thunder-bridge 1.5.0 → 2.2.0

package/dist/index.cjs

@@ -39,6 +39,7 @@ __export(src_exports, {
   ThunderBridge: () => ThunderBridge,
   UnverifiedRecipientError: () => UnverifiedRecipientError,
   WrapRefusedError: () => WrapRefusedError,
+  agreesWithItself: () => agreesWithItself,
   answerVerifyChallenge: () => answerVerifyChallenge,
   carriesProof: () => carriesProof,
   decodeInvoice: () => decodeInvoice,
@@ -157,11 +158,11 @@ var BLOCK_BYTES = 64;
 var LENGTH_BYTES = 8;
 var SCHEDULE_WORDS = 64;
 function sha256(bytes) {
-  const padded = withPadding(bytes);
-  const reader = new DataView(padded.buffer);
+  const padded2 = withPadding(bytes);
+  const reader = new DataView(padded2.buffer);
   const state = Uint32Array.from(INITIAL_STATE);
   const schedule = new Uint32Array(SCHEDULE_WORDS);
-  for (let block = 0; block < padded.length; block += BLOCK_BYTES) {
+  for (let block = 0; block < padded2.length; block += BLOCK_BYTES) {
     fillSchedule(schedule, reader, block);
     compress(state, schedule);
   }
@@ -171,13 +172,13 @@ function sha256Hex(text3) {
   return bytesToHex(sha256(new TextEncoder().encode(text3)));
 }
 function withPadding(bytes) {
-  const padded = new Uint8Array(
+  const padded2 = new Uint8Array(
     bytes.length + 1 + LENGTH_BYTES + BLOCK_BYTES - 1 & ~(BLOCK_BYTES - 1)
   );
-  padded.set(bytes);
-  padded[bytes.length] = 128;
-  new DataView(padded.buffer).setUint32(padded.length - 4, bytes.length * 8, false);
-  return padded;
+  padded2.set(bytes);
+  padded2[bytes.length] = 128;
+  new DataView(padded2.buffer).setUint32(padded2.length - 4, bytes.length * 8, false);
+  return padded2;
 }
 function fillSchedule(schedule, reader, block) {
   for (let at = 0; at < 16; at++) {
@@ -234,6 +235,7 @@ function rotate(value, by) {
 
 // ../core/bolt11.ts
 var BECH32_CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+var BECH32_GENERATOR = [996825010, 642813549, 513874426, 1027748829, 705979059];
 var CHECKSUM_WORDS = 6;
 var TIMESTAMP_WORDS = 7;
 var SIGNATURE_WORDS = 104;
@@ -251,18 +253,27 @@ var HRP_MULTIPLIER_MSAT = {
   n: MSAT_PER_BTC / 1e9,
   p: MSAT_PER_BTC / 1e12
 };
-var HRP_AMOUNT = /^ln[a-z]+?(\d+)([munp]?)$/;
+var HRP = /^ln(?:bcrt|bc|tbs|tb|sb)(?:(\d+)([munp]?))?$/;
 function decodeInvoice(bolt11) {
   const parts = splitBech32(bolt11);
   if (parts === null) {
-    return { paymentHash: null, descriptionHash: null, amountMsat: null, expiresAt: null };
+    return {
+      paymentHash: null,
+      descriptionHash: null,
+      amountMsat: null,
+      issuedAt: null,
+      expiresAt: null
+    };
   }
   const tagged = taggedFields(parts.words);
+  const issuedAt = issuedAtOf(parts.words);
+  const expiry = tagged.get(EXPIRY_TAG);
   return {
     paymentHash: hexTag(tagged, PAYMENT_HASH_TAG, PAYMENT_HASH_WORDS),
     descriptionHash: hexTag(tagged, DESCRIPTION_HASH_TAG, DESCRIPTION_HASH_WORDS),
     amountMsat: amountFromHrp(parts.hrp),
-    expiresAt: expiryOf(parts.words, tagged)
+    issuedAt,
+    expiresAt: issuedAt === null ? null : issuedAt + (expiry ? readNumber(expiry) : DEFAULT_EXPIRY_SECS)
   };
 }
 function preimageMatchesHash(preimage, paymentHash) {
@@ -273,7 +284,7 @@ function preimageMatchesHash(preimage, paymentHash) {
 }
 function splitBech32(bolt11) {
   const lower = bolt11.toLowerCase();
-  if (isBolt12Encoding(lower)) {
+  if (isBolt12Encoding(lower) || bolt11 !== lower && bolt11 !== bolt11.toUpperCase()) {
     return null;
   }
   const separator = lower.lastIndexOf("1");
@@ -292,7 +303,28 @@ function splitBech32(bolt11) {
     }
     words.push(value);
   }
-  return { hrp: lower.slice(0, separator), words: words.slice(0, -CHECKSUM_WORDS) };
+  const hrp = lower.slice(0, separator);
+  if (!HRP.test(hrp) || bech32Polymod([...expandedHrp(hrp), ...words]) !== 1) {
+    return null;
+  }
+  return { hrp, words: words.slice(0, -CHECKSUM_WORDS) };
+}
+function expandedHrp(hrp) {
+  const codes = [...hrp].map((char) => char.charCodeAt(0));
+  return [...codes.map((code) => code >> 5), 0, ...codes.map((code) => code & 31)];
+}
+function bech32Polymod(values) {
+  let checksum = 1;
+  for (const value of values) {
+    const top = checksum >> 25;
+    checksum = (checksum & 33554431) << 5 ^ value;
+    for (let bit = 0; bit < 5; bit++) {
+      if (top >> bit & 1) {
+        checksum ^= BECH32_GENERATOR[bit];
+      }
+    }
+  }
+  return checksum;
 }
 function isBolt12Encoding(lower) {
   return lower.startsWith("lno") || lower.startsWith("lni") || lower.startsWith("lnr");
@@ -322,19 +354,17 @@ function hexTag(fields, tag, expectedWords) {
   }
   return bytesToHex(wordsToBytes(words));
 }
-function expiryOf(words, fields) {
+function issuedAtOf(words) {
   if (words.length < TIMESTAMP_WORDS + SIGNATURE_WORDS) {
     return null;
   }
-  const expiry = fields.get(EXPIRY_TAG);
-  return readNumber(words.slice(0, TIMESTAMP_WORDS)) + (expiry ? readNumber(expiry) : DEFAULT_EXPIRY_SECS);
+  return readNumber(words.slice(0, TIMESTAMP_WORDS));
 }
 function amountFromHrp(hrp) {
-  const match = HRP_AMOUNT.exec(hrp);
-  if (match === null) {
+  const [, digits, multiplier] = HRP.exec(hrp) ?? [];
+  if (digits === void 0 || multiplier === "p" && !digits.endsWith("0")) {
     return null;
   }
-  const [, digits, multiplier] = match;
   return multiplier ? Number(digits) * HRP_MULTIPLIER_MSAT[multiplier] : Number(digits) * MSAT_PER_BTC;
 }
 function readNumber(words) {
@@ -355,49 +385,148 @@ function wordsToBytes(words) {
   return Uint8Array.from(bytes);
 }
 
