thunder-bridge 0.8.1 → 0.8.2

package/README.md

@@ -12,10 +12,11 @@ amount you asked for rather than the amount the gateway echoed back, and its
 settlement proof url belongs to the recipient. A gateway that substitutes an
 invoice is caught before a payer sees a QR code.
 
-Lightning is the rail it was built for, not the only one it can prove.
-`bankTransfer` derives a preimage and hands the gateway its hash, which puts money
-landing in a bank account behind the same watch and the same proof. `Statement` is
-the seam a bank plugs into and `fioStatement` is the first one.
+Lightning is the rail it was built for, not the only one it can prove. A bank
+transfer has no preimage, so `bankTransfer` derives one and hands the gateway its
+hash, which puts money arriving in a bank account behind the same watch, the same
+poll and the same proof. `Statement` is where a bank plugs in and `fioStatement`
+is the first one.
 
 It touches only `fetch`, `crypto.subtle`, `URL` and `WebSocket`, so it runs in
 Node, Bun, Deno, Cloudflare Workers and the browser. The gateway it talks to is
@@ -36,7 +37,7 @@ CORS open, so the proof fetches work from a browser too.
 ```ts
 import { ThunderBridge, invoiceToSvg, type CreatePaymentParams } from "thunder-bridge";
 
-const gateway = new ThunderBridge("https://thunder-bridge-direct-production.up.railway.app");
+const gateway = new ThunderBridge("https://thunder-bridge-production.up.railway.app");
 
 const request: CreatePaymentParams = {
   lnAddresses: ["alice@coinos.io", "alice@getalby.com"],
@@ -106,17 +107,38 @@ them and this table does not repeat them.
 | Export | What it does |
 |---|---|
 | `lnurlPayEndpoint(config)` | a whole LNURL-pay endpoint as one Fetch handler, so a static QR points at your domain |
-| `bankTransfer(params)` | register a Czech QR platba as a watched payment. Refuses a gateway with no token |
-| `bankVerifyEndpoint(config)` | the other half, the LUD-21 shape backed by your own statement |
-| `fioStatement(config)` | a `Statement` reading a Fio account, several tokens used strictly in turn |
 | `seal(secret, plaintext)`, `unseal` | the blob the gateway stores and cannot read |
 | `toLnurl(url)` | bech32-encode an endpoint url |
+| `bankTransfer(params)` | register a Czech QR platba as a watched payment. Refuses a gateway that serves strangers |
+| `bankVerifyEndpoint(config)` | the other half, the LUD-21 shape backed by your own statement |
+| `fioStatement(config)` | a `Statement` reading a Fio account, several tokens used strictly in turn |
+
+What your service answers once those handlers are mounted is written out in
+[`openapi.yaml`](openapi.yaml), shipped with this package.
 
 `Statement` is a plain `(sinceUnix) => Promise<Credit[]>`, so another bank is
 another function of that shape and persistence wraps it from outside rather than
 living inside it. Nothing above it changes, and the package stays ignorant of
 whatever runtime you keep state in.
 
+**One shape for every payment method** - [`src/rail.ts`](src/rail.ts)
+
+| Export | What it does |
+|---|---|
+| `bankRail(config)` | a `Rail` selling for a bank transfer, reading back through any `Statement` |
+| `lightningRail(config)` | a `Rail` where the gateway mints the invoice, so it learns the address and the amount |
+| `blindLightningRail(config)` | a `Rail` that resolves the address itself and tells the gateway only a hash |
+
+`Rail` is `(order: Order) => Promise<Leg>`. Everything that differs between rails
+is bound once when the rail is built, so the only thing passed per sale is which
+sale it is: a reference, an amount in minor units and a currency. A `Leg` reads
+the same whichever rail made it, which is what lets `firstToSettle` take a mixed
+list without being told what is in it.
+
+The gateway is already indifferent to all of this. It holds a payment hash, polls
+a verify URL and reports what came back, so a rail is an SDK-side arrangement of
+calls the gateway already answers, not a plugin it has to load.
