thunder-bridge 2.1.1 → 2.2.0

package/dist/nwc.cjs

@@ -25,9 +25,9 @@ __export(nwc_exports, {
   nwcHoldInvoice: () => nwcHoldInvoice,
   nwcInvoice: () => nwcInvoice,
   nwcPay: () => nwcPay,
-  nwcRail: () => nwcRail,
+  nwcRail: () => nwcRail2,
   nwcSettlement: () => nwcSettlement,
-  nwcVerifyEndpoint: () => nwcVerifyEndpoint,
+  nwcVerifyEndpoint: () => nwcVerifyEndpoint2,
   nwcVerifyUrl: () => nwcVerifyUrl
 });
 module.exports = __toCommonJS(nwc_exports);
@@ -365,58 +365,106 @@ var WalletRefused = class extends Error {
   }
 };
 
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
+}
+function asBuffer(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
 // ../core/sealed.ts
 var VERSION = "v2";
 var UNPADDED_VERSION = "v1";
+var PURPOSE_VERSION = "v3";
 var IV_BYTES = 12;
 var MIN_SECRET_CHARS = 32;
 var MAX_PLAIN_BYTES = 3e3;
 var SIZE_CLASSES = [256, 1024, MAX_PLAIN_BYTES];
 var END_OF_TEXT = 128;
-var INFO = new TextEncoder().encode("thunder-bridge/sealed");
+var INFO = "thunder-bridge/sealed";
 async function seal(secret, plaintext, paymentHash) {
   return await sealUnder(
-    secret,
+    await keyFor(secret, INFO),
     plaintext,
     crypto.getRandomValues(new Uint8Array(IV_BYTES)),
+    VERSION,
     boundTo(paymentHash)
   );
 }
-async function sealUnder(secret, plaintext, iv, additionalData) {
+async function sealFor(purpose, secret, plaintext, { stable = false } = {}) {
+  return await sealUnder(
+    await keyFor(secret, `${INFO}/${purpose}`),
+    plaintext,
+    stable ? await nonceOf(secret, plaintext) : crypto.getRandomValues(new Uint8Array(IV_BYTES)),
+    PURPOSE_VERSION,
+    new TextEncoder().encode(PURPOSE_VERSION)
+  );
+}
+async function unsealFor(purpose, secret, sealed) {
+  if (!sealed.startsWith(`${PURPOSE_VERSION}.`)) {
+    return await unseal(secret, sealed);
+  }
+  return await opened(
+    await keyFor(secret, `${INFO}/${purpose}`),
+    sealed.slice(PURPOSE_VERSION.length + 1),
+    new TextEncoder().encode(PURPOSE_VERSION)
+  );
+}
+async function nonceOf(secret, plaintext) {
+  const derived = await hmacHex(secret, `sealed-nonce|${plaintext}`);
+  const nonce = new Uint8Array(IV_BYTES);
+  for (let at = 0; at < IV_BYTES; at++) {
+    nonce[at] = Number.parseInt(derived.slice(at * 2, at * 2 + 2), 16);
+  }
+  return nonce;
+}
+async function sealUnder(key, plaintext, iv, version, additionalData) {
   const body = padToClass(plaintext);
-  const key = await keyFor(secret);
   const cipher = new Uint8Array(
     await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData }, key, body)
   );
   const joined2 = new Uint8Array(iv.length + cipher.length);
   joined2.set(iv);
   joined2.set(cipher, iv.length);
-  return `${VERSION}.${toBase64Url(joined2)}`;
+  return `${version}.${toBase64Url(joined2)}`;
 }
 async function unseal(secret, sealed, paymentHash) {
-  const key = await keyFor(secret);
+  const key = await keyFor(secret, INFO);
   const padded2 = sealed.startsWith(`${VERSION}.`);
   const unbound = !padded2 && sealed.startsWith(`${UNPADDED_VERSION}.`);
   if (!padded2 && (!unbound || paymentHash !== void 0)) {
     return null;
   }
-  const joined2 = fromBase64Url(sealed.slice(VERSION.length + 1));
+  return await opened(
