applesauce-wallet 7.0.0 → 7.1.1

package/README.md

@@ -1,3 +1,11 @@
 # Applesauce Wallet
 
 The `applesauce-wallet` package is a package of helpers, models, blueprints and other useful stuff for [NIP-60](https://github.com/nostr-protocol/nips/blob/master/60.md) wallets and [NIP-61](https://github.com/nostr-protocol/nips/blob/master/61.md) nutzaps
+
+Start with [NutWallet](https://applesauce.build/money/wallet/nut-wallet) for balance, token transfers, Lightning deposits and withdrawals over your application's signer, EventStore and RelayPool.
+
+- [Durable deposit recovery](https://applesauce.build/money/wallet/nut-wallet#resuming-interrupted-deposits): reopen account-scoped encrypted storage and explicitly resume pending operations after restart.
+- [Invoice-funded nutzaps](https://applesauce.build/money/wallet/nut-wallet#invoice-funded-nutzaps): use `MintRecovery` without a full wallet.
+- [KeyValueCouch and migration](https://applesauce.build/money/wallet/nut-wallet#migrating-existing-consumers): persist tokens in consumer-provided storage and migrate with copy-before-delete semantics.
+
+The [wallet guides](https://applesauce.build/money/wallet/package) also cover lower-level actions, casts and models.

package/dist/helpers/index.d.ts

@@ -10,3 +10,6 @@ export * from "./local-storage-couch.js";
 export * from "./indexed-db-couch.js";
 export * from "./mint-info.js";
 export * from "./mint-recommendation.js";
+export type { RecoveryStorage } from "./recovery-storage.js";
+export * from "./mint-recovery.js";
+export * from "./key-value-couch.js";

package/dist/helpers/index.js

@@ -10,3 +10,5 @@ export * from "./local-storage-couch.js";
 export * from "./indexed-db-couch.js";
 export * from "./mint-info.js";
 export * from "./mint-recommendation.js";
+export * from "./mint-recovery.js";
+export * from "./key-value-couch.js";

package/dist/helpers/key-value-couch.d.ts

@@ -0,0 +1,45 @@
+import { type Token } from "@cashu/cashu-ts";
+import type { Couch } from "./couch.js";
+import { type RecoveryStorage } from "./recovery-storage.js";
+/** Identifies a token by its normalized mint, unit, and unordered proof identities */
+export declare function tokenIdentity(token: Token): string;
+/** Stores couch tokens in a consumer-provided string store, which can encrypt values */
+export declare class KeyValueCouch implements Couch {
+    private readonly storage;
+    /** Creates a couch using app-scoped storage, optionally resolving the current account's storage */
+    constructor(storage: RecoveryStorage | (() => RecoveryStorage | null | undefined));
+    private context;
+    private serialize;
+    private read;
+    private decode;
+    /**
+     * Persists a token and returns cleanup bound to the original storage and account
+     * @throws if the storage scope is missing, unreadable, or cannot be persisted
+     */
+    store(token: Token): Promise<() => Promise<void>>;
+    /**
+     * Returns all tokens in this couch
+     * @throws if the storage scope is missing or its contents cannot be read
+     */
+    getAll(): Promise<Token[]>;
+    /**
+     * Removes one matching token regardless of proof order
+     * @throws if the storage scope is missing, unreadable, or cannot be persisted
+     */
+    remove(token: Token): Promise<void>;
+    /**
+     * Removes every token in this couch
+     * @throws if the storage scope is missing or cannot be persisted
+     */
+    clear(): Promise<void>;
+    /**
+     * Imports an earlier array-based couch record from explicitly selected legacy storage
+     * @throws if source and target overlap or persistence or cleanup fails
+     */
+    importLegacy(source: RecoveryStorage, key: string): Promise<number>;
+}
+/**
+ * Copies tokens into an explicitly selected couch before removing each source token
+ * @throws if either couch cannot be read or mutated
+ */
+export declare function migrateCouch(source: Couch, target: Couch): Promise<number>;

package/dist/helpers/key-value-couch.js

@@ -0,0 +1,140 @@
+import { deserializeProofs, serializeProofs } from "@cashu/cashu-ts";
+import { getProofUID } from "./cashu.js";
+import { saveRecovery, withRecoveryLock } from "./recovery-storage.js";
+const queues = new WeakMap();
+const tokensKey = "tokens";
+/** Identifies a token by its normalized mint, unit, and unordered proof identities */
+export function tokenIdentity(token) {
+    return JSON.stringify([token.mint.replace(/\/+$/, ""), token.unit ?? "sat", token.proofs.map(getProofUID).sort()]);
+}
+/** Stores couch tokens in a consumer-provided string store, which can encrypt values */
+export class KeyValueCouch {
+    storage;
+    /** Creates a couch using app-scoped storage, optionally resolving the current account's storage */
+    constructor(storage) {
+        this.storage = storage;
+    }
+    context() {
+        const storage = typeof this.storage === "function" ? this.storage() : this.storage;
+        if (!storage)
+            throw new Error("Unlock recovery storage before using the wallet");
+        return { storage, key: tokensKey };
+    }
+    serialize(storage, key, operation) {
+        const previous = queues.get(storage) ?? Promise.resolve();
+        const result = previous.then(() => withRecoveryLock(storage, `applesauce-couch:${key}`, operation));
+        const settled = result.then(() => undefined, () => undefined);
+        queues.set(storage, settled);
+        void settled.then(() => {
+            if (queues.get(storage) === settled)
+                queues.delete(storage);
+        });
+        return result;
+    }
+    async read(storage, key) {
+        const value = await storage.getItem(key);
+        if (value === null)
+            return [];
+        const records = JSON.parse(value);
+        if (!Array.isArray(records) ||
+            records.some((record) => !record.id || !record.token?.mint || !Array.isArray(record.token.proofs)))
+            throw new Error("Invalid couch record; preserve the stored value");
+        return records;
+    }
+    decode(record) {
+        return { ...record.token, proofs: deserializeProofs(record.token.proofs) };
+    }
+    /**
+     * Persists a token and returns cleanup bound to the original storage and account
+     * @throws if the storage scope is missing, unreadable, or cannot be persisted
+     */
+    async store(token) {
+        const { storage, key } = this.context();
+        const id = crypto.randomUUID();
+        await this.serialize(storage, key, async () => {
+            const records = await this.read(storage, key);
+            records.push({ id, token: { ...token, proofs: serializeProofs(token.proofs) } });
+            await saveRecovery(storage, key, records);
+        });
+        return () => this.serialize(storage, key, async () => {
+            const records = await this.read(storage, key);
+            await saveRecovery(storage, key, records.filter((record) => record.id !== id));
+        });
+    }
+    /**
+     * Returns all tokens in this couch
+     * @throws if the storage scope is missing or its contents cannot be read
+     */
+    async getAll() {
+        const { storage, key } = this.context();
+        return this.serialize(storage, key, async () => (await this.read(storage, key)).map((record) => this.decode(record)));
+    }
+    /**
+     * Removes one matching token regardless of proof order
+     * @throws if the storage scope is missing, unreadable, or cannot be persisted
+     */
+    async remove(token) {
+        const { storage, key } = this.context();
+        await this.serialize(storage, key, async () => {
+            const records = await this.read(storage, key);
+            const index = records.findIndex((record) => tokenIdentity(this.decode(record)) === tokenIdentity(token));
+            if (index >= 0)
+                await saveRecovery(storage, key, records.filter((_, position) => position !== index));
+        });
+    }
+    /**
+     * Removes every token in this couch
+     * @throws if the storage scope is missing or cannot be persisted
+     */
+    async clear() {
+        const { storage, key } = this.context();
+        await this.serialize(storage, key, () => saveRecovery(storage, key, []));
+    }
+    /**
+     * Imports an earlier array-based couch record from explicitly selected legacy storage
+     * @throws if source and target overlap or persistence or cleanup fails
+     */
+    async importLegacy(source, key) {
+        const { storage } = this.context();
+        if (source === storage && key === tokensKey)
+            throw new Error("Source and target couches must use independent storage scopes");
+        const target = new KeyValueCouch(storage);
+        return withRecoveryLock(source, `applesauce-couch:${key}`, async () => {
+            const value = await source.getItem(key);
+            if (value === null)
+                return 0;
+            const records = await this.read(source, key);
+            const copied = new Set((await target.getAll()).map(tokenIdentity));
+            for (const record of records) {
+                const token = this.decode(record);
+                const identity = tokenIdentity(token);
+                if (copied.has(identity))
+                    continue;
+                await target.store(token);
+                copied.add(identity);
+            }
+            await source.removeItem(key);
+            return records.length;
+        });
+    }
+}
+/**
+ * Copies tokens into an explicitly selected couch before removing each source token
+ * @throws if either couch cannot be read or mutated
+ */
+export async function migrateCouch(source, target) {
+    if (source === target)
+        throw new Error("Source and target couches must use independent storage scopes");
+    const copied = new Set((await target.getAll()).map(tokenIdentity));
+    let count = 0;
+    for (const token of await source.getAll()) {
+        const identity = tokenIdentity(token);
+        if (!copied.has(identity)) {
+            await target.store(token);
+            copied.add(identity);
+        }
+        await source.remove(token);
+        count++;
+    }
+    return count;
+}