+
 **Pricing a fiat order** - [`src/price.ts`](src/price.ts), [`src/currency.ts`](src/currency.ts)
 
 | Export | What it does |
@@ -129,10 +151,12 @@ whatever runtime you keep state in.
 **QR codes** - [`src/qr.ts`](src/qr.ts)
 
 Every renderer returns a string, so they work on a server, in a worker and in a
-browser with no canvas involved. `invoiceToSvg` takes an invoice or a lightning
-address, `lnurlToSvg` takes your own endpoint url, `spdToSvg` takes the `spd` from
-`bankTransfer`. Each has a `…ToDataUrl` twin for an `<img>` `src`. A BOLT12 offer
-is not handled, because this gateway never returns one.
+browser with no canvas involved. `qrToSvg` takes any rail's `Leg.qr` and needs to
+know nothing else, because a rail states its own payload. Below it sit the
+format-named ones for calling directly: `invoiceToSvg` takes an invoice or a
+lightning address, `lnurlToSvg` takes your own endpoint url, `spdToSvg` takes a
+Short Payment Descriptor. Each has a `…ToDataUrl` twin for an `<img>` `src`. A
+BOLT12 offer is not handled, because this gateway never returns one.
 
 ```ts
 import { invoiceToSvg, lnurlToSvg } from "thunder-bridge";

package/dist/index.cjs

@@ -30,9 +30,11 @@ __export(index_exports, {
   REQUEST_IN_FLIGHT: () => REQUEST_IN_FLIGHT,
   ThunderBridge: () => ThunderBridge,
   UnverifiedRecipientError: () => UnverifiedRecipientError,
+  bankRail: () => bankRail,
   bankTransfer: () => bankTransfer,
   bankVerifyEndpoint: () => bankVerifyEndpoint,
   bitstamp: () => bitstamp,
+  blindLightningRail: () => blindLightningRail,
   coinbase: () => coinbase,
   coinmate: () => coinmate,
   decodeInvoice: () => decodeInvoice,
@@ -42,6 +44,7 @@ __export(index_exports, {
   isProblemType: () => isProblemType,
   isProvablyPaid: () => isProvablyPaid,
   kraken: () => kraken,
+  lightningRail: () => lightningRail,
   lnurlPayEndpoint: () => lnurlPayEndpoint,
   lnurlToDataUrl: () => lnurlToDataUrl,
   lnurlToSvg: () => lnurlToSvg,
@@ -54,6 +57,8 @@ __export(index_exports, {
   preimageMatchesHash: () => preimageMatchesHash,
   proveOrigin: () => proveOrigin,
   proveSettlement: () => proveSettlement,
+  qrToDataUrl: () => qrToDataUrl,
+  qrToSvg: () => qrToSvg,
   seal: () => seal,
   spdToDataUrl: () => spdToDataUrl,
   spdToSvg: () => spdToSvg,
@@ -99,10 +104,8 @@ var ProblemError = class extends Error {
     this.detail = problem.detail ?? null;
   }
 };
-var NAMESPACE = "urn:problem-type:thunder-bridge:";
-var NAMESPACE_BEFORE_THE_RENAME = "urn:problem-type:thunder-bridge-direct:";
 function isProblemType(problem, type) {
-  return problem.type === type || problem.type === type.replace(NAMESPACE, NAMESPACE_BEFORE_THE_RENAME);
+  return problem.type === type;
 }
 var NO_WALLET_AVAILABLE = "urn:problem-type:thunder-bridge:no-wallet-available";
 var REQUEST_IN_FLIGHT = "urn:problem-type:thunder-bridge:request-in-flight";
@@ -138,8 +141,8 @@ function hexToBytes(hex) {
   }
   return bytes;
 }
-function isHex(text2) {
-  return /^[0-9a-f]+$/i.test(text2) && text2.length % 2 === 0;
+function isHex(text3) {
+  return /^[0-9a-f]+$/i.test(text3) && text3.length % 2 === 0;
 }
 
 // ../core/sha256.ts
@@ -233,8 +236,8 @@ function sha256(bytes) {
   }
   return asBytes(state);
 }
-function sha256Hex(text2) {
-  return bytesToHex(sha256(new TextEncoder().encode(text2)));
+function sha256Hex(text3) {
+  return bytesToHex(sha256(new TextEncoder().encode(text3)));
 }
 function withPadding(bytes) {
   const padded = new Uint8Array(
