thunder-bridge 0.8.1 → 0.8.3

package/dist/index.js

@@ -34,10 +34,8 @@ var ProblemError = class extends Error {
     this.detail = problem.detail ?? null;
   }
 };
-var NAMESPACE = "urn:problem-type:thunder-bridge:";
-var NAMESPACE_BEFORE_THE_RENAME = "urn:problem-type:thunder-bridge-direct:";
 function isProblemType(problem, type) {
-  return problem.type === type || problem.type === type.replace(NAMESPACE, NAMESPACE_BEFORE_THE_RENAME);
+  return problem.type === type;
 }
 var NO_WALLET_AVAILABLE = "urn:problem-type:thunder-bridge:no-wallet-available";
 var REQUEST_IN_FLIGHT = "urn:problem-type:thunder-bridge:request-in-flight";
@@ -348,10 +346,13 @@ function sameOrigin(one, other) {
     return false;
   }
 }
+function publicAddress(literal) {
+  return literal.includes(":") ? ipv6IsGlobal(literal) : ipv4IsGlobal(literal);
+}
 function hostIsPublic(host) {
-  if (host.startsWith("[")) return ipv6IsGlobal(host.slice(1, -1));
+  if (host.startsWith("[")) return publicAddress(host.slice(1, -1));
   const name = host.replace(/\.$/, "");
-  if (/^\d+\.\d+\.\d+\.\d+$/.test(name)) return ipv4IsGlobal(name);
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(name)) return publicAddress(name);
   const labels = name.split(".");
   if (labels.length < 2 || labels.some((label) => label === "")) return false;
   return !PRIVATE_SUFFIXES.includes(labels[labels.length - 1]);
@@ -616,6 +617,16 @@ var TERMINAL = /* @__PURE__ */ new Set(["paid", "expired"]);
 var RECONNECT_DELAY_MS = 3e3;
 var RECONNECT_CAP_MS = 3e4;
 var UNANSWERED_ATTEMPTS = 5;
+var TRIGGER_MIN_CHARS = 16;
+var STRANGER_PROBE = "is-this-gateway-yours";
+function unguessable(trigger) {
+  if (trigger.length < TRIGGER_MIN_CHARS) {
+    throw new Error(
+      `a trigger secret is the only thing guarding its stream, and nothing rate limits a guess at it, so it has to be at least ${TRIGGER_MIN_CHARS} characters nobody can predict`
+    );
+  }
+  return trigger;
+}
 function backoffMs(firstDelay, attempt) {
   const grown = Math.min(firstDelay * 2 ** (attempt - 1), RECONNECT_CAP_MS);
   return Math.round(grown * (0.5 + Math.random() / 2));
@@ -624,6 +635,7 @@ var ThunderBridge = class {
   baseUrl;
   verify;
   token;
+  strangers = null;
   constructor(baseUrl, options) {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.verify = options?.verify ?? true;
@@ -637,6 +649,21 @@ var ThunderBridge = class {
   get isPrivate() {
     return this.token !== null;
   }
+  /**
+   * Whether the gateway turns away a caller carrying no token, asked by making
+   * one unauthenticated read it would have to refuse. `isPrivate` answers only
+   * whether you configured a token, which is your side of the arrangement and
+   * says nothing about the gateway's, so a made-up token against a public
+   * instance reads as private and is not. Asked once and remembered, because an
+   * instance does not change its mind. Anything other than a refusal counts as
+   * open, so an unreachable gateway fails closed
+   */
+  async refusesStrangers() {
+    this.strangers ??= fetch(`${this.baseUrl}/incoming-payments/${STRANGER_PROBE}`, {
+      headers: { accept: "application/json" }
+    }).then((answer) => answer.status === 401).catch(() => false);
+    return await this.strangers;
+  }
   /**
    * Ask the gateway for an invoice payable to the first address on your list
    * that can issue a provable one, throws `NoWalletAvailableError` when none can
