Lightning withdraw (LNURL-withdraw): a site's withdraw lnurl in Send gets paid to you; the media pager says when a picture can't be loaded. (1) LUD-03 (Adam, 2026-10-16: "add lnurlw support"): an lnurl whose terms are a withdrawRequest — found when the pay fetch meets one (fetchPayParams throws with the terms attached, resolve() takes them up) — shows the site, their range (or the fixed amount) and description, the amount field at their max; Withdraw makes an invoice over Ark for the amount (arkLnInvoice), hands it to their callback with k1 (submitWithdraw), and watches it (arkLnWatch): "has your invoice for…", then "Received …" on settlement; their refusal in their words, with Try again; Back before it is paid stops watching. An amount outside their range is told the range, nothing sent; a watch-only device says it can't receive. LUD-17 schemes lnurlw:// and lnurlp:// (and lightning: before them) are the URL over https, http on an onion (parseZapTarget). (2) A pager slide whose picture can't load — the server copy and then the original both failing (isolabellart's relay answering 502 that afternoon: the broken-picture glyph sat in the corner of a black slide) — hides the <img> and says "This picture couldn't be loaded" with the host, caption and controls kept (mp-gone / .mp-missing). tools/lnurl-auth-unit-test.js (lnurlw:// and lnurlp://, an onion, the terms, a pay fetch that finds a withdraw, the callback's k1 and pr, a refusal); tools/lnurl-withdraw-test.js (the zaps feature against a faked Ark and a stand-in site: the terms, max prefilled, out of range refused unsent, the invoice at the callback and watched, Received on settlement, a fixed amount with no field, Back unwatches, a refusal's reason); tools/pager-gone-picture-test.js; lnurl-auth and feed-picture-pager tests pass.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01J1Kon8bxJoHRpJdSzshCkp

5 files changed, 131 insertions, 5 deletions

diff --git a/src/features/messages.js b/src/features/messages.js
index d5da326..20cfaa6 100644
--- a/src/features/messages.js
+++ b/src/features/messages.js
@@ -12279,7 +12279,15 @@ export function messagesFeature(ctx) {
       ? h('video', { class: 'mp-media', 'data-src': url, loop: true, playsinline: true, preload: 'none',
           poster: videoThumbs.get(url) || posterOf(ev, url) || (videoInfo.get(url) || {}).image || serverThumb(url) })
       : h('img', { class: 'mp-media', 'data-src': quick, 'data-full': url, alt: '', draggable: 'false', decoding: 'async',
-          onError: (e) => { const m = e.currentTarget; if ((m.getAttribute('src') || '') !== url) { m.setAttribute('data-src', url); m.setAttribute('src', url); } } });
+          onError: (e) => {
+            const m = e.currentTarget;
+            if ((m.getAttribute('src') || '') !== url) { m.setAttribute('data-src', url); m.setAttribute('src', url); return; }
+            // the original is gone too (its host down, the file deleted): say
+            // so, in place of the browser's broken-picture glyph
+            let host = ''; try { host = new URL(url).hostname; } catch {}
+            m.closest('.mp-slide').classList.add('mp-gone');
+            m.insertAdjacentElement('afterend', h('div', { class: 'mp-missing' }, h('div', { class: 'mp-missing-ico' }, '🖼'), h('div', {}, t('mediaPicGone')), host ? h('div', { class: 'small muted' }, host) : null));
+          } });
     const caption = mediaCaption(ev);
     const stop = (fn) => (e) => { e.stopPropagation(); fn(e); };
     const slide = h('div', { class: 'mp-slide', 'data-k': mediaKey(it) },
diff --git a/src/features/zaps.js b/src/features/zaps.js
index f29fe83..d364738 100644
--- a/src/features/zaps.js
+++ b/src/features/zaps.js
@@ -13,7 +13,7 @@
 
 import { t } from '../i18n.js';
 import { npubOf } from '../nostr.js';
-import { parseZapTarget, zapTargetFromProfile, fetchPayParams, buildZapRequest, requestInvoice, parseLnurlAuth, lnurlAuthKey, lnurlAuthLogin } from '../lnurl.js';
+import { parseZapTarget, zapTargetFromProfile, fetchPayParams, buildZapRequest, requestInvoice, parseLnurlAuth, lnurlAuthKey, lnurlAuthLogin, submitWithdraw } from '../lnurl.js';
 import { HDKey } from '@scure/bip32';
 import { mnemonicToSeedSync } from '@scure/bip39';
 import { decodeNoffer } from '../noffer.js';
@@ -136,7 +136,13 @@ export function zapsFeature(ctx) {
 
       z.address = lnTarget.address || z.address;
     }
-    const params = await fetchPayParams(target.url);
+    let params;
+    try { params = await fetchPayParams(target.url); }
+    catch (e) {
+      // not a payment after all: the site wants to pay US (LUD-03)
+      if (e && e.withdraw) { if (ui.zap === z) beginWithdraw(e.withdraw, z); return; }
+      throw e;
+    }
     if (ui.zap !== z) return; // user navigated away
     // Name the payee like a human: LNURL metadata usually carries the
     // lightning address (text/identifier) — show that instead of a bech32
@@ -350,6 +356,67 @@ export function zapsFeature(ctx) {
       h('button', { class: 'btn-primary btn-block', onClick: () => doLogin(a) }, a.status === 'error' ? t('lnAuthRetry') : t(action === 'register' ? 'lnAuthGoRegister' : 'lnAuthGo')),
       h('button', { class: 'btn-ghost btn-block', onClick: back }, t('back')));
   }
+  // ---- Lightning withdraw (LNURL-withdraw) ----
+  // A site's withdraw lnurl: they will pay an invoice of ours, within their
+  // range. Ask the amount (their max to start; fixed when min = max), make
+  // the invoice over Ark, hand it over, and watch for the money.
