thunder-bridge 1.5.0 → 2.1.1

package/dist/bank.js

@@ -1,3 +1,198 @@
+// ../core/bytes.ts
+function bytesToHex(bytes) {
+  let hex = "";
+  for (const byte of bytes) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function hexToBytes(hex) {
+  const bytes = new Uint8Array(hex.length >> 1);
+  for (let at = 0; at < bytes.length; at++) {
+    bytes[at] = parseInt(hex.slice(at * 2, at * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+// ../core/ed25519.ts
+var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
+var SMALL_ORDER = [
+  "00".repeat(32),
+  `01${"00".repeat(31)}`,
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+  `ec${"ff".repeat(30)}7f`,
+  `ed${"ff".repeat(30)}7f`,
+  `ee${"ff".repeat(30)}7f`
+];
+
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
+}
+function asBuffer(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
+// ../core/sha256.ts
+var ROUND_CONSTANTS = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var INITIAL_STATE = new Uint32Array([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// ../core/sealed.ts
+var MIN_SECRET_CHARS = 32;
+var INFO = new TextEncoder().encode("thunder-bridge/sealed");
+function refuseAWeakSecret(secret) {
+  if (secret.length < MIN_SECRET_CHARS) {
+    throw new Error(`the sealing secret needs ${MIN_SECRET_CHARS} characters of randomness`);
+  }
+}
+
+// src/bank.ts
+var DEFAULT_CURRENCY = "CZK";
+var DEFAULT_LOOK_BACK_SECS = 7 * 24 * 60 * 60;
+function bankAgent(config) {
+  refuseAWeakSecret(config.secret);
+  return config.gateway.attend({
+    onError: config.onError,
+    answer: async (paymentHash) => {
+      const order = await config.orders(paymentHash);
+      if (order === null) {
+        return null;
+      }
+      const currency = order.currency ?? DEFAULT_CURRENCY;
+      return await creditedPreimage({
+        secret: config.secret,
+        asked: {
+          iban: accountOf(order.iban),
+          reference: order.reference,
+          amountMinor: order.amountMinor,
+          currency,
+          expiresAt: order.expiresAt
+        },
+        statement: order.statement,
+        lookBackSecs: config.lookBackSecs
+      });
+    }
+  });
+}
+async function creditedPreimage(params) {
+  const since = unixNow() - (params.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
+  const landed = (await params.statement(since)).some((credit) => pays(credit, params.asked));
+  if (!landed) {
+    return null;
+  }
+  return await hmacHex(params.secret, `preimage|${subjectOf(params.asked)}`);
+}
+function pays(credit, asked) {
+  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && namesOnly(credit.reference, asked.reference);
+}
+function namesOnly(written, reference) {
+  const wanted = reference.toUpperCase();
+  const alike = [...written.toUpperCase().matchAll(wordsShapedLike(wanted))].map(([word]) => word);
+  return alike.includes(wanted) && (!/\d/.test(wanted) || alike.every((word) => word === wanted));
+}
+function wordsShapedLike(reference) {
+  const shape = [...reference].map((char) => {
+    if (/\d/.test(char)) {
+      return "\\d";
+    }
+    return /\p{L}/u.test(char) ? "\\p{L}" : char.replace(/[\^$\\.*+?()[\]{}|/]/g, "\\$&");
+  }).join("");
+  return new RegExp(`(?<![\\p{L}\\p{N}])${shape}(?![\\p{L}\\p{N}])`, "gu");
+}
+function subjectOf({ iban, amountMinor, currency, expiresAt, reference }) {
+  return `${iban}|${amountMinor}|${currency.toUpperCase()}|${expiresAt}|${reference}`;
+}
+function accountOf(iban) {
+  return iban.replace(/\s+/g, "").toUpperCase();
+}
+function unixNow() {
+  return Math.floor(Date.now() / 1e3);
+}
+
 // src/fio.ts
 var BASE_URL = "https://fioapi.fio.cz/v1/rest";
 var MINOR_UNITS = 100;
@@ -110,5 +305,6 @@ function asDate(unix) {
   return new Date(unix * MILLIS).toISOString().slice(0, DATE_CHARS);
 }
 export {
+  bankAgent,
   fioStatement
 };

package/dist/{errors-Dmh-Uoh8.d.cts → errors-DriqW-lp.d.cts}

@@ -1,4 +1,4 @@
-import { W as WalletFailure } from './types-BNPmVnA7.cjs';
+import { W as WalletFailure } from './types-DYZ9EkmJ.cjs';
 
 /**
  * Why an amount was refused. A code rather than a message, because a caller can
@@ -26,7 +26,7 @@ declare class AmountError extends Error {
  * The way a gateway was caught out, every code is a check that held against the
  * recipient's own server and failed against what the gateway returned
  */
-type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine";
+type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine" | "invoice_settled" | "invoice_stale" | "invoice_reused";
 /**
  * Thrown when the gateway demonstrably misbehaved, the invoice it returned is
  * not the one the address you asked for issued, or a settlement it reported

package/dist/{errors-0vbVoISA.d.ts → errors-ZEUT-MhO.d.ts}

@@ -1,4 +1,4 @@
-import { W as WalletFailure } from './types-BNPmVnA7.js';
+import { W as WalletFailure } from './types-DYZ9EkmJ.js';
 
 /**
  * Why an amount was refused. A code rather than a message, because a caller can
@@ -26,7 +26,7 @@ declare class AmountError extends Error {
  * The way a gateway was caught out, every code is a check that held against the
  * recipient's own server and failed against what the gateway returned
  */
-type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine";
+type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine" | "invoice_settled" | "invoice_stale" | "invoice_reused";
 /**
  * Thrown when the gateway demonstrably misbehaved, the invoice it returned is
  * not the one the address you asked for issued, or a settlement it reported