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
+}
+function equalInConstantTime(one, other) {
+  if (one.length !== other.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let at = 0; at < one.length; at++) {
+    difference |= one.charCodeAt(at) ^ other.charCodeAt(at);
+  }
+  return difference === 0;
+}
+function asBuffer(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
 // ../core/sealed.ts
-var VERSION = "v1";
+var VERSION = "v2";
+var UNPADDED_VERSION = "v1";
+var PURPOSE_VERSION = "v3";
 var IV_BYTES = 12;
 var MIN_SECRET_CHARS = 32;
 var MAX_PLAIN_BYTES = 3e3;
-var INFO = new TextEncoder().encode("thunder-bridge/sealed");
-async function seal(secret, plaintext) {
-  const body = new TextEncoder().encode(plaintext);
-  if (body.length > MAX_PLAIN_BYTES) {
-    throw new Error(`sealed takes at most ${MAX_PLAIN_BYTES} bytes, this was ${body.length}`);
-  }
-  const key = await keyFor(secret);
-  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-  const cipher = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, body));
-  const joined = new Uint8Array(iv.length + cipher.length);
-  joined.set(iv);
-  joined.set(cipher, iv.length);
-  return `${VERSION}.${toBase64Url(joined)}`;
-}
-async function unseal(secret, sealed) {
-  const key = await keyFor(secret);
-  if (!sealed.startsWith(`${VERSION}.`)) {
+var SIZE_CLASSES = [256, 1024, MAX_PLAIN_BYTES];
+var END_OF_TEXT = 128;
+var INFO = "thunder-bridge/sealed";
+async function seal(secret, plaintext, paymentHash) {
+  return await sealUnder(
+    await keyFor(secret, INFO),
+    plaintext,
+    crypto.getRandomValues(new Uint8Array(IV_BYTES)),
+    VERSION,
+    boundTo(paymentHash)
+  );
+}
+async function sealFor(purpose, secret, plaintext, { stable = false } = {}) {
+  return await sealUnder(
+    await keyFor(secret, `${INFO}/${purpose}`),
+    plaintext,
+    stable ? await nonceOf(secret, plaintext) : crypto.getRandomValues(new Uint8Array(IV_BYTES)),
+    PURPOSE_VERSION,
+    new TextEncoder().encode(PURPOSE_VERSION)
+  );
+}
+async function unsealFor(purpose, secret, sealed) {
+  if (!sealed.startsWith(`${PURPOSE_VERSION}.`)) {
+    return await unseal(secret, sealed);
+  }
+  return await opened(
+    await keyFor(secret, `${INFO}/${purpose}`),
+    sealed.slice(PURPOSE_VERSION.length + 1),
+    new TextEncoder().encode(PURPOSE_VERSION)
+  );
+}
+async function nonceOf(secret, plaintext) {
+  const derived = await hmacHex(secret, `sealed-nonce|${plaintext}`);
+  const nonce = new Uint8Array(IV_BYTES);
+  for (let at = 0; at < IV_BYTES; at++) {
+    nonce[at] = Number.parseInt(derived.slice(at * 2, at * 2 + 2), 16);
+  }
+  return nonce;
+}
+async function sealUnder(key, plaintext, iv, version, additionalData) {
+  const body = padToClass(plaintext);
+  const cipher = new Uint8Array(
+    await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData }, key, body)
+  );
+  const joined2 = new Uint8Array(iv.length + cipher.length);
+  joined2.set(iv);
+  joined2.set(cipher, iv.length);
+  return `${version}.${toBase64Url(joined2)}`;
+}
+async function unseal(secret, sealed, paymentHash) {
+  const key = await keyFor(secret, INFO);
+  const padded2 = sealed.startsWith(`${VERSION}.`);
+  const unbound = !padded2 && sealed.startsWith(`${UNPADDED_VERSION}.`);
+  if (!padded2 && (!unbound || paymentHash !== void 0)) {
     return null;
   }
-  const joined = fromBase64Url(sealed.slice(VERSION.length + 1));
-  if (joined === null || joined.length <= IV_BYTES) {
+  return await opened(
+    key,
+    sealed.slice(VERSION.length + 1),
+    padded2 ? boundTo(paymentHash) : void 0
+  );
+}
+async function opened(key, encoded, additionalData) {
+  const joined2 = fromBase64Url(encoded);
+  if (joined2 === null || joined2.length <= IV_BYTES) {
     return null;
   }
   try {
-    const body = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: joined.slice(0, IV_BYTES) },
-      key,
-      joined.slice(IV_BYTES)
+    const body = new Uint8Array(
+      await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: joined2.slice(0, IV_BYTES), additionalData },
+        key,
+        joined2.slice(IV_BYTES)
+      )
     );
-    return new TextDecoder().decode(body);
+    const text3 = additionalData === void 0 ? body : unpad(body);
+    return text3 === null ? null : new TextDecoder().decode(text3);
   } catch {
     return null;
   }
 }
-async function keyFor(secret) {
+function refuseAWeakSecret(secret) {
   if (secret.length < MIN_SECRET_CHARS) {
     throw new Error(`the sealing secret needs ${MIN_SECRET_CHARS} characters of randomness`);
   }
+}
+function boundTo(paymentHash) {
+  return new TextEncoder().encode(
+    paymentHash === void 0 ? VERSION : `${VERSION}|${paymentHash.toLowerCase()}`
+  );
+}
+function padToClass(plaintext) {
+  const text3 = new TextEncoder().encode(plaintext);
+  const size = SIZE_CLASSES.find((limit) => text3.length <= limit);
+  if (size === void 0) {
+    throw new Error(`sealed takes at most ${MAX_PLAIN_BYTES} bytes, this was ${text3.length}`);
+  }
+  const body = new Uint8Array(size + 1);
+  body.set(text3);
+  body[text3.length] = END_OF_TEXT;
+  return body;
+}
+function unpad(body) {
+  const end = body.lastIndexOf(END_OF_TEXT);
+  return end === -1 ? null : body.subarray(0, end);
+}
+async function keyFor(secret, info) {
+  refuseAWeakSecret(secret);
   const material = await crypto.subtle.importKey(
     "raw",
     new TextEncoder().encode(secret),
@@ -406,7 +535,12 @@ async function keyFor(secret) {
     ["deriveKey"]
   );
   return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: INFO },
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: new TextEncoder().encode(info)
+    },
     material,
     { name: "AES-GCM", length: 256 },
     false,
@@ -594,11 +728,11 @@ function coinbase(baseUrl = "https://api.coinbase.com") {
   return async (currency) => {
     const asked = currency.toUpperCase();
     const answer = await asJson(`${baseUrl}/v2/prices/BTC-${asked}/spot`, "coinbase");
-    const quoted = answer.data;
-    if (quoted?.currency !== asked) {
-      throw new Error(`coinbase quoted ${quoted?.currency} when asked for ${asked}`);
+    const quoted2 = answer.data;
+    if (quoted2?.currency !== asked) {
+      throw new Error(`coinbase quoted ${quoted2?.currency} when asked for ${asked}`);
     }
-    return asMinor(quoted.amount, "coinbase", asked);
+    return asMinor(quoted2.amount, "coinbase", asked);
   };
 }
 function kraken(baseUrl = "https://api.kraken.com") {
@@ -647,19 +781,19 @@ function medianOf(tickers = [coinbase(), kraken(), bitstamp(), coinmate()], opti
       return remembered.price;
     }
     const answers = await Promise.allSettled(tickers.map((ticker) => ticker(asked)));
-    const quoted = answers.filter((answer) => answer.status === "fulfilled").map((answer) => answer.value).sort((one, other) => one - other);
-    if (quoted.length < minVenues) {
+    const quoted2 = answers.filter((answer) => answer.status === "fulfilled").map((answer) => answer.value).sort((one, other) => one - other);
+    if (quoted2.length < minVenues) {
       throw new Error(
-        `${quoted.length} of ${tickers.length} venues quoted ${asked}, ${minVenues} wanted: ${refusals(answers)}`
+        `${quoted2.length} of ${tickers.length} venues quoted ${asked}, ${minVenues} wanted: ${refusals(answers)}`
       );
     }
-    const spread2 = spreadBpsOf(quoted);
+    const spread2 = spreadBpsOf(quoted2);
     if (spread2 > maxSpread) {
       throw new Error(
-        `venues disagree on ${asked} by ${Math.round(spread2)} bps, more than the ${maxSpread} allowed: ${quoted.join(", ")}`
+        `venues disagree on ${asked} by ${Math.round(spread2)} bps, more than the ${maxSpread} allowed: ${quoted2.join(", ")}`
       );
     }
-    const price = middleOf(quoted);
+    const price = middleOf(quoted2);
     held.set(asked, { at: Date.now(), price });
     return price;
   };
@@ -690,10 +824,10 @@ async function asJson(url, venue) {
   }
   return answer.json();
 }
-function asMinor(quoted, venue, currency) {
-  const major2 = Number(quoted);
+function asMinor(quoted2, venue, currency) {
+  const major2 = Number(quoted2);
   if (!Number.isFinite(major2) || major2 <= 0) {
-    throw new Error(`${venue} quoted ${String(quoted)} for ${currency.toUpperCase()}`);
+    throw new Error(`${venue} quoted ${String(quoted2)} for ${currency.toUpperCase()}`);
   }
   return Math.round(major2 * minorScaleOf(currency));
 }
@@ -781,6 +915,16 @@ var SEED_BYTES = 32;
 var SIGNATURE_BYTES = 64;
 var PUBLIC_KEY_BYTES = 32;
 var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
+var SIGN_BIT_CLEARED = 127;
+var SMALL_ORDER = [
+  "00".repeat(32),
+  `01${"00".repeat(31)}`,
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+  `ec${"ff".repeat(30)}7f`,
+  `ed${"ff".repeat(30)}7f`,
+  `ee${"ff".repeat(30)}7f`
+];
 async function signingKeyFromSeed(seed) {
   if (seed.length !== SEED_BYTES) {
     throw new Error(`an ed25519 seed is ${SEED_BYTES} bytes`);
@@ -788,24 +932,27 @@ async function signingKeyFromSeed(seed) {
   const wrapped = new Uint8Array(PKCS8_HEADER.length + SEED_BYTES);
   wrapped.set(PKCS8_HEADER);
   wrapped.set(seed, PKCS8_HEADER.length);
-  const key = await crypto.subtle.importKey("pkcs8", asBuffer(wrapped), ALGORITHM, true, ["sign"]);
+  const key = await crypto.subtle.importKey("pkcs8", asBuffer2(wrapped), ALGORITHM, true, ["sign"]);
   const jwk = await crypto.subtle.exportKey("jwk", key);
   return {
     publicKeyHex: bytesToHex(fromBase64Url2(jwk.x ?? "")),
-    sign: async (payload) => bytesToHex(new Uint8Array(await crypto.subtle.sign(ALGORITHM, key, asBuffer(payload))))
+    sign: async (payload) => bytesToHex(new Uint8Array(await crypto.subtle.sign(ALGORITHM, key, asBuffer2(payload))))
   };
 }
 async function verifyHex(publicKeyHex, signatureHex, payload) {
   if (!isHex(publicKeyHex) || publicKeyHex.length !== PUBLIC_KEY_BYTES * 2) {
     return false;
   }
+  if (hasSmallOrder(publicKeyHex)) {
+    return false;
+  }
   if (!isHex(signatureHex) || signatureHex.length !== SIGNATURE_BYTES * 2) {
     return false;
   }
   try {
     const key = await crypto.subtle.importKey(
       "raw",
-      asBuffer(hexToBytes(publicKeyHex)),
+      asBuffer2(hexToBytes(publicKeyHex)),
       ALGORITHM,
       false,
       ["verify"]
@@ -813,58 +960,38 @@ async function verifyHex(publicKeyHex, signatureHex, payload) {
     return await crypto.subtle.verify(
       ALGORITHM,
       key,
-      asBuffer(hexToBytes(signatureHex)),
-      asBuffer(payload)
+      asBuffer2(hexToBytes(signatureHex)),
+      asBuffer2(payload)
     );
   } catch {
     return false;
   }
 }
+function hasSmallOrder(publicKeyHex) {
+  const point = hexToBytes(publicKeyHex);
+  point[PUBLIC_KEY_BYTES - 1] = point[PUBLIC_KEY_BYTES - 1] & SIGN_BIT_CLEARED;
+  return SMALL_ORDER.includes(bytesToHex(point));
+}
 function fromBase64Url2(text3) {
-  const padded = text3.replace(/-/g, "+").replace(/_/g, "/");
-  const raw = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const padded2 = text3.replace(/-/g, "+").replace(/_/g, "/");
+  const raw = atob(padded2 + "=".repeat((4 - padded2.length % 4) % 4));
   const bytes = new Uint8Array(raw.length);
   for (let at = 0; at < raw.length; at++) {
     bytes[at] = raw.charCodeAt(at);
   }
   return bytes;
 }
-function asBuffer(bytes) {
-  return bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
-}
-
-// ../core/hmac.ts
-async function hmacHex(secret, payload) {
-  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
-  const key = await crypto.subtle.importKey(
-    "raw",
-    asBuffer2(raw),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
-  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer2(message))));
-}
-function equalInConstantTime(one, other) {
-  if (one.length !== other.length) {
-    return false;
-  }
-  let difference = 0;
-  for (let at = 0; at < one.length; at++) {
-    difference |= one.charCodeAt(at) ^ other.charCodeAt(at);
-  }
-  return difference === 0;
-}
 function asBuffer2(bytes) {
-  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+  return bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
 }
 
 // ../core/caller.ts
 var KEY_HEADER = "x-client-key";
 var SIGNATURE_HEADER = "x-signature";
 var TIMESTAMP_HEADER = "x-timestamp";
+var NONCE_HEADER = "x-nonce";
 var PREFIX = "ed25519=";
+var NONCE_BYTES = 16;
 var SIGNING_LABEL = "request-signing";
 async function callerKey(secret) {
   return await signingKeyFromSeed(hexToBytes(await hmacHex(secret, SIGNING_LABEL)));
@@ -872,17 +999,21 @@ async function callerKey(secret) {
 function paymentNamedBy(caller, paymentHash) {
   return sha256Hex(`${caller}.payment-id.${paymentHash}`);
 }
-async function signedAs(key, method, path, body) {
+async function signedAs(key, method, path, body, host) {
   const timestamp = String(Math.floor(Date.now() / 1e3));
+  const nonce = bytesToHex(crypto.getRandomValues(new Uint8Array(NONCE_BYTES)));
   return {
     [KEY_HEADER]: key.publicKeyHex,
     [TIMESTAMP_HEADER]: timestamp,
-    [SIGNATURE_HEADER]: `${PREFIX}${await key.sign(spoken(timestamp, method, path, body))}`
+    [NONCE_HEADER]: nonce,
+    [SIGNATURE_HEADER]: `${PREFIX}${await key.sign(spokenTo(host, timestamp, nonce, method, path, body))}`
   };
 }
-function spoken(timestamp, method, path, body) {
+function spokenTo(host, timestamp, nonce, method, path, body) {
   return new TextEncoder().encode(
-    `${timestamp}.${method.toUpperCase()}.${path}.${sha256Hex(body)}`
+    ["v2", host.toLowerCase(), timestamp, nonce, method.toUpperCase(), path, sha256Hex(body)].join(
+      "\n"
+    )
   );
 }
 
@@ -935,8 +1066,8 @@ function ipv4IsGlobal(literal) {
   if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
     return false;
   }
-  const [a, b] = parts;
-  if (a === 0 || a === 10 || a === 127 || a >= 240) {
+  const [a, b, c] = parts;
+  if (a === 0 || a === 10 || a === 127 || a >= 224) {
     return false;
   }
   if (a === 100 && b >= 64 && b < 128) {
@@ -948,7 +1079,13 @@ function ipv4IsGlobal(literal) {
   if (a === 172 && b >= 16 && b < 32) {
     return false;
   }
-  if (a === 192 && b === 168) {
+  if (a === 192 && (b === 168 || b === 0 && (c === 0 || c === 2))) {
+    return false;
+  }
+  if (a === 198 && (b === 18 || b === 19 || b === 51 && c === 100)) {
+    return false;
+  }
+  if (a === 203 && b === 0 && c === 113) {
     return false;
   }
   return true;
@@ -958,29 +1095,59 @@ function ipv6IsGlobal(literal) {
   if (groups.length !== 8 || groups.some(Number.isNaN)) {
     return false;
   }
-  const leading = groups.slice(0, 5).every((group) => group === 0);
-  if (leading && groups[5] === 0 && groups[6] === 0 && groups[7] <= 1) {
+  const [first, second, third, fourth, fifth, sixth, high, low] = groups;
+  const embedded = (one, other) => ipv4IsGlobal(`${one >> 8}.${one & 255}.${other >> 8}.${other & 255}`);
+  const zeroBefore = (count) => groups.slice(0, count).every((group) => group === 0);
+  if (zeroBefore(5) && sixth === 65535) {
+    return embedded(high, low);
+  }
+  if (zeroBefore(6) || zeroBefore(4) && fifth === 65535 && sixth === 0) {
+    return false;
+  }
+  if (first === 100 && second === 65435) {
+    return third === 0 && fourth === 0 && fifth === 0 && sixth === 0 && embedded(high, low);
+  }
+  if (first === 8194) {
+    return embedded(second, third);
+  }
+  if (first === 8193 && second === 0) {
     return false;
   }
-  if (leading && groups[5] === 65535) {
-    const [high, low] = [groups[6], groups[7]];
-    return ipv4IsGlobal(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+  if (first === 256 && second === 0 && third === 0 && fourth === 0) {
+    return false;
   }
-  const first = groups[0];
-  if ((first & 65024) === 64512) {
+  if ((first & 65024) === 64512 || (first & 65280) === 65280) {
     return false;
   }
-  if ((first & 65472) === 65152) {
+  if ((first & 65472) === 65152 || (first & 65472) === 65216) {
     return false;
   }
   return true;
 }
 function ipv6Groups(address) {
-  const [head = "", tail] = address.split("::");
+  const halves = withDottedTailAsGroups(address).split("::");
+  const [head = "", tail] = halves;
   const left = head.split(":").filter((group) => group !== "");
   const right = (tail ?? "").split(":").filter((group) => group !== "");
-  const gap = tail === void 0 ? [] : Array(8 - left.length - right.length).fill("0");
-  return [...left, ...gap, ...right].map((group) => parseInt(group, 16));
+  const missing = 8 - left.length - right.length;
+  if (halves.length > 2 || missing < 0) {
+    return [Number.NaN];
+  }
+  const gap = tail === void 0 ? [] : Array(missing).fill("0");
+  return [...left, ...gap, ...right].map(
+    (group) => /^[0-9a-f]{1,4}$/.test(group) ? parseInt(group, 16) : Number.NaN
+  );
+}
+function withDottedTailAsGroups(address) {
+  const dotted = /^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(address);
+  if (dotted === null) {
+    return address;
+  }
+  const [a, b, c, d] = dotted[2].split(".").map(Number);
+  if ([a, b, c, d].some((part) => part > 255)) {
+    return `${dotted[1]}x`;
+  }
+  return `${dotted[1]}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
 }
 
