thunder-bridge 1.1.0 → 1.3.0

package/dist/index.js

@@ -1,67 +1,9 @@
-// src/errors.ts
-var GatewayCheatError = class extends Error {
-  code;
-  paymentId;
-  constructor(code, paymentId) {
-    super(`gateway verification failed: ${code}`);
-    this.name = "GatewayCheatError";
-    this.code = code;
-    this.paymentId = paymentId;
-  }
-};
-var UnverifiedRecipientError = class extends Error {
-  lnAddress;
-  paymentId;
-  constructor(lnAddress, paymentId, cause) {
-    super(`could not reach ${lnAddress} to verify the invoice: ${String(cause)}`);
-    this.name = "UnverifiedRecipientError";
-    this.lnAddress = lnAddress;
-    this.paymentId = paymentId;
-  }
-};
-var ProblemError = class extends Error {
-  type;
-  title;
-  status;
-  detail;
-  constructor(problem) {
-    const title = problem.title ?? "Request failed";
-    super(problem.detail ? `${title}: ${problem.detail}` : title);
-    this.name = "ProblemError";
-    this.type = problem.type ?? "about:blank";
-    this.title = title;
-    this.status = problem.status ?? 0;
-    this.detail = problem.detail ?? null;
-  }
-};
-function isProblemType(problem, type) {
-  return problem.type === type;
-}
-var NO_WALLET_AVAILABLE = "urn:problem-type:thunder-bridge:no-wallet-available";
-var REQUEST_IN_FLIGHT = "urn:problem-type:thunder-bridge:request-in-flight";
-var IDEMPOTENCY_KEY_REUSED = "urn:problem-type:thunder-bridge:idempotency-key-reused";
-var PAYMENT_ALREADY_WATCHED = "urn:problem-type:thunder-bridge:payment-already-watched";
-var IdempotencyConflictError = class extends ProblemError {
-  conflict;
-  constructor(problem, conflict) {
-    super(problem);
-    this.name = "IdempotencyConflictError";
-    this.conflict = conflict;
-  }
-};
-var NoWalletAvailableError = class extends ProblemError {
-  wallets;
-  constructor(problem, wallets) {
-    super({ ...problem, type: NO_WALLET_AVAILABLE });
-    this.name = "NoWalletAvailableError";
-    this.wallets = wallets;
-  }
-};
-
 // ../core/bytes.ts
 function bytesToHex(bytes) {
   let hex = "";
-  for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+  for (const byte of bytes) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
   return hex;
 }
 function hexToBytes(hex) {
@@ -179,7 +121,9 @@ function withPadding(bytes) {
   return padded;
 }
 function fillSchedule(schedule, reader, block) {
-  for (let at = 0; at < 16; at++) schedule[at] = reader.getUint32(block + at * 4, false);
+  for (let at = 0; at < 16; at++) {
+    schedule[at] = reader.getUint32(block + at * 4, false);
+  }
   for (let at = 16; at < SCHEDULE_WORDS; at++) {
     const recent2 = schedule[at - 15];
     const distant = schedule[at - 2];
@@ -213,12 +157,16 @@ function compress(state, schedule) {
     a = carried + (mixedA + majority | 0) | 0;
   }
   const rolling = [a, b, c, d, e, f, g, h];
-  for (let at = 0; at < state.length; at++) state[at] = state[at] + rolling[at] | 0;
+  for (let at = 0; at < state.length; at++) {
+    state[at] = state[at] + rolling[at] | 0;
+  }
 }
 function asBytes(state) {
   const digest = new Uint8Array(state.length * 4);
   const writer = new DataView(digest.buffer);
-  for (let at = 0; at < state.length; at++) writer.setUint32(at * 4, state[at], false);
+  for (let at = 0; at < state.length; at++) {
+    writer.setUint32(at * 4, state[at], false);
+  }
   return digest;
 }
 function rotate(value, by) {
@@ -259,20 +207,30 @@ function decodeInvoice(bolt11) {
   };
 }
 function preimageMatchesHash(preimage, paymentHash) {
-  if (!isHex(preimage)) return false;
+  if (!isHex(preimage)) {
+    return false;
+  }
   return bytesToHex(sha256(hexToBytes(preimage))) === paymentHash.toLowerCase();
 }
 function splitBech32(bolt11) {
   const lower = bolt11.toLowerCase();
-  if (isBolt12Encoding(lower)) return null;
+  if (isBolt12Encoding(lower)) {
+    return null;
+  }
   const separator = lower.lastIndexOf("1");
-  if (separator < 1) return null;
+  if (separator < 1) {
+    return null;
+  }
   const dataChars = lower.slice(separator + 1);
-  if (dataChars.length < CHECKSUM_WORDS) return null;
+  if (dataChars.length < CHECKSUM_WORDS) {
+    return null;
+  }
   const words = [];
   for (const char of dataChars) {
     const value = BECH32_CHARSET.indexOf(char);
-    if (value === -1) return null;
+    if (value === -1) {
+      return null;
+    }
     words.push(value);
   }
   return { hrp: lower.slice(0, separator), words: words.slice(0, -CHECKSUM_WORDS) };
@@ -288,25 +246,35 @@ function taggedFields(words) {
     const lengthWords = words[cursor + 1] * 32 + words[cursor + 2];
     const dataStart = cursor + 1 + TAGGED_FIELD_LENGTH_WORDS;
     const dataEnd = dataStart + lengthWords;
-    if (dataEnd > signatureStart) return fields;
-    if (!fields.has(words[cursor])) fields.set(words[cursor], words.slice(dataStart, dataEnd));
+    if (dataEnd > signatureStart) {
+      return fields;
+    }
+    if (!fields.has(words[cursor])) {
+      fields.set(words[cursor], words.slice(dataStart, dataEnd));
+    }
     cursor = dataEnd;
   }
   return fields;
 }
 function hexTag(fields, tag, expectedWords) {
   const words = fields.get(tag);
-  if (words === void 0 || words.length !== expectedWords) return null;
+  if (words === void 0 || words.length !== expectedWords) {
+    return null;
+  }
   return bytesToHex(wordsToBytes(words));
 }
 function expiryOf(words, fields) {
-  if (words.length < TIMESTAMP_WORDS + SIGNATURE_WORDS) return null;
+  if (words.length < TIMESTAMP_WORDS + SIGNATURE_WORDS) {
+    return null;
+  }
   const expiry = fields.get(EXPIRY_TAG);
   return readNumber(words.slice(0, TIMESTAMP_WORDS)) + (expiry ? readNumber(expiry) : DEFAULT_EXPIRY_SECS);
 }
 function amountFromHrp(hrp) {
   const match = HRP_AMOUNT.exec(hrp);
-  if (match === null) return null;
+  if (match === null) {
+    return null;
+  }
   const [, digits, multiplier] = match;
   return multiplier ? Number(digits) * HRP_MULTIPLIER_MSAT[multiplier] : Number(digits) * MSAT_PER_BTC;
 }
@@ -328,105 +296,6 @@ function wordsToBytes(words) {
   return Uint8Array.from(bytes);
 }
 
-// ../core/ed25519.ts
-var ALGORITHM = { name: "Ed25519" };
-var SEED_BYTES = 32;
-var SIGNATURE_BYTES = 64;
-var PUBLIC_KEY_BYTES = 32;
-var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
-async function signingKeyFromSeed(seed) {
-  if (seed.length !== SEED_BYTES) throw new Error(`an ed25519 seed is ${SEED_BYTES} bytes`);
-  const wrapped = new Uint8Array(PKCS8_HEADER.length + SEED_BYTES);
-  wrapped.set(PKCS8_HEADER);
-  wrapped.set(seed, PKCS8_HEADER.length);
-  const key = await crypto.subtle.importKey("pkcs8", asBuffer(wrapped), ALGORITHM, true, ["sign"]);
-  const jwk = await crypto.subtle.exportKey("jwk", key);
-  return {
-    publicKeyHex: bytesToHex(fromBase64Url(jwk.x ?? "")),
-    sign: async (payload) => bytesToHex(new Uint8Array(await crypto.subtle.sign(ALGORITHM, key, asBuffer(payload))))
-  };
-}
-async function verifyHex(publicKeyHex, signatureHex, payload) {
-  if (!isHex(publicKeyHex) || publicKeyHex.length !== PUBLIC_KEY_BYTES * 2) return false;
-  if (!isHex(signatureHex) || signatureHex.length !== SIGNATURE_BYTES * 2) return false;
-  try {
-    const key = await crypto.subtle.importKey(
-      "raw",
-      asBuffer(hexToBytes(publicKeyHex)),
-      ALGORITHM,
-      false,
-      ["verify"]
-    );
-    return await crypto.subtle.verify(
-      ALGORITHM,
-      key,
-      asBuffer(hexToBytes(signatureHex)),
-      asBuffer(payload)
-    );
-  } catch {
-    return false;
-  }
-}
-function fromBase64Url(text2) {
-  const padded = text2.replace(/-/g, "+").replace(/_/g, "/");
-  const raw = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
-  const bytes = new Uint8Array(raw.length);
-  for (let at = 0; at < raw.length; at++) bytes[at] = raw.charCodeAt(at);
-  return bytes;
-}
-function asBuffer(bytes) {
-  return bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
-}
-
-// ../core/hmac.ts
-async function hmacHex(secret, payload) {
-  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
-  const key = await crypto.subtle.importKey(
-    "raw",
-    asBuffer2(raw),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
-  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer2(message))));
-}
-function equalInConstantTime(one, other) {
-  if (one.length !== other.length) return false;
-  let difference = 0;
-  for (let at = 0; at < one.length; at++) difference |= one.charCodeAt(at) ^ other.charCodeAt(at);
-  return difference === 0;
-}
-function asBuffer2(bytes) {
-  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
-}
-
-// ../core/caller.ts
-var KEY_HEADER = "x-client-key";
-var SIGNATURE_HEADER = "x-signature";
-var TIMESTAMP_HEADER = "x-timestamp";
-var PREFIX = "ed25519=";
-var SIGNING_LABEL = "request-signing";
-async function callerKey(secret) {
-  return await signingKeyFromSeed(hexToBytes(await hmacHex(secret, SIGNING_LABEL)));
-}
-function paymentNamedBy(caller, paymentHash) {
-  return sha256Hex(`${caller}.payment-id.${paymentHash}`);
-}
-async function signedAs(key, method, path, body) {
-  const timestamp = String(Math.floor(Date.now() / 1e3));
-  return {
-    [KEY_HEADER]: key.publicKeyHex,
-    [TIMESTAMP_HEADER]: timestamp,
-    [SIGNATURE_HEADER]: `${PREFIX}${await key.sign(spoken(timestamp, method, path, body))}`
-  };
-}
-function spoken(timestamp, method, path, body) {
-  return new TextEncoder().encode(
-    `${timestamp}.${method.toUpperCase()}.${path}.${sha256Hex(body)}`
-  );
-}
-
 // ../core/url.ts
 var PRIVATE_SUFFIXES = ["localhost", "local", "internal", "lan", "arpa", "test", "invalid"];
 function publicHttps(raw) {
@@ -449,11 +318,17 @@ function publicAddress(literal) {
   return literal.includes(":") ? ipv6IsGlobal(literal) : ipv4IsGlobal(literal);
 }
 function hostIsPublic(host) {
-  if (host.startsWith("[")) return publicAddress(host.slice(1, -1));
+  if (host.startsWith("[")) {
+    return publicAddress(host.slice(1, -1));
+  }
   const name = host.replace(/\.$/, "");
-  if (/^\d+\.\d+\.\d+\.\d+$/.test(name)) return publicAddress(name);
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(name)) {
+    return publicAddress(name);
+  }
   const labels = name.split(".");
-  if (labels.length < 2 || labels.some((label) => label === "")) return false;
+  if (labels.length < 2 || labels.some((label) => label === "")) {
+    return false;
+  }
   return !PRIVATE_SUFFIXES.includes(labels[labels.length - 1]);
 }
 function ipv4IsGlobal(literal) {
@@ -462,25 +337,43 @@ function ipv4IsGlobal(literal) {
     return false;
   }
   const [a, b] = parts;
-  if (a === 0 || a === 10 || a === 127 || a >= 240) return false;
-  if (a === 100 && b >= 64 && b < 128) return false;
-  if (a === 169 && b === 254) return false;
-  if (a === 172 && b >= 16 && b < 32) return false;
-  if (a === 192 && b === 168) return false;
+  if (a === 0 || a === 10 || a === 127 || a >= 240) {
+    return false;
+  }
+  if (a === 100 && b >= 64 && b < 128) {
+    return false;
+  }
+  if (a === 169 && b === 254) {
+    return false;
+  }
+  if (a === 172 && b >= 16 && b < 32) {
+    return false;
+  }
+  if (a === 192 && b === 168) {
+    return false;
+  }
   return true;
 }
 function ipv6IsGlobal(literal) {
   const groups = ipv6Groups(literal.toLowerCase());
-  if (groups.length !== 8 || groups.some(Number.isNaN)) return false;
+  if (groups.length !== 8 || groups.some(Number.isNaN)) {
+    return false;
+  }
   const leading = groups.slice(0, 5).every((group) => group === 0);
-  if (leading && groups[5] === 0 && groups[6] === 0 && groups[7] <= 1) return false;
+  if (leading && groups[5] === 0 && groups[6] === 0 && groups[7] <= 1) {
+    return false;
+  }
   if (leading && groups[5] === 65535) {
     const [high, low] = [groups[6], groups[7]];
     return ipv4IsGlobal(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
   }
   const first = groups[0];
-  if ((first & 65024) === 64512) return false;
-  if ((first & 65472) === 65152) return false;
+  if ((first & 65024) === 64512) {
+    return false;
+  }
+  if ((first & 65472) === 65152) {
+    return false;
+  }
   return true;
 }
 function ipv6Groups(address) {
@@ -491,74 +384,276 @@ function ipv6Groups(address) {
   return [...left, ...gap, ...right].map((group) => parseInt(group, 16));
 }
 
-// src/verify.ts
-var HTTP_TIMEOUT_MS = 15e3;
-async function proveOrigin(payment, request) {
-  const cheat = (code) => new GatewayCheatError(code, payment.id);
-  const listed = request.lnAddresses.find(
-    (address) => equalIgnoringCase(address, payment.lnAddress)
-  );
-  if (listed === void 0) throw cheat("address_not_requested");
-  if (payment.amountMsat !== request.amountMsat) throw cheat("amount_mismatch");
-  const invoice = decodeInvoice(payment.bolt11);
-  if (invoice.paymentHash === null || !equalIgnoringCase(invoice.paymentHash, payment.paymentHash)) {
-    throw cheat("hash_mismatch");
-  }
-  if (invoice.amountMsat !== request.amountMsat) throw cheat("amount_mismatch");
-  const payRequest = await payRequestFor(listed, payment);
-  if (typeof payRequest.metadata !== "string" || typeof payRequest.callback !== "string") {
-    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "no payRequest served");
-  }
-  if (invoice.descriptionHash !== sha256Hex(payRequest.metadata)) {
-    throw cheat("description_hash_mismatch");
-  }
-  if (!sameOrigin(payment.verifyUrl, payRequest.callback)) throw cheat("verify_url_foreign");
-  const issued = await reachable(payment.verifyUrl, payment);
-  if (typeof issued.pr !== "string" || !equalIgnoringCase(issued.pr, payment.bolt11)) {
-    throw cheat("invoice_not_issued");
+// ../core/lnurl.ts
+var BECH32_CHARSET2 = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+var BECH32_GENERATOR = [996825010, 642813549, 513874426, 1027748829, 705979059];
+var CHECKSUM_SLOTS = [0, 1, 2, 3, 4, 5];
+var LNURL_HRP = "lnurl";
+function toLnurl(endpoint) {
+  const scheme = parsedScheme(endpoint);
+  if (scheme !== "https:" && scheme !== "http:") {
+    throw new Error(`${endpoint} is not an http or https URL`);
   }
+  const words = toWords(new TextEncoder().encode(endpoint));
+  const data = [...words, ...checksumWords(LNURL_HRP, words)];
+  return `${LNURL_HRP}1${data.map((word) => BECH32_CHARSET2[word]).join("")}`.toUpperCase();
 }
-async function proveSettlement(payment, request) {
-  await proveOrigin(payment, request);
-  const verified = await reachable(payment.verifyUrl, payment);
-  if (verified.settled !== true || typeof verified.preimage !== "string") return null;
-  if (!preimageMatchesHash(verified.preimage, payment.paymentHash)) {
-    throw new GatewayCheatError("preimage_mismatch", payment.id);
+function parsedScheme(endpoint) {
+  try {
+    return new URL(endpoint).protocol;
+  } catch {
+    return null;
   }
-  return verified.preimage;
-}
-function isProvablyPaid(payment) {
-  if (payment.status !== "paid" || payment.preimage === null) return false;
-  const invoiceHash = decodeInvoice(payment.bolt11).paymentHash;
-  if (invoiceHash === null || !equalIgnoringCase(invoiceHash, payment.paymentHash)) return false;
-  return preimageMatchesHash(payment.preimage, invoiceHash);
