thunder-bridge 1.5.0 → 2.1.1

package/dist/index.js

@@ -175,6 +175,7 @@ function rotate(value, by) {
 
 // ../core/bolt11.ts
 var BECH32_CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+var BECH32_GENERATOR = [996825010, 642813549, 513874426, 1027748829, 705979059];
 var CHECKSUM_WORDS = 6;
 var TIMESTAMP_WORDS = 7;
 var SIGNATURE_WORDS = 104;
@@ -192,18 +193,27 @@ var HRP_MULTIPLIER_MSAT = {
   n: MSAT_PER_BTC / 1e9,
   p: MSAT_PER_BTC / 1e12
 };
-var HRP_AMOUNT = /^ln[a-z]+?(\d+)([munp]?)$/;
+var HRP = /^ln(?:bcrt|bc|tbs|tb|sb)(?:(\d+)([munp]?))?$/;
 function decodeInvoice(bolt11) {
   const parts = splitBech32(bolt11);
   if (parts === null) {
-    return { paymentHash: null, descriptionHash: null, amountMsat: null, expiresAt: null };
+    return {
+      paymentHash: null,
+      descriptionHash: null,
+      amountMsat: null,
+      issuedAt: null,
+      expiresAt: null
+    };
   }
   const tagged = taggedFields(parts.words);
+  const issuedAt = issuedAtOf(parts.words);
+  const expiry = tagged.get(EXPIRY_TAG);
   return {
     paymentHash: hexTag(tagged, PAYMENT_HASH_TAG, PAYMENT_HASH_WORDS),
     descriptionHash: hexTag(tagged, DESCRIPTION_HASH_TAG, DESCRIPTION_HASH_WORDS),
     amountMsat: amountFromHrp(parts.hrp),
-    expiresAt: expiryOf(parts.words, tagged)
+    issuedAt,
+    expiresAt: issuedAt === null ? null : issuedAt + (expiry ? readNumber(expiry) : DEFAULT_EXPIRY_SECS)
   };
 }
 function preimageMatchesHash(preimage, paymentHash) {
@@ -214,7 +224,7 @@ function preimageMatchesHash(preimage, paymentHash) {
 }
 function splitBech32(bolt11) {
   const lower = bolt11.toLowerCase();
-  if (isBolt12Encoding(lower)) {
+  if (isBolt12Encoding(lower) || bolt11 !== lower && bolt11 !== bolt11.toUpperCase()) {
     return null;
   }
   const separator = lower.lastIndexOf("1");
@@ -233,7 +243,28 @@ function splitBech32(bolt11) {
     }
     words.push(value);
   }
-  return { hrp: lower.slice(0, separator), words: words.slice(0, -CHECKSUM_WORDS) };
+  const hrp = lower.slice(0, separator);
+  if (!HRP.test(hrp) || bech32Polymod([...expandedHrp(hrp), ...words]) !== 1) {
+    return null;
+  }
+  return { hrp, words: words.slice(0, -CHECKSUM_WORDS) };
+}
+function expandedHrp(hrp) {
+  const codes = [...hrp].map((char) => char.charCodeAt(0));
+  return [...codes.map((code) => code >> 5), 0, ...codes.map((code) => code & 31)];
+}
+function bech32Polymod(values) {
+  let checksum = 1;
+  for (const value of values) {
+    const top = checksum >> 25;
+    checksum = (checksum & 33554431) << 5 ^ value;
+    for (let bit = 0; bit < 5; bit++) {
+      if (top >> bit & 1) {
+        checksum ^= BECH32_GENERATOR[bit];
+      }
+    }
+  }
+  return checksum;
 }
 function isBolt12Encoding(lower) {
   return lower.startsWith("lno") || lower.startsWith("lni") || lower.startsWith("lnr");
@@ -263,19 +294,17 @@ function hexTag(fields, tag, expectedWords) {
   }
   return bytesToHex(wordsToBytes(words));
 }
-function expiryOf(words, fields) {
+function issuedAtOf(words) {
   if (words.length < TIMESTAMP_WORDS + SIGNATURE_WORDS) {
     return null;
   }
-  const expiry = fields.get(EXPIRY_TAG);
-  return readNumber(words.slice(0, TIMESTAMP_WORDS)) + (expiry ? readNumber(expiry) : DEFAULT_EXPIRY_SECS);
+  return readNumber(words.slice(0, TIMESTAMP_WORDS));
 }
 function amountFromHrp(hrp) {
-  const match = HRP_AMOUNT.exec(hrp);
-  if (match === null) {
+  const [, digits, multiplier] = HRP.exec(hrp) ?? [];
+  if (digits === void 0 || multiplier === "p" && !digits.endsWith("0")) {
     return null;
   }
-  const [, digits, multiplier] = match;
   return multiplier ? Number(digits) * HRP_MULTIPLIER_MSAT[multiplier] : Number(digits) * MSAT_PER_BTC;
 }
 function readNumber(words) {
@@ -296,28 +325,74 @@ function wordsToBytes(words) {
   return Uint8Array.from(bytes);
 }
 
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
+}
+function equalInConstantTime(one, other) {
+  if (one.length !== other.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let at = 0; at < one.length; at++) {
+    difference |= one.charCodeAt(at) ^ other.charCodeAt(at);
+  }
+  return difference === 0;
+}
+function asBuffer(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
 // ../core/sealed.ts
-var VERSION = "v1";
+var VERSION = "v2";
+var UNPADDED_VERSION = "v1";
 var IV_BYTES = 12;
 var MIN_SECRET_CHARS = 32;
 var MAX_PLAIN_BYTES = 3e3;
+var SIZE_CLASSES = [256, 1024, MAX_PLAIN_BYTES];
+var END_OF_TEXT = 128;
 var INFO = new TextEncoder().encode("thunder-bridge/sealed");
-async function seal(secret, plaintext) {
-  const body = new TextEncoder().encode(plaintext);
-  if (body.length > MAX_PLAIN_BYTES) {
-    throw new Error(`sealed takes at most ${MAX_PLAIN_BYTES} bytes, this was ${body.length}`);
+async function seal(secret, plaintext, paymentHash) {
+  return await sealUnder(
+    secret,
+    plaintext,
+    crypto.getRandomValues(new Uint8Array(IV_BYTES)),
+    boundTo(paymentHash)
+  );
+}
+async function sealStable(secret, plaintext) {
+  const derived = await hmacHex(secret, `sealed-nonce|${plaintext}`);
+  const nonce = new Uint8Array(IV_BYTES);
+  for (let at = 0; at < IV_BYTES; at++) {
+    nonce[at] = Number.parseInt(derived.slice(at * 2, at * 2 + 2), 16);
   }
+  return await sealUnder(secret, plaintext, nonce, boundTo(void 0));
+}
+async function sealUnder(secret, plaintext, iv, additionalData) {
+  const body = padToClass(plaintext);
   const key = await keyFor(secret);
-  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-  const cipher = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, body));
+  const cipher = new Uint8Array(
+    await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData }, key, body)
+  );
   const joined = new Uint8Array(iv.length + cipher.length);
   joined.set(iv);
   joined.set(cipher, iv.length);
   return `${VERSION}.${toBase64Url(joined)}`;
 }
-async function unseal(secret, sealed) {
+async function unseal(secret, sealed, paymentHash) {
   const key = await keyFor(secret);
-  if (!sealed.startsWith(`${VERSION}.`)) {
+  const padded = sealed.startsWith(`${VERSION}.`);
+  const unbound = !padded && sealed.startsWith(`${UNPADDED_VERSION}.`);
+  if (!padded && (!unbound || paymentHash !== void 0)) {
     return null;
   }
   const joined = fromBase64Url(sealed.slice(VERSION.length + 1));
@@ -325,20 +400,50 @@ async function unseal(secret, sealed) {
     return null;
   }
   try {
-    const body = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: joined.slice(0, IV_BYTES) },
-      key,
-      joined.slice(IV_BYTES)
+    const body = new Uint8Array(
+      await crypto.subtle.decrypt(
+        {
+          name: "AES-GCM",
+          iv: joined.slice(0, IV_BYTES),
+          additionalData: padded ? boundTo(paymentHash) : void 0
+        },
+        key,
+        joined.slice(IV_BYTES)
+      )
     );
-    return new TextDecoder().decode(body);
+    const text3 = padded ? unpad(body) : body;
+    return text3 === null ? null : new TextDecoder().decode(text3);
   } catch {
     return null;
   }
 }
-async function keyFor(secret) {
+function refuseAWeakSecret(secret) {
   if (secret.length < MIN_SECRET_CHARS) {
     throw new Error(`the sealing secret needs ${MIN_SECRET_CHARS} characters of randomness`);
   }
+}
+function boundTo(paymentHash) {
+  return new TextEncoder().encode(
+    paymentHash === void 0 ? VERSION : `${VERSION}|${paymentHash.toLowerCase()}`
+  );
+}
+function padToClass(plaintext) {
+  const text3 = new TextEncoder().encode(plaintext);
+  const size = SIZE_CLASSES.find((limit) => text3.length <= limit);
+  if (size === void 0) {
+    throw new Error(`sealed takes at most ${MAX_PLAIN_BYTES} bytes, this was ${text3.length}`);
