thunder-bridge 0.8.3 → 0.8.4

package/README.md

@@ -166,7 +166,8 @@ const tipJar = lnurlToSvg("https://agora.gripe/tip");
 ```
 
 **Webhooks** - [`src/webhook.ts`](src/webhook.ts): `parseWebhookRequest`,
-`parseWebhook`, `verifyWebhookSignature`. See [Webhooks](#webhooks).
+`parseWebhook`, `parseWatchedWebhookRequest`, `parseWatchedWebhook`,
+`verifyWebhookSignature`. See [Webhooks](#webhooks).
 
 **Errors** - [`src/errors.ts`](src/errors.ts): `ProblemError`,
 `NoWalletAvailableError`, `GatewayCheatError`, `UnverifiedRecipientError`,
@@ -225,6 +226,27 @@ such as `nas`, the trailing-dot `localhost.`, and anything whose last label is
 
 It vets the first hop only. See below.
 
+### Which transfer counts as paying
+
+`bankVerifyEndpoint` calls a credit a settlement when the amount and the currency
+match exactly and the reference appears anywhere in what the payer wrote,
+case-insensitively. With `fioStatement` "what the payer wrote" is four Fio columns
+joined: the variable symbol, the user identification, the message for the recipient
+and the payer's own reference. So a bank that prefixes, appends, or moves the text
+between those fields still settles.
+
+Two shapes do not settle, and both leave the payment `pending` while the money is
+already in the account:
+
+- **A shortened reference.** The match asks whether the reference is inside what the
+  bank forwarded, not the other way round, so a bank that truncates it never matches.
+- **A payer whose bank forwards nothing but a numeric variable symbol.** The
+  reference is alphanumeric and cannot travel in a numeric field, and the match does
+  not read `X-VS` as an alternative.
+
+Neither has been seen with Fio, which forwards the message untouched. Check it
+against the banks your payers actually use before you promise them a rail.
+
 ## What is still trusted
 
 - **The gateway chooses which of your addresses gets paid.** Nothing here can
@@ -315,9 +337,9 @@ try {
 
 ## Webhooks
 
-Pass `webhookUrl` and optionally `webhookSecret` when you create a payment. Once
-it reaches `paid` the gateway POSTs the same JSON the API returns, so the body is
-a `Payment`. Every delivery carries `x-timestamp`, and with a secret set
+Pass `webhookUrl` and optionally `webhookSecret` when you create a payment, or on
+any rail. Once it reaches `paid` the gateway POSTs the same JSON the API returns,
+so the body is a `Payment`. Every delivery carries `x-timestamp`, and with a secret set
 `x-signature: sha256=<hmac>` over `<timestamp>.<body>` rather than the body alone,
 so a captured delivery cannot be replayed at you later. Six attempts on a widening
 backoff, then it parks. An invoice that expires fires nothing.
@@ -339,6 +361,29 @@ app.post("/hooks/paid", async (context) => {
 });
 ```
 
+### A watched payment sends a different body
+
+`bankRail` and `blindLightningRail` register a payment the gateway was told almost
+nothing about, so its webhook carries no address, no amount and no invoice. That is
+not a `Payment`, and `parseWebhook` answers `null` for it, which looks exactly like a
+bad signature. Use `parseWatchedWebhookRequest` there instead and you get a
+`TriggerEvent`, the shape `getWatched` hands back.
+
+```ts
+import { parseWatchedWebhookRequest } from "thunder-bridge";
+
+app.post("/hooks/bank", async (context) => {
+  const settled = await parseWatchedWebhookRequest(context.req.raw, secret);
+  if (settled === null) return context.text("bad signature", 401);
+
+  await fulfil(settled.id, settled.preimage);
+  return context.text("ok");
+});
+```
+
+Give each rail its own path, as above, and neither endpoint has to guess which body
+it was handed.
+
 `parseWebhookRequest` refuses anything more than five minutes out of date,
 adjustable with `toleranceSecs`. The signature proves the body came from someone
 holding your secret. It does not prove the payment happened, since the gateway

