thunder-bridge 1.4.2 → 2.1.1

package/dist/bank.js

@@ -0,0 +1,310 @@
+// ../core/bytes.ts
+function bytesToHex(bytes) {
+  let hex = "";
+  for (const byte of bytes) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function hexToBytes(hex) {
+  const bytes = new Uint8Array(hex.length >> 1);
+  for (let at = 0; at < bytes.length; at++) {
+    bytes[at] = parseInt(hex.slice(at * 2, at * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+// ../core/ed25519.ts
+var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
+var SMALL_ORDER = [
+  "00".repeat(32),
+  `01${"00".repeat(31)}`,
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+  `ec${"ff".repeat(30)}7f`,
+  `ed${"ff".repeat(30)}7f`,
+  `ee${"ff".repeat(30)}7f`
+];
+
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
+}
+function asBuffer(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
+// ../core/sha256.ts
+var ROUND_CONSTANTS = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var INITIAL_STATE = new Uint32Array([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// ../core/sealed.ts
+var MIN_SECRET_CHARS = 32;
+var INFO = new TextEncoder().encode("thunder-bridge/sealed");
+function refuseAWeakSecret(secret) {
+  if (secret.length < MIN_SECRET_CHARS) {
+    throw new Error(`the sealing secret needs ${MIN_SECRET_CHARS} characters of randomness`);
+  }
+}
+
+// src/bank.ts
+var DEFAULT_CURRENCY = "CZK";
+var DEFAULT_LOOK_BACK_SECS = 7 * 24 * 60 * 60;
+function bankAgent(config) {
+  refuseAWeakSecret(config.secret);
+  return config.gateway.attend({
+    onError: config.onError,
+    answer: async (paymentHash) => {
+      const order = await config.orders(paymentHash);
+      if (order === null) {
+        return null;
+      }
+      const currency = order.currency ?? DEFAULT_CURRENCY;
+      return await creditedPreimage({
+        secret: config.secret,
+        asked: {
+          iban: accountOf(order.iban),
+          reference: order.reference,
+          amountMinor: order.amountMinor,
+          currency,
+          expiresAt: order.expiresAt
+        },
+        statement: order.statement,
+        lookBackSecs: config.lookBackSecs
+      });
+    }
+  });
+}
+async function creditedPreimage(params) {
+  const since = unixNow() - (params.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
+  const landed = (await params.statement(since)).some((credit) => pays(credit, params.asked));
+  if (!landed) {
+    return null;
+  }
+  return await hmacHex(params.secret, `preimage|${subjectOf(params.asked)}`);
+}
+function pays(credit, asked) {
+  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && namesOnly(credit.reference, asked.reference);
+}
+function namesOnly(written, reference) {
+  const wanted = reference.toUpperCase();
+  const alike = [...written.toUpperCase().matchAll(wordsShapedLike(wanted))].map(([word]) => word);
+  return alike.includes(wanted) && (!/\d/.test(wanted) || alike.every((word) => word === wanted));
+}
+function wordsShapedLike(reference) {
+  const shape = [...reference].map((char) => {
+    if (/\d/.test(char)) {
+      return "\\d";
+    }
+    return /\p{L}/u.test(char) ? "\\p{L}" : char.replace(/[\^$\\.*+?()[\]{}|/]/g, "\\$&");
+  }).join("");
+  return new RegExp(`(?<![\\p{L}\\p{N}])${shape}(?![\\p{L}\\p{N}])`, "gu");
+}
+function subjectOf({ iban, amountMinor, currency, expiresAt, reference }) {
+  return `${iban}|${amountMinor}|${currency.toUpperCase()}|${expiresAt}|${reference}`;
+}
+function accountOf(iban) {
+  return iban.replace(/\s+/g, "").toUpperCase();
+}
+function unixNow() {
+  return Math.floor(Date.now() / 1e3);
+}
+
+// src/fio.ts
+var BASE_URL = "https://fioapi.fio.cz/v1/rest";
+var MINOR_UNITS = 100;
+var MILLIS = 1e3;
+var DATE_CHARS = "2026-08-04".length;
+var DEFAULT_MIN_INTERVAL_SECS = 30;
+var TOO_SOON = 409;
+var BOOKED_AT = "column0";
+var AMOUNT = "column1";
+var CURRENCY = "column14";
+var VARIABLE_SYMBOL = "column5";
+var USER_IDENTIFICATION = "column7";