+  }
+  const body = new Uint8Array(size + 1);
+  body.set(text3);
+  body[text3.length] = END_OF_TEXT;
+  return body;
+}
+function unpad(body) {
+  const end = body.lastIndexOf(END_OF_TEXT);
+  return end === -1 ? null : body.subarray(0, end);
+}
+async function keyFor(secret) {
+  refuseAWeakSecret(secret);
   const material = await crypto.subtle.importKey(
     "raw",
     new TextEncoder().encode(secret),
@@ -535,11 +640,11 @@ function coinbase(baseUrl = "https://api.coinbase.com") {
   return async (currency) => {
     const asked = currency.toUpperCase();
     const answer = await asJson(`${baseUrl}/v2/prices/BTC-${asked}/spot`, "coinbase");
-    const quoted = answer.data;
-    if (quoted?.currency !== asked) {
-      throw new Error(`coinbase quoted ${quoted?.currency} when asked for ${asked}`);
+    const quoted2 = answer.data;
+    if (quoted2?.currency !== asked) {
+      throw new Error(`coinbase quoted ${quoted2?.currency} when asked for ${asked}`);
     }
-    return asMinor(quoted.amount, "coinbase", asked);
+    return asMinor(quoted2.amount, "coinbase", asked);
   };
 }
 function kraken(baseUrl = "https://api.kraken.com") {
@@ -588,19 +693,19 @@ function medianOf(tickers = [coinbase(), kraken(), bitstamp(), coinmate()], opti
       return remembered.price;
     }
     const answers = await Promise.allSettled(tickers.map((ticker) => ticker(asked)));
-    const quoted = answers.filter((answer) => answer.status === "fulfilled").map((answer) => answer.value).sort((one, other) => one - other);
-    if (quoted.length < minVenues) {
+    const quoted2 = answers.filter((answer) => answer.status === "fulfilled").map((answer) => answer.value).sort((one, other) => one - other);
+    if (quoted2.length < minVenues) {
       throw new Error(
-        `${quoted.length} of ${tickers.length} venues quoted ${asked}, ${minVenues} wanted: ${refusals(answers)}`
+        `${quoted2.length} of ${tickers.length} venues quoted ${asked}, ${minVenues} wanted: ${refusals(answers)}`
       );
     }
-    const spread2 = spreadBpsOf(quoted);
+    const spread2 = spreadBpsOf(quoted2);
     if (spread2 > maxSpread) {
       throw new Error(
-        `venues disagree on ${asked} by ${Math.round(spread2)} bps, more than the ${maxSpread} allowed: ${quoted.join(", ")}`
+        `venues disagree on ${asked} by ${Math.round(spread2)} bps, more than the ${maxSpread} allowed: ${quoted2.join(", ")}`
       );
     }
-    const price = middleOf(quoted);
+    const price = middleOf(quoted2);
     held.set(asked, { at: Date.now(), price });
     return price;
   };
@@ -631,10 +736,10 @@ async function asJson(url, venue) {
   }
   return answer.json();
 }
-function asMinor(quoted, venue, currency) {
-  const major2 = Number(quoted);
+function asMinor(quoted2, venue, currency) {
+  const major2 = Number(quoted2);
   if (!Number.isFinite(major2) || major2 <= 0) {
-    throw new Error(`${venue} quoted ${String(quoted)} for ${currency.toUpperCase()}`);
+    throw new Error(`${venue} quoted ${String(quoted2)} for ${currency.toUpperCase()}`);
   }
   return Math.round(major2 * minorScaleOf(currency));
 }
@@ -722,6 +827,16 @@ var SEED_BYTES = 32;
 var SIGNATURE_BYTES = 64;
 var PUBLIC_KEY_BYTES = 32;
 var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
+var SIGN_BIT_CLEARED = 127;
+var SMALL_ORDER = [
+  "00".repeat(32),
+  `01${"00".repeat(31)}`,
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+  `ec${"ff".repeat(30)}7f`,
+  `ed${"ff".repeat(30)}7f`,
+  `ee${"ff".repeat(30)}7f`
+];
 async function signingKeyFromSeed(seed) {
   if (seed.length !== SEED_BYTES) {
     throw new Error(`an ed25519 seed is ${SEED_BYTES} bytes`);
@@ -729,24 +844,27 @@ async function signingKeyFromSeed(seed) {
   const wrapped = new Uint8Array(PKCS8_HEADER.length + SEED_BYTES);
   wrapped.set(PKCS8_HEADER);
   wrapped.set(seed, PKCS8_HEADER.length);
-  const key = await crypto.subtle.importKey("pkcs8", asBuffer(wrapped), ALGORITHM, true, ["sign"]);
+  const key = await crypto.subtle.importKey("pkcs8", asBuffer2(wrapped), ALGORITHM, true, ["sign"]);
   const jwk = await crypto.subtle.exportKey("jwk", key);
   return {
     publicKeyHex: bytesToHex(fromBase64Url2(jwk.x ?? "")),
-    sign: async (payload) => bytesToHex(new Uint8Array(await crypto.subtle.sign(ALGORITHM, key, asBuffer(payload))))
+    sign: async (payload) => bytesToHex(new Uint8Array(await crypto.subtle.sign(ALGORITHM, key, asBuffer2(payload))))
   };
 }
 async function verifyHex(publicKeyHex, signatureHex, payload) {
   if (!isHex(publicKeyHex) || publicKeyHex.length !== PUBLIC_KEY_BYTES * 2) {
     return false;
   }
+  if (hasSmallOrder(publicKeyHex)) {
+    return false;
+  }
   if (!isHex(signatureHex) || signatureHex.length !== SIGNATURE_BYTES * 2) {
     return false;
   }
   try {
     const key = await crypto.subtle.importKey(
       "raw",
-      asBuffer(hexToBytes(publicKeyHex)),
+      asBuffer2(hexToBytes(publicKeyHex)),
       ALGORITHM,
       false,
       ["verify"]
@@ -754,13 +872,18 @@ async function verifyHex(publicKeyHex, signatureHex, payload) {
     return await crypto.subtle.verify(
       ALGORITHM,
       key,
-      asBuffer(hexToBytes(signatureHex)),
-      asBuffer(payload)
+      asBuffer2(hexToBytes(signatureHex)),
+      asBuffer2(payload)
     );
   } catch {
     return false;
   }
 }
+function hasSmallOrder(publicKeyHex) {
+  const point = hexToBytes(publicKeyHex);
+  point[PUBLIC_KEY_BYTES - 1] = point[PUBLIC_KEY_BYTES - 1] & SIGN_BIT_CLEARED;
+  return SMALL_ORDER.includes(bytesToHex(point));
+}
 function fromBase64Url2(text3) {
   const padded = text3.replace(/-/g, "+").replace(/_/g, "/");
   const raw = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
@@ -770,35 +893,8 @@ function fromBase64Url2(text3) {
   }
   return bytes;
 }
-function asBuffer(bytes) {
-  return bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
-}
-
-// ../core/hmac.ts
-async function hmacHex(secret, payload) {
-  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
-  const key = await crypto.subtle.importKey(
-    "raw",
-    asBuffer2(raw),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
-  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer2(message))));
-}
-function equalInConstantTime(one, other) {
-  if (one.length !== other.length) {
-    return false;
-  }
-  let difference = 0;
-  for (let at = 0; at < one.length; at++) {
-    difference |= one.charCodeAt(at) ^ other.charCodeAt(at);
-  }
-  return difference === 0;
-}
 function asBuffer2(bytes) {
-  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+  return bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
 }
 
 // ../core/caller.ts
@@ -876,8 +972,8 @@ function ipv4IsGlobal(literal) {
   if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
     return false;
   }
-  const [a, b] = parts;
-  if (a === 0 || a === 10 || a === 127 || a >= 240) {
+  const [a, b, c] = parts;
+  if (a === 0 || a === 10 || a === 127 || a >= 224) {
     return false;
   }
   if (a === 100 && b >= 64 && b < 128) {
@@ -889,7 +985,13 @@ function ipv4IsGlobal(literal) {
   if (a === 172 && b >= 16 && b < 32) {
     return false;
   }
-  if (a === 192 && b === 168) {
+  if (a === 192 && (b === 168 || b === 0 && (c === 0 || c === 2))) {
+    return false;
+  }
+  if (a === 198 && (b === 18 || b === 19 || b === 51 && c === 100)) {
+    return false;
+  }
+  if (a === 203 && b === 0 && c === 113) {
     return false;
   }
   return true;
@@ -899,29 +1001,59 @@ function ipv6IsGlobal(literal) {
   if (groups.length !== 8 || groups.some(Number.isNaN)) {
     return false;
   }
-  const leading = groups.slice(0, 5).every((group) => group === 0);
