thunder-bridge 2.1.1 → 2.2.0

package/dist/index.cjs

@@ -39,6 +39,7 @@ __export(src_exports, {
   ThunderBridge: () => ThunderBridge,
   UnverifiedRecipientError: () => UnverifiedRecipientError,
   WrapRefusedError: () => WrapRefusedError,
+  agreesWithItself: () => agreesWithItself,
   answerVerifyChallenge: () => answerVerifyChallenge,
   carriesProof: () => carriesProof,
   decodeInvoice: () => decodeInvoice,
@@ -157,11 +158,11 @@ var BLOCK_BYTES = 64;
 var LENGTH_BYTES = 8;
 var SCHEDULE_WORDS = 64;
 function sha256(bytes) {
-  const padded = withPadding(bytes);
-  const reader = new DataView(padded.buffer);
+  const padded2 = withPadding(bytes);
+  const reader = new DataView(padded2.buffer);
   const state = Uint32Array.from(INITIAL_STATE);
   const schedule = new Uint32Array(SCHEDULE_WORDS);
-  for (let block = 0; block < padded.length; block += BLOCK_BYTES) {
+  for (let block = 0; block < padded2.length; block += BLOCK_BYTES) {
     fillSchedule(schedule, reader, block);
     compress(state, schedule);
   }
@@ -171,13 +172,13 @@ function sha256Hex(text3) {
   return bytesToHex(sha256(new TextEncoder().encode(text3)));
 }
 function withPadding(bytes) {
-  const padded = new Uint8Array(
+  const padded2 = new Uint8Array(
     bytes.length + 1 + LENGTH_BYTES + BLOCK_BYTES - 1 & ~(BLOCK_BYTES - 1)
   );
-  padded.set(bytes);
-  padded[bytes.length] = 128;
-  new DataView(padded.buffer).setUint32(padded.length - 4, bytes.length * 8, false);
-  return padded;
+  padded2.set(bytes);
+  padded2[bytes.length] = 128;
+  new DataView(padded2.buffer).setUint32(padded2.length - 4, bytes.length * 8, false);
+  return padded2;
 }
 function fillSchedule(schedule, reader, block) {
   for (let at = 0; at < 16; at++) {
@@ -414,63 +415,86 @@ function asBuffer(bytes) {
 // ../core/sealed.ts
 var VERSION = "v2";
 var UNPADDED_VERSION = "v1";
+var PURPOSE_VERSION = "v3";
 var IV_BYTES = 12;
 var MIN_SECRET_CHARS = 32;
 var MAX_PLAIN_BYTES = 3e3;
 var SIZE_CLASSES = [256, 1024, MAX_PLAIN_BYTES];
 var END_OF_TEXT = 128;
-var INFO = new TextEncoder().encode("thunder-bridge/sealed");
+var INFO = "thunder-bridge/sealed";
 async function seal(secret, plaintext, paymentHash) {
   return await sealUnder(
-    secret,
+    await keyFor(secret, INFO),
     plaintext,
     crypto.getRandomValues(new Uint8Array(IV_BYTES)),
+    VERSION,
     boundTo(paymentHash)
   );
 }
-async function sealStable(secret, plaintext) {
+async function sealFor(purpose, secret, plaintext, { stable = false } = {}) {
+  return await sealUnder(
+    await keyFor(secret, `${INFO}/${purpose}`),
+    plaintext,
+    stable ? await nonceOf(secret, plaintext) : crypto.getRandomValues(new Uint8Array(IV_BYTES)),
+    PURPOSE_VERSION,
+    new TextEncoder().encode(PURPOSE_VERSION)
+  );
+}
+async function unsealFor(purpose, secret, sealed) {
+  if (!sealed.startsWith(`${PURPOSE_VERSION}.`)) {
+    return await unseal(secret, sealed);
+  }
+  return await opened(
+    await keyFor(secret, `${INFO}/${purpose}`),
+    sealed.slice(PURPOSE_VERSION.length + 1),
+    new TextEncoder().encode(PURPOSE_VERSION)
+  );
+}
+async function nonceOf(secret, plaintext) {
   const derived = await hmacHex(secret, `sealed-nonce|${plaintext}`);
   const nonce = new Uint8Array(IV_BYTES);
   for (let at = 0; at < IV_BYTES; at++) {
     nonce[at] = Number.parseInt(derived.slice(at * 2, at * 2 + 2), 16);
   }
-  return await sealUnder(secret, plaintext, nonce, boundTo(void 0));
+  return nonce;
 }
-async function sealUnder(secret, plaintext, iv, additionalData) {
+async function sealUnder(key, plaintext, iv, version, additionalData) {
   const body = padToClass(plaintext);
-  const key = await keyFor(secret);
   const cipher = new Uint8Array(
     await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData }, key, body)
   );
-  const joined = new Uint8Array(iv.length + cipher.length);
-  joined.set(iv);
-  joined.set(cipher, iv.length);
-  return `${VERSION}.${toBase64Url(joined)}`;
+  const joined2 = new Uint8Array(iv.length + cipher.length);
+  joined2.set(iv);
+  joined2.set(cipher, iv.length);
+  return `${version}.${toBase64Url(joined2)}`;
 }
 async function unseal(secret, sealed, paymentHash) {
-  const key = await keyFor(secret);
-  const padded = sealed.startsWith(`${VERSION}.`);
-  const unbound = !padded && sealed.startsWith(`${UNPADDED_VERSION}.`);
-  if (!padded && (!unbound || paymentHash !== void 0)) {
+  const key = await keyFor(secret, INFO);
+  const padded2 = sealed.startsWith(`${VERSION}.`);
+  const unbound = !padded2 && sealed.startsWith(`${UNPADDED_VERSION}.`);
+  if (!padded2 && (!unbound || paymentHash !== void 0)) {
     return null;
   }
-  const joined = fromBase64Url(sealed.slice(VERSION.length + 1));
-  if (joined === null || joined.length <= IV_BYTES) {
+  return await opened(
+    key,
+    sealed.slice(VERSION.length + 1),
+    padded2 ? boundTo(paymentHash) : void 0
+  );
+}
+async function opened(key, encoded, additionalData) {
+  const joined2 = fromBase64Url(encoded);
+  if (joined2 === null || joined2.length <= IV_BYTES) {
     return null;
   }
   try {
     const body = new Uint8Array(
       await crypto.subtle.decrypt(
-        {
-          name: "AES-GCM",
-          iv: joined.slice(0, IV_BYTES),
