thunder-bridge 1.5.0 → 2.2.0

package/dist/bank.cjs

@@ -20,10 +20,205 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/entry/bank.ts
 var bank_exports = {};
 __export(bank_exports, {
+  bankAgent: () => bankAgent,
   fioStatement: () => fioStatement
 });
 module.exports = __toCommonJS(bank_exports);
 
+// ../core/bytes.ts
+function bytesToHex(bytes) {
+  let hex = "";
+  for (const byte of bytes) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function hexToBytes(hex) {
+  const bytes = new Uint8Array(hex.length >> 1);
+  for (let at = 0; at < bytes.length; at++) {
+    bytes[at] = parseInt(hex.slice(at * 2, at * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+// ../core/ed25519.ts
+var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
+var SMALL_ORDER = [
+  "00".repeat(32),
+  `01${"00".repeat(31)}`,
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+  `ec${"ff".repeat(30)}7f`,
+  `ed${"ff".repeat(30)}7f`,
+  `ee${"ff".repeat(30)}7f`
+];
+
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
+}
+function asBuffer(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
+// ../core/sha256.ts
+var ROUND_CONSTANTS = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var INITIAL_STATE = new Uint32Array([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// ../core/sealed.ts
+var MIN_SECRET_CHARS = 32;
+function refuseAWeakSecret(secret) {
+  if (secret.length < MIN_SECRET_CHARS) {
+    throw new Error(`the sealing secret needs ${MIN_SECRET_CHARS} characters of randomness`);
+  }
+}
+
+// src/bank.ts
+var DEFAULT_CURRENCY = "CZK";
+var DEFAULT_LOOK_BACK_SECS = 7 * 24 * 60 * 60;
+function bankAgent(config) {
+  refuseAWeakSecret(config.secret);
+  return config.gateway.attend({
+    onError: config.onError,
+    answer: async (paymentHash) => {
+      const order = await config.orders(paymentHash);
+      if (order === null) {
+        return null;
+      }
+      const currency = order.currency ?? DEFAULT_CURRENCY;
+      return await creditedPreimage({
+        secret: config.secret,
+        asked: {
+          iban: accountOf(order.iban),
+          reference: order.reference,
+          amountMinor: order.amountMinor,
+          currency,
+          expiresAt: order.expiresAt
+        },
+        statement: order.statement,
+        lookBackSecs: config.lookBackSecs
+      });
+    }
+  });
+}
+async function creditedPreimage(params) {
+  const since = unixNow() - (params.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
+  const landed = (await params.statement(since)).some((credit) => pays(credit, params.asked));
+  if (!landed) {
+    return null;
+  }
+  return await hmacHex(params.secret, `preimage|${subjectOf(params.asked)}`);
+}
+function pays(credit, asked) {
+  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && namesOnly(credit.reference, asked.reference);
+}
+function namesOnly(written, reference) {
+  const wanted = reference.toUpperCase();
+  const alike = [...written.toUpperCase().matchAll(wordsShapedLike(wanted))].map(([word]) => word);
+  return alike.includes(wanted) && (!/\d/.test(wanted) || alike.every((word) => word === wanted));
+}
+function wordsShapedLike(reference) {
+  const shape = [...reference].map((char) => {
+    if (/\d/.test(char)) {
+      return "\\d";
+    }
+    return /\p{L}/u.test(char) ? "\\p{L}" : char.replace(/[\^$\\.*+?()[\]{}|/]/g, "\\$&");
+  }).join("");
+  return new RegExp(`(?<![\\p{L}\\p{N}])${shape}(?![\\p{L}\\p{N}])`, "gu");
+}
+function subjectOf({ iban, amountMinor, currency, expiresAt, reference }) {
+  return `${iban}|${amountMinor}|${currency.toUpperCase()}|${expiresAt}|${reference}`;
+}
+function accountOf(iban) {
+  return iban.replace(/\s+/g, "").toUpperCase();
+}
+function unixNow() {
+  return Math.floor(Date.now() / 1e3);
+}
+
 // src/fio.ts
 var BASE_URL = "https://fioapi.fio.cz/v1/rest";
 var MINOR_UNITS = 100;
@@ -137,5 +332,6 @@ function asDate(unix) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  bankAgent,
   fioStatement
 });

package/dist/bank.d.cts

@@ -1,5 +1,7 @@
-import { S as Statement } from './bank-B3mHISn1.cjs';
-export { B as BankTransfer, a as BankTransferParams, b as BankVerifyConfig, C as Credit } from './bank-B3mHISn1.cjs';
+import { S as Statement } from './bank-Bg6RjuO-.cjs';
+export { B as BankAgentConfig, a as BankOrder, b as BankTransfer, c as BankTransferParams, d as BankVerifyConfig, C as Credit, e as bankAgent } from './bank-Bg6RjuO-.cjs';
+import './qr-CF-YeXU1.cjs';
+import './types-DYZ9EkmJ.cjs';
 
