beignet 0.24.0 → 0.24.1

package/README.md

@@ -755,7 +755,9 @@ Recommended safeguards in production:
 - Cap exposure with `maxPaymentSats` and `dailySpendLimitSats`. Both count a
   payment's amount plus its routing-fee cap, so the fee cannot slip past them:
   the cap is `maxFeeSats`/`maxFeeMsat` when you pass one, and 1% of the
-  amount (never below 50 sats) when you do not.
+  amount (never below 50 sats) when you do not. Both also cover external
+  on-chain sends (amount plus fee); see the Spending Limits section of
+  `src/cli/README.md`.
 - Call `validatePayment()` before every send.
 - Set `backupPath` for automated database backups, and keep an SCB (`beignet backup scb`).
 - Keep `~/.beignet` and the data directory owner-only. The CLI creates them `0700`/`0600` and tightens an older config on load; check them again after copying files between hosts.

package/dist/cli/backup-destination.js

@@ -0,0 +1,89 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBackupDestination = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const backup_mac_1 = require("./backup-mac");
+function canonicalPath(p) {
+    const resolved = path.resolve(p);
+    try {
+        return fs.realpathSync.native(resolved);
+    }
+    catch {
+        return path.join(fs.realpathSync.native(path.dirname(resolved)), path.basename(resolved));
+    }
+}
+function resolveBackupDestination(destPath, protectedPaths, overwrite) {
+    let target;
+    try {
+        target = canonicalPath(destPath);
+    }
+    catch {
+        return {
+            refusal: `Backup directory does not exist: ${path.dirname(path.resolve(destPath))}`
+        };
+    }
+    if (target !== target.trim()) {
+        return { refusal: 'Backup filename must not start or end with whitespace' };
+    }
+    const stat = fs.statSync(target, { throwIfNoEntry: false });
+    if (!stat && fs.lstatSync(target, { throwIfNoEntry: false })) {
+        return { refusal: `destPath is a broken symlink: ${target}` };
+    }
+    for (const p of protectedPaths) {
+        let own;
+        try {
+            own = canonicalPath(p);
+        }
+        catch {
+            own = path.resolve(p);
+        }
+        if (own === target) {
+            return { refusal: `Refusing to overwrite a daemon file: ${target}` };
+        }
+    }
+    if (stat && !stat.isFile()) {
+        return { refusal: `destPath is not a regular file: ${target}` };
+    }
+    if (stat && !overwrite) {
+        return {
+            refusal: `destPath already exists: ${target}. Pass overwrite: true to replace it`
+        };
+    }
+    const macPath = (0, backup_mac_1.backupMacPath)(target);
+    const macStat = fs.lstatSync(macPath, { throwIfNoEntry: false });
+    if (macStat && !macStat.isFile()) {
+        return { refusal: `MAC path is not a regular file: ${macPath}` };
+    }
+    if (macStat && !overwrite) {
+        return {
+            refusal: `MAC path already exists: ${macPath}. Pass overwrite: true to replace it`
+        };
+    }
+    return { path: target };
+}
+exports.resolveBackupDestination = resolveBackupDestination;
+//# sourceMappingURL=backup-destination.js.map

package/dist/cli/backup-destination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-destination.js","sourceRoot":"","sources":["../../src/cli/backup-destination.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,uCAAyB;AACzB,2CAA6B;AAC7B,6CAA6C;AAS7C,SAAS,aAAa,CAAC,CAAS;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;KACxC;IAAC,MAAM;QACP,OAAO,IAAI,CAAC,IAAI,CACf,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAC9C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACvB,CAAC;KACF;AACF,CAAC;AAMD,SAAgB,wBAAwB,CACvC,QAAgB,EAChB,cAAwB,EACxB,SAAkB;IAElB,IAAI,MAAc,CAAC;IACnB,IAAI;QACH,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;KACjC;IAAC,MAAM;QACP,OAAO;YACN,OAAO,EAAE,oCAAoC,IAAI,CAAC,OAAO,CACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CACtB,EAAE;SACH,CAAC;KACF;IAED,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE;QAC7B,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;KAC5E;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;QAC7D,OAAO,EAAE,OAAO,EAAE,iCAAiC,MAAM,EAAE,EAAE,CAAC;KAC9D;IACD,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE;QAC/B,IAAI,GAAW,CAAC;QAChB,IAAI;YACH,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;SACvB;QAAC,MAAM;YACP,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB;QACD,IAAI,GAAG,KAAK,MAAM,EAAE;YACnB,OAAO,EAAE,OAAO,EAAE,wCAAwC,MAAM,EAAE,EAAE,CAAC;SACrE;KACD;IACD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;QAC3B,OAAO,EAAE,OAAO,EAAE,mCAAmC,MAAM,EAAE,EAAE,CAAC;KAChE;IACD,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE;QACvB,OAAO;YACN,OAAO,EAAE,4BAA4B,MAAM,sCAAsC;SACjF,CAAC;KACF;IAED,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE;QACjC,OAAO,EAAE,OAAO,EAAE,mCAAmC,OAAO,EAAE,EAAE,CAAC;KACjE;IACD,IAAI,OAAO,IAAI,CAAC,SAAS,EAAE;QAC1B,OAAO;YACN,OAAO,EAAE,4BAA4B,OAAO,sCAAsC;SAClF,CAAC;KACF;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAvDD,4DAuDC"}

package/dist/cli/backup-mac.js

@@ -0,0 +1,74 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBackupMac = exports.writeBackupMac = exports.fileMac = exports.deriveBackupMacKey = exports.backupMacPath = void 0;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const encryption_1 = require("../lightning/storage/encryption");
+const fs_utils_1 = require("./fs-utils");
+const BACKUP_MAC_INFO = 'beignet-db-backup-mac-v1';
+const BACKUP_MAC_PREFIX = 'beignet-db-mac-v1:';
+function backupMacPath(backupPath) {
+    return `${backupPath}.hmac`;
+}
+exports.backupMacPath = backupMacPath;
+function deriveBackupMacKey(seed) {
+    return (0, encryption_1.hkdfKey)(seed, BACKUP_MAC_INFO);
+}
+exports.deriveBackupMacKey = deriveBackupMacKey;
+async function fileMac(key, filePath) {
+    const hmac = (0, crypto_1.createHmac)('sha256', key);
+    for await (const chunk of fs.createReadStream(filePath)) {
+        hmac.update(chunk);
+    }
+    return hmac.digest();
+}
+exports.fileMac = fileMac;
+async function writeBackupMac(key, backupPath) {
+    const mac = await fileMac(key, backupPath);
+    (0, fs_utils_1.writeFileAtomic)(backupMacPath(backupPath), `${BACKUP_MAC_PREFIX}${mac.toString('hex')}\n`);
+}
+exports.writeBackupMac = writeBackupMac;
+function readBackupMac(backupPath) {
+    const macPath = backupMacPath(backupPath);
+    let text;
+    try {
+        text = fs.readFileSync(macPath, 'utf8').trim();
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    const hex = text.startsWith(BACKUP_MAC_PREFIX)
+        ? text.slice(BACKUP_MAC_PREFIX.length)
+        : '';
+    if (!/^[0-9a-f]{64}$/.test(hex)) {
+        throw new Error(`Malformed backup MAC file: ${macPath}`);
+    }
+    return Buffer.from(hex, 'hex');
+}
+exports.readBackupMac = readBackupMac;
+//# sourceMappingURL=backup-mac.js.map

package/dist/cli/backup-mac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-mac.js","sourceRoot":"","sources":["../../src/cli/backup-mac.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,mCAAoC;AACpC,uCAAyB;AACzB,gEAA0D;AAC1D,yCAA6C;AAE7C,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAG/C,SAAgB,aAAa,CAAC,UAAkB;IAC/C,OAAO,GAAG,UAAU,OAAO,CAAC;AAC7B,CAAC;AAFD,sCAEC;AAGD,SAAgB,kBAAkB,CAAC,IAAY;IAC9C,OAAO,IAAA,oBAAO,EAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACvC,CAAC;AAFD,gDAEC;AAGM,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,QAAgB;IAC1D,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE;QACxD,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;KAC7B;IACD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;AACtB,CAAC;AAND,0BAMC;AAGM,KAAK,UAAU,cAAc,CACnC,GAAW,EACX,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAA,0BAAe,EACd,aAAa,CAAC,UAAU,CAAC,EACzB,GAAG,iBAAiB,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAC9C,CAAC;AACH,CAAC;AATD,wCASC;AAMD,SAAgB,aAAa,CAAC,UAAkB;IAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,IAAY,CAAC;IACjB,IAAI;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;KAC/C;IAAC,OAAO,GAAG,EAAE;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;KACV;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;IACN,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChC,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;KACzD;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAhBD,sCAgBC"}

package/dist/cli/beignet-node.js

@@ -42,6 +42,7 @@ const conversion_1 = require("../utils/conversion");
 const wallet_3 = require("../types/wallet");
 const wallet_storage_1 = require("./wallet-storage");
 const fs_utils_1 = require("./fs-utils");
+const backup_mac_1 = require("./backup-mac");
 const node_storage_view_1 = require("./node-storage-view");