+    key,
+    sealed.slice(VERSION.length + 1),
+    padded2 ? boundTo(paymentHash) : void 0
+  );
+}
+async function opened(key, encoded, additionalData) {
+  const joined2 = fromBase64Url(encoded);
   if (joined2 === null || joined2.length <= IV_BYTES) {
     return null;
   }
   try {
     const body = new Uint8Array(
       await crypto.subtle.decrypt(
-        {
-          name: "AES-GCM",
-          iv: joined2.slice(0, IV_BYTES),
-          additionalData: padded2 ? boundTo(paymentHash) : void 0
-        },
+        { name: "AES-GCM", iv: joined2.slice(0, IV_BYTES), additionalData },
         key,
         joined2.slice(IV_BYTES)
       )
     );
-    const text = padded2 ? unpad(body) : body;
+    const text = additionalData === void 0 ? body : unpad(body);
     return text === null ? null : new TextDecoder().decode(text);
   } catch {
     return null;
@@ -447,7 +495,7 @@ function unpad(body) {
   const end = body.lastIndexOf(END_OF_TEXT);
   return end === -1 ? null : body.subarray(0, end);
 }
-async function keyFor(secret) {
+async function keyFor(secret, info) {
   refuseAWeakSecret(secret);
   const material = await crypto.subtle.importKey(
     "raw",
@@ -457,7 +505,12 @@ async function keyFor(secret) {
     ["deriveKey"]
   );
   return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: INFO },
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: new TextEncoder().encode(info)
+    },
     material,
     { name: "AES-GCM", length: 256 },
     false,
@@ -882,7 +935,7 @@ async function answerVerifyChallenge(request) {
   if (request.method !== "POST") {
     return null;
   }
-  const nonce = nonceOf(await request.clone().text(), VERIFY_CHALLENGE);
+  const nonce = nonceOf2(await request.clone().text(), VERIFY_CHALLENGE);
   return nonce === null ? null : answered(nonce);
 }
 function answered(nonce) {
@@ -890,7 +943,7 @@ function answered(nonce) {
     headers: { "content-type": "application/json" }
   });
 }
-function nonceOf(text, type) {
+function nonceOf2(text, type) {
   try {
     const said = JSON.parse(text);
     if (said["type"] !== type || typeof said["nonce"] !== "string") {
@@ -1036,7 +1089,7 @@ function nwcVerifyEndpoint(config) {
     if (sealed === null) {
       return Response.json({ settled: false }, { status: 400 });
     }
-    const paymentHash = await unseal(config.secret, sealed);
+    const paymentHash = await unsealFor("nwc-verify", config.secret, sealed);
     if (paymentHash === null) {
       return Response.json({ settled: false }, { status: 403 });
     }
@@ -1051,7 +1104,7 @@ function nwcVerifyEndpoint(config) {
 }
 async function nwcVerifyUrl(endpoint, paymentHash, secret) {
   const sealed = new URL(endpoint);
-  sealed.searchParams.set(HASH, await seal(secret, paymentHash));
+  sealed.searchParams.set(HASH, await sealFor("nwc-verify", secret, paymentHash));
   return sealed.toString();
 }
 async function askWallet(connection, method, params, timeoutMs = DEFAULT_ASK_TIMEOUT_MS) {
@@ -1222,6 +1275,10 @@ function nwcRail(gateway, config) {
     };
   };
 }
+
+// src/entry/nwc.ts
+var nwcRail2 = nwcRail;
+var nwcVerifyEndpoint2 = nwcVerifyEndpoint;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   askWallet,

