thunder-bridge 0.8.10 → 1.0.0

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   GatewayCheatError: () => GatewayCheatError,
+  Gateways: () => Gateways,
   IDEMPOTENCY_KEY_REUSED: () => IDEMPOTENCY_KEY_REUSED,
   IdempotencyConflictError: () => IdempotencyConflictError,
   NO_WALLET_AVAILABLE: () => NO_WALLET_AVAILABLE,
@@ -46,6 +47,7 @@ __export(index_exports, {
   invoiceToSvg: () => invoiceToSvg,
   isProblemType: () => isProblemType,
   isProvablyPaid: () => isProvablyPaid,
+  isProvablySettled: () => isProvablySettled,
   kraken: () => kraken,
   lightningRail: () => lightningRail,
   lnurlToDataUrl: () => lnurlToDataUrl,
@@ -54,6 +56,8 @@ __export(index_exports, {
   minorScaleOf: () => minorScaleOf,
   minorUnitsOf: () => minorUnitsOf,
   msatFor: () => msatFor,
+  parseSettlement: () => parseSettlement,
+  parseSettlementRequest: () => parseSettlementRequest,
   parseWatchedWebhook: () => parseWatchedWebhook,
   parseWatchedWebhookRequest: () => parseWatchedWebhookRequest,
   parseWebhook: () => parseWebhook,
@@ -402,6 +406,105 @@ function wordsToBytes(words) {
   return Uint8Array.from(bytes);
 }
 
+// ../core/ed25519.ts
+var ALGORITHM = { name: "Ed25519" };
+var SEED_BYTES = 32;
+var SIGNATURE_BYTES = 64;
+var PUBLIC_KEY_BYTES = 32;
+var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
+async function signingKeyFromSeed(seed) {
+  if (seed.length !== SEED_BYTES) throw new Error(`an ed25519 seed is ${SEED_BYTES} bytes`);
+  const wrapped = new Uint8Array(PKCS8_HEADER.length + SEED_BYTES);
+  wrapped.set(PKCS8_HEADER);
+  wrapped.set(seed, PKCS8_HEADER.length);
+  const key = await crypto.subtle.importKey("pkcs8", asBuffer(wrapped), ALGORITHM, true, ["sign"]);
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  return {
+    publicKeyHex: bytesToHex(fromBase64Url(jwk.x ?? "")),
+    sign: async (payload) => bytesToHex(new Uint8Array(await crypto.subtle.sign(ALGORITHM, key, asBuffer(payload))))
+  };
+}
+async function verifyHex(publicKeyHex, signatureHex, payload) {
+  if (!isHex(publicKeyHex) || publicKeyHex.length !== PUBLIC_KEY_BYTES * 2) return false;
+  if (!isHex(signatureHex) || signatureHex.length !== SIGNATURE_BYTES * 2) return false;
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      asBuffer(hexToBytes(publicKeyHex)),
+      ALGORITHM,
+      false,
+      ["verify"]
+    );
+    return await crypto.subtle.verify(
+      ALGORITHM,
+      key,
+      asBuffer(hexToBytes(signatureHex)),
+      asBuffer(payload)
+    );
+  } catch {
+    return false;
+  }
+}
+function fromBase64Url(text2) {
+  const padded = text2.replace(/-/g, "+").replace(/_/g, "/");
+  const raw = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const bytes = new Uint8Array(raw.length);
+  for (let at = 0; at < raw.length; at++) bytes[at] = raw.charCodeAt(at);
+  return bytes;
+}
+function asBuffer(bytes) {
+  return bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer2(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer2(message))));
+}
+function equalInConstantTime(one, other) {
+  if (one.length !== other.length) return false;
+  let difference = 0;
+  for (let at = 0; at < one.length; at++) difference |= one.charCodeAt(at) ^ other.charCodeAt(at);
+  return difference === 0;
+}
+function asBuffer2(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
+// ../core/caller.ts
+var KEY_HEADER = "x-client-key";
+var SIGNATURE_HEADER = "x-signature";
+var TIMESTAMP_HEADER = "x-timestamp";
+var PREFIX = "ed25519=";
+var SIGNING_LABEL = "request-signing";
+async function callerKey(secret) {
+  return await signingKeyFromSeed(hexToBytes(await hmacHex(secret, SIGNING_LABEL)));
+}
+function paymentNamedBy(caller, paymentHash) {
+  return sha256Hex(`${caller}.payment-id.${paymentHash}`);
+}
+async function signedAs(key, method, path, body) {
+  const timestamp = String(Math.floor(Date.now() / 1e3));
+  return {
+    [KEY_HEADER]: key.publicKeyHex,
+    [TIMESTAMP_HEADER]: timestamp,
+    [SIGNATURE_HEADER]: `${PREFIX}${await key.sign(spoken(timestamp, method, path, body))}`
+  };
+}
+function spoken(timestamp, method, path, body) {
+  return new TextEncoder().encode(