@@ -648,7 +675,10 @@ var ThunderBridge = class {
     const response = await fetch(`${this.baseUrl}/incoming-payments`, {
       method: "POST",
       headers,
-      body: createRequestBody(params, options?.trigger ? sha256Hex(options.trigger) : null)
+      body: createRequestBody(
+        params,
+        options?.trigger ? sha256Hex(unguessable(options.trigger)) : null
+      )
     });
     if (!response.ok) throw await problemFrom(response);
     const payment = await paymentFrom(response);
@@ -890,7 +920,10 @@ var ThunderBridge = class {
     const response = await fetch(`${this.baseUrl}/watched-payments`, {
       method: "POST",
       headers: this.sending(),
-      body: watchRequestBody(params, params.trigger ? sha256Hex(params.trigger) : null)
+      body: watchRequestBody(
+        params,
+        params.trigger ? sha256Hex(unguessable(params.trigger)) : null
+      )
     });
     if (!response.ok) throw await problemFrom(response);
     const watched = triggerEventFromWire(await response.json().catch(() => null));
@@ -909,7 +942,7 @@ var ThunderBridge = class {
    */
   followTrigger(secret, options) {
     const base = this.baseUrl.replace(/^http/, "ws");
-    const direct = `${base}/ws/triggers/${encodeURIComponent(secret)}`;
+    const direct = `${base}/ws/triggers/${encodeURIComponent(unguessable(secret))}`;
     const firstDelay = options.reconnectDelayMs ?? RECONNECT_DELAY_MS;
     let socket = null;
     let retry;
@@ -1116,290 +1149,6 @@ function asBuffer(bytes) {
   return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
 }
 
-// ../core/refusal.ts
-var WalletRefused = class extends Error {
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.reason = reason;
-  }
-};
-var NoWalletAvailable = class extends Error {
-  wallets;
-  constructor(wallets) {
-    super(wallets.map((wallet) => `${wallet.address} ${wallet.reason}`).join(", "));
-    this.wallets = wallets;
-  }
-};
-
-// ../core/lnurl.ts
-var VERIFY_WITHOUT_PREIMAGE = ["zeuspay.com", "zeusnuts.com", "ecash.love"];
-var HTTP_TIMEOUT_MS2 = 15e3;
-var BECH32_CHARSET2 = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
-var BECH32_GENERATOR = [996825010, 642813549, 513874426, 1027748829, 705979059];
-var CHECKSUM_SLOTS = [0, 1, 2, 3, 4, 5];
-var LNURL_HRP = "lnurl";
-var RESOLVE_TIMEOUT_MS = 3e4;
-async function resolve(addresses, amountMsat) {
-  const served = await firstThatServes(
-    addresses,
-    (address, deadline) => resolveAddress(address, amountMsat, deadline)
-  );
-  return served.won;
-}
-async function firstThatServes(addresses, attempt) {
-  const deadline = AbortSignal.timeout(RESOLVE_TIMEOUT_MS);
-  const refusals3 = [];
-  for (const address of addresses) {
-    if (deadline.aborted) break;
-    try {
-      return { won: await attempt(address, deadline), refusals: refusals3 };
-    } catch (refusal) {
-      if (!(refusal instanceof WalletRefused)) throw refusal;
-      console.warn(`wallet ${address} refused, ${refusal.reason}: ${refusal.message}`);
-      refusals3.push({ address, reason: refusal.reason });
-    }
-  }
-  throw new NoWalletAvailable(refusals3);
-}
-async function probe(address, amountMsat, deadline) {
-  const [user, domain] = splitAddress(address);
-  if (cannotReleaseAPreimage(domain)) {
-    throw new WalletRefused("cannot-prove-delivery", `${address} never releases a preimage`);
-  }
-  const pay = await answered(
-    `https://${domain}/.well-known/lnurlp/${user}`,