 // ../core/outbound.ts
@@ -1008,6 +1175,9 @@ async function ask(send, url, sent = {}) {
     }
     await response.body?.cancel();
     const next = new URL(location, target).toString();
+    if (sent.staysOnOrigin && !sameOrigin(target, next)) {
+      throw new Error(`${target} redirected off its own origin, to ${next}`);
+    }
     carried = KEEPS_THE_METHOD.includes(response.status) ? carried : withoutBody(carried);
     carried = sameOrigin(target, next) ? carried : withoutCredentials(carried);
     target = next;
@@ -1025,14 +1195,39 @@ async function addressesToReach(url) {
   return found;
 }
 async function resolved(url) {
-  const { lookup } = await import("dns/promises");
-  const { setTimeout: sleep } = await import("timers/promises");
+  const { isIP } = await import("net");
   const host = new URL(url).hostname.replace(/^\[|]$/g, "");
+  const literal = isIP(host);
+  if (literal !== 0) {
+    return [{ address: host, family: literal }];
+  }
+  const { Resolver } = await import("dns/promises");
+  const { setTimeout: sleep } = await import("timers/promises");
+  const resolver = new Resolver({ timeout: LOOKUP_TIMEOUT_MS, tries: 1 });
   const found = await Promise.race([
-    lookup(host, { all: true, verbatim: true }).catch(() => []),
+    Promise.all([
+      resolver.resolve4(host).catch(() => []),
+      resolver.resolve6(host).catch(() => [])
+    ]),
     sleep(LOOKUP_TIMEOUT_MS, null, { ref: false })
   ]);
-  return found ?? [];
+  cancelled(resolver);
+  if (found === null) {
+    return [];
+  }
+  const [four, six] = found;
+  return [
+    ...four.map((address) => ({ address, family: 4 })),
+    ...six.map((address) => ({ address, family: 6 }))
+  ];
+}
+function cancelled(resolver) {
+  try {
+    resolver.cancel();
+    return true;
+  } catch {
+    return false;
+  }
 }
 async function answerOf(response) {
   const { status, ok, headers } = response;
@@ -1054,15 +1249,17 @@ async function answerOf(response) {
   return { status, ok, body: text(read), truncated: true, headers };
 }
 function withoutBody(sent) {
-  const headers = { ...sent.headers };
-  delete headers["content-type"];
+  const headers = Object.fromEntries(
+    Object.entries(sent.headers ?? {}).filter(([name]) => name.toLowerCase() !== "content-type")
+  );
   return { ...sent, method: "GET", headers, body: void 0 };
 }
 function withoutCredentials(sent) {
-  const headers = { ...sent.headers };
-  for (const named of CREDENTIALS) {
-    delete headers[named];
-  }
+  const headers = Object.fromEntries(
+    Object.entries(sent.headers ?? {}).filter(
+      ([name]) => !CREDENTIALS.includes(name.toLowerCase())
+    )
+  );
   return { ...sent, headers };
 }
 function text(chunks) {
@@ -1105,6 +1302,22 @@ async function resolve(send, addresses, amountMsat) {
   );
   return served.won;
 }
+async function quote(send, addresses, amountMsat) {
+  const served = await firstThatServes(
+    addresses,
+    (address2, deadline) => probe(send, address2, amountMsat, deadline)
+  );
+  const { address, pay } = served.won;
+  return {
+    won: {
+      address,
+      minMsat: pay.minSendable,
+      maxMsat: pay.maxSendable,
+      metadata: pay.metadata
+    },
+    refusals: served.refusals
+  };
+}
 async function firstThatServes(addresses, attempt) {
   const deadline = AbortSignal.timeout(RESOLVE_TIMEOUT_MS);
   const refusals3 = [];
@@ -1197,7 +1410,7 @@ function decodeIssued(address, bolt11) {
   return { paymentHash, descriptionHash, amountMsat, expiresAt };
 }
 async function checkSettled(send, verifyUrl, paymentHash) {
-  const answer = await answeredJson(send, verifyUrl);
+  const answer = await answeredJson(send, verifyUrl, { staysOnOrigin: true });
   const asked = {
     pace: paceAskedFor(answer.headers),
     ceiling: ceilingAskedFor(answer.headers)
@@ -1255,10 +1468,10 @@ function isNothingButAHost(domain) {
   }
 }
 async function fetchJson(send, url, deadline) {
-  return (await answeredJson(send, url, deadline)).said;
+  return (await answeredJson(send, url, { deadline })).said;
 }
-async function answeredJson(send, url, deadline) {
-  const answer = await ask(send, url, { headers: { accept: "application/json" }, deadline });
+async function answeredJson(send, url, sent) {
+  const answer = await ask(send, url, { headers: { accept: "application/json" }, ...sent });
   if (!answer.ok) {
     throw new Error(`${url} answered ${answer.status}`);
   }
@@ -1286,12 +1499,17 @@ var pinnedToTheAddressWeVerified = async (url, sent, signal, at) => {
     }
     const call = request(reaching(asked, sent, at, first), (answer) => {
       const status = answer.statusCode ?? 502;
-      settle(
-        new Response(
-          CARRIES_NO_BODY.includes(status) ? null : Readable.toWeb(answer),
-          { status, headers: headersOf(answer.headers) }
-        )
-      );
+      try {
+        settle(
+          new Response(
+            CARRIES_NO_BODY.includes(status) ? null : Readable.toWeb(answer),
+            { status, headers: headersOf(answer.headers) }
+          )
+        );
+      } catch (unreadable) {
+        answer.destroy();
+        fail(new Error(`${url} answered with something HTTP cannot carry`, { cause: unreadable }));
+      }
     });
     const give = () => call.destroy(new Error(`${url} took longer than allowed`));
     signal.addEventListener("abort", give, { once: true });
@@ -1338,6 +1556,182 @@ function headersOf(raw) {
   return headers;
 }
 
+// ../core/delivery.ts
+function deliverySigned(url, timestamp, body) {
+  const endpoint = new URL(url);
+  return new TextEncoder().encode(
+    ["v2", `${endpoint.origin}${endpoint.pathname}`, timestamp, body].join("\n")
+  );
+}
+
+// src/verify.ts
+var HTTP_TIMEOUT_MS2 = 15e3;
+var ISSUED_SKEW_SECS = 300;
+var NAMES_AN_ADDRESS = ["text/identifier", "text/email"];
+var DEFAULT_WRAP_PROPORTION = 0.01;
+var DEFAULT_WRAP_BASE_MSAT = 1e3;
+async function proveOrigin(payment, asked, askedAt) {
+  const cheat = (code) => new GatewayCheatError(code, payment.id);
+  const listed2 = asked.paidTo.find((address) => equalIgnoringCase(address, payment.lnAddress));
+  if (listed2 === void 0) {
+    throw cheat("address_not_requested");
+  }
+  if (payment.amountMsat !== asked.amountMsat) {
+    throw cheat("amount_mismatch");
+  }
+  const invoice = decodeInvoice(payment.bolt11);
+  if (invoice.paymentHash === null || !equalIgnoringCase(invoice.paymentHash, payment.paymentHash)) {
+    throw cheat("hash_mismatch");
+  }
+  if (invoice.amountMsat !== asked.amountMsat) {
+    throw cheat("amount_mismatch");
+  }
+  if (askedAt !== void 0 && (invoice.issuedAt ?? 0) < askedAt - ISSUED_SKEW_SECS) {
+    throw cheat("invoice_stale");
+  }
+  const payRequest = await payRequestFor(listed2, payment);
+  if (typeof payRequest.metadata !== "string" || typeof payRequest.callback !== "string") {
+    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "no payRequest served");
+  }
+  if (!namesTheAddress(payRequest.metadata, listed2)) {
+    throw new UnverifiedRecipientError(
+      payment.lnAddress,
+      payment.id,
+      "its metadata names no text/identifier for this address, so no invoice binds to it"
+    );
+  }
+  if (invoice.descriptionHash !== sha256Hex(payRequest.metadata)) {
+    throw cheat("description_hash_mismatch");
+  }
+  if (!sameOrigin(payment.verifyUrl, payRequest.callback)) {
+    throw cheat("verify_url_foreign");
+  }
+  const issued = await reachable(payment.verifyUrl, payment);
+  if (typeof issued.pr !== "string" || !equalIgnoringCase(issued.pr, payment.bolt11)) {
+    throw cheat("invoice_not_issued");
+  }
+  if (askedAt !== void 0 && issued.settled === true) {
+    throw cheat("invoice_settled");
+  }
+}
+function namesTheAddress(metadata, address) {
+  try {
+    const entries = JSON.parse(metadata);
+    return Array.isArray(entries) && entries.some(
+      (entry) => Array.isArray(entry) && NAMES_AN_ADDRESS.includes(entry[0]) && typeof entry[1] === "string" && equalIgnoringCase(entry[1], address)
+    );
+  } catch {
+    return false;
+  }
+}
+async function proveSettlement(payment, asked) {
+  await proveOrigin(payment, asked);
+  const verified = await reachable(payment.verifyUrl, payment);
+  if (verified.settled !== true || typeof verified.preimage !== "string") {
+    return null;
+  }
+  if (!preimageMatchesHash(verified.preimage, payment.paymentHash)) {
+    throw new GatewayCheatError("preimage_mismatch", payment.id);
+  }
+  return verified.preimage;
+}
+function agreesWithItself(report) {
+  if (report.status !== "paid" || report.preimage === null) {
+    return false;
+  }
+  if (report.bolt11 !== void 0 && report.bolt11 !== null) {
+    const invoiceHash = decodeInvoice(report.bolt11).paymentHash;
+    if (invoiceHash === null || !equalIgnoringCase(invoiceHash, report.paymentHash)) {
+      return false;
+    }
+  }
+  return preimageMatchesHash(report.preimage, report.paymentHash);
+}
+var carriesProof = agreesWithItself;
+function wrapFeeCeiling(amountMsat, allowance) {
+  const proportional = amountMsat * (allowance?.proportion ?? DEFAULT_WRAP_PROPORTION);
+  return msat(Math.max(allowance?.baseMsat ?? DEFAULT_WRAP_BASE_MSAT, Math.floor(proportional)));
+}
+function proveWrapped(wrapped, recipient, allowance) {
+  const offered = decodeInvoice(wrapped);
+  const owed = decodeInvoice(recipient);
+  const refuse2 = (code, detail) => {
+    throw new WrapRefusedError(code, detail);
+  };
+  if (offered.paymentHash === null || offered.amountMsat === null || offered.expiresAt === null) {
+    refuse2("undecodable", "the wrapped invoice carries no hash, amount or expiry");
+  }
+  if (owed.paymentHash === null || owed.amountMsat === null || owed.expiresAt === null) {
+    refuse2("undecodable", "the recipient's invoice carries no hash, amount or expiry");
+  }
+  if (offered.paymentHash?.toLowerCase() !== owed.paymentHash?.toLowerCase()) {
+    refuse2("hash_mismatch", "settling the wrap would not settle the recipient");
+  }
+  const asked = offered.amountMsat ?? 0;
+  const due = owed.amountMsat ?? 0;
+  if (asked < due) {
+    refuse2("amount_below_recipient", `${asked} msat cannot forward ${due} msat`);
+  }
+  const ceiling = wrapFeeCeiling(due, allowance);
+  if (asked - due > ceiling) {
+    refuse2("fee_above_allowance", `${asked - due} msat over ${due}, and ${ceiling} was allowed`);
+  }
+  if ((owed.expiresAt ?? 0) <= (offered.expiresAt ?? 0)) {
+    refuse2("recipient_expires_first", "the operator could be paid and find it cannot deliver");
+  }
+}
+async function payRequestFor(listed2, payment) {
+  const at = listed2.indexOf("@");
+  const name = listed2.slice(0, at);
+  const domain = listed2.slice(at + 1).toLowerCase();
+  if (at < 1 || !publicHttps(`https://${domain}/`)) {
+    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "not a usable address");
+  }
+  return reachable(`https://${domain}/.well-known/lnurlp/${name}`, payment);
+}
+async function reachable(url, payment) {
+  try {
+    if (!publicHttps(url)) {
+      throw new Error(`${url} is not a public https URL`);
+    }
+    const response = await fetch(url, {
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2),
+      headers: { accept: "application/json" }
+    });
+    if (response.redirected && !sameOrigin(response.url, url)) {
+      throw new Error(`redirected off its own origin, to ${response.url}`);
+    }
+    if (!response.ok) {
+      throw new Error(`answered ${response.status}`);
+    }
+    const body = JSON.parse(await boundedText(response));
+    if (body === null || typeof body !== "object") {
+      throw new Error("answered with no JSON object");
+    }
+    return body;
+  } catch (cause) {
+    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, cause);
+  }
+}
+async function boundedText(response) {
+  const reader = response.body?.getReader();
+  const decoder = new TextDecoder();
+  let text3 = "";
+  let bytes = 0;
+  for (let chunk = await reader?.read(); chunk && !chunk.done; chunk = await reader?.read()) {
+    bytes += chunk.value.length;
+    if (bytes > BODY_LIMIT_BYTES) {
+      await reader?.cancel();
+      throw new Error(`answered with more than the ${BODY_LIMIT_BYTES} bytes a proof reads`);
+    }
+    text3 += decoder.decode(chunk.value, { stream: true });
+  }
+  return text3 + decoder.decode();
+}
+function equalIgnoringCase(one, other) {
+  return one.toLowerCase() === other.toLowerCase();
+}
+
 // src/wire.ts
 var ASSET_CODE = "BTC";
 var ASSET_SCALE = 11;
@@ -1535,7 +1929,7 @@ function isStatus(value) {
 }
 