 }
-async function payRequestFor(listed, payment) {
-  const at = listed.indexOf("@");
-  const name = listed.slice(0, at);
-  const domain = listed.slice(at + 1).toLowerCase();
-  if (at < 1 || !publicHttps(`https://${domain}/`)) {
-    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "not a usable address");
+function toWords(bytes) {
+  const words = [];
+  let accumulator = 0;
+  let bits = 0;
+  for (const byte of bytes) {
+    accumulator = accumulator << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      words.push(accumulator >> bits & 31);
+    }
   }
-  return reachable(`https://${domain}/.well-known/lnurlp/${name}`, payment);
+  if (bits > 0) {
+    words.push(accumulator << 5 - bits & 31);
+  }
+  return words;
 }
-async function reachable(url, payment) {
+function checksumWords(hrp, words) {
+  const expanded = [...hrp].map((char) => char.charCodeAt(0));
+  const values = [
+    ...expanded.map((code) => code >> 5),
+    0,
+    ...expanded.map((code) => code & 31),
+    ...words,
+    ...CHECKSUM_SLOTS.map(() => 0)
+  ];
+  const polymod = bech32Polymod(values) ^ 1;
+  return CHECKSUM_SLOTS.map((slot) => polymod >> 5 * (5 - slot) & 31);
+}
+function bech32Polymod(values) {
+  let checksum = 1;
+  for (const value of values) {
+    const top = checksum >> 25;
+    checksum = (checksum & 33554431) << 5 ^ value;
+    for (let bit = 0; bit < 5; bit++) {
+      if (top >> bit & 1) {
+        checksum ^= BECH32_GENERATOR[bit];
+      }
+    }
+  }
+  return checksum;
+}
+
+// ../core/sealed.ts
+var VERSION = "v1";
+var IV_BYTES = 12;
+var MIN_SECRET_CHARS = 32;
+var MAX_PLAIN_BYTES = 3e3;
+var INFO = new TextEncoder().encode("thunder-bridge/sealed");
+async function seal(secret, plaintext) {
+  const body = new TextEncoder().encode(plaintext);
+  if (body.length > MAX_PLAIN_BYTES) {
+    throw new Error(`sealed takes at most ${MAX_PLAIN_BYTES} bytes, this was ${body.length}`);
+  }
+  const key = await keyFor(secret);
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const cipher = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, body));
+  const joined = new Uint8Array(iv.length + cipher.length);
+  joined.set(iv);
+  joined.set(cipher, iv.length);
+  return `${VERSION}.${toBase64Url(joined)}`;
+}
+async function unseal(secret, sealed) {
+  const key = await keyFor(secret);
+  if (!sealed.startsWith(`${VERSION}.`)) {
+    return null;
+  }
+  const joined = fromBase64Url(sealed.slice(VERSION.length + 1));
+  if (joined === null || joined.length <= IV_BYTES) {
+    return null;
+  }
   try {
-    if (!publicHttps(url)) throw new Error(`${url} is not a public https URL`);
-    const response = await fetch(url, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
-      headers: { accept: "application/json" }
-    });
-    if (!response.ok) throw new Error(`answered ${response.status}`);
-    const body = await response.json();
-    if (body === null || typeof body !== "object") throw new Error("answered with no JSON object");
-    return body;
-  } catch (cause) {
-    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, cause);
+    const body = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: joined.slice(0, IV_BYTES) },
+      key,
+      joined.slice(IV_BYTES)
+    );
+    return new TextDecoder().decode(body);
+  } catch {
+    return null;
   }
 }
-function equalIgnoringCase(one, other) {
-  return one.toLowerCase() === other.toLowerCase();
+async function keyFor(secret) {
+  if (secret.length < MIN_SECRET_CHARS) {
+    throw new Error(`the sealing secret needs ${MIN_SECRET_CHARS} characters of randomness`);
+  }
+  const material = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    "HKDF",
+    false,
+    ["deriveKey"]
+  );
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: INFO },
+    material,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(text2) {
+  if (text2.length === 0 || !/^[A-Za-z0-9_-]+$/.test(text2)) {
+    return null;
+  }
+  try {
+    const binary = atob(text2.replace(/-/g, "+").replace(/_/g, "/"));
+    const bytes = new Uint8Array(binary.length);
+    for (let at = 0; at < bytes.length; at++) {
+      bytes[at] = binary.charCodeAt(at);
+    }
+    return bytes;
+  } catch {
+    return null;
+  }
+}
+
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
+}
+function equalInConstantTime(one, other) {
+  if (one.length !== other.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let at = 0; at < one.length; at++) {
+    difference |= one.charCodeAt(at) ^ other.charCodeAt(at);
+  }
+  return difference === 0;
+}
+function asBuffer(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
+// src/currency.ts
+var ISO_4217_MINOR_UNITS = {
+  BHD: 3,
+  BIF: 0,
+  CLP: 0,
+  CZK: 2,
+  DJF: 0,
+  EUR: 2,
+  GBP: 2,
+  ISK: 0,
+  IQD: 3,
+  JOD: 3,
+  JPY: 0,
+  KRW: 0,
+  KWD: 3,
+  LYD: 3,
+  OMR: 3,
+  PLN: 2,
+  PYG: 0,
+  RWF: 0,
+  TND: 3,
+  UGX: 0,
+  USD: 2,
+  VND: 0,
+  VUV: 0,
+  XAF: 0,
+  XOF: 0,
+  XPF: 0
+};
+function minorUnitsOf(currency) {
+  const digits = ISO_4217_MINOR_UNITS[currency.toUpperCase()];
+  if (digits === void 0) {
+    throw new Error(
+      `${currency.toUpperCase()} is not a currency this knows the ISO 4217 minor unit of`
+    );
+  }
+  return digits;
+}
+function minorScaleOf(currency) {
+  return 10 ** minorUnitsOf(currency);
+}
+
+// ../core/ed25519.ts
+var ALGORITHM = { name: "Ed25519" };
+var SEED_BYTES = 32;
+var SIGNATURE_BYTES = 64;
+var PUBLIC_KEY_BYTES = 32;
+var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
+async function signingKeyFromSeed(seed) {
+  if (seed.length !== SEED_BYTES) {
+    throw new Error(`an ed25519 seed is ${SEED_BYTES} bytes`);
+  }
+  const wrapped = new Uint8Array(PKCS8_HEADER.length + SEED_BYTES);
+  wrapped.set(PKCS8_HEADER);
+  wrapped.set(seed, PKCS8_HEADER.length);
+  const key = await crypto.subtle.importKey("pkcs8", asBuffer2(wrapped), ALGORITHM, true, ["sign"]);
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  return {
+    publicKeyHex: bytesToHex(fromBase64Url2(jwk.x ?? "")),
+    sign: async (payload) => bytesToHex(new Uint8Array(await crypto.subtle.sign(ALGORITHM, key, asBuffer2(payload))))
+  };
+}
+async function verifyHex(publicKeyHex, signatureHex, payload) {
+  if (!isHex(publicKeyHex) || publicKeyHex.length !== PUBLIC_KEY_BYTES * 2) {
+    return false;
+  }
+  if (!isHex(signatureHex) || signatureHex.length !== SIGNATURE_BYTES * 2) {
+    return false;
+  }
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      asBuffer2(hexToBytes(publicKeyHex)),
+      ALGORITHM,
+      false,
+      ["verify"]
+    );
+    return await crypto.subtle.verify(
+      ALGORITHM,
+      key,
+      asBuffer2(hexToBytes(signatureHex)),
+      asBuffer2(payload)
+    );
+  } catch {
+    return false;
+  }
+}
+function fromBase64Url2(text2) {
+  const padded = text2.replace(/-/g, "+").replace(/_/g, "/");
+  const raw = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const bytes = new Uint8Array(raw.length);
+  for (let at = 0; at < raw.length; at++) {
+    bytes[at] = raw.charCodeAt(at);
+  }
+  return bytes;
+}
+function asBuffer2(bytes) {
+  return bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
 }
 
 // src/wire.ts
@@ -571,12 +666,13 @@ var REASONS = /* @__PURE__ */ new Set([
   "cannot-prove-delivery",
   "invoice-refused"
 ]);
-function createRequestBody(params, trigger) {
+function createRequestBody(params, trigger, replay) {
   return JSON.stringify({
     ln_addresses: params.lnAddresses,
     incoming_amount: toAmount(params.amountMsat),
     webhook: params.webhookUrl ? { url: params.webhookUrl } : void 0,
-    trigger: trigger ?? void 0
+    trigger: trigger ?? void 0,
+    replay
   });
 }
 function quoteRequestBody(params) {
@@ -587,7 +683,9 @@ function quoteRequestBody(params) {
 }
 function quoteFromWire(body) {
   const wire = asObject(body);
-  if (wire === null) return null;
+  if (wire === null) {
+    return null;
+  }
   const lnAddress = text(wire["ln_address"]);
   const amountMsat = msatFrom(wire["amount"], 1);
   const feeMsat = msatFrom(wire["fee"], 0);
@@ -595,13 +693,19 @@ function quoteFromWire(body) {
   const maxMsat = msatFrom(wire["max_amount"], 0);
   const metadata = text(wire["metadata"]);
   const refusals3 = refusalsFrom(wire["refusals"]);
-  if (lnAddress === null || amountMsat === null || feeMsat === null) return null;
-  if (minMsat === null || maxMsat === null || metadata === null || refusals3 === null) return null;
+  if (lnAddress === null || amountMsat === null || feeMsat === null) {
+    return null;
+  }
+  if (minMsat === null || maxMsat === null || metadata === null || refusals3 === null) {
+    return null;
+  }
   return { lnAddress, amountMsat, feeMsat, minMsat, maxMsat, metadata, refusals: refusals3 };
 }
 function paymentFromWire(body) {
   const wire = asObject(body);
-  if (wire === null) return null;
+  if (wire === null) {
+    return null;
+  }
   const id = text(wire["id"]);
   const lnAddress = text(wire["ln_address"]);
   const bolt11 = text(wire["bolt11"]);
@@ -612,11 +716,21 @@ function paymentFromWire(body) {
   const createdAt = secondsFrom(wire["created_at"]);
   const status = wire["status"];
   const preimage = wire["preimage"] ?? null;
-  if (id === null || lnAddress === null || bolt11 === null) return null;
-  if (paymentHash === null || verifyUrl === null) return null;
-  if (amountMsat === null || expiresAt === null || createdAt === null) return null;
-  if (!isStatus(status)) return null;
-  if (preimage !== null && typeof preimage !== "string") return null;
+  if (id === null || lnAddress === null || bolt11 === null) {
+    return null;
+  }
+  if (paymentHash === null || verifyUrl === null) {
+    return null;
+  }
+  if (amountMsat === null || expiresAt === null || createdAt === null) {
+    return null;
+  }
+  if (!isStatus(status)) {
+    return null;
+  }
+  if (preimage !== null && typeof preimage !== "string") {
+    return null;
+  }
   return {
     id,
     lnAddress,
@@ -640,25 +754,34 @@ function watchRequestBody(params, trigger) {
     verify_url: params.verifyUrl,
     expires_at: expiresAt.toISOString(),
     trigger: trigger ?? void 0,
+    replay: params.replay,
     sealed: params.sealed,
     webhook: params.webhookUrl ? { url: params.webhookUrl } : void 0
   });
 }
 function settlementFromWire(body) {
   const wire = asObject(body);
-  if (wire === null) return null;
+  if (wire === null) {
+    return null;
+  }
   const id = text(wire["id"]);
   const paymentHash = text(wire["payment_hash"]);
   const settledAt = secondsFrom(wire["settled_at"]);
   const status = wire["status"];
   const preimage = wire["preimage"] ?? null;
-  if (id === null || paymentHash === null || settledAt === null || !isStatus(status)) return null;
-  if (preimage !== null && typeof preimage !== "string") return null;
+  if (id === null || paymentHash === null || settledAt === null || !isStatus(status)) {
+    return null;
+  }
+  if (preimage !== null && typeof preimage !== "string") {
+    return null;
+  }
   return { id, status, paymentHash, preimage, settledAt };
 }
 function triggerEventFromWire(body) {
   const wire = asObject(body);
-  if (wire === null) return null;
+  if (wire === null) {
+    return null;
+  }
   const id = text(wire["id"]);
   const paymentHash = text(wire["payment_hash"]);
   const verifyUrl = text(wire["verify_url"]);
@@ -667,10 +790,18 @@ function triggerEventFromWire(body) {
   const status = wire["status"];
   const preimage = wire["preimage"] ?? null;
   const sealed = wire["sealed"] ?? null;
-  if (id === null || paymentHash === null || verifyUrl === null) return null;
-  if (expiresAt === null || createdAt === null || !isStatus(status)) return null;
-  if (preimage !== null && typeof preimage !== "string") return null;
-  if (sealed !== null && typeof sealed !== "string") return null;
+  if (id === null || paymentHash === null || verifyUrl === null) {
+    return null;
+  }
+  if (expiresAt === null || createdAt === null || !isStatus(status)) {
+    return null;
+  }
+  if (preimage !== null && typeof preimage !== "string") {
+    return null;
+  }
+  if (sealed !== null && typeof sealed !== "string") {
+    return null;
+  }
   return {
     id,
     kind: kindOf(wire),
@@ -687,14 +818,18 @@ function triggerEventFromWire(body) {
 }
 function kindOf(wire) {
   const said = wire["kind"];
-  if (said === "minted" || said === "watched") return said;
+  if (said === "minted" || said === "watched") {
+    return said;
+  }
   return text(wire["ln_address"]) === null ? "watched" : "minted";
 }
 function toAmount(msat) {
   return { value: String(msat), asset_code: ASSET_CODE, asset_scale: ASSET_SCALE };
 }
 function asObject(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return null;
+  }
   return value;
 }
 function text(value) {
@@ -702,27 +837,39 @@ function text(value) {
 }
 function msatFrom(value, least) {
   const amount = asObject(value);
-  if (amount === null) return null;
-  if (amount["asset_code"] !== ASSET_CODE || amount["asset_scale"] !== ASSET_SCALE) return null;
+  if (amount === null) {
+    return null;
+  }
+  if (amount["asset_code"] !== ASSET_CODE || amount["asset_scale"] !== ASSET_SCALE) {
+    return null;
+  }
   const digits = amount["value"];
-  if (typeof digits !== "string" || !/^[0-9]+$/.test(digits)) return null;
-  const msat = Number(digits);
+  if (typeof digits !== "string" || !/^[0-9]+$/.test(digits)) {
+    return null;
+  }
+  const msat = Number(digits);
   return Number.isSafeInteger(msat) && msat >= least ? msat : null;
 }
 function refusalsFrom(value) {
-  if (!Array.isArray(value)) return null;
+  if (!Array.isArray(value)) {
+    return null;
+  }
   const refusals3 = [];
   for (const entry of value) {
     const failure = asObject(entry);
     const address = failure === null ? null : text(failure["address"]);
     const reason = failure?.["reason"];
-    if (address === null || typeof reason !== "string" || !REASONS.has(reason)) return null;
+    if (address === null || typeof reason !== "string" || !REASONS.has(reason)) {
+      return null;
+    }
     refusals3.push({ address, reason });
   }
   return refusals3;
 }
 function secondsFrom(value) {
-  if (typeof value !== "string") return null;
+  if (typeof value !== "string") {
+    return null;
+  }
   const milliseconds = Date.parse(value);
   return Number.isNaN(milliseconds) ? null : Math.floor(milliseconds / 1e3);
 }
@@ -730,910 +877,1048 @@ function isStatus(value) {
   return value === "pending" || value === "paid" || value === "expired";
 }
 
-// src/client.ts
-var TERMINAL = /* @__PURE__ */ new Set(["paid", "expired"]);
-var RECONNECT_DELAY_MS = 3e3;
-var RECONNECT_CAP_MS = 3e4;
-var UNANSWERED_ATTEMPTS = 5;
-var TRIGGER_MIN_CHARS = 16;
-var STRANGER_PROBE = "is-this-gateway-yours";
-function unguessable(trigger) {
-  if (trigger.length < TRIGGER_MIN_CHARS) {
-    throw new Error(
-      `a trigger secret is the only thing guarding its stream, and nothing rate limits a guess at it, so it has to be at least ${TRIGGER_MIN_CHARS} characters nobody can predict`
-    );
+// src/webhook.ts