@@ -413,10 +416,13 @@ function sameOrigin(one, other) {
     return false;
   }
 }
+function publicAddress(literal) {
+  return literal.includes(":") ? ipv6IsGlobal(literal) : ipv4IsGlobal(literal);
+}
 function hostIsPublic(host) {
-  if (host.startsWith("[")) return ipv6IsGlobal(host.slice(1, -1));
+  if (host.startsWith("[")) return publicAddress(host.slice(1, -1));
   const name = host.replace(/\.$/, "");
-  if (/^\d+\.\d+\.\d+\.\d+$/.test(name)) return ipv4IsGlobal(name);
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(name)) return publicAddress(name);
   const labels = name.split(".");
   if (labels.length < 2 || labels.some((label) => label === "")) return false;
   return !PRIVATE_SUFFIXES.includes(labels[labels.length - 1]);
@@ -681,6 +687,16 @@ var TERMINAL = /* @__PURE__ */ new Set(["paid", "expired"]);
 var RECONNECT_DELAY_MS = 3e3;
 var RECONNECT_CAP_MS = 3e4;
 var UNANSWERED_ATTEMPTS = 5;
+var TRIGGER_MIN_CHARS = 16;
+var STRANGER_PROBE = "is-this-gateway-yours";
+function unguessable(trigger) {
+  if (trigger.length < TRIGGER_MIN_CHARS) {
+    throw new Error(
+      `a trigger secret is the only thing guarding its stream, and nothing rate limits a guess at it, so it has to be at least ${TRIGGER_MIN_CHARS} characters nobody can predict`
+    );
+  }
+  return trigger;
+}
 function backoffMs(firstDelay, attempt) {
   const grown = Math.min(firstDelay * 2 ** (attempt - 1), RECONNECT_CAP_MS);
   return Math.round(grown * (0.5 + Math.random() / 2));
@@ -689,6 +705,7 @@ var ThunderBridge = class {
   baseUrl;
   verify;
   token;
+  strangers = null;
   constructor(baseUrl, options) {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.verify = options?.verify ?? true;
@@ -702,6 +719,21 @@ var ThunderBridge = class {
   get isPrivate() {
     return this.token !== null;
   }
+  /**
+   * Whether the gateway turns away a caller carrying no token, asked by making
+   * one unauthenticated read it would have to refuse. `isPrivate` answers only
+   * whether you configured a token, which is your side of the arrangement and
+   * says nothing about the gateway's, so a made-up token against a public
+   * instance reads as private and is not. Asked once and remembered, because an
+   * instance does not change its mind. Anything other than a refusal counts as
+   * open, so an unreachable gateway fails closed
+   */
+  async refusesStrangers() {
+    this.strangers ??= fetch(`${this.baseUrl}/incoming-payments/${STRANGER_PROBE}`, {
+      headers: { accept: "application/json" }
+    }).then((answer) => answer.status === 401).catch(() => false);
+    return await this.strangers;
+  }
   /**
    * Ask the gateway for an invoice payable to the first address on your list
    * that can issue a provable one, throws `NoWalletAvailableError` when none can
@@ -713,7 +745,10 @@ var ThunderBridge = class {
     const response = await fetch(`${this.baseUrl}/incoming-payments`, {
       method: "POST",
       headers,
-      body: createRequestBody(params, options?.trigger ? sha256Hex(options.trigger) : null)
+      body: createRequestBody(
+        params,
+        options?.trigger ? sha256Hex(unguessable(options.trigger)) : null
+      )
     });
     if (!response.ok) throw await problemFrom(response);
     const payment = await paymentFrom(response);
@@ -955,7 +990,10 @@ var ThunderBridge = class {
     const response = await fetch(`${this.baseUrl}/watched-payments`, {
       method: "POST",