package/dist/nwc.d.cts

@@ -1,122 +1,19 @@
-import { A as Amount, T as Ticker } from './types-DYZ9EkmJ.cjs';
-import { R as RailConfig, O as Order, T as ThunderBridge, f as Rail } from './bank-CEIuNhV_.cjs';
+import { n as nwcRail$1, f as nwcVerifyEndpoint$1 } from './bank-Bg6RjuO-.cjs';
+export { N as NwcConnection, g as NwcInvoice, h as NwcRailConfig, i as NwcVerifyConfig, j as askWallet, k as nwcConnection, l as nwcHoldInvoice, m as nwcInvoice, o as nwcPay, p as nwcSettlement, q as nwcVerifyUrl } from './bank-Bg6RjuO-.cjs';
 import './qr-CF-YeXU1.cjs';
+import './types-DYZ9EkmJ.cjs';
 
-/** A wallet reachable over NIP-47, as its `nostr+walletconnect://` URI describes it */
-interface NwcConnection {
-    /** The wallet service's public key, which is what its answers have to be signed by */
-    walletPubkey: string;
-    /** Where to reach it, tried in order until one answers */
-    relays: string[];
-    /** Our own private key on this connection, and the only thing that authorises it */
-    secret: string;
-}
-/** A minted invoice and everything needed to watch it */
-interface NwcInvoice {
-    bolt11: string;
-    paymentHash: string;
-    expiresAt: number;
-}
-/** The endpoint the gateway polls for an NWC payment, answering off your own wallet */
-interface NwcVerifyConfig {
-    /** The wallet this endpoint speaks for. It never leaves this process */
-    connection: NwcConnection;
-    /** The secret the payment hash was sealed with, and nothing else uses it */
-    secret: string;
-    /** How often the gateway should ask, in seconds, sent as `Cache-Control: max-age`, `5` by default */
-    pollEverySecs?: number;
-    /** How long one `lookup_invoice` may take before the wallet counts as unreachable, `10_000` by default */
-    askTimeoutMs?: number;
-}
 /**
- * Read a `nostr+walletconnect://` URI. Refuses a relay that is not `wss`, for the
- * reason the gateway refuses a verify URL that is not https
- */
-declare function nwcConnection(uri: string): NwcConnection;
-/** Mint an invoice on the connected wallet, decoded so the caller need not trust its word */
-declare function nwcInvoice(connection: NwcConnection, amountMsat: number, description: string, timeoutMs?: number): Promise<NwcInvoice>;
-/**
- * Mint a hold invoice on a hash the wallet does not hold the preimage for, which
- * is what lets an operator be paid only by paying somebody else first. The hash
- * has to come from the recipient's own invoice, and the invoice that comes back
- * is decoded rather than believed
- */
-declare function nwcHoldInvoice(connection: NwcConnection, held: {
-    paymentHash: string;
-    amountMsat: number;
-    description: string;
-    expirySecs: number;
-    minCltvExpiryDelta?: number;
-}, timeoutMs?: number): Promise<NwcInvoice>;
-/**
- * The preimage the wallet released for this hash, null while it has released
- * none. A preimage that does not hash to what was asked for is a lie rather than
- * an answer, so it throws instead of being passed on
- */
-declare function nwcSettlement(connection: NwcConnection, paymentHash: string, timeoutMs?: number): Promise<string | null>;
-/**
- * Pay an invoice and keep the preimage the network handed back. Whoever pays
- * learns it, which is what makes delivery provable to a recipient publishing no
- * LUD-21 of their own. A preimage that does not hash to the invoice's own hash is
- * a lie rather than a receipt, so it throws instead of being passed on
- */
-declare function nwcPay(connection: NwcConnection, bolt11: string, timeoutMs?: number): Promise<string>;
-/**
- * A verify endpoint of your own that asks your wallet over NIP-47, so the gateway
- * polls you and never learns the connection, the relay, or which wallet it is.
- *
- * `nwcVerifyUrl` seals the payment hash into the query with your secret, which is
- * what stops a stranger driving your wallet through this handler. It answers the
- * LUD-21 shape the gateway already speaks, so nothing on that side changes.
+ * The NWC rail as a free function, which is how it was reached before 2.2.0
  *
- * A wallet it cannot reach answers `502` rather than "not settled", because those
- * are different claims and only one of them is true.
- */
-declare function nwcVerifyEndpoint(config: NwcVerifyConfig): (request: Request) => Promise<Response>;
-/**
- * The URL to hand the gateway, with the payment hash sealed inside it. Point it at
- * wherever `nwcVerifyEndpoint` is mounted
- */
-declare function nwcVerifyUrl(endpoint: string, paymentHash: string, secret: string): Promise<string>;
-/**
- * One NIP-47 call, for a method this SDK does not wrap. The wallet's own info
- * event lists what it will answer, and anything it refuses comes back as a
- * `WalletRefused` whose `reason` says which kind of refusal it was
+ * @deprecated Use `gateway.rails.nwc(config)`, the same rail beside every other one
  */
-declare function askWallet(connection: NwcConnection, method: string, params: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;
-/** A Lightning rail minting on a wallet of your own over NIP-47, bound once per shop */
-interface NwcRailConfig extends RailConfig {
-    /** The wallet that mints, which never leaves this process */
-    connection: NwcConnection;
-    /**
-     * What to charge for one order, the order's own price converted at `rate` by
-     * default. Give it a function and the price is whatever you say
-     */
-    amount?: (order: Order) => Amount;
-    /** Where the default conversion gets its rate, the median of four venues by default */
-    rate?: Ticker;
-    /** Where `nwcVerifyEndpoint` is mounted, and the secret the hash is sealed with */
-    verifyThrough: {
-        endpoint: string;
-        secret: string;
-    };
-    /** What the payer's wallet shows, the order's reference by default */
-    description?: (order: Order) => string;
-    /** Sealed before the gateway sees it, the way the blind Lightning rail does */
-    sealed?: {
-        secret: string;
-        data: (order: Order) => unknown;
-    };
-}
+declare const nwcRail: typeof nwcRail$1;
 /**
- * Sell for Lightning against a wallet of your own over NIP-47, for a wallet that
- * has no LUD-21 address to be watched at. Your node mints the invoice and releases
- * the preimage, so the proof comes from one hop nearer than any hosted address can
- * manage, and the gateway sees a hash and a URL of yours.
+ * The NWC verify endpoint as a free function, which is how it was reached before 2.2.0
  *
- * This rail lives here rather than on `gateway.rails` because NIP-47 needs the
- * nostr crypto in this module, and a browser showing a QR should not download it
+ * @deprecated Use `gateway.serve.nwcVerify(config)`, beside every other verify endpoint
  */
-declare function nwcRail(gateway: ThunderBridge, config: NwcRailConfig): Rail;
+declare const nwcVerifyEndpoint: typeof nwcVerifyEndpoint$1;
 
