From 911113814f13fa7a6b9645d5419162422ff4f82e Mon Sep 17 00:00:00 2001
From: Valentine Wallace <vwallace@protonmail.com>
Date: Mon, 28 Aug 2023 13:20:11 -0400
Subject: [PATCH 1/9] Fix BlindedPath::new_for_payment docs

---
 lightning/src/blinded_path/mod.rs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lightning/src/blinded_path/mod.rs b/lightning/src/blinded_path/mod.rs
index 89087a10cd4..8569a9ef974 100644
--- a/lightning/src/blinded_path/mod.rs
+++ b/lightning/src/blinded_path/mod.rs
@@ -75,10 +75,9 @@ impl BlindedPath {
 		})
 	}
 
-	/// Create a blinded path for a payment, to be forwarded along `path`. The last node
-	/// in `path` will be the destination node.
+	/// Create a blinded path for a payment, to be forwarded along `intermediate_nodes`.
 	///
-	/// Errors if `path` is empty or a node id in `path` is invalid.
+	/// Errors if a provided node id is invalid.
 	//  TODO: make all payloads the same size with padding + add dummy hops
 	pub fn new_for_payment<ES: EntropySource, T: secp256k1::Signing + secp256k1::Verification>(
 		intermediate_nodes: &[(PublicKey, payment::ForwardTlvs)], payee_node_id: PublicKey,

From ec01d7e061ad9a24809c5f21c400716ebd082fa6 Mon Sep 17 00:00:00 2001
From: Valentine Wallace <vwallace@protonmail.com>
Date: Tue, 20 Jun 2023 20:27:57 -0400
Subject: [PATCH 2/9] Compute aggregated BlindedPayInfo in path construction

---
 lightning/src/blinded_path/mod.rs     |  17 ++--
 lightning/src/blinded_path/payment.rs | 109 ++++++++++++++++++++++++++
 2 files changed, 121 insertions(+), 5 deletions(-)

diff --git a/lightning/src/blinded_path/mod.rs b/lightning/src/blinded_path/mod.rs
index 8569a9ef974..4a8f111be2c 100644
--- a/lightning/src/blinded_path/mod.rs
+++ b/lightning/src/blinded_path/mod.rs
@@ -15,8 +15,9 @@ pub(crate) mod utils;
 
 use bitcoin::secp256k1::{self, PublicKey, Secp256k1, SecretKey};
 
-use crate::sign::EntropySource;
 use crate::ln::msgs::DecodeError;
+use crate::offers::invoice::BlindedPayInfo;
+use crate::sign::EntropySource;
 use crate::util::ser::{Readable, Writeable, Writer};
 
 use crate::io;
@@ -77,22 +78,28 @@ impl BlindedPath {
 
 	/// Create a blinded path for a payment, to be forwarded along `intermediate_nodes`.
 	///
-	/// Errors if a provided node id is invalid.
+	/// Errors if:
+	/// * a provided node id is invalid
+	/// * [`BlindedPayInfo`] calculation results in an integer overflow
+	/// * any unknown features are required in the provided [`ForwardTlvs`]
+	///
+	/// [`ForwardTlvs`]: crate::blinded_path::payment::ForwardTlvs
 	//  TODO: make all payloads the same size with padding + add dummy hops
 	pub fn new_for_payment<ES: EntropySource, T: secp256k1::Signing + secp256k1::Verification>(
 		intermediate_nodes: &[(PublicKey, payment::ForwardTlvs)], payee_node_id: PublicKey,
 		payee_tlvs: payment::ReceiveTlvs, entropy_source: &ES, secp_ctx: &Secp256k1<T>
-	) -> Result<Self, ()> {
+	) -> Result<(BlindedPayInfo, Self), ()> {
 		let blinding_secret_bytes = entropy_source.get_secure_random_bytes();
 		let blinding_secret = SecretKey::from_slice(&blinding_secret_bytes[..]).expect("RNG is busted");
 
-		Ok(BlindedPath {
+		let blinded_payinfo = payment::compute_payinfo(intermediate_nodes, &payee_tlvs)?;
+		Ok((blinded_payinfo, BlindedPath {
 			introduction_node_id: intermediate_nodes.first().map_or(payee_node_id, |n| n.0),
 			blinding_point: PublicKey::from_secret_key(secp_ctx, &blinding_secret),
 			blinded_hops: payment::blinded_hops(
 				secp_ctx, intermediate_nodes, payee_node_id, payee_tlvs, &blinding_secret
 			).map_err(|_| ())?,
-		})
+		}))
 	}
 }
 
diff --git a/lightning/src/blinded_path/payment.rs b/lightning/src/blinded_path/payment.rs
index 0f6cf01858d..236369ddc0e 100644
--- a/lightning/src/blinded_path/payment.rs
+++ b/lightning/src/blinded_path/payment.rs
@@ -10,9 +10,12 @@ use crate::io;
 use crate::ln::PaymentSecret;
 use crate::ln::features::BlindedHopFeatures;
 use crate::ln::msgs::DecodeError;
+use crate::offers::invoice::BlindedPayInfo;
 use crate::prelude::*;
 use crate::util::ser::{Readable, Writeable, Writer};
 
+use core::convert::TryFrom;
+
 /// Data to construct a [`BlindedHop`] for forwarding a payment.
 pub struct ForwardTlvs {
 	/// The short channel id this payment should be forwarded out over.
@@ -150,6 +153,46 @@ pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	utils::construct_blinded_hops(secp_ctx, pks, tlvs, session_priv)
 }
 