package/dist/helpers/mint-recovery.d.ts

@@ -0,0 +1,106 @@
+import { Wallet, type MintQuoteBolt11Response } from "@cashu/cashu-ts";
+import type { NostrEvent } from "applesauce-core/helpers";
+import type { ISigner } from "applesauce-signers";
+import { type RecoveryStorage } from "./recovery-storage.js";
+import type { Couch } from "./couch.js";
+/** Options for preparing a durable bolt11 deposit or invoice-funded nutzap */
+export interface PrepareMintOptions {
+    /** The mint URL */
+    mint: string;
+    /** The positive integer amount in sats */
+    amount: number;
+    /** The optional invoice description */
+    description?: string;
+    /** The nutzap destination; omitted for a wallet deposit */
+    nutzap?: {
+        /** The recipient's Nostr public key */
+        recipient: string;
+        /** The recipient's Cashu P2PK key */
+        p2pk: string;
+        /** The recipient's delivery relays */
+        relays: string[];
+        /** The optional comment */
+        comment?: string;
+        /** The optional event being zapped */
+        event?: NostrEvent;
+    };
+}
+/** Public metadata for a pending mint, without secrets, proofs, or private wallet events */
+export interface PendingMint extends PrepareMintOptions {
+    /** The stable operation identifier */
+    id: string;
+    /** The operation owner's public key */
+    owner: string;
+    /** The persisted invoice */
+    quote: MintQuoteBolt11Response;
+    /** The last durable stage */
+    stage: "quote" | "outputs" | "proofs" | "events";
+}
+/** Options for explicitly resuming a persisted mint */
+export interface ResumeMintOptions {
+    /** Called after the invoice has been persisted, including on resume */
+    onQuote?: (quote: MintQuoteBolt11Response) => void | Promise<void>;
+    /** Stops execution without deleting recovery state */
+    signal?: AbortSignal;
+    /** The maximum time to wait for payment */
+    timeoutMs?: number;
+}
+/** Dependencies for durable minting and idempotent Nostr publication */
+export interface MintRecoveryOptions {
+    /** The app-scoped durable storage, preferably encrypted */
+    storage: RecoveryStorage;
+    /** The immutable operation owner's public key */
+    owner: string;
+    /** The signer for this owner */
+    signer: ISigner;
+    /** Publishes an event and rejects unless a relay explicitly accepts it */
+    publish: (event: NostrEvent, relays?: string[]) => Promise<void>;
+    /** Inserts accepted events into the current session's event store, including after restart */
+    onAccepted?: (event: NostrEvent) => void;
+    /** Returns a loaded Cashu wallet, allowing reuse of cached wallets */
+    getCashuWallet?: (mint: string) => Promise<Wallet>;
+    /** Waits for payment using the application's preferred transport */
+    waitForQuote?: (mint: string, quote: string, options: ResumeMintOptions) => Promise<unknown>;
+}
+/** Persists exact mint outputs and signed events so interrupted minting can be resumed safely */
+export declare class MintRecovery {
+    private readonly options;
+    private readonly prefix;
+    /** Creates a recovery journal without reading storage, signing, or publishing */
+    constructor(options: MintRecoveryOptions);
+    private key;
+    private wallet;
+    private waitForQuote;
+    private read;
+    private metadata;
+    /**
+     * Lists this owner's pending operations without signing or resuming them
+     * @throws if storage is unavailable or a saved record is invalid
+     */
+    getPending(): Promise<PendingMint[]>;
+    /**
+     * Creates and durably stores a quote before returning its invoice
+     * @throws if the amount or destination is invalid, recovery is unsupported, or persistence fails
+     */
+    prepare(input: PrepareMintOptions): Promise<PendingMint>;
+    /**
+     * Persists an externally created quote before redemption; issued quotes still require saved outputs
+     * @throws if the quote conflicts with its operation or cannot be persisted
+     */
+    adoptQuote(input: PrepareMintOptions, quote: MintQuoteBolt11Response): Promise<PendingMint>;
+    /**
+     * Imports an owner-tagged deposit from the earlier example journal without discarding its saved outputs
+     * @throws if ownership, saved state, storage, or couch cleanup cannot be verified
+     */
+    importLegacyDeposit(key: string, couch: Couch, source?: RecoveryStorage): Promise<PendingMint | undefined>;
+    /**
+     * Imports an unowned legacy nutzap only after the consumer explicitly selects its owner and delivery relays
+     * @throws if the legacy record is invalid or relay discovery or persistence fails
+     */
+    importLegacyNutzap(key: string, getRelays: (recipient: string) => Promise<string[]>, source?: RecoveryStorage): Promise<PendingMint | undefined>;
+    /**
+     * Resumes a saved operation, retaining its state on cancellation or any failure
+     * @throws if cancelled, already running, invalid, or unable to mint, sign, persist, or publish
+     */
+    resume(id: string, options?: ResumeMintOptions): Promise<void>;
+}