-          additionalData: padded ? boundTo(paymentHash) : void 0
-        },
+        { name: "AES-GCM", iv: joined2.slice(0, IV_BYTES), additionalData },
         key,
-        joined.slice(IV_BYTES)
+        joined2.slice(IV_BYTES)
       )
     );
-    const text3 = padded ? unpad(body) : body;
+    const text3 = additionalData === void 0 ? body : unpad(body);
     return text3 === null ? null : new TextDecoder().decode(text3);
   } catch {
     return null;
@@ -501,7 +525,7 @@ function unpad(body) {
   const end = body.lastIndexOf(END_OF_TEXT);
   return end === -1 ? null : body.subarray(0, end);
 }
-async function keyFor(secret) {
+async function keyFor(secret, info) {
   refuseAWeakSecret(secret);
   const material = await crypto.subtle.importKey(
     "raw",
@@ -511,7 +535,12 @@ async function keyFor(secret) {
     ["deriveKey"]
   );
   return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: INFO },
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: new TextEncoder().encode(info)
+    },
     material,
     { name: "AES-GCM", length: 256 },
     false,
@@ -944,8 +973,8 @@ function hasSmallOrder(publicKeyHex) {
   return SMALL_ORDER.includes(bytesToHex(point));
 }
 function fromBase64Url2(text3) {
-  const padded = text3.replace(/-/g, "+").replace(/_/g, "/");
-  const raw = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const padded2 = text3.replace(/-/g, "+").replace(/_/g, "/");
+  const raw = atob(padded2 + "=".repeat((4 - padded2.length % 4) % 4));
   const bytes = new Uint8Array(raw.length);
   for (let at = 0; at < raw.length; at++) {
     bytes[at] = raw.charCodeAt(at);
@@ -960,7 +989,9 @@ function asBuffer2(bytes) {
 var KEY_HEADER = "x-client-key";
 var SIGNATURE_HEADER = "x-signature";
 var TIMESTAMP_HEADER = "x-timestamp";
+var NONCE_HEADER = "x-nonce";
 var PREFIX = "ed25519=";
+var NONCE_BYTES = 16;
 var SIGNING_LABEL = "request-signing";
 async function callerKey(secret) {
   return await signingKeyFromSeed(hexToBytes(await hmacHex(secret, SIGNING_LABEL)));
@@ -968,17 +999,21 @@ async function callerKey(secret) {
 function paymentNamedBy(caller, paymentHash) {
   return sha256Hex(`${caller}.payment-id.${paymentHash}`);
 }
-async function signedAs(key, method, path, body) {
+async function signedAs(key, method, path, body, host) {
   const timestamp = String(Math.floor(Date.now() / 1e3));
+  const nonce = bytesToHex(crypto.getRandomValues(new Uint8Array(NONCE_BYTES)));
   return {
     [KEY_HEADER]: key.publicKeyHex,
     [TIMESTAMP_HEADER]: timestamp,
-    [SIGNATURE_HEADER]: `${PREFIX}${await key.sign(spoken(timestamp, method, path, body))}`
+    [NONCE_HEADER]: nonce,
+    [SIGNATURE_HEADER]: `${PREFIX}${await key.sign(spokenTo(host, timestamp, nonce, method, path, body))}`
   };
 }
-function spoken(timestamp, method, path, body) {
+function spokenTo(host, timestamp, nonce, method, path, body) {
   return new TextEncoder().encode(
-    `${timestamp}.${method.toUpperCase()}.${path}.${sha256Hex(body)}`
+    ["v2", host.toLowerCase(), timestamp, nonce, method.toUpperCase(), path, sha256Hex(body)].join(
+      "\n"
+    )
   );
 }
 
@@ -1160,14 +1195,39 @@ async function addressesToReach(url) {
   return found;
 }
 async function resolved(url) {
-  const { lookup } = await import("dns/promises");
-  const { setTimeout: sleep } = await import("timers/promises");
+  const { isIP } = await import("net");
   const host = new URL(url).hostname.replace(/^\[|]$/g, "");
+  const literal = isIP(host);
+  if (literal !== 0) {
+    return [{ address: host, family: literal }];
+  }
+  const { Resolver } = await import("dns/promises");
+  const { setTimeout: sleep } = await import("timers/promises");
+  const resolver = new Resolver({ timeout: LOOKUP_TIMEOUT_MS, tries: 1 });
   const found = await Promise.race([
-    lookup(host, { all: true, verbatim: true }).catch(() => []),
+    Promise.all([
+      resolver.resolve4(host).catch(() => []),
+      resolver.resolve6(host).catch(() => [])
+    ]),
     sleep(LOOKUP_TIMEOUT_MS, null, { ref: false })
   ]);
-  return found ?? [];
+  cancelled(resolver);
+  if (found === null) {
+    return [];
+  }
+  const [four, six] = found;
+  return [
+    ...four.map((address) => ({ address, family: 4 })),
+    ...six.map((address) => ({ address, family: 6 }))
+  ];
+}
+function cancelled(resolver) {
+  try {
+    resolver.cancel();
+    return true;
+  } catch {
+    return false;
+  }
 }
 async function answerOf(response) {
   const { status, ok, headers } = response;
@@ -1496,6 +1556,14 @@ function headersOf(raw) {
   return headers;
 }
 
+// ../core/delivery.ts
+function deliverySigned(url, timestamp, body) {
+  const endpoint = new URL(url);
+  return new TextEncoder().encode(
+    ["v2", `${endpoint.origin}${endpoint.pathname}`, timestamp, body].join("\n")
+  );
+}
+
 // src/verify.ts
 var HTTP_TIMEOUT_MS2 = 15e3;
 var ISSUED_SKEW_SECS = 300;
@@ -1567,7 +1635,7 @@ async function proveSettlement(payment, asked) {
   }
   return verified.preimage;
 }
-function carriesProof(report) {
+function agreesWithItself(report) {
   if (report.status !== "paid" || report.preimage === null) {
     return false;
   }
@@ -1579,6 +1647,7 @@ function carriesProof(report) {
   }
   return preimageMatchesHash(report.preimage, report.paymentHash);