-export { type NwcConnection, type NwcInvoice, type NwcRailConfig, type NwcVerifyConfig, askWallet, nwcConnection, nwcHoldInvoice, nwcInvoice, nwcPay, nwcRail, nwcSettlement, nwcVerifyEndpoint, nwcVerifyUrl };
+export { nwcRail, nwcVerifyEndpoint };

package/dist/nwc.d.ts

@@ -1,122 +1,19 @@
-import { A as Amount, T as Ticker } from './types-DYZ9EkmJ.js';
-import { R as RailConfig, O as Order, T as ThunderBridge, f as Rail } from './bank-M8flcMks.js';
+import { n as nwcRail$1, f as nwcVerifyEndpoint$1 } from './bank-B5MxT_6u.js';
+export { N as NwcConnection, g as NwcInvoice, h as NwcRailConfig, i as NwcVerifyConfig, j as askWallet, k as nwcConnection, l as nwcHoldInvoice, m as nwcInvoice, o as nwcPay, p as nwcSettlement, q as nwcVerifyUrl } from './bank-B5MxT_6u.js';
 import './qr-CF-YeXU1.js';
+import './types-DYZ9EkmJ.js';
 
-/** A wallet reachable over NIP-47, as its `nostr+walletconnect://` URI describes it */
-interface NwcConnection {
-    /** The wallet service's public key, which is what its answers have to be signed by */
-    walletPubkey: string;
-    /** Where to reach it, tried in order until one answers */
-    relays: string[];
-    /** Our own private key on this connection, and the only thing that authorises it */
-    secret: string;
-}
-/** A minted invoice and everything needed to watch it */
-interface NwcInvoice {
-    bolt11: string;
-    paymentHash: string;
-    expiresAt: number;
-}
-/** The endpoint the gateway polls for an NWC payment, answering off your own wallet */
-interface NwcVerifyConfig {
-    /** The wallet this endpoint speaks for. It never leaves this process */
-    connection: NwcConnection;
-    /** The secret the payment hash was sealed with, and nothing else uses it */
-    secret: string;
-    /** How often the gateway should ask, in seconds, sent as `Cache-Control: max-age`, `5` by default */
-    pollEverySecs?: number;
-    /** How long one `lookup_invoice` may take before the wallet counts as unreachable, `10_000` by default */
-    askTimeoutMs?: number;
-}
 /**
- * Read a `nostr+walletconnect://` URI. Refuses a relay that is not `wss`, for the
- * reason the gateway refuses a verify URL that is not https
- */
-declare function nwcConnection(uri: string): NwcConnection;
-/** Mint an invoice on the connected wallet, decoded so the caller need not trust its word */
-declare function nwcInvoice(connection: NwcConnection, amountMsat: number, description: string, timeoutMs?: number): Promise<NwcInvoice>;
-/**
- * Mint a hold invoice on a hash the wallet does not hold the preimage for, which
- * is what lets an operator be paid only by paying somebody else first. The hash
- * has to come from the recipient's own invoice, and the invoice that comes back
- * is decoded rather than believed
- */
-declare function nwcHoldInvoice(connection: NwcConnection, held: {
-    paymentHash: string;
-    amountMsat: number;
-    description: string;
-    expirySecs: number;
-    minCltvExpiryDelta?: number;
-}, timeoutMs?: number): Promise<NwcInvoice>;
-/**
- * The preimage the wallet released for this hash, null while it has released
- * none. A preimage that does not hash to what was asked for is a lie rather than
- * an answer, so it throws instead of being passed on
- */
-declare function nwcSettlement(connection: NwcConnection, paymentHash: string, timeoutMs?: number): Promise<string | null>;
-/**
- * Pay an invoice and keep the preimage the network handed back. Whoever pays
- * learns it, which is what makes delivery provable to a recipient publishing no