package/dist/helpers/mint-recovery.js

@@ -0,0 +1,388 @@
+import { Amount, OutputData, Wallet, deserializeProofs, serializeProofs, sumProofs, } from "@cashu/cashu-ts";
+import { WalletTokenFactory } from "../factories/tokens.js";
+import { WalletHistoryFactory } from "../factories/history.js";
+import { NutzapFactory } from "../factories/nutzap.js";
+import { saveRecovery, withRecoveryLock } from "./recovery-storage.js";
+import { tokenIdentity } from "./key-value-couch.js";
+import { WALLET_TOKEN_KIND } from "./tokens.js";
+import { WALLET_HISTORY_KIND } from "./history.js";
+import { NUTZAP_KIND } from "./nutzap.js";
+function storeQuote(quote) {
+    return { ...quote, amount: Amount.from(quote.amount).toString() };
+}
+function restoreQuote(quote) {
+    return { ...quote, amount: Amount.from(quote.amount) };
+}
+function validateMintInput(input) {
+    if (!Number.isSafeInteger(input.amount) || input.amount <= 0)
+        throw new Error("Mint amount must be a positive integer in sats");
+    if (input.nutzap?.event && input.nutzap.event.pubkey !== input.nutzap.recipient)
+        throw new Error("The nutzap event does not belong to the recipient");
+    // Validate the lock before exposing an invoice that the user could pay.
+    if (input.nutzap)
+        OutputData.createSingleP2PKData({ pubkey: input.nutzap.p2pk }, 1, "deedbeef");
+}
+function waitForPoll(signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", abort);
+            reject(signal?.reason);
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", abort);
+            resolve();
+        }, 3000);
+        signal?.addEventListener("abort", abort, { once: true });
+        if (signal?.aborted)
+            abort();
+    });
+}
+/** Persists exact mint outputs and signed events so interrupted minting can be resumed safely */
+export class MintRecovery {
+    options;
+    prefix;
+    /** Creates a recovery journal without reading storage, signing, or publishing */
+    constructor(options) {
+        this.options = options;
+        this.prefix = `applesauce-mint:${options.owner}:`;
+    }
+    key(id) {
+        return this.prefix + encodeURIComponent(id);
+    }
+    async wallet(mint) {
+        if (this.options.getCashuWallet)
+            return this.options.getCashuWallet(mint);
+        const wallet = new Wallet(mint);
+        await wallet.loadMint();
+        return wallet;
+    }
+    async waitForQuote(wallet, record, options) {
+        if (this.options.waitForQuote)
+            return this.options.waitForQuote(record.mint, record.quote.quote, options);
+        if (wallet.getMintInfo().isSupported(17).supported)
+            return wallet.on.onceMintPaid(record.quote.quote, {
+                signal: options.signal,
+                timeoutMs: options.timeoutMs ?? 60_000,
+            });
+        const deadline = Date.now() + (options.timeoutMs ?? 60_000);
+        while (Date.now() < deadline) {
+            options.signal?.throwIfAborted();
+            const quote = await wallet.checkMintQuoteBolt11(record.quote.quote);
+            if (quote.state === "PAID" || quote.state === "ISSUED")
+                return;
+            await waitForPoll(options.signal);
+        }
+        throw new Error("Timed out waiting for mint payment");
+    }
+    read(value, id) {
+        const record = JSON.parse(value);
+        if (record.version !== 1 ||
+            record.owner !== this.options.owner ||
+            record.id !== id ||
+            !record.mint ||
+            !Number.isSafeInteger(record.amount) ||
+            record.amount <= 0 ||
+            !record.quote?.quote ||
+            record.quote.unit !== "sat" ||
+            !Amount.from(record.quote.amount).equals(record.amount) ||
+            (record.events && (!record.token || record.events.length !== (record.nutzap ? 1 : 2)))) {
+            throw new Error("Invalid recovery record; preserve the stored value");
+        }
+        if (record.token) {
+            const proofs = deserializeProofs(record.token.proofs);
+            if (record.token.mint !== record.mint || record.token.unit !== "sat" || !sumProofs(proofs).equals(record.amount))
+                throw new Error("Saved proofs do not match the mint operation; preserve recovery state");
+        }
+        if (record.events) {
+            const ids = new Set(record.events.map((event) => event.id));
+            const kinds = record.nutzap ? [NUTZAP_KIND] : [WALLET_TOKEN_KIND, WALLET_HISTORY_KIND];
+            if (ids.size !== kinds.length ||
+                record.events.some((event, index) => !event.id || event.pubkey !== record.owner || event.kind !== kinds[index]) ||
+                record.accepted?.some((accepted) => !ids.has(accepted)))
+                throw new Error("Invalid saved publication events; preserve recovery state");
+        }
+        return record;
+    }
+    metadata(record) {
+        return {
+            id: record.id,
+            owner: record.owner,
+            mint: record.mint,
+            amount: record.amount,
+            description: record.description,
+            nutzap: record.nutzap,
+            quote: restoreQuote(record.quote),
+            stage: record.events ? "events" : record.token ? "proofs" : record.preview ? "outputs" : "quote",
+        };
+    }
+    /**
+     * Lists this owner's pending operations without signing or resuming them
+     * @throws if storage is unavailable or a saved record is invalid
+     */
+    async getPending() {
+        const records = [];
+        for (const key of await this.options.storage.keys()) {
+            if (!key.startsWith(this.prefix))
+                continue;
+            const value = await this.options.storage.getItem(key);
+            if (value !== null)
+                records.push(this.metadata(this.read(value, decodeURIComponent(key.slice(this.prefix.length)))));
+        }
+        return records;
+    }
+    /**
+     * Creates and durably stores a quote before returning its invoice
+     * @throws if the amount or destination is invalid, recovery is unsupported, or persistence fails
+     */
+    async prepare(input) {
+        validateMintInput(input);
+        // Check storage accessibility before contacting the mint, even when no records exist.
+        await this.options.storage.getItem(this.prefix + "probe");
+        const wallet = await this.wallet(input.mint);
+        if (!wallet.getMintInfo().isSupported(9).supported)
+            throw new Error("Mint does not support NUT-09 signature recovery");
+        const quote = await wallet.createMintQuoteBolt11(input.amount, input.description);
+        if (quote.unit !== "sat" || !Amount.from(quote.amount).equals(input.amount))
+            throw new Error("Mint quote amount or unit mismatch");
+        return this.adoptQuote(input, quote);
+    }
+    /**
+     * Persists an externally created quote before redemption; issued quotes still require saved outputs
+     * @throws if the quote conflicts with its operation or cannot be persisted
+     */
+    async adoptQuote(input, quote) {
+        validateMintInput(input);
+        if (quote.unit !== "sat" || !Amount.from(quote.amount).equals(input.amount))
+            throw new Error("Mint quote amount or unit mismatch");
+        const id = JSON.stringify([input.mint.replace(/\/+$/, ""), quote.quote]);
+        return withRecoveryLock(this.options.storage, this.key(id), async () => {
+            const saved = await this.options.storage.getItem(this.key(id));
+            if (saved !== null) {
+                const record = this.read(saved, id);
+                if (record.amount !== input.amount || JSON.stringify(record.nutzap) !== JSON.stringify(input.nutzap))
+                    throw new Error("Quote is already associated with another mint operation");
+                return this.metadata(record);
+            }
+            const record = {
+                mint: input.mint,
+                amount: input.amount,
+                description: input.description,
+                nutzap: input.nutzap,
+                version: 1,
+                owner: this.options.owner,
+                id,
+                quote: storeQuote(quote),
+            };
+            await saveRecovery(this.options.storage, this.key(record.id), record);
+            return this.metadata(record);
+        });
+    }
+    /**
+     * Imports an owner-tagged deposit from the earlier example journal without discarding its saved outputs
+     * @throws if ownership, saved state, storage, or couch cleanup cannot be verified
+     */
+    async importLegacyDeposit(key, couch, source = this.options.storage) {
+        return withRecoveryLock(source, `legacy:${key}`, async () => {
+            const value = await source.getItem(key);
+            if (value === null)
+                return undefined;
+            const legacy = JSON.parse(value);
+            if (legacy.owner !== this.options.owner || legacy.nutzap)
+                throw new Error("Legacy deposit belongs to another owner");
+            const id = JSON.stringify([legacy.mint.replace(/\/+$/, ""), legacy.quote.quote]);
+            const record = this.read(JSON.stringify({ ...legacy, id, version: 1 }), id);
+            return withRecoveryLock(this.options.storage, this.key(id), async () => {
+                // Remove duplicate couch copies while the legacy record still durably owns the proofs.
+                if (record.token) {
+                    const identity = tokenIdentity({ ...record.token, proofs: deserializeProofs(record.token.proofs) });
+                    for (const token of await couch.getAll())
+                        if (tokenIdentity(token) === identity)
+                            await couch.remove(token);
+                    if ((await couch.getAll()).some((token) => tokenIdentity(token) === identity))
+                        throw new Error("Could not remove legacy couch duplicates");
+                }
+                const saved = await this.options.storage.getItem(this.key(id));
+                if (saved === null)
+                    await saveRecovery(this.options.storage, this.key(id), record);
+                await source.removeItem(key);