 }
+var carriesProof = agreesWithItself;
 function wrapFeeCeiling(amountMsat, allowance) {
   const proportional = amountMsat * (allowance?.proportion ?? DEFAULT_WRAP_PROPORTION);
   return msat(Math.max(allowance?.baseMsat ?? DEFAULT_WRAP_BASE_MSAT, Math.floor(proportional)));
@@ -1860,7 +1929,7 @@ function isStatus(value) {
 }
 
 // src/webhook.ts
-var SIGNATURE_HEADER2 = "x-signature";
+var SIGNATURE_HEADER2 = "x-signature-v2";
 var TIMESTAMP_HEADER2 = "x-timestamp";
 var GATEWAY_KEY_PREFIX = "ed25519=";
 var DEFAULT_TOLERANCE_SECS = 300;
@@ -1876,14 +1945,14 @@ async function readSettlement(request, credential, options = {}) {
 }
 async function answerWebhookChallenge(request, credential, options = {}) {
   const body = await believable(request, credential, options);
-  const nonce = body === null ? null : nonceOf(body, CHALLENGE);
+  const nonce = body === null ? null : nonceOf2(body, CHALLENGE);
   return nonce === null ? null : answered2(nonce);
 }
 async function answerVerifyChallenge(request) {
   if (request.method !== "POST") {
     return null;
   }
-  const nonce = nonceOf(await request.clone().text(), VERIFY_CHALLENGE);
+  const nonce = nonceOf2(await request.clone().text(), VERIFY_CHALLENGE);
   return nonce === null ? null : answered2(nonce);
 }
 async function believable(request, credential, options) {
@@ -1902,12 +1971,12 @@ async function believable(request, credential, options) {
   const signed = await verifyHex(
     credential.publicKey.toLowerCase(),
     signature.slice(GATEWAY_KEY_PREFIX.length).toLowerCase(),
-    stamped(timestamp, body)
+    deliverySigned(options.url ?? request.url, timestamp, body)
   );
   return signed ? body : null;
 }
 function proved(read) {
-  return read !== null && read.status === "paid" && !carriesProof(read) ? null : read;
+  return read !== null && read.status === "paid" && !agreesWithItself(read) ? null : read;
 }
 function decoded(body, from) {
   try {
@@ -1921,7 +1990,7 @@ function answered2(nonce) {
     headers: { "content-type": "application/json" }
   });
 }
-function nonceOf(text3, type) {
+function nonceOf2(text3, type) {
   try {
     const said = JSON.parse(text3);
     if (said["type"] !== type || typeof said["nonce"] !== "string") {
@@ -1939,9 +2008,6 @@ function recent(timestamp, toleranceSecs) {
   }
   return Math.abs(Math.floor(Date.now() / 1e3) - sent) <= toleranceSecs;
 }
-function stamped(timestamp, body) {
-  return new TextEncoder().encode(`${timestamp}.${body}`);
-}
 
 // src/bank.ts
 var DEFAULT_CURRENCY = "CZK";
@@ -1994,7 +2060,7 @@ function bankVerifyEndpoint(config) {
     if (sealed === null) {
       return Response.json({ settled: false }, { status: 400 });
     }
-    const subject = await unseal(config.secret, sealed);
+    const subject = await unsealFor("bank-verify", config.secret, sealed);
     const asked = subject === null ? null : askedFrom(subject);
     if (asked === null || asked.iban !== answersFor) {
       return Response.json({ settled: false }, { status: 403 });
@@ -2013,7 +2079,10 @@ async function answeredAt(params, subject) {
     return `agent:${(await callerKey(params.secret)).publicKeyHex}`;
   }
   const polling = new URL(params.verifyUrl ?? "");
-  polling.searchParams.set("q", await sealStable(params.secret, subject));
+  polling.searchParams.set(
+    "q",
+    await sealFor("bank-verify", params.secret, subject, { stable: true })
+  );
   return polling.toString();
 }
 async function creditedPreimage(params) {
@@ -2119,6 +2188,161 @@ function unixNow() {
   return Math.floor(Date.now() / 1e3);
 }
 
+// src/nostr.ts
+var import_chacha = require("@noble/ciphers/chacha.js");
+var import_secp256k1 = require("@noble/curves/secp256k1.js");
+var import_hkdf = require("@noble/hashes/hkdf.js");
+var import_hmac4 = require("@noble/hashes/hmac.js");
+var import_sha2 = require("@noble/hashes/sha2.js");
+var NIP44_SALT = new TextEncoder().encode("nip44-v2");
+var NIP44_VERSION = 2;
+var NONCE_BYTES2 = 32;
+var MAC_BYTES = 32;
+var MESSAGE_KEYS_BYTES = 76;
+var CHACHA_KEY_END = 32;
+var CHACHA_NONCE_END = 44;
+var LENGTH_PREFIX_BYTES = 2;
+var SMALLEST_PAD = 32;
+var CHUNKS_STAY_SMALL_TO = 256;
+var MAX_PLAINTEXT_BYTES = 65535;
+function publicKeyFor(privateKeyHex) {
+  return bytesToHex(import_secp256k1.schnorr.getPublicKey(hexToBytes(privateKeyHex)));
+}
+function conversationKeyFor(privateKeyHex, publicKeyHex) {
+  const shared = import_secp256k1.secp256k1.getSharedSecret(
+    hexToBytes(privateKeyHex),
+    hexToBytes(`02${publicKeyHex}`)
+  );
+  return (0, import_hkdf.extract)(import_sha2.sha256, shared.subarray(1, 33), NIP44_SALT);
+}
+function signEvent(privateKeyHex, draft) {
+  const pubkey = publicKeyFor(privateKeyHex);
+  const id = idOf(pubkey, draft);
+  return {
+    id,
+    pubkey,
+    created_at: draft.created_at,
+    kind: draft.kind,
+    tags: draft.tags,
+    content: draft.content,
+    sig: bytesToHex(import_secp256k1.schnorr.sign(hexToBytes(id), hexToBytes(privateKeyHex)))
+  };
+}
+function verifyEvent(event) {
+  try {
+    return idOf(event.pubkey, event) === event.id && import_secp256k1.schnorr.verify(hexToBytes(event.sig), hexToBytes(event.id), hexToBytes(event.pubkey));
+  } catch {
+    return false;