package/dist/index.cjs

@@ -50,6 +50,8 @@ __export(index_exports, {
   minorScaleOf: () => minorScaleOf,
   minorUnitsOf: () => minorUnitsOf,
   msatFor: () => msatFor,
+  parseWatchedWebhook: () => parseWatchedWebhook,
+  parseWatchedWebhookRequest: () => parseWatchedWebhookRequest,
   parseWebhook: () => parseWebhook,
   parseWebhookRequest: () => parseWebhookRequest,
   preimageMatchesHash: () => preimageMatchesHash,
@@ -609,7 +611,8 @@ function watchRequestBody(params, trigger) {
     verify_url: params.verifyUrl,
     expires_at: expiresAt.toISOString(),
     trigger: trigger ?? void 0,
-    sealed: params.sealed
+    sealed: params.sealed,
+    webhook: params.webhookUrl ? { url: params.webhookUrl, secret: params.webhookSecret } : void 0
   });
 }
 function triggerEventFromWire(body) {
@@ -1281,7 +1284,9 @@ async function bankTransfer(params) {
     verifyUrl,
     expiresAt: params.expiresAt,
     trigger: params.trigger,
-    sealed: params.sealed
+    sealed: params.sealed,
+    webhookUrl: params.webhookUrl,
+    webhookSecret: params.webhookSecret
   });
   return { id: watched.id, paymentHash: watched.paymentHash, verifyUrl, spd };
 }
@@ -1602,6 +1607,8 @@ function bankRail(config) {
       trigger: config.trigger,
       sealed: await config.sealed?.(order),
       variableSymbol: config.variableSymbol?.(order),
+      webhookUrl: config.webhookUrl,
+      webhookSecret: config.webhookSecret,
       allowPublicGateway: config.allowPublicGateway
     });
     return {
@@ -1781,6 +1788,21 @@ async function parseWebhookRequest(request, secret, options = {}) {
   if (signature === null || timestamp === null) return null;
   return parseWebhook(await request.text(), signature, secret, timestamp, options);
 }
+async function parseWatchedWebhook(body, signature, secret, timestamp, options = {}) {
+  if (!await verifyWebhookSignature(body, signature, secret, timestamp, options)) return null;
+  const text2 = typeof body === "string" ? body : new TextDecoder().decode(body);
+  try {
+    return triggerEventFromWire(JSON.parse(text2));
+  } catch {
+    return null;
+  }
+}
+async function parseWatchedWebhookRequest(request, secret, options = {}) {
+  const signature = request.headers.get(SIGNATURE_HEADER);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER);
+  if (signature === null || timestamp === null) return null;
+  return parseWatchedWebhook(await request.text(), signature, secret, timestamp, options);
+}
 function recent(timestamp, toleranceSecs) {
   const sent = Number(timestamp);
   if (!Number.isFinite(sent)) return false;
@@ -1830,6 +1852,8 @@ function signed(timestamp, body) {
   minorScaleOf,
   minorUnitsOf,
   msatFor,
+  parseWatchedWebhook,
+  parseWatchedWebhookRequest,
   parseWebhook,
   parseWebhookRequest,
   preimageMatchesHash,

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { T as ThunderBridge, P as Payment, C as CreatePaymentParams, W as WalletFailure } from './rail-Cyc5zTtA.cjs';
-export { B as BankRailConfig, a as CreateOptions, b as CreateQuoteParams, F as FollowOptions, L as Leg, c as LightningRailConfig, O as Order, d as PaymentStatus, Q as Quote, R as Rail, e as ThunderBridgeOptions, f as TriggerEvent, g as WaitOptions, h as WalletReason, i as WatchPaymentParams, j as bankRail, l as lightningRail } from './rail-Cyc5zTtA.cjs';
+import { T as ThunderBridge, P as Payment, C as CreatePaymentParams, a as TriggerEvent, W as WalletFailure } from './rail-QZtUN1D-.cjs';
+export { B as BankRailConfig, b as CreateOptions, c as CreateQuoteParams, F as FollowOptions, L as Leg, d as LightningRailConfig, O as Order, e as PaymentStatus, Q as Quote, R as Rail, f as ThunderBridgeOptions, g as WaitOptions, h as WalletReason, i as WatchPaymentParams, j as bankRail, l as lightningRail } from './rail-QZtUN1D-.cjs';
 