+pub(super) fn compute_payinfo(
+	intermediate_nodes: &[(PublicKey, ForwardTlvs)], payee_tlvs: &ReceiveTlvs
+) -> Result<BlindedPayInfo, ()> {
+	let mut curr_base_fee: u64 = 0;
+	let mut curr_prop_mil: u64 = 0;
+	let mut cltv_expiry_delta: u16 = 0;
+	for (_, tlvs) in intermediate_nodes.iter().rev() {
+		// In the future, we'll want to take the intersection of all supported features for the
+		// `BlindedPayInfo`, but there are no features in that context right now.
+		if tlvs.features.requires_unknown_bits_from(&BlindedHopFeatures::empty()) { return Err(()) }
+
+		let next_base_fee = tlvs.payment_relay.fee_base_msat as u64;
+		let next_prop_mil = tlvs.payment_relay.fee_proportional_millionths as u64;
+		// Use integer arithmetic to compute `ceil(a/b)` as `(a+b-1)/b`
+		// ((curr_base_fee * (1_000_000 + next_prop_mil)) / 1_000_000) + next_base_fee
+		curr_base_fee = curr_base_fee.checked_mul(1_000_000 + next_prop_mil)
+			.and_then(|f| f.checked_add(1_000_000 - 1))
+			.map(|f| f / 1_000_000)
+			.and_then(|f| f.checked_add(next_base_fee))
+			.ok_or(())?;
+		// ceil(((curr_prop_mil + 1_000_000) * (next_prop_mil + 1_000_000)) / 1_000_000) - 1_000_000
+		curr_prop_mil = curr_prop_mil.checked_add(1_000_000)
+			.and_then(|f1| next_prop_mil.checked_add(1_000_000).and_then(|f2| f2.checked_mul(f1)))
+			.and_then(|f| f.checked_add(1_000_000 - 1))
+			.map(|f| f / 1_000_000)
+			.and_then(|f| f.checked_sub(1_000_000))
+			.ok_or(())?;
+
+		cltv_expiry_delta = cltv_expiry_delta.checked_add(tlvs.payment_relay.cltv_expiry_delta).ok_or(())?;
+	}
+	Ok(BlindedPayInfo {
+		fee_base_msat: u32::try_from(curr_base_fee).map_err(|_| ())?,
+		fee_proportional_millionths: u32::try_from(curr_prop_mil).map_err(|_| ())?,
+		cltv_expiry_delta,
+		htlc_minimum_msat: 1, // TODO
+		htlc_maximum_msat: 21_000_000 * 100_000_000 * 1_000, // TODO
+		features: BlindedHopFeatures::empty(),
+	})
+}
+
 impl_writeable_msg!(PaymentRelay, {
 	cltv_expiry_delta,
 	fee_proportional_millionths,
@@ -160,3 +203,69 @@ impl_writeable_msg!(PaymentConstraints, {
 	max_cltv_expiry,
 	htlc_minimum_msat
 }, {});
+
+#[cfg(test)]
+mod tests {
+	use bitcoin::secp256k1::PublicKey;
+	use crate::blinded_path::payment::{ForwardTlvs, ReceiveTlvs, PaymentConstraints, PaymentRelay};
+	use crate::ln::PaymentSecret;
+	use crate::ln::features::BlindedHopFeatures;
+
+	#[test]
+	fn compute_payinfo() {
+		// Taken from the spec example for aggregating blinded payment info. See
+		// https://github.com/lightning/bolts/blob/master/proposals/route-blinding.md#blinded-payments
+		let dummy_pk = PublicKey::from_slice(&[2; 33]).unwrap();
+		let intermediate_nodes = vec![(dummy_pk, ForwardTlvs {
+			short_channel_id: 0,
+			payment_relay: PaymentRelay {
+				cltv_expiry_delta: 144,
+				fee_proportional_millionths: 500,
+				fee_base_msat: 100,
+			},
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 100,
+			},
+			features: BlindedHopFeatures::empty(),
+		}), (dummy_pk, ForwardTlvs {
+			short_channel_id: 0,
+			payment_relay: PaymentRelay {
+				cltv_expiry_delta: 144,
+				fee_proportional_millionths: 500,
+				fee_base_msat: 100,
+			},
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 1_000,
+			},
+			features: BlindedHopFeatures::empty(),
+		})];
+		let recv_tlvs = ReceiveTlvs {
+			payment_secret: PaymentSecret([0; 32]),
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 1,
+			},
+		};
+		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs).unwrap();
+		assert_eq!(blinded_payinfo.fee_base_msat, 201);
+		assert_eq!(blinded_payinfo.fee_proportional_millionths, 1001);
+		assert_eq!(blinded_payinfo.cltv_expiry_delta, 288);
+	}
+
+	#[test]
+	fn compute_payinfo_1_hop() {
+		let recv_tlvs = ReceiveTlvs {
+			payment_secret: PaymentSecret([0; 32]),
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 1,
+			},
+		};
+		let blinded_payinfo = super::compute_payinfo(&[], &recv_tlvs).unwrap();
+		assert_eq!(blinded_payinfo.fee_base_msat, 0);
+		assert_eq!(blinded_payinfo.fee_proportional_millionths, 0);
+		assert_eq!(blinded_payinfo.cltv_expiry_delta, 0);
+	}
+}

From 02990cad80c26df89ad691c98df979e9382f8e2f Mon Sep 17 00:00:00 2001
From: Valentine Wallace <vwallace@protonmail.com>
Date: Sat, 19 Aug 2023 17:12:15 -0400
Subject: [PATCH 3/9] Support aggregating htlc_minimum_msat for BlindedPayInfo

---
 lightning/src/blinded_path/payment.rs | 126 +++++++++++++++++++++++++-
 1 file changed, 124 insertions(+), 2 deletions(-)

diff --git a/lightning/src/blinded_path/payment.rs b/lightning/src/blinded_path/payment.rs
index 236369ddc0e..488bdfee6c2 100644
--- a/lightning/src/blinded_path/payment.rs
+++ b/lightning/src/blinded_path/payment.rs
@@ -84,7 +84,8 @@ pub struct PaymentConstraints {
 	///
 	///[`BlindedHop`]: crate::blinded_path::BlindedHop
 	pub max_cltv_expiry: u32,
-	/// The minimum value, in msat, that may be relayed over this [`BlindedHop`].
+	/// The minimum value, in msat, that may be accepted by the node corresponding to this
+	/// [`BlindedHop`].
 	pub htlc_minimum_msat: u64,
 }
 
@@ -153,6 +154,27 @@ pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	utils::construct_blinded_hops(secp_ctx, pks, tlvs, session_priv)
 }
 
+/// `None` if underflow occurs.
+fn amt_to_forward_msat(inbound_amt_msat: u64, payment_relay: &PaymentRelay) -> Option<u64> {
+	let inbound_amt = inbound_amt_msat as u128;
+	let base = payment_relay.fee_base_msat as u128;
+	let prop = payment_relay.fee_proportional_millionths as u128;
+
+	let post_base_fee_inbound_amt =
+		if let Some(amt) = inbound_amt.checked_sub(base) { amt } else { return None };
+	let mut amt_to_forward =
+		(post_base_fee_inbound_amt * 1_000_000 + 1_000_000 + prop - 1) / (prop + 1_000_000);
+
+	let fee = ((amt_to_forward * prop) / 1_000_000) + base;
+	if inbound_amt - fee < amt_to_forward {
+		// Rounding up the forwarded amount resulted in underpaying this node, so take an extra 1 msat
+		// in fee to compensate.
+		amt_to_forward -= 1;
+	}
+	debug_assert_eq!(amt_to_forward + fee, inbound_amt);
+	u64::try_from(amt_to_forward).ok()
+}
+
 pub(super) fn compute_payinfo(
 	intermediate_nodes: &[(PublicKey, ForwardTlvs)], payee_tlvs: &ReceiveTlvs
 ) -> Result<BlindedPayInfo, ()> {
@@ -183,11 +205,26 @@ pub(super) fn compute_payinfo(
 
 		cltv_expiry_delta = cltv_expiry_delta.checked_add(tlvs.payment_relay.cltv_expiry_delta).ok_or(())?;
 	}
+
+	let mut htlc_minimum_msat: u64 = 1;
+	for (_, tlvs) in intermediate_nodes.iter() {
+		// The min htlc for an intermediate node is that node's min minus the fees charged by all of the
+		// following hops for forwarding that min, since that fee amount will automatically be included
+		// in the amount that this node receives and contribute towards reaching its min.
+		htlc_minimum_msat = amt_to_forward_msat(
+			core::cmp::max(tlvs.payment_constraints.htlc_minimum_msat, htlc_minimum_msat),
+			&tlvs.payment_relay
+		).unwrap_or(1); // If underflow occurs, we definitely reached this node's min
+	}
+	htlc_minimum_msat = core::cmp::max(
+		payee_tlvs.payment_constraints.htlc_minimum_msat, htlc_minimum_msat
+	);
+
 	Ok(BlindedPayInfo {
 		fee_base_msat: u32::try_from(curr_base_fee).map_err(|_| ())?,
 		fee_proportional_millionths: u32::try_from(curr_prop_mil).map_err(|_| ())?,
 		cltv_expiry_delta,
-		htlc_minimum_msat: 1, // TODO
+		htlc_minimum_msat,
 		htlc_maximum_msat: 21_000_000 * 100_000_000 * 1_000, // TODO
 		features: BlindedHopFeatures::empty(),
 	})
@@ -252,6 +289,7 @@ mod tests {
 		assert_eq!(blinded_payinfo.fee_base_msat, 201);
 		assert_eq!(blinded_payinfo.fee_proportional_millionths, 1001);
 		assert_eq!(blinded_payinfo.cltv_expiry_delta, 288);
+		assert_eq!(blinded_payinfo.htlc_minimum_msat, 900);
 	}
 