+  }
+}
+function idOf(pubkey, draft) {
+  return bytesToHex(
+    (0, import_sha2.sha256)(
+      new TextEncoder().encode(
+        JSON.stringify([0, pubkey, draft.created_at, draft.kind, draft.tags, draft.content])
+      )
+    )
+  );
+}
+function encryptNip44(conversationKey, plaintext) {
+  return sealNip44(conversationKey, plaintext, crypto.getRandomValues(new Uint8Array(NONCE_BYTES2)));
+}
+function sealNip44(conversationKey, plaintext, nonce) {
+  const keys = messageKeysFrom(conversationKey, nonce);
+  const ciphertext = (0, import_chacha.chacha20)(keys.chachaKey, keys.chachaNonce, padded(plaintext));
+  const mac = (0, import_hmac4.hmac)(import_sha2.sha256, keys.hmacKey, joined(nonce, ciphertext));
+  return toBase64(joined(Uint8Array.of(NIP44_VERSION), nonce, ciphertext, mac));
+}
+function decryptNip44(conversationKey, payload) {
+  if (payload.startsWith("#")) {
+    throw new Error("nip44 payload announces an encryption version we do not speak");
+  }
+  const raw = fromBase64(payload);
+  if (raw.length < 1 + NONCE_BYTES2 + MAC_BYTES) {
+    throw new Error(`nip44 payload is ${raw.length} bytes, too short to hold a nonce and a mac`);
+  }
+  if (raw[0] !== NIP44_VERSION) {
+    throw new Error(`nip44 payload is version ${raw[0]}, not ${NIP44_VERSION}`);
+  }
+  const nonce = raw.subarray(1, 1 + NONCE_BYTES2);
+  const ciphertext = raw.subarray(1 + NONCE_BYTES2, raw.length - MAC_BYTES);
+  const mac = raw.subarray(raw.length - MAC_BYTES);
+  const keys = messageKeysFrom(conversationKey, nonce);
+  if (!sameBytes((0, import_hmac4.hmac)(import_sha2.sha256, keys.hmacKey, joined(nonce, ciphertext)), mac)) {
+    throw new Error("nip44 payload failed its mac, so it was not written with this key");
+  }
+  return unpadded((0, import_chacha.chacha20)(keys.chachaKey, keys.chachaNonce, ciphertext));
+}
+function messageKeysFrom(conversationKey, nonce) {
+  if (conversationKey.length !== NONCE_BYTES2 || nonce.length !== NONCE_BYTES2) {
+    throw new Error("a nip44 conversation key and nonce are both 32 bytes");
+  }
+  const keys = (0, import_hkdf.expand)(import_sha2.sha256, conversationKey, nonce, MESSAGE_KEYS_BYTES);
+  return {
+    chachaKey: keys.subarray(0, CHACHA_KEY_END),
+    chachaNonce: keys.subarray(CHACHA_KEY_END, CHACHA_NONCE_END),
+    hmacKey: keys.subarray(CHACHA_NONCE_END)
+  };
+}
+function paddedLengthFor(unpadded2) {
+  if (unpadded2 <= SMALLEST_PAD) {
+    return SMALLEST_PAD;
+  }
+  const nextPower = 1 << Math.floor(Math.log2(unpadded2 - 1)) + 1;
+  const chunk = nextPower <= CHUNKS_STAY_SMALL_TO ? SMALLEST_PAD : nextPower / 8;
+  return chunk * (Math.floor((unpadded2 - 1) / chunk) + 1);
+}
+function padded(plaintext) {
+  const body = new TextEncoder().encode(plaintext);
+  if (body.length === 0 || body.length > MAX_PLAINTEXT_BYTES) {
+    throw new Error(`nip44 takes 1 to ${MAX_PLAINTEXT_BYTES} bytes, this was ${body.length}`);
+  }
+  const buffer = new Uint8Array(LENGTH_PREFIX_BYTES + paddedLengthFor(body.length));
+  buffer.set(Uint8Array.of(body.length >>> 8, body.length & 255));
+  buffer.set(body, LENGTH_PREFIX_BYTES);
+  return buffer;
+}
+function unpadded(buffer) {
+  const length = (buffer[0] ?? 0) << 8 | (buffer[1] ?? 0);
+  if (length === 0 || buffer.length !== LENGTH_PREFIX_BYTES + paddedLengthFor(length)) {
+    throw new Error("nip44 plaintext does not match the length its own padding declares");
+  }
+  return new TextDecoder().decode(
+    buffer.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + length)
+  );
+}
+function joined(...parts) {
+  const whole = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+  let at = 0;
+  for (const part of parts) {
+    whole.set(part, at);
+    at += part.length;
+  }
+  return whole;
+}
+function sameBytes(left, right) {
+  let different = left.length ^ right.length;
+  for (let at = 0; at < left.length && at < right.length; at++) {
+    different |= (left[at] ?? 0) ^ (right[at] ?? 0);
+  }
+  return different === 0;
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+function fromBase64(text3) {
+  const binary = atob(text3);
+  const bytes = new Uint8Array(binary.length);
+  for (let at = 0; at < bytes.length; at++) {
+    bytes[at] = binary.charCodeAt(at);
+  }
+  return bytes;
+}
+
 // src/qr.ts
 var import_uqr = require("uqr");
 var SAFE_COLOR = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$|^rgba?\([\d.,%/\s]+\)$|^[a-z]+$/i;
@@ -2161,12 +2385,244 @@ function renderSvg(content, size, color) {
   ].join("");
 }
 
-// src/relay.ts
+// src/nwc.ts
+var REQUEST_KIND = 23194;
+var RESPONSE_KIND = 23195;
+var NIP44_V2 = "nip44_v2";
+var DEFAULT_ASK_TIMEOUT_MS = 1e4;
 var DEFAULT_POLL_EVERY_SECS2 = 5;
+var HASH = "h";
+var REFUSAL_BY_CODE = {
+  INSUFFICIENT_BALANCE: "amount-not-accepted",
+  QUOTA_EXCEEDED: "amount-not-accepted",
+  RESTRICTED: "address-unusable",
+  UNAUTHORIZED: "address-unusable",
+  UNSUPPORTED_ENCRYPTION: "address-unusable"
+};
+async function nwcInvoice(connection, amountMsat, description, timeoutMs = DEFAULT_ASK_TIMEOUT_MS) {
+  const answered3 = await askWallet(
+    connection,
+    "make_invoice",
+    { amount: amountMsat, description },
+    timeoutMs
+  );
+  const bolt11 = String(answered3.invoice ?? "");
+  const issued = decodeInvoice(bolt11);