 /**
  * Encrypt what the watcher needs and the gateway must not have. The gateway
@@ -66,6 +66,13 @@ interface BankTransferParams {
      * without asking anyone. `seal` it and the gateway cannot read it either
      */
     sealed?: string;
+    /**
+     * Where the gateway posts once the money lands, a public https URL. Without one
+     * a transfer is only ever learned by following the trigger or asking
+     */
+    webhookUrl?: string;
+    /** Signs that delivery, so `verifyWebhookSignature` can tell it came from the gateway */
+    webhookSecret?: string;
     /**
      * Register on a gateway you do not own anyway. The verify URL names the amount
      * and the reference, so its operator ends up reading your order book, and the
@@ -340,6 +347,14 @@ declare function parseWebhook(body: string | Uint8Array, signature: string, secr
  * Cloudflare Workers and Deno, WebCrypto only so it runs anywhere fetch does
  */
 declare function parseWebhookRequest(request: Request, secret: string, options?: WebhookOptions): Promise<Payment | null>;
+/**
+ * The same, for a payment the gateway only watched. A bank transfer and a blind
+ * Lightning leg carry no address, amount or invoice, so they arrive in the shape
+ * `followTrigger` and `getWatched` hand back rather than the minted one
+ */
+declare function parseWatchedWebhook(body: string | Uint8Array, signature: string, secret: string, timestamp: string, options?: WebhookOptions): Promise<TriggerEvent | null>;
+/** `parseWatchedWebhook` from a Fetch API `Request`, the way `parseWebhookRequest` is */
+declare function parseWatchedWebhookRequest(request: Request, secret: string, options?: WebhookOptions): Promise<TriggerEvent | null>;
 
 /**
  * The way a gateway was caught out, every code is a check that held against the
@@ -417,4 +432,4 @@ declare class NoWalletAvailableError extends ProblemError {
     }, wallets: WalletFailure[]);
 }
 
-export { type BankTransfer, type BankTransferParams, type BankVerifyConfig, CreatePaymentParams, type Credit, type FioConfig, type GatewayCheatCode, GatewayCheatError, IDEMPOTENCY_KEY_REUSED, type IdempotencyConflict, IdempotencyConflictError, type Invoice, type MedianOptions, NO_WALLET_AVAILABLE, NoWalletAvailableError, PAYMENT_ALREADY_WATCHED, Payment, ProblemError, type QrOptions, REQUEST_IN_FLIGHT, type Statement, ThunderBridge, type Ticker, UnverifiedRecipientError, WalletFailure, type WebhookOptions, bankTransfer, bankVerifyEndpoint, bitstamp, coinbase, coinmate, decodeInvoice, fioStatement, invoiceToDataUrl, invoiceToSvg, isProblemType, isProvablyPaid, kraken, lnurlToDataUrl, lnurlToSvg, medianOf, minorScaleOf, minorUnitsOf, msatFor, parseWebhook, parseWebhookRequest, preimageMatchesHash, proveOrigin, proveSettlement, qrToDataUrl, qrToSvg, seal, spdToDataUrl, spdToSvg, toLnurl, unseal, verifyWebhookSignature };
+export { type BankTransfer, type BankTransferParams, type BankVerifyConfig, CreatePaymentParams, type Credit, type FioConfig, type GatewayCheatCode, GatewayCheatError, IDEMPOTENCY_KEY_REUSED, type IdempotencyConflict, IdempotencyConflictError, type Invoice, type MedianOptions, NO_WALLET_AVAILABLE, NoWalletAvailableError, PAYMENT_ALREADY_WATCHED, Payment, ProblemError, type QrOptions, REQUEST_IN_FLIGHT, type Statement, ThunderBridge, type Ticker, TriggerEvent, UnverifiedRecipientError, WalletFailure, type WebhookOptions, bankTransfer, bankVerifyEndpoint, bitstamp, coinbase, coinmate, decodeInvoice, fioStatement, invoiceToDataUrl, invoiceToSvg, isProblemType, isProvablyPaid, kraken, lnurlToDataUrl, lnurlToSvg, medianOf, minorScaleOf, minorUnitsOf, msatFor, parseWatchedWebhook, parseWatchedWebhookRequest, parseWebhook, parseWebhookRequest, preimageMatchesHash, proveOrigin, proveSettlement, qrToDataUrl, qrToSvg, seal, spdToDataUrl, spdToSvg, toLnurl, unseal, verifyWebhookSignature };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { T as ThunderBridge, P as Payment, C as CreatePaymentParams, W as WalletFailure } from './rail-Cyc5zTtA.js';
-export { B as BankRailConfig, a as CreateOptions, b as CreateQuoteParams, F as FollowOptions, L as Leg, c as LightningRailConfig, O as Order, d as PaymentStatus, Q as Quote, R as Rail, e as ThunderBridgeOptions, f as TriggerEvent, g as WaitOptions, h as WalletReason, i as WatchPaymentParams, j as bankRail, l as lightningRail } from './rail-Cyc5zTtA.js';
+import { T as ThunderBridge, P as Payment, C as CreatePaymentParams, a as TriggerEvent, W as WalletFailure } from './rail-QZtUN1D-.js';
+export { B as BankRailConfig, b as CreateOptions, c as CreateQuoteParams, F as FollowOptions, L as Leg, d as LightningRailConfig, O as Order, e as PaymentStatus, Q as Quote, R as Rail, f as ThunderBridgeOptions, g as WaitOptions, h as WalletReason, i as WatchPaymentParams, j as bankRail, l as lightningRail } from './rail-QZtUN1D-.js';
 