+var SIGNATURE_HEADER = "x-signature";
+var TIMESTAMP_HEADER = "x-timestamp";
+var GATEWAY_KEY_PREFIX = "ed25519=";
+var DEFAULT_TOLERANCE_SECS = 300;
+var CHALLENGE = "webhook-challenge";
+var VERIFY_CHALLENGE = "verify-challenge";
+async function verifyWebhookSignature(body, signature, credential, timestamp, options = {}) {
+  if (!recent(timestamp, options.toleranceSecs ?? DEFAULT_TOLERANCE_SECS)) {
+    return false;
   }
-  return trigger;
-}
-function backoffMs(firstDelay, attempt) {
-  const grown = Math.min(firstDelay * 2 ** (attempt - 1), RECONNECT_CAP_MS);
-  return Math.round(grown * (0.5 + Math.random() / 2));
+  if (!signature.startsWith(GATEWAY_KEY_PREFIX)) {
+    return false;
+  }
+  return await verifyHex(
+    credential.publicKey.toLowerCase(),
+    signature.slice(GATEWAY_KEY_PREFIX.length).toLowerCase(),
+    signed(timestamp, body)
+  );
 }
-var ThunderBridge = class {
-  baseUrl;
-  verify;
-  token;
-  secret;
-  strangers = null;
-  speaks = null;
-  constructor(baseUrl, options) {
-    this.baseUrl = baseUrl.replace(/\/+$/, "");
-    this.verify = options?.verify ?? true;
-    this.token = options?.token ?? null;
-    this.secret = options?.secret ?? null;
+async function parseWebhook(body, signature, credential, timestamp, options = {}) {
+  if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) {
+    return null;
   }
-  /**
-   * Whether a token was given, which is what makes an instance yours: a gateway
-   * started with `GATEWAY_TOKEN` answers nobody else, so anything you hand it
-   * stays between you and it
-   */
-  get isPrivate() {
-    return this.token !== null;
+  const text2 = typeof body === "string" ? body : new TextDecoder().decode(body);
+  try {
+    return paymentFromWire(JSON.parse(text2));
+  } catch {
+    return null;
   }
-  /**
-   * Whether the gateway turns away a caller carrying no token, asked by making
-   * one unauthenticated read it would have to refuse. `isPrivate` answers only
-   * whether you configured a token, which is your side of the arrangement and
-   * says nothing about the gateway's, so a made-up token against a public
-   * instance reads as private and is not. Asked once and remembered, because an
-   * instance does not change its mind. Anything other than a refusal counts as
-   * open, so an unreachable gateway fails closed
-   */
-  async refusesStrangers() {
-    this.strangers ??= fetch(`${this.baseUrl}/incoming-payments/${STRANGER_PROBE}`, {
-      headers: { accept: "application/json" }
-    }).then((answer) => answer.status === 401).catch(() => false);
-    return await this.strangers;
+}
+async function parseWebhookRequest(request, credential, options = {}) {
+  const signature = request.headers.get(SIGNATURE_HEADER);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER);
+  if (signature === null || timestamp === null) {
+    return null;
   }
-  /**
-   * Ask the gateway for an invoice payable to the first address on your list
-   * that can issue a provable one, throws `NoWalletAvailableError` when none can
-   * and `GatewayCheatError` when what comes back is not what you asked for
-   */
-  async createPayment(params, options) {
-    const sent = createRequestBody(
-      params,
-      options?.trigger ? sha256Hex(unguessable(options.trigger)) : null
-    );
-    const headers = await this.sending("/incoming-payments", sent);
-    if (options?.idempotencyKey) headers["idempotency-key"] = options.idempotencyKey;
-    const response = await fetch(`${this.baseUrl}/incoming-payments`, {
-      method: "POST",
-      headers,
-      body: sent
-    });
-    if (!response.ok) throw await problemFrom(response);
-    const payment = await paymentFrom(response);
-    if (this.verify) await proveOrigin(payment, params);
-    return payment;
+  return parseWebhook(await request.text(), signature, credential, timestamp, options);
+}
+async function parseWatchedWebhook(body, signature, credential, timestamp, options = {}) {
+  if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) {
+    return null;
   }
-  /**
-   * Ask which address would serve an amount without minting anything, throws
-   * `NoWalletAvailableError` when none would. A quote is a probe and not a
-   * promise: the address it names can still be refused at create time, because
-   * whether a wallet returns a provable invoice cannot be known without asking
-   * it for one, and asking mints it
-   */
-  async createQuote(params) {
-    const sent = quoteRequestBody(params);
-    const response = await fetch(`${this.baseUrl}/quotes`, {
-      method: "POST",
-      headers: await this.sending("/quotes", sent),
-      body: sent
-    });
-    if (!response.ok) throw await problemFrom(response);
-    const quote = quoteFromWire(await response.json().catch(() => null));
-    if (quote === null) {
-      throw new ProblemError({
-        status: response.status,
-        title: "The gateway answered with something that is not a quote"
-      });
-    }
-    return quote;
+  const text2 = typeof body === "string" ? body : new TextDecoder().decode(body);
+  try {
+    return triggerEventFromWire(JSON.parse(text2));
+  } catch {
+    return null;
   }
-  /** Read a payment back, null when the gateway has never heard of it */
-  /**
-   * The key this gateway signs webhooks with when you registered none of your own,
-   * ready to hand to `parseWebhookRequest` as `{ publicKey }`. Fetch it once and
-   * keep it: it is the same for every instance in the cluster
-   */
-  async webhookKey() {
-    const response = await fetch(`${this.baseUrl}/webhook-key`);
-    if (!response.ok) throw await problemFrom(response);
-    const body = await response.json().catch(() => null);
-    if (body?.algorithm !== "ed25519" || typeof body.public_key !== "string") {
-      throw new ProblemError({
-        status: response.status,
-        title: "The gateway published no ed25519 webhook key"
-      });
-    }
-    return body.public_key;
+}
+async function parseWatchedWebhookRequest(request, credential, options = {}) {
+  const signature = request.headers.get(SIGNATURE_HEADER);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER);
+  if (signature === null || timestamp === null) {
+    return null;
   }
-  async getPayment(id) {
-    const path = `/incoming-payments/${encodeURIComponent(id)}`;
-    const response = await fetch(`${this.baseUrl}${path}`, {
-      headers: await this.reading("GET", path)
-    });
-    if (response.status === 404) return null;
-    if (!response.ok) throw await problemFrom(response);
-    return this.checked(await paymentFrom(response));
+  return parseWatchedWebhook(await request.text(), signature, credential, timestamp, options);
+}
+async function parseSettlement(body, signature, credential, timestamp, options = {}) {
+  if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) {
+    return null;
   }
-  /**
-   * Read back a payment the gateway is only watching, null when it has never
-   * heard of it. A watched payment carries no address, amount or invoice, so
-   * `getPayment` refuses it and this reads the shape both rails share
-   */
-  async getWatched(id) {
-    const path = `/incoming-payments/${encodeURIComponent(id)}`;
-    const response = await fetch(`${this.baseUrl}${path}`, {
-      headers: await this.reading("GET", path)
-    });
-    if (response.status === 404) return null;
-    if (!response.ok) throw await problemFrom(response);
-    const watched = triggerEventFromWire(await response.json().catch(() => null));
-    if (watched === null) {
-      throw new ProblemError({
-        status: response.status,
-        title: "The gateway answered with something that is not a payment"
-      });
-    }
-    return this.proven(watched);
+  try {
+    return settlementFromWire(JSON.parse(textOf(body)));
+  } catch {
+    return null;
   }
-  /**
-   * List what this gateway is watching, newest first. Only a gateway started
-   * with `GATEWAY_TOKEN` serves this, because on a shared one it would hand
-   * every caller everyone else's payments, so a public gateway answers 404.
-   *
-   * `scanned` says how many settled records were looked at to build the page.
-   * Anything older than that window is not in the answer, and the list does not
-   * pretend otherwise
-   */
-  async listPayments(limit) {
-    const path = `/incoming-payments${limit === void 0 ? "" : `?limit=${limit}`}`;
-    const response = await fetch(`${this.baseUrl}${path}`, {
-      headers: await this.reading("GET", path)
-    });
-    if (!response.ok) throw await problemFrom(response);
-    const body = await response.json().catch(() => null);
-    const listed = Array.isArray(body?.payments) ? body.payments.map(triggerEventFromWire).filter((one) => one !== null) : null;
-    if (listed === null || typeof body?.settled_scanned !== "number") {
-      throw new ProblemError({
-        status: response.status,
-        title: "The gateway answered with something that is not a payment list"
-      });
-    }
-    return { payments: listed, scanned: body.settled_scanned };
+}
+async function parseSettlementRequest(request, credential, options = {}) {
+  const signature = request.headers.get(SIGNATURE_HEADER);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER);
+  if (signature === null || timestamp === null) {
+    return null;
   }
-  /**
-   * Follow a payment over WebSocket until it is paid or expired, reconnecting
-   * through a drop. A payment that never answers gives up after a few tries, and
-   * one that has answered is followed until its own expiry, so the wait always
-   * ends by itself
-   */
-  async waitForPayment(id, options) {
-    const payment = paymentFromWire(await this.followed(id, options));
-    if (payment === null) {
-      throw new ProblemError({
-        status: 200,
-        title: `payment ${id} is watched rather than minted here, read it with waitForWatched`
-      });
-    }
-    return this.checked(payment);
+  return await parseSettlement(await request.text(), signature, credential, timestamp, options);
+}
+function isProvablySettled(settled) {
+  if (settled.status !== "paid" || settled.preimage === null) {
+    return false;
   }
-  /**
-   * Follow a payment the gateway is only watching, one it did not mint, until it
-   * is paid or expired.
-   *
-   * A watched payment carries no address, no amount and no invoice, because the
-   * gateway was told none of them, so it reads back as the shape a trigger
-   * streams rather than as a `Payment`. That is every bank transfer, and every
-   * Lightning invoice registered with `watchPayment` instead of `createPayment`.
-   */
-  async waitForWatched(id, options) {
-    const watched = triggerEventFromWire(await this.followed(id, options));
-    if (watched === null) {
-      throw new ProblemError({
-        status: 200,
-        title: "The gateway answered with something that is not a payment"
-      });
-    }
-    return this.proven(watched);
+  return preimageMatchesHash(settled.preimage, settled.paymentHash);
+}
+async function answerWebhookChallenge(body, signature, credential, timestamp, options = {}) {
+  if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) {
+    return null;
   }
-  followed(id, options) {
-    const base = this.baseUrl.replace(/^http/, "ws");
-    const direct = `${base}/ws/incoming-payments/${encodeURIComponent(id)}`;
-    return new Promise((resolve2, reject) => {
-      const aborted = () => new Error(`waiting for payment ${id} was aborted`);
-      if (options?.signal?.aborted) {
-        reject(aborted());
-        return;
-      }
-      let socket = null;
-      let settled = false;
-      let attempt = 0;
-      let expiresAt = null;
-      let retry;
-      const abort = () => settle(() => reject(aborted()));
-      const settle = (finish) => {
-        if (settled) return;
-        settled = true;
-        options?.signal?.removeEventListener("abort", abort);
-        clearTimeout(retry);
-        finish();
-        socket?.close();
-      };
-      const again = () => {
-        if (settled) return;
-        if (expiresAt === null && attempt >= UNANSWERED_ATTEMPTS) {
-          settle(() => reject(new Error(`no gateway answered for payment ${id}`)));
-          return;
-        }
-        if (expiresAt !== null && Date.now() >= expiresAt * 1e3) {
-          settle(() => reject(new Error(`payment ${id} went unreported past its expiry`)));
-          return;
-        }
-        retry = setTimeout(() => void connect(), backoffMs(RECONNECT_DELAY_MS, attempt));
-      };
-      const connect = async () => {
-        if (settled) return;
-        attempt += 1;
-        let url = direct;
-        if (this.needsTicket(options?.tickets)) {
-          try {
-            url = `${base}/ws/tickets/${await this.wsTicket({ payment_id: id })}`;
-          } catch (refused) {
-            if (refused instanceof ProblemError) settle(() => reject(refused));
-            else again();
-            return;
-          }
-        }
-        if (settled) return;
-        const opened = new WebSocket(url);
-        socket = opened;
-        opened.onmessage = (event) => {
-          try {
-            const frame = JSON.parse(String(event.data));
-            const watched = triggerEventFromWire(frame);
-            if (watched === null) return;
-            expiresAt = watched.expiresAt;
-            attempt = 1;
-            if (!TERMINAL.has(watched.status)) return;
-            settle(() => resolve2(frame));
-          } catch (refused) {
-            settle(() => reject(refused));
-          }
-        };
-        opened.onclose = again;
-      };
-      options?.signal?.addEventListener("abort", abort, { once: true });
-      void connect();
-    });
+  const nonce = challenged(typeof body === "string" ? body : new TextDecoder().decode(body));
+  return nonce === null ? null : JSON.stringify({ nonce });
+}
+async function answerWebhookChallengeRequest(request, credential, options = {}) {
+  const signature = request.headers.get(SIGNATURE_HEADER);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER);
+  if (signature === null || timestamp === null) {
+    return null;
   }
-  /**
-   * Wait on several payments and keep the first one that is really paid, then stop
-   * waiting on the losers, which closes their sockets.
-   *
-   * This is how one order offers two rails. A Lightning invoice and a bank
-   * transfer for the same thing are two payments here, and the payer picks one, so
-   * what you want is the one that arrives and nothing further from the other.
-   *
-   * A leg that expires is a loser, not a winner, which is the whole reason this is
-   * not a race: `waitForPayment` ends on `paid` and on `expired` alike, and a
-   * Lightning invoice expires in an hour while a bank transfer takes days. `null`
-   * means every leg ended without being paid.
-   *
-   * Stopping the wait is not revoking the invoice. Nobody can revoke one, because
-   * the recipient's own wallet minted it, so a payer who pays the loser afterwards
-   * really does pay twice and that shows up on `followTrigger` as a second
-   * settlement to refund.