-  if (leading && groups[5] === 0 && groups[6] === 0 && groups[7] <= 1) {
+  const [first, second, third, fourth, fifth, sixth, high, low] = groups;
+  const embedded = (one, other) => ipv4IsGlobal(`${one >> 8}.${one & 255}.${other >> 8}.${other & 255}`);
+  const zeroBefore = (count) => groups.slice(0, count).every((group) => group === 0);
+  if (zeroBefore(5) && sixth === 65535) {
+    return embedded(high, low);
+  }
+  if (zeroBefore(6) || zeroBefore(4) && fifth === 65535 && sixth === 0) {
+    return false;
+  }
+  if (first === 100 && second === 65435) {
+    return third === 0 && fourth === 0 && fifth === 0 && sixth === 0 && embedded(high, low);
+  }
+  if (first === 8194) {
+    return embedded(second, third);
+  }
+  if (first === 8193 && second === 0) {
     return false;
   }
-  if (leading && groups[5] === 65535) {
-    const [high, low] = [groups[6], groups[7]];
-    return ipv4IsGlobal(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+  if (first === 256 && second === 0 && third === 0 && fourth === 0) {
+    return false;
   }
-  const first = groups[0];
-  if ((first & 65024) === 64512) {
+  if ((first & 65024) === 64512 || (first & 65280) === 65280) {
     return false;
   }
-  if ((first & 65472) === 65152) {
+  if ((first & 65472) === 65152 || (first & 65472) === 65216) {
     return false;
   }
   return true;
 }
 function ipv6Groups(address) {
-  const [head = "", tail] = address.split("::");
+  const halves = withDottedTailAsGroups(address).split("::");
+  const [head = "", tail] = halves;
   const left = head.split(":").filter((group) => group !== "");
   const right = (tail ?? "").split(":").filter((group) => group !== "");
-  const gap = tail === void 0 ? [] : Array(8 - left.length - right.length).fill("0");
-  return [...left, ...gap, ...right].map((group) => parseInt(group, 16));
+  const missing = 8 - left.length - right.length;
+  if (halves.length > 2 || missing < 0) {
+    return [Number.NaN];
+  }
+  const gap = tail === void 0 ? [] : Array(missing).fill("0");
+  return [...left, ...gap, ...right].map(
+    (group) => /^[0-9a-f]{1,4}$/.test(group) ? parseInt(group, 16) : Number.NaN
+  );
+}
+function withDottedTailAsGroups(address) {
+  const dotted = /^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(address);
+  if (dotted === null) {
+    return address;
+  }
+  const [a, b, c, d] = dotted[2].split(".").map(Number);
+  if ([a, b, c, d].some((part) => part > 255)) {
+    return `${dotted[1]}x`;
+  }
+  return `${dotted[1]}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
 }
 
 // ../core/outbound.ts
@@ -949,6 +1081,9 @@ async function ask(send, url, sent = {}) {
     }
     await response.body?.cancel();
     const next = new URL(location, target).toString();
+    if (sent.staysOnOrigin && !sameOrigin(target, next)) {
+      throw new Error(`${target} redirected off its own origin, to ${next}`);
+    }
     carried = KEEPS_THE_METHOD.includes(response.status) ? carried : withoutBody(carried);
     carried = sameOrigin(target, next) ? carried : withoutCredentials(carried);
     target = next;
@@ -995,15 +1130,17 @@ async function answerOf(response) {
   return { status, ok, body: text(read), truncated: true, headers };
 }
 function withoutBody(sent) {
-  const headers = { ...sent.headers };
-  delete headers["content-type"];
+  const headers = Object.fromEntries(
+    Object.entries(sent.headers ?? {}).filter(([name]) => name.toLowerCase() !== "content-type")
+  );
   return { ...sent, method: "GET", headers, body: void 0 };
 }
 function withoutCredentials(sent) {
-  const headers = { ...sent.headers };
-  for (const named of CREDENTIALS) {
-    delete headers[named];
-  }
+  const headers = Object.fromEntries(
+    Object.entries(sent.headers ?? {}).filter(
+      ([name]) => !CREDENTIALS.includes(name.toLowerCase())
+    )
+  );
   return { ...sent, headers };
 }
 function text(chunks) {
@@ -1046,6 +1183,22 @@ async function resolve(send, addresses, amountMsat) {
   );
   return served.won;
 }
+async function quote(send, addresses, amountMsat) {
+  const served = await firstThatServes(
+    addresses,
+    (address2, deadline) => probe(send, address2, amountMsat, deadline)
+  );
+  const { address, pay } = served.won;
+  return {
+    won: {
+      address,
+      minMsat: pay.minSendable,
+      maxMsat: pay.maxSendable,
+      metadata: pay.metadata
+    },
+    refusals: served.refusals
+  };
+}
 async function firstThatServes(addresses, attempt) {
   const deadline = AbortSignal.timeout(RESOLVE_TIMEOUT_MS);
   const refusals3 = [];
@@ -1138,7 +1291,7 @@ function decodeIssued(address, bolt11) {
   return { paymentHash, descriptionHash, amountMsat, expiresAt };
 }
 async function checkSettled(send, verifyUrl, paymentHash) {
-  const answer = await answeredJson(send, verifyUrl);
+  const answer = await answeredJson(send, verifyUrl, { staysOnOrigin: true });
   const asked = {
     pace: paceAskedFor(answer.headers),
     ceiling: ceilingAskedFor(answer.headers)
@@ -1196,10 +1349,10 @@ function isNothingButAHost(domain) {
   }
 }
 async function fetchJson(send, url, deadline) {
-  return (await answeredJson(send, url, deadline)).said;
+  return (await answeredJson(send, url, { deadline })).said;
 }
-async function answeredJson(send, url, deadline) {
-  const answer = await ask(send, url, { headers: { accept: "application/json" }, deadline });
+async function answeredJson(send, url, sent) {
+  const answer = await ask(send, url, { headers: { accept: "application/json" }, ...sent });
   if (!answer.ok) {
     throw new Error(`${url} answered ${answer.status}`);
   }
@@ -1227,12 +1380,17 @@ var pinnedToTheAddressWeVerified = async (url, sent, signal, at) => {
     }
     const call = request(reaching(asked, sent, at, first), (answer) => {
       const status = answer.statusCode ?? 502;
-      settle(
-        new Response(
-          CARRIES_NO_BODY.includes(status) ? null : Readable.toWeb(answer),
-          { status, headers: headersOf(answer.headers) }
-        )
-      );
+      try {
+        settle(
+          new Response(
+            CARRIES_NO_BODY.includes(status) ? null : Readable.toWeb(answer),
+            { status, headers: headersOf(answer.headers) }
+          )
+        );
+      } catch (unreadable) {
+        answer.destroy();
+        fail(new Error(`${url} answered with something HTTP cannot carry`, { cause: unreadable }));
+      }
     });
     const give = () => call.destroy(new Error(`${url} took longer than allowed`));
     signal.addEventListener("abort", give, { once: true });
@@ -1279,6 +1437,173 @@ function headersOf(raw) {
   return headers;
 }
 
+// src/verify.ts
+var HTTP_TIMEOUT_MS2 = 15e3;
+var ISSUED_SKEW_SECS = 300;
+var NAMES_AN_ADDRESS = ["text/identifier", "text/email"];
+var DEFAULT_WRAP_PROPORTION = 0.01;
+var DEFAULT_WRAP_BASE_MSAT = 1e3;
+async function proveOrigin(payment, asked, askedAt) {
+  const cheat = (code) => new GatewayCheatError(code, payment.id);
+  const listed2 = asked.paidTo.find((address) => equalIgnoringCase(address, payment.lnAddress));
+  if (listed2 === void 0) {
+    throw cheat("address_not_requested");
+  }
+  if (payment.amountMsat !== asked.amountMsat) {
+    throw cheat("amount_mismatch");
+  }
+  const invoice = decodeInvoice(payment.bolt11);
+  if (invoice.paymentHash === null || !equalIgnoringCase(invoice.paymentHash, payment.paymentHash)) {
+    throw cheat("hash_mismatch");
+  }
+  if (invoice.amountMsat !== asked.amountMsat) {
+    throw cheat("amount_mismatch");
+  }
+  if (askedAt !== void 0 && (invoice.issuedAt ?? 0) < askedAt - ISSUED_SKEW_SECS) {
+    throw cheat("invoice_stale");
+  }
+  const payRequest = await payRequestFor(listed2, payment);
