof NoSignerError) return {
-					ok: false,
-					message: "auth: no signer"
-				};
-				throw error;
-			}
-			if (!this.#isOpen()) throw new RelayClosedError("not connected", this.url);
-			const timeoutMs = opts?.timeoutMs ?? this.#publishTimeoutMs;
-			const authPromise = new Promise((resolve, reject) => {
-				const waiter = {
-					resolve: (result) => {
-						if (this.#challenge === challenge) {
-							this.#answeredChallenge = challenge;
-							this.#answeredResult = result;
-						}
-						resolve(result);
-					},
-					reject,
-					timer: setTimeout(() => {
-						if (this.#publishes.get(event.id) === waiter) {
-							this.#publishes.delete(event.id);
-							reject(new RelayTimeoutError("auth timed out", this.url));
-						}
-					}, timeoutMs),
-					timeoutMs,
-					get promise() {
-						return authPromise;
-					}
-				};
-				this.#publishes.set(event.id, waiter);
-				try {
-					this.#send(["AUTH", event]);
-				} catch (error) {
-					clearTimeout(waiter.timer);
-					if (this.#publishes.get(event.id) === waiter) this.#publishes.delete(event.id);
-					reject(error instanceof Error ? error : new RelayPublishError("auth send failed", this.url));
-				}
-			});
-			return authPromise;
-		})();
-		this.#authPromise = pending;
-		try {
-			const result = await pending;
-			if (result.ok && this.#challenge === challenge) this.#authedChallenge = challenge;
-			return result;
-		} finally {
-			if (this.#authPromise === pending) this.#authPromise = void 0;
-		}
+		return this.#authState.auth(sign, opts);
 	}
 	/**
 	* Clear a cached AUTH rejection for the current challenge so a later `auth()` signs again. A
@@ -1446,133 +1774,8 @@ var Relay = class Relay {
 	* `auth` event is re-fired so the pool's automatic auth can run once more.
 	*/
 	resetAuth() {
-		if (this.#answeredResult !== void 0 && !this.#answeredResult.ok) {
-			this.#answeredChallenge = void 0;
-			this.#answeredResult = void 0;
-		}
-		if (this.#challenge !== void 0 && this.#challenge !== this.#authedChallenge) {
-			const challenge = this.#challenge;
-			this.#emit("auth", challenge);
-		}
-	}
-	async #ensureAuthed() {
-		const signer = this.#authSigner;
-		if (!signer) return false;
-		for (let i = 0; i < 3; i++) {
-			if (this.#challenge === void 0 || this.#challenge === "") return false;
-			if (this.#authedChallenge === this.#challenge) return true;
-			const signed = this.#challenge;
-			const result = await this.auth(signer);
-			if (this.#authedChallenge === this.#challenge) return true;
-			if (!result.ok) {
-				if (this.#challenge === void 0 || this.#challenge === "" || this.#challenge === signed) return false;
-				continue;
-			}
-		}
-		return this.#authedChallenge === this.#challenge;
-	}
-	async #authThenResubscribe(sub, reason) {
-		try {
-			if (!await this.#ensureAuthed()) {
-				dropSubscription(this.#live, sub, reason);
-				return;
-			}
-			if (sub.closed || !this.#isOpen()) {
-				dropSubscription(this.#live, sub, reason);
-				return;
-			}
-			sub.eosed = false;
-			const group = this.#liveBySubId.get(sub.id);
-			if (group) for (const att of group.attachments) att.eosed = false;
-			this.#send([
-				"REQ",
-				sub.id,
-				...sub.replayFilters()
-			]);
-		} catch {
-			dropSubscription(this.#live, sub, reason);
-		}
-	}
-	async #authThenRecount(id, waiter, reason) {
-		if (waiter.timer !== void 0) {
-			clearTimeout(waiter.timer);
-			waiter.timer = void 0;
-		}
-		const fail = () => {
-			waiter.reject(new RelayClosedError(reason || "COUNT closed", this.url));
-		};
-		try {
-			const ok = await this.#ensureAuthed();
-			if (this.#counts.get(id) !== waiter) return;
-			if (!ok) {
-				fail();