       headers: this.sending(),
-      body: watchRequestBody(params, params.trigger ? sha256Hex(params.trigger) : null)
+      body: watchRequestBody(
+        params,
+        params.trigger ? sha256Hex(unguessable(params.trigger)) : null
+      )
     });
     if (!response.ok) throw await problemFrom(response);
     const watched = triggerEventFromWire(await response.json().catch(() => null));
@@ -974,7 +1012,7 @@ var ThunderBridge = class {
    */
   followTrigger(secret, options) {
     const base = this.baseUrl.replace(/^http/, "ws");
-    const direct = `${base}/ws/triggers/${encodeURIComponent(secret)}`;
+    const direct = `${base}/ws/triggers/${encodeURIComponent(unguessable(secret))}`;
     const firstDelay = options.reconnectDelayMs ?? RECONNECT_DELAY_MS;
     let socket = null;
     let retry;
@@ -1146,10 +1184,10 @@ function toBase64Url(bytes) {
   for (const byte of bytes) binary += String.fromCharCode(byte);
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function fromBase64Url(text2) {
-  if (text2.length === 0 || !/^[A-Za-z0-9_-]+$/.test(text2)) return null;
+function fromBase64Url(text3) {
+  if (text3.length === 0 || !/^[A-Za-z0-9_-]+$/.test(text3)) return null;
   try {
-    const binary = atob(text2.replace(/-/g, "+").replace(/_/g, "/"));
+    const binary = atob(text3.replace(/-/g, "+").replace(/_/g, "/"));
     const bytes = new Uint8Array(binary.length);
     for (let at = 0; at < bytes.length; at++) bytes[at] = binary.charCodeAt(at);
     return bytes;
@@ -1181,6 +1219,87 @@ function asBuffer(bytes) {
   return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
 }
 
+// ../core/outbound.ts
+var import_promises = require("dns/promises");
+var import_promises2 = require("timers/promises");
+var HTTP_TIMEOUT_MS2 = 15e3;
+var LOOKUP_TIMEOUT_MS = 5e3;
+var HOPS_FOLLOWED = 2;
+var REDIRECTS = [301, 302, 303, 307, 308];
+var KEEPS_THE_METHOD = [307, 308];
+var CREDENTIALS = ["authorization", "cookie", "proxy-authorization"];
+var BODY_LIMIT_BYTES = 262144;
+async function ask(url, sent = {}) {
+  const capped = AbortSignal.timeout(HTTP_TIMEOUT_MS2);
+  const signal = sent.deadline ? AbortSignal.any([sent.deadline, capped]) : capped;
+  let target = url;
+  let carried = sent;
+  for (let hop = 0; hop <= HOPS_FOLLOWED; hop += 1) {
+    await refuseUnlessPublic(target);
+    const response = await fetch(target, {
+      method: carried.method ?? "GET",
+      headers: carried.headers ?? {},
+      body: carried.body,
+      redirect: "manual",
+      signal
+    });
+    if (!REDIRECTS.includes(response.status)) return await answerOf(response);
+    const location = response.headers.get("location");
+    if (location === null) {
+      throw new Error(`${target} answered ${response.status} without saying where to`);
+    }
+    await response.body?.cancel();
+    const next = new URL(location, target).toString();
+    carried = KEEPS_THE_METHOD.includes(response.status) ? carried : withoutBody(carried);
+    carried = sameOrigin(target, next) ? carried : withoutCredentials(carried);
+    target = next;
+  }
+  throw new Error(`${url} redirected more than ${HOPS_FOLLOWED} times`);
+}
+async function resolvesNothingPrivate(url) {
+  const host = new URL(url).hostname.replace(/^\[|]$/g, "");
+  const found = await Promise.race([
+    (0, import_promises.lookup)(host, { all: true, verbatim: true }).catch(() => []),
+    (0, import_promises2.setTimeout)(LOOKUP_TIMEOUT_MS, null, { ref: false })