+  if (issued.paymentHash === null || issued.expiresAt === null) {
+    throw new WalletRefused("invoice-refused", "the nwc wallet issued an invoice we cannot decode");
+  }
+  if (issued.amountMsat !== amountMsat) {
+    throw new WalletRefused(
+      "invoice-refused",
+      `the nwc wallet issued an invoice for ${issued.amountMsat} msat, not ${amountMsat}`
+    );
+  }
+  return { bolt11, paymentHash: issued.paymentHash, expiresAt: issued.expiresAt };
+}
+async function nwcSettlement(connection, paymentHash, timeoutMs = DEFAULT_ASK_TIMEOUT_MS) {
+  const answered3 = await askWallet(
+    connection,
+    "lookup_invoice",
+    { payment_hash: paymentHash },
+    timeoutMs
+  );
+  const preimage = answered3.preimage;
+  if (typeof preimage !== "string" || preimage.length === 0) {
+    return null;
+  }
+  if (!preimageMatchesHash(preimage, paymentHash)) {
+    throw new Error(`the nwc wallet returned a preimage that does not hash to ${paymentHash}`);
+  }
+  return preimage;
+}
+function nwcVerifyEndpoint(config) {
+  const paced = {
+    "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS2}`
+  };
+  return async (request) => {
+    const consented = await answerVerifyChallenge(request);
+    if (consented !== null) {
+      return consented;
+    }
+    const sealed = new URL(request.url).searchParams.get(HASH);
+    if (sealed === null) {
+      return Response.json({ settled: false }, { status: 400 });
+    }
+    const paymentHash = await unsealFor("nwc-verify", config.secret, sealed);
+    if (paymentHash === null) {
+      return Response.json({ settled: false }, { status: 403 });
+    }
+    const preimage = await nwcSettlement(config.connection, paymentHash, config.askTimeoutMs).catch(
+      () => void 0
+    );
+    if (preimage === void 0) {
+      return Response.json({ settled: false }, { status: 502 });
+    }
+    return Response.json({ settled: preimage !== null, preimage }, { headers: paced });
+  };
+}
+async function nwcVerifyUrl(endpoint, paymentHash, secret) {
+  const sealed = new URL(endpoint);
+  sealed.searchParams.set(HASH, await sealFor("nwc-verify", secret, paymentHash));
+  return sealed.toString();
+}
+async function askWallet(connection, method, params, timeoutMs = DEFAULT_ASK_TIMEOUT_MS) {
+  const key = conversationKeyFor(connection.secret, connection.walletPubkey);
+  const request = signEvent(connection.secret, {
+    kind: REQUEST_KIND,
+    tags: [
+      ["p", connection.walletPubkey],
+      ["encryption", NIP44_V2]
+    ],
+    content: encryptNip44(key, JSON.stringify({ method, params })),
+    created_at: Math.floor(Date.now() / 1e3)
+  });
+  const answer = await overFirstRelayThatAnswers(connection, request, timeoutMs);
+  return resultOf(JSON.parse(decryptNip44(key, answer.content)), method);
+}
+function resultOf(said, method) {
+  const failure = said.error;
+  if (failure) {
+    throw new WalletRefused(
+      REFUSAL_BY_CODE[failure.code ?? ""] ?? "invoice-refused",
+      `the nwc wallet refused ${method}: ${failure.code ?? "unknown"} ${failure.message ?? ""}`.trim()
+    );
+  }
+  const result = said.result;
+  if (result === null || typeof result !== "object") {
+    throw new WalletRefused("invoice-refused", `the nwc wallet answered ${method} with no result`);
+  }
+  return result;
+}
+async function overFirstRelayThatAnswers(connection, request, timeoutMs) {
+  const deadline = AbortSignal.timeout(timeoutMs);
+  let lastFailure = null;
+  for (const relay of connection.relays) {
+    if (deadline.aborted) {
+      break;
+    }
+    try {
+      return await overRelay(relay, connection, request, deadline);
+    } catch (failure) {
+      lastFailure = failure;
+    }
+  }
+  throw new WalletRefused("unreachable", `no nwc relay answered: ${String(lastFailure)}`);
+}
+function overRelay(relay, connection, request, deadline) {
+  return new Promise((resolve2, reject) => {
+    const socket = new WebSocket(relay);
+    const subscription = request.id.slice(0, 16);
+    const expired = () => {
+      close();
+      reject(new Error(`${relay} did not answer before the deadline`));
+    };
+    deadline.addEventListener("abort", expired);
+    function close() {
+      deadline.removeEventListener("abort", expired);
+      socket.close();
+    }
+    socket.addEventListener("open", () => {
+      socket.send(
+        JSON.stringify([
+          "REQ",
+          subscription,
+          {
+            kinds: [RESPONSE_KIND],
+            authors: [connection.walletPubkey],
+            "#p": [publicKeyFor(connection.secret)],
+            "#e": [request.id]
+          }
+        ])
+      );
+      socket.send(JSON.stringify(["EVENT", request]));
+    });
+    socket.addEventListener("error", () => {
+      close();
+      reject(new Error(`${relay} could not be reached`));
+    });
+    socket.addEventListener("message", (delivered) => {
+      const frame = String(delivered.data);
+      const rejection = rejectionOf(frame, request.id);
+      if (rejection !== null) {
+        close();
+        reject(new Error(`${relay} refused the request: ${rejection}`));
+        return;
+      }
+      const answer = answeredEvent(frame, subscription, connection, request.id);
+      if (answer === null) {