 /** A Fio account to read credits from, as its own API describes one */
 interface FioConfig {

package/dist/bank.d.ts

@@ -1,5 +1,7 @@
-import { S as Statement } from './bank-B3mHISn1.js';
-export { B as BankTransfer, a as BankTransferParams, b as BankVerifyConfig, C as Credit } from './bank-B3mHISn1.js';
+import { S as Statement } from './bank-B5MxT_6u.js';
+export { B as BankAgentConfig, a as BankOrder, b as BankTransfer, c as BankTransferParams, d as BankVerifyConfig, C as Credit, e as bankAgent } from './bank-B5MxT_6u.js';
+import './qr-CF-YeXU1.js';
+import './types-DYZ9EkmJ.js';
 
 /** A Fio account to read credits from, as its own API describes one */
 interface FioConfig {

package/dist/bank.js

@@ -1,3 +1,197 @@
+// ../core/bytes.ts
+function bytesToHex(bytes) {
+  let hex = "";
+  for (const byte of bytes) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function hexToBytes(hex) {
+  const bytes = new Uint8Array(hex.length >> 1);
+  for (let at = 0; at < bytes.length; at++) {
+    bytes[at] = parseInt(hex.slice(at * 2, at * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+// ../core/ed25519.ts
+var PKCS8_HEADER = hexToBytes("302e020100300506032b657004220420");
+var SMALL_ORDER = [
+  "00".repeat(32),
+  `01${"00".repeat(31)}`,
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+  `ec${"ff".repeat(30)}7f`,
+  `ed${"ff".repeat(30)}7f`,
+  `ee${"ff".repeat(30)}7f`
+];
+
+// ../core/hmac.ts
+async function hmacHex(secret, payload) {
+  const raw = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    asBuffer(raw),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const message = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, asBuffer(message))));
+}
+function asBuffer(bytes) {
+  return bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer ? bytes : new Uint8Array(bytes);
+}
+
+// ../core/sha256.ts
+var ROUND_CONSTANTS = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var INITIAL_STATE = new Uint32Array([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// ../core/sealed.ts
+var MIN_SECRET_CHARS = 32;
+function refuseAWeakSecret(secret) {
+  if (secret.length < MIN_SECRET_CHARS) {
+    throw new Error(`the sealing secret needs ${MIN_SECRET_CHARS} characters of randomness`);
+  }
+}
+
+// src/bank.ts
+var DEFAULT_CURRENCY = "CZK";
+var DEFAULT_LOOK_BACK_SECS = 7 * 24 * 60 * 60;
+function bankAgent(config) {
+  refuseAWeakSecret(config.secret);
+  return config.gateway.attend({
+    onError: config.onError,
+    answer: async (paymentHash) => {
+      const order = await config.orders(paymentHash);
+      if (order === null) {
+        return null;
+      }
+      const currency = order.currency ?? DEFAULT_CURRENCY;
+      return await creditedPreimage({
+        secret: config.secret,
+        asked: {
+          iban: accountOf(order.iban),
+          reference: order.reference,
+          amountMinor: order.amountMinor,
+          currency,
+          expiresAt: order.expiresAt
+        },
+        statement: order.statement,
+        lookBackSecs: config.lookBackSecs
+      });
+    }
+  });
+}
+async function creditedPreimage(params) {
+  const since = unixNow() - (params.lookBackSecs ?? DEFAULT_LOOK_BACK_SECS);
+  const landed = (await params.statement(since)).some((credit) => pays(credit, params.asked));
+  if (!landed) {
+    return null;
+  }
+  return await hmacHex(params.secret, `preimage|${subjectOf(params.asked)}`);
+}
+function pays(credit, asked) {
+  return credit.amountMinor === asked.amountMinor && credit.currency.toUpperCase() === asked.currency.toUpperCase() && namesOnly(credit.reference, asked.reference);
+}
+function namesOnly(written, reference) {
+  const wanted = reference.toUpperCase();
+  const alike = [...written.toUpperCase().matchAll(wordsShapedLike(wanted))].map(([word]) => word);
+  return alike.includes(wanted) && (!/\d/.test(wanted) || alike.every((word) => word === wanted));
+}
+function wordsShapedLike(reference) {
+  const shape = [...reference].map((char) => {
+    if (/\d/.test(char)) {
+      return "\\d";
+    }
+    return /\p{L}/u.test(char) ? "\\p{L}" : char.replace(/[\^$\\.*+?()[\]{}|/]/g, "\\$&");
+  }).join("");
+  return new RegExp(`(?<![\\p{L}\\p{N}])${shape}(?![\\p{L}\\p{N}])`, "gu");
+}
+function subjectOf({ iban, amountMinor, currency, expiresAt, reference }) {
+  return `${iban}|${amountMinor}|${currency.toUpperCase()}|${expiresAt}|${reference}`;
+}
+function accountOf(iban) {
+  return iban.replace(/\s+/g, "").toUpperCase();
+}
+function unixNow() {
+  return Math.floor(Date.now() / 1e3);
+}
+
 // src/fio.ts
 var BASE_URL = "https://fioapi.fio.cz/v1/rest";
 var MINOR_UNITS = 100;
@@ -110,5 +304,6 @@ function asDate(unix) {
   return new Date(unix * MILLIS).toISOString().slice(0, DATE_CHARS);
 }
 export {
+  bankAgent,
   fioStatement
 };