-    deadline
-  );
-  if (pay.tag !== "payRequest" || !pay.callback) {
-    throw new WalletRefused("unreachable", `${address} answered with no payRequest`);
-  }
-  if (amountMsat < pay.minSendable || amountMsat > pay.maxSendable) {
-    throw new WalletRefused(
-      "amount-not-accepted",
-      `${address} takes [${pay.minSendable}, ${pay.maxSendable}] msat, not ${amountMsat}`
-    );
-  }
-  return { address, pay };
-}
-async function resolveAddress(address, amountMsat, deadline) {
-  const { pay } = await probe(address, amountMsat, deadline);
-  const invoice = await answered(withAmount(pay.callback, amountMsat), deadline);
-  if (!invoice.pr) throw new WalletRefused("unreachable", `${address} returned no invoice`);
-  if (!invoice.verify || !publicHttps(invoice.verify)) {
-    throw new WalletRefused(
-      "cannot-prove-delivery",
-      `${address} publishes no usable LUD-21 verify URL`
-    );
-  }
-  const issued = decodeIssued(address, invoice.pr);
-  if (issued.amountMsat !== amountMsat) {
-    throw new WalletRefused(
-      "invoice-refused",
-      `${address} issued an invoice for ${issued.amountMsat} msat, not ${amountMsat}`
-    );
-  }
-  if (issued.descriptionHash !== sha256Hex(pay.metadata)) {
-    throw new WalletRefused(
-      "invoice-refused",
-      `${address} does not bind its invoice to the metadata it serves`
-    );
-  }
-  return {
-    address,
-    bolt11: invoice.pr,
-    verifyUrl: invoice.verify,
-    paymentHash: issued.paymentHash,
-    expiresAt: issued.expiresAt
-  };
-}
-async function answered(url, deadline) {
-  try {
-    return await fetchJson(url, deadline);
-  } catch (cause) {
-    throw new WalletRefused("unreachable", String(cause));
-  }
-}
-function decodeIssued(address, bolt11) {
-  const { paymentHash, descriptionHash, amountMsat, expiresAt } = decodeInvoice(bolt11);
-  if (paymentHash === null || expiresAt === null) {
-    throw new WalletRefused("invoice-refused", `${address} issued an invoice we cannot decode`);
-  }
-  return { paymentHash, descriptionHash, amountMsat, expiresAt };
-}
-function cannotReleaseAPreimage(host) {
-  const lowered = host.toLowerCase();
-  return VERIFY_WITHOUT_PREIMAGE.some(
-    (known) => lowered === known || lowered.endsWith(`.${known}`)
-  );
-}
-function toLnurl(endpoint) {
-  const scheme = parsedScheme(endpoint);
-  if (scheme !== "https:" && scheme !== "http:") {
-    throw new Error(`${endpoint} is not an http or https URL`);
-  }
-  const words = toWords(new TextEncoder().encode(endpoint));
-  const data = [...words, ...checksumWords(LNURL_HRP, words)];
-  return `${LNURL_HRP}1${data.map((word) => BECH32_CHARSET2[word]).join("")}`.toUpperCase();
-}
-function parsedScheme(endpoint) {
-  try {
-    return new URL(endpoint).protocol;
-  } catch {
-    return null;
-  }
-}
-function toWords(bytes) {
-  const words = [];
-  let accumulator = 0;
-  let bits = 0;
-  for (const byte of bytes) {
-    accumulator = accumulator << 8 | byte;
-    bits += 8;
-    while (bits >= 5) {
-      bits -= 5;
-      words.push(accumulator >> bits & 31);
-    }
-  }
-  if (bits > 0) words.push(accumulator << 5 - bits & 31);
-  return words;
-}
-function checksumWords(hrp, words) {
-  const expanded = [...hrp].map((char) => char.charCodeAt(0));
-  const values = [
-    ...expanded.map((code) => code >> 5),
-    0,
-    ...expanded.map((code) => code & 31),
-    ...words,
-    ...CHECKSUM_SLOTS.map(() => 0)
-  ];