 // src/webhook.ts
-var SIGNATURE_HEADER2 = "x-signature";
+var SIGNATURE_HEADER2 = "x-signature-v2";
 var TIMESTAMP_HEADER2 = "x-timestamp";
 var GATEWAY_KEY_PREFIX = "ed25519=";
 var DEFAULT_TOLERANCE_SECS = 300;
@@ -1543,22 +1937,22 @@ var CHALLENGE = "webhook-challenge";
 var VERIFY_CHALLENGE = "verify-challenge";
 async function readPayment(request, credential, options = {}) {
   const body = await believable(request, credential, options);
-  return body === null ? null : decoded(body, paymentFromWire);
+  return body === null ? null : proved(decoded(body, paymentFromWire));
 }
 async function readSettlement(request, credential, options = {}) {
   const body = await believable(request, credential, options);
-  return body === null ? null : decoded(body, settlementFromWire);
+  return body === null ? null : proved(decoded(body, settlementFromWire));
 }
 async function answerWebhookChallenge(request, credential, options = {}) {
   const body = await believable(request, credential, options);
-  const nonce = body === null ? null : nonceOf(body, CHALLENGE);
+  const nonce = body === null ? null : nonceOf2(body, CHALLENGE);
   return nonce === null ? null : answered2(nonce);
 }
 async function answerVerifyChallenge(request) {
   if (request.method !== "POST") {
     return null;
   }
-  const nonce = nonceOf(await request.clone().text(), VERIFY_CHALLENGE);
+  const nonce = nonceOf2(await request.clone().text(), VERIFY_CHALLENGE);
   return nonce === null ? null : answered2(nonce);
 }
 async function believable(request, credential, options) {
@@ -1577,10 +1971,13 @@ async function believable(request, credential, options) {
   const signed = await verifyHex(
     credential.publicKey.toLowerCase(),
     signature.slice(GATEWAY_KEY_PREFIX.length).toLowerCase(),
-    stamped(timestamp, body)
+    deliverySigned(options.url ?? request.url, timestamp, body)
   );
   return signed ? body : null;
 }
+function proved(read) {
+  return read !== null && read.status === "paid" && !agreesWithItself(read) ? null : read;
+}
 function decoded(body, from) {
   try {
     return from(JSON.parse(body));
@@ -1593,7 +1990,7 @@ function answered2(nonce) {
     headers: { "content-type": "application/json" }
   });
 }
-function nonceOf(text3, type) {
+function nonceOf2(text3, type) {
   try {
     const said = JSON.parse(text3);
     if (said["type"] !== type || typeof said["nonce"] !== "string") {
@@ -1611,9 +2008,6 @@ function recent(timestamp, toleranceSecs) {
   }
   return Math.abs(Math.floor(Date.now() / 1e3) - sent) <= toleranceSecs;
 }
-function stamped(timestamp, body) {
-  return new TextEncoder().encode(`${timestamp}.${body}`);
-}
 
 // src/bank.ts
 var DEFAULT_CURRENCY = "CZK";
@@ -1621,30 +2015,39 @@ var DEFAULT_LOOK_BACK_SECS = 7 * 24 * 60 * 60;
 var DEFAULT_POLL_EVERY_SECS = 30;
 var IBAN = /^[A-Z]{2}[0-9]{2}[0-9A-Z]{8,30}$/;
 var FORBIDDEN_IN_SPD = "*";
+var MAX_REFERENCE_CHARS = 60;
 async function bankTransfer(gateway, params) {
   const currency = params.currency ?? DEFAULT_CURRENCY;
-  refuseUnusable(params, currency);
+  const iban = accountOf(params.iban);
+  refuseUnusable(params, iban, currency);
   await refuseAnOpenGateway(gateway, params);
-  const spd = shortPaymentDescriptor(params, currency);
-  const subject = subjectOf(params.reference, params.amountMinor, currency);
-  const polling = new URL(params.verifyUrl);
-  polling.searchParams.set("ref", params.reference);
-  polling.searchParams.set("minor", String(params.amountMinor));
-  polling.searchParams.set("cc", currency);
-  polling.searchParams.set("sig", await hmacHex(params.secret, `verify|${subject}`));
-  const verifyUrl = polling.toString();
+  const spd = shortPaymentDescriptor(params, iban, currency);
+  const subject = subjectOf({
+    iban,
+    amountMinor: params.amountMinor,
+    currency,
+    expiresAt: params.expiresAt,
+    reference: params.reference
+  });
+  const verifyUrl = await answeredAt(params, subject);
+  const paymentHash = hashOf(await hmacHex(params.secret, `preimage|${subject}`));
   const watched = await gateway.watch({
-    paymentHash: hashOf(await hmacHex(params.secret, `preimage|${subject}`)),
+    paymentHash,
     verifyUrl,
     expiresAt: params.expiresAt,
     trigger: params.trigger,
     replay: params.replay,
-    sealed: params.sealed,
+    sealed: params.sealed ? await seal(params.sealed.secret, JSON.stringify(params.sealed.data), paymentHash) : void 0,
     webhookUrl: params.webhookUrl
   });
-  return { id: watched.id, paymentHash: watched.paymentHash, verifyUrl, spd };
+  return { id: watched.id, paymentHash, verifyUrl, spd };
 }
 function bankVerifyEndpoint(config) {
+  refuseAWeakSecret(config.secret);
+  const answersFor = accountOf(config.iban);
+  if (!IBAN.test(answersFor)) {
+    throw new Error(`${config.iban} is not an IBAN, so this endpoint answers for no account`);
+  }
   const paced = {
     "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS}`
   };
@@ -1653,51 +2056,82 @@ function bankVerifyEndpoint(config) {
     if (consented !== null) {
       return consented;
     }
-    const asked = readQuery(new URL(request.url));
-    if (asked === null) {
+    const sealed = new URL(request.url).searchParams.get("q");
+    if (sealed === null) {
       return Response.json({ settled: false }, { status: 400 });
     }
-    const subject = subjectOf(asked.reference, asked.amountMinor, asked.currency);
-    const expected = await hmacHex(config.secret, `verify|${subject}`);
-    if (!equalInConstantTime(asked.signature, expected)) {
+    const subject = await unsealFor("bank-verify", config.secret, sealed);
+    const asked = subject === null ? null : askedFrom(subject);
+    if (asked === null || asked.iban !== answersFor) {
       return Response.json({ settled: false }, { status: 403 });
     }
-    const since = unixNow() - (config.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
-    const landed = (await config.statement(since)).some((credit) => pays(credit, asked));
-    if (!landed) {
-      return Response.json({ settled: false }, { headers: paced });
-    }
-    return Response.json(
-      { settled: true, preimage: await hmacHex(config.secret, `preimage|${subject}`) },
-      { headers: paced }
-    );
+    const preimage = await creditedPreimage({
+      secret: config.secret,
+      asked,
+      statement: config.statement,
+      lookBackSecs: config.lookBackSecs
+    });
+    return preimage === null ? Response.json({ settled: false }, { headers: paced }) : Response.json({ settled: true, preimage }, { headers: paced });
   };
 }
-function readQuery(url) {
-  const reference = url.searchParams.get("ref");
-  const minor = Number(url.searchParams.get("minor"));
-  const currency = url.searchParams.get("cc");
-  const signature = url.searchParams.get("sig");
-  if (!reference || !currency || !signature) {
+async function answeredAt(params, subject) {
+  if (params.answerBy === "agent") {
+    return `agent:${(await callerKey(params.secret)).publicKeyHex}`;
+  }
+  const polling = new URL(params.verifyUrl ?? "");
+  polling.searchParams.set(
+    "q",
+    await sealFor("bank-verify", params.secret, subject, { stable: true })
+  );
+  return polling.toString();
+}
+async function creditedPreimage(params) {
+  const since = unixNow() - (params.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
+  const landed = (await params.statement(since)).some((credit) => pays(credit, params.asked));
+  if (!landed) {
     return null;
   }
-  if (!Number.isInteger(minor) || minor <= 0) {
+  return await hmacHex(params.secret, `preimage|${subjectOf(params.asked)}`);
+}
+function askedFrom(subject) {
+  const [iban, minorText, currency, expiresText, ...rest] = subject.split("|");
+  const reference = rest.join("|");
+  const amountMinor = Number(minorText);
+  const expiresAt = Number(expiresText);
+  if (!iban || !currency || reference.length === 0) {
     return null;
   }
-  return { reference, amountMinor: minor, currency, signature };
+  if (!Number.isInteger(amountMinor) || amountMinor <= 0 || !Number.isSafeInteger(expiresAt)) {
+    return null;
+  }
+  return { iban, reference, amountMinor, currency, expiresAt };
 }
 function pays(credit, asked) {
-  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && credit.reference.toUpperCase().includes(asked.reference.toUpperCase());
+  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && namesOnly(credit.reference, asked.reference);
+}
+function namesOnly(written, reference) {
+  const wanted = reference.toUpperCase();
+  const alike = [...written.toUpperCase().matchAll(wordsShapedLike(wanted))].map(([word]) => word);
+  return alike.includes(wanted) && (!/\d/.test(wanted) || alike.every((word) => word === wanted));
+}
+function wordsShapedLike(reference) {
+  const shape = [...reference].map((char) => {
+    if (/\d/.test(char)) {
+      return "\\d";
+    }
+    return /\p{L}/u.test(char) ? "\\p{L}" : char.replace(/[\^$\\.*+?()[\]{}|/]/g, "\\$&");
+  }).join("");
+  return new RegExp(`(?<![\\p{L}\\p{N}])${shape}(?![\\p{L}\\p{N}])`, "gu");
 }
-function subjectOf(reference, amountMinor, currency) {
-  return `${reference}|${amountMinor}|${currency.toUpperCase()}`;
+function subjectOf({ iban, amountMinor, currency, expiresAt, reference }) {
+  return `${iban}|${amountMinor}|${currency.toUpperCase()}|${expiresAt}|${reference}`;
 }
 function hashOf(preimage) {
   return bytesToHex(sha256(hexToBytes(preimage)));
 }
-function shortPaymentDescriptor(params, currency) {
+function shortPaymentDescriptor(params, iban, currency) {
   const fields = [
-    `ACC:${params.iban}`,
+    `ACC:${iban}`,
     `AM:${major(params.amountMinor, currency)}`,
     `CC:${currency.toUpperCase()}`,
     `MSG:${params.reference}`
@@ -1718,19 +2152,28 @@ async function refuseAnOpenGateway(gateway, params) {
     return;
   }
   throw new Error(
-    "this gateway serves callers with no token, so it is not yours, and its operator would read the amount and the reference off every verify URL. Point at one that answers 401 to a stranger, or say allowPublicGateway"
+    "this gateway serves callers with no token, so it is not yours, and its operator would learn every watch you place. Point at one that answers 401 to a stranger, or say allowPublicGateway"
   );
 }
-function refuseUnusable(params, currency) {
-  if (!IBAN.test(params.iban)) {
+function refuseUnusable(params, iban, currency) {
+  refuseAWeakSecret(params.secret);
+  if (params.answerBy !== "agent" && params.verifyUrl === void 0) {
+    throw new Error("a transfer the gateway polls needs the verify url it is polled at");
+  }
+  if (!IBAN.test(iban)) {
     throw new Error(`${params.iban} is not an IBAN`);
   }
-  if (!Number.isInteger(params.amountMinor) || params.amountMinor <= 0) {
+  if (!Number.isSafeInteger(params.amountMinor) || params.amountMinor <= 0) {
     throw new Error("amountMinor must be a whole number of minor units above zero");
   }
   if (params.reference.length === 0) {
     throw new Error("a transfer with no reference cannot be found");
   }
+  if (params.reference.length > MAX_REFERENCE_CHARS) {
+    throw new Error(
+      `a reference is at most ${MAX_REFERENCE_CHARS} characters, as many as a QR payment's message carries and its sealed query hides`
+    );
+  }
   if (params.reference.includes(FORBIDDEN_IN_SPD)) {
     throw new Error("a reference cannot contain an asterisk, it separates the QR fields");
   }
@@ -1738,10 +2181,168 @@ function refuseUnusable(params, currency) {
     throw new Error("a variable symbol is up to ten digits");
   }
 }
+function accountOf(iban) {
+  return iban.replace(/\s+/g, "").toUpperCase();
+}
 function unixNow() {
   return Math.floor(Date.now() / 1e3);
 }
 