+  if (typeof payRequest.metadata !== "string" || typeof payRequest.callback !== "string") {
+    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "no payRequest served");
+  }
+  if (!namesTheAddress(payRequest.metadata, listed2)) {
+    throw new UnverifiedRecipientError(
+      payment.lnAddress,
+      payment.id,
+      "its metadata names no text/identifier for this address, so no invoice binds to it"
+    );
+  }
+  if (invoice.descriptionHash !== sha256Hex(payRequest.metadata)) {
+    throw cheat("description_hash_mismatch");
+  }
+  if (!sameOrigin(payment.verifyUrl, payRequest.callback)) {
+    throw cheat("verify_url_foreign");
+  }
+  const issued = await reachable(payment.verifyUrl, payment);
+  if (typeof issued.pr !== "string" || !equalIgnoringCase(issued.pr, payment.bolt11)) {
+    throw cheat("invoice_not_issued");
+  }
+  if (askedAt !== void 0 && issued.settled === true) {
+    throw cheat("invoice_settled");
+  }
+}
+function namesTheAddress(metadata, address) {
+  try {
+    const entries = JSON.parse(metadata);
+    return Array.isArray(entries) && entries.some(
+      (entry) => Array.isArray(entry) && NAMES_AN_ADDRESS.includes(entry[0]) && typeof entry[1] === "string" && equalIgnoringCase(entry[1], address)
+    );
+  } catch {
+    return false;
+  }
+}
+async function proveSettlement(payment, asked) {
+  await proveOrigin(payment, asked);
+  const verified = await reachable(payment.verifyUrl, payment);
+  if (verified.settled !== true || typeof verified.preimage !== "string") {
+    return null;
+  }
+  if (!preimageMatchesHash(verified.preimage, payment.paymentHash)) {
+    throw new GatewayCheatError("preimage_mismatch", payment.id);
+  }
+  return verified.preimage;
+}
+function carriesProof(report) {
+  if (report.status !== "paid" || report.preimage === null) {
+    return false;
+  }
+  if (report.bolt11 !== void 0 && report.bolt11 !== null) {
+    const invoiceHash = decodeInvoice(report.bolt11).paymentHash;
+    if (invoiceHash === null || !equalIgnoringCase(invoiceHash, report.paymentHash)) {
+      return false;
+    }
+  }
+  return preimageMatchesHash(report.preimage, report.paymentHash);
+}
+function wrapFeeCeiling(amountMsat, allowance) {
+  const proportional = amountMsat * (allowance?.proportion ?? DEFAULT_WRAP_PROPORTION);
+  return msat(Math.max(allowance?.baseMsat ?? DEFAULT_WRAP_BASE_MSAT, Math.floor(proportional)));
+}
+function proveWrapped(wrapped, recipient, allowance) {
+  const offered = decodeInvoice(wrapped);
+  const owed = decodeInvoice(recipient);
+  const refuse2 = (code, detail) => {
+    throw new WrapRefusedError(code, detail);
+  };
+  if (offered.paymentHash === null || offered.amountMsat === null || offered.expiresAt === null) {
+    refuse2("undecodable", "the wrapped invoice carries no hash, amount or expiry");
+  }
+  if (owed.paymentHash === null || owed.amountMsat === null || owed.expiresAt === null) {
+    refuse2("undecodable", "the recipient's invoice carries no hash, amount or expiry");
+  }
+  if (offered.paymentHash?.toLowerCase() !== owed.paymentHash?.toLowerCase()) {
+    refuse2("hash_mismatch", "settling the wrap would not settle the recipient");
+  }
+  const asked = offered.amountMsat ?? 0;
+  const due = owed.amountMsat ?? 0;
+  if (asked < due) {
+    refuse2("amount_below_recipient", `${asked} msat cannot forward ${due} msat`);
+  }
+  const ceiling = wrapFeeCeiling(due, allowance);
+  if (asked - due > ceiling) {
+    refuse2("fee_above_allowance", `${asked - due} msat over ${due}, and ${ceiling} was allowed`);
+  }
+  if ((owed.expiresAt ?? 0) <= (offered.expiresAt ?? 0)) {
+    refuse2("recipient_expires_first", "the operator could be paid and find it cannot deliver");
+  }
+}
+async function payRequestFor(listed2, payment) {
+  const at = listed2.indexOf("@");
+  const name = listed2.slice(0, at);
+  const domain = listed2.slice(at + 1).toLowerCase();
+  if (at < 1 || !publicHttps(`https://${domain}/`)) {
+    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "not a usable address");
+  }
+  return reachable(`https://${domain}/.well-known/lnurlp/${name}`, payment);
+}
+async function reachable(url, payment) {
+  try {
+    if (!publicHttps(url)) {
+      throw new Error(`${url} is not a public https URL`);
+    }
+    const response = await fetch(url, {
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2),
+      headers: { accept: "application/json" }
+    });
+    if (response.redirected && !sameOrigin(response.url, url)) {
+      throw new Error(`redirected off its own origin, to ${response.url}`);
+    }
+    if (!response.ok) {
+      throw new Error(`answered ${response.status}`);
+    }
+    const body = JSON.parse(await boundedText(response));
+    if (body === null || typeof body !== "object") {
+      throw new Error("answered with no JSON object");
+    }
+    return body;
+  } catch (cause) {
+    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, cause);
+  }
+}
+async function boundedText(response) {
+  const reader = response.body?.getReader();
+  const decoder = new TextDecoder();
+  let text3 = "";
+  let bytes = 0;
+  for (let chunk = await reader?.read(); chunk && !chunk.done; chunk = await reader?.read()) {
+    bytes += chunk.value.length;
+    if (bytes > BODY_LIMIT_BYTES) {
+      await reader?.cancel();
+      throw new Error(`answered with more than the ${BODY_LIMIT_BYTES} bytes a proof reads`);
+    }
+    text3 += decoder.decode(chunk.value, { stream: true });
+  }
+  return text3 + decoder.decode();
+}
+function equalIgnoringCase(one, other) {
+  return one.toLowerCase() === other.toLowerCase();
+}
+
 // src/wire.ts
 var ASSET_CODE = "BTC";
 var ASSET_SCALE = 11;
@@ -1484,11 +1809,11 @@ var CHALLENGE = "webhook-challenge";
 var VERIFY_CHALLENGE = "verify-challenge";
 async function readPayment(request, credential, options = {}) {
   const body = await believable(request, credential, options);
-  return body === null ? null : decoded(body, paymentFromWire);
+  return body === null ? null : proved(decoded(body, paymentFromWire));
 }
 async function readSettlement(request, credential, options = {}) {
   const body = await believable(request, credential, options);
-  return body === null ? null : decoded(body, settlementFromWire);
+  return body === null ? null : proved(decoded(body, settlementFromWire));
 }
 async function answerWebhookChallenge(request, credential, options = {}) {
   const body = await believable(request, credential, options);
@@ -1522,6 +1847,9 @@ async function believable(request, credential, options) {
   );
   return signed ? body : null;
 }
+function proved(read) {
+  return read !== null && read.status === "paid" && !carriesProof(read) ? null : read;
+}
 function decoded(body, from) {
   try {
     return from(JSON.parse(body));
@@ -1562,30 +1890,39 @@ var DEFAULT_LOOK_BACK_SECS = 7 * 24 * 60 * 60;
 var DEFAULT_POLL_EVERY_SECS = 30;
 var IBAN = /^[A-Z]{2}[0-9]{2}[0-9A-Z]{8,30}$/;
 var FORBIDDEN_IN_SPD = "*";
+var MAX_REFERENCE_CHARS = 60;
 async function bankTransfer(gateway, params) {
   const currency = params.currency ?? DEFAULT_CURRENCY;
-  refuseUnusable(params, currency);
+  const iban = accountOf(params.iban);
+  refuseUnusable(params, iban, currency);
   await refuseAnOpenGateway(gateway, params);
-  const spd = shortPaymentDescriptor(params, currency);
-  const subject = subjectOf(params.reference, params.amountMinor, currency);
-  const polling = new URL(params.verifyUrl);
-  polling.searchParams.set("ref", params.reference);
-  polling.searchParams.set("minor", String(params.amountMinor));
-  polling.searchParams.set("cc", currency);