 const electrum_1 = require("../types/electrum");
 const lightning_node_1 = require("../lightning/node/lightning-node");
@@ -703,6 +704,7 @@ class BeignetNode extends events_1.EventEmitter {
         this._dailySpendResetTime = 0;
         this._pendingSpendSats = 0;
         this._asyncSpendClaims = new Map();
+        this._liveRebalanceChargeSats = 0;
         this._onchainSendLock = Promise.resolve();
         this._l402Credentials = new l402_1.MemoryL402CredentialStore();
         this._draining = false;
@@ -1241,7 +1243,10 @@ class BeignetNode extends events_1.EventEmitter {
                 }
                 : {}),
             peerStorageEnabled: this.peerStorageEnabled,
-            autoRebalance: opts.autoRebalance,
+            autoRebalance: opts.autoRebalance && {
+                ...opts.autoRebalance,
+                enabled: false
+            },
             autoTuneFees: opts.autoTuneFees,
             watchtowers: opts.watchtowers,
             recovery: this.recoveryNodeConfig
@@ -1710,6 +1715,16 @@ class BeignetNode extends events_1.EventEmitter {
         if (opts.maxPaymentSats !== undefined && opts.maxPaymentSats > 0) {
             this._maxPaymentSats = opts.maxPaymentSats;
         }
+        if (opts.autoRebalance?.enabled === true) {
+            this._autoRebalanceTimer = setInterval(() => {
+                this.executeRebalances().catch((err) => {
+                    this.log('warn', 'Automatic rebalance failed', {
+                        error: err instanceof Error ? err.message : String(err)
+                    });
+                });
+            }, opts.autoRebalance.intervalMs ?? 3600000);
+            this._autoRebalanceTimer.unref?.();
+        }
         if (opts.autoBootstrap) {
             this.node.connectToSeeds().catch(() => {
             });
@@ -1901,13 +1916,18 @@ class BeignetNode extends events_1.EventEmitter {
         });
     }
     relayRecordTooLarge(event) {
-        if (event.type !== 'record:too-large')
+        if (event.type !== 'record:too-large' &&
+            event.type !== 'record:quota-refused') {
             return;
-        this.log('error', 'Recovery guardian refused an oversized record', {
-            detail: event.detail
-        });
+        }
+        const tooLarge = event.type === 'record:too-large';
+        this.log('error', tooLarge
+            ? 'Recovery guardian refused an oversized record'
+            : 'Recovery guardian refused a record: its quota is full', { detail: event.detail });
         const data = {
-            code: 'RECOVERY_RECORD_TOO_LARGE',
+            code: tooLarge
+                ? 'RECOVERY_RECORD_TOO_LARGE'
+                : 'RECOVERY_GUARDIAN_QUOTA_EXCEEDED',
             message: event.detail,
             timestamp: Date.now()
         };
@@ -2620,6 +2640,10 @@ class BeignetNode extends events_1.EventEmitter {
             clearInterval(this._fallbackRecoveryTimer);
             this._fallbackRecoveryTimer = undefined;
         }
+        if (this._autoRebalanceTimer) {
+            clearInterval(this._autoRebalanceTimer);
+            this._autoRebalanceTimer = undefined;
+        }
         this.paymentQueue?.removeAllListeners();
         this.node.destroy();
         try {
@@ -2831,6 +2855,10 @@ class BeignetNode extends events_1.EventEmitter {
                     ...(0, recovery_1.bindGuardianSet)(incoming, { transportFor })
                 },
                 required: recovery_1.CRASH_V1_PROFILE.required,
+                journalKeys: {
+                    masterKey: (0, recovery_1.deriveRecoveryMasterKey)(this.nodeSecret()),
+                    nodeId: (0, ecdh_1.getPublicKey)(this.nodeSecret())
+                },
                 onEvent: (event) => this.noteRotationEvent(event),
                 onReplicationEvent: (event) => {
                     this.log('debug', `Rotation replication: ${event.type}`, {
@@ -3348,6 +3376,7 @@ class BeignetNode extends events_1.EventEmitter {
         return run;
     }
     async sendOnchain(address, amountSats, satsPerVbyte) {
+        this._checkMaxPayment(amountSats);
         this._checkSpendLimit(amountSats);
         return this._runOnchainSend(async () => {
             try {
@@ -3361,19 +3390,27 @@ class BeignetNode extends events_1.EventEmitter {
                 if (result.isErr()) {
