@toon-protocol/client-mcp 0.1.0

package/dist/chunk-3NAWISI5.js

@@ -0,0 +1,2245 @@
+import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
+import {
+  DEFAULT_KEYSTORE_PASSWORD,
+  ILP_PEER_INFO_KIND,
+  ToonError,
+  buildIlpPrepare,
+  configDir,
+  decodeEventFromToon,
+  defaultConfigPath,
+  deriveFullIdentity,
+  encodeEventToToon,
+  generateKeystore,
+  isEventExpired,
+  parseIlpPeerInfo,
+  readConfigFile
+} from "./chunk-5KFXUT5Q.js";
+import {
+  startManagedAnonProxy
+} from "./chunk-SKQTKZIH.js";
+import {
+  __require
+} from "./chunk-F22GNSF6.js";
+
+// src/daemon/first-run.ts
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+function defaultKeystorePath() {
+  return join(configDir(), "keystore.json");
+}
+function hasConfiguredIdentity(file) {
+  return Boolean(
+    process.env["TOON_CLIENT_MNEMONIC"]?.trim() || file.keystorePath || file.mnemonic
+  );
+}
+var CONFIG_HELP = {
+  transport: "Point btpUrl/relayUrl at your apex. For an .anyone hidden service use ws://<host>.anyone:3000/btp + ws://<host>.anyone:7100 \u2014 the daemon auto-routes through a managed anon proxy. For a direct apex use ws://<host>:3000/btp + ws://<host>:7100.",
+  btpUrl: "REQUIRED. BTP WebSocket URL of the apex/connector for paid writes.",
+  relayUrl: "Town relay WebSocket URL for FREE reads. Default ws://localhost:7100.",
+  managedAnonProxy: "Optional override \u2014 leave unset to auto-infer from btpUrl (.anyone host \u2192 managed anon proxy, anything else \u2192 direct).",
+  keystorePath: "Auto-generated encrypted identity. Do not hand-edit; back up your seed phrase."
+};
+async function scaffoldFirstRun(opts = {}) {
+  const log = opts.log ?? ((m) => console.error(m));
+  const configPath = opts.configPath ?? process.env["TOON_CLIENT_CONFIG"] ?? defaultConfigPath();
+  mkdirSync(dirname(configPath), { recursive: true });
+  const file = readConfigFile(configPath);
+  let updated = { ...file };
+  let changed = false;
+  if (!hasConfiguredIdentity(file)) {
+    const keystorePath = defaultKeystorePath();
+    const envPassword = process.env["TOON_CLIENT_KEYSTORE_PASSWORD"];
+    const password = envPassword ?? DEFAULT_KEYSTORE_PASSWORD;
+    let mnemonic;
+    if (existsSync(keystorePath)) {
+      mnemonic = "";
+      log(
+        `[toon-clientd] first run: relinking existing keystore at ${keystorePath}`
+      );
+    } else {
+      const generated = generateKeystore(keystorePath, password);
+      mnemonic = generated.mnemonic;
+    }
+    updated = {
+      ...updated,
+      keystorePath,
+      // Only flag auto-password when WE chose it, so a user-imported keystore
+      // (custom password) still requires the env var.
+      ...envPassword ? {} : { keystoreAutoPassword: true }
+    };
+    changed = true;
+    if (mnemonic) {
+      await printNewIdentity(mnemonic, keystorePath, Boolean(envPassword), log);
+    }
+  }
+  if (!existsSync(configPath)) {
+    updated = {
+      _help: CONFIG_HELP,
+      btpUrl: "",
+      relayUrl: "ws://localhost:7100",
+      ...updated
+    };
+    changed = true;
+    log(
+      `[toon-clientd] wrote starter config at ${configPath} \u2014 set "btpUrl" to your apex before publishing.`
+    );
+  }
+  if (changed) writeConfigFile(configPath, updated);
+}
+async function printNewIdentity(mnemonic, keystorePath, hasEnvPassword, log) {
+  const id = await deriveFullIdentity(mnemonic);
+  const lines = [
+    "",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    "  TOON client: generated a new identity (first run)",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    `  Nostr pubkey : ${id.nostr.pubkey}`,
+    `  EVM address  : ${id.evm.address}`,
+    ...id.solana.publicKey ? [`  Solana       : ${id.solana.publicKey}`] : [],
+    ...id.mina.publicKey ? [`  Mina         : ${id.mina.publicKey}`] : [],
+    "",
+    "  Seed phrase (BACK THIS UP \u2014 shown only once):",
+    `    ${mnemonic}`,
+    "",
+    `  Encrypted keystore: ${keystorePath}`,
+    hasEnvPassword ? "  Encrypted with TOON_CLIENT_KEYSTORE_PASSWORD." : "  Encrypted with the default password (set TOON_CLIENT_KEYSTORE_PASSWORD\n  + re-import to use your own). Identity reloads automatically on restart.",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    ""
+  ];
+  log(lines.join("\n"));
+}
+function writeConfigFile(path, file) {
+  writeFileSync(path, JSON.stringify(file, null, 2) + "\n", {
+    encoding: "utf8",
+    mode: 384
+  });
+}
+
+// src/relay-subscription.ts
+import { createRequire } from "module";
+var nodeRequire = createRequire(import.meta.url);
+var DEFAULT_BUFFER = 5e3;
+var DEFAULT_BASE_MS = 1e3;
+var DEFAULT_MAX_MS = 3e4;
+var noop = () => void 0;
+var RelaySubscription = class {
+  relayUrl;
+  socksProxy;
+  bufferSize;
+  reconnectBaseMs;
+  reconnectMaxMs;
+  log;
+  wsFactory;
+  decodeEvent;
+  onEvent;
+  /** Active subscriptions: subId -> filters (re-sent on every (re)connect). */
+  subscriptions = /* @__PURE__ */ new Map();
+  /** Ring buffer of received events, ordered by ascending `seq`. */
+  buffer = [];
+  /** De-dup index: event.id -> seq (kept in lockstep with the buffer). */
+  seen = /* @__PURE__ */ new Set();
+  seqCounter = 0;
+  subIdCounter = 0;
+  ws = null;
+  connected = false;
+  closing = false;
+  reconnectAttempts = 0;
+  reconnectTimer = null;
+  constructor(opts) {
+    this.relayUrl = opts.relayUrl;
+    this.socksProxy = opts.socksProxy;
+    this.bufferSize = opts.bufferSize ?? DEFAULT_BUFFER;
+    this.reconnectBaseMs = opts.reconnectBaseMs ?? DEFAULT_BASE_MS;
+    this.reconnectMaxMs = opts.reconnectMaxMs ?? DEFAULT_MAX_MS;
+    this.log = opts.logger ?? noop;
+    this.wsFactory = opts.wsFactory ?? defaultWebSocketFactory(this.socksProxy);
+    this.decodeEvent = opts.decodeEvent;
+    this.onEvent = opts.onEvent;
+  }
+  /** Whether the underlying socket is currently open. */
+  isConnected() {
+    return this.connected;
+  }
+  /** Number of events currently held in the buffer. */
+  bufferedCount() {
+    return this.buffer.length;
+  }
+  /** Active subscription ids. */
+  activeSubscriptions() {
+    return [...this.subscriptions.keys()];
+  }
+  /** Open the connection (idempotent). */
+  start() {
+    this.closing = false;
+    if (this.ws) return;
+    this.open();
+  }
+  /**
+   * Register a persistent subscription and (if connected) send the REQ.
+   * Returns the subscription id (caller-supplied or generated).
+   */
+  subscribe(filters, subId) {
+    const id = subId ?? `sub-${++this.subIdCounter}`;
+    const list = Array.isArray(filters) ? filters : [filters];
+    this.subscriptions.set(id, list);
+    if (this.connected) this.sendReq(id, list);
+    return id;
+  }
+  /** Cancel a subscription and send CLOSE if connected. */
+  unsubscribe(subId) {
+    if (!this.subscriptions.delete(subId)) return;
+    if (this.connected) this.sendRaw(["CLOSE", subId]);
+  }
+  /**
+   * Drain events newer than `cursor`. The cursor is the highest `seq` returned;
+   * pass it back to fetch only events received since. Filtering by `subId`
+   * restricts to one subscription.
+   */
+  getEvents(opts = {}) {
+    const after = opts.cursor ?? 0;
+    const limit = opts.limit ?? 200;
+    const matches = this.buffer.filter(
+      (b) => b.seq > after && (opts.subId === void 0 || b.subId === opts.subId)
+    );
+    const page = matches.slice(0, limit);
+    const hasMore = matches.length > page.length;
+    const last = page.at(-1);
+    const cursor = last ? last.seq : after;
+    return { events: page.map((b) => b.event), cursor, hasMore };
+  }
+  /** Close the connection permanently and stop reconnecting. */
+  close() {
+    this.closing = true;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+    this.connected = false;
+  }
+  // ── internals ────────────────────────────────────────────────────────────
+  open() {
+    let ws;
+    try {
+      ws = this.wsFactory(this.relayUrl);
+    } catch (err) {
+      this.log(`[relay] connect failed: ${errMsg(err)}`);
+      this.scheduleReconnect();
+      return;
+    }
+    this.ws = ws;
+    ws.on("open", () => {
+      this.connected = true;
+      this.reconnectAttempts = 0;
+      this.log(`[relay] connected to ${this.relayUrl}`);
+      for (const [id, filters] of this.subscriptions) this.sendReq(id, filters);
+    });
+    ws.on("message", (data) => this.handleMessage(data));
+    ws.on("error", (err) => {
+      this.log(`[relay] socket error: ${errMsg(err)}`);
+    });
+    ws.on("close", () => {
+      this.connected = false;
+      this.ws = null;
+      if (!this.closing) {
+        this.log("[relay] disconnected; scheduling reconnect");
+        this.scheduleReconnect();
+      }
+    });
+  }
+  scheduleReconnect() {
+    if (this.closing || this.reconnectTimer) return;
+    const delay2 = Math.min(
+      this.reconnectMaxMs,
+      this.reconnectBaseMs * 2 ** this.reconnectAttempts
+    );
+    this.reconnectAttempts += 1;
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      if (!this.closing) this.open();
+    }, delay2);
+    this.reconnectTimer.unref?.();
+  }
+  sendReq(subId, filters) {
+    this.sendRaw(["REQ", subId, ...filters]);
+  }
+  sendRaw(message) {
+    if (!this.ws || !this.connected) return;
+    try {
+      this.ws.send(JSON.stringify(message));
+    } catch (err) {
+      this.log(`[relay] send failed: ${errMsg(err)}`);
+    }
+  }
+  handleMessage(data) {
+    let parsed;
+    try {
+      parsed = JSON.parse(toText(data));
+    } catch {
+      return;
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0) return;
+    const type = parsed[0];
+    switch (type) {
+      case "EVENT": {
+        const subId = typeof parsed[1] === "string" ? parsed[1] : "";
+        const event = this.parseEventPayload(parsed[2]);
+        if (event && typeof event.id === "string")
+          this.bufferEvent(subId, event);
+        break;
+      }
+      case "EOSE":
+        break;
+      case "CLOSED":
+        this.log(
+          `[relay] subscription closed by relay: ${String(parsed[2] ?? "")}`
+        );
+        break;
+      case "NOTICE":
+        this.log(`[relay] NOTICE: ${String(parsed[1] ?? "")}`);
+        break;
+      default:
+        break;
+    }
+  }
+  /**
+   * Normalise an `EVENT` payload to a NostrEvent. Standard relays send a JSON
+   * object; the TOON relay sends a TOON-encoded string, decoded via the injected
+   * `decodeEvent`. Returns undefined when it can't be parsed.