+// src/nostr.ts
+var import_chacha = require("@noble/ciphers/chacha.js");
+var import_secp256k1 = require("@noble/curves/secp256k1.js");
+var import_hkdf = require("@noble/hashes/hkdf.js");
+var import_hmac4 = require("@noble/hashes/hmac.js");
+var import_sha2 = require("@noble/hashes/sha2.js");
+var NIP44_SALT = new TextEncoder().encode("nip44-v2");
+var NIP44_VERSION = 2;
+var NONCE_BYTES2 = 32;
+var MAC_BYTES = 32;
+var MESSAGE_KEYS_BYTES = 76;
+var CHACHA_KEY_END = 32;
+var CHACHA_NONCE_END = 44;
+var LENGTH_PREFIX_BYTES = 2;
+var SMALLEST_PAD = 32;
+var CHUNKS_STAY_SMALL_TO = 256;
+var MAX_PLAINTEXT_BYTES = 65535;
+function publicKeyFor(privateKeyHex) {
+  return bytesToHex(import_secp256k1.schnorr.getPublicKey(hexToBytes(privateKeyHex)));
+}
+function conversationKeyFor(privateKeyHex, publicKeyHex) {
+  const shared = import_secp256k1.secp256k1.getSharedSecret(
+    hexToBytes(privateKeyHex),
+    hexToBytes(`02${publicKeyHex}`)
+  );
+  return (0, import_hkdf.extract)(import_sha2.sha256, shared.subarray(1, 33), NIP44_SALT);
+}
+function signEvent(privateKeyHex, draft) {
+  const pubkey = publicKeyFor(privateKeyHex);
+  const id = idOf(pubkey, draft);
+  return {
+    id,
+    pubkey,
+    created_at: draft.created_at,
+    kind: draft.kind,
+    tags: draft.tags,
+    content: draft.content,
+    sig: bytesToHex(import_secp256k1.schnorr.sign(hexToBytes(id), hexToBytes(privateKeyHex)))
+  };
+}
+function verifyEvent(event) {
+  try {
+    return idOf(event.pubkey, event) === event.id && import_secp256k1.schnorr.verify(hexToBytes(event.sig), hexToBytes(event.id), hexToBytes(event.pubkey));
+  } catch {
+    return false;
+  }
+}
+function idOf(pubkey, draft) {
+  return bytesToHex(
+    (0, import_sha2.sha256)(
+      new TextEncoder().encode(
+        JSON.stringify([0, pubkey, draft.created_at, draft.kind, draft.tags, draft.content])
+      )
+    )
+  );
+}
+function encryptNip44(conversationKey, plaintext) {
+  return sealNip44(conversationKey, plaintext, crypto.getRandomValues(new Uint8Array(NONCE_BYTES2)));
+}
+function sealNip44(conversationKey, plaintext, nonce) {
+  const keys = messageKeysFrom(conversationKey, nonce);
+  const ciphertext = (0, import_chacha.chacha20)(keys.chachaKey, keys.chachaNonce, padded(plaintext));
+  const mac = (0, import_hmac4.hmac)(import_sha2.sha256, keys.hmacKey, joined(nonce, ciphertext));
+  return toBase64(joined(Uint8Array.of(NIP44_VERSION), nonce, ciphertext, mac));
+}
+function decryptNip44(conversationKey, payload) {
+  if (payload.startsWith("#")) {
+    throw new Error("nip44 payload announces an encryption version we do not speak");
+  }
+  const raw = fromBase64(payload);
+  if (raw.length < 1 + NONCE_BYTES2 + MAC_BYTES) {
+    throw new Error(`nip44 payload is ${raw.length} bytes, too short to hold a nonce and a mac`);
+  }
+  if (raw[0] !== NIP44_VERSION) {
+    throw new Error(`nip44 payload is version ${raw[0]}, not ${NIP44_VERSION}`);
+  }
+  const nonce = raw.subarray(1, 1 + NONCE_BYTES2);
+  const ciphertext = raw.subarray(1 + NONCE_BYTES2, raw.length - MAC_BYTES);
+  const mac = raw.subarray(raw.length - MAC_BYTES);
+  const keys = messageKeysFrom(conversationKey, nonce);
+  if (!sameBytes((0, import_hmac4.hmac)(import_sha2.sha256, keys.hmacKey, joined(nonce, ciphertext)), mac)) {
+    throw new Error("nip44 payload failed its mac, so it was not written with this key");
+  }
+  return unpadded((0, import_chacha.chacha20)(keys.chachaKey, keys.chachaNonce, ciphertext));
+}
+function messageKeysFrom(conversationKey, nonce) {
+  if (conversationKey.length !== NONCE_BYTES2 || nonce.length !== NONCE_BYTES2) {
+    throw new Error("a nip44 conversation key and nonce are both 32 bytes");
+  }
+  const keys = (0, import_hkdf.expand)(import_sha2.sha256, conversationKey, nonce, MESSAGE_KEYS_BYTES);
+  return {
+    chachaKey: keys.subarray(0, CHACHA_KEY_END),
+    chachaNonce: keys.subarray(CHACHA_KEY_END, CHACHA_NONCE_END),
+    hmacKey: keys.subarray(CHACHA_NONCE_END)
+  };
+}
+function paddedLengthFor(unpadded2) {
+  if (unpadded2 <= SMALLEST_PAD) {
+    return SMALLEST_PAD;
+  }
+  const nextPower = 1 << Math.floor(Math.log2(unpadded2 - 1)) + 1;
+  const chunk = nextPower <= CHUNKS_STAY_SMALL_TO ? SMALLEST_PAD : nextPower / 8;
+  return chunk * (Math.floor((unpadded2 - 1) / chunk) + 1);
+}
+function padded(plaintext) {
+  const body = new TextEncoder().encode(plaintext);
+  if (body.length === 0 || body.length > MAX_PLAINTEXT_BYTES) {
+    throw new Error(`nip44 takes 1 to ${MAX_PLAINTEXT_BYTES} bytes, this was ${body.length}`);
+  }
+  const buffer = new Uint8Array(LENGTH_PREFIX_BYTES + paddedLengthFor(body.length));
+  buffer.set(Uint8Array.of(body.length >>> 8, body.length & 255));
+  buffer.set(body, LENGTH_PREFIX_BYTES);
+  return buffer;
+}
+function unpadded(buffer) {
+  const length = (buffer[0] ?? 0) << 8 | (buffer[1] ?? 0);
+  if (length === 0 || buffer.length !== LENGTH_PREFIX_BYTES + paddedLengthFor(length)) {
+    throw new Error("nip44 plaintext does not match the length its own padding declares");
+  }
+  return new TextDecoder().decode(
+    buffer.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + length)
+  );
+}
+function joined(...parts) {
+  const whole = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+  let at = 0;
+  for (const part of parts) {
+    whole.set(part, at);
+    at += part.length;
+  }
+  return whole;
+}
+function sameBytes(left, right) {
+  let different = left.length ^ right.length;
+  for (let at = 0; at < left.length && at < right.length; at++) {
+    different |= (left[at] ?? 0) ^ (right[at] ?? 0);
+  }
+  return different === 0;
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+function fromBase64(text3) {
+  const binary = atob(text3);
+  const bytes = new Uint8Array(binary.length);
+  for (let at = 0; at < bytes.length; at++) {
+    bytes[at] = binary.charCodeAt(at);
+  }
+  return bytes;
+}
+
 // src/qr.ts
 var import_uqr = require("uqr");
 var SAFE_COLOR = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$|^rgba?\([\d.,%/\s]+\)$|^[a-z]+$/i;
@@ -1752,44 +2353,276 @@ function toLightningUri(destination) {
 function invoiceToSvg(destination, options) {
   return svgOf(toLightningUri(destination), options);
 }
-function svgOf(scanned, options) {
-  const size = options?.size ?? 256;
-  const color = options?.color ?? "#000";
-  if (!SAFE_COLOR.test(color)) {
-    throw new Error(`Invalid color: ${color}`);
+function svgOf(scanned, options) {
+  const size = options?.size ?? 256;
+  const color = options?.color ?? "#000";
+  if (!SAFE_COLOR.test(color)) {
+    throw new Error(`Invalid color: ${color}`);
+  }
+  return renderSvg(scanned, size, color);
+}
+function isLnAddress(destination) {
+  const at = destination.indexOf("@");
+  return at > 0 && destination.slice(at + 1).includes(".");
+}
+function renderSvg(content, size, color) {
+  const { data } = (0, import_uqr.encode)(content);
+  const modules = data.length;
+  const cellSize = size / modules;
+  let path = "";
+  for (let y = 0; y < modules; y++) {
+    for (let x = 0; x < modules; x++) {
+      if (data[y][x]) {
+        path += `M${x * cellSize},${y * cellSize}h${cellSize}v${cellSize}h-${cellSize}z`;
+      }
+    }
+  }
+  return [
+    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${size} ${size}" width="${size}" height="${size}">`,
+    `<rect width="100%" height="100%" fill="white"/>`,
+    `<path d="${path}" fill="${color}"/>`,
+    `</svg>`
+  ].join("");
+}
+
+// src/nwc.ts
+var REQUEST_KIND = 23194;
+var RESPONSE_KIND = 23195;
+var NIP44_V2 = "nip44_v2";
+var DEFAULT_ASK_TIMEOUT_MS = 1e4;
+var DEFAULT_POLL_EVERY_SECS2 = 5;
+var HASH = "h";
+var REFUSAL_BY_CODE = {
+  INSUFFICIENT_BALANCE: "amount-not-accepted",
+  QUOTA_EXCEEDED: "amount-not-accepted",
+  RESTRICTED: "address-unusable",
+  UNAUTHORIZED: "address-unusable",
+  UNSUPPORTED_ENCRYPTION: "address-unusable"
+};
+async function nwcInvoice(connection, amountMsat, description, timeoutMs = DEFAULT_ASK_TIMEOUT_MS) {
+  const answered3 = await askWallet(
+    connection,
+    "make_invoice",
+    { amount: amountMsat, description },
+    timeoutMs
+  );
+  const bolt11 = String(answered3.invoice ?? "");
+  const issued = decodeInvoice(bolt11);
+  if (issued.paymentHash === null || issued.expiresAt === null) {
+    throw new WalletRefused("invoice-refused", "the nwc wallet issued an invoice we cannot decode");
+  }
+  if (issued.amountMsat !== amountMsat) {
+    throw new WalletRefused(
+      "invoice-refused",
+      `the nwc wallet issued an invoice for ${issued.amountMsat} msat, not ${amountMsat}`
+    );
+  }
+  return { bolt11, paymentHash: issued.paymentHash, expiresAt: issued.expiresAt };
+}
+async function nwcSettlement(connection, paymentHash, timeoutMs = DEFAULT_ASK_TIMEOUT_MS) {
+  const answered3 = await askWallet(
+    connection,
+    "lookup_invoice",
+    { payment_hash: paymentHash },
+    timeoutMs
+  );
+  const preimage = answered3.preimage;
+  if (typeof preimage !== "string" || preimage.length === 0) {
+    return null;
+  }
+  if (!preimageMatchesHash(preimage, paymentHash)) {
+    throw new Error(`the nwc wallet returned a preimage that does not hash to ${paymentHash}`);
+  }
+  return preimage;
+}
+function nwcVerifyEndpoint(config) {
+  const paced = {
+    "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS2}`
+  };
+  return async (request) => {
+    const consented = await answerVerifyChallenge(request);
+    if (consented !== null) {
+      return consented;
+    }
+    const sealed = new URL(request.url).searchParams.get(HASH);
+    if (sealed === null) {
+      return Response.json({ settled: false }, { status: 400 });
+    }
+    const paymentHash = await unsealFor("nwc-verify", config.secret, sealed);
+    if (paymentHash === null) {
+      return Response.json({ settled: false }, { status: 403 });
+    }
+    const preimage = await nwcSettlement(config.connection, paymentHash, config.askTimeoutMs).catch(
+      () => void 0
+    );
+    if (preimage === void 0) {
+      return Response.json({ settled: false }, { status: 502 });
+    }
+    return Response.json({ settled: preimage !== null, preimage }, { headers: paced });
+  };
+}
+async function nwcVerifyUrl(endpoint, paymentHash, secret) {
+  const sealed = new URL(endpoint);
+  sealed.searchParams.set(HASH, await sealFor("nwc-verify", secret, paymentHash));
+  return sealed.toString();
+}
+async function askWallet(connection, method, params, timeoutMs = DEFAULT_ASK_TIMEOUT_MS) {
+  const key = conversationKeyFor(connection.secret, connection.walletPubkey);
+  const request = signEvent(connection.secret, {
+    kind: REQUEST_KIND,
+    tags: [
+      ["p", connection.walletPubkey],
+      ["encryption", NIP44_V2]
+    ],
+    content: encryptNip44(key, JSON.stringify({ method, params })),
+    created_at: Math.floor(Date.now() / 1e3)
+  });
+  const answer = await overFirstRelayThatAnswers(connection, request, timeoutMs);
+  return resultOf(JSON.parse(decryptNip44(key, answer.content)), method);
+}
+function resultOf(said, method) {
+  const failure = said.error;
+  if (failure) {
+    throw new WalletRefused(
+      REFUSAL_BY_CODE[failure.code ?? ""] ?? "invoice-refused",
+      `the nwc wallet refused ${method}: ${failure.code ?? "unknown"} ${failure.message ?? ""}`.trim()
+    );
+  }
+  const result = said.result;
+  if (result === null || typeof result !== "object") {
+    throw new WalletRefused("invoice-refused", `the nwc wallet answered ${method} with no result`);
+  }
+  return result;
+}
+async function overFirstRelayThatAnswers(connection, request, timeoutMs) {
+  const deadline = AbortSignal.timeout(timeoutMs);
+  let lastFailure = null;
+  for (const relay of connection.relays) {
+    if (deadline.aborted) {
+      break;
+    }
+    try {
+      return await overRelay(relay, connection, request, deadline);
+    } catch (failure) {
+      lastFailure = failure;
+    }
+  }
+  throw new WalletRefused("unreachable", `no nwc relay answered: ${String(lastFailure)}`);
+}
+function overRelay(relay, connection, request, deadline) {
+  return new Promise((resolve2, reject) => {
+    const socket = new WebSocket(relay);
+    const subscription = request.id.slice(0, 16);
+    const expired = () => {
+      close();
+      reject(new Error(`${relay} did not answer before the deadline`));
+    };
+    deadline.addEventListener("abort", expired);
+    function close() {
+      deadline.removeEventListener("abort", expired);
+      socket.close();
+    }
+    socket.addEventListener("open", () => {
+      socket.send(
+        JSON.stringify([
+          "REQ",
+          subscription,
+          {
+            kinds: [RESPONSE_KIND],
+            authors: [connection.walletPubkey],
+            "#p": [publicKeyFor(connection.secret)],
+            "#e": [request.id]
+          }
+        ])
+      );
+      socket.send(JSON.stringify(["EVENT", request]));
+    });
+    socket.addEventListener("error", () => {
+      close();
+      reject(new Error(`${relay} could not be reached`));
+    });
+    socket.addEventListener("message", (delivered) => {
+      const frame = String(delivered.data);
+      const rejection = rejectionOf(frame, request.id);
+      if (rejection !== null) {
+        close();
+        reject(new Error(`${relay} refused the request: ${rejection}`));
+        return;
+      }
+      const answer = answeredEvent(frame, subscription, connection, request.id);
+      if (answer === null) {
+        return;
+      }
+      close();
+      resolve2(answer);
+    });
+  });
+}
+function rejectionOf(frame, requestId) {
+  const parsed = parsedFrame(frame);
+  if (parsed === null || parsed[0] !== "OK" || parsed[1] !== requestId || parsed[2] !== false) {
+    return null;
   }
-  return renderSvg(scanned, size, color);
+  return typeof parsed[3] === "string" && parsed[3].length > 0 ? parsed[3] : "no reason given";
 }
-function isLnAddress(destination) {
-  const at = destination.indexOf("@");
-  return at > 0 && destination.slice(at + 1).includes(".");
+function answeredEvent(frame, subscription, connection, requestId) {
+  const parsed = parsedFrame(frame);
+  if (parsed === null || parsed[0] !== "EVENT" || parsed[1] !== subscription) {
+    return null;
+  }
+  const event = parsed[2];
+  const answers = event?.kind === RESPONSE_KIND && event.pubkey === connection.walletPubkey && Array.isArray(event.tags) && event.tags.some((tag) => tag?.[0] === "e" && tag[1] === requestId) && verifyEvent(event);
+  return answers ? event : null;
 }
-function renderSvg(content, size, color) {
-  const { data } = (0, import_uqr.encode)(content);
-  const modules = data.length;
-  const cellSize = size / modules;
-  let path = "";
-  for (let y = 0; y < modules; y++) {
-    for (let x = 0; x < modules; x++) {
-      if (data[y][x]) {
-        path += `M${x * cellSize},${y * cellSize}h${cellSize}v${cellSize}h-${cellSize}z`;
-      }
-    }
+function parsedFrame(frame) {
+  try {
+    const parsed = JSON.parse(frame);
+    return Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
   }
-  return [
-    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${size} ${size}" width="${size}" height="${size}">`,
-    `<rect width="100%" height="100%" fill="white"/>`,
-    `<path d="${path}" fill="${color}"/>`,
-    `</svg>`
-  ].join("");
+}
+function nwcRail(gateway, config) {
+  return async (order) => {
+    const invoice = await nwcInvoice(
+      config.connection,
+      await msatForOrder(order, config.amount, config.rate),
+      config.description?.(order) ?? order.reference
+    );
+    const watched = await gateway.watch({
+      paymentHash: invoice.paymentHash,
+      verifyUrl: await nwcVerifyUrl(
+        config.verifyThrough.endpoint,
+        invoice.paymentHash,
+        config.verifyThrough.secret
+      ),
+      expiresAt: invoice.expiresAt,
+      trigger: config.trigger,
+      replay: config.replay,
+      sealed: config.sealed ? await seal(
+        config.sealed.secret,
+        JSON.stringify(config.sealed.data(order)),
+        invoice.paymentHash
+      ) : void 0,
+      webhookUrl: config.webhookUrl
+    });
+    return {
+      id: watched.id,
+      paymentHash: invoice.paymentHash,
+      rail: config.name ?? "lightning",
+      scan: invoice.bolt11,
+      qr: toLightningUri(invoice.bolt11),
+      expiresAt: invoice.expiresAt
+    };
+  };
 }
 