+                return this.metadata(saved === null ? record : this.read(saved, id));
+            });
+        });
+    }
+    /**
+     * Imports an unowned legacy nutzap only after the consumer explicitly selects its owner and delivery relays
+     * @throws if the legacy record is invalid or relay discovery or persistence fails
+     */
+    async importLegacyNutzap(key, getRelays, source = this.options.storage) {
+        return withRecoveryLock(source, `legacy:${key}`, async () => {
+            const value = await source.getItem(key);
+            if (value === null)
+                return undefined;
+            const legacy = JSON.parse(value);
+            if (!legacy.recipient || !legacy.p2pk)
+                throw new Error("Invalid legacy nutzap");
+            const relays = await getRelays(legacy.recipient);
+            const id = JSON.stringify([legacy.mint.replace(/\/+$/, ""), legacy.quote.quote]);
+            const record = this.read(JSON.stringify({
+                version: 1,
+                id,
+                owner: this.options.owner,
+                mint: legacy.mint,
+                amount: legacy.amount,
+                quote: storeQuote(restoreQuote(legacy.quote)),
+                preview: legacy.preview && {
+                    ...legacy.preview,
+                    quote: storeQuote(restoreQuote(legacy.preview.quote)),
+                },
+                token: legacy.token && {
+                    ...legacy.token,
+                    proofs: serializeProofs(deserializeProofs(JSON.stringify(legacy.token.proofs))),
+                },
+                nutzap: { recipient: legacy.recipient, p2pk: legacy.p2pk, comment: legacy.comment, relays },
+            }), id);
+            return withRecoveryLock(this.options.storage, this.key(id), async () => {
+                const saved = await this.options.storage.getItem(this.key(id));
+                if (saved === null)
+                    await saveRecovery(this.options.storage, this.key(id), record);
+                await source.removeItem(key);
+                return this.metadata(saved === null ? record : this.read(saved, id));
+            });
+        });
+    }
+    /**
+     * Resumes a saved operation, retaining its state on cancellation or any failure
+     * @throws if cancelled, already running, invalid, or unable to mint, sign, persist, or publish
+     */
+    async resume(id, options = {}) {
+        const key = this.key(id);
+        await withRecoveryLock(this.options.storage, key, async () => {
+            const check = () => options.signal?.throwIfAborted();
+            check();
+            const value = await this.options.storage.getItem(key);
+            if (value === null)
+                throw new Error("No pending mint to resume");
+            const record = this.read(value, id);
+            const save = () => saveRecovery(this.options.storage, key, record);
+            await options.onQuote?.(restoreQuote(record.quote));
+            check();
+            if (!record.token) {
+                const wallet = await this.wallet(record.mint);
+                if (!wallet.getMintInfo().isSupported(9).supported)
+                    throw new Error("Mint does not support NUT-09 signature recovery");
+                let quote = await wallet.checkMintQuoteBolt11(record.quote.quote);
+                if (quote.state === "UNPAID") {
+                    await this.waitForQuote(wallet, record, options);
+                    quote = await wallet.checkMintQuoteBolt11(record.quote.quote);
+                }
+                check();
+                if (quote.quote !== record.quote.quote ||
+                    quote.unit !== "sat" ||
+                    !Amount.from(quote.amount).equals(record.amount))
+                    throw new Error("Mint quote does not match the saved operation");
+                if (quote.state !== "PAID" && quote.state !== "ISSUED")
+                    throw new Error("Mint quote is not paid");
+                if (!record.preview) {
+                    if (quote.state === "ISSUED")
+                        throw new Error("Quote issued without saved outputs; preserve recovery state");
+                    const operation = wallet.ops.mintBolt11(record.amount, quote);
+                    const preview = await (record.nutzap ? operation.asP2PK({ pubkey: record.nutzap.p2pk }) : operation).prepare();
+                    const { outputs: _outputs, ...payload } = preview.payload;
+                    record.preview = {
+                        ...preview,
+                        quote: storeQuote(preview.quote),
+                        payload,
+                        outputData: preview.outputData.map(OutputData.serialize),
+                    };
+                    await save();
+                }
+                const outputData = record.preview.outputData.map(OutputData.deserialize);
+                if (record.preview.method !== "bolt11" ||
+                    record.preview.quote.quote !== record.quote.quote ||
+                    record.preview.payload.quote !== record.quote.quote ||
+                    !outputData.length ||
+                    new Set(outputData.map((output) => output.blindedMessage.B_)).size !== outputData.length ||
+                    outputData.some((output) => output.blindedMessage.id !== record.preview.keysetId) ||
+                    !sumProofs(outputData.map((output) => output.blindedMessage)).equals(record.amount))
+                    throw new Error("Saved outputs do not match the mint operation; preserve recovery state");
+                const preview = {
+                    ...record.preview,
+                    quote: restoreQuote(record.preview.quote),
+                    outputData,
+                    payload: { ...record.preview.payload, outputs: outputData.map((output) => output.blindedMessage) },
+                };
+                check();
+                let proofs;
+                if (quote.state === "ISSUED") {
+                    const restored = await wallet.mint.restore({ outputs: preview.payload.outputs });
+                    if (restored.outputs.length !== outputData.length || restored.signatures.length !== outputData.length)
+                        throw new Error("Mint did not restore all saved outputs");
+                    const seen = new Set();
+                    // A saved quote may refer to a keyset that became inactive while the client was offline.
+                    await wallet.ensureOperableKeysets([preview.keysetId]);
+                    const keys = wallet.getKeyset(preview.keysetId);
+                    proofs = restored.outputs.map((output, index) => {
+                        const original = outputData.find((candidate) => candidate.blindedMessage.B_ === output.B_);
+                        if (!original || seen.has(output.B_))
+                            throw new Error("Mint returned an unknown or repeated recovery output");
+                        seen.add(output.B_);
+                        const signature = restored.signatures[index];
+                        if (signature.id !== preview.keysetId ||
+                            !Amount.from(signature.amount).equals(original.blindedMessage.amount))
+                            throw new Error("Mint returned mismatched recovery signatures");
+                        return original.toProof(signature, keys);
+                    });
+                }
+                else {
+                    proofs = await wallet.completeMint(preview);
+                }
+                if (!sumProofs(proofs).equals(record.amount))
+                    throw new Error("Mint issued an unexpected amount");
+                record.token = { mint: record.mint, unit: "sat", proofs: serializeProofs(proofs) };
+                // Never put these proofs in the ordinary couch: couch recovery could swap them before publication.
+                await save();
+            }
+            check();
+            if (!record.events) {
+                if ((await this.options.signer.getPublicKey()) !== record.owner)
+                    throw new Error("The signer does not own this operation");
+                const token = { ...record.token, proofs: deserializeProofs(record.token.proofs) };
+                if (record.nutzap) {
+                    const { event, recipient, comment } = record.nutzap;
+                    const factory = event
+                        ? NutzapFactory.forEvent(event, token, comment)
+                        : NutzapFactory.forProfile(recipient, token, comment);
+                    record.events = [await factory.sign(this.options.signer)];
+                }
+                else {
+                    const tokenEvent = await WalletTokenFactory.create(token).sign(this.options.signer);
+                    const history = await WalletHistoryFactory.create({
+                        direction: "in",
+                        amount: record.amount,
+                        mint: record.mint,
+                        created: [tokenEvent.id],
+                    }).sign(this.options.signer);
+                    record.events = [tokenEvent, history];
+                }
+                if (record.events.some((event) => event.pubkey !== record.owner))
+                    throw new Error("The active signer changed during mint recovery");
+                record.accepted = [];
+                await save();
+            }
+            for (const event of record.events) {
+                check();
+                if (event.pubkey !== record.owner)
+                    throw new Error("A saved event belongs to another owner");
+                if (record.accepted?.includes(event.id)) {
+                    this.options.onAccepted?.(event);
+                    continue;
+                }
+                await this.options.publish(event, record.nutzap?.relays);
+                this.options.onAccepted?.(event);
+                record.accepted = [...(record.accepted ?? []), event.id];
+                await save();
+            }
+            await this.options.storage.removeItem(key);
+        });
+    }
+}

