@forgesworn/moneyer 0.1.0-next.0

package/dist/backends/lnd.js

@@ -0,0 +1,191 @@
+import { hexToBytes } from '@noble/hashes/utils.js';
+import { verifyPreimage } from 'farrier-kit/preimage';
+import { PaymentAlreadyKnownError, PaymentFailedError, PaymentPendingError } from "./types.js";
+// lnd over its REST proxy. AddInvoice never returns a preimage but accepts
+// one (r_preimage), which is what lets it back a mint. Payment send/track
+// are chunked NDJSON streams read line by line to a terminal status.
+//
+// Not yet exercised against a live node - the semantics are a direct port
+// of the reference mint's lnd backend, which is.
+//
+// TLS: for lnd's self-signed cert, point NODE_EXTRA_CA_CERTS at it.
+const FAILURE_REASONS = {
+    FAILURE_REASON_NO_ROUTE: 'Could not find a route to pay this invoice.',
+    FAILURE_REASON_INCORRECT_PAYMENT_DETAILS: "The invoice's payment details were rejected.",
+    FAILURE_REASON_INSUFFICIENT_BALANCE: 'Insufficient balance to pay this invoice.',
+    FAILURE_REASON_TIMEOUT: 'Timed out trying to find a route to pay this invoice.'
+};
+const hexToBase64 = (hex) => Buffer.from(hexToBytes(hex)).toString('base64');
+const decodeHexOrBase64 = (value) => {
+    if (/^[0-9a-fA-F]{64}$/.test(value))
+        return value.toLowerCase();
+    return Buffer.from(value, 'base64').toString('hex');
+};
+export const createLndBackend = (config) => {
+    const headers = { 'Grpc-Metadata-macaroon': config.macaroon, 'content-type': 'application/json' };
+    const json = async (path, init = {}) => {
+        const res = await fetch(`${config.url}${path}`, {
+            method: init.method ?? 'GET',
+            headers,
+            ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+            signal: AbortSignal.timeout(init.timeoutMs ?? 15_000)
+        });
+        return { ok: res.ok, status: res.status, json: await res.json().catch(() => null) };
+    };
+    // Reads a chunked NDJSON stream until `until` returns a value. A non-2xx
+    // response's body rides back in `error` - grpc-gateway puts the actual
+    // refusal reason there, and payInvoice needs to read it.
+    const streamUntil = async (path, init, until) => {
+        const res = await fetch(`${config.url}${path}`, {
+            method: init.method ?? 'GET',
+            headers,
+            ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+            signal: AbortSignal.timeout(init.timeoutMs ?? 90_000)
+        });
+        if (!res.ok || !res.body) {
+            const error = await res.text().catch(() => '');
+            return { status: res.status, result: undefined, error };
+        }
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (value)
+                    buffer += decoder.decode(value, { stream: true });
+                const lines = buffer.split('\n');
+                buffer = lines.pop() ?? '';
+                for (const line of lines) {
+                    if (!line.trim())
+                        continue;
+                    let event;
+                    try {
+                        event = JSON.parse(line);
+                    }
+                    catch {
+                        continue;
+                    }
+                    const payment = event?.result ?? event;
+                    const result = until(payment);
+                    if (result !== undefined)
+                        return { status: res.status, result };
+                }
+                if (done)
+                    return { status: res.status, result: undefined };
+            }
+        }
+        finally {
+            reader.cancel().catch(() => { });
+        }
+    };
+    return {
+        name: 'lnd',
+        async createInvoice({ amountMsat, preimageHex, memo }) {
+            const res = await json('/v1/invoices', {
+                method: 'POST',
+                body: { value_msat: String(amountMsat), memo, r_preimage: hexToBase64(preimageHex) }
+            });
+            if (!res.ok || typeof res.json?.payment_request !== 'string') {
+                throw new Error(`lnd did not return a payment_request (${res.status}).`);
+            }
+            return { pr: res.json.payment_request };
+        },
+        async payInvoice({ pr, feeLimitMsat }) {
+            const { result, error } = await streamUntil('/v2/router/send', {
+                method: 'POST',
+                body: { payment_request: pr, timeout_seconds: 60, fee_limit_msat: String(feeLimitMsat) },
+                timeoutMs: 90_000
+            }, payment => (payment?.status === 'SUCCEEDED' || payment?.status === 'FAILED' ? payment : undefined));
+            if (!result) {
+                // lnd refuses a send whose payment hash it already holds - on a
+                // shared node that is somebody else's payment, and nothing went
+                // out for THIS call. Distinct from ambiguity: safely restorable.