                     throw new errors_1.BeignetError('SEND_FAILED', result.error.message);
                 }
-                if (this._dailySpendLimitSats === undefined) {
+                if (this._dailySpendLimitSats === undefined &&
+                    this._maxPaymentSats === undefined) {
                     return await this._broadcastRawTx(result.value);
                 }
                 const totalSats = this._builtOnchainTotalSats(amountSats);
+                this._checkMaxPayment(totalSats, amountSats, {
+                    name: 'on-chain fees',
+                    param: 'satsPerVbyte'
+                });
                 this._checkSpendLimit(totalSats);
-                this._pendingSpendSats += totalSats;
+                const reserving = this._dailySpendLimitSats !== undefined;
+                if (reserving)
+                    this._pendingSpendSats += totalSats;
                 try {
                     const info = await this._broadcastRawTx(result.value);
                     this._recordSpend(totalSats, 'onchain');
                     return info;
                 }
                 finally {
-                    this._pendingSpendSats -= totalSats;
+                    if (reserving)
+                        this._pendingSpendSats -= totalSats;
                 }
             }
             finally {
@@ -3601,24 +3638,29 @@ class BeignetNode extends events_1.EventEmitter {
                 if (result.isErr()) {
                     throw new errors_1.BeignetError('SEND_FAILED', result.error.message);
                 }
-                if (this._dailySpendLimitSats === undefined) {
+                if (this._dailySpendLimitSats === undefined &&
+                    this._maxPaymentSats === undefined) {
                     return await this._broadcastRawTx(result.value);
                 }
                 const totalSats = this.wallet.transaction.getTransactionInputValue({
                     inputs: this.wallet.transaction.data.inputs
                 });
                 if (totalSats <= 0) {
-                    throw new errors_1.BeignetError('SPENDING_LIMIT_EXCEEDED', 'Unable to determine the swept amount for the daily spend limit check; refusing to send');
+                    throw new errors_1.BeignetError('SPENDING_LIMIT_EXCEEDED', 'Unable to determine the swept amount for the spend limit checks; refusing to send');
                 }
+                this._checkMaxPayment(totalSats);
                 this._checkSpendLimit(totalSats);
-                this._pendingSpendSats += totalSats;
+                const reserving = this._dailySpendLimitSats !== undefined;
+                if (reserving)
+                    this._pendingSpendSats += totalSats;
                 try {
                     const info = await this._broadcastRawTx(result.value);
                     this._recordSpend(totalSats, 'onchain');
                     return info;
                 }
                 finally {
-                    this._pendingSpendSats -= totalSats;
+                    if (reserving)
+                        this._pendingSpendSats -= totalSats;
                 }
             }
             finally {
@@ -5097,6 +5139,10 @@ class BeignetNode extends events_1.EventEmitter {
             try {
                 const quote = sender.quote(opts.request, sendOpts);
                 costSats = Number(quote.amountSat + quote.maxTotalFeeSat);
+                this._checkMaxPayment(costSats, Number(quote.amountSat), {
+                    name: 'fees',
+                    param: 'maxTotalFeeSat'
+                });
                 this._checkSpendLimit(costSats);
             }
             catch (err) {
@@ -5287,6 +5333,11 @@ class BeignetNode extends events_1.EventEmitter {
             this._dailySpentSats = 0;
             this._dailySpentLightningSats = 0;
             this._dailySpentOnchainSats = 0;
+            if (this._dailySpendLimitSats !== undefined &&
+                this._liveRebalanceChargeSats > 0) {
+                this._dailySpentSats = this._liveRebalanceChargeSats;
+                this._dailySpentLightningSats = this._liveRebalanceChargeSats;
+            }
             if (persist)
                 this._persistSpendState();
         }
@@ -5305,14 +5356,14 @@ class BeignetNode extends events_1.EventEmitter {