package/dist/helpers/recovery-storage.d.ts

@@ -0,0 +1,23 @@
+/** An app-scoped durable string store; missing values return null and failed reads or mutations must reject */
+export interface RecoveryStorage {
+    /** Returns the stored value, or null only when the key does not exist */
+    getItem(key: string): Promise<string | null>;
+    /** Persists a value before resolving; false is also treated as a failed write */
+    setItem(key: string, value: string): Promise<unknown>;
+    /** Removes a value durably before resolving */
+    removeItem(key: string): Promise<void>;
+    /** Returns all keys, including keys written in previous sessions */
+    keys(): Promise<string[]>;
+    /** Runs an exclusive operation using locks scoped to this storage backend */
+    withLock?<T>(key: string, operation: () => Promise<T>): Promise<T>;
+}
+/**
+ * Runs a recovery mutation exclusively within a storage instance and delegates backend locking to the adapter
+ * @throws if the operation is already running or the lock provider fails
+ */
+export declare function withRecoveryLock<T>(storage: RecoveryStorage, key: string, operation: () => Promise<T>): Promise<T>;
+/**
+ * Persists a recovery value and rejects storage adapters that report failure without throwing
+ * @throws if serialization or persistence fails
+ */
+export declare function saveRecovery(storage: RecoveryStorage, key: string, value: unknown): Promise<void>;

package/dist/helpers/recovery-storage.js

@@ -0,0 +1,29 @@
+const active = new WeakMap();
+/**
+ * Runs a recovery mutation exclusively within a storage instance and delegates backend locking to the adapter
+ * @throws if the operation is already running or the lock provider fails
+ */
+export async function withRecoveryLock(storage, key, operation) {
+    let keys = active.get(storage);
+    if (!keys)
+        active.set(storage, (keys = new Set()));
+    if (keys.has(key))
+        throw new Error("A recovery operation is already running");
+    keys.add(key);
+    try {
+        if (storage.withLock)
+            return await storage.withLock(key, operation);
+        return await operation();
+    }
+    finally {
+        keys.delete(key);
+    }
+}
+/**
+ * Persists a recovery value and rejects storage adapters that report failure without throwing
+ * @throws if serialization or persistence fails
+ */
+export async function saveRecovery(storage, key, value) {
+    if ((await storage.setItem(key, JSON.stringify(value))) === false)
+        throw new Error("Could not persist recovery state");
+}