+   */
+  parseEventPayload(raw) {
+    if (raw && typeof raw === "object" && typeof raw.id === "string") {
+      return raw;
+    }
+    if (typeof raw === "string" && this.decodeEvent) {
+      try {
+        return this.decodeEvent(raw);
+      } catch (err) {
+        this.log(`[relay] event decode failed: ${errMsg(err)}`);
+        return void 0;
+      }
+    }
+    return void 0;
+  }
+  bufferEvent(subId, event) {
+    if (this.seen.has(event.id)) return;
+    this.seen.add(event.id);
+    this.buffer.push({ seq: ++this.seqCounter, subId, event });
+    if (this.buffer.length > this.bufferSize) {
+      const evicted = this.buffer.shift();
+      if (evicted) this.seen.delete(evicted.event.id);
+    }
+    this.onEvent?.(subId, event);
+  }
+};
+function toText(data) {
+  if (typeof data === "string") return data;
+  if (data instanceof Uint8Array) return Buffer.from(data).toString("utf8");
+  if (Buffer.isBuffer(data)) return data.toString("utf8");
+  return String(data);
+}
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function defaultWebSocketFactory(socksProxy) {
+  return (url) => {
+    const WebSocketImpl = nodeRequire("ws");
+    let agent;
+    if (socksProxy) {
+      const { SocksProxyAgent } = nodeRequire("socks-proxy-agent");
+      agent = new SocksProxyAgent(socksProxy);
+    }
+    return new WebSocketImpl(url, agent ? { agent } : void 0);
+  };
+}
+
+// src/daemon/client-runner.ts
+import { generateSecretKey as generateSecretKey2 } from "nostr-tools/pure";
+
+// ../../node_modules/.pnpm/@toon-protocol+sdk@0.5.1_@toon-protocol+connector@3.13.0_mina-signer@3.1.0_typescript@5.9.3/node_modules/@toon-protocol/sdk/dist/chunk-UP2VWCW5.js
+var __require2 = /* @__PURE__ */ ((x) => typeof __require !== "undefined" ? __require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof __require !== "undefined" ? __require : a)[b]
+}) : x)(function(x) {
+  if (typeof __require !== "undefined") return __require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// ../../node_modules/.pnpm/@toon-protocol+sdk@0.5.1_@toon-protocol+connector@3.13.0_mina-signer@3.1.0_typescript@5.9.3/node_modules/@toon-protocol/sdk/dist/chunk-XTHUXP63.js
+import { getPublicKey } from "nostr-tools/pure";
+import { generateSecretKey, getPublicKey as getPublicKey2 } from "nostr-tools/pure";
+import { createRumor, createSeal, createWrap } from "nostr-tools/nip59";
+import {
+  encrypt as nip44Encrypt,
+  decrypt as nip44Decrypt,
+  getConversationKey
+} from "nostr-tools/nip44";
+import { getPublicKey as getPublicKey3 } from "nostr-tools/pure";
+var IdentityError = class extends ToonError {
+  constructor(message, cause) {
+    super(message, "IDENTITY_ERROR", cause);
+    this.name = "IdentityError";
+  }
+};
+var GiftWrapError = class extends ToonError {
+  constructor(message, cause) {
+    super(message, "GIFT_WRAP_ERROR", cause);
+    this.name = "GiftWrapError";
+  }
+};
+var SwapHandlerError = class extends ToonError {
+  constructor(message, cause) {
+    super(message, "SWAP_HANDLER_ERROR", cause);
+    this.name = "SwapHandlerError";
+  }
+};
+var StreamSwapError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message);
+    this.name = "StreamSwapError";
+    this.code = code;
+    if (options && "cause" in options) {
+      Object.defineProperty(this, "cause", {
+        value: options.cause,
+        enumerable: false,
+        writable: true,
+        configurable: true
+      });
+    }
+  }
+};
+var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function base58Decode(str) {
+  let zeros = 0;
+  for (let i = 0; i < str.length && str[i] === "1"; i++) zeros++;
+  let value = 0n;
+  for (const ch of str) {
+    const idx = BASE58_ALPHABET.indexOf(ch);
+    if (idx === -1) throw new IdentityError(`Invalid base58 character: ${ch}`);
+    value = value * 58n + BigInt(idx);
+  }
+  const hex = value === 0n ? "" : value.toString(16);
+  const hexPadded = hex.length % 2 ? "0" + hex : hex;
+  const rawBytes = [];
+  for (let i = 0; i < hexPadded.length; i += 2) {
+    rawBytes.push(parseInt(hexPadded.slice(i, i + 2), 16));
+  }
+  const result = new Uint8Array(zeros + rawBytes.length);
+  result.set(rawBytes, zeros);
+  return result;
+}
+function validateSecretKey(key2, paramName) {
+  if (!(key2 instanceof Uint8Array) || key2.length !== 32) {
+    throw new GiftWrapError(
+      `${paramName} must be a 32-byte Uint8Array, got ${key2 instanceof Uint8Array ? `${key2.length} bytes` : typeof key2}`
+    );
+  }
+}
+function validatePubkey(pubkey, paramName) {
+  if (typeof pubkey !== "string" || !/^[0-9a-f]{64}$/.test(pubkey)) {
+    throw new GiftWrapError(
+      `${paramName} must be a 64-character lowercase hex string`
+    );
+  }
+}
+function wrapSwapPacket(params) {
+  const { rumor, senderSecretKey, recipientPubkey } = params;
+  validateSecretKey(senderSecretKey, "senderSecretKey");
+  validatePubkey(recipientPubkey, "recipientPubkey");
+  try {
+    const rumorEvent = createRumor(rumor, senderSecretKey);
+    const seal = createSeal(rumorEvent, senderSecretKey, recipientPubkey);
+    const giftWrap = createWrap(seal, recipientPubkey);
+    const ephemeralPubkey = giftWrap.pubkey;
+    return { giftWrap, ephemeralPubkey };
+  } catch (error) {
+    throw new GiftWrapError(
+      `Failed to wrap swap packet: ${error instanceof Error ? error.message : String(error)}`,
+      error instanceof Error ? error : void 0
+    );
+  }
+}
+function wrapSwapPacketToToon(params) {
+  const {
+    rumor,
+    senderSecretKey,
+    recipientPubkey,
+    destination,
+    amount,
+    expiresAt
+  } = params;
+  const { giftWrap, ephemeralPubkey } = wrapSwapPacket({
+    rumor,
+    senderSecretKey,
+    recipientPubkey
+  });
+  const toonBinary = encodeEventToToon(giftWrap);
+  const ilpPrepare = buildIlpPrepare({
+    destination,
+    amount,
+    data: toonBinary,
+    expiresAt
+  });
+  return { ilpPrepare, ephemeralPubkey };
+}
+function decryptFulfillClaim(params) {
+  const { ciphertext, ephemeralPubkey, recipientSecretKey } = params;
+  validateSecretKey(recipientSecretKey, "recipientSecretKey");
+  validatePubkey(ephemeralPubkey, "ephemeralPubkey");
+  if (!(ciphertext instanceof Uint8Array) || ciphertext.length === 0) {
+    throw new GiftWrapError("ciphertext must be a non-empty Uint8Array");
+  }
+  let conversationKey = null;
+  try {
+    conversationKey = getConversationKey(recipientSecretKey, ephemeralPubkey);
+    const ciphertextString = new TextDecoder().decode(ciphertext);
+    const claimString = nip44Decrypt(ciphertextString, conversationKey);
+    return new Uint8Array(Buffer.from(claimString, "base64"));
+  } catch (error) {
+    if (error instanceof GiftWrapError) {
+      throw error;
+    }
+    throw new GiftWrapError(
+      `Failed to decrypt FULFILL claim: ${error instanceof Error ? error.message : String(error)}`,
+      error instanceof Error ? error : void 0
+    );
+  } finally {
+    if (conversationKey) {
+      conversationKey.fill(0);
+      conversationKey = null;
+    }
+  }
+}
+var RATE_REGEX = /^(0|[1-9]\d*)(\.\d+)?$/;
+function applyRate(params) {
+  const { sourceAmount, fromScale, toScale, rate } = params;
+  if (!RATE_REGEX.test(rate)) {
+    throw new SwapHandlerError(`Invalid rate format: ${rate}`);
+  }
+  if (/^0(\.0+)?$/.test(rate)) {
+    throw new SwapHandlerError("Rate is zero (pair not quoting)");
+  }
+  if (sourceAmount <= 0n) {
+    throw new SwapHandlerError(
+      `sourceAmount must be positive, got ${sourceAmount}`
+    );
+  }
+  const dotIdx = rate.indexOf(".");
+  const integerPart = dotIdx === -1 ? rate : rate.slice(0, dotIdx);
+  const fractionalPart = dotIdx === -1 ? "" : rate.slice(dotIdx + 1);
+  const rateNumerator = BigInt(integerPart + fractionalPart);
+  const rateDenominator = 10n ** BigInt(fractionalPart.length);
+  const scaleUp = 10n ** BigInt(toScale);
+  const scaleDown = 10n ** BigInt(fromScale);
+  return sourceAmount * rateNumerator * scaleUp / (rateDenominator * scaleDown);
+}
+var RATE_REGEX2 = /^(0|[1-9]\d*)(\.\d+)?$/;
+var HEX64_REGEX = /^[0-9a-f]{64}$/;
+var BASE64_REGEX = /^[A-Za-z0-9+/]+={0,2}$/;
+function isBase64(s) {
+  if (s.length === 0 || s.length % 4 !== 0) return false;
+  return BASE64_REGEX.test(s);
+}
+function chunkAmount(total, count) {
+  if (!Number.isInteger(count) || count <= 0 || count > Number.MAX_SAFE_INTEGER) {
+    throw new StreamSwapError(
+      "INVALID_CHUNKING",
+      `packetCount must be a positive integer, got ${count}`
+    );
+  }
+  if (total < BigInt(count)) {
+    throw new StreamSwapError(
+      "INVALID_CHUNKING",
+      `totalAmount (${total}) must be >= packetCount (${count}) so per-packet amount >= 1`
+    );
+  }
+  const base = total / BigInt(count);
+  const remainder = total - base * BigInt(count);
+  const out = new Array(count);
+  for (let i = 0; i < count; i++) out[i] = base;
+  const last = out[count - 1] ?? 0n;
+  out[count - 1] = last + remainder;
+  return out;
+}
+function buildSwapRumor(input) {
+  const {
+    senderPubkey,
+    pair,
+    sourceAmount,
+    packetIndex,
+    totalPackets,