-  const polymod = bech32Polymod(values) ^ 1;
-  return CHECKSUM_SLOTS.map((slot) => polymod >> 5 * (5 - slot) & 31);
-}
-function bech32Polymod(values) {
-  let checksum = 1;
-  for (const value of values) {
-    const top = checksum >> 25;
-    checksum = (checksum & 33554431) << 5 ^ value;
-    for (let bit = 0; bit < 5; bit++) {
-      if (top >> bit & 1) checksum ^= BECH32_GENERATOR[bit];
-    }
-  }
-  return checksum;
-}
-function withAmount(callback, amountMsat) {
-  const separator = callback.includes("?") ? "&" : "?";
-  return `${callback}${separator}amount=${amountMsat}`;
-}
-function splitAddress(address) {
-  const [user, domain, ...rest] = address.split("@");
-  if (!user || !domain || rest.length > 0 || !publicHttps(`https://${domain}/`)) {
-    throw new WalletRefused("address-unusable", `${address} is not a usable lightning address`);
-  }
-  return [user, domain];
-}
-async function fetchJson(url, deadline) {
-  if (!publicHttps(url)) throw new Error(`${url} is not a public https URL`);
-  const capped = AbortSignal.timeout(HTTP_TIMEOUT_MS2);
-  const response = await fetch(url, {
-    signal: deadline ? AbortSignal.any([deadline, capped]) : capped,
-    headers: { accept: "application/json" }
-  });
-  if (!response.ok) throw new Error(`${url} answered ${response.status}`);
-  return await response.json();
-}
-
-// src/trigger.ts
-var NONCE_BYTES = 16;
-function lnurlPayEndpoint(config) {
-  return async (request) => {
-    const url = new URL(request.url);
-    const asked = url.searchParams.get("to");
-    try {
-      return asked === null ? await offer(config, url) : await mint(config, url, asked);
-    } catch (failure) {
-      return refuse(failure instanceof Error ? failure.message : "the trigger could not be served");
-    }
-  };
-}
-async function offer(config, url) {
-  const amountMsat = await config.amountMsat();
-  const quote = await config.gateway.createQuote({
-    lnAddresses: config.lnAddresses,
-    amountMsat
-  });
-  const nonce = randomNonce();
-  const callback = new URL(config.baseUrl ?? `${url.origin}${url.pathname}`);
-  callback.searchParams.set("to", quote.lnAddress);
-  callback.searchParams.set("msat", String(amountMsat));
-  callback.searchParams.set("n", nonce);
-  callback.searchParams.set("sig", await sign(config.secret, quote.lnAddress, amountMsat, nonce));
-  return Response.json({
-    tag: "payRequest",
-    callback: callback.toString(),
-    metadata: quote.metadata,
-    minSendable: amountMsat,
-    maxSendable: amountMsat
-  });
-}
-async function mint(config, url, address) {
-  const amountMsat = Number(url.searchParams.get("msat"));
-  const nonce = url.searchParams.get("n") ?? "";
-  const signature = url.searchParams.get("sig") ?? "";
-  const expected = await sign(config.secret, address, amountMsat, nonce);
-  if (!equalInConstantTime(signature, expected)) return refuse("this callback was not signed here");
-  const wanted = url.searchParams.get("amount");
-  if (wanted !== null && Number(wanted) !== amountMsat) {
-    return refuse(`this trigger costs exactly ${amountMsat} msat`);
-  }
-  const minted = config.blind ? await mintBlind(config, address, amountMsat) : await mintThroughGateway(config, address, amountMsat, nonce);
-  return Response.json({
-    status: "OK",
-    pr: minted.bolt11,
-    routes: [],
-    verify: minted.verifyUrl
-  });
-}
-async function mintThroughGateway(config, address, amountMsat, nonce) {