 // src/relay.ts
-var DEFAULT_POLL_EVERY_SECS2 = 5;
+var DEFAULT_POLL_EVERY_SECS3 = 5;
 var WALLET = "w";
 function lightningVerifyEndpoint(config) {
   const paced = {
-    "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS2}`
+    "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS3}`
   };
   return async (request) => {
     const consented = await answerVerifyChallenge(request);
@@ -1800,11 +2633,11 @@ function lightningVerifyEndpoint(config) {
     if (sealed === null) {
       return Response.json({ settled: false }, { status: 400 });
     }
-    const opened = await unseal(config.secret, sealed);
-    if (opened === null) {
+    const opened2 = await unsealFor("relay", config.secret, sealed);
+    const wallet = opened2 === null ? null : relayedFrom(opened2);
+    if (wallet === null) {
       return Response.json({ settled: false }, { status: 403 });
     }
-    const wallet = JSON.parse(opened);
     const asked = await checkSettled(
       config.send ?? pinnedToTheAddressWeVerified,
       wallet.url,
@@ -1819,9 +2652,17 @@ function lightningVerifyEndpoint(config) {
     );
   };
 }
+function relayedFrom(opened2) {
+  try {
+    const said = JSON.parse(opened2);
+    return typeof said?.url === "string" && typeof said.hash === "string" ? { url: said.url, hash: said.hash } : null;
+  } catch {
+    return null;
+  }
+}
 async function relayedVerifyUrl(endpoint, wallet, secret) {
   const relayed = new URL(endpoint);
-  relayed.searchParams.set(WALLET, await seal(secret, JSON.stringify(wallet)));
+  relayed.searchParams.set(WALLET, await sealFor("relay", secret, JSON.stringify(wallet)));
   return relayed.toString();
 }
 
@@ -1841,13 +2682,14 @@ function bankRail(gateway, config) {
       expiresAt,
       trigger: config.trigger,
       replay: config.replay,
-      sealed: await config.sealed?.(order),
+      sealed: config.sealed && { secret: config.sealed.secret, data: config.sealed.data(order) },
       variableSymbol: config.variableSymbol?.(order),
       webhookUrl: config.webhookUrl,
       allowPublicGateway: config.allowPublicGateway
     });
     return {
       id: transfer.id,
+      paymentHash: transfer.paymentHash,
       rail: config.name ?? BANK,
       scan: transfer.spd,
       qr: transfer.spd,
@@ -1871,6 +2713,7 @@ function lightningRail(gateway, config) {
     );
     return {
       id: payment.id,
+      paymentHash: payment.paymentHash,
       rail: config.name ?? LIGHTNING,
       scan: payment.bolt11,
       qr: toLightningUri(payment.bolt11),
@@ -1896,11 +2739,16 @@ function blindLightningRail(gateway, config) {
       expiresAt: resolved2.expiresAt,
       trigger: config.trigger,
       replay: config.replay,
-      sealed: await config.sealed?.(order),
+      sealed: config.sealed ? await seal(
+        config.sealed.secret,
+        JSON.stringify(config.sealed.data(order)),
+        resolved2.paymentHash
+      ) : void 0,
       webhookUrl: config.webhookUrl
     });
     return {
       id: watched.id,
+      paymentHash: resolved2.paymentHash,
       rail: config.name ?? LIGHTNING,
       scan: resolved2.bolt11,
       qr: toLightningUri(resolved2.bolt11),
@@ -1945,6 +2793,15 @@ var Rails = class {
   bank(config) {
     return bankRail(this.gateway, config);
   }
+  /**
+   * Lightning against a wallet of your own over NIP-47, for a wallet that has no
+   * LUD-21 address to be watched at. Your node mints the invoice and releases the
+   * preimage, so the proof comes from one hop nearer than any hosted address can
+   * manage, and the gateway sees a hash and a URL of yours
+   */
+  nwc(config) {
+    return nwcRail(this.gateway, config);
+  }
   /**
    * One bank transfer without building a rail first, for a shop that asks for
    * them one at a time rather than beside another payment method
@@ -1954,130 +2811,6 @@ var Rails = class {
   }
 };
 