-  polling.searchParams.set("sig", await hmacHex(params.secret, `verify|${subject}`));
-  const verifyUrl = polling.toString();
+  const spd = shortPaymentDescriptor(params, iban, currency);
+  const subject = subjectOf({
+    iban,
+    amountMinor: params.amountMinor,
+    currency,
+    expiresAt: params.expiresAt,
+    reference: params.reference
+  });
+  const verifyUrl = await answeredAt(params, subject);
+  const paymentHash = hashOf(await hmacHex(params.secret, `preimage|${subject}`));
   const watched = await gateway.watch({
-    paymentHash: hashOf(await hmacHex(params.secret, `preimage|${subject}`)),
+    paymentHash,
     verifyUrl,
     expiresAt: params.expiresAt,
     trigger: params.trigger,
     replay: params.replay,
-    sealed: params.sealed,
+    sealed: params.sealed ? await seal(params.sealed.secret, JSON.stringify(params.sealed.data), paymentHash) : void 0,
     webhookUrl: params.webhookUrl
   });
-  return { id: watched.id, paymentHash: watched.paymentHash, verifyUrl, spd };
+  return { id: watched.id, paymentHash, verifyUrl, spd };
 }
 function bankVerifyEndpoint(config) {
+  refuseAWeakSecret(config.secret);
+  const answersFor = accountOf(config.iban);
+  if (!IBAN.test(answersFor)) {
+    throw new Error(`${config.iban} is not an IBAN, so this endpoint answers for no account`);
+  }
   const paced = {
     "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS}`
   };
@@ -1594,51 +1931,79 @@ function bankVerifyEndpoint(config) {
     if (consented !== null) {
       return consented;
     }
-    const asked = readQuery(new URL(request.url));
-    if (asked === null) {
+    const sealed = new URL(request.url).searchParams.get("q");
+    if (sealed === null) {
       return Response.json({ settled: false }, { status: 400 });
     }
-    const subject = subjectOf(asked.reference, asked.amountMinor, asked.currency);
-    const expected = await hmacHex(config.secret, `verify|${subject}`);
-    if (!equalInConstantTime(asked.signature, expected)) {
+    const subject = await unseal(config.secret, sealed);
+    const asked = subject === null ? null : askedFrom(subject);
+    if (asked === null || asked.iban !== answersFor) {
       return Response.json({ settled: false }, { status: 403 });
     }
-    const since = unixNow() - (config.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
-    const landed = (await config.statement(since)).some((credit) => pays(credit, asked));
-    if (!landed) {
-      return Response.json({ settled: false }, { headers: paced });
-    }
-    return Response.json(
-      { settled: true, preimage: await hmacHex(config.secret, `preimage|${subject}`) },
-      { headers: paced }
-    );
+    const preimage = await creditedPreimage({
+      secret: config.secret,
+      asked,
+      statement: config.statement,
+      lookBackSecs: config.lookBackSecs
+    });
+    return preimage === null ? Response.json({ settled: false }, { headers: paced }) : Response.json({ settled: true, preimage }, { headers: paced });
   };
 }
-function readQuery(url) {
-  const reference = url.searchParams.get("ref");
-  const minor = Number(url.searchParams.get("minor"));
-  const currency = url.searchParams.get("cc");
-  const signature = url.searchParams.get("sig");
-  if (!reference || !currency || !signature) {
+async function answeredAt(params, subject) {
+  if (params.answerBy === "agent") {
+    return `agent:${(await callerKey(params.secret)).publicKeyHex}`;
+  }
+  const polling = new URL(params.verifyUrl ?? "");
+  polling.searchParams.set("q", await sealStable(params.secret, subject));
+  return polling.toString();
+}
+async function creditedPreimage(params) {
+  const since = unixNow() - (params.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
+  const landed = (await params.statement(since)).some((credit) => pays(credit, params.asked));
+  if (!landed) {
     return null;
   }
-  if (!Number.isInteger(minor) || minor <= 0) {
+  return await hmacHex(params.secret, `preimage|${subjectOf(params.asked)}`);
+}
+function askedFrom(subject) {
+  const [iban, minorText, currency, expiresText, ...rest] = subject.split("|");
+  const reference = rest.join("|");
+  const amountMinor = Number(minorText);
+  const expiresAt = Number(expiresText);
+  if (!iban || !currency || reference.length === 0) {
     return null;
   }
-  return { reference, amountMinor: minor, currency, signature };
+  if (!Number.isInteger(amountMinor) || amountMinor <= 0 || !Number.isSafeInteger(expiresAt)) {
+    return null;
+  }
+  return { iban, reference, amountMinor, currency, expiresAt };
 }
 function pays(credit, asked) {
-  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && credit.reference.toUpperCase().includes(asked.reference.toUpperCase());
+  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && namesOnly(credit.reference, asked.reference);
+}
+function namesOnly(written, reference) {
+  const wanted = reference.toUpperCase();
+  const alike = [...written.toUpperCase().matchAll(wordsShapedLike(wanted))].map(([word]) => word);
+  return alike.includes(wanted) && (!/\d/.test(wanted) || alike.every((word) => word === wanted));
 }
-function subjectOf(reference, amountMinor, currency) {
-  return `${reference}|${amountMinor}|${currency.toUpperCase()}`;
+function wordsShapedLike(reference) {
+  const shape = [...reference].map((char) => {
+    if (/\d/.test(char)) {
+      return "\\d";
+    }
+    return /\p{L}/u.test(char) ? "\\p{L}" : char.replace(/[\^$\\.*+?()[\]{}|/]/g, "\\$&");
+  }).join("");
+  return new RegExp(`(?<![\\p{L}\\p{N}])${shape}(?![\\p{L}\\p{N}])`, "gu");
+}
+function subjectOf({ iban, amountMinor, currency, expiresAt, reference }) {
+  return `${iban}|${amountMinor}|${currency.toUpperCase()}|${expiresAt}|${reference}`;
 }
 function hashOf(preimage) {
   return bytesToHex(sha256(hexToBytes(preimage)));
 }
-function shortPaymentDescriptor(params, currency) {
+function shortPaymentDescriptor(params, iban, currency) {
   const fields = [
-    `ACC:${params.iban}`,
+    `ACC:${iban}`,
     `AM:${major(params.amountMinor, currency)}`,
     `CC:${currency.toUpperCase()}`,
     `MSG:${params.reference}`
@@ -1659,19 +2024,28 @@ async function refuseAnOpenGateway(gateway, params) {
     return;
   }
   throw new Error(
-    "this gateway serves callers with no token, so it is not yours, and its operator would read the amount and the reference off every verify URL. Point at one that answers 401 to a stranger, or say allowPublicGateway"
+    "this gateway serves callers with no token, so it is not yours, and its operator would learn every watch you place. Point at one that answers 401 to a stranger, or say allowPublicGateway"
   );
 }
-function refuseUnusable(params, currency) {
-  if (!IBAN.test(params.iban)) {
+function refuseUnusable(params, iban, currency) {
+  refuseAWeakSecret(params.secret);
+  if (params.answerBy !== "agent" && params.verifyUrl === void 0) {
+    throw new Error("a transfer the gateway polls needs the verify url it is polled at");
+  }
+  if (!IBAN.test(iban)) {
     throw new Error(`${params.iban} is not an IBAN`);
   }
-  if (!Number.isInteger(params.amountMinor) || params.amountMinor <= 0) {
+  if (!Number.isSafeInteger(params.amountMinor) || params.amountMinor <= 0) {
     throw new Error("amountMinor must be a whole number of minor units above zero");
   }
   if (params.reference.length === 0) {
     throw new Error("a transfer with no reference cannot be found");
   }
+  if (params.reference.length > MAX_REFERENCE_CHARS) {
+    throw new Error(
+      `a reference is at most ${MAX_REFERENCE_CHARS} characters, as many as a QR payment's message carries and its sealed query hides`
+    );
+  }
   if (params.reference.includes(FORBIDDEN_IN_SPD)) {