-  const payment = await config.gateway.createPayment(
-    { lnAddresses: [address], amountMsat },
-    { idempotencyKey: nonce, trigger: config.watchSecret }
-  );
-  return { bolt11: payment.bolt11, verifyUrl: payment.verifyUrl };
-}
-async function mintBlind(config, address, amountMsat) {
-  const resolved = await resolve([address], amountMsat);
-  const minted = { ...resolved, amountMsat, lnAddress: resolved.address };
-  const locked = config.sealed;
-  try {
-    await config.gateway.watchPayment({
-      paymentHash: resolved.paymentHash,
-      verifyUrl: resolved.verifyUrl,
-      expiresAt: resolved.expiresAt,
-      trigger: config.watchSecret,
-      sealed: locked ? await seal(locked.secret, JSON.stringify(locked.data(minted))) : void 0
-    });
-  } catch (refused) {
-    if (!alreadyWatched(refused)) throw refused;
-  }
-  return { bolt11: resolved.bolt11, verifyUrl: resolved.verifyUrl };
-}
-function alreadyWatched(refused) {
-  return refused instanceof ProblemError && isProblemType(refused, PAYMENT_ALREADY_WATCHED);
-}
-function sign(secret, address, amountMsat, nonce) {
-  return hmacHex(secret, `${address}|${amountMsat}|${nonce}`);
-}
-function randomNonce() {
-  const bytes = crypto.getRandomValues(new Uint8Array(NONCE_BYTES));
-  let hex = "";
-  for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
-  return hex;
-}
-function refuse(reason) {
-  return Response.json({ status: "ERROR", reason });
-}
-
 // src/currency.ts
 var ISO_4217_MINOR_UNITS = {
   BHD: 3,
@@ -1450,6 +1199,7 @@ var FORBIDDEN_IN_SPD = "*";
 async function bankTransfer(params) {
   const currency = params.currency ?? DEFAULT_CURRENCY;
   refuseUnusable(params, currency);
+  await refuseAnOpenGateway(params);
   const spd = shortPaymentDescriptor(params, currency);
   const subject = subjectOf(params.reference, params.amountMinor, currency);
   const polling = new URL(params.verifyUrl);
@@ -1516,12 +1266,14 @@ function shortPaymentDescriptor(params, currency) {
 function major(amountMinor, currency) {
   return (amountMinor / minorScaleOf(currency)).toFixed(minorUnitsOf(currency));
 }
+async function refuseAnOpenGateway(params) {
+  if (params.allowPublicGateway === true) return;
+  if (await params.gateway.refusesStrangers()) return;
+  throw new Error(
+    "this gateway serves callers with no token, so it is not yours, and its operator would read the amount and the reference off every verify URL. Point at one that answers 401 to a stranger, or say allowPublicGateway"
+  );
+}
 function refuseUnusable(params, currency) {
-  if (!params.gateway.isPrivate && params.allowPublicGateway !== true) {
-    throw new Error(
-      "this gateway has no token, so it is not yours, and its operator would read the amount and the reference off every verify URL. Give it a token or say allowPublicGateway"
-    );
-  }
   if (!IBAN.test(params.iban)) throw new Error(`${params.iban} is not an IBAN`);
   if (!Number.isInteger(params.amountMinor) || params.amountMinor <= 0) {
     throw new Error("amountMinor must be a whole number of minor units above zero");
@@ -1560,6 +1312,7 @@ var WHERE_A_PAYER_WRITES = [
   USER_IDENTIFICATION,
   PAYER_REFERENCE
 ];
+var UTC_OFFSET = /^[+-]\d{4}$/;
 function fioStatement(config) {
   const named = typeof config.token === "string" ? [config.token] : config.token;
   if (named.length === 0) throw new Error("fioStatement needs at least one token to read with");