-// src/verify.ts
-var HTTP_TIMEOUT_MS2 = 15e3;
-var DEFAULT_WRAP_PROPORTION = 0.01;
-var DEFAULT_WRAP_BASE_MSAT = 1e3;
-async function proveOrigin(payment, asked) {
-  const cheat = (code) => new GatewayCheatError(code, payment.id);
-  const listed = asked.paidTo.find((address) => equalIgnoringCase(address, payment.lnAddress));
-  if (listed === void 0) {
-    throw cheat("address_not_requested");
-  }
-  if (payment.amountMsat !== asked.amountMsat) {
-    throw cheat("amount_mismatch");
-  }
-  const invoice = decodeInvoice(payment.bolt11);
-  if (invoice.paymentHash === null || !equalIgnoringCase(invoice.paymentHash, payment.paymentHash)) {
-    throw cheat("hash_mismatch");
-  }
-  if (invoice.amountMsat !== asked.amountMsat) {
-    throw cheat("amount_mismatch");
-  }
-  const payRequest = await payRequestFor(listed, payment);
-  if (typeof payRequest.metadata !== "string" || typeof payRequest.callback !== "string") {
-    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "no payRequest served");
-  }
-  if (invoice.descriptionHash !== sha256Hex(payRequest.metadata)) {
-    throw cheat("description_hash_mismatch");
-  }
-  if (!sameOrigin(payment.verifyUrl, payRequest.callback)) {
-    throw cheat("verify_url_foreign");
-  }
-  const issued = await reachable(payment.verifyUrl, payment);
-  if (typeof issued.pr !== "string" || !equalIgnoringCase(issued.pr, payment.bolt11)) {
-    throw cheat("invoice_not_issued");
-  }
-}
-async function proveSettlement(payment, asked) {
-  await proveOrigin(payment, asked);
-  const verified = await reachable(payment.verifyUrl, payment);
-  if (verified.settled !== true || typeof verified.preimage !== "string") {
-    return null;
-  }
-  if (!preimageMatchesHash(verified.preimage, payment.paymentHash)) {
-    throw new GatewayCheatError("preimage_mismatch", payment.id);
-  }
-  return verified.preimage;
-}
-function carriesProof(report) {
-  if (report.status !== "paid" || report.preimage === null) {
-    return false;
-  }
-  if (report.bolt11 !== void 0 && report.bolt11 !== null) {
-    const invoiceHash = decodeInvoice(report.bolt11).paymentHash;
-    if (invoiceHash === null || !equalIgnoringCase(invoiceHash, report.paymentHash)) {
-      return false;
-    }
-  }
-  return preimageMatchesHash(report.preimage, report.paymentHash);
-}
-function wrapFeeCeiling(amountMsat, allowance) {
-  const proportional = amountMsat * (allowance?.proportion ?? DEFAULT_WRAP_PROPORTION);
-  return msat(Math.max(allowance?.baseMsat ?? DEFAULT_WRAP_BASE_MSAT, Math.floor(proportional)));
-}
-function proveWrapped(wrapped, recipient, allowance) {
-  const offered = decodeInvoice(wrapped);
-  const owed = decodeInvoice(recipient);
-  const refuse2 = (code, detail) => {
-    throw new WrapRefusedError(code, detail);
-  };
-  if (offered.paymentHash === null || offered.amountMsat === null || offered.expiresAt === null) {
-    refuse2("undecodable", "the wrapped invoice carries no hash, amount or expiry");
-  }
-  if (owed.paymentHash === null || owed.amountMsat === null || owed.expiresAt === null) {
-    refuse2("undecodable", "the recipient's invoice carries no hash, amount or expiry");
-  }
-  if (offered.paymentHash?.toLowerCase() !== owed.paymentHash?.toLowerCase()) {
-    refuse2("hash_mismatch", "settling the wrap would not settle the recipient");
-  }
-  const asked = offered.amountMsat ?? 0;
-  const due = owed.amountMsat ?? 0;
-  if (asked < due) {
-    refuse2("amount_below_recipient", `${asked} msat cannot forward ${due} msat`);
-  }
-  const ceiling = wrapFeeCeiling(due, allowance);
-  if (asked - due > ceiling) {
-    refuse2("fee_above_allowance", `${asked - due} msat over ${due}, and ${ceiling} was allowed`);
-  }
-  if ((owed.expiresAt ?? 0) <= (offered.expiresAt ?? 0)) {
-    refuse2("recipient_expires_first", "the operator could be paid and find it cannot deliver");
-  }
-}
-async function payRequestFor(listed, payment) {
-  const at = listed.indexOf("@");
-  const name = listed.slice(0, at);
-  const domain = listed.slice(at + 1).toLowerCase();
-  if (at < 1 || !publicHttps(`https://${domain}/`)) {
-    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, "not a usable address");
-  }
-  return reachable(`https://${domain}/.well-known/lnurlp/${name}`, payment);
-}
-async function reachable(url, payment) {
-  try {
-    if (!publicHttps(url)) {
-      throw new Error(`${url} is not a public https URL`);
-    }
-    const response = await fetch(url, {
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2),
-      headers: { accept: "application/json" }
-    });
-    if (!response.ok) {
-      throw new Error(`answered ${response.status}`);
-    }
-    const body = await response.json();
-    if (body === null || typeof body !== "object") {
-      throw new Error("answered with no JSON object");
-    }
-    return body;
-  } catch (cause) {
-    throw new UnverifiedRecipientError(payment.lnAddress, payment.id, cause);
-  }
-}
-function equalIgnoringCase(one, other) {
-  return one.toLowerCase() === other.toLowerCase();
-}
-
 // src/request.ts
 function paymentRequestOf(gateway, payment, options) {
   return {
@@ -2089,13 +2822,13 @@ function paymentRequestOf(gateway, payment, options) {
     expiresAt: payment.expiresAt,
     qr: invoiceToSvg(payment.bolt11, options?.qr),
     payment,
-    paid: async (waiting) => paidOnly(await gateway.settled(payment.id, { ...waitingOf(options), ...waiting })),
+    paid: async (waiting) => paidOnly(await gateway.settled(payment, { ...waitingOf(options), ...waiting })),
     prove: () => proveSettlement(payment, { paidTo: [payment.lnAddress], amountMsat: payment.amountMsat }),
     onPaid: (arrived, failed) => {
       const stop = new AbortController();
       const waiting = waitingOf(options);
       const signal = waiting.signal ? AbortSignal.any([stop.signal, waiting.signal]) : stop.signal;
-      gateway.settled(payment.id, { ...waiting, signal }).then((ended) => arrived(paidOnly(ended))).catch((reason) => {
+      gateway.settled(payment, { ...waiting, signal }).then((ended) => arrived(paidOnly(ended))).catch((reason) => {
         if (!stop.signal.aborted) {
           failed?.(reason);
         }
@@ -2118,7 +2851,7 @@ function waitingOf(options) {
 }
 