+    `${timestamp}.${method.toUpperCase()}.${path}.${sha256Hex(body)}`
+  );
+}
+
 // ../core/url.ts
 var PRIVATE_SUFFIXES = ["localhost", "local", "internal", "lan", "arpa", "test", "invalid"];
 function publicHttps(raw) {
@@ -550,7 +653,7 @@ function createRequestBody(params, trigger) {
   return JSON.stringify({
     ln_addresses: params.lnAddresses,
     incoming_amount: toAmount(params.amountMsat),
-    webhook: params.webhookUrl ? { url: params.webhookUrl, secret: params.webhookSecret } : void 0,
+    webhook: params.webhookUrl ? { url: params.webhookUrl } : void 0,
     trigger: trigger ?? void 0
   });
 }
@@ -616,9 +719,21 @@ function watchRequestBody(params, trigger) {
     expires_at: expiresAt.toISOString(),
     trigger: trigger ?? void 0,
     sealed: params.sealed,
-    webhook: params.webhookUrl ? { url: params.webhookUrl, secret: params.webhookSecret } : void 0
+    webhook: params.webhookUrl ? { url: params.webhookUrl } : void 0
   });
 }
+function settlementFromWire(body) {
+  const wire = asObject(body);
+  if (wire === null) return null;
+  const id = text(wire["id"]);
+  const paymentHash = text(wire["payment_hash"]);
+  const settledAt = secondsFrom(wire["settled_at"]);
+  const status = wire["status"];
+  const preimage = wire["preimage"] ?? null;
+  if (id === null || paymentHash === null || settledAt === null || !isStatus(status)) return null;
+  if (preimage !== null && typeof preimage !== "string") return null;
+  return { id, status, paymentHash, preimage, settledAt };
+}
 function triggerEventFromWire(body) {
   const wire = asObject(body);
   if (wire === null) return null;
@@ -716,11 +831,14 @@ var ThunderBridge = class {
   baseUrl;
   verify;
   token;
+  secret;
   strangers = null;
+  speaks = null;
   constructor(baseUrl, options) {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.verify = options?.verify ?? true;
     this.token = options?.token ?? null;
+    this.secret = options?.secret ?? null;
   }
   /**
    * Whether a token was given, which is what makes an instance yours: a gateway
@@ -751,15 +869,16 @@ var ThunderBridge = class {
    * and `GatewayCheatError` when what comes back is not what you asked for
    */
   async createPayment(params, options) {
-    const headers = this.sending();
+    const sent = createRequestBody(
+      params,
+      options?.trigger ? sha256Hex(unguessable(options.trigger)) : null
+    );
+    const headers = await this.sending("/incoming-payments", sent);
     if (options?.idempotencyKey) headers["idempotency-key"] = options.idempotencyKey;
     const response = await fetch(`${this.baseUrl}/incoming-payments`, {
       method: "POST",
       headers,
-      body: createRequestBody(
-        params,
-        options?.trigger ? sha256Hex(unguessable(options.trigger)) : null
-      )
+      body: sent
     });
     if (!response.ok) throw await problemFrom(response);
     const payment = await paymentFrom(response);
@@ -774,10 +893,11 @@ var ThunderBridge = class {
    * it for one, and asking mints it
    */
   async createQuote(params) {
+    const sent = quoteRequestBody(params);
     const response = await fetch(`${this.baseUrl}/quotes`, {
       method: "POST",
-      headers: this.sending(),
-      body: quoteRequestBody(params)
+      headers: await this.sending("/quotes", sent),
+      body: sent
     });
     if (!response.ok) throw await problemFrom(response);
     const quote = quoteFromWire(await response.json().catch(() => null));
@@ -808,8 +928,9 @@ var ThunderBridge = class {
     return body.public_key;
   }
   async getPayment(id) {
-    const response = await fetch(`${this.baseUrl}/incoming-payments/${encodeURIComponent(id)}`, {
-      headers: this.reading()
+    const path = `/incoming-payments/${encodeURIComponent(id)}`;
+    const response = await fetch(`${this.baseUrl}${path}`, {
+      headers: await this.reading("GET", path)
     });
     if (response.status === 404) return null;
     if (!response.ok) throw await problemFrom(response);
@@ -821,8 +942,9 @@ var ThunderBridge = class {
    * `getPayment` refuses it and this reads the shape both rails share
    */
   async getWatched(id) {
-    const response = await fetch(`${this.baseUrl}/incoming-payments/${encodeURIComponent(id)}`, {