- * LUD-21 of their own. A preimage that does not hash to the invoice's own hash is
- * a lie rather than a receipt, so it throws instead of being passed on
- */
-declare function nwcPay(connection: NwcConnection, bolt11: string, timeoutMs?: number): Promise<string>;
-/**
- * A verify endpoint of your own that asks your wallet over NIP-47, so the gateway
- * polls you and never learns the connection, the relay, or which wallet it is.
- *
- * `nwcVerifyUrl` seals the payment hash into the query with your secret, which is
- * what stops a stranger driving your wallet through this handler. It answers the
- * LUD-21 shape the gateway already speaks, so nothing on that side changes.
+ * The NWC rail as a free function, which is how it was reached before 2.2.0
  *
- * A wallet it cannot reach answers `502` rather than "not settled", because those
- * are different claims and only one of them is true.
- */
-declare function nwcVerifyEndpoint(config: NwcVerifyConfig): (request: Request) => Promise<Response>;
-/**
- * The URL to hand the gateway, with the payment hash sealed inside it. Point it at
- * wherever `nwcVerifyEndpoint` is mounted
- */
-declare function nwcVerifyUrl(endpoint: string, paymentHash: string, secret: string): Promise<string>;
-/**
- * One NIP-47 call, for a method this SDK does not wrap. The wallet's own info
- * event lists what it will answer, and anything it refuses comes back as a
- * `WalletRefused` whose `reason` says which kind of refusal it was
+ * @deprecated Use `gateway.rails.nwc(config)`, the same rail beside every other one
  */
-declare function askWallet(connection: NwcConnection, method: string, params: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;
-/** A Lightning rail minting on a wallet of your own over NIP-47, bound once per shop */
-interface NwcRailConfig extends RailConfig {
-    /** The wallet that mints, which never leaves this process */
-    connection: NwcConnection;
-    /**
-     * What to charge for one order, the order's own price converted at `rate` by
-     * default. Give it a function and the price is whatever you say
-     */
-    amount?: (order: Order) => Amount;
-    /** Where the default conversion gets its rate, the median of four venues by default */
-    rate?: Ticker;
-    /** Where `nwcVerifyEndpoint` is mounted, and the secret the hash is sealed with */
-    verifyThrough: {
-        endpoint: string;
-        secret: string;
-    };
-    /** What the payer's wallet shows, the order's reference by default */
-    description?: (order: Order) => string;
-    /** Sealed before the gateway sees it, the way the blind Lightning rail does */
-    sealed?: {
-        secret: string;
-        data: (order: Order) => unknown;
-    };
-}
+declare const nwcRail: typeof nwcRail$1;
 /**
- * Sell for Lightning against a wallet of your own over NIP-47, for a wallet that
- * has no LUD-21 address to be watched at. Your node mints the invoice and releases
- * the preimage, so the proof comes from one hop nearer than any hosted address can
- * manage, and the gateway sees a hash and a URL of yours.
+ * The NWC verify endpoint as a free function, which is how it was reached before 2.2.0
  *
- * This rail lives here rather than on `gateway.rails` because NIP-47 needs the
- * nostr crypto in this module, and a browser showing a QR should not download it
+ * @deprecated Use `gateway.serve.nwcVerify(config)`, beside every other verify endpoint
  */
-declare function nwcRail(gateway: ThunderBridge, config: NwcRailConfig): Rail;
+declare const nwcVerifyEndpoint: typeof nwcVerifyEndpoint$1;
 