+    nonce,
+    createdAt,
+    chainRecipient
+  } = input;
+  return {
+    kind: 20032,
+    pubkey: senderPubkey,
+    content: "",
+    created_at: createdAt,
+    tags: [
+      ["swap-from", `${pair.from.assetCode}:${pair.from.chain}`],
+      ["swap-to", `${pair.to.assetCode}:${pair.to.chain}`],
+      ["amount", sourceAmount.toString()],
+      ["seq", String(packetIndex), String(totalPackets)],
+      ["nonce", Buffer.from(nonce).toString("hex")],
+      ["chain-recipient", chainRecipient]
+    ]
+  };
+}
+var EVM_CHANNEL_ID_REGEX = /^0x[0-9a-f]{64}$/;
+var EVM_ADDRESS_REGEX = /^0x[0-9a-f]{40}$/;
+var DECIMAL_UINT_REGEX = /^(0|[1-9]\d*)$/;
+var BASE58_REGEX = /^[1-9A-HJ-NP-Za-km-z]+$/;
+function validateChainAddress(value, chain, kind) {
+  if (chain.startsWith("evm:")) {
+    const normalized = value.toLowerCase();
+    if (kind === "channelId") return EVM_CHANNEL_ID_REGEX.test(normalized);
+    return EVM_ADDRESS_REGEX.test(normalized);
+  }
+  if (chain.startsWith("solana:")) {
+    if (!BASE58_REGEX.test(value)) return false;
+    if (value.length < 32 || value.length > 44) return false;
+    try {
+      return base58Decode(value).length === 32;
+    } catch {
+      return false;
+    }
+  }
+  if (chain.startsWith("mina:")) {
+    return BASE58_REGEX.test(value) && value.length >= 32;
+  }
+  return value.length > 0;
+}
+function decodeFulfillMetadata(data, chain) {
+  if (data === void 0 || data === null || data === "") {
+    throw new StreamSwapError("FULFILL_DECODE_FAILED", "FULFILL data missing");
+  }
+  if (!isBase64(data)) {
+    throw new StreamSwapError(
+      "FULFILL_DECODE_FAILED",
+      "FULFILL data is not valid base64"
+    );
+  }
+  let jsonBytes;
+  try {
+    jsonBytes = Buffer.from(data, "base64");
+  } catch (err) {
+    throw new StreamSwapError(
+      "FULFILL_DECODE_FAILED",
+      `FULFILL data base64 decode failed: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonBytes.toString("utf8"));
+  } catch (err) {
+    throw new StreamSwapError(
+      "FULFILL_DECODE_FAILED",
+      `FULFILL data JSON parse failed: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new StreamSwapError(
+      "FULFILL_DECODE_FAILED",
+      "FULFILL metadata is not an object"
+    );
+  }
+  const obj = parsed;
+  const claim = obj["claim"];
+  const ephemeralPubkey = obj["ephemeralPubkey"];
+  if (typeof claim !== "string" || !isBase64(claim)) {
+    throw new StreamSwapError(
+      "FULFILL_DECODE_FAILED",
+      "FULFILL metadata.claim is missing or not base64 string"
+    );
+  }
+  if (typeof ephemeralPubkey !== "string" || !HEX64_REGEX.test(ephemeralPubkey)) {
+    throw new StreamSwapError(
+      "FULFILL_DECODE_FAILED",
+      "FULFILL metadata.ephemeralPubkey is missing or not 64-char hex"
+    );
+  }
+  const result = {
+    claim,
+    ephemeralPubkey
+  };
+  if (typeof obj["claimId"] === "string") {
+    result.claimId = obj["claimId"];
+  }
+  if (obj["targetAmount"] !== void 0) {
+    const ta = obj["targetAmount"];
+    if (typeof ta !== "string" || !/^(0|[1-9]\d*)$/.test(ta)) {
+      throw new StreamSwapError(
+        "FULFILL_DECODE_FAILED",
+        "FULFILL metadata.targetAmount must be a non-negative integer decimal string"
+      );
+    }
+    result.targetAmount = ta;
+  }
+  const channelId = obj["channelId"];
+  if (typeof channelId === "string" && (!chain || validateChainAddress(channelId, chain, "channelId"))) {
+    result.channelId = channelId;
+  }
+  const nonce = obj["nonce"];
+  if (typeof nonce === "string" && DECIMAL_UINT_REGEX.test(nonce)) {
+    result.nonce = nonce;
+  }
+  const cumulativeAmount = obj["cumulativeAmount"];
+  if (typeof cumulativeAmount === "string" && DECIMAL_UINT_REGEX.test(cumulativeAmount)) {
+    result.cumulativeAmount = cumulativeAmount;
+  }
+  const recipient = obj["recipient"];
+  if (typeof recipient === "string" && recipient.length > 0) {
+    result.recipient = recipient;
+  }
+  const millSignerAddress = obj["millSignerAddress"];
+  if (typeof millSignerAddress === "string" && (!chain || validateChainAddress(millSignerAddress, chain, "address"))) {
+    result.millSignerAddress = millSignerAddress;
+  }
+  return result;
+}
+var Deferred = class {
+  promise;
+  resolve;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- mirror Promise constructor
+  reject;
+  constructor() {
+    this.promise = new Promise((res, rej) => {
+      this.resolve = res;
+      this.reject = rej;
+    });
+  }
+};
+var noop2 = () => void 0;
+var NOOP_LOGGER2 = {
+  debug: noop2,
+  info: noop2,
+  warn: noop2,
+  error: noop2
+};
+function validateParams(params) {
+  if (typeof params.totalAmount !== "bigint" || params.totalAmount <= 0n) {
+    throw new StreamSwapError(
+      "INVALID_AMOUNT",
+      `totalAmount must be a positive bigint, got ${String(params.totalAmount)}`
+    );
+  }
+  const hasCount = params.packetCount !== void 0;
+  const hasAmounts = params.packetAmounts !== void 0;
+  if (hasCount === hasAmounts) {
+    throw new StreamSwapError(
+      "INVALID_CHUNKING",
+      "Exactly one of packetCount or packetAmounts must be provided"
+    );
+  }
+  if (hasCount) {
+    const c = params.packetCount;
+    if (!Number.isInteger(c) || c <= 0) {
+      throw new StreamSwapError(
+        "INVALID_CHUNKING",
+        `packetCount must be a positive integer, got ${c}`
+      );
+    }
+    if (BigInt(c) > params.totalAmount) {
+      throw new StreamSwapError(
+        "INVALID_CHUNKING",
+        `packetCount (${c}) exceeds totalAmount (${params.totalAmount}); per-packet amount would be < 1 micro-unit`
+      );
+    }
+  } else {
+    const arr = params.packetAmounts;
+    if (!Array.isArray(arr) || arr.length === 0) {
+      throw new StreamSwapError(
+        "INVALID_CHUNKING",
+        "packetAmounts must be a non-empty array"
+      );
+    }
+    let sum = 0n;
+    for (const a of arr) {
+      if (typeof a !== "bigint" || a <= 0n) {
+        throw new StreamSwapError(
+          "INVALID_CHUNKING",
+          `packetAmounts entries must be positive bigint, got ${String(a)}`
+        );
+      }
+      sum += a;
+    }
+    if (sum !== params.totalAmount) {
+      throw new StreamSwapError(
+        "INVALID_CHUNKING",
+        `sum(packetAmounts) (${sum}) !== totalAmount (${params.totalAmount})`
+      );
+    }
+  }
+  if (!(params.senderSecretKey instanceof Uint8Array) || params.senderSecretKey.length !== 32) {
+    throw new StreamSwapError(
+      "INVALID_STATE",
+      "senderSecretKey must be a 32-byte Uint8Array"
+    );
+  }
+  if (typeof params.millPubkey !== "string" || !HEX64_REGEX.test(params.millPubkey)) {
+    throw new StreamSwapError(
+      "INVALID_STATE",
+      "millPubkey must be a 64-char lowercase hex string"
+    );
+  }
+  if (!params.pair || typeof params.pair !== "object") {
+    throw new StreamSwapError("INVALID_PAIR", "pair is required");
+  }
+  if (!params.pair.from || typeof params.pair.from !== "object" || typeof params.pair.from.assetCode !== "string" || typeof params.pair.from.assetScale !== "number" || typeof params.pair.from.chain !== "string") {
+    throw new StreamSwapError(
+      "INVALID_PAIR",
+      "pair.from must have { assetCode: string, assetScale: number, chain: string }"
+    );
+  }
+  if (!params.pair.to || typeof params.pair.to !== "object" || typeof params.pair.to.assetCode !== "string" || typeof params.pair.to.assetScale !== "number" || typeof params.pair.to.chain !== "string") {
+    throw new StreamSwapError(
+      "INVALID_PAIR",
+      "pair.to must have { assetCode: string, assetScale: number, chain: string }"
+    );
+  }
+  if (typeof params.pair.rate !== "string" || !RATE_REGEX2.test(params.pair.rate)) {
+    throw new StreamSwapError(
+      "INVALID_PAIR",
+      `pair.rate must match ${RATE_REGEX2}, got ${params.pair.rate}`
+    );
+  }
+  try {
+    applyRate({
+      sourceAmount: 1n,
+      fromScale: params.pair.from.assetScale,
+      toScale: params.pair.to.assetScale,
+      rate: params.pair.rate
+    });
+  } catch (err) {
+    throw new StreamSwapError(
+      "INVALID_PAIR",
+      `pair failed applyRate sanity check: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  if (params.rateDeviationThreshold !== void 0 && (typeof params.rateDeviationThreshold !== "number" || !Number.isFinite(params.rateDeviationThreshold) || params.rateDeviationThreshold < 0)) {
+    throw new StreamSwapError(
+      "INVALID_STATE",
+      `rateDeviationThreshold must be a non-negative finite number, got ${params.rateDeviationThreshold}`
+    );
+  }
+  if (typeof params.chainRecipient !== "string" || params.chainRecipient.length === 0) {
+    throw new StreamSwapError(
+      "INVALID_STATE",
+      "chainRecipient must be a non-empty string (sender payout address for pair.to.chain)"
+    );
+  }
+  if (!validateChainAddress(
+    params.chainRecipient,
+    params.pair.to.chain,
+    "address"
+  )) {
+    throw new StreamSwapError(
+      "INVALID_CHAIN_RECIPIENT",
+      `chainRecipient ${params.chainRecipient} is malformed for chain ${params.pair.to.chain}`
+    );