-      headers: this.reading()
+    const path = `/incoming-payments/${encodeURIComponent(id)}`;
+    const response = await fetch(`${this.baseUrl}${path}`, {
+      headers: await this.reading("GET", path)
     });
     if (response.status === 404) return null;
     if (!response.ok) throw await problemFrom(response);
@@ -845,9 +967,9 @@ var ThunderBridge = class {
    * pretend otherwise
    */
   async listPayments(limit) {
-    const query = limit === void 0 ? "" : `?limit=${limit}`;
-    const response = await fetch(`${this.baseUrl}/incoming-payments${query}`, {
-      headers: this.reading()
+    const path = `/incoming-payments${limit === void 0 ? "" : `?limit=${limit}`}`;
+    const response = await fetch(`${this.baseUrl}${path}`, {
+      headers: await this.reading("GET", path)
     });
     if (!response.ok) throw await problemFrom(response);
     const body = await response.json().catch(() => null);
@@ -1015,13 +1137,14 @@ var ThunderBridge = class {
    * the watcher needs goes in `sealed`, which the gateway cannot read
    */
   async watchPayment(params) {
+    const sent = watchRequestBody(
+      params,
+      params.trigger ? sha256Hex(unguessable(params.trigger)) : null
+    );
     const response = await fetch(`${this.baseUrl}/watched-payments`, {
       method: "POST",
-      headers: this.sending(),
-      body: watchRequestBody(
-        params,
-        params.trigger ? sha256Hex(unguessable(params.trigger)) : null
-      )
+      headers: await this.sending("/watched-payments", sent),
+      body: sent
     });
     if (!response.ok) throw await problemFrom(response);
     const watched = triggerEventFromWire(await response.json().catch(() => null));
@@ -1031,8 +1154,22 @@ var ThunderBridge = class {
         title: "The gateway answered with something that is not a watched payment"
       });
     }
+    const named = await this.nameFor(params.paymentHash);
+    if (named !== null && watched.id !== named) {
+      throw new GatewayCheatError("id_not_mine", watched.id);
+    }
     return watched;
   }
+  /**
+   * What this payment is called, which you can work out before any gateway has
+   * heard of it. Every gateway you hand the same invoice to answers with the same
+   * name, so watching at several of them adds up to one payment rather than
+   * several, and no gateway's key is in the answer. Null when no secret was given,
+   * because then the gateway names the payment and only it can
+   */
+  async nameFor(paymentHash) {
+    return this.secret === null ? null : paymentNamedBy((await this.speaking()).publicKeyHex, paymentHash);
+  }
   /**
    * Follow every payment made to one trigger, replayed from the recent ones on
    * connect and then live, reconnecting on its own until the returned function
@@ -1089,10 +1226,11 @@ var ThunderBridge = class {
     return asked === true || this.token !== null;
   }
   async wsTicket(body) {
+    const sent = JSON.stringify(body);
     const response = await fetch(`${this.baseUrl}/ws-tickets`, {
       method: "POST",
-      headers: this.sending(),
-      body: JSON.stringify(body)
+      headers: await this.sending("/ws-tickets", sent),
+      body: sent
     });
     if (!response.ok) throw await problemFrom(response);
     const minted = await response.json().catch(() => null);
@@ -1104,11 +1242,18 @@ var ThunderBridge = class {
     }
     return encodeURIComponent(minted.ticket);
   }
-  sending() {
-    return { "content-type": "application/json", ...this.reading() };
+  async sending(path, body) {
+    return { "content-type": "application/json", ...await this.reading("POST", path, body) };
+  }
+  async reading(method, path, body = "") {
+    return {
+      ...this.token === null ? {} : { authorization: `Bearer ${this.token}` },
+      ...this.secret === null ? {} : await signedAs(await this.speaking(), method, path, body)
+    };
   }
-  reading() {
-    return this.token === null ? {} : { authorization: `Bearer ${this.token}` };
+  async speaking() {
+    this.speaks ??= callerKey(this.secret ?? "");
+    return await this.speaks;
   }
   proven(settled) {