+        return;
+      }
+      close();
+      resolve2(answer);
+    });
+  });
+}
+function rejectionOf(frame, requestId) {
+  const parsed = parsedFrame(frame);
+  if (parsed === null || parsed[0] !== "OK" || parsed[1] !== requestId || parsed[2] !== false) {
+    return null;
+  }
+  return typeof parsed[3] === "string" && parsed[3].length > 0 ? parsed[3] : "no reason given";
+}
+function answeredEvent(frame, subscription, connection, requestId) {
+  const parsed = parsedFrame(frame);
+  if (parsed === null || parsed[0] !== "EVENT" || parsed[1] !== subscription) {
+    return null;
+  }
+  const event = parsed[2];
+  const answers = event?.kind === RESPONSE_KIND && event.pubkey === connection.walletPubkey && Array.isArray(event.tags) && event.tags.some((tag) => tag?.[0] === "e" && tag[1] === requestId) && verifyEvent(event);
+  return answers ? event : null;
+}
+function parsedFrame(frame) {
+  try {
+    const parsed = JSON.parse(frame);
+    return Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function nwcRail(gateway, config) {
+  return async (order) => {
+    const invoice = await nwcInvoice(
+      config.connection,
+      await msatForOrder(order, config.amount, config.rate),
+      config.description?.(order) ?? order.reference
+    );
+    const watched = await gateway.watch({
+      paymentHash: invoice.paymentHash,
+      verifyUrl: await nwcVerifyUrl(
+        config.verifyThrough.endpoint,
+        invoice.paymentHash,
+        config.verifyThrough.secret
+      ),
+      expiresAt: invoice.expiresAt,
+      trigger: config.trigger,
+      replay: config.replay,
+      sealed: config.sealed ? await seal(
+        config.sealed.secret,
+        JSON.stringify(config.sealed.data(order)),
+        invoice.paymentHash
+      ) : void 0,
+      webhookUrl: config.webhookUrl
+    });
+    return {
+      id: watched.id,
+      paymentHash: invoice.paymentHash,
+      rail: config.name ?? "lightning",
+      scan: invoice.bolt11,
+      qr: toLightningUri(invoice.bolt11),
+      expiresAt: invoice.expiresAt
+    };
+  };
+}
+
+// src/relay.ts
+var DEFAULT_POLL_EVERY_SECS3 = 5;
 var WALLET = "w";
 function lightningVerifyEndpoint(config) {
   const paced = {
-    "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS2}`
+    "cache-control": `max-age=${config.pollEverySecs ?? DEFAULT_POLL_EVERY_SECS3}`
   };
   return async (request) => {
     const consented = await answerVerifyChallenge(request);
@@ -2177,8 +2633,8 @@ function lightningVerifyEndpoint(config) {
     if (sealed === null) {
       return Response.json({ settled: false }, { status: 400 });
     }
-    const opened = await unseal(config.secret, sealed);
-    const wallet = opened === null ? null : relayedFrom(opened);
+    const opened2 = await unsealFor("relay", config.secret, sealed);
+    const wallet = opened2 === null ? null : relayedFrom(opened2);
     if (wallet === null) {
       return Response.json({ settled: false }, { status: 403 });
     }
@@ -2196,9 +2652,9 @@ function lightningVerifyEndpoint(config) {
     );
   };
 }
-function relayedFrom(opened) {
+function relayedFrom(opened2) {
   try {
-    const said = JSON.parse(opened);
+    const said = JSON.parse(opened2);
     return typeof said?.url === "string" && typeof said.hash === "string" ? { url: said.url, hash: said.hash } : null;
   } catch {
     return null;
@@ -2206,7 +2662,7 @@ function relayedFrom(opened) {
 }
 async function relayedVerifyUrl(endpoint, wallet, secret) {
   const relayed = new URL(endpoint);
-  relayed.searchParams.set(WALLET, await seal(secret, JSON.stringify(wallet)));
+  relayed.searchParams.set(WALLET, await sealFor("relay", secret, JSON.stringify(wallet)));
   return relayed.toString();
 }
 
@@ -2337,6 +2793,15 @@ var Rails = class {
   bank(config) {
     return bankRail(this.gateway, config);
   }
+  /**
+   * Lightning against a wallet of your own over NIP-47, for a wallet that has no
+   * LUD-21 address to be watched at. Your node mints the invoice and releases the
+   * preimage, so the proof comes from one hop nearer than any hosted address can
+   * manage, and the gateway sees a hash and a URL of yours
+   */
+  nwc(config) {
+    return nwcRail(this.gateway, config);
+  }
   /**
    * One bank transfer without building a rail first, for a shop that asks for
    * them one at a time rather than beside another payment method
@@ -2386,7 +2851,7 @@ function waitingOf(options) {
 }
 
 // src/trigger.ts
-var NONCE_BYTES = 16;
+var NONCE_BYTES3 = 16;
 function lnurlPayEndpoint(gateway, config) {
   return async (request) => {
     const url = new URL(request.url);
@@ -2525,10 +2990,10 @@ function alreadyWatched(refused) {
   return refused instanceof ProblemError && isProblemType(refused, PAYMENT_ALREADY_WATCHED);
 }
 function sign(secret, address, least, most, nonce) {
-  return hmacHex(secret, `${address}|${least}|${most}|${nonce}`);
+  return hmacHex(secret, `lnurl-callback|${address}|${least}|${most}|${nonce}`);
 }
 function randomNonce() {
-  const bytes = crypto.getRandomValues(new Uint8Array(NONCE_BYTES));
+  const bytes = crypto.getRandomValues(new Uint8Array(NONCE_BYTES3));
   let hex = "";
   for (const byte of bytes) {
     hex += byte.toString(16).padStart(2, "0");