-   */
-  async firstToSettle(ids, options) {
-    if (ids.length === 0) return null;
-    const stopLosers = new AbortController();
-    const signal = options?.signal ? AbortSignal.any([stopLosers.signal, options.signal]) : stopLosers.signal;
-    let refused = null;
-    try {
-      const winner = await new Promise((resolve2) => {
-        let waiting = ids.length;
-        const lost = () => {
-          waiting -= 1;
-          if (waiting === 0) resolve2(null);
-        };
-        for (const id of ids) {
-          this.waitForWatched(id, { ...options, signal }).then((watched) => watched.status === "paid" ? resolve2(watched) : lost()).catch((failure) => {
-            refused ??= failure;
-            lost();
-          });
-        }
-      });
-      if (winner === null && refused !== null) throw refused;
-      return winner;
-    } finally {
-      stopLosers.abort();
+  const answer = await answerWebhookChallenge(
+    await request.clone().text(),
+    signature,
+    credential,
+    timestamp,
+    options
+  );
+  return answer === null ? null : new Response(answer, { headers: { "content-type": "application/json" } });
+}
+function textOf(body) {
+  return typeof body === "string" ? body : new TextDecoder().decode(body);
+}
+function challenged(text2) {
+  return nonceOf(text2, CHALLENGE);
+}
+function nonceOf(text2, type) {
+  try {
+    const said = JSON.parse(text2);
+    if (said["type"] !== type || typeof said["nonce"] !== "string") {
+      return null;
     }
+    return said["nonce"];
+  } catch {
+    return null;
   }
-  /**
-   * Hand over an invoice you obtained yourself so the gateway watches it without
-   * being told the address or the amount. It can then only refuse everyone
-   * rather than one recipient, which is what makes leaving it cheap. Anything
-   * the watcher needs goes in `sealed`, which the gateway cannot read
-   */
-  async watchPayment(params) {
-    const sent = watchRequestBody(
-      params,
-      params.trigger ? sha256Hex(unguessable(params.trigger)) : null
-    );
-    const response = await fetch(`${this.baseUrl}/watched-payments`, {
-      method: "POST",
-      headers: await this.sending("/watched-payments", sent),
-      body: sent
-    });
-    if (!response.ok) throw await problemFrom(response);
-    const watched = triggerEventFromWire(await response.json().catch(() => null));
-    if (watched === null) {
-      throw new ProblemError({
-        status: response.status,
-        title: "The gateway answered with something that is not a watched payment"
-      });
+}
+function answerVerifyChallenge(body) {
+  const nonce = nonceOf(body, VERIFY_CHALLENGE);
+  return nonce === null ? null : JSON.stringify({ nonce });
+}
+async function answerVerifyChallengeRequest(request) {
+  if (request.method !== "POST") {
+    return null;
+  }
+  const answer = answerVerifyChallenge(await request.clone().text());
+  return answer === null ? null : new Response(answer, { headers: { "content-type": "application/json" } });
+}
+function recent(timestamp, toleranceSecs) {
+  const sent = Number(timestamp);
+  if (!Number.isFinite(sent)) {
+    return false;
+  }
+  return Math.abs(Math.floor(Date.now() / 1e3) - sent) <= toleranceSecs;
+}
+function signed(timestamp, body) {
+  const encoder = new TextEncoder();
+  const stamp = encoder.encode(`${timestamp}.`);
+  const rest = typeof body === "string" ? encoder.encode(body) : new Uint8Array(body);
+  const payload = new Uint8Array(stamp.length + rest.length);
+  payload.set(stamp);
+  payload.set(rest, stamp.length);
+  return payload;
+}
+
+// src/bank.ts
+var DEFAULT_CURRENCY = "CZK";
+var DEFAULT_LOOK_BACK_SECS = 7 * 24 * 60 * 60;
+var DEFAULT_POLL_EVERY_SECS = 30;
+var IBAN = /^[A-Z]{2}[0-9]{2}[0-9A-Z]{8,30}$/;
+var FORBIDDEN_IN_SPD = "*";
+async function bankTransfer(params) {
+  const currency = params.currency ?? DEFAULT_CURRENCY;
+  refuseUnusable(params, currency);
+  await refuseAnOpenGateway(params);
+  const spd = shortPaymentDescriptor(params, currency);
+  const subject = subjectOf(params.reference, params.amountMinor, currency);
+  const polling = new URL(params.verifyUrl);
+  polling.searchParams.set("ref", params.reference);
+  polling.searchParams.set("minor", String(params.amountMinor));
+  polling.searchParams.set("cc", currency);
+  polling.searchParams.set("sig", await hmacHex(params.secret, `verify|${subject}`));
+  const verifyUrl = polling.toString();
+  const watched = await params.gateway.watchPayment({
+    paymentHash: hashOf(await hmacHex(params.secret, `preimage|${subject}`)),
+    verifyUrl,
+    expiresAt: params.expiresAt,
+    trigger: params.trigger,
+    replay: params.replay,
+    sealed: params.sealed,
+    webhookUrl: params.webhookUrl
+  });
+  return { id: watched.id, paymentHash: watched.paymentHash, verifyUrl, spd };
+}
+function bankVerifyEndpoint(config) {
+  const paced = {
+    "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS}`
+  };
+  return async (request) => {
+    const consented = await answerVerifyChallengeRequest(request);
+    if (consented !== null) {
+      return consented;
     }
-    const named = await this.nameFor(params.paymentHash);
-    if (named !== null && watched.id !== named) {
-      throw new GatewayCheatError("id_not_mine", watched.id);
+    const asked = readQuery(new URL(request.url));
+    if (asked === null) {
+      return Response.json({ settled: false }, { status: 400 });
     }
-    return watched;
+    const subject = subjectOf(asked.reference, asked.amountMinor, asked.currency);
+    const expected = await hmacHex(config.secret, `verify|${subject}`);
+    if (!equalInConstantTime(asked.signature, expected)) {
+      return Response.json({ settled: false }, { status: 403 });
+    }
+    const since = unixNow() - (config.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
+    const landed = (await config.statement(since)).some((credit) => pays(credit, asked));
+    if (!landed) {
+      return Response.json({ settled: false }, { headers: paced });
+    }
+    return Response.json(
+      { settled: true, preimage: await hmacHex(config.secret, `preimage|${subject}`) },
+      { headers: paced }
+    );
+  };
+}
+function readQuery(url) {
+  const reference = url.searchParams.get("ref");
+  const minor = Number(url.searchParams.get("minor"));
+  const currency = url.searchParams.get("cc");
+  const signature = url.searchParams.get("sig");
+  if (!reference || !currency || !signature) {
+    return null;
   }
-  /**
-   * What this payment is called, which you can work out before any gateway has
-   * heard of it. Every gateway you hand the same invoice to answers with the same
-   * name, so watching at several of them adds up to one payment rather than
-   * several, and no gateway's key is in the answer. Null when no secret was given,
-   * because then the gateway names the payment and only it can
-   */
-  async nameFor(paymentHash) {
-    return this.secret === null ? null : paymentNamedBy((await this.speaking()).publicKeyHex, paymentHash);
+  if (!Number.isInteger(minor) || minor <= 0) {
+    return null;
   }
-  /**
-   * Follow every payment made to one trigger, replayed from the recent ones on
-   * connect and then live, reconnecting on its own until the returned function
-   * is called. A trigger has no terminal state, so this never resolves
-   */
-  followTrigger(secret, options) {
-    const base = this.baseUrl.replace(/^http/, "ws");
-    const direct = `${base}/ws/triggers/${encodeURIComponent(unguessable(secret))}`;
-    const firstDelay = options.reconnectDelayMs ?? RECONNECT_DELAY_MS;
-    let socket = null;
-    let retry;
-    let stopped = false;
-    let attempt = 0;
-    const again = () => {
-      if (stopped || options.reconnect === false) return;
-      retry = setTimeout(() => void connect(), backoffMs(firstDelay, attempt));
-    };
-    const connect = async () => {
-      attempt += 1;
-      let url = direct;
-      if (this.needsTicket(options.tickets)) {
-        try {
-          url = `${base}/ws/tickets/${await this.wsTicket({ trigger_secret: secret })}`;
-        } catch (refused) {
-          options.onError?.(refused);
-          again();
-          return;
-        }
-      }
-      if (stopped) return;
-      socket = new WebSocket(url);
-      socket.onopen = () => {
-        attempt = 1;
-      };
-      socket.onmessage = (event) => {
-        try {
-          const settled = triggerEventFromWire(JSON.parse(String(event.data)));
-          if (settled !== null) options.onPayment(this.proven(settled));
-        } catch (refused) {
-          options.onError?.(refused);
-        }
-      };
-      socket.onerror = () => options.onError?.(new Error(`could not follow trigger at ${base}`));
-      socket.onclose = again;
-    };
-    void connect();
-    return () => {
-      stopped = true;
-      clearTimeout(retry);
-      socket?.close();
-    };
-  }
-  needsTicket(asked) {
-    return asked === true || this.token !== null;
+  return { reference, amountMinor: minor, currency, signature };
+}
+function pays(credit, asked) {
+  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && credit.reference.toUpperCase().includes(asked.reference.toUpperCase());
+}
+function subjectOf(reference, amountMinor, currency) {
+  return `${reference}|${amountMinor}|${currency.toUpperCase()}`;
+}
+function hashOf(preimage) {
+  return bytesToHex(sha256(hexToBytes(preimage)));
+}
+function shortPaymentDescriptor(params, currency) {
+  const fields = [
+    `ACC:${params.iban}`,
+    `AM:${major(params.amountMinor, currency)}`,
+    `CC:${currency.toUpperCase()}`,
+    `MSG:${params.reference}`
+  ];
+  if (params.variableSymbol) {
+    fields.push(`X-VS:${params.variableSymbol}`);
   }
-  async wsTicket(body) {
-    const sent = JSON.stringify(body);
-    const response = await fetch(`${this.baseUrl}/ws-tickets`, {
-      method: "POST",
-      headers: await this.sending("/ws-tickets", sent),
-      body: sent
-    });
-    if (!response.ok) throw await problemFrom(response);
-    const minted = await response.json().catch(() => null);
-    if (typeof minted?.ticket !== "string") {
-      throw new ProblemError({
-        status: response.status,
-        title: "The gateway answered with something that is not a ticket"
-      });
-    }
-    return encodeURIComponent(minted.ticket);
+  return `SPD*1.0*${fields.join("*")}`;
+}
+function major(amountMinor, currency) {
+  return (amountMinor / minorScaleOf(currency)).toFixed(minorUnitsOf(currency));
+}
+async function refuseAnOpenGateway(params) {
+  if (params.allowPublicGateway === true) {
+    return;
   }
-  async sending(path, body) {
-    return { "content-type": "application/json", ...await this.reading("POST", path, body) };
+  if (await params.gateway.refusesStrangers()) {
+    return;
   }
-  async reading(method, path, body = "") {
-    return {
-      ...this.token === null ? {} : { authorization: `Bearer ${this.token}` },
-      ...this.secret === null ? {} : await signedAs(await this.speaking(), method, path, body)
-    };
+  throw new Error(
+    "this gateway serves callers with no token, so it is not yours, and its operator would read the amount and the reference off every verify URL. Point at one that answers 401 to a stranger, or say allowPublicGateway"
+  );
+}
+function refuseUnusable(params, currency) {
+  if (!IBAN.test(params.iban)) {
+    throw new Error(`${params.iban} is not an IBAN`);
   }
-  async speaking() {
-    this.speaks ??= callerKey(this.secret ?? "");
-    return await this.speaks;
+  if (!Number.isInteger(params.amountMinor) || params.amountMinor <= 0) {
+    throw new Error("amountMinor must be a whole number of minor units above zero");
   }
-  proven(settled) {
-    const unproven = settled.status === "paid" && (settled.preimage === null || !preimageMatchesHash(settled.preimage, settled.paymentHash));
-    if (this.verify && unproven) throw new GatewayCheatError("preimage_mismatch", settled.id);
-    return settled;
+  if (params.reference.length === 0) {
+    throw new Error("a transfer with no reference cannot be found");
   }
-  checked(payment) {
-    if (this.verify && payment.status === "paid" && !isProvablyPaid(payment)) {
-      throw new GatewayCheatError("preimage_mismatch", payment.id);
-    }
-    return payment;
+  if (params.reference.includes(FORBIDDEN_IN_SPD)) {
+    throw new Error("a reference cannot contain an asterisk, it separates the QR fields");
   }
-};
-async function paymentFrom(response) {
-  const payment = paymentFromWire(await response.json().catch(() => null));
-  if (payment === null) {
-    throw new ProblemError({
-      status: response.status,
-      title: "The gateway answered with something that is not a payment"
-    });
+  if (params.variableSymbol && !/^[0-9]{1,10}$/.test(params.variableSymbol)) {
+    throw new Error("a variable symbol is up to ten digits");
   }
-  return payment;
 }
-async function problemFrom(response) {
-  const problem = await response.json().catch(() => ({}));
-  const document = { ...problem, status: response.status };
-  if (isProblemType(problem, NO_WALLET_AVAILABLE)) {
-    return new NoWalletAvailableError(document, refusals(problem.wallets));
-  }
-  if (isProblemType(problem, REQUEST_IN_FLIGHT)) {
-    return new IdempotencyConflictError(document, "request-in-flight");
-  }
-  if (isProblemType(problem, IDEMPOTENCY_KEY_REUSED)) {
-    return new IdempotencyConflictError(document, "key-reused");
-  }
-  return new ProblemError(document);
+function unixNow() {
+  return Math.floor(Date.now() / 1e3);
 }
-function refusals(wallets) {
-  if (!Array.isArray(wallets)) return [];
-  return wallets.filter((wallet) => {
-    return typeof wallet === "object" && wallet !== null && "address" in wallet;
-  });
+
+// ../core/caller.ts
+var KEY_HEADER = "x-client-key";
+var SIGNATURE_HEADER2 = "x-signature";
+var TIMESTAMP_HEADER2 = "x-timestamp";
+var PREFIX = "ed25519=";
+var SIGNING_LABEL = "request-signing";
+async function callerKey(secret) {
+  return await signingKeyFromSeed(hexToBytes(await hmacHex(secret, SIGNING_LABEL)));
+}
+function paymentNamedBy(caller, paymentHash) {
+  return sha256Hex(`${caller}.payment-id.${paymentHash}`);
+}
+async function signedAs(key, method, path, body) {
+  const timestamp = String(Math.floor(Date.now() / 1e3));
+  return {
+    [KEY_HEADER]: key.publicKeyHex,
+    [TIMESTAMP_HEADER2]: timestamp,
+    [SIGNATURE_HEADER2]: `${PREFIX}${await key.sign(spoken(timestamp, method, path, body))}`
+  };
+}
+function spoken(timestamp, method, path, body) {
+  return new TextEncoder().encode(
+    `${timestamp}.${method.toUpperCase()}.${path}.${sha256Hex(body)}`
+  );
 }
 
-// src/gateways.ts
-var Gateways = class {
-  each;
-  urls;
-  onRefused;
-  constructor(baseUrls, options) {
-    if (baseUrls.length === 0) throw new Error("name at least one gateway to watch at");
-    this.urls = [...baseUrls];
-    this.each = baseUrls.map((baseUrl) => new ThunderBridge(baseUrl, options));
-    this.onRefused = options?.onRefused ?? (() => {
-    });
+// src/errors.ts
+var GatewayCheatError = class extends Error {
+  code;
+  paymentId;
+  constructor(code, paymentId) {
+    super(`gateway verification failed: ${code}`);
+    this.name = "GatewayCheatError";
+    this.code = code;
+    this.paymentId = paymentId;
   }
-  /** What this payment is called, which every gateway here will agree on */
-  async nameFor(paymentHash) {
-    return await this.each[0].nameFor(paymentHash);
+};
+var WrapRefusedError = class extends Error {
+  code;