     throw new Error("a reference cannot contain an asterisk, it separates the QR fields");
   }
@@ -1679,6 +2053,9 @@ function refuseUnusable(params, currency) {
     throw new Error("a variable symbol is up to ten digits");
   }
 }
+function accountOf(iban) {
+  return iban.replace(/\s+/g, "").toUpperCase();
+}
 function unixNow() {
   return Math.floor(Date.now() / 1e3);
 }
@@ -1742,10 +2119,10 @@ function lightningVerifyEndpoint(config) {
       return Response.json({ settled: false }, { status: 400 });
     }
     const opened = await unseal(config.secret, sealed);
-    if (opened === null) {
+    const wallet = opened === null ? null : relayedFrom(opened);
+    if (wallet === null) {
       return Response.json({ settled: false }, { status: 403 });
     }
-    const wallet = JSON.parse(opened);
     const asked = await checkSettled(
       config.send ?? pinnedToTheAddressWeVerified,
       wallet.url,
@@ -1760,6 +2137,14 @@ function lightningVerifyEndpoint(config) {
     );
   };
 }
+function relayedFrom(opened) {
+  try {
+    const said = JSON.parse(opened);
+    return typeof said?.url === "string" && typeof said.hash === "string" ? { url: said.url, hash: said.hash } : null;
+  } catch {
+    return null;
+  }
+}
 async function relayedVerifyUrl(endpoint, wallet, secret) {
   const relayed = new URL(endpoint);
   relayed.searchParams.set(WALLET, await seal(secret, JSON.stringify(wallet)));
@@ -1782,13 +2167,14 @@ function bankRail(gateway, config) {
       expiresAt,
       trigger: config.trigger,
       replay: config.replay,
-      sealed: await config.sealed?.(order),
+      sealed: config.sealed && { secret: config.sealed.secret, data: config.sealed.data(order) },
       variableSymbol: config.variableSymbol?.(order),
       webhookUrl: config.webhookUrl,
       allowPublicGateway: config.allowPublicGateway
     });
     return {
       id: transfer.id,
+      paymentHash: transfer.paymentHash,
       rail: config.name ?? BANK,
       scan: transfer.spd,
       qr: transfer.spd,
@@ -1812,6 +2198,7 @@ function lightningRail(gateway, config) {
     );
     return {
       id: payment.id,
+      paymentHash: payment.paymentHash,
       rail: config.name ?? LIGHTNING,
       scan: payment.bolt11,
       qr: toLightningUri(payment.bolt11),
@@ -1837,11 +2224,16 @@ function blindLightningRail(gateway, config) {
       expiresAt: resolved2.expiresAt,
       trigger: config.trigger,
       replay: config.replay,
-      sealed: await config.sealed?.(order),
+      sealed: config.sealed ? await seal(
+        config.sealed.secret,
+        JSON.stringify(config.sealed.data(order)),
+        resolved2.paymentHash
+      ) : void 0,
       webhookUrl: config.webhookUrl
     });
     return {
       id: watched.id,
+      paymentHash: resolved2.paymentHash,
       rail: config.name ?? LIGHTNING,
       scan: resolved2.bolt11,
       qr: toLightningUri(resolved2.bolt11),
@@ -1895,130 +2287,6 @@ var Rails = class {
   }
 };
 
-// src/verify.ts
-var HTTP_TIMEOUT_MS2 = 15e3;
-var DEFAULT_WRAP_PROPORTION = 0.01;
-var DEFAULT_WRAP_BASE_MSAT = 1e3;
-async function proveOrigin(payment, asked) {
-  const cheat = (code) => new GatewayCheatError(code, payment.id);
-  const listed = asked.paidTo.find((address) => equalIgnoringCase(address, payment.lnAddress));
-  if (listed === void 0) {
-    throw cheat("address_not_requested");
-  }
-  if (payment.amountMsat !== asked.amountMsat) {
-    throw cheat("amount_mismatch");
-  }
-  const invoice = decodeInvoice(payment.bolt11);
-  if (invoice.paymentHash === null || !equalIgnoringCase(invoice.paymentHash, payment.paymentHash)) {
-    throw cheat("hash_mismatch");
-  }
-  if (invoice.amountMsat !== asked.amountMsat) {
-    throw cheat("amount_mismatch");
-  }
-  const payRequest = await payRequestFor(listed, payment);
-  if (typeof payRequest.metadata !== "string" || typeof payRequest.callback !== "string") {
-    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "no payRequest served");
-  }
-  if (invoice.descriptionHash !== sha256Hex(payRequest.metadata)) {
-    throw cheat("description_hash_mismatch");
-  }
-  if (!sameOrigin(payment.verifyUrl, payRequest.callback)) {
-    throw cheat("verify_url_foreign");
-  }
-  const issued = await reachable(payment.verifyUrl, payment);
-  if (typeof issued.pr !== "string" || !equalIgnoringCase(issued.pr, payment.bolt11)) {
-    throw cheat("invoice_not_issued");
-  }
-}
-async function proveSettlement(payment, asked) {
-  await proveOrigin(payment, asked);
-  const verified = await reachable(payment.verifyUrl, payment);
-  if (verified.settled !== true || typeof verified.preimage !== "string") {
-    return null;
-  }
-  if (!preimageMatchesHash(verified.preimage, payment.paymentHash)) {
-    throw new GatewayCheatError("preimage_mismatch", payment.id);
-  }
-  return verified.preimage;
-}
-function carriesProof(report) {
-  if (report.status !== "paid" || report.preimage === null) {
-    return false;
-  }
-  if (report.bolt11 !== void 0 && report.bolt11 !== null) {
-    const invoiceHash = decodeInvoice(report.bolt11).paymentHash;
-    if (invoiceHash === null || !equalIgnoringCase(invoiceHash, report.paymentHash)) {
-      return false;
-    }
-  }
-  return preimageMatchesHash(report.preimage, report.paymentHash);
-}
-function wrapFeeCeiling(amountMsat, allowance) {
-  const proportional = amountMsat * (allowance?.proportion ?? DEFAULT_WRAP_PROPORTION);
-  return msat(Math.max(allowance?.baseMsat ?? DEFAULT_WRAP_BASE_MSAT, Math.floor(proportional)));
-}
-function proveWrapped(wrapped, recipient, allowance) {
-  const offered = decodeInvoice(wrapped);
-  const owed = decodeInvoice(recipient);
-  const refuse2 = (code, detail) => {
-    throw new WrapRefusedError(code, detail);
-  };
-  if (offered.paymentHash === null || offered.amountMsat === null || offered.expiresAt === null) {
-    refuse2("undecodable", "the wrapped invoice carries no hash, amount or expiry");
-  }
-  if (owed.paymentHash === null || owed.amountMsat === null || owed.expiresAt === null) {
-    refuse2("undecodable", "the recipient's invoice carries no hash, amount or expiry");
-  }
-  if (offered.paymentHash?.toLowerCase() !== owed.paymentHash?.toLowerCase()) {
-    refuse2("hash_mismatch", "settling the wrap would not settle the recipient");
-  }
-  const asked = offered.amountMsat ?? 0;
-  const due = owed.amountMsat ?? 0;
-  if (asked < due) {
-    refuse2("amount_below_recipient", `${asked} msat cannot forward ${due} msat`);
-  }
-  const ceiling = wrapFeeCeiling(due, allowance);
-  if (asked - due > ceiling) {
-    refuse2("fee_above_allowance", `${asked - due} msat over ${due}, and ${ceiling} was allowed`);
-  }
-  if ((owed.expiresAt ?? 0) <= (offered.expiresAt ?? 0)) {
-    refuse2("recipient_expires_first", "the operator could be paid and find it cannot deliver");
-  }
-}
-async function payRequestFor(listed, payment) {
-  const at = listed.indexOf("@");
-  const name = listed.slice(0, at);
-  const domain = listed.slice(at + 1).toLowerCase();
-  if (at < 1 || !publicHttps(`https://${domain}/`)) {
-    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "not a usable address");
-  }
-  return reachable(`https://${domain}/.well-known/lnurlp/${name}`, payment);
-}
-async function reachable(url, payment) {
-  try {
-    if (!publicHttps(url)) {
-      throw new Error(`${url} is not a public https URL`);
-    }
-    const response = await fetch(url, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2),
-      headers: { accept: "application/json" }
-    });
-    if (!response.ok) {
-      throw new Error(`answered ${response.status}`);
-    }
-    const body = await response.json();