-export { type NwcConnection, type NwcInvoice, type NwcRailConfig, type NwcVerifyConfig, askWallet, nwcConnection, nwcHoldInvoice, nwcInvoice, nwcPay, nwcRail, nwcSettlement, nwcVerifyEndpoint, nwcVerifyUrl };
+export { nwcRail, nwcVerifyEndpoint };

package/dist/nwc.js

@@ -331,58 +331,106 @@ var WalletRefused = class extends Error {
   }
 };
 
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
+}
+function asBuffer(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
 // ../core/sealed.ts
 var VERSION = "v2";
 var UNPADDED_VERSION = "v1";
+var PURPOSE_VERSION = "v3";
 var IV_BYTES = 12;
 var MIN_SECRET_CHARS = 32;
 var MAX_PLAIN_BYTES = 3e3;
 var SIZE_CLASSES = [256, 1024, MAX_PLAIN_BYTES];
 var END_OF_TEXT = 128;
-var INFO = new TextEncoder().encode("thunder-bridge/sealed");
+var INFO = "thunder-bridge/sealed";
 async function seal(secret, plaintext, paymentHash) {
   return await sealUnder(
-    secret,
+    await keyFor(secret, INFO),
     plaintext,
     crypto.getRandomValues(new Uint8Array(IV_BYTES)),
+    VERSION,
     boundTo(paymentHash)
   );
 }
-async function sealUnder(secret, plaintext, iv, additionalData) {
+async function sealFor(purpose, secret, plaintext, { stable = false } = {}) {
+  return await sealUnder(
+    await keyFor(secret, `${INFO}/${purpose}`),
+    plaintext,
+    stable ? await nonceOf(secret, plaintext) : crypto.getRandomValues(new Uint8Array(IV_BYTES)),
+    PURPOSE_VERSION,
+    new TextEncoder().encode(PURPOSE_VERSION)
+  );
+}
+async function unsealFor(purpose, secret, sealed) {
+  if (!sealed.startsWith(`${PURPOSE_VERSION}.`)) {
+    return await unseal(secret, sealed);
+  }
+  return await opened(
+    await keyFor(secret, `${INFO}/${purpose}`),
+    sealed.slice(PURPOSE_VERSION.length + 1),
+    new TextEncoder().encode(PURPOSE_VERSION)
+  );
+}
+async function nonceOf(secret, plaintext) {
+  const derived = await hmacHex(secret, `sealed-nonce|${plaintext}`);
+  const nonce = new Uint8Array(IV_BYTES);
+  for (let at = 0; at < IV_BYTES; at++) {
+    nonce[at] = Number.parseInt(derived.slice(at * 2, at * 2 + 2), 16);
+  }
+  return nonce;
+}
+async function sealUnder(key, plaintext, iv, version, additionalData) {
   const body = padToClass(plaintext);
-  const key = await keyFor(secret);
   const cipher = new Uint8Array(
     await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData }, key, body)
   );
   const joined2 = new Uint8Array(iv.length + cipher.length);
   joined2.set(iv);
   joined2.set(cipher, iv.length);
-  return `${VERSION}.${toBase64Url(joined2)}`;
+  return `${version}.${toBase64Url(joined2)}`;
 }
 async function unseal(secret, sealed, paymentHash) {
-  const key = await keyFor(secret);
+  const key = await keyFor(secret, INFO);
   const padded2 = sealed.startsWith(`${VERSION}.`);
   const unbound = !padded2 && sealed.startsWith(`${UNPADDED_VERSION}.`);
   if (!padded2 && (!unbound || paymentHash !== void 0)) {
     return null;
   }
-  const joined2 = fromBase64Url(sealed.slice(VERSION.length + 1));
+  return await opened(
+    key,
+    sealed.slice(VERSION.length + 1),
+    padded2 ? boundTo(paymentHash) : void 0
+  );
+}
+async function opened(key, encoded, additionalData) {
+  const joined2 = fromBase64Url(encoded);
   if (joined2 === null || joined2.length <= IV_BYTES) {
     return null;
   }
   try {
     const body = new Uint8Array(
       await crypto.subtle.decrypt(