+  function beginWithdraw(w, z) {
+    const maxSat = Math.floor(w.maxMsat / 1000), minSat = Math.ceil(w.minMsat / 1000);
+    ui.zap = null; ui.sendError = '';
+    ui.lnWithdraw = { w, minSat, maxSat, fixed: minSat >= maxSat, amount: ctx.amountField(maxSat), status: 'ask', address: z && z.address };
+    render();
+  }
+  async function doWithdraw(d) {
+    const sats = d.fixed ? d.maxSat : (parseAmount(d.amount, getUnit()) || 0);
+    if (!(sats >= Math.max(1, d.minSat) && sats <= d.maxSat)) { d.error = t('lnWithdrawRange', { min: fmtAmount(d.minSat), max: fmtAmount(d.maxSat), unit: unitLabel() }); render(); return; }
+    if (wallet.watchOnly) { d.error = t('lnWithdrawWatchOnly'); render(); return; }
+    d.sats = sats; d.status = 'busy'; d.error = ''; render();
+    try {
+      const inv = await hook('arkLnInvoice', sats, (d.w.description || t('lnWithdrawMemo', { domain: d.w.domain })).slice(0, 120));
+      if (!inv || !inv.invoice) throw new Error(t('lnWithdrawNoInvoice'));
+      if (ui.lnWithdraw !== d) { hook('arkLnCancel', inv.id); return; }
+      await submitWithdraw(d.w, inv.invoice);
+      if (ui.lnWithdraw !== d) return;
+      d.status = 'sent'; d.lnId = inv.id;
+      hook('arkLnWatch', inv.id, (a) => { if (ui.lnWithdraw !== d) return; d.status = a && a.step === 'done' ? 'paid' : 'error'; if (d.status === 'error') d.error = t('lnWithdrawNotPaid'); render(); });
+    } catch (e) {
+      if (ui.lnWithdraw !== d) return;
+      d.status = 'error'; d.error = e.message || String(e);
+    }
+    render();
+  }
+  function lnWithdrawView() {
+    const d = ui.lnWithdraw;
+    if (!d) return null;
+    const domain = d.w.domain;
+    const back = () => { if (d.lnId && d.status !== 'paid') hook('arkLnUnwatch', d.lnId); ui.lnWithdraw = null; ui.sendError = ''; ui.send = blankSend(); render(); };
+    const heading = '⚡ ' + t('lnWithdrawTitle');
+    if (d.status === 'busy') {
+      return h('div', { class: 'card col', style: 'align-items:center;gap:14px;padding:32px 14px' },
+        h('span', { class: 'spinner' }), h('p', { class: 'muted', style: 'margin:0' }, t('lnWithdrawAsking', { domain })));
+    }
+    if (d.status === 'sent' || d.status === 'paid') {
+      const paid = d.status === 'paid';
+      return h('div', { class: 'card col', style: 'align-items:center;text-align:center;gap:14px;padding:32px 14px' },
+        paid ? h('div', { class: 'check-badge' }, '✓') : h('span', { class: 'spinner' }),
+        h('h3', { style: 'margin:0' }, paid ? t('lnWithdrawPaid', { amount: fmtAmount(d.sats) + ' ' + unitLabel() }) : t('lnWithdrawSent', { amount: fmtAmount(d.sats) + ' ' + unitLabel(), domain })),
+        paid ? null : h('p', { class: 'small muted', style: 'margin:0' }, t('lnWithdrawSentHint')),
+        h('button', { class: paid ? 'btn-primary btn-block' : 'btn-ghost btn-block', onClick: back }, paid ? t('done') : t('back')));
+    }
+    return h('div', { class: 'card col', style: 'gap:12px' },
+      h('h3', {}, heading),
+      h('div', { class: 'small', style: 'font-size:18px;font-weight:600;word-break:break-all' }, domain),
+      d.w.description ? h('p', { class: 'small muted', style: 'margin:0' }, d.w.description) : null,
+      h('p', { class: 'small muted', style: 'margin:0' }, d.fixed ? t('lnWithdrawFixed', { amount: fmtAmount(d.maxSat) + ' ' + unitLabel(), domain })
+        : t('lnWithdrawOffer', { min: fmtAmount(d.minSat), max: fmtAmount(d.maxSat), unit: unitLabel(), domain })),
+      d.fixed ? null : h('div', { class: 'row gap6', style: 'align-items:center' },
