feat: add DISABLE_LN_ADDRESS kill-switch for Lightning Address payouts

[grunch]

Summary

Adds a temporary, reversible kill-switch to disable Lightning Address payouts as a security mitigation. When DISABLE_LN_ADDRESS=true, buyers are routed to the manual BOLT11 invoice flow instead of having their saved Lightning Address auto-resolved and paid.

Motivation

Provides operators a way to quickly shut off the Lightning Address payout path (e.g. in response to a security concern) without code changes or losing user data.

Changes

• bot/commands.ts — guards the auto-resolution path in addInvoice; when disabled, notifies the buyer and falls back to the manual invoice wizard.
• bot/scenes.ts — guards both addInvoiceWizard and addInvoicePHIWizard so a pasted Lightning Address is rejected with a notice while BOLT11 invoices keep working.
• .env-sample — documents the new DISABLE_LN_ADDRESS flag.
• locales/en.yaml, locales/es.yaml — adds the ln_address_temporarily_disabled user-facing notice.

Safety / behavior

• Complete coverage: all three resolvLightningAddress call sites are guarded by the flag.
• BOLT11 unaffected: validateLightningAddress only matches the name@domain pattern (+ DNS check), so regular invoices flow through normally — users can still receive sats.
• Reversible: saved Lightning Addresses are kept and merely ignored; unsetting the flag restores prior behavior with no migration.
• Safe default: unset/empty keeps Lightning Address enabled — no behavior change unless explicitly activated. The check is a strict === 'true' match.

Notes

• Locale strings were added for en and es; other languages fall back to the default locale. Happy to add the remaining locales if desired.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added a configuration option to temporarily disable Lightning Address payouts, requiring users to provide a standard BOLT11 invoice instead.

• Documentation

  • Added English and Spanish translations for the Lightning Address disabled message.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 4a75fc4d-e4f4-414a-838d-f7a1ea50e48d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

This PR implements a temporary kill-switch for Lightning Address payouts via the DISABLE_LN_ADDRESS environment variable. When enabled, the bot rejects Lightning Address inputs across invoice flows and prompts users to submit BOLT11 invoices instead, with localized messaging in English and Spanish.

Changes

Lightning Address Kill-Switch Feature

Layer / File(s)	Summary
Feature flag definition and user messaging .env-sample, locales/en.yaml, locales/es.yaml	Environment variable DISABLE_LN_ADDRESS with descriptive comments and corresponding i18n key ln_address_temporarily_disabled providing localized maintenance notices in English and Spanish.
Invoice command-level mitigation bot/commands.ts	addInvoice checks the DISABLE_LN_ADDRESS flag; when enabled and the buyer has a Lightning Address on file, a maintenance notification is sent and the flow routes to the manual invoice wizard instead of auto-resolving.
Wizard flow-level mitigation bot/scenes.ts	Both addInvoiceWizard and addInvoicePHIWizard validate the flag after parsing input; when Lightning Address is detected and the flag is enabled, the wizard replies with the maintenance message and exits early, while non-Lightning-Address inputs proceed normally.

---

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

---

Poem

🐰 A switch flips soft, a gentle pause,
Lightning pauses for a cause,
Invoices flow through BOLT11's door,
While bots catch users with messages galore,
Maintenance magic, temporary and true! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding a DISABLE_LN_ADDRESS kill-switch to control Lightning Address payouts. It is concise, clear, and directly reflects the primary objective of the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/disable-ln-address-killswitch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}