package/dist/models/tokens.js

@@ -29,7 +29,8 @@ function collectDeletedIds(tokens) {
  */
 export function WalletDeletedTokenIdsModel(pubkey) {
     return (events) => {
-        return events.timeline({ kinds: [WALLET_TOKEN_KIND], authors: [pubkey] }).pipe(
+        // Spend exclusions must be visible immediately, before later token arrivals can affect the balance
+        return events.timeline({ kinds: [WALLET_TOKEN_KIND], authors: [pubkey] }, { batchWindow: false }).pipe(
         // Re-collect when a token unlocks so the decrypted-content fallback stays accurate
         watchEventsUpdates(events), map(collectDeletedIds));
     };
@@ -38,7 +39,7 @@ export function WalletDeletedTokenIdsModel(pubkey) {
 export function WalletTokensModel(pubkey, unlocked) {
     return (events) => {
         return combineLatest([
-            events.timeline({ kinds: [WALLET_TOKEN_KIND], authors: [pubkey] }),
+            events.timeline({ kinds: [WALLET_TOKEN_KIND], authors: [pubkey] }, { batchWindow: false }),
             events.model(WalletDeletedTokenIdsModel, pubkey),
         ]).pipe(
         // remove deleted events
@@ -55,7 +56,7 @@ export function WalletTokensModel(pubkey, unlocked) {
 export function WalletDeletedTokensModel(pubkey) {
     return (events) => {
         return combineLatest([
-            events.timeline({ kinds: [WALLET_TOKEN_KIND], authors: [pubkey] }),
+            events.timeline({ kinds: [WALLET_TOKEN_KIND], authors: [pubkey] }, { batchWindow: false }),
             events.model(WalletDeletedTokenIdsModel, pubkey),
         ]).pipe(map(([tokens, deleted]) => tokens.filter((token) => deleted.has(token.id))));
     };
@@ -65,7 +66,9 @@ export function WalletBalanceModel(pubkey) {
     return (events) => {
         return combineLatest([
             // Watch for updates to the tokens so the balance recounts when a token unlocks
-            events.timeline({ kinds: [WALLET_TOKEN_KIND], authors: [pubkey] }).pipe(watchEventsUpdates(events)),
+            events
+                .timeline({ kinds: [WALLET_TOKEN_KIND], authors: [pubkey] }, { batchWindow: false })
+                .pipe(watchEventsUpdates(events)),
             events.model(WalletDeletedTokenIdsModel, pubkey),
         ]).pipe(
         // Ignore deleted tokens

package/dist/wallet/loading.js

@@ -27,7 +27,7 @@ export function loadWalletEvents({ pool, eventStore, pubkey, relays$, useDeleteE
         authors: [pubkey],
     };
     const walletEventKinds = [WALLET_KIND, WALLET_TOKEN_KIND, WALLET_HISTORY_KIND];
-    const deleteFilter = { kinds: [kinds.EventDeletion], "#k": walletEventKinds.map(String) };
+    const deleteFilter = { kinds: [kinds.EventDeletion], authors: [pubkey], "#k": walletEventKinds.map(String) };
     // The subscription and request also watch for wallet event deletions, unless they are disabled
     const subscriptionFilters = useDeleteEvents ? [negentropyFilter, deleteFilter] : [negentropyFilter];
     const syncLoader = createSyncLoader({ pool, eventStore, logger });

package/dist/wallet/nut-wallet.d.ts

@@ -12,6 +12,8 @@ import type { WalletHistory } from "../casts/wallet-history.js";
 import type { WalletToken } from "../casts/wallet-token.js";
 import type { Wallet } from "../casts/wallet.js";
 import type { Couch } from "../helpers/couch.js";
+import { type PendingMint, type ResumeMintOptions } from "../helpers/mint-recovery.js";
+import type { RecoveryStorage } from "../helpers/recovery-storage.js";
 import { WalletLoaderStatus } from "./loading.js";
 import { type Bolt11WithdrawResponse, type CreateWalletOptions, type DepositOptions, type NutWalletOperation, type NutWalletOptions, type RelayStatusInfo, type TokenRelayCoverage, type WithdrawOptions, WalletStatus } from "./types.js";
 import "../casts/__register__.js";
@@ -119,6 +121,7 @@ export declare class NutWallet {
     protected autoUnlockSub?: Subscription;
     protected unlocking: boolean;
     protected backupPromise?: Promise<void>;
+    private readonly mintRecovery?;
     constructor(options: NutWalletOptions);
     /** Creates a new NIP-60 wallet and returns a started {@link NutWallet} */
     static create(options: NutWalletOptions, wallet: CreateWalletOptions): Promise<NutWallet>;
@@ -171,7 +174,8 @@ export declare class NutWallet {
     /**
      * Creates a bolt11 mint quote (lightning invoice) to deposit `amount` sats into a mint.
      * Pay the returned `request` invoice, then wait for it with {@link waitForMintQuote} and redeem it
-     * with {@link redeemMintQuote} (or use {@link mint} to do all three in one call).
+     * with {@link redeemMintQuote} (or use {@link deposit} to do all three in one call).
+     * @throws if quote creation fails or configured recovery storage cannot persist it
      */
     createMintQuote(mint: string, amount: number, description?: string): Promise<MintQuoteBolt11Response>;
     /**
@@ -186,7 +190,10 @@ export declare class NutWallet {
         timeoutMs?: number;
         interval?: number;
     }): Promise<MintQuoteBolt11Response>;
-    /** Redeems an already-paid bolt11 mint quote, minting proofs and adding them to the wallet */
+    /**
+     * Redeems an already-paid bolt11 mint quote with durable recovery when configured
+     * @throws if minting, publication, or configured recovery storage fails
+     */
     redeemMintQuote(mint: string, amount: number, quote: string | MintQuoteBolt11Response): Promise<void>;
     /**
      * Deposits funds into a mint using the given payment method, minting the resulting proofs into the
@@ -195,8 +202,25 @@ export declare class NutWallet {
      *
      * For bolt11 it creates a mint quote, surfaces the invoice via `onQuote`, waits for it to be paid,
      * and redeems the proofs.
+     * @throws if the deposit fails, is cancelled, or times out
      */
     deposit(options: DepositOptions): Promise<void>;
+    private requireMintRecovery;
+    /**
+     * Lists pending deposits without signing or publishing
+     * @throws if recovery storage is missing, unavailable, or contains invalid records
+     */
+    getPendingDeposits(): Promise<PendingMint[]>;
+    /**
+     * Imports an owner-tagged deposit journal created by an older example
+     * @throws if recovery storage is missing or migration cannot complete safely
+     */
+    importLegacyDeposit(key: string, source?: RecoveryStorage): Promise<PendingMint | undefined>;
+    /**
+     * Resumes a pending deposit using its saved outputs and signed events
+     * @throws if recovery storage is missing or the operation cannot complete safely
+     */
+    resumeDeposit(id: string, options?: ResumeMintOptions): Promise<void>;
     /**
      * Withdraws funds from a mint's balance using the given payment method (melts ecash). This is the
      * method-agnostic entry point; {@link payInvoice} is the bolt11 alias. New payment methods are added