 /**
  * Encrypt what the watcher needs and the gateway must not have. The gateway
@@ -66,6 +66,13 @@ interface BankTransferParams {
      * without asking anyone. `seal` it and the gateway cannot read it either
      */
     sealed?: string;
+    /**
+     * Where the gateway posts once the money lands, a public https URL. Without one
+     * a transfer is only ever learned by following the trigger or asking
+     */
+    webhookUrl?: string;
+    /** Signs that delivery, so `verifyWebhookSignature` can tell it came from the gateway */
+    webhookSecret?: string;
     /**
      * Register on a gateway you do not own anyway. The verify URL names the amount
      * and the reference, so its operator ends up reading your order book, and the
@@ -340,6 +347,14 @@ declare function parseWebhook(body: string | Uint8Array, signature: string, secr
  * Cloudflare Workers and Deno, WebCrypto only so it runs anywhere fetch does
  */
 declare function parseWebhookRequest(request: Request, secret: string, options?: WebhookOptions): Promise<Payment | null>;
+/**
+ * The same, for a payment the gateway only watched. A bank transfer and a blind
+ * Lightning leg carry no address, amount or invoice, so they arrive in the shape
+ * `followTrigger` and `getWatched` hand back rather than the minted one
+ */
+declare function parseWatchedWebhook(body: string | Uint8Array, signature: string, secret: string, timestamp: string, options?: WebhookOptions): Promise<TriggerEvent | null>;
+/** `parseWatchedWebhook` from a Fetch API `Request`, the way `parseWebhookRequest` is */
+declare function parseWatchedWebhookRequest(request: Request, secret: string, options?: WebhookOptions): Promise<TriggerEvent | null>;
 
 /**
  * The way a gateway was caught out, every code is a check that held against the
@@ -417,4 +432,4 @@ declare class NoWalletAvailableError extends ProblemError {
     }, wallets: WalletFailure[]);
 }
 