             throw new errors_1.BeignetError('SPENDING_LIMIT_EXCEEDED', `Daily spend limit exceeded. Limit: ${this._dailySpendLimitSats} sats, spent: ${this._dailySpentSats} sats, remaining: ${remaining} sats, requested: ${requested}`);
         }
     }
-    _checkMaxPayment(spendSats, amountSats = spendSats) {
+    _checkMaxPayment(spendSats, amountSats = spendSats, fees = { name: 'routing fees', param: 'maxFeeSats' }) {
         if (this._maxPaymentSats === undefined)
             return;
         if (amountSats > this._maxPaymentSats) {
             throw new errors_1.BeignetError('SPENDING_LIMIT_EXCEEDED', `Payment amount ${amountSats} sats exceeds per-payment limit of ${this._maxPaymentSats} sats`);
         }
         if (spendSats > this._maxPaymentSats) {
-            throw new errors_1.BeignetError('SPENDING_LIMIT_EXCEEDED', `Payment amount ${amountSats} sats plus up to ${spendSats - amountSats} sats in routing fees exceeds per-payment limit of ${this._maxPaymentSats} sats; lower maxFeeSats or the amount`);
+            throw new errors_1.BeignetError('SPENDING_LIMIT_EXCEEDED', `Payment amount ${amountSats} sats plus up to ${spendSats - amountSats} sats in ${fees.name} exceeds per-payment limit of ${this._maxPaymentSats} sats; lower ${fees.param} or the amount`);
         }
     }
     _admitLightningSpend(claimKey, payAmountMsat, maxFeeMsat) {
@@ -5337,6 +5388,14 @@ class BeignetNode extends events_1.EventEmitter {
         }
         this._persistSpendState();
     }
+    _refundSpend(sats) {
+        if (this._dailySpendLimitSats === undefined)
+            return;
+        this._resetDailySpendIfNeeded(false);
+        this._dailySpentSats -= sats;
+        this._dailySpentLightningSats -= sats;
+        this._persistSpendState();
+    }
     _openAsyncSpendClaim(paymentHashHex, amountSats) {
         if (this._dailySpendLimitSats === undefined)
             return undefined;
@@ -5667,8 +5726,9 @@ class BeignetNode extends events_1.EventEmitter {
     _builtOnchainTotalSats(amountSats) {
         const feeSats = this.wallet.transaction?.data?.fee;
         if (!Number.isFinite(feeSats) || feeSats < 0) {
-            if (this._dailySpendLimitSats !== undefined) {
-                throw new errors_1.BeignetError('SPENDING_LIMIT_EXCEEDED', 'Unable to determine the transaction fee for the daily spend limit check; refusing to send');
+            if (this._dailySpendLimitSats !== undefined ||
+                this._maxPaymentSats !== undefined) {
+                throw new errors_1.BeignetError('SPENDING_LIMIT_EXCEEDED', 'Unable to determine the transaction fee for the spend limit checks; refusing to send');
             }
             return amountSats;
         }
@@ -6706,6 +6766,10 @@ class BeignetNode extends events_1.EventEmitter {
                 destinationScriptLen: destinationScript.length
             }), feeratePerkw));
             externalSpendSats = amountSats + feeSats;
+            this._checkMaxPayment(externalSpendSats, amountSats, {
+                name: 'on-chain fees',
+                param: 'feeratePerkw'
+            });
             this._checkSpendLimit(externalSpendSats);
         }
         const result = fundingOrRefuse(() => this.node.spliceOut(idBuf, BigInt(amountSats), feeratePerkw, destinationScript));
@@ -7186,12 +7250,31 @@ class BeignetNode extends events_1.EventEmitter {
             throw new errors_1.BeignetError(errors_1.BeignetErrorCode.INVALID_PARAMS, 'amountSats must be a positive integer');
         if (!Number.isInteger(maxFeeSats) || maxFeeSats < 0)
             throw new errors_1.BeignetError(errors_1.BeignetErrorCode.INVALID_PARAMS, 'maxFeeSats must be a non-negative integer');
-        const result = await this.node.rebalanceChannel({
-            fromChannelId: Buffer.from(fromChannelId, 'hex'),
-            toChannelId: Buffer.from(toChannelId, 'hex'),
-            amountSats: BigInt(amountSats),
-            maxFeeSats: BigInt(maxFeeSats)
-        });
+        this._checkDraining();
+        this._checkSpendLimit(maxFeeSats);
+        this._recordSpend(maxFeeSats);
+        this._liveRebalanceChargeSats += maxFeeSats;
+        let spentSats = maxFeeSats;
+        let result;
+        try {
+            result = await this.node.rebalanceChannel({
+                fromChannelId: Buffer.from(fromChannelId, 'hex'),
+                toChannelId: Buffer.from(toChannelId, 'hex'),