+  ]);
+  return found !== null && found.every((one) => publicAddress(one.address));
+}
+async function refuseUnlessPublic(url) {
+  if (!publicHttps(url)) throw new Error(`${url} is not a public https URL`);
+  if (!await resolvesNothingPrivate(url)) throw new Error(`${url} resolves to an address we do not reach`);
+}
+async function answerOf(response) {
+  const { status, ok } = response;
+  const reader = response.body?.getReader();
+  if (!reader) return { status, ok, body: "", truncated: false };
+  const read = [];
+  let bytes = 0;
+  while (bytes <= BODY_LIMIT_BYTES) {
+    const { done, value } = await reader.read();
+    if (done) return { status, ok, body: text2(read), truncated: false };
+    read.push(value);
+    bytes += value.length;
+  }
+  await reader.cancel();
+  return { status, ok, body: text2(read), truncated: true };
+}
+function withoutBody(sent) {
+  const headers = { ...sent.headers };
+  delete headers["content-type"];
+  return { ...sent, method: "GET", headers, body: void 0 };
+}
+function withoutCredentials(sent) {
+  const headers = { ...sent.headers };
+  for (const named of CREDENTIALS) delete headers[named];
+  return { ...sent, headers };
+}
+function text2(chunks) {
+  const decoder = new TextDecoder();
+  let decoded = "";
+  for (const chunk of chunks) decoded += decoder.decode(chunk, { stream: true });
+  return decoded + decoder.decode();
+}
+
 // ../core/refusal.ts
 var WalletRefused = class extends Error {
   reason;
@@ -1199,7 +1318,6 @@ var NoWalletAvailable = class extends Error {
 
 // ../core/lnurl.ts
 var VERIFY_WITHOUT_PREIMAGE = ["zeuspay.com", "zeusnuts.com", "ecash.love"];
-var HTTP_TIMEOUT_MS2 = 15e3;
 var BECH32_CHARSET2 = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
 var BECH32_GENERATOR = [996825010, 642813549, 513874426, 1027748829, 705979059];
 var CHECKSUM_SLOTS = [0, 1, 2, 3, 4, 5];
@@ -1364,14 +1482,12 @@ function splitAddress(address) {
   return [user, domain];
 }
 async function fetchJson(url, deadline) {
-  if (!publicHttps(url)) throw new Error(`${url} is not a public https URL`);
-  const capped = AbortSignal.timeout(HTTP_TIMEOUT_MS2);
-  const response = await fetch(url, {
-    signal: deadline ? AbortSignal.any([deadline, capped]) : capped,
-    headers: { accept: "application/json" }
-  });
-  if (!response.ok) throw new Error(`${url} answered ${response.status}`);
-  return await response.json();
+  const answer = await ask(url, { headers: { accept: "application/json" }, deadline });
+  if (!answer.ok) throw new Error(`${url} answered ${answer.status}`);
+  if (answer.truncated) {
+    throw new Error(`${url} answered with more than the ${BODY_LIMIT_BYTES} bytes we read`);
+  }
+  return JSON.parse(answer.body);
 }
 
 // src/trigger.ts
@@ -1515,6 +1631,7 @@ var FORBIDDEN_IN_SPD = "*";
 async function bankTransfer(params) {
   const currency = params.currency ?? DEFAULT_CURRENCY;
   refuseUnusable(params, currency);
+  await refuseAnOpenGateway(params);
   const spd = shortPaymentDescriptor(params, currency);
   const subject = subjectOf(params.reference, params.amountMinor, currency);
   const polling = new URL(params.verifyUrl);
@@ -1581,12 +1698,14 @@ function shortPaymentDescriptor(params, currency) {
 function major(amountMinor, currency) {
   return (amountMinor / minorScaleOf(currency)).toFixed(minorUnitsOf(currency));
 }
+async function refuseAnOpenGateway(params) {
+  if (params.allowPublicGateway === true) return;