+  constructor(code, detail) {
+    super(`wrapped invoice refused: ${code}, ${detail}`);
+    this.name = "WrapRefusedError";
+    this.code = code;
   }
-  /**
-   * Hand the same invoice to every gateway. Throws only when none of them took it,
-   * carrying the first refusal, because one gateway that agreed is enough to be
-   * watched
-   */
-  async watchPayment(params) {
-    const asked = await Promise.allSettled(this.each.map((gateway) => gateway.watchPayment(params)));
-    const taken = [];
-    const refusals3 = [];
-    for (const [at, answer] of asked.entries()) {
-      if (answer.status === "fulfilled") {
-        taken.push(answer.value);
-        continue;
-      }
-      refusals3.push(answer.reason);
-      this.onRefused(this.urls[at], answer.reason);
-    }
-    if (taken[0] === void 0) throw refusals3[0];
-    return taken[0];
+};
+var UnverifiedRecipientError = class extends Error {
+  lnAddress;
+  paymentId;
+  constructor(lnAddress, paymentId, cause) {
+    super(`could not reach ${lnAddress} to verify the invoice: ${String(cause)}`);
+    this.name = "UnverifiedRecipientError";
+    this.lnAddress = lnAddress;
+    this.paymentId = paymentId;
   }
-  /**
-   * Wait for whichever gateway speaks first. A settlement from any of them is the
-   * settlement, and each has already proved the preimage against the hash before
-   * saying so. When they all end without a payment, the first ending is the answer,
-   * and when they all fail, the first failure is thrown
-   */
-  async waitForWatched(id, options) {
-    const stopLosers = new AbortController();
-    const signal = options?.signal ? AbortSignal.any([stopLosers.signal, options.signal]) : stopLosers.signal;
-    const unpaid = [];
-    let refused = null;
-    try {
-      const settled = await new Promise((resolve2) => {
-        let waiting = this.each.length;
-        const lost = () => {
-          waiting -= 1;
-          if (waiting === 0) resolve2(null);
-        };
-        for (const gateway of this.each) {
-          gateway.waitForWatched(id, { ...options, signal }).then((watched) => {
-            if (watched.status === "paid") return resolve2(watched);
-            unpaid.push(watched);
-            lost();
-          }).catch((failure) => {
-            refused ??= failure;
-            lost();
-          });
-        }
-      });
-      if (settled !== null) return settled;
-      if (unpaid.length > 0) return unpaid[0];
-      throw refused;
-    } finally {
-      stopLosers.abort();
-    }
+};
+var ProblemError = class extends Error {
+  type;
+  title;
+  status;
+  detail;
+  constructor(problem) {
+    const title = problem.title ?? "Request failed";
+    super(problem.detail ? `${title}: ${problem.detail}` : title);
+    this.name = "ProblemError";
+    this.type = problem.type ?? "about:blank";
+    this.title = title;
+    this.status = problem.status ?? 0;
+    this.detail = problem.detail ?? null;
   }
 };
-
-// ../core/sealed.ts
-var VERSION = "v1";
-var IV_BYTES = 12;
-var MIN_SECRET_CHARS = 32;
-var MAX_PLAIN_BYTES = 3e3;
-var INFO = new TextEncoder().encode("thunder-bridge/sealed");
-async function seal(secret, plaintext) {
-  const body = new TextEncoder().encode(plaintext);
-  if (body.length > MAX_PLAIN_BYTES) {
-    throw new Error(`sealed takes at most ${MAX_PLAIN_BYTES} bytes, this was ${body.length}`);
-  }
-  const key = await keyFor(secret);
-  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-  const cipher = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, body));
-  const joined = new Uint8Array(iv.length + cipher.length);
-  joined.set(iv);
-  joined.set(cipher, iv.length);
-  return `${VERSION}.${toBase64Url(joined)}`;
+function isProblemType(problem, type) {
+  return problem.type === type;
 }
-async function unseal(secret, sealed) {
-  const key = await keyFor(secret);
-  if (!sealed.startsWith(`${VERSION}.`)) return null;
-  const joined = fromBase64Url2(sealed.slice(VERSION.length + 1));
-  if (joined === null || joined.length <= IV_BYTES) return null;
-  try {
-    const body = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: joined.slice(0, IV_BYTES) },
-      key,
-      joined.slice(IV_BYTES)
-    );
-    return new TextDecoder().decode(body);
-  } catch {
-    return null;
+var NO_WALLET_AVAILABLE = "urn:problem-type:thunder-bridge:no-wallet-available";
+var REQUEST_IN_FLIGHT = "urn:problem-type:thunder-bridge:request-in-flight";
+var IDEMPOTENCY_KEY_REUSED = "urn:problem-type:thunder-bridge:idempotency-key-reused";
+var PAYMENT_ALREADY_WATCHED = "urn:problem-type:thunder-bridge:payment-already-watched";
+var IdempotencyConflictError = class extends ProblemError {
+  conflict;
+  constructor(problem, conflict) {
+    super(problem);
+    this.name = "IdempotencyConflictError";
+    this.conflict = conflict;
   }
-}
-async function keyFor(secret) {
-  if (secret.length < MIN_SECRET_CHARS) {
-    throw new Error(`the sealing secret needs ${MIN_SECRET_CHARS} characters of randomness`);
+};
+var NoWalletAvailableError = class extends ProblemError {
+  wallets;
+  constructor(problem, wallets) {
+    super({ ...problem, type: NO_WALLET_AVAILABLE });
+    this.name = "NoWalletAvailableError";
+    this.wallets = wallets;
   }
-  const material = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    "HKDF",
-    false,
-    ["deriveKey"]
-  );
-  return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: INFO },
-    material,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"]
+};
+
+// src/verify.ts
+var HTTP_TIMEOUT_MS = 15e3;
+var DEFAULT_WRAP_PROPORTION = 0.01;
+var DEFAULT_WRAP_BASE_MSAT = 1e3;
+async function proveOrigin(payment, request) {
+  const cheat = (code) => new GatewayCheatError(code, payment.id);
+  const listed = request.lnAddresses.find(
+    (address) => equalIgnoringCase(address, payment.lnAddress)
   );
+  if (listed === void 0) {
+    throw cheat("address_not_requested");
+  }
+  if (payment.amountMsat !== request.amountMsat) {
+    throw cheat("amount_mismatch");
+  }
+  const invoice = decodeInvoice(payment.bolt11);
+  if (invoice.paymentHash === null || !equalIgnoringCase(invoice.paymentHash, payment.paymentHash)) {
+    throw cheat("hash_mismatch");
+  }
+  if (invoice.amountMsat !== request.amountMsat) {
+    throw cheat("amount_mismatch");
+  }
+  const payRequest = await payRequestFor(listed, payment);
+  if (typeof payRequest.metadata !== "string" || typeof payRequest.callback !== "string") {
+    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "no payRequest served");
+  }
+  if (invoice.descriptionHash !== sha256Hex(payRequest.metadata)) {
+    throw cheat("description_hash_mismatch");
+  }
+  if (!sameOrigin(payment.verifyUrl, payRequest.callback)) {
+    throw cheat("verify_url_foreign");
+  }
+  const issued = await reachable(payment.verifyUrl, payment);
+  if (typeof issued.pr !== "string" || !equalIgnoringCase(issued.pr, payment.bolt11)) {
+    throw cheat("invoice_not_issued");
+  }
 }
-function toBase64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function fromBase64Url2(text2) {
-  if (text2.length === 0 || !/^[A-Za-z0-9_-]+$/.test(text2)) return null;
-  try {
-    const binary = atob(text2.replace(/-/g, "+").replace(/_/g, "/"));
-    const bytes = new Uint8Array(binary.length);
-    for (let at = 0; at < bytes.length; at++) bytes[at] = binary.charCodeAt(at);
-    return bytes;
-  } catch {
+async function proveSettlement(payment, request) {
+  await proveOrigin(payment, request);
+  const verified = await reachable(payment.verifyUrl, payment);
+  if (verified.settled !== true || typeof verified.preimage !== "string") {
     return null;
   }
-}
-
-// src/currency.ts
-var ISO_4217_MINOR_UNITS = {
-  BHD: 3,
-  BIF: 0,
-  CLP: 0,
-  CZK: 2,
-  DJF: 0,
-  EUR: 2,
-  GBP: 2,
-  ISK: 0,
-  IQD: 3,
-  JOD: 3,
-  JPY: 0,
-  KRW: 0,
-  KWD: 3,
-  LYD: 3,
-  OMR: 3,
-  PLN: 2,
-  PYG: 0,
-  RWF: 0,
-  TND: 3,
-  UGX: 0,
-  USD: 2,
-  VND: 0,
-  VUV: 0,
-  XAF: 0,
-  XOF: 0,
-  XPF: 0
-};
-function minorUnitsOf(currency) {
-  const digits = ISO_4217_MINOR_UNITS[currency.toUpperCase()];
-  if (digits === void 0) {
-    throw new Error(
-      `${currency.toUpperCase()} is not a currency this knows the ISO 4217 minor unit of`
-    );
+  if (!preimageMatchesHash(verified.preimage, payment.paymentHash)) {
+    throw new GatewayCheatError("preimage_mismatch", payment.id);
   }
-  return digits;
-}
-function minorScaleOf(currency) {
-  return 10 ** minorUnitsOf(currency);
-}
-
-// src/webhook.ts
-var SIGNATURE_HEADER2 = "x-signature";
-var TIMESTAMP_HEADER2 = "x-timestamp";
-var GATEWAY_KEY_PREFIX = "ed25519=";
-var DEFAULT_TOLERANCE_SECS = 300;
-var CHALLENGE = "webhook-challenge";
-var VERIFY_CHALLENGE = "verify-challenge";
-async function verifyWebhookSignature(body, signature, credential, timestamp, options = {}) {
-  if (!recent(timestamp, options.toleranceSecs ?? DEFAULT_TOLERANCE_SECS)) return false;
-  if (!signature.startsWith(GATEWAY_KEY_PREFIX)) return false;
-  return await verifyHex(
-    credential.publicKey.toLowerCase(),
-    signature.slice(GATEWAY_KEY_PREFIX.length).toLowerCase(),
-    signed(timestamp, body)
-  );
+  return verified.preimage;
 }
-async function parseWebhook(body, signature, credential, timestamp, options = {}) {
-  if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) return null;
-  const text2 = typeof body === "string" ? body : new TextDecoder().decode(body);
-  try {
-    return paymentFromWire(JSON.parse(text2));
-  } catch {
-    return null;
+function isProvablyPaid(payment) {
+  if (payment.status !== "paid" || payment.preimage === null) {
+    return false;
   }
+  const invoiceHash = decodeInvoice(payment.bolt11).paymentHash;
+  if (invoiceHash === null || !equalIgnoringCase(invoiceHash, payment.paymentHash)) {
+    return false;
+  }
+  return preimageMatchesHash(payment.preimage, invoiceHash);
 }
-async function parseWebhookRequest(request, credential, options = {}) {
-  const signature = request.headers.get(SIGNATURE_HEADER2);
-  const timestamp = request.headers.get(TIMESTAMP_HEADER2);
-  if (signature === null || timestamp === null) return null;
-  return parseWebhook(await request.text(), signature, credential, timestamp, options);
+function wrapFeeCeiling(amountMsat, allowance) {
+  const proportional = amountMsat * (allowance?.proportion ?? DEFAULT_WRAP_PROPORTION);
+  return Math.max(allowance?.baseMsat ?? DEFAULT_WRAP_BASE_MSAT, Math.floor(proportional));
 }
-async function parseWatchedWebhook(body, signature, credential, timestamp, options = {}) {
-  if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) return null;
-  const text2 = typeof body === "string" ? body : new TextDecoder().decode(body);
-  try {
-    return triggerEventFromWire(JSON.parse(text2));
-  } catch {
-    return null;
+function proveWrapped(wrapped, recipient, allowance) {
+  const offered = decodeInvoice(wrapped);
+  const owed = decodeInvoice(recipient);
+  const refuse = (code, detail) => {
+    throw new WrapRefusedError(code, detail);
+  };
+  if (offered.paymentHash === null || offered.amountMsat === null || offered.expiresAt === null) {
+    refuse("undecodable", "the wrapped invoice carries no hash, amount or expiry");
+  }
+  if (owed.paymentHash === null || owed.amountMsat === null || owed.expiresAt === null) {
+    refuse("undecodable", "the recipient's invoice carries no hash, amount or expiry");
+  }
+  if (offered.paymentHash?.toLowerCase() !== owed.paymentHash?.toLowerCase()) {
+    refuse("hash_mismatch", "settling the wrap would not settle the recipient");
+  }
+  const asked = offered.amountMsat ?? 0;
+  const due = owed.amountMsat ?? 0;
+  if (asked < due) {
+    refuse("amount_below_recipient", `${asked} msat cannot forward ${due} msat`);
+  }
+  const ceiling = wrapFeeCeiling(due, allowance);
+  if (asked - due > ceiling) {
+    refuse("fee_above_allowance", `${asked - due} msat over ${due}, and ${ceiling} was allowed`);
+  }
+  if ((owed.expiresAt ?? 0) <= (offered.expiresAt ?? 0)) {
+    refuse("recipient_expires_first", "the operator could be paid and find it cannot deliver");
   }
 }
-async function parseWatchedWebhookRequest(request, credential, options = {}) {
-  const signature = request.headers.get(SIGNATURE_HEADER2);
-  const timestamp = request.headers.get(TIMESTAMP_HEADER2);
-  if (signature === null || timestamp === null) return null;
-  return parseWatchedWebhook(await request.text(), signature, credential, timestamp, options);
+async function payRequestFor(listed, payment) {
+  const at = listed.indexOf("@");
+  const name = listed.slice(0, at);
+  const domain = listed.slice(at + 1).toLowerCase();
+  if (at < 1 || !publicHttps(`https://${domain}/`)) {
+    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "not a usable address");
+  }
+  return reachable(`https://${domain}/.well-known/lnurlp/${name}`, payment);
 }
-async function parseSettlement(body, signature, credential, timestamp, options = {}) {
-  if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) return null;
+async function reachable(url, payment) {
   try {
-    return settlementFromWire(JSON.parse(textOf(body)));
-  } catch {
-    return null;
+    if (!publicHttps(url)) {
+      throw new Error(`${url} is not a public https URL`);
+    }
+    const response = await fetch(url, {
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+      headers: { accept: "application/json" }
+    });
+    if (!response.ok) {
+      throw new Error(`answered ${response.status}`);
+    }
+    const body = await response.json();
+    if (body === null || typeof body !== "object") {
+      throw new Error("answered with no JSON object");
+    }
+    return body;
+  } catch (cause) {
+    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, cause);
   }
 }
-async function parseSettlementRequest(request, credential, options = {}) {
-  const signature = request.headers.get(SIGNATURE_HEADER2);
-  const timestamp = request.headers.get(TIMESTAMP_HEADER2);
-  if (signature === null || timestamp === null) return null;
-  return await parseSettlement(await request.text(), signature, credential, timestamp, options);
-}
-function isProvablySettled(settled) {
-  if (settled.status !== "paid" || settled.preimage === null) return false;
-  return preimageMatchesHash(settled.preimage, settled.paymentHash);
-}
-async function answerWebhookChallenge(body, signature, credential, timestamp, options = {}) {
-  if (!await verifyWebhookSignature(body, signature, credential, timestamp, options)) return null;
-  const nonce = challenged(typeof body === "string" ? body : new TextDecoder().decode(body));
-  return nonce === null ? null : JSON.stringify({ nonce });
-}
-async function answerWebhookChallengeRequest(request, credential, options = {}) {
-  const signature = request.headers.get(SIGNATURE_HEADER2);
-  const timestamp = request.headers.get(TIMESTAMP_HEADER2);
-  if (signature === null || timestamp === null) return null;
-  const answer = await answerWebhookChallenge(
-    await request.clone().text(),
-    signature,
-    credential,
-    timestamp,
-    options
-  );
-  return answer === null ? null : new Response(answer, { headers: { "content-type": "application/json" } });
-}
-function textOf(body) {
-  return typeof body === "string" ? body : new TextDecoder().decode(body);
-}
-function challenged(text2) {
-  return nonceOf(text2, CHALLENGE);
+function equalIgnoringCase(one, other) {
+  return one.toLowerCase() === other.toLowerCase();
 }
-function nonceOf(text2, type) {
-  try {
-    const said = JSON.parse(text2);