     const unproven = settled.status === "paid" && (settled.preimage === null || !preimageMatchesHash(settled.preimage, settled.paymentHash));
@@ -1153,6 +1298,80 @@ function refusals(wallets) {
   });
 }
 
+// src/gateways.ts
+var Gateways = class {
+  each;
+  urls;
+  onRefused;
+  constructor(baseUrls, options) {
+    if (baseUrls.length === 0) throw new Error("name at least one gateway to watch at");
+    this.urls = [...baseUrls];
+    this.each = baseUrls.map((baseUrl) => new ThunderBridge(baseUrl, options));
+    this.onRefused = options?.onRefused ?? (() => {
+    });
+  }
+  /** What this payment is called, which every gateway here will agree on */
+  async nameFor(paymentHash) {
+    return await this.each[0].nameFor(paymentHash);
+  }
+  /**
+   * Hand the same invoice to every gateway. Throws only when none of them took it,
+   * carrying the first refusal, because one gateway that agreed is enough to be
+   * watched
+   */
+  async watchPayment(params) {
+    const asked = await Promise.allSettled(this.each.map((gateway) => gateway.watchPayment(params)));
+    const taken = [];
+    const refusals3 = [];
+    for (const [at, answer] of asked.entries()) {
+      if (answer.status === "fulfilled") {
+        taken.push(answer.value);
+        continue;
+      }
+      refusals3.push(answer.reason);
+      this.onRefused(this.urls[at], answer.reason);
+    }
+    if (taken[0] === void 0) throw refusals3[0];
+    return taken[0];
+  }
+  /**
+   * Wait for whichever gateway speaks first. A settlement from any of them is the
+   * settlement, and each has already proved the preimage against the hash before
+   * saying so. When they all end without a payment, the first ending is the answer,
+   * and when they all fail, the first failure is thrown
+   */
+  async waitForWatched(id, options) {
+    const stopLosers = new AbortController();
+    const signal = options?.signal ? AbortSignal.any([stopLosers.signal, options.signal]) : stopLosers.signal;
+    const unpaid = [];
+    let refused = null;
+    try {
+      const settled = await new Promise((resolve2) => {
+        let waiting = this.each.length;
+        const lost = () => {
+          waiting -= 1;
+          if (waiting === 0) resolve2(null);
+        };
+        for (const gateway of this.each) {
+          gateway.waitForWatched(id, { ...options, signal }).then((watched) => {
+            if (watched.status === "paid") return resolve2(watched);
+            unpaid.push(watched);
+            lost();
+          }).catch((failure) => {
+            refused ??= failure;
+            lost();
+          });
+        }
+      });
+      if (settled !== null) return settled;
+      if (unpaid.length > 0) return unpaid[0];
+      throw refused;
+    } finally {
+      stopLosers.abort();
+    }
+  }
+};
+
 // ../core/sealed.ts
 var VERSION = "v1";
 var IV_BYTES = 12;
@@ -1175,7 +1394,7 @@ async function seal(secret, plaintext) {
 async function unseal(secret, sealed) {
   const key = await keyFor(secret);
   if (!sealed.startsWith(`${VERSION}.`)) return null;
-  const joined = fromBase64Url(sealed.slice(VERSION.length + 1));
+  const joined = fromBase64Url2(sealed.slice(VERSION.length + 1));
   if (joined === null || joined.length <= IV_BYTES) return null;
   try {
     const body = await crypto.subtle.decrypt(
@@ -1212,7 +1431,7 @@ function toBase64Url(bytes) {
   for (const byte of bytes) binary += String.fromCharCode(byte);
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function fromBase64Url(text2) {
+function fromBase64Url2(text2) {
   if (text2.length === 0 || !/^[A-Za-z0-9_-]+$/.test(text2)) return null;
   try {
     const binary = atob(text2.replace(/-/g, "+").replace(/_/g, "/"));
@@ -1224,29 +1443,6 @@ function fromBase64Url(text2) {
   }
 }
 
-// ../core/hmac.ts
-async function hmacHex(secret, payload) {
-  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
-  const key = await crypto.subtle.importKey(
-    "raw",
-    asBuffer(raw),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
-  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
-}
-function equalInConstantTime(one, other) {
-  if (one.length !== other.length) return false;
-  let difference = 0;