+  }
+}
+async function streamSwap(params) {
+  return streamSwapControlled(params).result;
+}
+function streamSwapControlled(params) {
+  validateParams(params);
+  const logger = params.logger ?? NOOP_LOGGER2;
+  const schedule = params.packetAmounts ? [...params.packetAmounts] : chunkAmount(params.totalAmount, params.packetCount);
+  const frozenPair = Object.freeze({
+    from: Object.freeze({ ...params.pair.from }),
+    to: Object.freeze({ ...params.pair.to }),
+    rate: params.pair.rate
+  });
+  const senderPubkey = getPublicKey3(params.senderSecretKey);
+  let streamState = "running";
+  let resumeDeferred = null;
+  const controller = {
+    pause() {
+      if (streamState === "running") {
+        streamState = "paused";
+      }
+    },
+    resume() {
+      if (streamState === "paused") {
+        streamState = "running";
+        if (resumeDeferred) {
+          resumeDeferred.resolve("resume");
+          resumeDeferred = null;
+        }
+      } else if (streamState === "running") {
+      } else {
+        throw new StreamSwapError(
+          "INVALID_STATE",
+          `Cannot resume from state "${streamState}"`
+        );
+      }
+    },
+    stop() {
+      if (streamState === "completed" || streamState === "failed") return;
+      const prev = streamState;
+      streamState = "stopped";
+      if (prev === "paused" && resumeDeferred) {
+        resumeDeferred.resolve("stop");
+        resumeDeferred = null;
+      }
+    },
+    get state() {
+      return streamState;
+    }
+  };
+  const result = runLoop(
+    params,
+    frozenPair,
+    schedule,
+    senderPubkey,
+    logger,
+    () => streamState,
+    (v) => {
+      streamState = v;
+    },
+    () => {
+      if (streamState !== "paused") return Promise.resolve("resume");
+      if (!resumeDeferred) resumeDeferred = new Deferred();
+      return resumeDeferred.promise;
+    }
+  );
+  return { result, controller };
+}
+async function runLoop(params, pair, schedule, senderPubkey, logger, getState, setState, waitForResumeOrStop) {
+  const claims = [];
+  const rejections = [];
+  const errors = [];
+  let cumulativeSource = 0n;
+  let cumulativeTarget = 0n;
+  let packetsSent = 0;
+  let abortReason = "complete";
+  const totalPackets = schedule.length;
+  const isAborted = () => params.signal?.aborted === true;
+  packetLoop: for (let packetIndex = 0; packetIndex < totalPackets; packetIndex++) {
+    if (isAborted()) {
+      abortReason = "aborted";
+      break;
+    }
+    if (getState() === "stopped") {
+      abortReason = "stopped";
+      break;
+    }
+    if (getState() === "paused") {
+      const resumedBy = await waitForResumeOrStop();
+      if (resumedBy === "stop" || getState() === "stopped") {
+        abortReason = "stopped";
+        break;
+      }
+      if (isAborted()) {
+        abortReason = "aborted";
+        break;
+      }
+    }
+    const sourceAmount = schedule[packetIndex];
+    if (sourceAmount === void 0) {
+      throw new StreamSwapError(
+        "INVALID_STATE",
+        `schedule[${packetIndex}] is undefined; schedule was mutated mid-stream`
+      );
+    }
+    const nonce = new Uint8Array(16);
+    getRandomValues(nonce);
+    const rumor = buildSwapRumor({
+      senderPubkey,
+      pair,
+      sourceAmount,
+      packetIndex: packetIndex + 1,
+      totalPackets,
+      nonce,
+      createdAt: Math.floor(Date.now() / 1e3),
+      chainRecipient: params.chainRecipient
+    });
+    let toonData;
+    try {
+      const wrapped = wrapSwapPacketToToon({
+        rumor,
+        senderSecretKey: params.senderSecretKey,
+        recipientPubkey: params.millPubkey,
+        destination: params.millIlpAddress,
+        amount: sourceAmount
+      });
+      toonData = new Uint8Array(Buffer.from(wrapped.ilpPrepare.data, "base64"));
+    } catch (err) {
+      logger.error({
+        event: "stream_swap.wrap_failed",
+        packetIndex,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      errors.push({
+        packetIndex,
+        cause: err instanceof Error ? err : new Error(String(err))
+      });
+      continue;
+    }
+    let sendResult;
+    try {
+      sendResult = await params.client.sendSwapPacket({
+        destination: params.millIlpAddress,
+        amount: sourceAmount,
+        toonData,
+        timeout: params.packetTimeoutMs ?? 3e4,
+        claim: params.claim
+      });
+      packetsSent += 1;
+    } catch (err) {
+      logger.error({
+        event: "stream_swap.send_failed",
+        packetIndex,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      errors.push({
+        packetIndex,
+        cause: err instanceof Error ? err : new Error(String(err))
+      });
+      continue;
+    }
+    if (!sendResult.accepted) {
+      const code = sendResult.code ?? "F00";
+      const message = sendResult.message ?? "rejected";
+      logger.warn({
+        event: "stream_swap.packet_rejected",
+        packetIndex,
+        code,
+        message
+      });
+      rejections.push({ packetIndex, sourceAmount, code, message });
+      continue;
+    }
+    let metadata;
+    try {
+      metadata = decodeFulfillMetadata(sendResult.data, pair.to.chain);
+    } catch (err) {
+      logger.error({
+        event: "stream_swap.fulfill_decode_failed",
+        packetIndex,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      errors.push({
+        packetIndex,
+        cause: err instanceof Error ? err : new Error(String(err))
+      });
+      continue;
+    }
+    const isEvmTarget = pair.to.chain.startsWith("evm:");
+    const recipientMatches = metadata.recipient === void 0 || (isEvmTarget ? metadata.recipient.toLowerCase() === params.chainRecipient.toLowerCase() : metadata.recipient === params.chainRecipient);
+    if (!recipientMatches) {
+      logger.warn({
+        event: "stream_swap.recipient_mismatch",
+        packetIndex,
+        expected: params.chainRecipient,
+        actual: metadata.recipient
+      });
+      rejections.push({
+        packetIndex,
+        sourceAmount,
+        code: "MILL_RECIPIENT_MISMATCH",
+        message: `Mill echoed recipient ${metadata.recipient} but sender expected ${params.chainRecipient}`
+      });
+      continue;
+    }
+    let claimBytes;
+    try {
+      const ciphertext = new Uint8Array(Buffer.from(metadata.claim, "base64"));
+      claimBytes = decryptFulfillClaim({
+        ciphertext,
+        ephemeralPubkey: metadata.ephemeralPubkey,
+        recipientSecretKey: params.senderSecretKey
+      });
+    } catch (err) {
+      logger.error({
+        event: "stream_swap.decrypt_failed",
+        packetIndex,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      errors.push({
+        packetIndex,
+        cause: err instanceof Error ? err : new Error(String(err))
+      });
+      continue;
+    }
+    if (claimBytes.length === 0) {
+      logger.warn({
+        event: "stream_swap.empty_claim_bytes",
+        packetIndex
+      });
+    }
+    const expectedTargetAmount = applyRate({
+      sourceAmount,
+      fromScale: pair.from.assetScale,
+      toScale: pair.to.assetScale,
+      rate: pair.rate
+    });
+    const targetAmount = metadata.targetAmount !== void 0 ? BigInt(metadata.targetAmount) : expectedTargetAmount;
+    let rateDeviation = 0;
+    if (expectedTargetAmount > 0n) {
+      const diff = targetAmount >= expectedTargetAmount ? targetAmount - expectedTargetAmount : expectedTargetAmount - targetAmount;
+      const scaled = diff * 1000000n / expectedTargetAmount;
+      rateDeviation = Number(scaled) / 1e6;
+    }
+    const advertisedRate = parseFloat(pair.rate);
+    let effectiveRate;
+    if (targetAmount === expectedTargetAmount) {
+      effectiveRate = advertisedRate;
+    } else {
+      const signedDeviation = targetAmount >= expectedTargetAmount ? rateDeviation : -rateDeviation;
+      effectiveRate = advertisedRate * (1 + signedDeviation);
+    }
+    if (!Number.isFinite(effectiveRate)) {
+      effectiveRate = advertisedRate;
+    }
+    cumulativeSource += sourceAmount;
+    cumulativeTarget += targetAmount;
+    const accumulated = {
+      packetIndex,
+      sourceAmount,
+      targetAmount,
+      claimBytes,
+      millEphemeralPubkey: metadata.ephemeralPubkey,
+      pair,
+      receivedAt: Date.now()
+    };
+    if (metadata.claimId !== void 0) accumulated.claimId = metadata.claimId;
+    if (metadata.channelId !== void 0)
+      accumulated.channelId = metadata.channelId;
+    if (metadata.nonce !== void 0) accumulated.nonce = metadata.nonce;
+    if (metadata.cumulativeAmount !== void 0)
+      accumulated.cumulativeAmount = metadata.cumulativeAmount;
+    if (metadata.recipient !== void 0)
+      accumulated.recipient = metadata.recipient;
+    if (metadata.millSignerAddress !== void 0)
+      accumulated.millSignerAddress = metadata.millSignerAddress;
+    claims.push(accumulated);
+    logger.debug({
+      event: "stream_swap.packet_accepted",
+      packetIndex,
+      sourceAmount: sourceAmount.toString(),
+      targetAmount: targetAmount.toString()
+    });