-    if (said["type"] !== type || typeof said["nonce"] !== "string") return null;
-    return said["nonce"];
-  } catch {
-    return null;
+
+// src/client.ts
+var TERMINAL = /* @__PURE__ */ new Set(["paid", "expired"]);
+var RECONNECT_DELAY_MS = 3e3;
+var RECONNECT_CAP_MS = 3e4;
+var UNANSWERED_ATTEMPTS = 5;
+var TRIGGER_MIN_CHARS = 16;
+var STRANGER_PROBE = "is-this-gateway-yours";
+function unguessable(trigger) {
+  if (trigger.length < TRIGGER_MIN_CHARS) {
+    throw new Error(
+      `a trigger secret is the only thing guarding its stream, and nothing rate limits a guess at it, so it has to be at least ${TRIGGER_MIN_CHARS} characters nobody can predict`
+    );
   }
+  return trigger;
 }
-function answerVerifyChallenge(body) {
-  const nonce = nonceOf(body, VERIFY_CHALLENGE);
-  return nonce === null ? null : JSON.stringify({ nonce });
-}
-async function answerVerifyChallengeRequest(request) {
-  if (request.method !== "POST") return null;
-  const answer = answerVerifyChallenge(await request.clone().text());
-  return answer === null ? null : new Response(answer, { headers: { "content-type": "application/json" } });
-}
-function recent(timestamp, toleranceSecs) {
-  const sent = Number(timestamp);
-  if (!Number.isFinite(sent)) return false;
-  return Math.abs(Math.floor(Date.now() / 1e3) - sent) <= toleranceSecs;
-}
-function signed(timestamp, body) {
-  const encoder = new TextEncoder();
-  const stamp = encoder.encode(`${timestamp}.`);
-  const rest = typeof body === "string" ? encoder.encode(body) : new Uint8Array(body);
-  const payload = new Uint8Array(stamp.length + rest.length);
-  payload.set(stamp);
-  payload.set(rest, stamp.length);
-  return payload;
-}
-
-// src/bank.ts
-var DEFAULT_CURRENCY = "CZK";
-var DEFAULT_LOOK_BACK_SECS = 7 * 24 * 60 * 60;
-var DEFAULT_POLL_EVERY_SECS = 30;
-var IBAN = /^[A-Z]{2}[0-9]{2}[0-9A-Z]{8,30}$/;
-var FORBIDDEN_IN_SPD = "*";
-async function bankTransfer(params) {
-  const currency = params.currency ?? DEFAULT_CURRENCY;
-  refuseUnusable(params, currency);
-  await refuseAnOpenGateway(params);
-  const spd = shortPaymentDescriptor(params, currency);
-  const subject = subjectOf(params.reference, params.amountMinor, currency);
-  const polling = new URL(params.verifyUrl);
-  polling.searchParams.set("ref", params.reference);
-  polling.searchParams.set("minor", String(params.amountMinor));
-  polling.searchParams.set("cc", currency);
-  polling.searchParams.set("sig", await hmacHex(params.secret, `verify|${subject}`));
-  const verifyUrl = polling.toString();
-  const watched = await params.gateway.watchPayment({
-    paymentHash: hashOf(await hmacHex(params.secret, `preimage|${subject}`)),
-    verifyUrl,
-    expiresAt: params.expiresAt,
-    trigger: params.trigger,
-    sealed: params.sealed,
-    webhookUrl: params.webhookUrl
-  });
-  return { id: watched.id, paymentHash: watched.paymentHash, verifyUrl, spd };
+function backoffMs(firstDelay, attempt) {
+  const grown = Math.min(firstDelay * 2 ** (attempt - 1), RECONNECT_CAP_MS);
+  return Math.round(grown * (0.5 + Math.random() / 2));
 }
-function bankVerifyEndpoint(config) {
-  const paced = {
-    "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS}`
-  };
-  return async (request) => {
-    const consented = await answerVerifyChallengeRequest(request);
-    if (consented !== null) return consented;
-    const asked = readQuery(new URL(request.url));
-    if (asked === null) return Response.json({ settled: false }, { status: 400 });
-    const subject = subjectOf(asked.reference, asked.amountMinor, asked.currency);
-    const expected = await hmacHex(config.secret, `verify|${subject}`);
-    if (!equalInConstantTime(asked.signature, expected)) {
-      return Response.json({ settled: false }, { status: 403 });
+var ThunderBridge = class {
+  baseUrl;
+  verify;
+  token;
+  secret;
+  strangers = null;
+  speaks = null;
+  constructor(baseUrl, options) {
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
+    this.verify = options?.verify ?? true;
+    this.token = options?.token ?? null;
+    this.secret = options?.secret ?? null;
+  }
+  /**
+   * Whether a token was given, which is what makes an instance yours: a gateway
+   * started with `GATEWAY_TOKEN` answers nobody else, so anything you hand it
+   * stays between you and it
+   */
+  get isPrivate() {
+    return this.token !== null;
+  }
+  /**
+   * Whether the gateway turns away a caller carrying no token, asked by making
+   * one unauthenticated read it would have to refuse. `isPrivate` answers only
+   * whether you configured a token, which is your side of the arrangement and
+   * says nothing about the gateway's, so a made-up token against a public
+   * instance reads as private and is not. Asked once and remembered, because an
+   * instance does not change its mind. Anything other than a refusal counts as
+   * open, so an unreachable gateway fails closed
+   */
+  async refusesStrangers() {
+    this.strangers ??= fetch(`${this.baseUrl}/incoming-payments/${STRANGER_PROBE}`, {
+      headers: { accept: "application/json" }
+    }).then((answer) => answer.status === 401).catch(() => false);
+    return await this.strangers;
+  }
+  /**
+   * Ask the gateway for an invoice payable to the first address on your list
+   * that can issue a provable one, throws `NoWalletAvailableError` when none can
+   * and `GatewayCheatError` when what comes back is not what you asked for
+   */
+  async createPayment(params, options) {
+    const sent = createRequestBody(
+      params,
+      options?.trigger ? sha256Hex(unguessable(options.trigger)) : null,
+      options?.replay
+    );
+    const headers = await this.sending("/incoming-payments", sent);
+    if (options?.idempotencyKey) {
+      headers["idempotency-key"] = options.idempotencyKey;
+    }
+    const response = await fetch(`${this.baseUrl}/incoming-payments`, {
+      method: "POST",
+      headers,
+      body: sent
+    });
+    if (!response.ok) {
+      throw await problemFrom(response);
+    }
+    const payment = await paymentFrom(response);
+    if (this.verify) {
+      await proveOrigin(payment, params);
+    }
+    return payment;
+  }
+  /**
+   * Ask which address would serve an amount without minting anything, throws
+   * `NoWalletAvailableError` when none would. A quote is a probe and not a
+   * promise: the address it names can still be refused at create time, because
+   * whether a wallet returns a provable invoice cannot be known without asking
+   * it for one, and asking mints it
+   */
+  async createQuote(params) {
+    const sent = quoteRequestBody(params);
+    const response = await fetch(`${this.baseUrl}/quotes`, {
+      method: "POST",
+      headers: await this.sending("/quotes", sent),
+      body: sent
+    });
+    if (!response.ok) {
+      throw await problemFrom(response);
+    }
+    const quote = quoteFromWire(await response.json().catch(() => null));
+    if (quote === null) {
+      throw new ProblemError({
+        status: response.status,
+        title: "The gateway answered with something that is not a quote"
+      });
+    }
+    return quote;
+  }
+  /** Read a payment back, null when the gateway has never heard of it */
+  /**
+   * The key this gateway signs webhooks with when you registered none of your own,
+   * ready to hand to `parseWebhookRequest` as `{ publicKey }`. Fetch it once and
+   * keep it: it is the same for every instance in the cluster
+   */
+  async webhookKey() {
+    const response = await fetch(`${this.baseUrl}/webhook-key`);
+    if (!response.ok) {
+      throw await problemFrom(response);
+    }
+    const body = await response.json().catch(() => null);
+    if (body?.algorithm !== "ed25519" || typeof body.public_key !== "string") {
+      throw new ProblemError({
+        status: response.status,
+        title: "The gateway published no ed25519 webhook key"
+      });
+    }
+    return body.public_key;
+  }
+  async getPayment(id) {
+    const path = `/incoming-payments/${encodeURIComponent(id)}`;
+    const response = await fetch(`${this.baseUrl}${path}`, {
+      headers: await this.reading("GET", path)
+    });
+    if (response.status === 404) {
+      return null;
+    }
+    if (!response.ok) {
+      throw await problemFrom(response);
+    }
+    return this.checked(await paymentFrom(response));
+  }
+  /**
+   * Read back a payment the gateway is only watching, null when it has never
+   * heard of it. A watched payment carries no address, amount or invoice, so
+   * `getPayment` refuses it and this reads the shape both rails share
+   */
+  async getWatched(id) {
+    const path = `/incoming-payments/${encodeURIComponent(id)}`;
+    const response = await fetch(`${this.baseUrl}${path}`, {
+      headers: await this.reading("GET", path)
+    });
+    if (response.status === 404) {
+      return null;
+    }
+    if (!response.ok) {
+      throw await problemFrom(response);
+    }
+    const watched = triggerEventFromWire(await response.json().catch(() => null));
+    if (watched === null) {
+      throw new ProblemError({
+        status: response.status,
+        title: "The gateway answered with something that is not a payment"
+      });
+    }
+    return this.proven(watched);
+  }
+  /**
+   * List what this gateway is watching, newest first. Only a gateway started
+   * with `GATEWAY_TOKEN` serves this, because on a shared one it would hand
+   * every caller everyone else's payments, so a public gateway answers 404.
+   *
+   * `scanned` says how many settled records were looked at to build the page.
+   * Anything older than that window is not in the answer, and the list does not
+   * pretend otherwise
+   */
+  async listPayments(limit) {
+    const path = `/incoming-payments${limit === void 0 ? "" : `?limit=${limit}`}`;
+    const response = await fetch(`${this.baseUrl}${path}`, {
+      headers: await this.reading("GET", path)
+    });
+    if (!response.ok) {
+      throw await problemFrom(response);
+    }
+    const body = await response.json().catch(() => null);
+    const listed = Array.isArray(body?.payments) ? body.payments.map(triggerEventFromWire).filter((one) => one !== null) : null;
+    if (listed === null || typeof body?.settled_scanned !== "number") {
+      throw new ProblemError({
+        status: response.status,
+        title: "The gateway answered with something that is not a payment list"
+      });
+    }
+    return { payments: listed, scanned: body.settled_scanned };
+  }
+  /**
+   * Follow a payment over WebSocket until it is paid or expired, reconnecting
+   * through a drop. A payment that never answers gives up after a few tries, and
+   * one that has answered is followed until its own expiry, so the wait always
+   * ends by itself
+   */
+  async waitForPayment(id, options) {
+    const payment = paymentFromWire(await this.followed(id, options));
+    if (payment === null) {
+      throw new ProblemError({
+        status: 200,
+        title: `payment ${id} is watched rather than minted here, read it with waitForWatched`
+      });
+    }
+    return this.checked(payment);
+  }
+  /**
+   * Follow a payment the gateway is only watching, one it did not mint, until it
+   * is paid or expired.
+   *
+   * A watched payment carries no address, no amount and no invoice, because the
+   * gateway was told none of them, so it reads back as the shape a trigger
+   * streams rather than as a `Payment`. That is every bank transfer, and every
+   * Lightning invoice registered with `watchPayment` instead of `createPayment`.
+   */
+  async waitForWatched(id, options) {
+    const watched = triggerEventFromWire(await this.followed(id, options));
+    if (watched === null) {
+      throw new ProblemError({
+        status: 200,
+        title: "The gateway answered with something that is not a payment"
+      });
+    }
+    return this.proven(watched);
+  }
+  followed(id, options) {
+    const base = this.baseUrl.replace(/^http/, "ws");
+    const direct = `${base}/ws/incoming-payments/${encodeURIComponent(id)}`;
+    return new Promise((resolve2, reject) => {
+      const aborted = () => new Error(`waiting for payment ${id} was aborted`);
+      if (options?.signal?.aborted) {
+        reject(aborted());
+        return;
+      }
+      let socket = null;
+      let settled = false;
+      let attempt = 0;
+      let expiresAt = null;
+      let retry;
+      const abort = () => settle(() => reject(aborted()));
+      const settle = (finish) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        options?.signal?.removeEventListener("abort", abort);
+        clearTimeout(retry);
+        finish();
+        socket?.close();
+      };
+      const again = () => {
+        if (settled) {
+          return;
+        }
+        if (expiresAt === null && attempt >= UNANSWERED_ATTEMPTS) {
+          settle(() => reject(new Error(`no gateway answered for payment ${id}`)));
+          return;
+        }
+        if (expiresAt !== null && Date.now() >= expiresAt * 1e3) {
+          settle(() => reject(new Error(`payment ${id} went unreported past its expiry`)));
+          return;
+        }
+        retry = setTimeout(() => void connect(), backoffMs(RECONNECT_DELAY_MS, attempt));
+      };
+      const connect = async () => {
+        if (settled) {
+          return;
+        }
+        attempt += 1;
+        let url = direct;
+        if (this.needsTicket(options?.tickets)) {
+          try {
+            url = `${base}/ws/tickets/${await this.wsTicket({ payment_id: id })}`;
+          } catch (refused) {
+            if (refused instanceof ProblemError) {
+              settle(() => reject(refused));
+            } else {
+              again();
+            }
+            return;
+          }
+        }
+        if (settled) {
+          return;
+        }
+        const opened = new WebSocket(url);
+        socket = opened;
+        opened.onmessage = (event) => {
+          try {
+            const frame = JSON.parse(String(event.data));
+            const watched = triggerEventFromWire(frame);
+            if (watched === null) {
+              return;
+            }
+            expiresAt = watched.expiresAt;
+            attempt = 1;
+            if (!TERMINAL.has(watched.status)) {
+              return;
+            }
+            settle(() => resolve2(frame));
+          } catch (refused) {
+            settle(() => reject(refused));
+          }
+        };
+        opened.onclose = again;
+      };
+      options?.signal?.addEventListener("abort", abort, { once: true });
+      void connect();
+    });
+  }
+  /**
+   * Wait on several payments and keep the first one that is really paid, then stop
+   * waiting on the losers, which closes their sockets.
+   *
+   * This is how one order offers two rails. A Lightning invoice and a bank
+   * transfer for the same thing are two payments here, and the payer picks one, so
+   * what you want is the one that arrives and nothing further from the other.
+   *
+   * A leg that expires is a loser, not a winner, which is the whole reason this is
+   * not a race: `waitForPayment` ends on `paid` and on `expired` alike, and a
+   * Lightning invoice expires in an hour while a bank transfer takes days. `null`
+   * means every leg ended without being paid.
+   *
+   * Stopping the wait is not revoking the invoice. Nobody can revoke one, because
+   * the recipient's own wallet minted it, so a payer who pays the loser afterwards
+   * really does pay twice and that shows up on `followTrigger` as a second
+   * settlement to refund.