 // src/trigger.ts
-var NONCE_BYTES = 16;
+var NONCE_BYTES3 = 16;
 function lnurlPayEndpoint(gateway, config) {
   return async (request) => {
     const url = new URL(request.url);
@@ -2144,22 +2877,37 @@ function publicWatchTicketEndpoint(gateway, config) {
 }
 async function offer(gateway, config, url) {
   const { least, most } = await spread(config.amount);
-  const quote = await gateway.quote({ paidTo: config.paidTo, amount: msat(least) });
+  const winner = await quoted(gateway, config, least);
   const nonce = randomNonce();
   const callback = new URL(config.baseUrl ?? `${url.origin}${url.pathname}`);
-  callback.searchParams.set("to", quote.lnAddress);
+  callback.searchParams.set("to", winner.address);
   callback.searchParams.set("least", String(least));
   callback.searchParams.set("most", String(most));
   callback.searchParams.set("n", nonce);
-  callback.searchParams.set("sig", await sign(config.secret, quote.lnAddress, least, most, nonce));
+  callback.searchParams.set("sig", await sign(config.secret, winner.address, least, most, nonce));
   return Response.json({
     tag: "payRequest",
     callback: callback.toString(),
-    metadata: quote.metadata,
+    metadata: winner.metadata,
     minSendable: least,
     maxSendable: most
   });
 }
+async function quoted(gateway, config, amountMsat) {
+  if (config.blind) {
+    const { won } = await quote(
+      config.send ?? pinnedToTheAddressWeVerified,
+      listed(config.paidTo),
+      amountMsat
+    );
+    return won;
+  }
+  const { lnAddress, metadata } = await gateway.quote({
+    paidTo: config.paidTo,
+    amount: msat(amountMsat)
+  });
+  return { address: lnAddress, metadata };
+}
 async function spread(amount) {
   if (typeof amount === "number" || typeof amount === "function") {
     const pinned = await amountNow(amount);
@@ -2181,6 +2929,9 @@ async function mint(gateway, config, url, address) {
   if (!equalInConstantTime(signature, expected)) {
     return refuse("this callback was not signed here");
   }
+  if (!listed(config.paidTo).some((one) => one.toLowerCase() === address.toLowerCase())) {
+    return refuse(`${address} is not paid through this trigger`);
+  }
   const asked = url.searchParams.get("amount");
   const amountMsat = asked === null ? least : Number(asked);
   if (!Number.isSafeInteger(amountMsat) || amountMsat < least || amountMsat > most) {
@@ -2223,7 +2974,7 @@ async function mintBlind(gateway, config, address, amountMsat) {
       expiresAt: resolved2.expiresAt,
       trigger: config.watchSecret,
       replay: config.replay,
-      sealed: locked ? await seal(locked.secret, JSON.stringify(locked.data(minted))) : void 0
+      sealed: locked ? await seal(locked.secret, JSON.stringify(locked.data(minted)), minted.paymentHash) : void 0
     });
   } catch (refused) {
     if (!alreadyWatched(refused)) {
@@ -2232,14 +2983,17 @@ async function mintBlind(gateway, config, address, amountMsat) {
   }
   return { bolt11: resolved2.bolt11, verifyUrl: resolved2.verifyUrl };
 }
+function listed(paidTo) {
+  return typeof paidTo === "string" ? [paidTo] : paidTo;
+}
 function alreadyWatched(refused) {
   return refused instanceof ProblemError && isProblemType(refused, PAYMENT_ALREADY_WATCHED);
 }
 function sign(secret, address, least, most, nonce) {
-  return hmacHex(secret, `${address}|${least}|${most}|${nonce}`);
+  return hmacHex(secret, `lnurl-callback|${address}|${least}|${most}|${nonce}`);
 }
 function randomNonce() {
-  const bytes = crypto.getRandomValues(new Uint8Array(NONCE_BYTES));
+  const bytes = crypto.getRandomValues(new Uint8Array(NONCE_BYTES3));
   let hex = "";
   for (const byte of bytes) {
     hex += byte.toString(16).padStart(2, "0");
@@ -2289,23 +3043,39 @@ var Serve = class {
    * A verify endpoint of your own that asks the recipient's wallet for you, so
    * the gateway polls you and never the wallet
    */
-  verify(config) {
+  lightningVerify(config) {
     return lightningVerifyEndpoint(config);
   }
+  /**
+   * What `lightningVerify` was called before 2.2.0
+   *
+   * @deprecated Use `lightningVerify`, beside `bankVerify` and `nwcVerify`
+   */
+  verify(config) {
+    return this.lightningVerify(config);
+  }
   /** The verify endpoint a bank rail is polled at, answering off your own statement */
   bankVerify(config) {
     return bankVerifyEndpoint(config);
   }
+  /**
+   * The verify endpoint an NWC rail is polled at, asking your own wallet over
+   * NIP-47, so the gateway never learns the connection, the relay or the wallet
+   */
+  nwcVerify(config) {
+    return nwcVerifyEndpoint(config);
+  }
   /**
    * The whole webhook route: it answers the gateway's challenge, checks the
    * signature against the key the gateway publishes, refuses a settlement that
-   * proves nothing, and calls you for the one that does.
+   * proves nothing, and calls you once for the one that does.
    *
    * `export const POST = gateway.serve.webhook({ onSettled: fulfil })` is the
    * entire integration
    */
   webhook(handlers) {
-    const options = { toleranceSecs: handlers.toleranceSecs };
+    const options = { toleranceSecs: handlers.toleranceSecs, url: handlers.url };
+    const once = onceWhileReplayable(handlers.toleranceSecs ?? DEFAULT_TOLERANCE_SECS);
     return async (request) => {
       const credential = await this.credential(handlers);
       const challenge = await answerWebhookChallenge(request, credential, options);
@@ -2314,12 +3084,17 @@ var Serve = class {
       }
       const settlement = await readSettlement(request, credential, options);
       if (settlement !== null) {
-        return await acted(settlement, handlers);
+        return await once(
+          `${settlement.id}:${settlement.status}`,
+          () => acted(settlement, handlers)
+        );
       }
       const payment = await readPayment(request, credential, options);
       if (payment !== null) {
-        await handlers.onPayment?.(payment);
-        return new Response("ok");
+        return await once(`${payment.id}:${payment.status}`, async () => {
+          await handlers.onPayment?.(payment);
+          return new Response("ok");
+        });
       }
       return new Response("bad signature", { status: 401 });
     };
@@ -2340,8 +3115,34 @@ var Serve = class {
     return handlers.credential ?? { publicKey: await this.gateway.webhookKey() };
   }
 };
+function onceWhileReplayable(toleranceSecs) {
+  const acting = /* @__PURE__ */ new Map();
+  const replayableForMs = 2 * toleranceSecs * 1e3;
+  return async (delivery, act) => {
+    const now = Date.now();
+    for (const [earlier2, { forgetAt }] of acting) {
+      if (forgetAt > now) {
+        break;
+      }
+      acting.delete(earlier2);
+    }
+    const earlier = acting.get(delivery);
+    if (earlier !== void 0) {
+      await earlier.done;
+      return new Response("ok");
+    }
+    const done = act();
+    acting.set(delivery, { forgetAt: now + replayableForMs, done });
+    try {
+      return await done;
+    } catch (failure) {
+      acting.delete(delivery);
+      throw failure;
+    }
+  };
+}
 async function acted(settlement, handlers) {
-  if (carriesProof(settlement)) {
+  if (agreesWithItself(settlement)) {
     await handlers.onSettled?.(settlement);
     return new Response("ok");
   }
@@ -2371,6 +3172,21 @@ function backoffMs(firstDelay, attempt) {
   const grown = Math.min(firstDelay * 2 ** (attempt - 1), RECONNECT_CAP_MS);
   return Math.round(grown * (0.5 + Math.random() / 2));
 }
+function askFromWire(raw) {
+  let said;
+  try {
+    said = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof said !== "object" || said === null) {
+    return null;
+  }
+  const fields = said;
+  const ask2 = fields["ask"];
+  const paymentHash = fields["payment_hash"];
+  return typeof ask2 === "string" && typeof paymentHash === "string" ? { ask: ask2, paymentHash } : null;
+}
 function gatewayAt(baseUrl) {
   const at = URL.canParse(baseUrl) ? new URL(baseUrl) : null;
   if (at === null || at.protocol !== "http:" && at.protocol !== "https:") {
@@ -2380,8 +3196,8 @@ function gatewayAt(baseUrl) {
 }
 var ThunderBridge = class {
   baseUrl;
-  verify;
   token;
+  handedOut = /* @__PURE__ */ new Map();
   secret;
   strangers = null;
   speaks = null;
@@ -2392,7 +3208,6 @@ var ThunderBridge = class {
   rails;
   constructor(baseUrl, options) {
     this.baseUrl = gatewayAt(baseUrl);
-    this.verify = options?.verify ?? true;
     this.token = options?.token ?? null;
     this.secret = options?.secret ?? null;
     this.serve = new Serve(this);
@@ -2434,6 +3249,7 @@ var ThunderBridge = class {
    * and `GatewayCheatError` when what comes back is not what you asked for
    */
   async mint(charge, options) {
+    const askedAt = Math.floor(Date.now() / 1e3);
     const asked = await priced(charge);
     const sent = createRequestBody(
       asked,
@@ -2454,9 +3270,8 @@ var ThunderBridge = class {
       throw await problemFrom(response);
     }
     const payment = await mintedFrom(response);
-    if (this.verify) {
-      await proveOrigin(payment, asked);
-    }
+    await proveOrigin(payment, asked, askedAt);
+    this.handOut(payment, options?.idempotencyKey ?? null);
     return payment;
   }
   /**
@@ -2467,7 +3282,8 @@ var ThunderBridge = class {
    * it for one, and asking mints it
    */
   async quote(charge) {
-    const sent = quoteRequestBody(await priced(charge));
+    const asked = await priced(charge);
+    const sent = quoteRequestBody(asked);
     const response = await fetch(`${this.baseUrl}/quotes`, {
       method: "POST",
       headers: await this.sending("/quotes", sent),
@@ -2476,14 +3292,17 @@ var ThunderBridge = class {
     if (!response.ok) {
       throw await problemFrom(response);
     }
-    const quote = quoteFromWire(await response.json().catch(() => null));
-    if (quote === null) {
+    const quote2 = quoteFromWire(await response.json().catch(() => null));
+    if (quote2 === null) {
       throw new ProblemError({
         status: response.status,
         title: "The gateway answered with something that is not a quote"
       });
     }
-    return quote;
+    if (!asked.paidTo.some((address) => address.toLowerCase() === quote2.lnAddress.toLowerCase())) {
+      throw new GatewayCheatError("address_not_requested", "");
+    }
+    return quote2;
   }
   /**
    * The key this gateway signs webhooks with when you registered none of your own.
@@ -2516,8 +3335,8 @@ var ThunderBridge = class {
    * for both sorts: `kind` says whether the gateway minted it or was handed it,
    * and the address, amount and invoice are null on one it was never told
    */
-  async payment(id) {
-    const path = `/incoming-payments/${encodeURIComponent(id)}`;
+  async payment(held) {
+    const path = `/incoming-payments/${encodeURIComponent(held.id)}`;
     const response = await fetch(`${this.baseUrl}${path}`, {
       headers: await this.reading("GET", path)
     });
@@ -2527,7 +3346,7 @@ var ThunderBridge = class {
     if (!response.ok) {
       throw await problemFrom(response);
     }
-    return this.proven(await paymentFrom(response));
+    return this.proven(await paymentFrom(response), held);
   }
   /**
    * List what this gateway is watching, newest first. Only a gateway started
@@ -2547,14 +3366,14 @@ var ThunderBridge = class {
       throw await problemFrom(response);
     }
     const body = await response.json().catch(() => null);
-    const listed = Array.isArray(body?.payments) ? body.payments.map(paymentFromWire).filter((one) => one !== null) : null;
-    if (listed === null || typeof body?.settled_scanned !== "number") {
+    const listed2 = Array.isArray(body?.payments) ? body.payments.map(paymentFromWire).filter((one) => one !== null).filter((one) => one.status !== "paid" || agreesWithItself(one)) : null;
+    if (listed2 === null || typeof body?.settled_scanned !== "number") {
       throw new ProblemError({
         status: response.status,
         title: "The gateway answered with something that is not a payment list"
       });
     }
-    return { payments: listed, scanned: body.settled_scanned };
+    return { payments: listed2, scanned: body.settled_scanned };
   }
   /**
    * Follow a payment over WebSocket until it is paid or expired, reconnecting
@@ -2562,15 +3381,15 @@ var ThunderBridge = class {
    * one that has answered is followed until its own expiry, so the wait always
    * ends by itself
    */
-  async settled(id, options) {
-    const ended = paymentFromWire(await this.followed(id, options));
+  async settled(held, options) {
+    const ended = paymentFromWire(await this.followed(held.id, options));
     if (ended === null) {
       throw new ProblemError({
         status: 200,
         title: "The gateway answered with something that is not a payment"
       });
     }
-    return this.proven(ended);
+    return this.proven(ended, held);
   }
   followed(id, options) {
     const base = this.baseUrl.replace(/^http/, "ws");
@@ -2632,9 +3451,9 @@ var ThunderBridge = class {
         if (settled) {
           return;
         }
-        const opened = new WebSocket(url);
-        socket = opened;
-        opened.onmessage = (event) => {
+        const opened2 = new WebSocket(url);
+        socket = opened2;
+        opened2.onmessage = (event) => {
           try {
             const frame = JSON.parse(String(event.data));
             const watched = paymentFromWire(frame);
@@ -2651,7 +3470,7 @@ var ThunderBridge = class {
             settle(() => reject(refused));
           }
         };
-        opened.onclose = again;
+        opened2.onclose = again;
       };
       options?.signal?.addEventListener("abort", abort, { once: true });
       void connect();
@@ -2674,25 +3493,33 @@ var ThunderBridge = class {
    * the recipient's own wallet minted it, so a payer who pays the loser afterwards
    * really does pay twice and that shows up on `follow` as a second settlement to
    * refund.
+   *
+   * A leg the gateway is caught lying about before any leg is paid ends the wait
+   * with its `GatewayCheatError`, even when another leg is paid after it, so a
+   * detected cheat is never traded for a later win.
    */
-  async firstSettled(ids, options) {
-    if (ids.length === 0) {
+  async firstSettled(held, options) {
+    if (held.length === 0) {
       return null;
     }
     const stopLosers = new AbortController();
     const signal = options?.signal ? AbortSignal.any([stopLosers.signal, options.signal]) : stopLosers.signal;
     let refused = null;
     try {
-      const winner = await new Promise((resolve2) => {
-        let waiting = ids.length;
+      const winner = await new Promise((resolve2, caught) => {
+        let waiting = held.length;
         const lost = () => {
           waiting -= 1;
           if (waiting === 0) {
             resolve2(null);
           }
         };
-        for (const id of ids) {
-          this.settled(id, { ...options, signal }).then((watched) => watched.status === "paid" ? resolve2(watched) : lost()).catch((failure) => {
+        for (const leg of held) {
+          this.settled(leg, { ...options, signal }).then((watched) => watched.status === "paid" ? resolve2(watched) : lost()).catch((failure) => {
+            if (failure instanceof GatewayCheatError) {
+              caught(failure);
+              return;
+            }
             refused ??= failure;
             lost();
           });
@@ -2736,6 +3563,9 @@ var ThunderBridge = class {
     if (named !== null && watched.id !== named) {
       throw new GatewayCheatError("id_not_mine", watched.id);
     }
+    if (watched.paymentHash.toLowerCase() !== handover.paymentHash.toLowerCase()) {
+      throw new GatewayCheatError("hash_mismatch", watched.id);
+    }
     return watched;
   }
   /**
@@ -2748,6 +3578,69 @@ var ThunderBridge = class {
   async nameFor(paymentHash) {
     return this.secret === null ? null : paymentNamedBy((await this.speaking()).publicKeyHex, paymentHash);
   }
+  /**
+   * Hold a socket open and answer what the gateway asks about this caller's own
+   * payments, so a watch addressed to this caller settles without anybody
+   * hosting a URL. Reconnects on its own until the returned function is called
+   */
+  attend(options) {
+    const base = this.baseUrl.replace(/^http/, "ws");
+    const firstDelay = options.reconnectDelayMs ?? RECONNECT_DELAY_MS;
+    let socket = null;
+    let retry;
+    let stopped = false;
+    let attempt = 0;
+    const again = () => {
+      if (stopped || options.reconnect === false) {
+        return;
+      }
+      retry = setTimeout(() => void connect(), backoffMs(firstDelay, attempt));
+    };
+    const answered3 = async (opened2, raw) => {
+      const asked = askFromWire(raw);
+      if (asked === null) {
+        return;
+      }
+      const preimage = await options.answer(asked.paymentHash);
+      opened2.send(
+        JSON.stringify(
+          preimage === null ? { ask: asked.ask, settled: false } : { ask: asked.ask, settled: true, preimage }
+        )
+      );
+    };
+    const connect = async () => {
+      attempt += 1;
+      let url;
+      try {
+        url = `${base}/ws/tickets/${await this.wsTicket({ agent: true })}`;
+      } catch (refused) {
+        options.onError?.(refused);
+        again();
+        return;
+      }
+      if (stopped) {
+        return;
+      }
+      const opened2 = new WebSocket(url);
+      socket = opened2;
+      opened2.onopen = () => {
+        attempt = 1;
+      };
+      opened2.onmessage = (event) => {
+        void answered3(opened2, String(event.data)).catch(
+          (refused) => options.onError?.(refused)
+        );
+      };
+      opened2.onerror = () => options.onError?.(new Error(`could not attend ${base}`));
+      opened2.onclose = again;
+    };
+    void connect();
+    return () => {
+      stopped = true;
+      clearTimeout(retry);
+      socket?.close();
+    };
+  }
   /**
    * Follow every payment made to one trigger, replayed from the recent ones on
    * connect and then live, reconnecting on its own until the returned function
@@ -2824,7 +3717,7 @@ var ThunderBridge = class {
     });
   }
   needsTicket(asked) {
-    return asked === true || this.token !== null;
+    return asked === true || this.token !== null || this.secret !== null;
   }
   async wsTicket(body) {
     return encodeURIComponent((await this.mintedTicket(body)).ticket);
@@ -2854,15 +3747,33 @@ var ThunderBridge = class {
   async reading(method, path, body = "") {
     return {
       ...this.token === null ? {} : { authorization: `Bearer ${this.token}` },
-      ...this.secret === null ? {} : await signedAs(await this.speaking(), method, path, body)
+      ...this.secret === null ? {} : await signedAs(await this.speaking(), method, path, body, new URL(this.baseUrl).host)
     };
   }
   async speaking() {
     this.speaks ??= callerKey(this.secret ?? "");
     return await this.speaks;
   }
-  proven(payment) {
-    if (this.verify && payment.status === "paid" && !carriesProof(payment)) {
+  handOut(payment, key) {
+    const now = Math.floor(Date.now() / 1e3);
+    for (const [hash2, earlier2] of this.handedOut) {
+      if (earlier2.expiresAt <= now) {
+        this.handedOut.delete(hash2);
+      }
+    }
+    const hash = payment.paymentHash.toLowerCase();
+    const earlier = this.handedOut.get(hash);
+    if (earlier !== void 0 && (earlier.key === null || earlier.key !== key)) {
+      throw new GatewayCheatError("invoice_reused", payment.id);
+    }
+    this.handedOut.set(hash, { key, expiresAt: payment.expiresAt });
+  }
+  proven(payment, held) {
+    const other = held !== void 0 && (payment.id !== held.id || payment.paymentHash.toLowerCase() !== held.paymentHash.toLowerCase());
+    if (other) {
+      throw new GatewayCheatError("hash_mismatch", payment.id);
+    }
+    if (payment.status === "paid" && !agreesWithItself(payment)) {
       throw new GatewayCheatError("preimage_mismatch", payment.id);
     }
     return payment;
@@ -2916,6 +3827,7 @@ var Gateways = class {
   each;
   urls;
   onRefused;
+  onCaught;
   constructor(baseUrls, options) {
     if (baseUrls.length === 0) {
       throw new Error("name at least one gateway to watch at");
@@ -2924,6 +3836,8 @@ var Gateways = class {
     this.each = baseUrls.map((baseUrl) => new ThunderBridge(baseUrl, options));
     this.onRefused = options?.onRefused ?? (() => {
     });
+    this.onCaught = options?.onCaught ?? (() => {
+    });
   }
   /** What this payment is called, which every gateway here will agree on */
   async nameFor(paymentHash) {
@@ -2957,7 +3871,7 @@ var Gateways = class {
    * saying so. When they all end without a payment, the first ending is the answer,
    * and when they all fail, the first failure is thrown
    */
-  async settled(id, options) {
+  async settled(held, options) {
     const stopLosers = new AbortController();
     const signal = options?.signal ? AbortSignal.any([stopLosers.signal, options.signal]) : stopLosers.signal;
     const unpaid = [];
@@ -2971,14 +3885,17 @@ var Gateways = class {
             resolve2(null);
           }
         };
-        for (const gateway of this.each) {
-          gateway.settled(id, { ...options, signal }).then((watched) => {
+        for (const [at, gateway] of this.each.entries()) {
+          gateway.settled(held, { ...options, signal }).then((watched) => {
             if (watched.status === "paid") {
               return resolve2(watched);
             }
             unpaid.push(watched);
             lost();
           }).catch((failure) => {
+            if (failure instanceof GatewayCheatError) {
+              this.onCaught(this.urls[at], failure);
+            }
             refused ??= failure;
             lost();
           });
@@ -3007,6 +3924,7 @@ var Gateways = class {
   ThunderBridge,
   UnverifiedRecipientError,
   WrapRefusedError,
+  agreesWithItself,
   answerVerifyChallenge,
   carriesProof,
   decodeInvoice,