+var MESSAGE_FOR_RECIPIENT = "column16";
+var PAYER_REFERENCE = "column27";
+var WHERE_A_PAYER_WRITES = [
+  MESSAGE_FOR_RECIPIENT,
+  VARIABLE_SYMBOL,
+  USER_IDENTIFICATION,
+  PAYER_REFERENCE
+];
+var UTC_OFFSET = /^[+-]\d{4}$/;
+function fioStatement(config) {
+  const named = typeof config.token === "string" ? [config.token] : config.token;
+  if (named.length === 0) {
+    throw new Error("fioStatement needs at least one token to read with");
+  }
+  const usedAt = new Map(named.map((token) => [token, Number.NEGATIVE_INFINITY]));
+  const tokenWindowMs = (config.minIntervalSecs ?? DEFAULT_MIN_INTERVAL_SECS) * MILLIS;
+  const paceMs = tokenWindowMs / usedAt.size;
+  let lastRead = Number.NEGATIVE_INFINITY;
+  let credits = [];
+  return async (sinceUnix) => {
+    const now = Date.now();
+    if (now - lastRead < paceMs) {
+      return credits;
+    }
+    const idlest = longestUnused(usedAt);
+    if (now - idlest.usedAt < tokenWindowMs) {
+      return credits;
+    }
+    usedAt.set(idlest.token, now);
+    lastRead = now;
+    const url = [
+      config.baseUrl ?? BASE_URL,
+      "periods",
+      idlest.token,
+      asDate(sinceUnix),
+      asDate(Math.floor(now / MILLIS)),
+      "transactions.json"
+    ].join("/");
+    const answer = await fetch(url, { headers: { accept: "application/json" } });
+    if (answer.status === TOO_SOON) {
+      throw new Error("fio refuses a second read of this token inside its 30 second window");
+    }
+    if (!answer.ok) {
+      throw new Error(`fio answered ${answer.status} reading the statement`);
+    }
+    const read = await answer.json();
+    credits = (read.accountStatement?.transactionList?.transaction ?? []).filter(isCredit).map(asCredit);
+    return credits;
+  };
+}
+function longestUnused(usedAt) {
+  let token = "";
+  let idleSince = Number.POSITIVE_INFINITY;
+  for (const [candidate, at] of usedAt) {
+    if (at < idleSince) {
+      token = candidate;
+      idleSince = at;
+    }
+  }
+  return { token, usedAt: idleSince };
+}
+function isCredit(transaction) {
+  return numberIn(transaction[AMOUNT]) > 0;
+}
+function asCredit(transaction) {
+  return {
+    amountMinor: Math.round(numberIn(transaction[AMOUNT]) * MINOR_UNITS),
+    currency: textIn(transaction[CURRENCY]),
+    reference: WHERE_A_PAYER_WRITES.map((column) => textIn(transaction[column])).filter((written) => written.length > 0).join(" "),
+    bookedAt: bookedAtIn(transaction[BOOKED_AT])
+  };
+}
+function bookedAtIn(cell) {
+  const value = cell?.value;
+  if (typeof value === "number") {
+    return Math.floor(value / MILLIS);
+  }
+  const at = Date.parse(asIso8601(textIn(cell)));
+  return Number.isFinite(at) ? Math.floor(at / MILLIS) : 0;
+}
+function asIso8601(booked) {
+  const day = booked.slice(0, DATE_CHARS);
+  const zone = booked.slice(DATE_CHARS);
+  if (!UTC_OFFSET.test(zone)) {
+    return `${day}T00:00:00Z`;
+  }
+  return `${day}T00:00:00${zone.slice(0, 3)}:${zone.slice(3)}`;
+}
+function numberIn(cell) {
+  const value = Number(cell?.value ?? Number.NaN);
+  return Number.isFinite(value) ? value : 0;
+}
+function textIn(cell) {
+  const value = cell?.value;
+  return value === null || value === void 0 ? "" : String(value).trim();
+}
+function asDate(unix) {
+  return new Date(unix * MILLIS).toISOString().slice(0, DATE_CHARS);
+}
+export {
+  bankAgent,
+  fioStatement
+};

package/dist/errors-DriqW-lp.d.cts

@@ -0,0 +1,126 @@
+import { W as WalletFailure } from './types-DYZ9EkmJ.cjs';
+
+/**
+ * Why an amount was refused. A code rather than a message, because a caller can
+ * only recover from a failure it can name and a message is free to be reworded
+ */
+type AmountFault = "not-whole-satoshi" | "not-whole-millisatoshi" | "not-a-decimal" | "too-precise" | "unknown-currency";
+/**
+ * Thrown when a price cannot be held exactly. Every constructor of an amount
+ * throws this rather than returning something approximate, because a payment