@@ -2578,23 +3043,39 @@ var Serve = class {
    * A verify endpoint of your own that asks the recipient's wallet for you, so
    * the gateway polls you and never the wallet
    */
-  verify(config) {
+  lightningVerify(config) {
     return lightningVerifyEndpoint(config);
   }
+  /**
+   * What `lightningVerify` was called before 2.2.0
+   *
+   * @deprecated Use `lightningVerify`, beside `bankVerify` and `nwcVerify`
+   */
+  verify(config) {
+    return this.lightningVerify(config);
+  }
   /** The verify endpoint a bank rail is polled at, answering off your own statement */
   bankVerify(config) {
     return bankVerifyEndpoint(config);
   }
+  /**
+   * The verify endpoint an NWC rail is polled at, asking your own wallet over
+   * NIP-47, so the gateway never learns the connection, the relay or the wallet
+   */
+  nwcVerify(config) {
+    return nwcVerifyEndpoint(config);
+  }
   /**
    * The whole webhook route: it answers the gateway's challenge, checks the
    * signature against the key the gateway publishes, refuses a settlement that
-   * proves nothing, and calls you for the one that does.
+   * proves nothing, and calls you once for the one that does.
    *
    * `export const POST = gateway.serve.webhook({ onSettled: fulfil })` is the
    * entire integration
    */
   webhook(handlers) {
-    const options = { toleranceSecs: handlers.toleranceSecs };
+    const options = { toleranceSecs: handlers.toleranceSecs, url: handlers.url };
+    const once = onceWhileReplayable(handlers.toleranceSecs ?? DEFAULT_TOLERANCE_SECS);
     return async (request) => {
       const credential = await this.credential(handlers);
       const challenge = await answerWebhookChallenge(request, credential, options);
@@ -2603,12 +3084,17 @@ var Serve = class {
       }
       const settlement = await readSettlement(request, credential, options);
       if (settlement !== null) {
-        return await acted(settlement, handlers);
+        return await once(
+          `${settlement.id}:${settlement.status}`,
+          () => acted(settlement, handlers)
+        );
       }
       const payment = await readPayment(request, credential, options);
       if (payment !== null) {
-        await handlers.onPayment?.(payment);
-        return new Response("ok");
+        return await once(`${payment.id}:${payment.status}`, async () => {
+          await handlers.onPayment?.(payment);
+          return new Response("ok");
+        });
       }
       return new Response("bad signature", { status: 401 });
     };
@@ -2629,8 +3115,34 @@ var Serve = class {
     return handlers.credential ?? { publicKey: await this.gateway.webhookKey() };
   }
 };
+function onceWhileReplayable(toleranceSecs) {
+  const acting = /* @__PURE__ */ new Map();
+  const replayableForMs = 2 * toleranceSecs * 1e3;
+  return async (delivery, act) => {
+    const now = Date.now();
+    for (const [earlier2, { forgetAt }] of acting) {
+      if (forgetAt > now) {
+        break;
+      }
+      acting.delete(earlier2);
+    }
+    const earlier = acting.get(delivery);
+    if (earlier !== void 0) {
+      await earlier.done;
+      return new Response("ok");
+    }
+    const done = act();
+    acting.set(delivery, { forgetAt: now + replayableForMs, done });
+    try {
+      return await done;
+    } catch (failure) {
+      acting.delete(delivery);
+      throw failure;
+    }
+  };
+}
 async function acted(settlement, handlers) {
-  if (carriesProof(settlement)) {
+  if (agreesWithItself(settlement)) {
     await handlers.onSettled?.(settlement);
     return new Response("ok");
   }
@@ -2854,7 +3366,7 @@ var ThunderBridge = class {
       throw await problemFrom(response);
     }
     const body = await response.json().catch(() => null);
-    const listed2 = Array.isArray(body?.payments) ? body.payments.map(paymentFromWire).filter((one) => one !== null).filter((one) => one.status !== "paid" || carriesProof(one)) : null;
+    const listed2 = Array.isArray(body?.payments) ? body.payments.map(paymentFromWire).filter((one) => one !== null).filter((one) => one.status !== "paid" || agreesWithItself(one)) : null;
     if (listed2 === null || typeof body?.settled_scanned !== "number") {
       throw new ProblemError({
         status: response.status,
@@ -2939,9 +3451,9 @@ var ThunderBridge = class {
         if (settled) {
           return;
         }
-        const opened = new WebSocket(url);
-        socket = opened;
-        opened.onmessage = (event) => {
+        const opened2 = new WebSocket(url);
+        socket = opened2;
+        opened2.onmessage = (event) => {
           try {
             const frame = JSON.parse(String(event.data));
             const watched = paymentFromWire(frame);
@@ -2958,7 +3470,7 @@ var ThunderBridge = class {
             settle(() => reject(refused));
           }
         };
-        opened.onclose = again;
+        opened2.onclose = again;
       };
       options?.signal?.addEventListener("abort", abort, { once: true });
       void connect();
@@ -2981,6 +3493,10 @@ var ThunderBridge = class {
    * the recipient's own wallet minted it, so a payer who pays the loser afterwards
    * really does pay twice and that shows up on `follow` as a second settlement to
    * refund.