 	#[test]
@@ -267,5 +305,89 @@ mod tests {
 		assert_eq!(blinded_payinfo.fee_base_msat, 0);
 		assert_eq!(blinded_payinfo.fee_proportional_millionths, 0);
 		assert_eq!(blinded_payinfo.cltv_expiry_delta, 0);
+		assert_eq!(blinded_payinfo.htlc_minimum_msat, 1);
+	}
+
+	#[test]
+	fn simple_aggregated_htlc_min() {
+		// If no hops charge fees, the htlc_minimum_msat should just be the maximum htlc_minimum_msat
+		// along the path.
+		let dummy_pk = PublicKey::from_slice(&[2; 33]).unwrap();
+		let intermediate_nodes = vec![(dummy_pk, ForwardTlvs {
+			short_channel_id: 0,
+			payment_relay: PaymentRelay {
+				cltv_expiry_delta: 0,
+				fee_proportional_millionths: 0,
+				fee_base_msat: 0,
+			},
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 1,
+			},
+			features: BlindedHopFeatures::empty(),
+		}), (dummy_pk, ForwardTlvs {
+			short_channel_id: 0,
+			payment_relay: PaymentRelay {
+				cltv_expiry_delta: 0,
+				fee_proportional_millionths: 0,
+				fee_base_msat: 0,
+			},
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 2_000,
+			},
+			features: BlindedHopFeatures::empty(),
+		})];
+		let recv_tlvs = ReceiveTlvs {
+			payment_secret: PaymentSecret([0; 32]),
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 3,
+			},
+		};
+		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs).unwrap();
+		assert_eq!(blinded_payinfo.htlc_minimum_msat, 2_000);
+	}
+
+	#[test]
+	fn aggregated_htlc_min() {
+		// Create a path with varying fees and htlc_mins, and make sure htlc_minimum_msat ends up as the
+		// max (htlc_min - following_fees) along the path.
+		let dummy_pk = PublicKey::from_slice(&[2; 33]).unwrap();
+		let intermediate_nodes = vec![(dummy_pk, ForwardTlvs {
+			short_channel_id: 0,
+			payment_relay: PaymentRelay {
+				cltv_expiry_delta: 0,
+				fee_proportional_millionths: 500,
+				fee_base_msat: 1_000,
+			},
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 5_000,
+			},
+			features: BlindedHopFeatures::empty(),
+		}), (dummy_pk, ForwardTlvs {
+			short_channel_id: 0,
+			payment_relay: PaymentRelay {
+				cltv_expiry_delta: 0,
+				fee_proportional_millionths: 500,
+				fee_base_msat: 200,
+			},
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 2_000,
+			},
+			features: BlindedHopFeatures::empty(),
+		})];
+		let recv_tlvs = ReceiveTlvs {
+			payment_secret: PaymentSecret([0; 32]),
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 1,
+			},
+		};
+		let htlc_minimum_msat = 3798;
+		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs).unwrap();
+		assert_eq!(blinded_payinfo.htlc_minimum_msat, htlc_minimum_msat);
 	}
 }

From fc0d15136e4668486356dde21d80587218cdedb0 Mon Sep 17 00:00:00 2001
From: Valentine Wallace <vwallace@protonmail.com>
Date: Sat, 19 Aug 2023 17:56:33 -0400
Subject: [PATCH 4/9] Support aggregating htlc_maximum_msat for BlindedPayInfo

---
 lightning/src/blinded_path/mod.rs     | 10 +--
 lightning/src/blinded_path/payment.rs | 91 ++++++++++++++++++++++-----
 2 files changed, 80 insertions(+), 21 deletions(-)

diff --git a/lightning/src/blinded_path/mod.rs b/lightning/src/blinded_path/mod.rs
index 4a8f111be2c..82d50546ddd 100644
--- a/lightning/src/blinded_path/mod.rs
+++ b/lightning/src/blinded_path/mod.rs
@@ -76,7 +76,8 @@ impl BlindedPath {
 		})
 	}
 
-	/// Create a blinded path for a payment, to be forwarded along `intermediate_nodes`.
+	/// Create a blinded path for a payment, to be forwarded along `intermediate_nodes`, where each
+	/// node is composed of `(node_id, tlvs, htlc_maximum_msat)`.
 	///
 	/// Errors if:
 	/// * a provided node id is invalid
@@ -86,13 +87,14 @@ impl BlindedPath {
 	/// [`ForwardTlvs`]: crate::blinded_path::payment::ForwardTlvs
 	//  TODO: make all payloads the same size with padding + add dummy hops
 	pub fn new_for_payment<ES: EntropySource, T: secp256k1::Signing + secp256k1::Verification>(
-		intermediate_nodes: &[(PublicKey, payment::ForwardTlvs)], payee_node_id: PublicKey,
-		payee_tlvs: payment::ReceiveTlvs, entropy_source: &ES, secp_ctx: &Secp256k1<T>
+		intermediate_nodes: &[(PublicKey, payment::ForwardTlvs, u64)], payee_node_id: PublicKey,
+		payee_tlvs: payment::ReceiveTlvs, htlc_maximum_msat: u64, entropy_source: &ES,
+		secp_ctx: &Secp256k1<T>
 	) -> Result<(BlindedPayInfo, Self), ()> {
 		let blinding_secret_bytes = entropy_source.get_secure_random_bytes();
 		let blinding_secret = SecretKey::from_slice(&blinding_secret_bytes[..]).expect("RNG is busted");
 
-		let blinded_payinfo = payment::compute_payinfo(intermediate_nodes, &payee_tlvs)?;
+		let blinded_payinfo = payment::compute_payinfo(intermediate_nodes, &payee_tlvs, htlc_maximum_msat)?;
 		Ok((blinded_payinfo, BlindedPath {
 			introduction_node_id: intermediate_nodes.first().map_or(payee_node_id, |n| n.0),
 			blinding_point: PublicKey::from_secret_key(secp_ctx, &blinding_secret),
diff --git a/lightning/src/blinded_path/payment.rs b/lightning/src/blinded_path/payment.rs
index 488bdfee6c2..779b121cadb 100644
--- a/lightning/src/blinded_path/payment.rs
+++ b/lightning/src/blinded_path/payment.rs
@@ -144,12 +144,12 @@ impl Readable for BlindedPaymentTlvs {
 