+        h('input', { type: 'number', min: '0', inputmode: 'decimal', placeholder: t('lnPayAmount'), value: d.amount, onInput: (e) => { d.amount = e.target.value; d.error = ''; render(); } }),
+        unitTag(),
+        h('button', { type: 'button', onClick: () => { d.amount = ctx.amountField(d.maxSat); d.error = ''; render(); } }, t('max'))),
+      d.error ? h('div', { class: 'notice err' }, d.error) : null,
+      h('button', { class: 'btn-primary btn-block', onClick: () => doWithdraw(d) }, d.status === 'error' ? t('lnAuthRetry') : t('lnWithdrawGo')),
+      h('button', { class: 'btn-ghost btn-block', onClick: back }, t('back')));
+  }
   function zapView() {
     const z = ui.zap;
     if (!z) return null;
@@ -535,8 +602,8 @@ export function zapsFeature(ctx) {
       begin({ kind: 'npub', pk, eventId: eventId || null }, shortNpub(npub || npubOf(pk)));
       return true;
     },
-    resetSend() { ui.zap = null; ui.lnAuth = null; },
-    sendView() { return lnAuthView() || zapView(); },
+    resetSend() { ui.zap = null; ui.lnAuth = null; ui.lnWithdraw = null; },
+    sendView() { return lnAuthView() || lnWithdrawView() || zapView(); },
     // Settings → Nostr: the one-tap zap amount.
     nostrSettingsCards() {
       const cur = ctx.zapDefaultSat ? ctx.zapDefaultSat() : 0;
diff --git a/src/i18n.js b/src/i18n.js
index 4cccefd..2b33a47 100644
--- a/src/i18n.js
+++ b/src/i18n.js
@@ -531,6 +531,7 @@ const STR = {
     postBlocked: 'Blocked',
     zapSending: 'Sending your zap…',
     msgReply: 'Reply',
+    mediaPicGone: 'This picture couldn’t be loaded',
     mediaOpenPost: 'Open the post',
     profNewPost: 'New post',
     profYourProfile: 'Your profile',
@@ -1491,6 +1492,19 @@ const STR = {
     lnAuthDoneHint: 'Go back to their page — it should have let you in.',
     lnAuthFailed: 'They didn’t accept the login.',
     lnAuthNoKey: 'This account has no wallet key to log in with.',
+    lnWithdrawTitle: 'Withdraw over Lightning',
+    lnWithdrawOffer: '{domain} will pay you between {min} and {max} {unit}. How much?',
+    lnWithdrawFixed: '{domain} will pay you {amount}.',
+    lnWithdrawRange: 'Between {min} and {max} {unit}.',
+    lnWithdrawGo: 'Withdraw',
+    lnWithdrawAsking: 'Asking {domain} to pay…',
+    lnWithdrawSent: '{domain} has your invoice for {amount}',
+    lnWithdrawSentHint: 'It should arrive in a moment. You can leave this page; the payment will show in your history.',
+    lnWithdrawPaid: 'Received {amount}',
+    lnWithdrawNotPaid: 'They took the invoice but the payment didn’t arrive. Check with them before trying again.',
+    lnWithdrawNoInvoice: 'Couldn’t make an invoice to be paid to.',
+    lnWithdrawWatchOnly: 'This device can’t receive: the wallet is watch-only here.',
+    lnWithdrawMemo: 'Withdrawal from {domain}',
     lnPayAmount: 'Amount',
     lnPayBoltzFee: 'Swap fee',
     lnPayNetworkFee: 'Network fee',
diff --git a/src/lnurl.js b/src/lnurl.js
index cf851b5..bfebf0d 100644
--- a/src/lnurl.js
+++ b/src/lnurl.js
@@ -47,6 +47,9 @@ export function lnAddressToUrl(addr) {
 export function parseZapTarget(input, { pk = null } = {}) {
   const s = (input || '').trim().replace(/^lightning:/i, '');
   if (!s) return null;
+  // LUD-17: lnurlp:// (pay) and lnurlw:// (withdraw) are the URL itself over https (http on an onion)
+  const scheme = /^(lnurlp|lnurlw):\/\/(.+)$/i.exec(s);
+  if (scheme) { const url = (/^[^/]+\.onion(\/|$)/i.test(scheme[2]) ? 'http://' : 'https://') + scheme[2]; return { kind: 'lnurl', url, lnurlBech32: safeEncode(url), pk }; }
   // An npub/hex pubkey — the caller resolves lud16/lud06 from the profile and
   // calls fromProfile() below; here we just report the shape.