+   *
+   * A leg the gateway is caught lying about before any leg is paid ends the wait
+   * with its `GatewayCheatError`, even when another leg is paid after it, so a
+   * detected cheat is never traded for a later win.
    */
   async firstSettled(held, options) {
     if (held.length === 0) {
@@ -2990,7 +3506,7 @@ var ThunderBridge = class {
     const signal = options?.signal ? AbortSignal.any([stopLosers.signal, options.signal]) : stopLosers.signal;
     let refused = null;
     try {
-      const winner = await new Promise((resolve2) => {
+      const winner = await new Promise((resolve2, caught) => {
         let waiting = held.length;
         const lost = () => {
           waiting -= 1;
@@ -3000,6 +3516,10 @@ var ThunderBridge = class {
         };
         for (const leg of held) {
           this.settled(leg, { ...options, signal }).then((watched) => watched.status === "paid" ? resolve2(watched) : lost()).catch((failure) => {
+            if (failure instanceof GatewayCheatError) {
+              caught(failure);
+              return;
+            }
             refused ??= failure;
             lost();
           });
@@ -3076,13 +3596,13 @@ var ThunderBridge = class {
       }
       retry = setTimeout(() => void connect(), backoffMs(firstDelay, attempt));
     };
-    const answered3 = async (opened, raw) => {
+    const answered3 = async (opened2, raw) => {
       const asked = askFromWire(raw);
       if (asked === null) {
         return;
       }
       const preimage = await options.answer(asked.paymentHash);
-      opened.send(
+      opened2.send(
         JSON.stringify(
           preimage === null ? { ask: asked.ask, settled: false } : { ask: asked.ask, settled: true, preimage }
         )
@@ -3101,18 +3621,18 @@ var ThunderBridge = class {
       if (stopped) {
         return;
       }
-      const opened = new WebSocket(url);
-      socket = opened;
-      opened.onopen = () => {
+      const opened2 = new WebSocket(url);
+      socket = opened2;
+      opened2.onopen = () => {
         attempt = 1;
       };
-      opened.onmessage = (event) => {
-        void answered3(opened, String(event.data)).catch(
+      opened2.onmessage = (event) => {
+        void answered3(opened2, String(event.data)).catch(
           (refused) => options.onError?.(refused)
         );
       };
-      opened.onerror = () => options.onError?.(new Error(`could not attend ${base}`));
-      opened.onclose = again;
+      opened2.onerror = () => options.onError?.(new Error(`could not attend ${base}`));
+      opened2.onclose = again;
     };
     void connect();
     return () => {
@@ -3227,7 +3747,7 @@ var ThunderBridge = class {
   async reading(method, path, body = "") {
     return {
       ...this.token === null ? {} : { authorization: `Bearer ${this.token}` },
-      ...this.secret === null ? {} : await signedAs(await this.speaking(), method, path, body)
+      ...this.secret === null ? {} : await signedAs(await this.speaking(), method, path, body, new URL(this.baseUrl).host)
     };
   }
   async speaking() {
@@ -3253,7 +3773,7 @@ var ThunderBridge = class {
     if (other) {
       throw new GatewayCheatError("hash_mismatch", payment.id);
     }
-    if (payment.status === "paid" && !carriesProof(payment)) {
+    if (payment.status === "paid" && !agreesWithItself(payment)) {
       throw new GatewayCheatError("preimage_mismatch", payment.id);
     }
     return payment;
@@ -3307,6 +3827,7 @@ var Gateways = class {
   each;
   urls;
   onRefused;
+  onCaught;
   constructor(baseUrls, options) {
     if (baseUrls.length === 0) {
       throw new Error("name at least one gateway to watch at");
@@ -3315,6 +3836,8 @@ var Gateways = class {
     this.each = baseUrls.map((baseUrl) => new ThunderBridge(baseUrl, options));
     this.onRefused = options?.onRefused ?? (() => {
     });
+    this.onCaught = options?.onCaught ?? (() => {
+    });
   }
   /** What this payment is called, which every gateway here will agree on */
   async nameFor(paymentHash) {
@@ -3362,7 +3885,7 @@ var Gateways = class {
             resolve2(null);
           }
         };
-        for (const gateway of this.each) {
+        for (const [at, gateway] of this.each.entries()) {
           gateway.settled(held, { ...options, signal }).then((watched) => {
             if (watched.status === "paid") {
               return resolve2(watched);
@@ -3370,6 +3893,9 @@ var Gateways = class {
             unpaid.push(watched);
             lost();
           }).catch((failure) => {
+            if (failure instanceof GatewayCheatError) {
+              this.onCaught(this.urls[at], failure);
+            }
             refused ??= failure;
             lost();
           });
@@ -3398,6 +3924,7 @@ var Gateways = class {
   ThunderBridge,
   UnverifiedRecipientError,
   WrapRefusedError,
+  agreesWithItself,
   answerVerifyChallenge,
   carriesProof,
   decodeInvoice,