@@ -1612,9 +1365,21 @@ function asCredit(transaction) {
     amountMinor: Math.round(numberIn(transaction[AMOUNT]) * MINOR_UNITS),
     currency: textIn(transaction[CURRENCY]),
     reference: WHERE_A_PAYER_WRITES.map((column) => textIn(transaction[column])).filter((written) => written.length > 0).join(" "),
-    bookedAt: Math.floor(numberIn(transaction[BOOKED_AT]) / MILLIS)
+    bookedAt: bookedAtIn(transaction[BOOKED_AT])
   };
 }
+function bookedAtIn(cell) {
+  const value = cell?.value;
+  if (typeof value === "number") return Math.floor(value / MILLIS);
+  const at = Date.parse(asIso8601(textIn(cell)));
+  return Number.isFinite(at) ? Math.floor(at / MILLIS) : 0;
+}
+function asIso8601(booked) {
+  const day = booked.slice(0, DATE_CHARS);
+  const zone = booked.slice(DATE_CHARS);
+  if (!UTC_OFFSET.test(zone)) return `${day}T00:00:00Z`;
+  return `${day}T00:00:00${zone.slice(0, 3)}:${zone.slice(3)}`;
+}
 function numberIn(cell) {
   const value = Number(cell?.value ?? Number.NaN);
   return Number.isFinite(value) ? value : 0;
@@ -1627,6 +1392,180 @@ function asDate(unix) {
   return new Date(unix * MILLIS).toISOString().slice(0, DATE_CHARS);
 }
 
+// ../core/lnurl.ts
+var BECH32_CHARSET2 = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+var BECH32_GENERATOR = [996825010, 642813549, 513874426, 1027748829, 705979059];
+var CHECKSUM_SLOTS = [0, 1, 2, 3, 4, 5];
+var LNURL_HRP = "lnurl";
+function toLnurl(endpoint) {
+  const scheme = parsedScheme(endpoint);
+  if (scheme !== "https:" && scheme !== "http:") {
+    throw new Error(`${endpoint} is not an http or https URL`);
+  }
+  const words = toWords(new TextEncoder().encode(endpoint));
+  const data = [...words, ...checksumWords(LNURL_HRP, words)];
+  return `${LNURL_HRP}1${data.map((word) => BECH32_CHARSET2[word]).join("")}`.toUpperCase();
+}
+function parsedScheme(endpoint) {
+  try {
+    return new URL(endpoint).protocol;
+  } catch {
+    return null;
+  }
+}
+function toWords(bytes) {
+  const words = [];
+  let accumulator = 0;
+  let bits = 0;
+  for (const byte of bytes) {
+    accumulator = accumulator << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      words.push(accumulator >> bits & 31);
+    }
+  }
+  if (bits > 0) words.push(accumulator << 5 - bits & 31);
+  return words;
+}
+function checksumWords(hrp, words) {
+  const expanded = [...hrp].map((char) => char.charCodeAt(0));
+  const values = [
+    ...expanded.map((code) => code >> 5),
+    0,
+    ...expanded.map((code) => code & 31),
+    ...words,
+    ...CHECKSUM_SLOTS.map(() => 0)
+  ];
+  const polymod = bech32Polymod(values) ^ 1;
+  return CHECKSUM_SLOTS.map((slot) => polymod >> 5 * (5 - slot) & 31);
+}
+function bech32Polymod(values) {
+  let checksum = 1;
+  for (const value of values) {
+    const top = checksum >> 25;
+    checksum = (checksum & 33554431) << 5 ^ value;
+    for (let bit = 0; bit < 5; bit++) {
+      if (top >> bit & 1) checksum ^= BECH32_GENERATOR[bit];
+    }
+  }
+  return checksum;
+}
+
+// src/qr.ts
+import { encode } from "uqr";
+var SAFE_COLOR = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$|^rgba?\([\d.,%/\s]+\)$|^[a-z]+$/i;
+function encodeForQr(destination) {
+  const scanned = isLnAddress(destination) ? destination : destination.toUpperCase();
+  return `LIGHTNING:${scanned}`;
+}
+function invoiceToSvg(destination, options) {
+  return svgOf(encodeForQr(destination), options);
+}
+function invoiceToDataUrl(destination, options) {