 /// Construct blinded payment hops for the given `intermediate_nodes` and payee info.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
-	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[(PublicKey, ForwardTlvs)],
+	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[(PublicKey, ForwardTlvs, u64)],
 	payee_node_id: PublicKey, payee_tlvs: ReceiveTlvs, session_priv: &SecretKey
 ) -> Result<Vec<BlindedHop>, secp256k1::Error> {
-	let pks = intermediate_nodes.iter().map(|(pk, _)| pk)
+	let pks = intermediate_nodes.iter().map(|(pk, _, _)| pk)
 		.chain(core::iter::once(&payee_node_id));
-	let tlvs = intermediate_nodes.iter().map(|(_, tlvs)| BlindedPaymentTlvsRef::Forward(tlvs))
+	let tlvs = intermediate_nodes.iter().map(|(_, tlvs, _)| BlindedPaymentTlvsRef::Forward(tlvs))
 		.chain(core::iter::once(BlindedPaymentTlvsRef::Receive(&payee_tlvs)));
 	utils::construct_blinded_hops(secp_ctx, pks, tlvs, session_priv)
 }
@@ -176,12 +176,13 @@ fn amt_to_forward_msat(inbound_amt_msat: u64, payment_relay: &PaymentRelay) -> O
 }
 
 pub(super) fn compute_payinfo(
-	intermediate_nodes: &[(PublicKey, ForwardTlvs)], payee_tlvs: &ReceiveTlvs
+	intermediate_nodes: &[(PublicKey, ForwardTlvs, u64)], payee_tlvs: &ReceiveTlvs,
+	payee_htlc_maximum_msat: u64
 ) -> Result<BlindedPayInfo, ()> {
 	let mut curr_base_fee: u64 = 0;
 	let mut curr_prop_mil: u64 = 0;
 	let mut cltv_expiry_delta: u16 = 0;
-	for (_, tlvs) in intermediate_nodes.iter().rev() {
+	for (_, tlvs, _) in intermediate_nodes.iter().rev() {
 		// In the future, we'll want to take the intersection of all supported features for the
 		// `BlindedPayInfo`, but there are no features in that context right now.
 		if tlvs.features.requires_unknown_bits_from(&BlindedHopFeatures::empty()) { return Err(()) }
@@ -207,7 +208,8 @@ pub(super) fn compute_payinfo(
 	}
 
 	let mut htlc_minimum_msat: u64 = 1;
-	for (_, tlvs) in intermediate_nodes.iter() {
+	let mut htlc_maximum_msat: u64 = 21_000_000 * 100_000_000 * 1_000; // Total bitcoin supply
+	for (_, tlvs, max_htlc_candidate) in intermediate_nodes.iter() {
 		// The min htlc for an intermediate node is that node's min minus the fees charged by all of the
 		// following hops for forwarding that min, since that fee amount will automatically be included
 		// in the amount that this node receives and contribute towards reaching its min.
@@ -215,17 +217,22 @@ pub(super) fn compute_payinfo(
 			core::cmp::max(tlvs.payment_constraints.htlc_minimum_msat, htlc_minimum_msat),
 			&tlvs.payment_relay
 		).unwrap_or(1); // If underflow occurs, we definitely reached this node's min
+		htlc_maximum_msat = amt_to_forward_msat(
+			core::cmp::min(*max_htlc_candidate, htlc_maximum_msat), &tlvs.payment_relay
+		).ok_or(())?; // If underflow occurs, we cannot send to this hop without exceeding their max
 	}
 	htlc_minimum_msat = core::cmp::max(
 		payee_tlvs.payment_constraints.htlc_minimum_msat, htlc_minimum_msat
 	);
+	htlc_maximum_msat = core::cmp::min(payee_htlc_maximum_msat, htlc_maximum_msat);
 
+	if htlc_maximum_msat < htlc_minimum_msat { return Err(()) }
 	Ok(BlindedPayInfo {
 		fee_base_msat: u32::try_from(curr_base_fee).map_err(|_| ())?,
 		fee_proportional_millionths: u32::try_from(curr_prop_mil).map_err(|_| ())?,
 		cltv_expiry_delta,
 		htlc_minimum_msat,
-		htlc_maximum_msat: 21_000_000 * 100_000_000 * 1_000, // TODO
+		htlc_maximum_msat,
 		features: BlindedHopFeatures::empty(),
 	})
 }
@@ -265,7 +272,7 @@ mod tests {
 				htlc_minimum_msat: 100,
 			},
 			features: BlindedHopFeatures::empty(),
-		}), (dummy_pk, ForwardTlvs {
+		}, u64::max_value()), (dummy_pk, ForwardTlvs {
 			short_channel_id: 0,
 			payment_relay: PaymentRelay {
 				cltv_expiry_delta: 144,
@@ -277,7 +284,7 @@ mod tests {
 				htlc_minimum_msat: 1_000,
 			},
 			features: BlindedHopFeatures::empty(),
-		})];
+		}, u64::max_value())];
 		let recv_tlvs = ReceiveTlvs {
 			payment_secret: PaymentSecret([0; 32]),
 			payment_constraints: PaymentConstraints {
@@ -285,11 +292,13 @@ mod tests {
 				htlc_minimum_msat: 1,
 			},
 		};
-		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs).unwrap();
+		let htlc_maximum_msat = 100_000;
+		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs, htlc_maximum_msat).unwrap();
 		assert_eq!(blinded_payinfo.fee_base_msat, 201);
 		assert_eq!(blinded_payinfo.fee_proportional_millionths, 1001);
 		assert_eq!(blinded_payinfo.cltv_expiry_delta, 288);
 		assert_eq!(blinded_payinfo.htlc_minimum_msat, 900);
+		assert_eq!(blinded_payinfo.htlc_maximum_msat, htlc_maximum_msat);
 	}
 
 	#[test]
@@ -301,11 +310,12 @@ mod tests {
 				htlc_minimum_msat: 1,
 			},
 		};
-		let blinded_payinfo = super::compute_payinfo(&[], &recv_tlvs).unwrap();
+		let blinded_payinfo = super::compute_payinfo(&[], &recv_tlvs, 4242).unwrap();
 		assert_eq!(blinded_payinfo.fee_base_msat, 0);
 		assert_eq!(blinded_payinfo.fee_proportional_millionths, 0);
 		assert_eq!(blinded_payinfo.cltv_expiry_delta, 0);
 		assert_eq!(blinded_payinfo.htlc_minimum_msat, 1);
+		assert_eq!(blinded_payinfo.htlc_maximum_msat, 4242);
 	}
 
 	#[test]
@@ -325,7 +335,7 @@ mod tests {
 				htlc_minimum_msat: 1,
 			},
 			features: BlindedHopFeatures::empty(),
-		}), (dummy_pk, ForwardTlvs {
+		}, u64::max_value()), (dummy_pk, ForwardTlvs {
 			short_channel_id: 0,
 			payment_relay: PaymentRelay {
 				cltv_expiry_delta: 0,
@@ -337,7 +347,7 @@ mod tests {
 				htlc_minimum_msat: 2_000,
 			},
 			features: BlindedHopFeatures::empty(),
-		})];
+		}, u64::max_value())];
 		let recv_tlvs = ReceiveTlvs {
 			payment_secret: PaymentSecret([0; 32]),
 			payment_constraints: PaymentConstraints {
@@ -345,7 +355,8 @@ mod tests {
 				htlc_minimum_msat: 3,
 			},
 		};
-		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs).unwrap();
+		let htlc_maximum_msat = 100_000;
+		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs, htlc_maximum_msat).unwrap();
 		assert_eq!(blinded_payinfo.htlc_minimum_msat, 2_000);
 	}
 