-				return;
-			}
-			if (!this.#isOpen()) {
-				fail();
-				return;
-			}
-			waiter.timer = setTimeout(() => {
-				waiter.reject(new RelayTimeoutError("count timed out", this.url));
-			}, waiter.timeoutMs);
-			this.#send([
-				"COUNT",
-				id,
-				...waiter.filters
-			]);
-		} catch (error) {
-			if (!this.#counts.has(id)) return;
-			waiter.reject(error instanceof Error ? error : new RelayClosedError(reason || "COUNT closed", this.url));
-		}
-	}
-	async #authThenRepublish(waiter, eventId, message) {
-		if (waiter.timer !== void 0) {
-			clearTimeout(waiter.timer);
-			waiter.timer = void 0;
-		}
-		const finish = (result) => {
-			if (waiter.timer !== void 0) clearTimeout(waiter.timer);
-			if (this.#publishes.get(eventId) === waiter) this.#publishes.delete(eventId);
-			waiter.resolve(result);
-		};
-		try {
-			if (!waiter.event) {
-				finish({
-					ok: false,
-					message
-				});
-				return;
-			}
-			const ok = await this.#ensureAuthed();
-			if (this.#publishes.get(eventId) !== waiter) return;
-			if (!ok) {
-				finish({
-					ok: false,
-					message
-				});
-				return;
-			}
-			if (!this.#isOpen()) {
-				finish({
-					ok: false,
-					message
-				});
-				return;
-			}
-			waiter.timer = setTimeout(() => {
-				if (this.#publishes.get(eventId) === waiter) {
-					this.#publishes.delete(eventId);
-					waiter.reject(new RelayTimeoutError("publish timed out", this.url));
-				}
-			}, waiter.timeoutMs);
-			this.#send(["EVENT", waiter.event]);
-		} catch {
-			if (!this.#publishes.has(eventId)) return;
-			finish({
-				ok: false,
-				message
-			});
-		}
+		const challenge = this.#authState.resetRejection();
+		if (challenge !== void 0) this.#events.emit("auth", challenge);
 	}
 	/**
 	* NIP-77: run Negentropy reconciliation against this relay. Returns the local-only (`have`) and
@@ -1584,32 +1787,17 @@ var Relay = class Relay {
 	async negReconcile(filter, storage, opts) {
 		if (!this.#isOpen()) throw new RelayClosedError("not connected", this.url);
 		throwIfAborted(opts?.signal);
-		const canonical = canonicalizeFilter(filter);
 		const id = opts?.id === void 0 ? this.nextSubId("neg") : assertSubscriptionId(opts.id);
-		const timeoutMs = opts?.timeoutMs ?? this.#publishTimeoutMs;
-		const prev = this.#neg.get(id);
-		if (prev) failNegSession(prev, new Nip77Error("closed: replaced by new NEG-OPEN"));
-		const session = createNegSession();
-		this.#neg.set(id, session);
-		try {
-			return await runWiredNegSession({
-				session,
-				storage,
-				filter: canonical,
-				id,
-				timeoutMs,
-				signal: opts?.signal,
-				send: (message) => this.#send(message),
-				url: this.url
-			});
-		} finally {
-			if (this.#neg.get(id) === session) {
-				this.#neg.delete(id);
-				try {
-					this.#send(["NEG-CLOSE", id]);
-				} catch {}
-			}
-		}
+		return runTrackedNegSession({
+			sessions: this.#neg,
+			id,
+			storage,
+			filter: canonicalizeFilter(filter),
+			timeoutMs: opts?.timeoutMs ?? this.#publishTimeoutMs,
+			signal: opts?.signal,
+			send: (message) => this.#send(message),
+			url: this.url
+		});
 	}
 	/** Generate a unique subscription id for this relay instance. */
 	nextSubId(prefix = "sub") {
@@ -1620,4 +1808,4 @@ var Relay = class Relay {
 //#endregion
 export { getWebSocketImplementation as a, RelayConnectionError as c, RelaySuspendedError as d, RelayTimeoutError as f, subscriptionToAsyncIterable as i, RelayError as l, Relay as n, useWebSocketImplementation as o, RelayStatus as r, RelayClosedError as s, DEFAULT_REQUEST_TIMEOUT_MS as t, RelayPublishError as u };
 
-//# sourceMappingURL=relay-CvxPiQ_m.mjs.map
+//# sourceMappingURL=relay-quCs7MHD.mjs.map