+    if (params.onPacket) {
+      const progress = Object.freeze({
+        index: packetIndex,
+        total: totalPackets,
+        sourceAmount,
+        targetAmount,
+        advertisedRate: pair.rate,
+        effectiveRate,
+        rateDeviation,
+        cumulativeSource,
+        cumulativeTarget,
+        state: getState() === "paused" ? "paused" : getState() === "stopped" ? "stopped" : "running"
+      });
+      try {
+        const maybePromise = params.onPacket(progress);
+        if (maybePromise && typeof maybePromise.then === "function") {
+          await maybePromise;
+        }
+      } catch (err) {
+        logger.warn({
+          event: "stream_swap.callback_threw",
+          packetIndex,
+          error: err instanceof Error ? err.message : String(err)
+        });
+        errors.push({
+          packetIndex,
+          cause: err instanceof Error ? err : new Error(String(err))
+        });
+        abortReason = "callback-throw";
+        break packetLoop;
+      }
+    }
+    if (isAborted()) {
+      abortReason = "aborted";
+      break;
+    }
+    if (getState() === "stopped") {
+      abortReason = "stopped";
+      break;
+    }
+    if (params.rateDeviationThreshold !== void 0 && rateDeviation > params.rateDeviationThreshold) {
+      abortReason = "rate-deviation";
+      break;
+    }
+  }
+  let finalState;
+  if (abortReason === "aborted" || abortReason === "stopped") {
+    finalState = "stopped";
+  } else if (claims.length === 0 && (rejections.length > 0 || errors.length > 0)) {
+    finalState = "failed";
+    if (abortReason === "complete" && rejections.length > 0 && errors.length === 0) {
+      abortReason = "all-rejected";
+    }
+  } else {
+    finalState = "completed";
+  }
+  setState(finalState);
+  return {
+    state: finalState,
+    claims,
+    rejections,
+    errors,
+    abortReason,
+    cumulativeSource,
+    cumulativeTarget,
+    packetsSent,
+    packetsScheduled: totalPackets
+  };
+}
+function getRandomValues(buf) {
+  const g = globalThis;
+  if (g.crypto && typeof g.crypto.getRandomValues === "function") {
+    g.crypto.getRandomValues(buf);
+    return buf;
+  }
+  const nodeCrypto = __require2("crypto");
+  if (nodeCrypto.webcrypto?.getRandomValues) {
+    nodeCrypto.webcrypto.getRandomValues(buf);
+    return buf;
+  }
+  if (nodeCrypto.randomFillSync) {
+    nodeCrypto.randomFillSync(buf);
+    return buf;
+  }
+  throw new StreamSwapError(
+    "INVALID_STATE",
+    "No crypto.getRandomValues available in this environment"
+  );
+}
+
+// src/daemon/apex-channel-store.ts
+import { mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+function key(destination, chain) {
+  return `${destination}|${chain}`;
+}
+function readStore(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function loadApexChannel(path, destination, chain) {
+  return readStore(path)[key(destination, chain)] ?? null;
+}
+function saveApexChannel(path, destination, chain, record) {
+  const store = readStore(path);
+  store[key(destination, chain)] = record;
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, JSON.stringify(store, null, 2), { mode: 384 });
+}
+
+// src/daemon/targets-store.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3, join as join2 } from "path";
+function defaultTargetsPath() {
+  return join2(configDir(), "targets.json");
+}
+function loadTargets(path = defaultTargetsPath()) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return { relays: [], apexes: [] };
+  }
+  return {
+    relays: Array.isArray(parsed.relays) ? parsed.relays : [],
+    apexes: Array.isArray(parsed.apexes) ? parsed.apexes : []
+  };
+}
+function write(path, data) {
+  mkdirSync3(dirname3(path), { recursive: true });
+  writeFileSync3(path, JSON.stringify(data, null, 2), { mode: 384 });
+}
+function saveRelayTarget(relayUrl, path = defaultTargetsPath()) {
+  const store = loadTargets(path);
+  if (!store.relays.some((r) => r.relayUrl === relayUrl)) {
+    store.relays.push({ relayUrl });
+    write(path, store);
+  }
+}
+function removeRelayTarget(relayUrl, path = defaultTargetsPath()) {
+  const store = loadTargets(path);
+  const next = store.relays.filter((r) => r.relayUrl !== relayUrl);
+  if (next.length === store.relays.length) return false;
+  store.relays = next;
+  write(path, store);
+  return true;
+}
+function saveApexTarget(target, path = defaultTargetsPath()) {
+  const store = loadTargets(path);
+  store.apexes = store.apexes.filter((a) => a.btpUrl !== target.btpUrl);
+  store.apexes.push(target);
+  write(path, store);
+}
+function removeApexTarget(btpUrl, path = defaultTargetsPath()) {
+  const store = loadTargets(path);
+  const next = store.apexes.filter((a) => a.btpUrl !== btpUrl);
+  if (next.length === store.apexes.length) return false;
+  store.apexes = next;
+  write(path, store);
+  return true;
+}
+
+// src/daemon/apex-discovery.ts
+var ApexDiscoveryError = class extends Error {
+  constructor(message, retryable = false) {
+    super(message);
+    this.retryable = retryable;
+    this.name = "ApexDiscoveryError";
+  }
+};
+async function discoverApex(params) {
+  const { relay, ilpAddress, pubkey, chain, childPeers } = params;
+  const timeoutMs = params.timeoutMs ?? 15e3;
+  const pollMs = params.pollMs ?? 250;
+  const subId = relay.subscribe(
+    [
+      {
+        kinds: [ILP_PEER_INFO_KIND],
+        ...pubkey ? { authors: [pubkey] } : {}
+      }
+    ],
+    `apex-discovery-${ilpAddress}`
+  );
+  try {
+    const deadline = Date.now() + timeoutMs;
+    let cursor = 0;
+    while (Date.now() < deadline) {
+      const { events, cursor: next } = relay.getEvents({ cursor });
+      cursor = next;
+      const match = events.find((e) => matchesApex(e, ilpAddress, pubkey));
+      if (match) return mapAnnouncement(match, { chain, childPeers });
+      await delay(pollMs);
+    }
+    throw new ApexDiscoveryError(
+      `Timed out after ${timeoutMs}ms waiting for the apex kind:${ILP_PEER_INFO_KIND} announcement for "${ilpAddress}" on the relay. Is the relay reachable and the apex online?`,
+      true
+      // retryable: the apex may just be slow/offline
+    );
+  } finally {
+    relay.unsubscribe(subId);
+  }
+}
+function matchesApex(event, ilpAddress, pubkey) {
+  if (event.kind !== ILP_PEER_INFO_KIND) return false;
+  if (pubkey && event.pubkey !== pubkey) return false;
+  if (isEventExpired(event)) return false;
+  try {
+    const info = parseIlpPeerInfo(event);
+    const addrs = info.ilpAddresses ?? [info.ilpAddress];
+    return addrs.includes(ilpAddress) || info.ilpAddress === ilpAddress;
+  } catch {
+    return false;
+  }
+}
+function mapAnnouncement(event, opts) {
+  const info = parseIlpPeerInfo(event);
+  const chains = info.supportedChains ?? [];
+  if (chains.length === 0) {
+    throw new ApexDiscoveryError(
+      `Apex "${info.ilpAddress}" announced no supportedChains \u2014 cannot settle.`
+    );
+  }
+  const chainKey = (opts.chain ? chains.find((c) => c.split(":")[0] === opts.chain) : void 0) ?? chains[0];
+  if (!chainKey) {
+    throw new ApexDiscoveryError(
+      `Apex "${info.ilpAddress}" announced no usable settlement chain.`
+    );
+  }
+  const family = chainKey.split(":")[0];
+  const settlementAddress = info.settlementAddresses?.[chainKey];
+  if (!settlementAddress) {
+    throw new ApexDiscoveryError(
+      `Apex "${info.ilpAddress}" announced no settlementAddress for chain "${chainKey}".`
+    );
+  }
+  const btpUrl = info.btpEndpoint;
+  if (!btpUrl) {
+    throw new ApexDiscoveryError(
+      `Apex "${info.ilpAddress}" announced an empty btpEndpoint \u2014 cannot open a BTP session.`
+    );
+  }
+  const negotiation = {
+    destination: info.ilpAddress,
+    peerId: info.ilpAddress.split(".").at(-1) ?? info.ilpAddress,
+    chain: family,
+    chainKey,
+    // EVM chainKeys are `evm:<network>:<chainId>`; non-EVM carry no numeric id.
+    chainId: family === "evm" ? Number(chainKey.split(":")[2] ?? 0) : 0,
+    settlementAddress,
+    ...info.preferredTokens?.[chainKey] ? { tokenAddress: info.preferredTokens[chainKey] } : {},
+    ...info.tokenNetworks?.[chainKey] ? { tokenNetwork: info.tokenNetworks[chainKey] } : {}
+  };
+  return {
+    btpUrl,
+    negotiation,
+    ...opts.childPeers && opts.childPeers.length > 0 ? { apexChildPeers: opts.childPeers } : {}
+  };
+}
+function delay(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/daemon/client-runner.ts
+var MERGED_BUFFER = 5e3;
+var ClientRunner = class {
+  config;
+  createClient;
+  createRelay;
+  startReadProxy;
+  log;
+  targetsPath;
+  startedAt = Date.now();
+  /** Apex write targets, keyed by btpUrl. */
+  apexes = /* @__PURE__ */ new Map();
+  /** Relay read targets, keyed by relayUrl. */
+  relays = /* @__PURE__ */ new Map();
+  /** Runner-level merged read buffer across all relays (de-duped by event.id). */
+  merged = [];
+  mergedSeen = /* @__PURE__ */ new Set();
+  mergedSeq = 0;
+  /**
+   * Fan-out subscriptions (no relayUrl restriction): replayed onto relays added
+   * later so a new relay immediately participates in existing reads.