-    if (body === null || typeof body !== "object") {
-      throw new Error("answered with no JSON object");
-    }
-    return body;
-  } catch (cause) {
-    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, cause);
-  }
-}
-function equalIgnoringCase(one, other) {
-  return one.toLowerCase() === other.toLowerCase();
-}
-
 // src/request.ts
 function paymentRequestOf(gateway, payment, options) {
   return {
@@ -2030,13 +2298,13 @@ function paymentRequestOf(gateway, payment, options) {
     expiresAt: payment.expiresAt,
     qr: invoiceToSvg(payment.bolt11, options?.qr),
     payment,
-    paid: async (waiting) => paidOnly(await gateway.settled(payment.id, { ...waitingOf(options), ...waiting })),
+    paid: async (waiting) => paidOnly(await gateway.settled(payment, { ...waitingOf(options), ...waiting })),
     prove: () => proveSettlement(payment, { paidTo: [payment.lnAddress], amountMsat: payment.amountMsat }),
     onPaid: (arrived, failed) => {
       const stop = new AbortController();
       const waiting = waitingOf(options);
       const signal = waiting.signal ? AbortSignal.any([stop.signal, waiting.signal]) : stop.signal;
-      gateway.settled(payment.id, { ...waiting, signal }).then((ended) => arrived(paidOnly(ended))).catch((reason) => {
+      gateway.settled(payment, { ...waiting, signal }).then((ended) => arrived(paidOnly(ended))).catch((reason) => {
         if (!stop.signal.aborted) {
           failed?.(reason);
         }
@@ -2085,22 +2353,37 @@ function publicWatchTicketEndpoint(gateway, config) {
 }
 async function offer(gateway, config, url) {
   const { least, most } = await spread(config.amount);
-  const quote = await gateway.quote({ paidTo: config.paidTo, amount: msat(least) });
+  const winner = await quoted(gateway, config, least);
   const nonce = randomNonce();
   const callback = new URL(config.baseUrl ?? `${url.origin}${url.pathname}`);
-  callback.searchParams.set("to", quote.lnAddress);
+  callback.searchParams.set("to", winner.address);
   callback.searchParams.set("least", String(least));
   callback.searchParams.set("most", String(most));
   callback.searchParams.set("n", nonce);
-  callback.searchParams.set("sig", await sign(config.secret, quote.lnAddress, least, most, nonce));
+  callback.searchParams.set("sig", await sign(config.secret, winner.address, least, most, nonce));
   return Response.json({
     tag: "payRequest",
     callback: callback.toString(),
-    metadata: quote.metadata,
+    metadata: winner.metadata,
     minSendable: least,
     maxSendable: most
   });
 }
+async function quoted(gateway, config, amountMsat) {
+  if (config.blind) {
+    const { won } = await quote(
+      config.send ?? pinnedToTheAddressWeVerified,
+      listed(config.paidTo),
+      amountMsat
+    );
+    return won;
+  }
+  const { lnAddress, metadata } = await gateway.quote({
+    paidTo: config.paidTo,
+    amount: msat(amountMsat)
+  });
+  return { address: lnAddress, metadata };
+}
 async function spread(amount) {
   if (typeof amount === "number" || typeof amount === "function") {
     const pinned = await amountNow(amount);
@@ -2122,6 +2405,9 @@ async function mint(gateway, config, url, address) {
   if (!equalInConstantTime(signature, expected)) {
     return refuse("this callback was not signed here");
   }
+  if (!listed(config.paidTo).some((one) => one.toLowerCase() === address.toLowerCase())) {
+    return refuse(`${address} is not paid through this trigger`);
+  }
   const asked = url.searchParams.get("amount");
   const amountMsat = asked === null ? least : Number(asked);
   if (!Number.isSafeInteger(amountMsat) || amountMsat < least || amountMsat > most) {
@@ -2164,7 +2450,7 @@ async function mintBlind(gateway, config, address, amountMsat) {
       expiresAt: resolved2.expiresAt,
       trigger: config.watchSecret,
       replay: config.replay,
-      sealed: locked ? await seal(locked.secret, JSON.stringify(locked.data(minted))) : void 0
+      sealed: locked ? await seal(locked.secret, JSON.stringify(locked.data(minted)), minted.paymentHash) : void 0
     });
   } catch (refused) {
     if (!alreadyWatched(refused)) {
@@ -2173,6 +2459,9 @@ async function mintBlind(gateway, config, address, amountMsat) {
   }
   return { bolt11: resolved2.bolt11, verifyUrl: resolved2.verifyUrl };
 }
+function listed(paidTo) {
+  return typeof paidTo === "string" ? [paidTo] : paidTo;
+}
 function alreadyWatched(refused) {
   return refused instanceof ProblemError && isProblemType(refused, PAYMENT_ALREADY_WATCHED);
 }
@@ -2312,6 +2601,21 @@ function backoffMs(firstDelay, attempt) {
   const grown = Math.min(firstDelay * 2 ** (attempt - 1), RECONNECT_CAP_MS);
   return Math.round(grown * (0.5 + Math.random() / 2));
 }
+function askFromWire(raw) {
+  let said;
+  try {
+    said = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof said !== "object" || said === null) {
+    return null;
+  }
+  const fields = said;
+  const ask2 = fields["ask"];
+  const paymentHash = fields["payment_hash"];
+  return typeof ask2 === "string" && typeof paymentHash === "string" ? { ask: ask2, paymentHash } : null;
+}
 function gatewayAt(baseUrl) {
   const at = URL.canParse(baseUrl) ? new URL(baseUrl) : null;
   if (at === null || at.protocol !== "http:" && at.protocol !== "https:") {
@@ -2321,8 +2625,8 @@ function gatewayAt(baseUrl) {
 }
 var ThunderBridge = class {
   baseUrl;
-  verify;
   token;
+  handedOut = /* @__PURE__ */ new Map();
   secret;
   strangers = null;
   speaks = null;
@@ -2333,7 +2637,6 @@ var ThunderBridge = class {
   rails;
   constructor(baseUrl, options) {
     this.baseUrl = gatewayAt(baseUrl);
-    this.verify = options?.verify ?? true;
     this.token = options?.token ?? null;
     this.secret = options?.secret ?? null;
     this.serve = new Serve(this);
@@ -2375,6 +2678,7 @@ var ThunderBridge = class {
    * and `GatewayCheatError` when what comes back is not what you asked for
    */
   async mint(charge, options) {
+    const askedAt = Math.floor(Date.now() / 1e3);
     const asked = await priced(charge);
     const sent = createRequestBody(
       asked,
@@ -2395,9 +2699,8 @@ var ThunderBridge = class {
       throw await problemFrom(response);
     }
     const payment = await mintedFrom(response);
-    if (this.verify) {
-      await proveOrigin(payment, asked);
-    }
+    await proveOrigin(payment, asked, askedAt);
+    this.handOut(payment, options?.idempotencyKey ?? null);
     return payment;
   }
   /**
@@ -2408,7 +2711,8 @@ var ThunderBridge = class {
    * it for one, and asking mints it
    */
   async quote(charge) {
-    const sent = quoteRequestBody(await priced(charge));
+    const asked = await priced(charge);
+    const sent = quoteRequestBody(asked);
     const response = await fetch(`${this.baseUrl}/quotes`, {
       method: "POST",
       headers: await this.sending("/quotes", sent),
@@ -2417,14 +2721,17 @@ var ThunderBridge = class {
     if (!response.ok) {
       throw await problemFrom(response);
     }
-    const quote = quoteFromWire(await response.json().catch(() => null));
-    if (quote === null) {
+    const quote2 = quoteFromWire(await response.json().catch(() => null));
+    if (quote2 === null) {
       throw new ProblemError({
         status: response.status,
         title: "The gateway answered with something that is not a quote"
       });
     }
-    return quote;
+    if (!asked.paidTo.some((address) => address.toLowerCase() === quote2.lnAddress.toLowerCase())) {
+      throw new GatewayCheatError("address_not_requested", "");
+    }
+    return quote2;
   }
   /**
    * The key this gateway signs webhooks with when you registered none of your own.