package/dist/wallet/nut-wallet.js

@@ -2,13 +2,15 @@ import { getTokenMetadata, getEncodedToken, Mint, MintQuoteState, Wallet as Cash
 import { ActionRunner } from "applesauce-actions";
 import { logger as baseLogger, chainable, } from "applesauce-core";
 import { castUser } from "applesauce-core/casts";
-import { addSeenRelay, canHaveEncryptedContent, getEncryptedContent, getOutboxes, getSeenRelays, isEncryptedContentUnlocked, kinds, normalizeURL, notifyEventUpdate, relaySet, setEncryptedContentCache, } from "applesauce-core/helpers";
+import { addSeenRelay, getEncryptedContent, getOutboxes, getSeenRelays, isEncryptedContentUnlocked, kinds, normalizeURL, notifyEventUpdate, relaySet, } from "applesauce-core/helpers";
 import { isEncryptedContentFromCache, markEncryptedContentFromCache, } from "applesauce-common/helpers";
-import { BehaviorSubject, combineLatest, isObservable, of } from "rxjs";
+import { restoreEncryptedContentFromCache } from "applesauce-core/observable";
+import { BehaviorSubject, combineLatest, from, ignoreElements, isObservable, lastValueFrom, of, } from "rxjs";
 import { distinctUntilChanged, map, shareReplay, startWith, switchMap } from "rxjs/operators";
 // Ensure the User.wallet$ is setup
 import "../casts/__register__.js";
 import { CleanupDeletedTokens, ConsolidateTokens, CreateWallet, MintTokens, ReceiveToken, ReceiveNutzaps, RecoverFromCouch, RolloverTokens, SetWalletMints, SetWalletRelays, TokensOperation, UnlockWallet, } from "../actions/index.js";
+import { MintRecovery } from "../helpers/mint-recovery.js";
 import { lockHistoryContent, WALLET_HISTORY_KIND } from "../helpers/history.js";
 import { lockTokenContent, WALLET_TOKEN_KIND } from "../helpers/tokens.js";
 import { getWalletRelays, lockWallet, WALLET_KIND } from "../helpers/wallet.js";
@@ -162,12 +164,23 @@ export class NutWallet {
     autoUnlockSub;
     unlocking = false;
     backupPromise;
+    mintRecovery;
     constructor(options) {
         this.pubkey = options.pubkey;
         this.signer = options.signer;
         this.pool = options.pool;
         this.eventStore = options.eventStore;
         this.couch = options.couch;
+        if (options.recovery)
+            this.mintRecovery = new MintRecovery({
+                storage: options.recovery,
+                owner: this.pubkey,
+                signer: this.signer,
+                getCashuWallet: (mint) => this.getCashuWallet(mint),
+                waitForQuote: (mint, quote, resumeOptions) => this.waitForMintQuote(mint, quote, resumeOptions),
+                publish: (event, relays) => this.publish(event, relays),
+                onAccepted: (event) => this.eventStore.add(event),
+            });
         this.autoUnlock = options.autoUnlock ?? false;
         this.useDeleteEvents = options.useDeleteEvents ?? false;
         this.decryptionCache = options.decryptionCache;
@@ -355,23 +368,9 @@ export class NutWallet {
         const cache = this.decryptionCache;
         if (!cache)
             return;
-        for (const event of events) {
-            // Skip events that cannot have encrypted content or are already unlocked
-            if (!canHaveEncryptedContent(event.kind) || isEncryptedContentUnlocked(event))
-                continue;
-            try {
-                const content = await cache.getItem(event.id);
-                if (typeof content !== "string")
-                    continue;
-                // Mark as from cache so it is not persisted again, then restore the content
-                markEncryptedContentFromCache(event);
-                setEncryptedContentCache(event, content);
-                this.log("Restored encrypted content for %s from cache", event.id.slice(0, 8));
-            }
-            catch (error) {
-                this.log("Failed to restore encrypted content for %s: %s", event.id.slice(0, 8), error?.message ?? error);
-            }
-        }
+        await lastValueFrom(from(events).pipe(restoreEncryptedContentFromCache(cache), ignoreElements()), {
+            defaultValue: undefined,
+        });
     }
     /** Persists the decrypted content of unlocked events to the {@link decryptionCache} */
     async persistToCache(events) {
@@ -468,13 +467,18 @@ export class NutWallet {
     /**
      * Creates a bolt11 mint quote (lightning invoice) to deposit `amount` sats into a mint.
      * Pay the returned `request` invoice, then wait for it with {@link waitForMintQuote} and redeem it
-     * with {@link redeemMintQuote} (or use {@link mint} to do all three in one call).
+     * with {@link redeemMintQuote} (or use {@link deposit} to do all three in one call).
+     * @throws if quote creation fails or configured recovery storage cannot persist it
      */
     async createMintQuote(mint, amount, description) {
         return this.track("mintQuote", async () => {
             this.log("Creating mint quote for %d sats at %s", amount, mint);
-            const cashuWallet = await this.getCashuWallet(mint);
-            return cashuWallet.createMintQuoteBolt11(amount, description);
+            if (!this.mintRecovery) {
+                const cashuWallet = await this.getCashuWallet(mint);
+                return cashuWallet.createMintQuoteBolt11(amount, description);
+            }
+            const pending = await this.mintRecovery.prepare({ mint, amount, description });
+            return pending.quote;
         });
     }
     /**
@@ -493,17 +497,34 @@ export class NutWallet {
         this.log("Waiting for mint quote %s via polling", quote);
         return this.pollMintQuote(cashuWallet, quote, options);
     }
-    /** Redeems an already-paid bolt11 mint quote, minting proofs and adding them to the wallet */
+    /**
+     * Redeems an already-paid bolt11 mint quote with durable recovery when configured
+     * @throws if minting, publication, or configured recovery storage fails
+     */
     async redeemMintQuote(mint, amount, quote) {
         await this.track("mint", async () => {
             this.log("Redeeming mint quote for %d sats at %s", amount, mint);
-            const wallet = await this.getCashuWallet(mint);
-            await this.actions.run(MintTokens, mint, amount, quote, {
-                couch: this.couch,
-                wallet,
-                getCashuWallet: this.getCashuWallet,
-            });
-            await this.refreshCouch();
+            const recovery = this.mintRecovery;
+            if (!recovery) {
+                const wallet = await this.getCashuWallet(mint);
+                await this.actions.run(MintTokens, mint, amount, quote, {
+                    couch: this.couch,
+                    wallet,
+                    getCashuWallet: this.getCashuWallet,
+                });
+                await this.refreshCouch();
+                return;
+            }
+            const quoteId = typeof quote === "string" ? quote : quote.quote;
+            let pending = (await recovery.getPending()).find((record) => record.mint === mint && record.quote.quote === quoteId && !record.nutzap);
+            if (pending && pending.amount !== amount)
+                throw new Error("Quote amount does not match the saved deposit");
+            if (!pending) {
+                const wallet = await this.getCashuWallet(mint);
+                const response = await wallet.checkMintQuoteBolt11(quoteId);
+                pending = await recovery.adoptQuote({ mint, amount }, response);
+            }
+            await recovery.resume(pending.id);
         });
     }
     /**
@@ -513,22 +534,56 @@ export class NutWallet {
      *
      * For bolt11 it creates a mint quote, surfaces the invoice via `onQuote`, waits for it to be paid,
      * and redeems the proofs.
+     * @throws if the deposit fails, is cancelled, or times out
      */
     async deposit(options) {
+        const recovery = this.mintRecovery;
         const method = options.method ?? "bolt11";
         switch (method) {
             case "bolt11": {
-                const { mint, amount, description, onQuote, signal, timeoutMs } = options;
-                const quote = await this.createMintQuote(mint, amount, description);
-                onQuote?.(quote);
-                await this.waitForMintQuote(mint, quote.quote, { signal, timeoutMs });
-                await this.redeemMintQuote(mint, amount, quote);
+                options.signal?.throwIfAborted();
+                if (!recovery) {
+                    const { mint, amount, description, onQuote, signal, timeoutMs } = options;
+                    const quote = await this.createMintQuote(mint, amount, description);
+                    await onQuote?.(quote);
+                    await this.waitForMintQuote(mint, quote.quote, { signal, timeoutMs });
+                    await this.redeemMintQuote(mint, amount, quote);
+                    return;
+                }
+                const pending = await this.track("mintQuote", () => recovery.prepare(options));
+                await this.resumeDeposit(pending.id, options);
                 return;
             }
             default:
                 throw new Error(`Unsupported deposit method: ${method}`);
         }
     }
+    requireMintRecovery() {
+        if (!this.mintRecovery)
+            throw new Error("Configure recovery storage before depositing");
+        return this.mintRecovery;
+    }
+    /**
+     * Lists pending deposits without signing or publishing
+     * @throws if recovery storage is missing, unavailable, or contains invalid records
+     */
+    async getPendingDeposits() {
+        return (await this.requireMintRecovery().getPending()).filter((pending) => !pending.nutzap);
+    }
+    /**
+     * Imports an owner-tagged deposit journal created by an older example
+     * @throws if recovery storage is missing or migration cannot complete safely
+     */
+    async importLegacyDeposit(key, source) {
+        return this.requireMintRecovery().importLegacyDeposit(key, this.couch, source);
+    }
+    /**
+     * Resumes a pending deposit using its saved outputs and signed events
+     * @throws if recovery storage is missing or the operation cannot complete safely
+     */
+    async resumeDeposit(id, options = {}) {
+        await this.track("mint", () => this.requireMintRecovery().resume(id, options));
+    }
     /**
      * Withdraws funds from a mint's balance using the given payment method (melts ecash). This is the
      * method-agnostic entry point; {@link payInvoice} is the bolt11 alias. New payment methods are added
@@ -899,6 +954,8 @@ export class NutWallet {
             throw new Error("No relays available to publish event");
         this.log("Publishing event %s (kind %d) to %d relays", event.id.slice(0, 8), event.kind, targets.length);
         const responses = await this.pool.publish(targets, event);
+        if (!responses.some((response) => response.ok))
+            throw new Error("No relay accepted the wallet event");
         for (const response of responses)
             if (response.ok)
                 addSeenRelay(event, response.from);