+ * library that rounds silently moves the wrong money
+ */
+declare class AmountError extends Error {
+    /**
+     * Whether a failure is one of these, without asking whether it is this exact
+     * class. Every entry point carries its own copy of the class, so a price
+     * refused inside `thunder-bridge/price` is not `instanceof` the `AmountError`
+     * imported from `thunder-bridge`. The name and the code are the same in every
+     * copy, so this holds where `instanceof` does not
+     */
+    static is(failure: unknown): failure is AmountError;
+    readonly code: AmountFault;
+    constructor(code: AmountFault, detail: string);
+}
+/**
+ * The way a gateway was caught out, every code is a check that held against the
+ * recipient's own server and failed against what the gateway returned
+ */
+type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine" | "invoice_settled" | "invoice_stale" | "invoice_reused";
+/**
+ * Thrown when the gateway demonstrably misbehaved, the invoice it returned is
+ * not the one the address you asked for issued, or a settlement it reported
+ * carries a preimage that does not hash to the payment hash
+ */
+declare class GatewayCheatError extends Error {
+    readonly code: GatewayCheatCode;
+    readonly paymentId: string;
+    constructor(code: GatewayCheatCode, paymentId: string);
+}
+/**
+ * The way a wrapping operator was caught out. Every code is the wrapped invoice
+ * failing to bind to the recipient's own, which is the only thing that makes
+ * paying the wrap the same act as paying the recipient
+ */
+type WrapRefusalCode = "undecodable" | "hash_mismatch" | "amount_below_recipient" | "fee_above_allowance" | "recipient_expires_first";
+/**
+ * Thrown when a wrapped invoice does not bind to the recipient's. Paying it
+ * would be paying the operator on its word rather than on the shared payment
+ * hash, which is the whole of what makes wrapping safe
+ */
+declare class WrapRefusedError extends Error {
+    readonly code: WrapRefusalCode;
+    constructor(code: WrapRefusalCode, detail: string);
+}
+/**
+ * Thrown when the recipient's own server could not be reached to check the
+ * invoice against, a CORS-blocked browser or a provider that is down, this is
+ * not proof the gateway cheated and it is not proof it did not
+ */
+declare class UnverifiedRecipientError extends Error {
+    readonly lnAddress: string;
+    readonly paymentId: string;
+    constructor(lnAddress: string, paymentId: string, cause: unknown);
+}
+/** An RFC 9457 problem document the gateway answered with */
+declare class ProblemError extends Error {
+    static readonly NO_WALLET_AVAILABLE = "urn:problem-type:thunder-bridge:no-wallet-available";
+    static readonly REQUEST_IN_FLIGHT = "urn:problem-type:thunder-bridge:request-in-flight";
+    static readonly IDEMPOTENCY_KEY_REUSED = "urn:problem-type:thunder-bridge:idempotency-key-reused";
+    static readonly PAYMENT_ALREADY_WATCHED = "urn:problem-type:thunder-bridge:payment-already-watched";
+    static readonly INVALID_REQUEST = "urn:problem-type:thunder-bridge:invalid-request";
+    static readonly CALLER_UNKNOWN = "urn:problem-type:thunder-bridge:caller-unknown";
+    static readonly VERIFY_HOST_REFUSED = "urn:problem-type:thunder-bridge:verify-host-refused";
+    static readonly VERIFY_UNCONFIRMED = "urn:problem-type:thunder-bridge:verify-unconfirmed";
+    static readonly VERIFY_UNCONSENTED = "urn:problem-type:thunder-bridge:verify-unconsented";
+    static readonly WEBHOOK_UNCONFIRMED = "urn:problem-type:thunder-bridge:webhook-unconfirmed";
+    static readonly TOO_MANY_PENDING = "urn:problem-type:thunder-bridge:too-many-pending";
+    /**
+     * Whether a problem carries this type. Branch on the type, never on the prose,
+     * and reach for `instanceof` first: every type this SDK gives a class to has one
+     */
+    static is(problem: {
+        type?: string;
+    }, type: string): boolean;
+    readonly type: string;