-        {
-          name: "AES-GCM",
-          iv: joined2.slice(0, IV_BYTES),
-          additionalData: padded2 ? boundTo(paymentHash) : void 0
-        },
+        { name: "AES-GCM", iv: joined2.slice(0, IV_BYTES), additionalData },
         key,
         joined2.slice(IV_BYTES)
       )
     );
-    const text = padded2 ? unpad(body) : body;
+    const text = additionalData === void 0 ? body : unpad(body);
     return text === null ? null : new TextDecoder().decode(text);
   } catch {
     return null;
@@ -413,7 +461,7 @@ function unpad(body) {
   const end = body.lastIndexOf(END_OF_TEXT);
   return end === -1 ? null : body.subarray(0, end);
 }
-async function keyFor(secret) {
+async function keyFor(secret, info) {
   refuseAWeakSecret(secret);
   const material = await crypto.subtle.importKey(
     "raw",
@@ -423,7 +471,12 @@ async function keyFor(secret) {
     ["deriveKey"]
   );
   return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: INFO },
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: new TextEncoder().encode(info)
+    },
     material,
     { name: "AES-GCM", length: 256 },
     false,
@@ -848,7 +901,7 @@ async function answerVerifyChallenge(request) {
   if (request.method !== "POST") {
     return null;
   }
-  const nonce = nonceOf(await request.clone().text(), VERIFY_CHALLENGE);
+  const nonce = nonceOf2(await request.clone().text(), VERIFY_CHALLENGE);
   return nonce === null ? null : answered(nonce);
 }
 function answered(nonce) {
@@ -856,7 +909,7 @@ function answered(nonce) {
     headers: { "content-type": "application/json" }
   });
 }
-function nonceOf(text, type) {
+function nonceOf2(text, type) {
   try {
     const said = JSON.parse(text);
     if (said["type"] !== type || typeof said["nonce"] !== "string") {
@@ -1002,7 +1055,7 @@ function nwcVerifyEndpoint(config) {
     if (sealed === null) {
       return Response.json({ settled: false }, { status: 400 });
     }
-    const paymentHash = await unseal(config.secret, sealed);
+    const paymentHash = await unsealFor("nwc-verify", config.secret, sealed);
     if (paymentHash === null) {
       return Response.json({ settled: false }, { status: 403 });
     }
@@ -1017,7 +1070,7 @@ function nwcVerifyEndpoint(config) {
 }
 async function nwcVerifyUrl(endpoint, paymentHash, secret) {
   const sealed = new URL(endpoint);
-  sealed.searchParams.set(HASH, await seal(secret, paymentHash));
+  sealed.searchParams.set(HASH, await sealFor("nwc-verify", secret, paymentHash));
   return sealed.toString();
 }
 async function askWallet(connection, method, params, timeoutMs = DEFAULT_ASK_TIMEOUT_MS) {
@@ -1188,14 +1241,18 @@ function nwcRail(gateway, config) {
     };
   };
 }
+
+// src/entry/nwc.ts
+var nwcRail2 = nwcRail;
+var nwcVerifyEndpoint2 = nwcVerifyEndpoint;
 export {
   askWallet,
   nwcConnection,
   nwcHoldInvoice,
   nwcInvoice,
   nwcPay,
-  nwcRail,
+  nwcRail2 as nwcRail,
   nwcSettlement,
-  nwcVerifyEndpoint,
+  nwcVerifyEndpoint2 as nwcVerifyEndpoint,
   nwcVerifyUrl
 };

package/dist/price.d.cts

@@ -1,4 +1,4 @@
-export { A as AmountError, a as AmountFault } from './errors-DriqW-lp.cjs';
+export { A as AmountError, a as AmountFault } from './errors-DJmsalYZ.cjs';
 export { M as MedianOptions, T as Ticker, b as bitstamp, c as coinbase, a as coinmate, k as kraken, m as medianOf, d as msatFor } from './types-DYZ9EkmJ.cjs';
 
 /**