package/dist/wallet/types.d.ts

@@ -6,6 +6,7 @@ import type { RelayPool } from "applesauce-relay";
 import type { Observable } from "rxjs";
 import type { WalletToken } from "../casts/wallet-token.js";
 import type { Couch } from "../helpers/couch.js";
+import type { RecoveryStorage } from "../helpers/recovery-storage.js";
 /** Options for constructing a {@link NutWallet} */
 export interface NutWalletOptions {
     /** The pubkey of the wallet owner */
@@ -18,6 +19,8 @@ export interface NutWalletOptions {
     eventStore: EventStore;
     /** A couch used to keep tokens safe during multi-step operations */
     couch: Couch;
+    /** Optional app-scoped storage enabling durable deposit recovery */
+    recovery?: RecoveryStorage;
     /**
      * Override the relay set used for loading and publishing.
      * When omitted, the relays are derived from the wallet's own relay list plus the user's outbox relays.
@@ -64,7 +67,7 @@ export interface Bolt11DepositOptions {
     /** An optional description for the generated lightning invoice */
     description?: string;
     /** Called with the mint quote so the caller can display the lightning invoice to pay */
-    onQuote?: (quote: MintQuoteBolt11Response) => void;
+    onQuote?: (quote: MintQuoteBolt11Response) => void | Promise<void>;
     /** Aborts waiting for the quote to be paid */
     signal?: AbortSignal;
     /** Rejects if the quote is not paid within this many milliseconds */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "applesauce-wallet",
-  "version": "7.0.0",
+  "version": "7.1.1",
   "description": "",
   "type": "module",
   "main": "dist/index.js",
@@ -87,12 +87,12 @@
     }
   },
   "dependencies": {
-    "@cashu/cashu-ts": "^4.11.0",
+    "@cashu/cashu-ts": "^4.13.0",
     "@gandlaf21/bc-ur": "^1.1.12",
-    "applesauce-actions": "^7.0.0",
-    "applesauce-common": "^7.0.0",
-    "applesauce-core": "^7.0.0",
-    "applesauce-loaders": "^7.0.0",
+    "applesauce-actions": "^7.1.0",
+    "applesauce-common": "^7.1.0",
+    "applesauce-core": "^7.1.0",
+    "applesauce-loaders": "^7.1.0",
     "rxjs": "^7.8.2"
   },
   "peerDependencies": {
@@ -101,11 +101,11 @@
   },
   "devDependencies": {
     "@hirez_io/observer-spy": "^2.2.0",
-    "applesauce-relay": "^7.0.0",
-    "applesauce-signers": "^7.0.0",
-    "rimraf": "^6.1.3",
+    "applesauce-relay": "^7.1.0",
+    "applesauce-signers": "^7.1.0",
+    "rimraf": "^6.1.4",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.1.0"
   },
   "funding": {
     "type": "lightning",
@@ -115,7 +115,7 @@
     "prebuild": "rimraf dist",
     "build": "tsc",
     "watch:build": "tsc --watch > /dev/null",
-    "test": "vitest run --passWithNoTests",
-    "watch:test": "vitest"
+    "test": "vitest run --config ../../vitest.config.mts --dir . --passWithNoTests",
+    "watch:test": "vitest --config ../../vitest.config.mts --dir ."
   }
 }