+   */
+  fanoutSubs = /* @__PURE__ */ new Map();
+  subIdCounter = 0;
+  defaultBtpUrl;
+  defaultRelayUrl;
+  /** Teardown for the daemon-managed read proxy (btp-direct + relay-`.anyone`). */
+  stopReadProxy;
+  readProxyError;
+  stopped = false;
+  started = false;
+  constructor(deps) {
+    this.config = deps.config;
+    this.createClient = deps.createClient;
+    this.log = deps.logger ?? (() => void 0);
+    if (deps.targetsPath !== void 0) this.targetsPath = deps.targetsPath;
+    this.defaultBtpUrl = deps.config.toonClientConfig.btpUrl ?? "";
+    this.defaultRelayUrl = deps.config.relayUrl;
+    this.createRelay = deps.createRelay ?? ((opts) => new RelaySubscription({
+      relayUrl: opts.relayUrl,
+      ...opts.socksProxy ? { socksProxy: opts.socksProxy } : {},
+      ...opts.logger ? { logger: opts.logger } : {},
+      onEvent: opts.onEvent,
+      // The TOON relay sends events TOON-encoded (text) on reads, not JSON.
+      decodeEvent: (raw) => decodeEventFromToon(new TextEncoder().encode(raw))
+    }));
+    this.startReadProxy = deps.startReadProxy ?? ((opts) => startManagedAnonProxy({
+      socksPort: opts.socksPort,
+      ...opts.log ? { log: opts.log } : {}
+    }));
+    this.registerRelay(this.defaultRelayUrl, this.config.socksProxy);
+    const defaultApex = this.makeApex({
+      btpUrl: this.defaultBtpUrl,
+      client: this.createClient(this.config.toonClientConfig),
+      ...this.config.apex ? { negotiation: this.config.apex } : {},
+      childPeers: this.config.apexChildPeers ?? [],
+      destination: this.config.destination,
+      chain: this.config.chain,
+      channelStorePath: this.config.toonClientConfig.channelStorePath ?? this.apexChannelStorePathFor(this.defaultBtpUrl),
+      feePerEvent: this.config.feePerEvent,
+      isDefault: true
+    });
+    this.apexes.set(defaultApex.btpUrl, defaultApex);
+  }
+  /**
+   * Start the live connections: the shared read proxy, every relay socket, the
+   * default apex bootstrap (non-blocking), then replay persisted dynamic
+   * targets. Returns immediately; apexes become ready asynchronously.
+   */
+  start() {
+    if (this.started) return;
+    this.started = true;
+    if (this.config.manageReadProxy) void this.bringUpReadProxy();
+    for (const relay of this.relays.values()) relay.start();
+    void this.bootstrap();
+    this.replayPersistedTargets();
+  }
+  /** Await the default apex's bootstrap (kicking it off if not already running). */
+  bootstrap() {
+    const apex = this.apexes.get(this.defaultBtpUrl);
+    if (!apex) return Promise.resolve();
+    return this.bootstrapApex(apex);
+  }
+  // ── Relays (reads) ─────────────────────────────────────────────────────────
+  /**
+   * Build + register a relay (idempotent by URL), wiring its events into the
+   * merged buffer and replaying active fan-out subscriptions. Does NOT start the
+   * socket — callers start it (so construction stays side-effect-free for tests).
+   */
+  registerRelay(relayUrl, socksProxy) {
+    const existing = this.relays.get(relayUrl);
+    if (existing) return existing;
+    const relay = this.createRelay({
+      relayUrl,
+      ...socksProxy ? { socksProxy } : {},
+      logger: this.log,
+      onEvent: (subId, event) => this.pushMerged(relayUrl, subId, event)
+    });
+    this.relays.set(relayUrl, relay);
+    for (const [subId, filters] of this.fanoutSubs)
+      relay.subscribe(filters, subId);
+    return relay;
+  }
+  /**
+   * Add a relay read target at runtime. `.anyone` relays reuse the managed read
+   * proxy (started here if needed). Persisted unless `persist` is false.
+   */
+  async addRelay(relayUrl, persist = true) {
+    if (this.relays.has(relayUrl)) return;
+    let socksProxy = this.config.socksProxy;
+    if (isAnyoneHost(relayUrl) && !socksProxy) {
+      await this.ensureReadProxy();
+      socksProxy = `socks5h://127.0.0.1:${this.config.readProxySocksPort ?? 9050}`;
+    }
+    const relay = this.registerRelay(relayUrl, socksProxy);
+    relay.start();
+    if (persist) saveRelayTarget(relayUrl, this.targetsPath);
+  }
+  /** Remove a relay read target. The config-seeded default cannot be removed. */
+  removeRelay(relayUrl) {
+    if (relayUrl === this.defaultRelayUrl) {
+      throw new TargetError("Cannot remove the default (config-seeded) relay.");
+    }
+    const relay = this.relays.get(relayUrl);
+    if (!relay) throw new TargetError(`No such relay: ${relayUrl}`);
+    relay.close();
+    this.relays.delete(relayUrl);
+    this.merged = this.merged.filter((m) => {
+      if (m.relayUrl === relayUrl) {
+        this.mergedSeen.delete(m.event.id);
+        return false;
+      }
+      return true;
+    });
+    removeRelayTarget(relayUrl, this.targetsPath);
+  }
+  /** Mirror a newly-buffered relay event into the merged cross-relay buffer. */
+  pushMerged(relayUrl, subId, event) {
+    if (this.mergedSeen.has(event.id)) return;
+    this.mergedSeen.add(event.id);
+    this.merged.push({ seq: ++this.mergedSeq, relayUrl, subId, event });
+    if (this.merged.length > MERGED_BUFFER) {
+      const evicted = this.merged.shift();
+      if (evicted) this.mergedSeen.delete(evicted.event.id);
+    }
+  }
+  /**
+   * Register a free-read subscription. With no `relayUrl` it FANS OUT across
+   * every relay (and onto relays added later); with one it targets that relay.
+   */
+  subscribe(req) {
+    const subId = req.subId ?? `sub-${++this.subIdCounter}`;
+    const filters = Array.isArray(req.filters) ? req.filters : [req.filters];
+    const targets = req.relayUrl ? [req.relayUrl] : [...this.relays.keys()];
+    if (req.relayUrl && !this.relays.has(req.relayUrl)) {
+      throw new TargetError(`No such relay: ${req.relayUrl}`);
+    }
+    if (!req.relayUrl) this.fanoutSubs.set(subId, filters);
+    for (const url of targets) this.relays.get(url)?.subscribe(filters, subId);
+    return { subId, relays: targets };
+  }
+  /** Drain merged events newer than the cursor (free read), optionally scoped. */
+  getEvents(query) {
+    const after = query.cursor ?? 0;
+    const limit = query.limit ?? 200;
+    const matches = this.merged.filter(
+      (m) => m.seq > after && (query.subId === void 0 || m.subId === query.subId) && (query.relayUrl === void 0 || m.relayUrl === query.relayUrl)
+    );
+    const page = matches.slice(0, limit);
+    const hasMore = matches.length > page.length;
+    const last = page.at(-1);
+    return {
+      events: page.map((m) => m.event),
+      cursor: last ? last.seq : after,
+      hasMore
+    };
+  }
+  // ── Apexes (writes) ──────────────────────────────────────────────────────
+  makeApex(init) {
+    return {
+      ...init,
+      ready: false,
+      bootstrapping: false
+    };
+  }
+  /**
+   * Bootstrap one apex (memoized): start, inject negotiation, open/resume the
+   * channel, route child peers. Concurrent callers await the same in-flight
+   * work rather than re-running it.
+   */
+  bootstrapApex(apex) {
+    if (apex.ready) return Promise.resolve();
+    if (!apex.bootstrapPromise) {
+      apex.bootstrapPromise = this.doBootstrapApex(apex);
+    }
+    return apex.bootstrapPromise;
+  }
+  async doBootstrapApex(apex) {
+    apex.bootstrapping = true;
+    try {
+      await apex.client.start();
+      this.injectApexNegotiation(apex);
+      apex.apexChannelId = await this.openOrResumeApexChannel(apex);
+      this.routeChildPeersThroughApexChannel(apex);
+      apex.ready = true;
+      apex.lastError = void 0;
+      this.log(
+        `[runner] apex ${apex.btpUrl} ready; channel ${apex.apexChannelId}`
+      );
+    } catch (err) {
+      apex.lastError = err instanceof Error ? err.message : String(err);
+      this.log(
+        `[runner] apex ${apex.btpUrl} bootstrap failed: ${apex.lastError}`
+      );
+    } finally {
+      apex.bootstrapping = false;
+    }
+  }
+  /**
+   * Add an apex write target. Settlement params are discovered by reading the
+   * apex's kind:10032 off the given relay (added first if unknown). Persisted.
+   */
+  async addApex(req) {
+    await this.addRelay(req.relayUrl);
+    const relay = this.relays.get(req.relayUrl);
+    if (!relay) throw new TargetError(`Relay unavailable: ${req.relayUrl}`);
+    const discovered = await discoverApex({
+      relay,
+      ilpAddress: req.ilpAddress,
+      ...req.pubkey ? { pubkey: req.pubkey } : {},
+      ...req.chain ? { chain: req.chain } : {},
+      ...req.childPeers ? { childPeers: req.childPeers } : {}
+    });
+    const feePerEvent = req.feePerEvent !== void 0 ? BigInt(req.feePerEvent) : this.config.feePerEvent;
+    await this.instantiateApex(
+      {
+        btpUrl: discovered.btpUrl,
+        negotiation: discovered.negotiation,
+        ...discovered.apexChildPeers ? { apexChildPeers: discovered.apexChildPeers } : {},
+        feePerEvent: req.feePerEvent ?? feePerEvent.toString(),
+        discoveredFrom: req.relayUrl
+      },
+      true
+    );
+    const apex = this.apexes.get(discovered.btpUrl);
+    if (!apex) {
+      throw new TargetError(
+        `Apex ${discovered.btpUrl} failed to register after discovery.`
+      );
+    }
+    return {
+      btpUrl: apex.btpUrl,
+      destination: apex.destination,
+      chain: apex.chain,
+      ready: apex.ready
+    };
+  }
+  /** Build + register + bootstrap an apex from a (persisted) target record. */
+  async instantiateApex(target, persist) {
+    if (this.apexes.has(target.btpUrl)) return;
+    const clientConfig = this.deriveApexClientConfig(
+      target.btpUrl,
+      target.negotiation.destination
+    );
+    const apex = this.makeApex({
+      btpUrl: target.btpUrl,
+      client: this.createClient(clientConfig),
+      negotiation: target.negotiation,
+      childPeers: target.apexChildPeers ?? [],
+      destination: target.negotiation.destination,
+      chain: target.negotiation.chain,
+      channelStorePath: this.apexChannelStorePathFor(target.btpUrl),
+      feePerEvent: BigInt(target.feePerEvent ?? this.config.feePerEvent),
+      isDefault: false
+    });
+    this.apexes.set(apex.btpUrl, apex);
+    if (persist) saveApexTarget(target, this.targetsPath);
+    await this.bootstrapApex(apex);
+  }
+  /** Remove an apex write target. The config-seeded default cannot be removed. */
+  async removeApex(btpUrl) {
+    if (btpUrl === this.defaultBtpUrl) {
+      throw new TargetError("Cannot remove the default (config-seeded) apex.");
+    }
+    const apex = this.apexes.get(btpUrl);
+    if (!apex) throw new TargetError(`No such apex: ${btpUrl}`);
+    try {
+      await apex.client.stop();
+    } catch (err) {
+      this.log(
+        `[runner] apex ${btpUrl} stop error: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    this.apexes.delete(btpUrl);
+    removeApexTarget(btpUrl, this.targetsPath);
+  }
+  /** Derive a per-apex ToonClientConfig from the default (shared identity/transport). */
+  deriveApexClientConfig(btpUrl, destination) {
+    const base = this.config.toonClientConfig;
+    return {
+      ...base,
+      btpUrl,
+      destinationAddress: destination,
+      // Distinct nonce-watermark store per apex so parallel ChannelManagers in
+      // this process never race a shared channels.json.