package/dist/{errors-Dmh-Uoh8.d.cts → errors-DJmsalYZ.d.cts}

@@ -1,4 +1,4 @@
-import { W as WalletFailure } from './types-BNPmVnA7.cjs';
+import { W as WalletFailure } from './types-DYZ9EkmJ.cjs';
 
 /**
  * Why an amount was refused. A code rather than a message, because a caller can
@@ -26,7 +26,7 @@ declare class AmountError extends Error {
  * The way a gateway was caught out, every code is a check that held against the
  * recipient's own server and failed against what the gateway returned
  */
-type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine";
+type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine" | "invoice_settled" | "invoice_stale" | "invoice_reused";
 /**
  * Thrown when the gateway demonstrably misbehaved, the invoice it returned is
  * not the one the address you asked for issued, or a settlement it reported
@@ -123,4 +123,4 @@ declare class NoWalletAvailableError extends ProblemError {
     }, wallets: WalletFailure[]);
 }
 
-export { AmountError as A, type GatewayCheatCode as G, type IdempotencyConflict as I, NoWalletAvailableError as N, ProblemError as P, UnverifiedRecipientError as U, type WrapRefusalCode as W, type AmountFault as a, GatewayCheatError as b, IdempotencyConflictError as c, WrapRefusedError as d };
+export { AmountError as A, GatewayCheatError as G, type IdempotencyConflict as I, NoWalletAvailableError as N, ProblemError as P, UnverifiedRecipientError as U, type WrapRefusalCode as W, type AmountFault as a, type GatewayCheatCode as b, IdempotencyConflictError as c, WrapRefusedError as d };

package/dist/{errors-0vbVoISA.d.ts → errors-VX0R18oE.d.ts}

@@ -1,4 +1,4 @@
-import { W as WalletFailure } from './types-BNPmVnA7.js';
+import { W as WalletFailure } from './types-DYZ9EkmJ.js';
 
 /**
  * Why an amount was refused. A code rather than a message, because a caller can
@@ -26,7 +26,7 @@ declare class AmountError extends Error {
  * The way a gateway was caught out, every code is a check that held against the
  * recipient's own server and failed against what the gateway returned
  */
-type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine";
+type GatewayCheatCode = "address_not_requested" | "hash_mismatch" | "amount_mismatch" | "description_hash_mismatch" | "verify_url_foreign" | "invoice_not_issued" | "preimage_mismatch" | "id_not_mine" | "invoice_settled" | "invoice_stale" | "invoice_reused";
 /**
  * Thrown when the gateway demonstrably misbehaved, the invoice it returned is
  * not the one the address you asked for issued, or a settlement it reported
@@ -123,4 +123,4 @@ declare class NoWalletAvailableError extends ProblemError {
     }, wallets: WalletFailure[]);
 }
 
-export { AmountError as A, type GatewayCheatCode as G, type IdempotencyConflict as I, NoWalletAvailableError as N, ProblemError as P, UnverifiedRecipientError as U, type WrapRefusalCode as W, type AmountFault as a, GatewayCheatError as b, IdempotencyConflictError as c, WrapRefusedError as d };
+export { AmountError as A, GatewayCheatError as G, type IdempotencyConflict as I, NoWalletAvailableError as N, ProblemError as P, UnverifiedRecipientError as U, type WrapRefusalCode as W, type AmountFault as a, type GatewayCheatCode as b, IdempotencyConflictError as c, WrapRefusedError as d };