+  if (await params.gateway.refusesStrangers()) return;
+  throw new Error(
+    "this gateway serves callers with no token, so it is not yours, and its operator would read the amount and the reference off every verify URL. Point at one that answers 401 to a stranger, or say allowPublicGateway"
+  );
+}
 function refuseUnusable(params, currency) {
-  if (!params.gateway.isPrivate && params.allowPublicGateway !== true) {
-    throw new Error(
-      "this gateway has no token, so it is not yours, and its operator would read the amount and the reference off every verify URL. Give it a token or say allowPublicGateway"
-    );
-  }
   if (!IBAN.test(params.iban)) throw new Error(`${params.iban} is not an IBAN`);
   if (!Number.isInteger(params.amountMinor) || params.amountMinor <= 0) {
     throw new Error("amountMinor must be a whole number of minor units above zero");
@@ -1625,6 +1744,7 @@ var WHERE_A_PAYER_WRITES = [
   USER_IDENTIFICATION,
   PAYER_REFERENCE
 ];
+var UTC_OFFSET = /^[+-]\d{4}$/;
 function fioStatement(config) {
   const named = typeof config.token === "string" ? [config.token] : config.token;
   if (named.length === 0) throw new Error("fioStatement needs at least one token to read with");
@@ -1677,9 +1797,21 @@ function asCredit(transaction) {
     amountMinor: Math.round(numberIn(transaction[AMOUNT]) * MINOR_UNITS),
     currency: textIn(transaction[CURRENCY]),
     reference: WHERE_A_PAYER_WRITES.map((column) => textIn(transaction[column])).filter((written) => written.length > 0).join(" "),
-    bookedAt: Math.floor(numberIn(transaction[BOOKED_AT]) / MILLIS)
+    bookedAt: bookedAtIn(transaction[BOOKED_AT])
   };
 }
+function bookedAtIn(cell) {
+  const value = cell?.value;
+  if (typeof value === "number") return Math.floor(value / MILLIS);
+  const at = Date.parse(asIso8601(textIn(cell)));
+  return Number.isFinite(at) ? Math.floor(at / MILLIS) : 0;
+}
+function asIso8601(booked) {
+  const day = booked.slice(0, DATE_CHARS);
+  const zone = booked.slice(DATE_CHARS);
+  if (!UTC_OFFSET.test(zone)) return `${day}T00:00:00Z`;
+  return `${day}T00:00:00${zone.slice(0, 3)}:${zone.slice(3)}`;
+}
 function numberIn(cell) {
   const value = Number(cell?.value ?? Number.NaN);
   return Number.isFinite(value) ? value : 0;
@@ -1692,6 +1824,149 @@ function asDate(unix) {
   return new Date(unix * MILLIS).toISOString().slice(0, DATE_CHARS);
 }
 
+// src/qr.ts
+var import_uqr = require("uqr");
+var SAFE_COLOR = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$|^rgba?\([\d.,%/\s]+\)$|^[a-z]+$/i;
+function encodeForQr(destination) {
+  const scanned = isLnAddress(destination) ? destination : destination.toUpperCase();
+  return `LIGHTNING:${scanned}`;
+}
+function invoiceToSvg(destination, options) {
+  return svgOf(encodeForQr(destination), options);
+}
+function invoiceToDataUrl(destination, options) {
+  return asDataUrl(invoiceToSvg(destination, options));
+}
+function lnurlToSvg(endpoint, options) {
+  return svgOf(toLnurl(endpoint), options);
+}
+function lnurlToDataUrl(endpoint, options) {
+  return asDataUrl(lnurlToSvg(endpoint, options));
+}
+function spdToSvg(spd, options) {
+  return svgOf(spd, options);
+}
+function spdToDataUrl(spd, options) {
+  return asDataUrl(spdToSvg(spd, options));
+}
+function qrToSvg(payload, options) {
+  return svgOf(payload, options);
+}
+function qrToDataUrl(payload, options) {
+  return asDataUrl(qrToSvg(payload, options));
+}