+      channelStorePath: this.apexChannelStorePathFor(btpUrl),
+      ilpInfo: { ...base.ilpInfo, btpEndpoint: btpUrl }
+    };
+  }
+  apexChannelStorePathFor(btpUrl) {
+    return `${configDir()}/channels-${sanitize(btpUrl)}.json`;
+  }
+  // ── Persisted-target replay ────────────────────────────────────────────────
+  replayPersistedTargets() {
+    let store;
+    try {
+      store = loadTargets(this.targetsPath);
+    } catch (err) {
+      this.log(
+        `[runner] failed to load targets store: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return;
+    }
+    for (const r of store.relays) {
+      if (r.relayUrl === this.defaultRelayUrl) continue;
+      void this.addRelay(r.relayUrl, false).catch(
+        (err) => this.log(`[runner] replay relay ${r.relayUrl} failed: ${errMsg2(err)}`)
+      );
+    }
+    for (const a of store.apexes) {
+      if (a.btpUrl === this.defaultBtpUrl) continue;
+      void this.instantiateApex(a, false).catch(
+        (err) => this.log(`[runner] replay apex ${a.btpUrl} failed: ${errMsg2(err)}`)
+      );
+    }
+  }
+  // ── Shared read proxy ──────────────────────────────────────────────────────
+  async ensureReadProxy() {
+    if (this.stopReadProxy) return;
+    await this.bringUpReadProxy();
+  }
+  async bringUpReadProxy() {
+    if (this.stopReadProxy) return;
+    const socksPort = this.config.readProxySocksPort ?? 9050;
+    try {
+      this.log(
+        `[runner] starting managed read proxy on 127.0.0.1:${socksPort}`
+      );
+      const proxy = await this.startReadProxy({
+        socksPort,
+        log: (m) => this.log(`[anon] ${m}`)
+      });
+      if (this.stopped) {
+        await proxy.stop();
+        return;
+      }
+      this.stopReadProxy = () => proxy.stop();
+      this.readProxyError = void 0;
+      this.log("[runner] managed read proxy ready");
+    } catch (err) {
+      this.readProxyError = err instanceof Error ? err.message : String(err);
+      this.log(`[runner] managed read proxy failed: ${this.readProxyError}`);
+    }
+  }
+  // ── Channel / negotiation helpers (per-apex) ───────────────────────────────
+  /** Open the apex channel — or, on a restart, RESUME the existing one. */
+  async openOrResumeApexChannel(apex) {
+    const { destination, chain } = apex;
+    const { apexChannelStorePath } = this.config;
+    const saved = loadApexChannel(apexChannelStorePath, destination, chain);
+    const cm = apex.client.channelManager;
+    if (saved && cm && typeof cm.trackChannel === "function") {
+      cm.trackChannel(saved.channelId, saved.context);
+      this.log(
+        `[runner] resumed apex channel ${saved.channelId} (tracked, no re-deposit)`
+      );
+      return saved.channelId;
+    }
+    const channelId = await apex.client.openChannel(destination);
+    if (apex.negotiation) {
+      const a = apex.negotiation;
+      saveApexChannel(apexChannelStorePath, destination, chain, {
+        channelId,
+        context: {
+          chainType: a.chain,
+          chainId: a.chainId,
+          tokenNetworkAddress: a.tokenNetwork ?? "",
+          ...a.tokenAddress ? { tokenAddress: a.tokenAddress } : {},
+          recipient: a.settlementAddress
+        }
+      });
+    }
+    return channelId;
+  }
+  /** Inject the apex settlement negotiation directly into its ToonClient. */
+  injectApexNegotiation(apex) {
+    const a = apex.negotiation;
+    if (!a) return;
+    const negotiations = apex.client.peerNegotiations;
+    if (!(negotiations instanceof Map)) {
+      throw new Error(
+        "ToonClient.peerNegotiations layout changed \u2014 cannot inject apex negotiation"
+      );
+    }
+    negotiations.set(a.peerId, {
+      chain: a.chainKey,
+      chainType: a.chain,
+      chainId: a.chainId,
+      settlementAddress: a.settlementAddress,
+      tokenAddress: a.tokenAddress,
+      tokenNetwork: a.tokenNetwork
+    });
+    this.log(`[runner] injected apex negotiation for peer "${a.peerId}"`);
+  }
+  /** Route apex CHILD peers (dvm/mill) through the SAME apex payment channel. */
+  routeChildPeersThroughApexChannel(apex) {
+    const a = apex.negotiation;
+    if (!a || !apex.apexChannelId || apex.childPeers.length === 0) return;
+    const client = apex.client;
+    const negotiations = client.peerNegotiations;
+    const peerChannels = client.channelManager?.peerChannels;
+    if (!(negotiations instanceof Map) || !(peerChannels instanceof Map)) {
+      this.log(
+        "[runner] cannot route child peers \u2014 ToonClient internals layout changed"
+      );
+      return;
+    }
+    for (const peer of apex.childPeers) {
+      if (peer === a.peerId) continue;
+      negotiations.set(peer, {
+        chain: a.chainKey,
+        chainType: a.chain,
+        chainId: a.chainId,
+        settlementAddress: a.settlementAddress,
+        tokenAddress: a.tokenAddress,
+        tokenNetwork: a.tokenNetwork
+      });
+      peerChannels.set(peer, apex.apexChannelId);
+      this.log(
+        `[runner] routed child peer "${peer}" through apex channel ${apex.apexChannelId}`
+      );
+    }
+  }
+  // ── Status ─────────────────────────────────────────────────────────────────
+  defaultApex() {
+    return this.apexes.get(this.defaultBtpUrl);
+  }
+  /** Whether any apex has finished bootstrapping. */
+  isReady() {
+    return [...this.apexes.values()].some((a) => a.ready);
+  }
+  isBootstrapping() {
+    return [...this.apexes.values()].some((a) => a.bootstrapping);
+  }
+  getStatus() {
+    const apex = this.defaultApex();
+    const client = apex?.client;
+    const net = client?.getNetworkStatus();
+    const network = net ? ["evm", "solana", "mina"].map((c) => ({
+      chain: c,
+      ready: net[c] === "configured",
+      detail: net[c]
+    })) : void 0;
+    const relay = this.relays.get(this.defaultRelayUrl);
+    return {
+      uptimeMs: Date.now() - this.startedAt,
+      bootstrapping: apex?.bootstrapping ?? false,
+      ready: apex?.ready ?? false,
+      settlementChain: this.config.chain,
+      identity: {
+        nostrPubkey: safe(() => client?.getPublicKey()) ?? "",
+        evmAddress: safe(() => client?.getEvmAddress()),
+        solanaAddress: safe(() => client?.getSolanaAddress()),
+        minaAddress: safe(() => client?.getMinaAddress())
+      },
+      transport: {
+        type: this.config.socksProxy ? "socks5" : "direct",
+        ...this.config.socksProxy ? { socksProxy: this.config.socksProxy } : {},
+        ...apex ? { btpUrl: apex.btpUrl } : {}
+      },
+      relay: {
+        url: this.defaultRelayUrl,
+        connected: relay?.isConnected() ?? false,
+        buffered: relay?.bufferedCount() ?? 0,
+        subscriptions: relay?.activeSubscriptions() ?? [],
+        ...this.readProxyError ? { proxyError: this.readProxyError } : {}
+      },
+      ...network ? { network } : {},
+      ...apex?.lastError ? { lastError: apex.lastError } : {}
+    };
+  }
+  /** Full registry of relay + apex targets with per-target status. */
+  getTargets() {
+    const relays = [...this.relays.entries()].map(
+      ([relayUrl, r]) => ({
+        relayUrl,
+        connected: r.isConnected(),
+        buffered: r.bufferedCount(),
+        subscriptions: r.activeSubscriptions(),
+        isDefault: relayUrl === this.defaultRelayUrl
+      })
+    );
+    const apexes = [...this.apexes.values()].map((a) => ({
+      btpUrl: a.btpUrl,
+      destination: a.destination,
+      chain: a.chain,
+      ready: a.ready,
+      bootstrapping: a.bootstrapping,
+      ...a.apexChannelId ? { channelId: a.apexChannelId } : {},
+      ...a.lastError ? { lastError: a.lastError } : {},
+      isDefault: a.isDefault
+    }));
+    return { relays, apexes };
+  }
+  // ── Paid operations ──────────────────────────────────────────────────────
+  /** Pay-to-write a single event through the selected (or default) apex. */
+  async publish(req) {
+    const apex = this.selectApex(req.btpUrl);
+    this.assertApexReady(apex);
+    const channelId = apex.apexChannelId ?? await apex.client.openChannel(req.destination);
+    const fee = req.fee !== void 0 ? BigInt(req.fee) : apex.feePerEvent;
+    const claim = await apex.client.signBalanceProof(channelId, fee);
+    const result = await apex.client.publishEvent(req.event, {
+      ...req.destination ? { destination: req.destination } : {},
+      claim,
+      ilpAmount: fee
+    });
+    if (!result.success) {
+      throw new PublishRejectedError(result.error ?? "relay rejected event");
+    }
+    return {
+      eventId: result.eventId ?? req.event.id,
+      ...result.data !== void 0 ? { data: result.data } : {},
+      channelId,
+      nonce: apex.client.getChannelNonce(channelId)
+    };
+  }
+  /** Open (or return) a payment channel on the selected (or default) apex. */
+  async openChannel(destination, btpUrl) {
+    const apex = this.selectApex(btpUrl);
+    this.assertApexReady(apex);
+    const channelId = await apex.client.openChannel(
+      destination ?? apex.destination
+    );
+    if (!destination || destination === apex.destination) {
+      apex.apexChannelId = channelId;
+    }
+    return { channelId };
+  }
+  /** List tracked channels across ALL apexes with nonce + cumulative amount. */
+  getChannels() {