-  for (let at = 0; at < one.length; at++) difference |= one.charCodeAt(at) ^ other.charCodeAt(at);
-  return difference === 0;
-}
-function asBuffer(bytes) {
-  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
-}
-
 // src/currency.ts
 var ISO_4217_MINOR_UNITS = {
   BHD: 3,
@@ -1289,57 +1485,21 @@ function minorScaleOf(currency) {
   return 10 ** minorUnitsOf(currency);
 }
 
-// ../core/ed25519.ts
-var ALGORITHM = { name: "Ed25519" };
-var SIGNATURE_BYTES = 64;
-var PUBLIC_KEY_BYTES = 32;
-var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
-async function verifyHex(publicKeyHex, signatureHex, payload) {
-  if (!isHex(publicKeyHex) || publicKeyHex.length !== PUBLIC_KEY_BYTES * 2) return false;
-  if (!isHex(signatureHex) || signatureHex.length !== SIGNATURE_BYTES * 2) return false;
-  try {
-    const key = await crypto.subtle.importKey(
-      "raw",
-      asBuffer2(hexToBytes(publicKeyHex)),
-      ALGORITHM,
-      false,
-      ["verify"]
-    );
-    return await crypto.subtle.verify(
-      ALGORITHM,
-      key,
-      asBuffer2(hexToBytes(signatureHex)),
-      asBuffer2(payload)
-    );
-  } catch {
-    return false;
-  }
-}
-function asBuffer2(bytes) {
-  return bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
-}
-
 // src/webhook.ts
-var SIGNATURE_HEADER = "x-signature";
-var TIMESTAMP_HEADER = "x-timestamp";
-var SHARED_SECRET_PREFIX = "sha256=";
+var SIGNATURE_HEADER2 = "x-signature";
+var TIMESTAMP_HEADER2 = "x-timestamp";
 var GATEWAY_KEY_PREFIX = "ed25519=";
 var DEFAULT_TOLERANCE_SECS = 300;
 var CHALLENGE = "webhook-challenge";
 var VERIFY_CHALLENGE = "verify-challenge";
 async function verifyWebhookSignature(body, signature, credential, timestamp, options = {}) {
   if (!recent(timestamp, options.toleranceSecs ?? DEFAULT_TOLERANCE_SECS)) return false;
-  if (typeof credential !== "string") {
-    if (!signature.startsWith(GATEWAY_KEY_PREFIX)) return false;
-    return verifyHex(
-      credential.publicKey.toLowerCase(),
-      signature.slice(GATEWAY_KEY_PREFIX.length).toLowerCase(),
-      signed(timestamp, body)
-    );
-  }
-  if (signature.startsWith(GATEWAY_KEY_PREFIX)) return false;
-  const received = signature.startsWith(SHARED_SECRET_PREFIX) ? signature.slice(SHARED_SECRET_PREFIX.length) : signature;
-  return equalInConstantTime(await sign(credential, timestamp, body), received.toLowerCase());
+  if (!signature.startsWith(GATEWAY_KEY_PREFIX)) return false;
+  return await verifyHex(
+    credential.publicKey.toLowerCase(),
+    signature.slice(GATEWAY_KEY_PREFIX.length).toLowerCase(),
+    signed(timestamp, body)
+  );
 }
 async function parseWebhook(body, signature, credential, timestamp, options = {}) {
   if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) return null;
@@ -1351,8 +1511,8 @@ async function parseWebhook(body, signature, credential, timestamp, options = {}
   }
 }
 async function parseWebhookRequest(request, credential, options = {}) {
-  const signature = request.headers.get(SIGNATURE_HEADER);
-  const timestamp = request.headers.get(TIMESTAMP_HEADER);
+  const signature = request.headers.get(SIGNATURE_HEADER2);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER2);
   if (signature === null || timestamp === null) return null;
   return parseWebhook(await request.text(), signature, credential, timestamp, options);
 }
@@ -1366,25 +1526,37 @@ async function parseWatchedWebhook(body, signature, credential, timestamp, optio
   }
 }
 async function parseWatchedWebhookRequest(request, credential, options = {}) {
-  const signature = request.headers.get(SIGNATURE_HEADER);
-  const timestamp = request.headers.get(TIMESTAMP_HEADER);
+  const signature = request.headers.get(SIGNATURE_HEADER2);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER2);
   if (signature === null || timestamp === null) return null;
   return parseWatchedWebhook(await request.text(), signature, credential, timestamp, options);
 }
+async function parseSettlement(body, signature, credential, timestamp, options = {}) {
+  if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) return null;
+  try {
+    return settlementFromWire(JSON.parse(textOf(body)));
+  } catch {