+    readonly title: string;
+    readonly status: number;
+    readonly detail: string | null;
+    constructor(problem: {
+        type?: string;
+        title?: string;
+        status?: number;
+        detail?: string;
+    });
+}
+/**
+ * Why an `Idempotency-Key` was refused, `request-in-flight` is the benign one and
+ * `key-reused` means the same key was sent for a different request
+ */
+type IdempotencyConflict = "request-in-flight" | "key-reused";
+/**
+ * Thrown when an `Idempotency-Key` is held by another request. On
+ * `request-in-flight` the first attempt is still resolving, so wait and read the
+ * payment back rather than retrying. `key-reused` is a bug in the caller: the key
+ * is bound to the addresses, amount and webhook that claimed it
+ */
+declare class IdempotencyConflictError extends ProblemError {
+    readonly conflict: IdempotencyConflict;
+    constructor(problem: {
+        type?: string;
+        title?: string;
+        status?: number;
+        detail?: string;
+    }, conflict: IdempotencyConflict);
+}
+/** Thrown when no wallet on your list could issue a provable invoice, `wallets` says why each refused */
+declare class NoWalletAvailableError extends ProblemError {
+    readonly wallets: WalletFailure[];
+    constructor(problem: {
+        title?: string;
+        status?: number;
+        detail?: string;
+    }, wallets: WalletFailure[]);
+}
+
+export { AmountError as A, type GatewayCheatCode as G, type IdempotencyConflict as I, NoWalletAvailableError as N, ProblemError as P, UnverifiedRecipientError as U, type WrapRefusalCode as W, type AmountFault as a, GatewayCheatError as b, IdempotencyConflictError as c, WrapRefusedError as d };

package/dist/errors-ZEUT-MhO.d.ts

@@ -0,0 +1,126 @@
+import { W as WalletFailure } from './types-DYZ9EkmJ.js';
+
+/**
+ * Why an amount was refused. A code rather than a message, because a caller can
+ * only recover from a failure it can name and a message is free to be reworded
+ */
+type AmountFault = "not-whole-satoshi" | "not-whole-millisatoshi" | "not-a-decimal" | "too-precise" | "unknown-currency";
+/**
+ * Thrown when a price cannot be held exactly. Every constructor of an amount
+ * throws this rather than returning something approximate, because a payment
+ * library that rounds silently moves the wrong money
+ */
+declare class AmountError extends Error {
+    /**
+     * Whether a failure is one of these, without asking whether it is this exact
+     * class. Every entry point carries its own copy of the class, so a price
+     * refused inside `thunder-bridge/price` is not `instanceof` the `AmountError`
+     * imported from `thunder-bridge`. The name and the code are the same in every
+     * copy, so this holds where `instanceof` does not
+     */
+    static is(failure: unknown): failure is AmountError;
+    readonly code: AmountFault;
+    constructor(code: AmountFault, detail: string);
+}
+/**
+ * The way a gateway was caught out, every code is a check that held against the
+ * recipient's own server and failed against what the gateway returned
+ */
+type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine" | "invoice_settled" | "invoice_stale" | "invoice_reused";
+/**
+ * Thrown when the gateway demonstrably misbehaved, the invoice it returned is
+ * not the one the address you asked for issued, or a settlement it reported
+ * carries a preimage that does not hash to the payment hash
+ */
+declare class GatewayCheatError extends Error {
+    readonly code: GatewayCheatCode;
+    readonly paymentId: string;
+    constructor(code: GatewayCheatCode, paymentId: string);
+}
+/**
+ * The way a wrapping operator was caught out. Every code is the wrapped invoice
+ * failing to bind to the recipient's own, which is the only thing that makes
+ * paying the wrap the same act as paying the recipient
+ */
+type WrapRefusalCode = "undecodable" | "hash_mismatch" | "amount_below_recipient" | "fee_above_allowance" | "recipient_expires_first";