+  return asDataUrl(invoiceToSvg(destination, options));
+}
+function lnurlToSvg(endpoint, options) {
+  return svgOf(toLnurl(endpoint), options);
+}
+function lnurlToDataUrl(endpoint, options) {
+  return asDataUrl(lnurlToSvg(endpoint, options));
+}
+function spdToSvg(spd, options) {
+  return svgOf(spd, options);
+}
+function spdToDataUrl(spd, options) {
+  return asDataUrl(spdToSvg(spd, options));
+}
+function qrToSvg(payload, options) {
+  return svgOf(payload, options);
+}
+function qrToDataUrl(payload, options) {
+  return asDataUrl(qrToSvg(payload, options));
+}
+function svgOf(scanned, options) {
+  const size = options?.size ?? 256;
+  const color = options?.color ?? "#000";
+  if (!SAFE_COLOR.test(color)) throw new Error(`Invalid color: ${color}`);
+  return renderSvg(scanned, size, color);
+}
+function asDataUrl(svg) {
+  return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+}
+function isLnAddress(destination) {
+  const at = destination.indexOf("@");
+  return at > 0 && destination.slice(at + 1).includes(".");
+}
+function renderSvg(content, size, color) {
+  const { data } = encode(content);
+  const modules = data.length;
+  const cellSize = size / modules;
+  let path = "";
+  for (let y = 0; y < modules; y++) {
+    for (let x = 0; x < modules; x++) {
+      if (data[y][x]) {
+        path += `M${x * cellSize},${y * cellSize}h${cellSize}v${cellSize}h-${cellSize}z`;
+      }
+    }
+  }
+  return [
+    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${size} ${size}" width="${size}" height="${size}">`,
+    `<rect width="100%" height="100%" fill="white"/>`,
+    `<path d="${path}" fill="${color}"/>`,
+    `</svg>`
+  ].join("");
+}
+
+// src/rail.ts
+var BANK = "bank";
+var LIGHTNING = "lightning";
+function bankRail(config) {
+  return async (order) => {
+    const expiresAt = config.expiresAt(order);
+    const transfer = await bankTransfer({
+      gateway: config.gateway,
+      secret: config.secret,
+      iban: config.iban,
+      verifyUrl: config.verifyUrl,
+      reference: order.reference,
+      amountMinor: order.amountMinor,
+      currency: order.currency,
+      expiresAt,
+      trigger: config.trigger,
+      sealed: await config.sealed?.(order),
+      variableSymbol: config.variableSymbol?.(order),
+      allowPublicGateway: config.allowPublicGateway
+    });
+    return {
+      id: transfer.id,
+      rail: config.name ?? BANK,
+      scan: transfer.spd,
+      qr: transfer.spd,
+      expiresAt
+    };
+  };
+}
+function lightningRail(config) {
+  return async (order) => {
+    const payment = await config.gateway.createPayment(
+      {
+        lnAddresses: config.lnAddresses,
+        amountMsat: await config.amountMsat(order),
+        webhookUrl: config.webhookUrl,
+        webhookSecret: config.webhookSecret
+      },
+      { idempotencyKey: config.idempotencyKey?.(order), trigger: config.trigger }
+    );
+    return {
+      id: payment.id,
+      rail: config.name ?? LIGHTNING,
+      scan: payment.bolt11,
+      qr: encodeForQr(payment.bolt11),
+      expiresAt: payment.expiresAt
+    };
+  };
+}
+
 // src/price.ts
 var MSAT_PER_BTC2 = 1e11;
 var BASIS_POINTS = 1e4;
@@ -1749,64 +1688,6 @@ function refusals2(answers) {
   ).join("; ");
 }
 
-// src/qr.ts
-import { encode } from "uqr";
-var SAFE_COLOR = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$|^rgba?\([\d.,%/\s]+\)$|^[a-z]+$/i;
-function encodeForQr(destination) {