+    return null;
+  }
+}
+async function parseSettlementRequest(request, credential, options = {}) {
+  const signature = request.headers.get(SIGNATURE_HEADER2);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER2);
+  if (signature === null || timestamp === null) return null;
+  return await parseSettlement(await request.text(), signature, credential, timestamp, options);
+}
+function isProvablySettled(settled) {
+  if (settled.status !== "paid" || settled.preimage === null) return false;
+  return preimageMatchesHash(settled.preimage, settled.paymentHash);
+}
 async function answerWebhookChallenge(body, signature, credential, timestamp, options = {}) {
   if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) return null;
-  const text2 = typeof body === "string" ? body : new TextDecoder().decode(body);
-  const nonce = challenged(text2);
-  if (nonce === null) return null;
-  if (typeof credential !== "string") return JSON.stringify({ nonce });
-  return JSON.stringify({
-    nonce,
-    signature: `${SHARED_SECRET_PREFIX}${await hmacHex(credential, nonce)}`
-  });
+  const nonce = challenged(typeof body === "string" ? body : new TextDecoder().decode(body));
+  return nonce === null ? null : JSON.stringify({ nonce });
 }
 async function answerWebhookChallengeRequest(request, credential, options = {}) {
-  const signature = request.headers.get(SIGNATURE_HEADER);
-  const timestamp = request.headers.get(TIMESTAMP_HEADER);
+  const signature = request.headers.get(SIGNATURE_HEADER2);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER2);
   if (signature === null || timestamp === null) return null;
   const answer = await answerWebhookChallenge(
     await request.clone().text(),
@@ -1395,6 +1567,9 @@ async function answerWebhookChallengeRequest(request, credential, options = {})
   );
   return answer === null ? null : new Response(answer, { headers: { "content-type": "application/json" } });
 }
+function textOf(body) {
+  return typeof body === "string" ? body : new TextDecoder().decode(body);
+}
 function challenged(text2) {
   return nonceOf(text2, CHALLENGE);
 }
@@ -1421,9 +1596,6 @@ function recent(timestamp, toleranceSecs) {
   if (!Number.isFinite(sent)) return false;
   return Math.abs(Math.floor(Date.now() / 1e3) - sent) <= toleranceSecs;
 }
-async function sign(secret, timestamp, body) {
-  return hmacHex(secret, signed(timestamp, body));
-}
 function signed(timestamp, body) {
   const encoder = new TextEncoder();
   const stamp = encoder.encode(`${timestamp}.`);
@@ -1458,8 +1630,7 @@ async function bankTransfer(params) {
     expiresAt: params.expiresAt,
     trigger: params.trigger,
     sealed: params.sealed,
-    webhookUrl: params.webhookUrl,
-    webhookSecret: params.webhookSecret
+    webhookUrl: params.webhookUrl
   });
   return { id: watched.id, paymentHash: watched.paymentHash, verifyUrl, spd };
 }
@@ -1786,7 +1957,6 @@ function bankRail(config) {
       sealed: await config.sealed?.(order),
       variableSymbol: config.variableSymbol?.(order),
       webhookUrl: config.webhookUrl,
-      webhookSecret: config.webhookSecret,
       allowPublicGateway: config.allowPublicGateway
     });
     return {
@@ -1804,8 +1974,7 @@ function lightningRail(config) {
       {
         lnAddresses: config.lnAddresses,
         amountMsat: await config.amountMsat(order),
-        webhookUrl: config.webhookUrl,
-        webhookSecret: config.webhookSecret
+        webhookUrl: config.webhookUrl
       },
       { idempotencyKey: config.idempotencyKey?.(order), trigger: config.trigger }
     );
@@ -1943,6 +2112,7 @@ function refusals2(answers) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   GatewayCheatError,
+  Gateways,
   IDEMPOTENCY_KEY_REUSED,
   IdempotencyConflictError,
   NO_WALLET_AVAILABLE,
@@ -1968,6 +2138,7 @@ function refusals2(answers) {
   invoiceToSvg,
   isProblemType,
   isProvablyPaid,
+  isProvablySettled,
   kraken,
   lightningRail,
   lnurlToDataUrl,
@@ -1976,6 +2147,8 @@ function refusals2(answers) {
   minorScaleOf,
   minorUnitsOf,
   msatFor,
+  parseSettlement,
+  parseSettlementRequest,
   parseWatchedWebhook,
   parseWatchedWebhookRequest,
   parseWebhook,