+    const seen = /* @__PURE__ */ new Set();
+    const channels = [];
+    for (const apex of this.apexes.values()) {
+      for (const channelId of apex.client.getTrackedChannels()) {
+        if (seen.has(channelId)) continue;
+        seen.add(channelId);
+        channels.push({
+          channelId,
+          nonce: apex.client.getChannelNonce(channelId),
+          cumulativeAmount: apex.client.getChannelCumulativeAmount(channelId).toString()
+        });
+      }
+    }
+    return { channels };
+  }
+  /** Swap source→target asset against a mill peer via the selected apex. */
+  async swap(req) {
+    const apex = this.selectApex(req.btpUrl);
+    this.assertApexReady(apex);
+    const senderSecretKey = generateSecretKey2();
+    const result = await streamSwap({
+      client: apex.client,
+      millPubkey: req.millPubkey,
+      millIlpAddress: req.destination,
+      pair: req.pair,
+      senderSecretKey,
+      chainRecipient: req.chainRecipient,
+      totalAmount: BigInt(req.amount),
+      packetCount: req.packetCount ?? 1
+    });
+    const firstReject = result.rejections[0];
+    return {
+      accepted: result.claims.length > 0,
+      packetsAccepted: result.claims.length,
+      claims: result.claims.map((c) => ({
+        sourceAmount: c.sourceAmount.toString(),
+        targetAmount: c.targetAmount.toString(),
+        claim: Buffer.from(c.claimBytes).toString("base64"),
+        ...c.channelId ? { channelId: c.channelId } : {},
+        ...c.recipient ? { recipient: c.recipient } : {},
+        ...c.millSignerAddress ? { millSignerAddress: c.millSignerAddress } : {},
+        ...c.claimId ? { claimId: c.claimId } : {},
+        ...c.nonce ? { nonce: c.nonce } : {},
+        ...c.cumulativeAmount ? { cumulativeAmount: c.cumulativeAmount } : {}
+      })),
+      cumulativeSource: result.cumulativeSource.toString(),
+      cumulativeTarget: result.cumulativeTarget.toString(),
+      state: result.state,
+      ...firstReject ? { code: firstReject.code, message: firstReject.message } : {}
+    };
+  }
+  /** Graceful teardown: close every relay + stop every apex client + read proxy. */
+  async stop() {
+    if (this.stopped) return;
+    this.stopped = true;
+    for (const relay of this.relays.values()) relay.close();
+    if (this.stopReadProxy) {
+      try {
+        await this.stopReadProxy();
+      } catch (err) {
+        this.log(`[runner] read proxy stop error: ${errMsg2(err)}`);
+      }
+      this.stopReadProxy = void 0;
+    }
+    for (const apex of this.apexes.values()) {
+      try {
+        await apex.client.stop();
+      } catch (err) {
+        this.log(`[runner] client stop error (${apex.btpUrl}): ${errMsg2(err)}`);
+      }
+    }
+  }
+  // ── internals ────────────────────────────────────────────────────────────
+  selectApex(btpUrl) {
+    if (btpUrl) {
+      const apex = this.apexes.get(btpUrl);
+      if (!apex) throw new TargetError(`No such apex: ${btpUrl}`);
+      return apex;
+    }
+    const def = this.defaultApex();
+    if (!def) throw new NotReadyError("No apex configured.");
+    return def;
+  }
+  assertApexReady(apex) {
+    if (!apex.ready) {
+      throw new NotReadyError(
+        apex.bootstrapping ? "Apex is still bootstrapping (BTP/anon coming up) \u2014 retry shortly." : apex.lastError ?? "Apex is not ready."
+      );
+    }
+  }
+};
+var NotReadyError = class extends Error {
+  retryable = true;
+  constructor(message) {
+    super(message);
+    this.name = "NotReadyError";
+  }
+};
+var PublishRejectedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PublishRejectedError";
+  }
+};
+var TargetError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TargetError";
+  }
+};
+function safe(fn) {
+  try {
+    return fn();
+  } catch {
+    return void 0;
+  }
+}
+function errMsg2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function sanitize(s) {
+  return s.replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
+}
+function isAnyoneHost(url) {
+  try {
+    return new URL(url).hostname.endsWith(".anyone");
+  } catch {
+    return false;
+  }
+}
+
+// src/daemon/routes.ts
+function registerRoutes(app, runner) {
+  app.get("/status", async () => runner.getStatus());
+  app.post("/publish", async (req, reply) => {
+    const body = req.body;
+    if (!body || !isSignedEvent(body.event)) {
+      return sendError(reply, 400, "invalid_event", {
+        detail: "body.event must be a fully-signed Nostr event (id + sig)."
+      });
+    }
+    try {
+      return await runner.publish(body);
+    } catch (err) {
+      return mapError(reply, err);
+    }
+  });
+  app.post("/subscribe", async (req, reply) => {
+    const body = req.body;
+    if (!body || body.filters === void 0) {
+      return sendError(reply, 400, "invalid_filters", {
+        detail: "body.filters is required (a NIP-01 filter or array of filters)."
+      });
+    }
+    try {
+      return runner.subscribe(body);
+    } catch (err) {
+      return mapError(reply, err);
+    }
+  });
+  app.get("/events", async (req) => {
+    const q = req.query;
+    const query = {};
+    if (q.subId) query.subId = q.subId;
+    if (q.cursor !== void 0) query.cursor = Number(q.cursor);
+    if (q.limit !== void 0) query.limit = Number(q.limit);
+    if (q.relayUrl) query.relayUrl = q.relayUrl;
+    return runner.getEvents(query);
+  });
+  app.post("/channels", async (req, reply) => {
+    try {
+      return await runner.openChannel(req.body?.destination);
+    } catch (err) {
+      return mapError(reply, err);
+    }
+  });
+  app.get("/channels", async () => runner.getChannels());
+  app.post("/swap", async (req, reply) => {
+    const body = req.body;
+    if (!body || !body.destination || body.amount === void 0 || !body.millPubkey || !body.pair || !body.chainRecipient) {
+      return sendError(reply, 400, "invalid_swap", {
+        detail: "body.destination, amount, millPubkey, pair, and chainRecipient are required."
+      });
+    }
+    try {
+      return await runner.swap(body);
+    } catch (err) {
+      return mapError(reply, err);
+    }
+  });
+  app.get("/targets", async () => runner.getTargets());
+  app.post("/relays", async (req, reply) => {
+    const url = req.body?.relayUrl;
+    if (!url) {
+      return sendError(reply, 400, "invalid_relay", {
+        detail: "body.relayUrl is required."
+      });
+    }
+    try {
+      await runner.addRelay(url);
+      return runner.getTargets();
+    } catch (err) {
+      return mapError(reply, err);
+    }
+  });
+  app.delete("/relays", async (req, reply) => {
+    const url = req.body?.relayUrl;
+    if (!url) {
+      return sendError(reply, 400, "invalid_relay", {
+        detail: "body.relayUrl is required."
+      });
+    }
+    try {
+      runner.removeRelay(url);
+      return runner.getTargets();
+    } catch (err) {
+      return mapError(reply, err);
+    }
+  });
+  app.post("/apex", async (req, reply) => {
+    const body = req.body;
+    if (!body || !body.ilpAddress || !body.relayUrl) {
+      return sendError(reply, 400, "invalid_apex", {
+        detail: "body.ilpAddress and body.relayUrl are required."
+      });
+    }
+    try {
+      return await runner.addApex(body);
+    } catch (err) {
+      return mapError(reply, err);
+    }
+  });
+  app.delete("/apex", async (req, reply) => {
+    const url = req.body?.btpUrl;
+    if (!url) {
+      return sendError(reply, 400, "invalid_apex", {
+        detail: "body.btpUrl is required."
+      });
+    }
+    try {
+      await runner.removeApex(url);
+      return runner.getTargets();
+    } catch (err) {
+      return mapError(reply, err);
+    }
+  });
+}
+function isSignedEvent(event) {
+  if (typeof event !== "object" || event === null) return false;
+  const e = event;
+  return typeof e["id"] === "string" && typeof e["sig"] === "string" && typeof e["pubkey"] === "string" && typeof e["kind"] === "number";
+}
+function mapError(reply, err) {
+  if (err instanceof NotReadyError) {
+    return sendError(reply, 503, "bootstrapping", {
+      detail: err.message,
+      retryable: true
+    });
+  }
+  if (err instanceof PublishRejectedError) {
+    return sendError(reply, 502, "rejected", { detail: err.message });
+  }
+  if (err instanceof TargetError) {
+    const status = /no such/i.test(err.message) ? 404 : 400;
+    return sendError(reply, status, "invalid_target", { detail: err.message });
+  }
+  if (err instanceof ApexDiscoveryError) {
+    return err.retryable ? sendError(reply, 504, "discovery_timeout", {
+      detail: err.message,
+      retryable: true
+    }) : sendError(reply, 502, "discovery_failed", { detail: err.message });
+  }
+  return sendError(reply, 500, "internal_error", {
+    detail: err instanceof Error ? err.message : String(err)
+  });
+}
+function sendError(reply, status, error, extra = {}) {
+  return reply.status(status).send({
+    error,
+    ...extra.detail ? { detail: extra.detail } : {},
+    ...extra.retryable ? { retryable: true } : {}
+  });
+}
+
+export {
+  defaultKeystorePath,
+  hasConfiguredIdentity,
+  scaffoldFirstRun,
+  RelaySubscription,
+  ClientRunner,
+  NotReadyError,
+  PublishRejectedError,
+  registerRoutes
+};
+//# sourceMappingURL=chunk-3NAWISI5.js.map