   const npk = parseNostrPubkey(s);
@@ -96,10 +99,14 @@ async function fetchJson(url, ms = 8000) {
 }
 
 // GET the LNURL-pay params. Normalizes the bits we use; keeps `callback`.
+// An lnurl that turns out to be a withdraw (LUD-03) is not an error here:
+// the thrown error carries its terms (`withdraw`) for the caller to take up.
 export async function fetchPayParams(url) {
   const d = await fetchJson(url);
   if (!d || d.tag !== 'payRequest' || !d.callback) {
     if (d && d.status === 'ERROR') throw new Error(d.reason || 'LNURL error');
+    const w = withdrawParamsOf(d);
+    if (w) { const e = new Error('a Lightning withdraw, not a payment'); e.withdraw = w; throw e; }
     throw new Error('not a Lightning pay endpoint');
   }
   return {
@@ -179,3 +186,30 @@ export async function lnurlAuthLogin(auth, key) {
   return { key: bytesToHex(key.publicKey) };
 }
 
+// ---- LNURL-withdraw (LUD-03): the other side asks to PAY us ----
+// Their terms: an amount range (msat), a callback and k1. We make an invoice
+// for the amount chosen and hand it to the callback; they pay it.
+export function withdrawParamsOf(d) {
+  if (!d || d.tag !== 'withdrawRequest' || !d.callback || !d.k1) return null;
+  const min = Math.max(0, Number(d.minWithdrawable) || 0), max = Number(d.maxWithdrawable) || 0;
+  if (!(max > 0)) return null;
+  let domain = '';
+  try { domain = new URL(d.callback).hostname; } catch {}
+  return { callback: d.callback, k1: String(d.k1), minMsat: min, maxMsat: Math.max(min, max), description: String(d.defaultDescription || '').slice(0, 200), domain };
+}
+export async function fetchWithdrawParams(url) {
+  const d = await fetchJson(url);
+  const w = withdrawParamsOf(d);
+  if (!w) { if (d && d.status === 'ERROR') throw new Error(d.reason || 'LNURL error'); throw new Error('not a Lightning withdraw'); }
+  return w;
+}
+// Hand them the invoice to pay. Their OK means they have it, not that it is paid.
+export async function submitWithdraw(params, invoice) {
+  const url = new URL(params.callback);
+  url.searchParams.set('k1', params.k1);
+  url.searchParams.set('pr', invoice);
+  const d = await fetchJson(url.href);
+  if (!d || String(d.status || '').toUpperCase() !== 'OK') throw new Error((d && d.reason) || 'withdraw refused');
+  return true;
+}
+
diff --git a/src/style.css b/src/style.css
index 15fe4a6..4a9b191 100644
--- a/src/style.css
+++ b/src/style.css
@@ -1510,6 +1510,9 @@ body::after {
    kept a full-size texture per slide, and a flight past them stuttered. */
 .mp-slide img.mp-media { touch-action: pan-x pan-y; transform-origin: center center; }
 .mp-slide.mp-cur img.mp-media { will-change: transform; }
+.mp-slide.mp-gone img.mp-media { display: none; }
+.mp-missing { display: flex; flex-direction: column; align-items: center; gap: 6px; color: rgba(255, 255, 255, .55); font-size: 15px; text-align: center; padding: 20px; }
+.mp-missing-ico { font-size: 44px; opacity: .5; }
 /* nothing but the picture until a tap */
 .mp-meta, .mp-top { opacity: 0; pointer-events: none; transition: opacity .18s; }
 .media-pager.show .mp-meta, .media-pager.show .mp-top { opacity: 1; pointer-events: auto; }