+   */
+  async firstToSettle(ids, options) {
+    if (ids.length === 0) {
+      return null;
+    }
+    const stopLosers = new AbortController();
+    const signal = options?.signal ? AbortSignal.any([stopLosers.signal, options.signal]) : stopLosers.signal;
+    let refused = null;
+    try {
+      const winner = await new Promise((resolve2) => {
+        let waiting = ids.length;
+        const lost = () => {
+          waiting -= 1;
+          if (waiting === 0) {
+            resolve2(null);
+          }
+        };
+        for (const id of ids) {
+          this.waitForWatched(id, { ...options, signal }).then((watched) => watched.status === "paid" ? resolve2(watched) : lost()).catch((failure) => {
+            refused ??= failure;
+            lost();
+          });
+        }
+      });
+      if (winner === null && refused !== null) {
+        throw refused;
+      }
+      return winner;
+    } finally {
+      stopLosers.abort();
+    }
+  }
+  /**
+   * Hand over an invoice you obtained yourself so the gateway watches it without
+   * being told the address or the amount. It can then only refuse everyone
+   * rather than one recipient, which is what makes leaving it cheap. Anything
+   * the watcher needs goes in `sealed`, which the gateway cannot read
+   */
+  async watchPayment(params) {
+    const sent = watchRequestBody(
+      params,
+      params.trigger ? sha256Hex(unguessable(params.trigger)) : null
+    );
+    const response = await fetch(`${this.baseUrl}/watched-payments`, {
+      method: "POST",
+      headers: await this.sending("/watched-payments", sent),
+      body: sent
+    });
+    if (!response.ok) {
+      throw await problemFrom(response);
+    }
+    const watched = triggerEventFromWire(await response.json().catch(() => null));
+    if (watched === null) {
+      throw new ProblemError({
+        status: response.status,
+        title: "The gateway answered with something that is not a watched payment"
+      });
+    }
+    const named = await this.nameFor(params.paymentHash);
+    if (named !== null && watched.id !== named) {
+      throw new GatewayCheatError("id_not_mine", watched.id);
+    }
+    return watched;
+  }
+  /**
+   * What this payment is called, which you can work out before any gateway has
+   * heard of it. Every gateway you hand the same invoice to answers with the same
+   * name, so watching at several of them adds up to one payment rather than
+   * several, and no gateway's key is in the answer. Null when no secret was given,
+   * because then the gateway names the payment and only it can
+   */
+  async nameFor(paymentHash) {
+    return this.secret === null ? null : paymentNamedBy((await this.speaking()).publicKeyHex, paymentHash);
+  }
+  /**
+   * Follow every payment made to one trigger, replayed from the recent ones on
+   * connect and then live, reconnecting on its own until the returned function
+   * is called. A trigger has no terminal state, so this never resolves
+   */
+  followTrigger(secret, options) {
+    const base = this.baseUrl.replace(/^http/, "ws");
+    const asked = options.replay === void 0 ? "" : `?replay=${options.replay}`;
+    const direct = `${base}/ws/triggers/${encodeURIComponent(unguessable(secret))}${asked}`;
+    const firstDelay = options.reconnectDelayMs ?? RECONNECT_DELAY_MS;
+    let socket = null;
+    let retry;
+    let stopped = false;
+    let attempt = 0;
+    const again = () => {
+      if (stopped || options.reconnect === false) {
+        return;
+      }
+      retry = setTimeout(() => void connect(), backoffMs(firstDelay, attempt));
+    };
+    const connect = async () => {
+      attempt += 1;
+      let url = direct;
+      if (this.needsTicket(options.tickets)) {
+        try {
+          url = `${base}/ws/tickets/${await this.wsTicket({
+            trigger_secret: secret,
+            replay: options.replay
+          })}`;
+        } catch (refused) {
+          options.onError?.(refused);
+          again();
+          return;
+        }
+      }
+      if (stopped) {
+        return;
+      }
+      socket = new WebSocket(url);
+      socket.onopen = () => {
+        attempt = 1;
+      };
+      socket.onmessage = (event) => {
+        try {
+          const settled = triggerEventFromWire(JSON.parse(String(event.data)));
+          if (settled !== null) {
+            options.onPayment(this.proven(settled));
+          }
+        } catch (refused) {
+          options.onError?.(refused);
+        }
+      };
+      socket.onerror = () => options.onError?.(new Error(`could not follow trigger at ${base}`));
+      socket.onclose = again;
+    };
+    void connect();
+    return () => {
+      stopped = true;
+      clearTimeout(retry);
+      socket?.close();
+    };
+  }
+  needsTicket(asked) {
+    return asked === true || this.token !== null;
+  }
+  async wsTicket(body) {
+    const sent = JSON.stringify(body);
+    const response = await fetch(`${this.baseUrl}/ws-tickets`, {
+      method: "POST",
+      headers: await this.sending("/ws-tickets", sent),
+      body: sent
+    });
+    if (!response.ok) {
+      throw await problemFrom(response);
     }
-    const since = unixNow() - (config.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
-    const landed = (await config.statement(since)).some((credit) => pays(credit, asked));
-    if (!landed) return Response.json({ settled: false }, { headers: paced });
-    return Response.json(
-      { settled: true, preimage: await hmacHex(config.secret, `preimage|${subject}`) },
-      { headers: paced }
-    );
-  };
-}
-function readQuery(url) {
-  const reference = url.searchParams.get("ref");
-  const minor = Number(url.searchParams.get("minor"));
-  const currency = url.searchParams.get("cc");
-  const signature = url.searchParams.get("sig");
-  if (!reference || !currency || !signature) return null;
-  if (!Number.isInteger(minor) || minor <= 0) return null;
-  return { reference, amountMinor: minor, currency, signature };
-}
-function pays(credit, asked) {
-  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && credit.reference.toUpperCase().includes(asked.reference.toUpperCase());
-}
-function subjectOf(reference, amountMinor, currency) {
-  return `${reference}|${amountMinor}|${currency.toUpperCase()}`;
-}
-function hashOf(preimage) {
-  return bytesToHex(sha256(hexToBytes(preimage)));
-}
-function shortPaymentDescriptor(params, currency) {
-  const fields = [
-    `ACC:${params.iban}`,
-    `AM:${major(params.amountMinor, currency)}`,
-    `CC:${currency.toUpperCase()}`,
-    `MSG:${params.reference}`
-  ];
-  if (params.variableSymbol) fields.push(`X-VS:${params.variableSymbol}`);
-  return `SPD*1.0*${fields.join("*")}`;
-}
-function major(amountMinor, currency) {
-  return (amountMinor / minorScaleOf(currency)).toFixed(minorUnitsOf(currency));
-}
-async function refuseAnOpenGateway(params) {
-  if (params.allowPublicGateway === true) return;
-  if (await params.gateway.refusesStrangers()) return;
-  throw new Error(
-    "this gateway serves callers with no token, so it is not yours, and its operator would read the amount and the reference off every verify URL. Point at one that answers 401 to a stranger, or say allowPublicGateway"
-  );
-}
-function refuseUnusable(params, currency) {
-  if (!IBAN.test(params.iban)) throw new Error(`${params.iban} is not an IBAN`);
-  if (!Number.isInteger(params.amountMinor) || params.amountMinor <= 0) {
-    throw new Error("amountMinor must be a whole number of minor units above zero");
+    const minted = await response.json().catch(() => null);
+    if (typeof minted?.ticket !== "string") {
+      throw new ProblemError({
+        status: response.status,
+        title: "The gateway answered with something that is not a ticket"
+      });
+    }
+    return encodeURIComponent(minted.ticket);
   }
-  if (params.reference.length === 0) {
-    throw new Error("a transfer with no reference cannot be found");
+  async sending(path, body) {
+    return { "content-type": "application/json", ...await this.reading("POST", path, body) };
   }
-  if (params.reference.includes(FORBIDDEN_IN_SPD)) {
-    throw new Error("a reference cannot contain an asterisk, it separates the QR fields");
+  async reading(method, path, body = "") {
+    return {
+      ...this.token === null ? {} : { authorization: `Bearer ${this.token}` },
+      ...this.secret === null ? {} : await signedAs(await this.speaking(), method, path, body)
+    };
   }
-  if (params.variableSymbol && !/^[0-9]{1,10}$/.test(params.variableSymbol)) {
-    throw new Error("a variable symbol is up to ten digits");
+  async speaking() {
+    this.speaks ??= callerKey(this.secret ?? "");
+    return await this.speaks;
+  }
+  proven(settled) {
+    const unproven = settled.status === "paid" && (settled.preimage === null || !preimageMatchesHash(settled.preimage, settled.paymentHash));
+    if (this.verify && unproven) {
+      throw new GatewayCheatError("preimage_mismatch", settled.id);
+    }
+    return settled;
+  }
+  checked(payment) {
+    if (this.verify && payment.status === "paid" && !isProvablyPaid(payment)) {
+      throw new GatewayCheatError("preimage_mismatch", payment.id);
+    }
+    return payment;
+  }
+};
+async function paymentFrom(response) {
+  const payment = paymentFromWire(await response.json().catch(() => null));
+  if (payment === null) {
+    throw new ProblemError({
+      status: response.status,
+      title: "The gateway answered with something that is not a payment"
+    });
   }
+  return payment;
 }
-function unixNow() {
-  return Math.floor(Date.now() / 1e3);
+async function problemFrom(response) {
+  const problem = await response.json().catch(() => ({}));
+  const document = { ...problem, status: response.status };
+  if (isProblemType(problem, NO_WALLET_AVAILABLE)) {
+    return new NoWalletAvailableError(document, refusals(problem.wallets));
+  }
+  if (isProblemType(problem, REQUEST_IN_FLIGHT)) {
+    return new IdempotencyConflictError(document, "request-in-flight");
+  }
+  if (isProblemType(problem, IDEMPOTENCY_KEY_REUSED)) {
+    return new IdempotencyConflictError(document, "key-reused");
+  }
+  return new ProblemError(document);
+}
+function refusals(wallets) {
+  if (!Array.isArray(wallets)) {
+    return [];
+  }
+  return wallets.filter((wallet) => {
+    return typeof wallet === "object" && wallet !== null && "address" in wallet;
+  });
 }
 
 // src/fio.ts
@@ -1659,7 +1944,9 @@ var WHERE_A_PAYER_WRITES = [
 var UTC_OFFSET = /^[+-]\d{4}$/;
 function fioStatement(config) {
   const named = typeof config.token === "string" ? [config.token] : config.token;
-  if (named.length === 0) throw new Error("fioStatement needs at least one token to read with");
+  if (named.length === 0) {
+    throw new Error("fioStatement needs at least one token to read with");
+  }
   const usedAt = new Map(named.map((token) => [token, Number.NEGATIVE_INFINITY]));
   const tokenWindowMs = (config.minIntervalSecs ?? DEFAULT_MIN_INTERVAL_SECS) * MILLIS;
   const paceMs = tokenWindowMs / usedAt.size;
@@ -1667,9 +1954,13 @@ function fioStatement(config) {
   let credits = [];
   return async (sinceUnix) => {
     const now = Date.now();
-    if (now - lastRead < paceMs) return credits;
+    if (now - lastRead < paceMs) {
+      return credits;
+    }
     const idlest = longestUnused(usedAt);
-    if (now - idlest.usedAt < tokenWindowMs) return credits;
+    if (now - idlest.usedAt < tokenWindowMs) {
+      return credits;
+    }
     usedAt.set(idlest.token, now);
     lastRead = now;
     const url = [
@@ -1684,7 +1975,9 @@ function fioStatement(config) {
     if (answer.status === TOO_SOON) {
       throw new Error("fio refuses a second read of this token inside its 30 second window");
     }
-    if (!answer.ok) throw new Error(`fio answered ${answer.status} reading the statement`);
+    if (!answer.ok) {
+      throw new Error(`fio answered ${answer.status} reading the statement`);
+    }
     const read = await answer.json();
     credits = (read.accountStatement?.transactionList?.transaction ?? []).filter(isCredit).map(asCredit);
     return credits;
@@ -1714,86 +2007,250 @@ function asCredit(transaction) {
 }
 function bookedAtIn(cell) {
   const value = cell?.value;
-  if (typeof value === "number") return Math.floor(value / MILLIS);
+  if (typeof value === "number") {
+    return Math.floor(value / MILLIS);
+  }
   const at = Date.parse(asIso8601(textIn(cell)));
   return Number.isFinite(at) ? Math.floor(at / MILLIS) : 0;
 }
 function asIso8601(booked) {
   const day = booked.slice(0, DATE_CHARS);
   const zone = booked.slice(DATE_CHARS);
-  if (!UTC_OFFSET.test(zone)) return `${day}T00:00:00Z`;
+  if (!UTC_OFFSET.test(zone)) {
+    return `${day}T00:00:00Z`;
+  }
   return `${day}T00:00:00${zone.slice(0, 3)}:${zone.slice(3)}`;
 }
-function numberIn(cell) {
-  const value = Number(cell?.value ?? Number.NaN);
-  return Number.isFinite(value) ? value : 0;
+function numberIn(cell) {
+  const value = Number(cell?.value ?? Number.NaN);
+  return Number.isFinite(value) ? value : 0;
+}
+function textIn(cell) {
+  const value = cell?.value;
+  return value === null || value === void 0 ? "" : String(value).trim();
+}
+function asDate(unix) {
+  return new Date(unix * MILLIS).toISOString().slice(0, DATE_CHARS);
+}
+
+// src/gateways.ts
+var Gateways = class {
+  each;
+  urls;
+  onRefused;
+  constructor(baseUrls, options) {
+    if (baseUrls.length === 0) {
+      throw new Error("name at least one gateway to watch at");
+    }
+    this.urls = [...baseUrls];
+    this.each = baseUrls.map((baseUrl) => new ThunderBridge(baseUrl, options));
+    this.onRefused = options?.onRefused ?? (() => {
+    });
+  }
+  /** What this payment is called, which every gateway here will agree on */
+  async nameFor(paymentHash) {
+    return await this.each[0].nameFor(paymentHash);
+  }
+  /**
+   * Hand the same invoice to every gateway. Throws only when none of them took it,
+   * carrying the first refusal, because one gateway that agreed is enough to be
+   * watched
+   */
+  async watchPayment(params) {
+    const asked = await Promise.allSettled(
+      this.each.map((gateway) => gateway.watchPayment(params))
+    );
+    const taken = [];
+    const refusals3 = [];
+    for (const [at, answer] of asked.entries()) {
+      if (answer.status === "fulfilled") {
+        taken.push(answer.value);
+        continue;
+      }
+      refusals3.push(answer.reason);
+      this.onRefused(this.urls[at], answer.reason);
+    }
+    if (taken[0] === void 0) {
+      throw refusals3[0];
+    }
+    return taken[0];
+  }
+  /**
+   * Wait for whichever gateway speaks first. A settlement from any of them is the
+   * settlement, and each has already proved the preimage against the hash before
+   * saying so. When they all end without a payment, the first ending is the answer,
+   * and when they all fail, the first failure is thrown
+   */
+  async waitForWatched(id, options) {
+    const stopLosers = new AbortController();
+    const signal = options?.signal ? AbortSignal.any([stopLosers.signal, options.signal]) : stopLosers.signal;
+    const unpaid = [];
+    let refused = null;
+    try {
+      const settled = await new Promise((resolve2) => {
+        let waiting = this.each.length;
+        const lost = () => {
+          waiting -= 1;