@@ -366,7 +377,7 @@ mod tests {
 				htlc_minimum_msat: 5_000,
 			},
 			features: BlindedHopFeatures::empty(),
-		}), (dummy_pk, ForwardTlvs {
+		}, u64::max_value()), (dummy_pk, ForwardTlvs {
 			short_channel_id: 0,
 			payment_relay: PaymentRelay {
 				cltv_expiry_delta: 0,
@@ -378,7 +389,7 @@ mod tests {
 				htlc_minimum_msat: 2_000,
 			},
 			features: BlindedHopFeatures::empty(),
-		})];
+		}, u64::max_value())];
 		let recv_tlvs = ReceiveTlvs {
 			payment_secret: PaymentSecret([0; 32]),
 			payment_constraints: PaymentConstraints {
@@ -387,7 +398,53 @@ mod tests {
 			},
 		};
 		let htlc_minimum_msat = 3798;
-		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs).unwrap();
+		assert!(super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs, htlc_minimum_msat - 1).is_err());
+
+		let htlc_maximum_msat = htlc_minimum_msat + 1;
+		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs, htlc_maximum_msat).unwrap();
 		assert_eq!(blinded_payinfo.htlc_minimum_msat, htlc_minimum_msat);
+		assert_eq!(blinded_payinfo.htlc_maximum_msat, htlc_maximum_msat);
+	}
+
+	#[test]
+	fn aggregated_htlc_max() {
+		// Create a path with varying fees and `htlc_maximum_msat`s, and make sure the aggregated max
+		// htlc ends up as the min (htlc_max - following_fees) along the path.
+		let dummy_pk = PublicKey::from_slice(&[2; 33]).unwrap();
+		let intermediate_nodes = vec![(dummy_pk, ForwardTlvs {
+			short_channel_id: 0,
+			payment_relay: PaymentRelay {
+				cltv_expiry_delta: 0,
+				fee_proportional_millionths: 500,
+				fee_base_msat: 1_000,
+			},
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 1,
+			},
+			features: BlindedHopFeatures::empty(),
+		}, 5_000), (dummy_pk, ForwardTlvs {
+			short_channel_id: 0,
+			payment_relay: PaymentRelay {
+				cltv_expiry_delta: 0,
+				fee_proportional_millionths: 500,
+				fee_base_msat: 1,
+			},
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 1,
+			},
+			features: BlindedHopFeatures::empty(),
+		}, 10_000)];
+		let recv_tlvs = ReceiveTlvs {
+			payment_secret: PaymentSecret([0; 32]),
+			payment_constraints: PaymentConstraints {
+				max_cltv_expiry: 0,
+				htlc_minimum_msat: 1,
+			},
+		};
+
+		let blinded_payinfo = super::compute_payinfo(&intermediate_nodes[..], &recv_tlvs, 10_000).unwrap();
+		assert_eq!(blinded_payinfo.htlc_maximum_msat, 3997);
 	}
 }

From aee7bb4acde387983c428fddcfc5b1a173cdcee7 Mon Sep 17 00:00:00 2001
From: Valentine Wallace <vwallace@protonmail.com>
Date: Thu, 7 Sep 2023 13:32:30 -0400
Subject: [PATCH 5/9] Make blinded payment TLV fields public.

These should've been made public when they were added for use in
BlindedPath::new_for_payment.
---
 lightning/src/blinded_path/payment.rs | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lightning/src/blinded_path/payment.rs b/lightning/src/blinded_path/payment.rs
index 779b121cadb..8caf8443eee 100644
--- a/lightning/src/blinded_path/payment.rs
+++ b/lightning/src/blinded_path/payment.rs
@@ -19,25 +19,25 @@ use core::convert::TryFrom;
 /// Data to construct a [`BlindedHop`] for forwarding a payment.
 pub struct ForwardTlvs {
 	/// The short channel id this payment should be forwarded out over.
-	short_channel_id: u64,
+	pub short_channel_id: u64,
 	/// Payment parameters for relaying over [`Self::short_channel_id`].
-	payment_relay: PaymentRelay,
+	pub payment_relay: PaymentRelay,
 	/// Payment constraints for relaying over [`Self::short_channel_id`].
-	payment_constraints: PaymentConstraints,
+	pub payment_constraints: PaymentConstraints,
 	/// Supported and required features when relaying a payment onion containing this object's
 	/// corresponding [`BlindedHop::encrypted_payload`].
 	///
 	/// [`BlindedHop::encrypted_payload`]: crate::blinded_path::BlindedHop::encrypted_payload
-	features: BlindedHopFeatures,
+	pub features: BlindedHopFeatures,
 }
 
 /// Data to construct a [`BlindedHop`] for receiving a payment. This payload is custom to LDK and
 /// may not be valid if received by another lightning implementation.
 pub struct ReceiveTlvs {
 	/// Used to authenticate the sender of a payment to the receiver and tie MPP HTLCs together.
-	payment_secret: PaymentSecret,
+	pub payment_secret: PaymentSecret,
 	/// Constraints for the receiver of this payment.
-	payment_constraints: PaymentConstraints,
+	pub payment_constraints: PaymentConstraints,
 }
 
 /// Data to construct a [`BlindedHop`] for sending a payment over.

From 10a159f71e35a0e9d8e2fc9356fe350608272873 Mon Sep 17 00:00:00 2001
From: Valentine Wallace <vwallace@protonmail.com>
Date: Thu, 7 Sep 2023 13:32:51 -0400
Subject: [PATCH 6/9] Derive Clone and Debug for blinded payment TLV structs

---
 lightning/src/blinded_path/payment.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lightning/src/blinded_path/payment.rs b/lightning/src/blinded_path/payment.rs
index 8caf8443eee..65af85eca4d 100644
--- a/lightning/src/blinded_path/payment.rs
+++ b/lightning/src/blinded_path/payment.rs
@@ -17,6 +17,7 @@ use crate::util::ser::{Readable, Writeable, Writer};
 use core::convert::TryFrom;
 
 /// Data to construct a [`BlindedHop`] for forwarding a payment.
+#[derive(Clone, Debug)]
 pub struct ForwardTlvs {
 	/// The short channel id this payment should be forwarded out over.
 	pub short_channel_id: u64,
@@ -33,6 +34,7 @@ pub struct ForwardTlvs {
 
 /// Data to construct a [`BlindedHop`] for receiving a payment. This payload is custom to LDK and
 /// may not be valid if received by another lightning implementation.
+#[derive(Clone, Debug)]
 pub struct ReceiveTlvs {
 	/// Used to authenticate the sender of a payment to the receiver and tie MPP HTLCs together.
 	pub payment_secret: PaymentSecret,
@@ -59,6 +61,7 @@ enum BlindedPaymentTlvsRef<'a> {
 /// Parameters for relaying over a given [`BlindedHop`].
 ///
 /// [`BlindedHop`]: crate::blinded_path::BlindedHop
+#[derive(Clone, Debug)]
 pub struct PaymentRelay {
 	/// Number of blocks subtracted from an incoming HTLC's `cltv_expiry` for this [`BlindedHop`].
 	///
@@ -78,6 +81,7 @@ pub struct PaymentRelay {
 /// Constraints for relaying over a given [`BlindedHop`].
 ///
 /// [`BlindedHop`]: crate::blinded_path::BlindedHop
+#[derive(Clone, Debug)]
 pub struct PaymentConstraints {
 	/// The maximum total CLTV delta that is acceptable when relaying a payment over this
 	/// [`BlindedHop`].