+/**
+ * Thrown when a wrapped invoice does not bind to the recipient's. Paying it
+ * would be paying the operator on its word rather than on the shared payment
+ * hash, which is the whole of what makes wrapping safe
+ */
+declare class WrapRefusedError extends Error {
+    readonly code: WrapRefusalCode;
+    constructor(code: WrapRefusalCode, detail: string);
+}
+/**
+ * Thrown when the recipient's own server could not be reached to check the
+ * invoice against, a CORS-blocked browser or a provider that is down, this is
+ * not proof the gateway cheated and it is not proof it did not
+ */
+declare class UnverifiedRecipientError extends Error {
+    readonly lnAddress: string;
+    readonly paymentId: string;
+    constructor(lnAddress: string, paymentId: string, cause: unknown);
+}
+/** An RFC 9457 problem document the gateway answered with */
+declare class ProblemError extends Error {
+    static readonly NO_WALLET_AVAILABLE = "urn:problem-type:thunder-bridge:no-wallet-available";
+    static readonly REQUEST_IN_FLIGHT = "urn:problem-type:thunder-bridge:request-in-flight";
+    static readonly IDEMPOTENCY_KEY_REUSED = "urn:problem-type:thunder-bridge:idempotency-key-reused";
+    static readonly PAYMENT_ALREADY_WATCHED = "urn:problem-type:thunder-bridge:payment-already-watched";
+    static readonly INVALID_REQUEST = "urn:problem-type:thunder-bridge:invalid-request";
+    static readonly CALLER_UNKNOWN = "urn:problem-type:thunder-bridge:caller-unknown";
+    static readonly VERIFY_HOST_REFUSED = "urn:problem-type:thunder-bridge:verify-host-refused";
+    static readonly VERIFY_UNCONFIRMED = "urn:problem-type:thunder-bridge:verify-unconfirmed";
+    static readonly VERIFY_UNCONSENTED = "urn:problem-type:thunder-bridge:verify-unconsented";
+    static readonly WEBHOOK_UNCONFIRMED = "urn:problem-type:thunder-bridge:webhook-unconfirmed";
+    static readonly TOO_MANY_PENDING = "urn:problem-type:thunder-bridge:too-many-pending";
+    /**
+     * Whether a problem carries this type. Branch on the type, never on the prose,
+     * and reach for `instanceof` first: every type this SDK gives a class to has one
+     */
+    static is(problem: {
+        type?: string;
+    }, type: string): boolean;
+    readonly type: string;
+    readonly title: string;
+    readonly status: number;
+    readonly detail: string | null;
+    constructor(problem: {
+        type?: string;
+        title?: string;
+        status?: number;
+        detail?: string;
+    });
+}
+/**
+ * Why an `Idempotency-Key` was refused, `request-in-flight` is the benign one and
+ * `key-reused` means the same key was sent for a different request
+ */
+type IdempotencyConflict = "request-in-flight" | "key-reused";
+/**
+ * Thrown when an `Idempotency-Key` is held by another request. On
+ * `request-in-flight` the first attempt is still resolving, so wait and read the
+ * payment back rather than retrying. `key-reused` is a bug in the caller: the key
+ * is bound to the addresses, amount and webhook that claimed it
+ */
+declare class IdempotencyConflictError extends ProblemError {
+    readonly conflict: IdempotencyConflict;
+    constructor(problem: {
+        type?: string;
+        title?: string;
+        status?: number;
+        detail?: string;
+    }, conflict: IdempotencyConflict);
+}
+/** Thrown when no wallet on your list could issue a provable invoice, `wallets` says why each refused */
+declare class NoWalletAvailableError extends ProblemError {
+    readonly wallets: WalletFailure[];
+    constructor(problem: {
+        title?: string;
+        status?: number;
+        detail?: string;
+    }, wallets: WalletFailure[]);
+}
+
+export { AmountError as A, type GatewayCheatCode as G, type IdempotencyConflict as I, NoWalletAvailableError as N, ProblemError as P, UnverifiedRecipientError as U, type WrapRefusalCode as W, type AmountFault as a, GatewayCheatError as b, IdempotencyConflictError as c, WrapRefusedError as d };