+function svgOf(scanned, options) {
+  const size = options?.size ?? 256;
+  const color = options?.color ?? "#000";
+  if (!SAFE_COLOR.test(color)) throw new Error(`Invalid color: ${color}`);
+  return renderSvg(scanned, size, color);
+}
+function asDataUrl(svg) {
+  return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+}
+function isLnAddress(destination) {
+  const at = destination.indexOf("@");
+  return at > 0 && destination.slice(at + 1).includes(".");
+}
+function renderSvg(content, size, color) {
+  const { data } = (0, import_uqr.encode)(content);
+  const modules = data.length;
+  const cellSize = size / modules;
+  let path = "";
+  for (let y = 0; y < modules; y++) {
+    for (let x = 0; x < modules; x++) {
+      if (data[y][x]) {
+        path += `M${x * cellSize},${y * cellSize}h${cellSize}v${cellSize}h-${cellSize}z`;
+      }
+    }
+  }
+  return [
+    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${size} ${size}" width="${size}" height="${size}">`,
+    `<rect width="100%" height="100%" fill="white"/>`,
+    `<path d="${path}" fill="${color}"/>`,
+    `</svg>`
+  ].join("");
+}
+
+// src/rail.ts
+var BANK = "bank";
+var LIGHTNING = "lightning";
+function bankRail(config) {
+  return async (order) => {
+    const expiresAt = config.expiresAt(order);
+    const transfer = await bankTransfer({
+      gateway: config.gateway,
+      secret: config.secret,
+      iban: config.iban,
+      verifyUrl: config.verifyUrl,
+      reference: order.reference,
+      amountMinor: order.amountMinor,
+      currency: order.currency,
+      expiresAt,
+      trigger: config.trigger,
+      sealed: await config.sealed?.(order),
+      variableSymbol: config.variableSymbol?.(order),
+      allowPublicGateway: config.allowPublicGateway
+    });
+    return {
+      id: transfer.id,
+      rail: config.name ?? BANK,
+      scan: transfer.spd,
+      qr: transfer.spd,
+      expiresAt
+    };
+  };
+}
+function lightningRail(config) {
+  return async (order) => {
+    const payment = await config.gateway.createPayment(
+      {
+        lnAddresses: config.lnAddresses,
+        amountMsat: await config.amountMsat(order),
+        webhookUrl: config.webhookUrl,
+        webhookSecret: config.webhookSecret
+      },
+      { idempotencyKey: config.idempotencyKey?.(order), trigger: config.trigger }
+    );
+    return {
+      id: payment.id,
+      rail: config.name ?? LIGHTNING,
+      scan: payment.bolt11,
+      qr: encodeForQr(payment.bolt11),
+      expiresAt: payment.expiresAt
+    };
+  };
+}
+function blindLightningRail(config) {
+  return async (order) => {
+    const resolved = await invoiceFrom(config.lnAddresses, await config.amountMsat(order));
+    const watched = await config.gateway.watchPayment({
+      paymentHash: resolved.paymentHash,
+      verifyUrl: resolved.verifyUrl,
+      expiresAt: resolved.expiresAt,
+      trigger: config.trigger,
+      sealed: await config.sealed?.(order)
+    });
+    return {
+      id: watched.id,
+      rail: config.name ?? LIGHTNING,
+      scan: resolved.bolt11,
+      qr: encodeForQr(resolved.bolt11),
+      expiresAt: resolved.expiresAt
+    };
+  };
+}
+async function invoiceFrom(lnAddresses, amountMsat) {
+  try {
+    return await resolve(lnAddresses, amountMsat);
+  } catch (refused) {
+    if (refused instanceof NoWalletAvailable) {
+      throw new NoWalletAvailableError({ title: refused.message }, refused.wallets);
+    }
+    throw refused;