From d5925f210ed9820ace75c5c1af6c43473ec6892b Mon Sep 17 00:00:00 2001
From: Valentine Wallace <vwallace@protonmail.com>
Date: Thu, 24 Aug 2023 15:23:06 -0400
Subject: [PATCH 7/9] Fix blinded payment TLV ser to not length-prefix

impl_writeable_tlv_based includes a length prefix to the TLV stream, which we
don't want.
---
 lightning/src/blinded_path/payment.rs | 32 ++++++++++++++++++---------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/lightning/src/blinded_path/payment.rs b/lightning/src/blinded_path/payment.rs
index 65af85eca4d..b671fb919d5 100644
--- a/lightning/src/blinded_path/payment.rs
+++ b/lightning/src/blinded_path/payment.rs
@@ -93,17 +93,27 @@ pub struct PaymentConstraints {
 	pub htlc_minimum_msat: u64,
 }
 
-impl_writeable_tlv_based!(ForwardTlvs, {
-	(2, short_channel_id, required),
-	(10, payment_relay, required),
-	(12, payment_constraints, required),
-	(14, features, required),
-});
-
-impl_writeable_tlv_based!(ReceiveTlvs, {
-	(12, payment_constraints, required),
-	(65536, payment_secret, required),
-});
+impl Writeable for ForwardTlvs {
+	fn write<W: Writer>(&self, w: &mut W) -> Result<(), io::Error> {
+		encode_tlv_stream!(w, {
+			(2, self.short_channel_id, required),
+			(10, self.payment_relay, required),
+			(12, self.payment_constraints, required),
+			(14, self.features, required)
+		});
+		Ok(())
+	}
+}
+
+impl Writeable for ReceiveTlvs {
+	fn write<W: Writer>(&self, w: &mut W) -> Result<(), io::Error> {
+		encode_tlv_stream!(w, {
+			(12, self.payment_constraints, required),
+			(65536, self.payment_secret, required)
+		});
+		Ok(())
+	}
+}
 
 impl<'a> Writeable for BlindedPaymentTlvsRef<'a> {
 	fn write<W: Writer>(&self, w: &mut W) -> Result<(), io::Error> {

From 138a5a770c1f870ec16844295f16a5406257e80d Mon Sep 17 00:00:00 2001
From: Valentine Wallace <vwallace@protonmail.com>
Date: Thu, 7 Sep 2023 17:10:21 -0400
Subject: [PATCH 8/9] Remove unnecessary doc links

---
 lightning/src/blinded_path/payment.rs | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/lightning/src/blinded_path/payment.rs b/lightning/src/blinded_path/payment.rs
index b671fb919d5..25031f9b472 100644
--- a/lightning/src/blinded_path/payment.rs
+++ b/lightning/src/blinded_path/payment.rs
@@ -64,17 +64,11 @@ enum BlindedPaymentTlvsRef<'a> {
 #[derive(Clone, Debug)]
 pub struct PaymentRelay {
 	/// Number of blocks subtracted from an incoming HTLC's `cltv_expiry` for this [`BlindedHop`].
-	///
-	///[`BlindedHop`]: crate::blinded_path::BlindedHop
 	pub cltv_expiry_delta: u16,
 	/// Liquidity fee charged (in millionths of the amount transferred) for relaying a payment over
 	/// this [`BlindedHop`], (i.e., 10,000 is 1%).
-	///
-	///[`BlindedHop`]: crate::blinded_path::BlindedHop
 	pub fee_proportional_millionths: u32,
 	/// Base fee charged (in millisatoshi) for relaying a payment over this [`BlindedHop`].
-	///
-	///[`BlindedHop`]: crate::blinded_path::BlindedHop
 	pub fee_base_msat: u32,
 }
 
@@ -85,8 +79,6 @@ pub struct PaymentRelay {
 pub struct PaymentConstraints {
 	/// The maximum total CLTV delta that is acceptable when relaying a payment over this
 	/// [`BlindedHop`].
-	///
-	///[`BlindedHop`]: crate::blinded_path::BlindedHop
 	pub max_cltv_expiry: u32,
 	/// The minimum value, in msat, that may be accepted by the node corresponding to this
 	/// [`BlindedHop`].

From f3616e606ffd76b1769638c910e8db2234bbf5ff Mon Sep 17 00:00:00 2001
From: Valentine Wallace <vwallace@protonmail.com>
Date: Thu, 7 Sep 2023 17:11:30 -0400
Subject: [PATCH 9/9] Struct-ify blinded payment path intermediate node info

---
 lightning/src/blinded_path/mod.rs     |   7 +-
 lightning/src/blinded_path/payment.rs | 249 +++++++++++++++-----------
 2 files changed, 149 insertions(+), 107 deletions(-)

diff --git a/lightning/src/blinded_path/mod.rs b/lightning/src/blinded_path/mod.rs
index 82d50546ddd..927bbea9f6e 100644
--- a/lightning/src/blinded_path/mod.rs
+++ b/lightning/src/blinded_path/mod.rs
@@ -76,8 +76,7 @@ impl BlindedPath {
 		})
 	}
 
-	/// Create a blinded path for a payment, to be forwarded along `intermediate_nodes`, where each
-	/// node is composed of `(node_id, tlvs, htlc_maximum_msat)`.
+	/// Create a blinded path for a payment, to be forwarded along `intermediate_nodes`.
 	///
 	/// Errors if:
 	/// * a provided node id is invalid
@@ -87,7 +86,7 @@ impl BlindedPath {
 	/// [`ForwardTlvs`]: crate::blinded_path::payment::ForwardTlvs
 	//  TODO: make all payloads the same size with padding + add dummy hops
 	pub fn new_for_payment<ES: EntropySource, T: secp256k1::Signing + secp256k1::Verification>(
-		intermediate_nodes: &[(PublicKey, payment::ForwardTlvs, u64)], payee_node_id: PublicKey,
+		intermediate_nodes: &[payment::ForwardNode], payee_node_id: PublicKey,
 		payee_tlvs: payment::ReceiveTlvs, htlc_maximum_msat: u64, entropy_source: &ES,
 		secp_ctx: &Secp256k1<T>
 	) -> Result<(BlindedPayInfo, Self), ()> {
@@ -96,7 +95,7 @@ impl BlindedPath {
 
 		let blinded_payinfo = payment::compute_payinfo(intermediate_nodes, &payee_tlvs, htlc_maximum_msat)?;
 		Ok((blinded_payinfo, BlindedPath {
-			introduction_node_id: intermediate_nodes.first().map_or(payee_node_id, |n| n.0),
+			introduction_node_id: intermediate_nodes.first().map_or(payee_node_id, |n| n.node_id),
 			blinding_point: PublicKey::from_secret_key(secp_ctx, &blinding_secret),
 			blinded_hops: payment::blinded_hops(
 				secp_ctx, intermediate_nodes, payee_node_id, payee_tlvs, &blinding_secret
diff --git a/lightning/src/blinded_path/payment.rs b/lightning/src/blinded_path/payment.rs
index 25031f9b472..32181f7889c 100644
--- a/lightning/src/blinded_path/payment.rs
+++ b/lightning/src/blinded_path/payment.rs
@@ -16,6 +16,18 @@ use crate::util::ser::{Readable, Writeable, Writer};
 
 use core::convert::TryFrom;
 
+/// An intermediate node, its outbound channel, and relay parameters.
+#[derive(Clone, Debug)]
+pub struct ForwardNode {
+	/// The TLVs for this node's [`BlindedHop`], where the fee parameters contained within are also
+	/// used for [`BlindedPayInfo`] construction.
+	pub tlvs: ForwardTlvs,
+	/// This node's pubkey.
+	pub node_id: PublicKey,
+	/// The maximum value, in msat, that may be accepted by this node.
+	pub htlc_maximum_msat: u64,
+}
+
 /// Data to construct a [`BlindedHop`] for forwarding a payment.
 #[derive(Clone, Debug)]
 pub struct ForwardTlvs {
@@ -150,12 +162,12 @@ impl Readable for BlindedPaymentTlvs {
 