-export { type BankTransfer, type BankTransferParams, type BankVerifyConfig, CreatePaymentParams, type Credit, type FioConfig, type GatewayCheatCode, GatewayCheatError, IDEMPOTENCY_KEY_REUSED, type IdempotencyConflict, IdempotencyConflictError, type Invoice, type MedianOptions, NO_WALLET_AVAILABLE, NoWalletAvailableError, PAYMENT_ALREADY_WATCHED, Payment, ProblemError, type QrOptions, REQUEST_IN_FLIGHT, type Statement, ThunderBridge, type Ticker, UnverifiedRecipientError, WalletFailure, type WebhookOptions, bankTransfer, bankVerifyEndpoint, bitstamp, coinbase, coinmate, decodeInvoice, fioStatement, invoiceToDataUrl, invoiceToSvg, isProblemType, isProvablyPaid, kraken, lnurlToDataUrl, lnurlToSvg, medianOf, minorScaleOf, minorUnitsOf, msatFor, parseWebhook, parseWebhookRequest, preimageMatchesHash, proveOrigin, proveSettlement, qrToDataUrl, qrToSvg, seal, spdToDataUrl, spdToSvg, toLnurl, unseal, verifyWebhookSignature };
+export { type BankTransfer, type BankTransferParams, type BankVerifyConfig, CreatePaymentParams, type Credit, type FioConfig, type GatewayCheatCode, GatewayCheatError, IDEMPOTENCY_KEY_REUSED, type IdempotencyConflict, IdempotencyConflictError, type Invoice, type MedianOptions, NO_WALLET_AVAILABLE, NoWalletAvailableError, PAYMENT_ALREADY_WATCHED, Payment, ProblemError, type QrOptions, REQUEST_IN_FLIGHT, type Statement, ThunderBridge, type Ticker, TriggerEvent, UnverifiedRecipientError, WalletFailure, type WebhookOptions, bankTransfer, bankVerifyEndpoint, bitstamp, coinbase, coinmate, decodeInvoice, fioStatement, invoiceToDataUrl, invoiceToSvg, isProblemType, isProvablyPaid, kraken, lnurlToDataUrl, lnurlToSvg, medianOf, minorScaleOf, minorUnitsOf, msatFor, parseWatchedWebhook, parseWatchedWebhookRequest, parseWebhook, parseWebhookRequest, preimageMatchesHash, proveOrigin, proveSettlement, qrToDataUrl, qrToSvg, seal, spdToDataUrl, spdToSvg, toLnurl, unseal, verifyWebhookSignature };

package/dist/index.js

@@ -541,7 +541,8 @@ function watchRequestBody(params, trigger) {
     verify_url: params.verifyUrl,
     expires_at: expiresAt.toISOString(),
     trigger: trigger ?? void 0,
-    sealed: params.sealed
+    sealed: params.sealed,
+    webhook: params.webhookUrl ? { url: params.webhookUrl, secret: params.webhookSecret } : void 0
   });
 }
 function triggerEventFromWire(body) {
@@ -1213,7 +1214,9 @@ async function bankTransfer(params) {
     verifyUrl,
     expiresAt: params.expiresAt,
     trigger: params.trigger,
-    sealed: params.sealed
+    sealed: params.sealed,
+    webhookUrl: params.webhookUrl,
+    webhookSecret: params.webhookSecret
   });
   return { id: watched.id, paymentHash: watched.paymentHash, verifyUrl, spd };
 }
@@ -1534,6 +1537,8 @@ function bankRail(config) {
       trigger: config.trigger,
       sealed: await config.sealed?.(order),
       variableSymbol: config.variableSymbol?.(order),
+      webhookUrl: config.webhookUrl,
+      webhookSecret: config.webhookSecret,
       allowPublicGateway: config.allowPublicGateway
     });
     return {
@@ -1713,6 +1718,21 @@ async function parseWebhookRequest(request, secret, options = {}) {
   if (signature === null || timestamp === null) return null;
   return parseWebhook(await request.text(), signature, secret, timestamp, options);
 }
+async function parseWatchedWebhook(body, signature, secret, timestamp, options = {}) {
+  if (!await verifyWebhookSignature(body, signature, secret, timestamp, options)) return null;
+  const text2 = typeof body === "string" ? body : new TextDecoder().decode(body);
+  try {
+    return triggerEventFromWire(JSON.parse(text2));
+  } catch {
+    return null;
+  }
+}
+async function parseWatchedWebhookRequest(request, secret, options = {}) {
+  const signature = request.headers.get(SIGNATURE_HEADER);
+  const timestamp = request.headers.get(TIMESTAMP_HEADER);
+  if (signature === null || timestamp === null) return null;
+  return parseWatchedWebhook(await request.text(), signature, secret, timestamp, options);
+}
 function recent(timestamp, toleranceSecs) {
   const sent = Number(timestamp);
   if (!Number.isFinite(sent)) return false;
@@ -1761,6 +1781,8 @@ export {
   minorScaleOf,
   minorUnitsOf,
   msatFor,
+  parseWatchedWebhook,
+  parseWatchedWebhookRequest,
   parseWebhook,
   parseWebhookRequest,
   preimageMatchesHash,