+          if (waiting === 0) {
+            resolve2(null);
+          }
+        };
+        for (const gateway of this.each) {
+          gateway.waitForWatched(id, { ...options, signal }).then((watched) => {
+            if (watched.status === "paid") {
+              return resolve2(watched);
+            }
+            unpaid.push(watched);
+            lost();
+          }).catch((failure) => {
+            refused ??= failure;
+            lost();
+          });
+        }
+      });
+      if (settled !== null) {
+        return settled;
+      }
+      if (unpaid.length > 0) {
+        return unpaid[0];
+      }
+      throw refused;
+    } finally {
+      stopLosers.abort();
+    }
+  }
+};
+
+// src/price.ts
+var MSAT_PER_BTC2 = 1e11;
+var BASIS_POINTS = 1e4;
+var DEFAULT_HOLD_SECS = 60;
+var DEFAULT_MIN_VENUES = 2;
+var DEFAULT_MAX_SPREAD_BPS = 200;
+var MILLIS2 = 1e3;
+function coinbase(baseUrl = "https://api.coinbase.com") {
+  return async (currency) => {
+    const asked = currency.toUpperCase();
+    const answer = await asJson(`${baseUrl}/v2/prices/BTC-${asked}/spot`, "coinbase");
+    const quoted = answer.data;
+    if (quoted?.currency !== asked) {
+      throw new Error(`coinbase quoted ${quoted?.currency} when asked for ${asked}`);
+    }
+    return asMinor(quoted.amount, "coinbase", asked);
+  };
+}
+function kraken(baseUrl = "https://api.kraken.com") {
+  return async (currency) => {
+    const asked = currency.toUpperCase();
+    const answer = await asJson(`${baseUrl}/0/public/Ticker?pair=XBT${asked}`, "kraken");
+    if (answer.error?.length) {
+      throw new Error(`kraken refused XBT${asked}: ${answer.error[0]}`);
+    }
+    const pairs = Object.values(answer.result ?? {});
+    if (pairs.length !== 1) {
+      throw new Error(`kraken answered ${pairs.length} pairs for XBT${asked}`);
+    }
+    return asMinor(pairs[0]?.c?.[0], "kraken", asked);
+  };
+}
+function bitstamp(baseUrl = "https://www.bitstamp.net") {
+  return async (currency) => {
+    const pair = `btc${currency.toLowerCase()}`;
+    const answer = await asJson(`${baseUrl}/api/v2/ticker/${pair}/`, "bitstamp");
+    if (Array.isArray(answer)) {
+      throw new Error(`bitstamp has no ${pair} pair`);
+    }
+    return asMinor(answer.last, "bitstamp", currency);
+  };
 }
-function textIn(cell) {
-  const value = cell?.value;
-  return value === null || value === void 0 ? "" : String(value).trim();
+function coinmate(baseUrl = "https://coinmate.io") {
+  return async (currency) => {
+    const pair = `BTC_${currency.toUpperCase()}`;
+    const answer = await asJson(`${baseUrl}/api/ticker?currencyPair=${pair}`, "coinmate");
+    if (answer.error !== false) {
+      throw new Error(`coinmate refused ${pair}: ${answer.errorMessage ?? "no reason"}`);
+    }
+    return asMinor(answer.data?.last, "coinmate", currency);
+  };
 }
-function asDate(unix) {
-  return new Date(unix * MILLIS).toISOString().slice(0, DATE_CHARS);
+function medianOf(tickers = [coinbase(), kraken(), bitstamp(), coinmate()], options = {}) {
+  const holdFor = (options.holdForSecs ?? DEFAULT_HOLD_SECS) * MILLIS2;
+  const minVenues = options.minVenues ?? DEFAULT_MIN_VENUES;
+  const maxSpread = options.maxSpreadBps ?? DEFAULT_MAX_SPREAD_BPS;
+  const held = /* @__PURE__ */ new Map();
+  return async (currency) => {
+    const asked = currency.toUpperCase();
+    const remembered = held.get(asked);
+    if (remembered && Date.now() - remembered.at < holdFor) {
+      return remembered.price;
+    }
+    const answers = await Promise.allSettled(tickers.map((ticker) => ticker(asked)));
+    const quoted = answers.filter((answer) => answer.status === "fulfilled").map((answer) => answer.value).sort((one, other) => one - other);
+    if (quoted.length < minVenues) {
+      throw new Error(
+        `${quoted.length} of ${tickers.length} venues quoted ${asked}, ${minVenues} wanted: ${refusals2(answers)}`
+      );
+    }
+    const spread = spreadBpsOf(quoted);
+    if (spread > maxSpread) {
+      throw new Error(
+        `venues disagree on ${asked} by ${Math.round(spread)} bps, more than the ${maxSpread} allowed: ${quoted.join(", ")}`
+      );
+    }
+    const price = middleOf(quoted);
+    held.set(asked, { at: Date.now(), price });
+    return price;
+  };
 }
-
-// ../core/lnurl.ts
-var BECH32_CHARSET2 = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
-var BECH32_GENERATOR = [996825010, 642813549, 513874426, 1027748829, 705979059];
-var CHECKSUM_SLOTS = [0, 1, 2, 3, 4, 5];
-var LNURL_HRP = "lnurl";
-function toLnurl(endpoint) {
-  const scheme = parsedScheme(endpoint);
-  if (scheme !== "https:" && scheme !== "http:") {
-    throw new Error(`${endpoint} is not an http or https URL`);
+function msatFor(amountMinor, priceMinorPerBtc, options = {}) {
+  if (!Number.isInteger(amountMinor) || amountMinor <= 0) {
+    throw new Error("amountMinor must be a whole number of minor units above zero");
   }
-  const words = toWords(new TextEncoder().encode(endpoint));
-  const data = [...words, ...checksumWords(LNURL_HRP, words)];
-  return `${LNURL_HRP}1${data.map((word) => BECH32_CHARSET2[word]).join("")}`.toUpperCase();
+  if (!Number.isFinite(priceMinorPerBtc) || priceMinorPerBtc <= 0) {
+    throw new Error(`${priceMinorPerBtc} is not a usable price`);
+  }
+  const spreadBps = options.spreadBps ?? 0;
+  if (!Number.isInteger(spreadBps) || spreadBps < 0) {
+    throw new Error("spreadBps must be a whole number of basis points, none or more");
+  }
+  const wanted = BigInt(amountMinor) * BigInt(MSAT_PER_BTC2) * BigInt(BASIS_POINTS + spreadBps);
+  const per = BigInt(Math.round(priceMinorPerBtc)) * BigInt(BASIS_POINTS);
+  const msat = (wanted + per - 1n) / per;
+  if (msat > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error(`${amountMinor} at ${priceMinorPerBtc} is more millisatoshi than exist`);
+  }
+  return Number(msat);
 }
-function parsedScheme(endpoint) {
-  try {
-    return new URL(endpoint).protocol;
-  } catch {
-    return null;
+async function asJson(url, venue) {
+  const answer = await fetch(url, { headers: { accept: "application/json" } });
+  if (!answer.ok) {
+    throw new Error(`${venue} answered ${answer.status}`);
   }
+  return answer.json();
 }
-function toWords(bytes) {
-  const words = [];
-  let accumulator = 0;
-  let bits = 0;
-  for (const byte of bytes) {
-    accumulator = accumulator << 8 | byte;
-    bits += 8;
-    while (bits >= 5) {
-      bits -= 5;
-      words.push(accumulator >> bits & 31);
-    }
+function asMinor(quoted, venue, currency) {
+  const major2 = Number(quoted);
+  if (!Number.isFinite(major2) || major2 <= 0) {
+    throw new Error(`${venue} quoted ${String(quoted)} for ${currency.toUpperCase()}`);
   }
-  if (bits > 0) words.push(accumulator << 5 - bits & 31);
-  return words;
+  return Math.round(major2 * minorScaleOf(currency));
 }
-function checksumWords(hrp, words) {
-  const expanded = [...hrp].map((char) => char.charCodeAt(0));
-  const values = [
-    ...expanded.map((code) => code >> 5),
-    0,
-    ...expanded.map((code) => code & 31),
-    ...words,
-    ...CHECKSUM_SLOTS.map(() => 0)
-  ];
-  const polymod = bech32Polymod(values) ^ 1;
-  return CHECKSUM_SLOTS.map((slot) => polymod >> 5 * (5 - slot) & 31);
+function spreadBpsOf(sorted) {
+  const lowest = sorted[0] ?? 0;
+  const highest = sorted[sorted.length - 1] ?? 0;
+  return lowest === 0 ? Number.POSITIVE_INFINITY : (highest - lowest) / lowest * BASIS_POINTS;
 }
-function bech32Polymod(values) {
-  let checksum = 1;
-  for (const value of values) {
-    const top = checksum >> 25;
-    checksum = (checksum & 33554431) << 5 ^ value;
-    for (let bit = 0; bit < 5; bit++) {
-      if (top >> bit & 1) checksum ^= BECH32_GENERATOR[bit];
-    }
+function middleOf(sorted) {
+  const middle = Math.floor(sorted.length / 2);
+  if (sorted.length % 2 === 1) {
+    return sorted[middle] ?? 0;
   }
-  return checksum;
+  return Math.round(((sorted[middle - 1] ?? 0) + (sorted[middle] ?? 0)) / 2);
+}
+function refusals2(answers) {
+  return answers.filter((answer) => answer.status === "rejected").map(
+    (answer) => answer.reason instanceof Error ? answer.reason.message : String(answer.reason)
+  ).join("; ");
 }
 
 // src/qr.ts
@@ -1830,7 +2287,9 @@ function qrToDataUrl(payload, options) {
 function svgOf(scanned, options) {
   const size = options?.size ?? 256;
   const color = options?.color ?? "#000";
-  if (!SAFE_COLOR.test(color)) throw new Error(`Invalid color: ${color}`);
+  if (!SAFE_COLOR.test(color)) {
+    throw new Error(`Invalid color: ${color}`);
+  }
   return renderSvg(scanned, size, color);
 }
 function asDataUrl(svg) {
@@ -1876,6 +2335,7 @@ function bankRail(config) {
       currency: order.currency,
       expiresAt,
       trigger: config.trigger,
+      replay: config.replay,
       sealed: await config.sealed?.(order),
       variableSymbol: config.variableSymbol?.(order),
       webhookUrl: config.webhookUrl,
@@ -1898,7 +2358,11 @@ function lightningRail(config) {
         amountMsat: await config.amountMsat(order),
         webhookUrl: config.webhookUrl
       },
-      { idempotencyKey: config.idempotencyKey?.(order), trigger: config.trigger }
+      {
+        idempotencyKey: config.idempotencyKey?.(order),
+        trigger: config.trigger,
+        replay: config.replay
+      }
     );
     return {
       id: payment.id,
@@ -1909,128 +2373,6 @@ function lightningRail(config) {
     };
   };
 }
-
-// src/price.ts
-var MSAT_PER_BTC2 = 1e11;
-var BASIS_POINTS = 1e4;
-var DEFAULT_HOLD_SECS = 60;
-var DEFAULT_MIN_VENUES = 2;
-var DEFAULT_MAX_SPREAD_BPS = 200;
-var MILLIS2 = 1e3;
-function coinbase(baseUrl = "https://api.coinbase.com") {
-  return async (currency) => {
-    const asked = currency.toUpperCase();
-    const answer = await asJson(`${baseUrl}/v2/prices/BTC-${asked}/spot`, "coinbase");
-    const quoted = answer.data;
-    if (quoted?.currency !== asked) {
-      throw new Error(`coinbase quoted ${quoted?.currency} when asked for ${asked}`);
-    }
-    return asMinor(quoted.amount, "coinbase", asked);
-  };
-}
-function kraken(baseUrl = "https://api.kraken.com") {
-  return async (currency) => {
-    const asked = currency.toUpperCase();
-    const answer = await asJson(`${baseUrl}/0/public/Ticker?pair=XBT${asked}`, "kraken");
-    if (answer.error?.length) throw new Error(`kraken refused XBT${asked}: ${answer.error[0]}`);
-    const pairs = Object.values(answer.result ?? {});
-    if (pairs.length !== 1) {
-      throw new Error(`kraken answered ${pairs.length} pairs for XBT${asked}`);
-    }
-    return asMinor(pairs[0]?.c?.[0], "kraken", asked);
-  };
-}
-function bitstamp(baseUrl = "https://www.bitstamp.net") {
-  return async (currency) => {
-    const pair = `btc${currency.toLowerCase()}`;
-    const answer = await asJson(`${baseUrl}/api/v2/ticker/${pair}/`, "bitstamp");
-    if (Array.isArray(answer)) throw new Error(`bitstamp has no ${pair} pair`);
-    return asMinor(answer.last, "bitstamp", currency);
-  };
-}
-function coinmate(baseUrl = "https://coinmate.io") {
-  return async (currency) => {
-    const pair = `BTC_${currency.toUpperCase()}`;
-    const answer = await asJson(`${baseUrl}/api/ticker?currencyPair=${pair}`, "coinmate");
-    if (answer.error !== false) {
-      throw new Error(`coinmate refused ${pair}: ${answer.errorMessage ?? "no reason"}`);
-    }
-    return asMinor(answer.data?.last, "coinmate", currency);
-  };
-}
-function medianOf(tickers = [coinbase(), kraken(), bitstamp(), coinmate()], options = {}) {
-  const holdFor = (options.holdForSecs ?? DEFAULT_HOLD_SECS) * MILLIS2;
-  const minVenues = options.minVenues ?? DEFAULT_MIN_VENUES;
-  const maxSpread = options.maxSpreadBps ?? DEFAULT_MAX_SPREAD_BPS;
-  const held = /* @__PURE__ */ new Map();
-  return async (currency) => {
-    const asked = currency.toUpperCase();
-    const remembered = held.get(asked);
-    if (remembered && Date.now() - remembered.at < holdFor) return remembered.price;
-    const answers = await Promise.allSettled(tickers.map((ticker) => ticker(asked)));
-    const quoted = answers.filter((answer) => answer.status === "fulfilled").map((answer) => answer.value).sort((one, other) => one - other);
-    if (quoted.length < minVenues) {
-      throw new Error(
-        `${quoted.length} of ${tickers.length} venues quoted ${asked}, ${minVenues} wanted: ${refusals2(answers)}`
-      );
-    }
-    const spread = spreadBpsOf(quoted);
-    if (spread > maxSpread) {
-      throw new Error(
-        `venues disagree on ${asked} by ${Math.round(spread)} bps, more than the ${maxSpread} allowed: ${quoted.join(", ")}`
-      );
-    }
-    const price = middleOf(quoted);
-    held.set(asked, { at: Date.now(), price });
-    return price;
-  };
-}
-function msatFor(amountMinor, priceMinorPerBtc, options = {}) {
-  if (!Number.isInteger(amountMinor) || amountMinor <= 0) {
-    throw new Error("amountMinor must be a whole number of minor units above zero");
-  }
-  if (!Number.isFinite(priceMinorPerBtc) || priceMinorPerBtc <= 0) {
-    throw new Error(`${priceMinorPerBtc} is not a usable price`);
-  }
-  const spreadBps = options.spreadBps ?? 0;
-  if (!Number.isInteger(spreadBps) || spreadBps < 0) {
-    throw new Error("spreadBps must be a whole number of basis points, none or more");
-  }
-  const wanted = BigInt(amountMinor) * BigInt(MSAT_PER_BTC2) * BigInt(BASIS_POINTS + spreadBps);
-  const per = BigInt(Math.round(priceMinorPerBtc)) * BigInt(BASIS_POINTS);
-  const msat = (wanted + per - 1n) / per;
-  if (msat > BigInt(Number.MAX_SAFE_INTEGER)) {
-    throw new Error(`${amountMinor} at ${priceMinorPerBtc} is more millisatoshi than exist`);
-  }
-  return Number(msat);
-}
-async function asJson(url, venue) {
-  const answer = await fetch(url, { headers: { accept: "application/json" } });
-  if (!answer.ok) throw new Error(`${venue} answered ${answer.status}`);
-  return answer.json();
-}
-function asMinor(quoted, venue, currency) {
-  const major2 = Number(quoted);
-  if (!Number.isFinite(major2) || major2 <= 0) {
-    throw new Error(`${venue} quoted ${String(quoted)} for ${currency.toUpperCase()}`);
-  }
-  return Math.round(major2 * minorScaleOf(currency));
-}
-function spreadBpsOf(sorted) {
-  const lowest = sorted[0] ?? 0;
-  const highest = sorted[sorted.length - 1] ?? 0;
-  return lowest === 0 ? Number.POSITIVE_INFINITY : (highest - lowest) / lowest * BASIS_POINTS;
-}
-function middleOf(sorted) {
-  const middle = Math.floor(sorted.length / 2);
-  if (sorted.length % 2 === 1) return sorted[middle] ?? 0;
-  return Math.round(((sorted[middle - 1] ?? 0) + (sorted[middle] ?? 0)) / 2);
-}
-function refusals2(answers) {
-  return answers.filter((answer) => answer.status === "rejected").map(
-    (answer) => answer.reason instanceof Error ? answer.reason.message : String(answer.reason)
-  ).join("; ");
-}
 export {
   GatewayCheatError,
   Gateways,
@@ -2043,6 +2385,7 @@ export {
   REQUEST_IN_FLIGHT,
   ThunderBridge,
   UnverifiedRecipientError,
+  WrapRefusedError,
   answerVerifyChallenge,
   answerVerifyChallengeRequest,
   answerWebhookChallenge,
@@ -2077,6 +2420,7 @@ export {
   preimageMatchesHash,
   proveOrigin,
   proveSettlement,
+  proveWrapped,
   qrToDataUrl,
   qrToSvg,
   seal,
@@ -2084,5 +2428,6 @@ export {
   spdToSvg,
   toLnurl,
   unseal,
-  verifyWebhookSignature
+  verifyWebhookSignature,
+  wrapFeeCeiling
 };