 /// Construct blinded payment hops for the given `intermediate_nodes` and payee info.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
-	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[(PublicKey, ForwardTlvs, u64)],
+	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[ForwardNode],
 	payee_node_id: PublicKey, payee_tlvs: ReceiveTlvs, session_priv: &SecretKey
 ) -> Result<Vec<BlindedHop>, secp256k1::Error> {
-	let pks = intermediate_nodes.iter().map(|(pk, _, _)| pk)
+	let pks = intermediate_nodes.iter().map(|node| &node.node_id)
 		.chain(core::iter::once(&payee_node_id));
-	let tlvs = intermediate_nodes.iter().map(|(_, tlvs, _)| BlindedPaymentTlvsRef::Forward(tlvs))
+	let tlvs = intermediate_nodes.iter().map(|node| BlindedPaymentTlvsRef::Forward(&node.tlvs))
 		.chain(core::iter::once(BlindedPaymentTlvsRef::Receive(&payee_tlvs)));
 	utils::construct_blinded_hops(secp_ctx, pks, tlvs, session_priv)
 }
@@ -182,13 +194,12 @@ fn amt_to_forward_msat(inbound_amt_msat: u64, payment_relay: &PaymentRelay) -> O
 }
 
 pub(super) fn compute_payinfo(
-	intermediate_nodes: &[(PublicKey, ForwardTlvs, u64)], payee_tlvs: &ReceiveTlvs,
-	payee_htlc_maximum_msat: u64
+	intermediate_nodes: &[ForwardNode], payee_tlvs: &ReceiveTlvs, payee_htlc_maximum_msat: u64
 ) -> Result<BlindedPayInfo, ()> {
 	let mut curr_base_fee: u64 = 0;
 	let mut curr_prop_mil: u64 = 0;
 	let mut cltv_expiry_delta: u16 = 0;
-	for (_, tlvs, _) in intermediate_nodes.iter().rev() {
+	for tlvs in intermediate_nodes.iter().rev().map(|n| &n.tlvs) {
 		// In the future, we'll want to take the intersection of all supported features for the
 		// `BlindedPayInfo`, but there are no features in that context right now.
 		if tlvs.features.requires_unknown_bits_from(&BlindedHopFeatures::empty()) { return Err(()) }
@@ -215,16 +226,16 @@ pub(super) fn compute_payinfo(
 
 	let mut htlc_minimum_msat: u64 = 1;
 	let mut htlc_maximum_msat: u64 = 21_000_000 * 100_000_000 * 1_000; // Total bitcoin supply
-	for (_, tlvs, max_htlc_candidate) in intermediate_nodes.iter() {
+	for node in intermediate_nodes.iter() {
 		// The min htlc for an intermediate node is that node's min minus the fees charged by all of the
 		// following hops for forwarding that min, since that fee amount will automatically be included
 		// in the amount that this node receives and contribute towards reaching its min.
 		htlc_minimum_msat = amt_to_forward_msat(
-			core::cmp::max(tlvs.payment_constraints.htlc_minimum_msat, htlc_minimum_msat),
-			&tlvs.payment_relay
+			core::cmp::max(node.tlvs.payment_constraints.htlc_minimum_msat, htlc_minimum_msat),
+			&node.tlvs.payment_relay
 		).unwrap_or(1); // If underflow occurs, we definitely reached this node's min
 		htlc_maximum_msat = amt_to_forward_msat(
-			core::cmp::min(*max_htlc_candidate, htlc_maximum_msat), &tlvs.payment_relay
+			core::cmp::min(node.htlc_maximum_msat, htlc_maximum_msat), &node.tlvs.payment_relay
 		).ok_or(())?; // If underflow occurs, we cannot send to this hop without exceeding their max
 	}
 	htlc_minimum_msat = core::cmp::max(
@@ -257,7 +268,7 @@ impl_writeable_msg!(PaymentConstraints, {
 #[cfg(test)]
 mod tests {
 	use bitcoin::secp256k1::PublicKey;
-	use crate::blinded_path::payment::{ForwardTlvs, ReceiveTlvs, PaymentConstraints, PaymentRelay};
+	use crate::blinded_path::payment::{ForwardNode, ForwardTlvs, ReceiveTlvs, PaymentConstraints, PaymentRelay};
 	use crate::ln::PaymentSecret;
 	use crate::ln::features::BlindedHopFeatures;
 