@@ -2457,8 +2764,8 @@ var ThunderBridge = class {
    * for both sorts: `kind` says whether the gateway minted it or was handed it,
    * and the address, amount and invoice are null on one it was never told
    */
-  async payment(id) {
-    const path = `/incoming-payments/${encodeURIComponent(id)}`;
+  async payment(held) {
+    const path = `/incoming-payments/${encodeURIComponent(held.id)}`;
     const response = await fetch(`${this.baseUrl}${path}`, {
       headers: await this.reading("GET", path)
     });
@@ -2468,7 +2775,7 @@ var ThunderBridge = class {
     if (!response.ok) {
       throw await problemFrom(response);
     }
-    return this.proven(await paymentFrom(response));
+    return this.proven(await paymentFrom(response), held);
   }
   /**
    * List what this gateway is watching, newest first. Only a gateway started
@@ -2488,14 +2795,14 @@ var ThunderBridge = class {
       throw await problemFrom(response);
     }
     const body = await response.json().catch(() => null);
-    const listed = Array.isArray(body?.payments) ? body.payments.map(paymentFromWire).filter((one) => one !== null) : null;
-    if (listed === null || typeof body?.settled_scanned !== "number") {
+    const listed2 = Array.isArray(body?.payments) ? body.payments.map(paymentFromWire).filter((one) => one !== null).filter((one) => one.status !== "paid" || carriesProof(one)) : null;
+    if (listed2 === null || typeof body?.settled_scanned !== "number") {
       throw new ProblemError({
         status: response.status,
         title: "The gateway answered with something that is not a payment list"
       });
     }
-    return { payments: listed, scanned: body.settled_scanned };
+    return { payments: listed2, scanned: body.settled_scanned };
   }
   /**
    * Follow a payment over WebSocket until it is paid or expired, reconnecting
@@ -2503,15 +2810,15 @@ var ThunderBridge = class {
    * one that has answered is followed until its own expiry, so the wait always
    * ends by itself
    */
-  async settled(id, options) {
-    const ended = paymentFromWire(await this.followed(id, options));
+  async settled(held, options) {
+    const ended = paymentFromWire(await this.followed(held.id, options));
     if (ended === null) {
       throw new ProblemError({
         status: 200,
         title: "The gateway answered with something that is not a payment"
       });
     }
-    return this.proven(ended);
+    return this.proven(ended, held);
   }
   followed(id, options) {
     const base = this.baseUrl.replace(/^http/, "ws");
@@ -2616,8 +2923,8 @@ var ThunderBridge = class {
    * really does pay twice and that shows up on `follow` as a second settlement to
    * refund.
    */
-  async firstSettled(ids, options) {
-    if (ids.length === 0) {
+  async firstSettled(held, options) {
+    if (held.length === 0) {
       return null;
     }
     const stopLosers = new AbortController();
@@ -2625,15 +2932,15 @@ var ThunderBridge = class {
     let refused = null;
     try {
       const winner = await new Promise((resolve2) => {
-        let waiting = ids.length;
+        let waiting = held.length;
         const lost = () => {
           waiting -= 1;
           if (waiting === 0) {
             resolve2(null);
           }
         };
-        for (const id of ids) {
-          this.settled(id, { ...options, signal }).then((watched) => watched.status === "paid" ? resolve2(watched) : lost()).catch((failure) => {
+        for (const leg of held) {
+          this.settled(leg, { ...options, signal }).then((watched) => watched.status === "paid" ? resolve2(watched) : lost()).catch((failure) => {
             refused ??= failure;
             lost();
           });
@@ -2677,6 +2984,9 @@ var ThunderBridge = class {
     if (named !== null && watched.id !== named) {
       throw new GatewayCheatError("id_not_mine", watched.id);
     }
+    if (watched.paymentHash.toLowerCase() !== handover.paymentHash.toLowerCase()) {
+      throw new GatewayCheatError("hash_mismatch", watched.id);
+    }
     return watched;
   }
   /**
@@ -2689,6 +2999,69 @@ var ThunderBridge = class {
   async nameFor(paymentHash) {
     return this.secret === null ? null : paymentNamedBy((await this.speaking()).publicKeyHex, paymentHash);
   }
+  /**
+   * Hold a socket open and answer what the gateway asks about this caller's own
+   * payments, so a watch addressed to this caller settles without anybody
+   * hosting a URL. Reconnects on its own until the returned function is called
+   */
+  attend(options) {
+    const base = this.baseUrl.replace(/^http/, "ws");
+    const firstDelay = options.reconnectDelayMs ?? RECONNECT_DELAY_MS;
+    let socket = null;
+    let retry;
+    let stopped = false;
+    let attempt = 0;
+    const again = () => {
+      if (stopped || options.reconnect === false) {
+        return;
+      }
+      retry = setTimeout(() => void connect(), backoffMs(firstDelay, attempt));
+    };
+    const answered3 = async (opened, raw) => {
+      const asked = askFromWire(raw);
+      if (asked === null) {
+        return;
+      }
+      const preimage = await options.answer(asked.paymentHash);
+      opened.send(
+        JSON.stringify(
+          preimage === null ? { ask: asked.ask, settled: false } : { ask: asked.ask, settled: true, preimage }
+        )
+      );
+    };
+    const connect = async () => {
+      attempt += 1;
+      let url;
+      try {
+        url = `${base}/ws/tickets/${await this.wsTicket({ agent: true })}`;
+      } catch (refused) {
+        options.onError?.(refused);
+        again();
+        return;
+      }
+      if (stopped) {
+        return;
+      }
+      const opened = new WebSocket(url);
+      socket = opened;
+      opened.onopen = () => {
+        attempt = 1;
+      };
+      opened.onmessage = (event) => {
+        void answered3(opened, String(event.data)).catch(
+          (refused) => options.onError?.(refused)
+        );
+      };
+      opened.onerror = () => options.onError?.(new Error(`could not attend ${base}`));
+      opened.onclose = again;
+    };
+    void connect();
+    return () => {
+      stopped = true;
+      clearTimeout(retry);
+      socket?.close();
+    };
+  }
   /**
    * Follow every payment made to one trigger, replayed from the recent ones on
    * connect and then live, reconnecting on its own until the returned function
@@ -2765,7 +3138,7 @@ var ThunderBridge = class {
     });
   }
   needsTicket(asked) {
-    return asked === true || this.token !== null;
+    return asked === true || this.token !== null || this.secret !== null;
   }
   async wsTicket(body) {
     return encodeURIComponent((await this.mintedTicket(body)).ticket);
@@ -2802,8 +3175,26 @@ var ThunderBridge = class {
     this.speaks ??= callerKey(this.secret ?? "");
     return await this.speaks;
   }
-  proven(payment) {
-    if (this.verify && payment.status === "paid" && !carriesProof(payment)) {
+  handOut(payment, key) {
+    const now = Math.floor(Date.now() / 1e3);
+    for (const [hash2, earlier2] of this.handedOut) {
+      if (earlier2.expiresAt <= now) {
+        this.handedOut.delete(hash2);
+      }
+    }
+    const hash = payment.paymentHash.toLowerCase();
+    const earlier = this.handedOut.get(hash);
+    if (earlier !== void 0 && (earlier.key === null || earlier.key !== key)) {
+      throw new GatewayCheatError("invoice_reused", payment.id);
+    }
+    this.handedOut.set(hash, { key, expiresAt: payment.expiresAt });
+  }
+  proven(payment, held) {
+    const other = held !== void 0 && (payment.id !== held.id || payment.paymentHash.toLowerCase() !== held.paymentHash.toLowerCase());
+    if (other) {
+      throw new GatewayCheatError("hash_mismatch", payment.id);
+    }
+    if (payment.status === "paid" && !carriesProof(payment)) {
       throw new GatewayCheatError("preimage_mismatch", payment.id);
     }
     return payment;
@@ -2898,7 +3289,7 @@ var Gateways = class {
    * saying so. When they all end without a payment, the first ending is the answer,
    * and when they all fail, the first failure is thrown
    */
-  async settled(id, options) {
+  async settled(held, options) {
     const stopLosers = new AbortController();
     const signal = options?.signal ? AbortSignal.any([stopLosers.signal, options.signal]) : stopLosers.signal;
     const unpaid = [];
@@ -2913,7 +3304,7 @@ var Gateways = class {
           }
         };
         for (const gateway of this.each) {
-          gateway.settled(id, { ...options, signal }).then((watched) => {
+          gateway.settled(held, { ...options, signal }).then((watched) => {
             if (watched.status === "paid") {
               return resolve2(watched);
             }