package/dist/{rail-Cyc5zTtA.d.cts → rail-QZtUN1D-.d.cts}

@@ -74,6 +74,8 @@ interface WatchPaymentParams {
     expiresAt: number;
     trigger?: string;
     sealed?: string;
+    webhookUrl?: string;
+    webhookSecret?: string;
 }
 /** Why one wallet in the list could not be used */
 type WalletReason = "address-unusable" | "unreachable" | "amount-not-accepted" | "cannot-prove-delivery" | "invoice-refused";
@@ -312,6 +314,8 @@ interface BankRailConfig {
     sealed?: (order: Order) => string | Promise<string>;
     /** Up to ten digits, for accounting systems that still want one */
     variableSymbol?: (order: Order) => string | undefined;
+    webhookUrl?: string;
+    webhookSecret?: string;
     /** Register on a gateway you do not own anyway, on the terms `bankTransfer` sets out */
     allowPublicGateway?: boolean;
     /** What `Leg.rail` reads, for a shop running more than one account */
@@ -347,6 +351,8 @@ interface BlindLightningRailConfig {
     trigger?: string;
     /** Only a watched leg has anywhere to carry this */
     sealed?: (order: Order) => string | Promise<string>;
+    webhookUrl?: string;
+    webhookSecret?: string;
     /** What `Leg.rail` reads, for a shop running more than one wallet */
     name?: string;
 }
@@ -372,4 +378,4 @@ declare function lightningRail(config: LightningRailConfig): Rail;
  */
 declare function blindLightningRail(config: BlindLightningRailConfig): Rail;
 
-export { type BankRailConfig as B, type CreatePaymentParams as C, type FollowOptions as F, type Leg as L, type Order as O, type Payment as P, type Quote as Q, type Rail as R, ThunderBridge as T, type WalletFailure as W, type CreateOptions as a, type CreateQuoteParams as b, type LightningRailConfig as c, type PaymentStatus as d, type ThunderBridgeOptions as e, type TriggerEvent as f, type WaitOptions as g, type WalletReason as h, type WatchPaymentParams as i, bankRail as j, type BlindLightningRailConfig as k, lightningRail as l, blindLightningRail as m };
+export { type BankRailConfig as B, type CreatePaymentParams as C, type FollowOptions as F, type Leg as L, type Order as O, type Payment as P, type Quote as Q, type Rail as R, ThunderBridge as T, type WalletFailure as W, type TriggerEvent as a, type CreateOptions as b, type CreateQuoteParams as c, type LightningRailConfig as d, type PaymentStatus as e, type ThunderBridgeOptions as f, type WaitOptions as g, type WalletReason as h, type WatchPaymentParams as i, bankRail as j, type BlindLightningRailConfig as k, lightningRail as l, blindLightningRail as m };

package/dist/{rail-Cyc5zTtA.d.ts → rail-QZtUN1D-.d.ts}

@@ -74,6 +74,8 @@ interface WatchPaymentParams {
     expiresAt: number;
     trigger?: string;
     sealed?: string;
+    webhookUrl?: string;
+    webhookSecret?: string;
 }
 /** Why one wallet in the list could not be used */
 type WalletReason = "address-unusable" | "unreachable" | "amount-not-accepted" | "cannot-prove-delivery" | "invoice-refused";
@@ -312,6 +314,8 @@ interface BankRailConfig {
     sealed?: (order: Order) => string | Promise<string>;
     /** Up to ten digits, for accounting systems that still want one */
     variableSymbol?: (order: Order) => string | undefined;
+    webhookUrl?: string;
+    webhookSecret?: string;
     /** Register on a gateway you do not own anyway, on the terms `bankTransfer` sets out */
     allowPublicGateway?: boolean;
     /** What `Leg.rail` reads, for a shop running more than one account */
@@ -347,6 +351,8 @@ interface BlindLightningRailConfig {
     trigger?: string;
     /** Only a watched leg has anywhere to carry this */
     sealed?: (order: Order) => string | Promise<string>;
+    webhookUrl?: string;
+    webhookSecret?: string;
     /** What `Leg.rail` reads, for a shop running more than one wallet */
     name?: string;
 }
@@ -372,4 +378,4 @@ declare function lightningRail(config: LightningRailConfig): Rail;
  */
 declare function blindLightningRail(config: BlindLightningRailConfig): Rail;
 