@@ -266,31 +277,39 @@ mod tests {
 		// Taken from the spec example for aggregating blinded payment info. See
 		// https://github.com/lightning/bolts/blob/master/proposals/route-blinding.md#blinded-payments
 		let dummy_pk = PublicKey::from_slice(&[2; 33]).unwrap();
-		let intermediate_nodes = vec![(dummy_pk, ForwardTlvs {
-			short_channel_id: 0,
-			payment_relay: PaymentRelay {
-				cltv_expiry_delta: 144,
-				fee_proportional_millionths: 500,
-				fee_base_msat: 100,
-			},
-			payment_constraints: PaymentConstraints {
-				max_cltv_expiry: 0,
-				htlc_minimum_msat: 100,
+		let intermediate_nodes = vec![ForwardNode {
+			node_id: dummy_pk,
+			tlvs: ForwardTlvs {
+				short_channel_id: 0,
+				payment_relay: PaymentRelay {
+					cltv_expiry_delta: 144,
+					fee_proportional_millionths: 500,
+					fee_base_msat: 100,
+				},
+				payment_constraints: PaymentConstraints {
+					max_cltv_expiry: 0,
+					htlc_minimum_msat: 100,
+				},
+				features: BlindedHopFeatures::empty(),
 			},
-			features: BlindedHopFeatures::empty(),
-		}, u64::max_value()), (dummy_pk, ForwardTlvs {
-			short_channel_id: 0,
-			payment_relay: PaymentRelay {
-				cltv_expiry_delta: 144,
-				fee_proportional_millionths: 500,
-				fee_base_msat: 100,
+			htlc_maximum_msat: u64::max_value(),
+		}, ForwardNode {
+			node_id: dummy_pk,
+			tlvs: ForwardTlvs {
+				short_channel_id: 0,
+				payment_relay: PaymentRelay {
+					cltv_expiry_delta: 144,
+					fee_proportional_millionths: 500,
+					fee_base_msat: 100,
+				},
+				payment_constraints: PaymentConstraints {
+					max_cltv_expiry: 0,
+					htlc_minimum_msat: 1_000,
+				},
+				features: BlindedHopFeatures::empty(),
 			},
-			payment_constraints: PaymentConstraints {
-				max_cltv_expiry: 0,
-				htlc_minimum_msat: 1_000,
-			},
-			features: BlindedHopFeatures::empty(),
-		}, u64::max_value())];
+			htlc_maximum_msat: u64::max_value(),
+		}];
 		let recv_tlvs = ReceiveTlvs {
 			payment_secret: PaymentSecret([0; 32]),
 			payment_constraints: PaymentConstraints {
@@ -329,31 +348,39 @@ mod tests {
 		// If no hops charge fees, the htlc_minimum_msat should just be the maximum htlc_minimum_msat
 		// along the path.
 		let dummy_pk = PublicKey::from_slice(&[2; 33]).unwrap();
-		let intermediate_nodes = vec![(dummy_pk, ForwardTlvs {
-			short_channel_id: 0,
-			payment_relay: PaymentRelay {
-				cltv_expiry_delta: 0,
-				fee_proportional_millionths: 0,
-				fee_base_msat: 0,
+		let intermediate_nodes = vec![ForwardNode {
+			node_id: dummy_pk,
+			tlvs: ForwardTlvs {
+				short_channel_id: 0,
+				payment_relay: PaymentRelay {
+					cltv_expiry_delta: 0,
+					fee_proportional_millionths: 0,
+					fee_base_msat: 0,
+				},
+				payment_constraints: PaymentConstraints {
+					max_cltv_expiry: 0,
+					htlc_minimum_msat: 1,
+				},
+				features: BlindedHopFeatures::empty(),
 			},
-			payment_constraints: PaymentConstraints {
-				max_cltv_expiry: 0,
-				htlc_minimum_msat: 1,
-			},
-			features: BlindedHopFeatures::empty(),
-		}, u64::max_value()), (dummy_pk, ForwardTlvs {
-			short_channel_id: 0,
-			payment_relay: PaymentRelay {
-				cltv_expiry_delta: 0,
-				fee_proportional_millionths: 0,
-				fee_base_msat: 0,
-			},
-			payment_constraints: PaymentConstraints {
-				max_cltv_expiry: 0,
-				htlc_minimum_msat: 2_000,
+			htlc_maximum_msat: u64::max_value()
+		}, ForwardNode {
+			node_id: dummy_pk,
+			tlvs: ForwardTlvs {
+				short_channel_id: 0,
+				payment_relay: PaymentRelay {
+					cltv_expiry_delta: 0,
+					fee_proportional_millionths: 0,
+					fee_base_msat: 0,
+				},
+				payment_constraints: PaymentConstraints {
+					max_cltv_expiry: 0,
+					htlc_minimum_msat: 2_000,
+				},
+				features: BlindedHopFeatures::empty(),
 			},
-			features: BlindedHopFeatures::empty(),
-		}, u64::max_value())];
+			htlc_maximum_msat: u64::max_value()
+		}];
 		let recv_tlvs = ReceiveTlvs {
 			payment_secret: PaymentSecret([0; 32]),
 			payment_constraints: PaymentConstraints {
@@ -371,31 +398,39 @@ mod tests {
 		// Create a path with varying fees and htlc_mins, and make sure htlc_minimum_msat ends up as the
 		// max (htlc_min - following_fees) along the path.
 		let dummy_pk = PublicKey::from_slice(&[2; 33]).unwrap();
-		let intermediate_nodes = vec![(dummy_pk, ForwardTlvs {
-			short_channel_id: 0,
-			payment_relay: PaymentRelay {
-				cltv_expiry_delta: 0,
-				fee_proportional_millionths: 500,
-				fee_base_msat: 1_000,
-			},
-			payment_constraints: PaymentConstraints {
-				max_cltv_expiry: 0,
-				htlc_minimum_msat: 5_000,
+		let intermediate_nodes = vec![ForwardNode {
+			node_id: dummy_pk,
+			tlvs: ForwardTlvs {
+				short_channel_id: 0,
+				payment_relay: PaymentRelay {
+					cltv_expiry_delta: 0,
+					fee_proportional_millionths: 500,
+					fee_base_msat: 1_000,
+				},
+				payment_constraints: PaymentConstraints {
+					max_cltv_expiry: 0,
+					htlc_minimum_msat: 5_000,
+				},
+				features: BlindedHopFeatures::empty(),
 			},
-			features: BlindedHopFeatures::empty(),
-		}, u64::max_value()), (dummy_pk, ForwardTlvs {
-			short_channel_id: 0,
-			payment_relay: PaymentRelay {
-				cltv_expiry_delta: 0,
-				fee_proportional_millionths: 500,
-				fee_base_msat: 200,
+			htlc_maximum_msat: u64::max_value()
+		}, ForwardNode {
+			node_id: dummy_pk,
+			tlvs: ForwardTlvs {
+				short_channel_id: 0,
+				payment_relay: PaymentRelay {
+					cltv_expiry_delta: 0,
+					fee_proportional_millionths: 500,
+					fee_base_msat: 200,
+				},
+				payment_constraints: PaymentConstraints {
+					max_cltv_expiry: 0,
+					htlc_minimum_msat: 2_000,
+				},
+				features: BlindedHopFeatures::empty(),
 			},
-			payment_constraints: PaymentConstraints {
-				max_cltv_expiry: 0,
-				htlc_minimum_msat: 2_000,
-			},
-			features: BlindedHopFeatures::empty(),
-		}, u64::max_value())];
+			htlc_maximum_msat: u64::max_value()
+		}];
 		let recv_tlvs = ReceiveTlvs {
 			payment_secret: PaymentSecret([0; 32]),
 			payment_constraints: PaymentConstraints {
@@ -417,31 +452,39 @@ mod tests {
 		// Create a path with varying fees and `htlc_maximum_msat`s, and make sure the aggregated max
 		// htlc ends up as the min (htlc_max - following_fees) along the path.
 		let dummy_pk = PublicKey::from_slice(&[2; 33]).unwrap();
-		let intermediate_nodes = vec![(dummy_pk, ForwardTlvs {
-			short_channel_id: 0,
-			payment_relay: PaymentRelay {
-				cltv_expiry_delta: 0,
-				fee_proportional_millionths: 500,
-				fee_base_msat: 1_000,
+		let intermediate_nodes = vec![ForwardNode {
+			node_id: dummy_pk,
+			tlvs: ForwardTlvs {
+				short_channel_id: 0,
+				payment_relay: PaymentRelay {
+					cltv_expiry_delta: 0,
+					fee_proportional_millionths: 500,
+					fee_base_msat: 1_000,
+				},
+				payment_constraints: PaymentConstraints {
+					max_cltv_expiry: 0,
+					htlc_minimum_msat: 1,
+				},
+				features: BlindedHopFeatures::empty(),
 			},
-			payment_constraints: PaymentConstraints {
-				max_cltv_expiry: 0,
-				htlc_minimum_msat: 1,
-			},
-			features: BlindedHopFeatures::empty(),
-		}, 5_000), (dummy_pk, ForwardTlvs {
-			short_channel_id: 0,
-			payment_relay: PaymentRelay {
-				cltv_expiry_delta: 0,
-				fee_proportional_millionths: 500,
-				fee_base_msat: 1,
-			},
-			payment_constraints: PaymentConstraints {
-				max_cltv_expiry: 0,
-				htlc_minimum_msat: 1,
+			htlc_maximum_msat: 5_000,
+		}, ForwardNode {
+			node_id: dummy_pk,
+			tlvs: ForwardTlvs {
+				short_channel_id: 0,
+				payment_relay: PaymentRelay {
+					cltv_expiry_delta: 0,
+					fee_proportional_millionths: 500,
+					fee_base_msat: 1,
+				},
+				payment_constraints: PaymentConstraints {
+					max_cltv_expiry: 0,
+					htlc_minimum_msat: 1,
+				},
+				features: BlindedHopFeatures::empty(),
 			},
-			features: BlindedHopFeatures::empty(),
-		}, 10_000)];
+			htlc_maximum_msat: 10_000
+		}];
 		let recv_tlvs = ReceiveTlvs {
 			payment_secret: PaymentSecret([0; 32]),
 			payment_constraints: PaymentConstraints {