-  const scanned = isLnAddress(destination) ? destination : destination.toUpperCase();
-  return `LIGHTNING:${scanned}`;
-}
-function invoiceToSvg(destination, options) {
-  return svgOf(encodeForQr(destination), options);
-}
-function invoiceToDataUrl(destination, options) {
-  return asDataUrl(invoiceToSvg(destination, options));
-}
-function lnurlToSvg(endpoint, options) {
-  return svgOf(toLnurl(endpoint), options);
-}
-function lnurlToDataUrl(endpoint, options) {
-  return asDataUrl(lnurlToSvg(endpoint, options));
-}
-function spdToSvg(spd, options) {
-  return svgOf(spd, options);
-}
-function spdToDataUrl(spd, options) {
-  return asDataUrl(spdToSvg(spd, options));
-}
-function svgOf(scanned, options) {
-  const size = options?.size ?? 256;
-  const color = options?.color ?? "#000";
-  if (!SAFE_COLOR.test(color)) throw new Error(`Invalid color: ${color}`);
-  return renderSvg(scanned, size, color);
-}
-function asDataUrl(svg) {
-  return `data:image/svg+xml,${encodeURIComponent(svg)}`;
-}
-function isLnAddress(destination) {
-  const at = destination.indexOf("@");
-  return at > 0 && destination.slice(at + 1).includes(".");
-}
-function renderSvg(content, size, color) {
-  const { data } = encode(content);
-  const modules = data.length;
-  const cellSize = size / modules;
-  let path = "";
-  for (let y = 0; y < modules; y++) {
-    for (let x = 0; x < modules; x++) {
-      if (data[y][x]) {
-        path += `M${x * cellSize},${y * cellSize}h${cellSize}v${cellSize}h-${cellSize}z`;
-      }
-    }
-  }
-  return [
-    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${size} ${size}" width="${size}" height="${size}">`,
-    `<rect width="100%" height="100%" fill="white"/>`,
-    `<path d="${path}" fill="${color}"/>`,
-    `</svg>`
-  ].join("");
-}
-
 // src/webhook.ts
 var SIGNATURE_HEADER = "x-signature";
 var TIMESTAMP_HEADER = "x-timestamp";
@@ -1815,7 +1696,7 @@ var DEFAULT_TOLERANCE_SECS = 300;
 async function verifyWebhookSignature(body, signature, secret, timestamp, options = {}) {
   if (!recent(timestamp, options.toleranceSecs ?? DEFAULT_TOLERANCE_SECS)) return false;
   const received = signature.startsWith(SIGNATURE_PREFIX) ? signature.slice(SIGNATURE_PREFIX.length) : signature;
-  return equalInConstantTime(await sign2(secret, timestamp, body), received.toLowerCase());
+  return equalInConstantTime(await sign(secret, timestamp, body), received.toLowerCase());
 }
 async function parseWebhook(body, signature, secret, timestamp, options = {}) {
   if (!await verifyWebhookSignature(body, signature, secret, timestamp, options)) return null;
@@ -1837,7 +1718,7 @@ function recent(timestamp, toleranceSecs) {
   if (!Number.isFinite(sent)) return false;
   return Math.abs(Math.floor(Date.now() / 1e3) - sent) <= toleranceSecs;
 }
-async function sign2(secret, timestamp, body) {
+async function sign(secret, timestamp, body) {
   return hmacHex(secret, signed(timestamp, body));
 }
 function signed(timestamp, body) {
@@ -1860,6 +1741,7 @@ export {
   REQUEST_IN_FLIGHT,
   ThunderBridge,
   UnverifiedRecipientError,
+  bankRail,
   bankTransfer,
   bankVerifyEndpoint,
   bitstamp,
@@ -1872,7 +1754,7 @@ export {
   isProblemType,
   isProvablyPaid,
   kraken,
-  lnurlPayEndpoint,
+  lightningRail,
   lnurlToDataUrl,
   lnurlToSvg,
   medianOf,
@@ -1884,6 +1766,8 @@ export {
   preimageMatchesHash,
   proveOrigin,
   proveSettlement,
+  qrToDataUrl,
+  qrToSvg,
   seal,
   spdToDataUrl,
   spdToSvg,