+  }
+}
+
 // src/price.ts
 var MSAT_PER_BTC2 = 1e11;
 var BASIS_POINTS = 1e4;
@@ -1814,64 +2089,6 @@ function refusals2(answers) {
   ).join("; ");
 }
 
-// src/qr.ts
-var import_uqr = require("uqr");
-var SAFE_COLOR = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$|^rgba?\([\d.,%/\s]+\)$|^[a-z]+$/i;
-function encodeForQr(destination) {
-  const scanned = isLnAddress(destination) ? destination : destination.toUpperCase();
-  return `LIGHTNING:${scanned}`;
-}
-function invoiceToSvg(destination, options) {
-  return svgOf(encodeForQr(destination), options);
-}
-function invoiceToDataUrl(destination, options) {
-  return asDataUrl(invoiceToSvg(destination, options));
-}
-function lnurlToSvg(endpoint, options) {
-  return svgOf(toLnurl(endpoint), options);
-}
-function lnurlToDataUrl(endpoint, options) {
-  return asDataUrl(lnurlToSvg(endpoint, options));
-}
-function spdToSvg(spd, options) {
-  return svgOf(spd, options);
-}
-function spdToDataUrl(spd, options) {
-  return asDataUrl(spdToSvg(spd, options));
-}
-function svgOf(scanned, options) {
-  const size = options?.size ?? 256;
-  const color = options?.color ?? "#000";
-  if (!SAFE_COLOR.test(color)) throw new Error(`Invalid color: ${color}`);
-  return renderSvg(scanned, size, color);
-}
-function asDataUrl(svg) {
-  return `data:image/svg+xml,${encodeURIComponent(svg)}`;
-}
-function isLnAddress(destination) {
-  const at = destination.indexOf("@");
-  return at > 0 && destination.slice(at + 1).includes(".");
-}
-function renderSvg(content, size, color) {
-  const { data } = (0, import_uqr.encode)(content);
-  const modules = data.length;
-  const cellSize = size / modules;
-  let path = "";
-  for (let y = 0; y < modules; y++) {
-    for (let x = 0; x < modules; x++) {
-      if (data[y][x]) {
-        path += `M${x * cellSize},${y * cellSize}h${cellSize}v${cellSize}h-${cellSize}z`;
-      }
-    }
-  }
-  return [
-    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${size} ${size}" width="${size}" height="${size}">`,
-    `<rect width="100%" height="100%" fill="white"/>`,
-    `<path d="${path}" fill="${color}"/>`,
-    `</svg>`
-  ].join("");
-}
-
 // src/webhook.ts
 var SIGNATURE_HEADER = "x-signature";
 var TIMESTAMP_HEADER = "x-timestamp";
@@ -1884,9 +2101,9 @@ async function verifyWebhookSignature(body, signature, secret, timestamp, option
 }
 async function parseWebhook(body, signature, secret, timestamp, options = {}) {
   if (!await verifyWebhookSignature(body, signature, secret, timestamp, options)) return null;
-  const text2 = typeof body === "string" ? body : new TextDecoder().decode(body);
+  const text3 = typeof body === "string" ? body : new TextDecoder().decode(body);
   try {
-    return paymentFromWire(JSON.parse(text2));
+    return paymentFromWire(JSON.parse(text3));
   } catch {
     return null;
   }
@@ -1926,9 +2143,11 @@ function signed(timestamp, body) {
   REQUEST_IN_FLIGHT,
   ThunderBridge,
   UnverifiedRecipientError,
+  bankRail,
   bankTransfer,
   bankVerifyEndpoint,
   bitstamp,
+  blindLightningRail,
   coinbase,
   coinmate,
   decodeInvoice,
@@ -1938,6 +2157,7 @@ function signed(timestamp, body) {
   isProblemType,
   isProvablyPaid,
   kraken,
+  lightningRail,
   lnurlPayEndpoint,
   lnurlToDataUrl,
   lnurlToSvg,
@@ -1950,6 +2170,8 @@ function signed(timestamp, body) {
   preimageMatchesHash,
   proveOrigin,
   proveSettlement,
+  qrToDataUrl,
+  qrToSvg,
   seal,
   spdToDataUrl,
   spdToSvg,