-export { type BankRailConfig as B, type CreatePaymentParams as C, type FollowOptions as F, type Leg as L, type Order as O, type Payment as P, type Quote as Q, type Rail as R, ThunderBridge as T, type WalletFailure as W, type CreateOptions as a, type CreateQuoteParams as b, type LightningRailConfig as c, type PaymentStatus as d, type ThunderBridgeOptions as e, type TriggerEvent as f, type WaitOptions as g, type WalletReason as h, type WatchPaymentParams as i, bankRail as j, type BlindLightningRailConfig as k, lightningRail as l, blindLightningRail as m };
+export { type BankRailConfig as B, type CreatePaymentParams as C, type FollowOptions as F, type Leg as L, type Order as O, type Payment as P, type Quote as Q, type Rail as R, ThunderBridge as T, type WalletFailure as W, type TriggerEvent as a, type CreateOptions as b, type CreateQuoteParams as c, type LightningRailConfig as d, type PaymentStatus as e, type ThunderBridgeOptions as f, type WaitOptions as g, type WalletReason as h, type WatchPaymentParams as i, bankRail as j, type BlindLightningRailConfig as k, lightningRail as l, blindLightningRail as m };

package/dist/server.cjs

@@ -777,7 +777,9 @@ function blindLightningRail(config) {
       verifyUrl: resolved.verifyUrl,
       expiresAt: resolved.expiresAt,
       trigger: config.trigger,
-      sealed: await config.sealed?.(order)
+      sealed: await config.sealed?.(order),
+      webhookUrl: config.webhookUrl,
+      webhookSecret: config.webhookSecret
     });
     return {
       id: watched.id,

package/dist/server.d.cts

@@ -1,5 +1,5 @@
-import { T as ThunderBridge } from './rail-Cyc5zTtA.cjs';
-export { k as BlindLightningRailConfig, m as blindLightningRail } from './rail-Cyc5zTtA.cjs';
+import { T as ThunderBridge } from './rail-QZtUN1D-.cjs';
+export { k as BlindLightningRailConfig, m as blindLightningRail } from './rail-QZtUN1D-.cjs';
 
 interface TriggerConfig {
     /** The gateway that quotes the addresses and mints the invoice */

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { T as ThunderBridge } from './rail-Cyc5zTtA.js';
-export { k as BlindLightningRailConfig, m as blindLightningRail } from './rail-Cyc5zTtA.js';
+import { T as ThunderBridge } from './rail-QZtUN1D-.js';
+export { k as BlindLightningRailConfig, m as blindLightningRail } from './rail-QZtUN1D-.js';
 
 interface TriggerConfig {
     /** The gateway that quotes the addresses and mints the invoice */

package/dist/server.js

@@ -740,7 +740,9 @@ function blindLightningRail(config) {
       verifyUrl: resolved.verifyUrl,
       expiresAt: resolved.expiresAt,
       trigger: config.trigger,
-      sealed: await config.sealed?.(order)
+      sealed: await config.sealed?.(order),
+      webhookUrl: config.webhookUrl,
+      webhookSecret: config.webhookSecret
     });
     return {
       id: watched.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thunder-bridge",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Trustless JavaScript client for the Thunder Bridge Lightning payment gateway. Proves the invoice came from your own wallet before the payer sees it.",
   "author": "i-am-fatik",
   "homepage": "https://agora.gripe/en/tools/thunder-bridge",