+                amountSats: BigInt(amountSats),
+                maxFeeSats: BigInt(maxFeeSats)
+            });
+            spentSats = spendLimitSats(result.feeMsat);
+        }
+        catch (err) {
+            if (!(err instanceof types_6.PaymentWaitTimeoutError))
+                spentSats = 0;
+            throw err;
+        }
+        finally {
+            if (!this.destroyed)
+                this._refundSpend(maxFeeSats - spentSats);
+            this._liveRebalanceChargeSats -= maxFeeSats;
+        }
         this.log('info', 'Rebalance completed', {
             fromChannelId,
             toChannelId,
@@ -7211,9 +7294,37 @@ class BeignetNode extends events_1.EventEmitter {
             (!Number.isInteger(budgetSatsPerDay) || budgetSatsPerDay < 0)) {
             throw new errors_1.BeignetError(errors_1.BeignetErrorCode.INVALID_PARAMS, 'budgetSatsPerDay must be a non-negative integer');
         }
-        const summary = await this.node.executeRebalanceRecommendations({
-            budgetSatsPerDay
-        });
+        this._checkDraining();
+        const holdSats = this.node.rebalanceBudgetSatsPerDay(budgetSatsPerDay);
+        if (!Number.isInteger(holdSats) || holdSats < 0) {
+            throw new errors_1.BeignetError(errors_1.BeignetErrorCode.INVALID_PARAMS, 'autoRebalance.budgetSatsPerDay must be a non-negative integer');
+        }
+        this._checkSpendLimit(holdSats);
+        this._recordSpend(holdSats);
+        this._liveRebalanceChargeSats += holdSats;
+        let spentSats = holdSats;
+        let reachedPlans = false;
+        let summary;
+        try {
+            summary = await this.node.executeRebalanceRecommendations({
+                budgetSatsPerDay,
+                stopRequested: () => {
+                    reachedPlans = true;
+                    return this._draining;
+                }
+            });
+            spentSats = spendLimitSats(summary.feeSpentMsat);
+        }
+        catch (err) {
+            if (!reachedPlans)
+                spentSats = 0;
+            throw err;
+        }
+        finally {
+            if (!this.destroyed)
+                this._refundSpend(holdSats - spentSats);
+            this._liveRebalanceChargeSats -= holdSats;
+        }
         return {
             attempts: summary.attempts.map((a) => ({
                 fromChannelId: a.fromChannelId,
@@ -7749,12 +7860,22 @@ class BeignetNode extends events_1.EventEmitter {
     }
     async backup(destPath) {
         await this.storage.backup(destPath);
+        await (0, backup_mac_1.writeBackupMac)((0, backup_mac_1.deriveBackupMacKey)(bip39.mnemonicToSeedSync(this.mnemonic)), destPath);
+    }
+    storageFiles() {
+        const dbPath = fs.realpathSync.native(path.join(this.dataDir, `${this.networkName}.db`));
+        return [
+            dbPath,
+            `${dbPath}-wal`,
+            `${dbPath}-shm`,
+            `${dbPath}-journal`,
+            path.join(this.dataDir, `${this.networkName}.lock`)
+        ];
     }
     performScheduledBackup() {
         if (!this.backupPath || this.destroyed)
             return;
-        this._backupPromise = this.storage
-            .backup(this.backupPath)
+        this._backupPromise = this.backup(this.backupPath)
             .then(() => {
             this.log('info', 'Scheduled backup completed', {
                 path: this.backupPath
@@ -8008,6 +8129,10 @@ class BeignetNode extends events_1.EventEmitter {
             clearInterval(this._fallbackRecoveryTimer);
             this._fallbackRecoveryTimer = undefined;
         }
+        if (this._autoRebalanceTimer) {
+            clearInterval(this._autoRebalanceTimer);
+            this._autoRebalanceTimer = undefined;
+        }
         this.paymentQueue?.stop();
         this.paymentQueue?.removeAllListeners();
         this.directFundingSender?.stop();
@@ -8052,6 +8177,10 @@ class BeignetNode extends events_1.EventEmitter {
             clearInterval(this._fallbackRecoveryTimer);
             this._fallbackRecoveryTimer = undefined;
         }
+        if (this._autoRebalanceTimer) {
+            clearInterval(this._autoRebalanceTimer);
+            this._autoRebalanceTimer = undefined;
+        }
         if (this._confirmTimer) {
             clearTimeout(this._confirmTimer);
             this._confirmTimer = undefined;