+                if (error && /already exists|AlreadyExists|payment is in transition/i.test(error)) {
+                    throw new PaymentAlreadyKnownError('lnd already has a payment for this hash');
+                }
+                // The stream ended without a terminal status - genuinely ambiguous.
+                throw new Error('lnd did not report a terminal payment status.');
+            }
+            if (result.status !== 'SUCCEEDED') {
+                const reason = FAILURE_REASONS[result.failure_reason] ?? `Payment failed: ${result.failure_reason ?? 'unknown'}.`;
+                throw new PaymentFailedError(reason);
+            }
+            const preimageHex = result.payment_preimage ? decodeHexOrBase64(result.payment_preimage) : null;
+            if (!preimageHex)
+                throw new Error('lnd did not return a payment_preimage.');
+            const feeMsat = result.fee_msat !== undefined ? Number(result.fee_msat) : null;
+            return { preimageHex, feeMsat };
+        },
+        async isPaymentComplete(paymentHashHex) {
+            const { status, result } = await streamUntil(`/v2/router/track/${encodeURIComponent(hexToBase64(paymentHashHex))}?no_inflight_updates=true`, { timeoutMs: 15_000 }, payment => {
+                if (payment?.status === 'SUCCEEDED')
+                    return true;
+                if (payment?.status === 'FAILED')
+                    return false;
+                if (payment?.status) {
+                    // Anything non-terminal must not read as "confirmed not paid".
+                    throw new PaymentPendingError(`lnd reports payment status ${payment.status}`);
+                }
+                return undefined;
+            });
+            // A payment lnd never attempted is a 404 - safe to report incomplete,
+            // since no HTLC was ever sent for it.
+            if (status === 404)
+                return false;
+            if (result === undefined)
+                throw new Error('lnd did not report a payment status.');
+            return result;
+        },
+        async isInvoiceSettled(paymentHashHex) {
+            const res = await json(`/v1/invoice/${paymentHashHex}`);
+            return res.ok && Boolean(res.json?.settled);
+        },
+        async invoicePreimage(paymentHashHex) {
+            const res = await json(`/v1/invoice/${paymentHashHex}`);
+            if (!res.ok || !res.json?.settled || typeof res.json?.r_preimage !== 'string')
+                return null;
+            const preimageHex = decodeHexOrBase64(res.json.r_preimage);
+            return verifyPreimage(preimageHex, paymentHashHex) ? preimageHex : null;
+        },
+        async paymentPreimage(paymentHashHex) {
+            const { result } = await streamUntil(`/v2/router/track/${encodeURIComponent(hexToBase64(paymentHashHex))}?no_inflight_updates=true`, { timeoutMs: 15_000 }, payment => {
+                if (payment?.status === 'SUCCEEDED')
+                    return payment.payment_preimage ?? null;
+                if (payment?.status === 'FAILED')
+                    return null;
+                return undefined;
+            });
+            if (typeof result !== 'string')
+                return null;
+            const preimageHex = decodeHexOrBase64(result);
+            return verifyPreimage(preimageHex, paymentHashHex) ? preimageHex : null;
+        },
+        async nodeInfo() {
+            const res = await json('/v1/getinfo');
+            if (!res.ok)
+                return {};
+            const uris = res.json?.uris ?? [];
+            const color = typeof res.json?.color === 'string' ? `#${res.json.color.replace(/^#/, '')}` : undefined;
+            const numChannels = Number(res.json?.num_active_channels);
+            const numPeers = Number(res.json?.num_peers);
+            // Total public capacity, best-effort: the macaroon may not carry
+            // offchain:read, and the discovery endpoint works fine without it.
+            let capacityMsat;
+            const channels = await json('/v1/channels');
+            if (channels.ok && Array.isArray(channels.json?.channels)) {
+                capacityMsat = channels.json.channels.reduce((sum, channel) => sum + Number(channel.capacity ?? 0) * 1000, 0);
+            }
+            return {
+                ...(res.json?.alias ? { alias: res.json.alias } : {}),
+                ...(uris[0] || res.json?.identity_pubkey ? { uri: uris[0] ?? res.json.identity_pubkey } : {}),
+                ...(color && /^#[0-9a-fA-F]{6}$/.test(color) ? { color } : {}),
+                // !== undefined narrows for exactOptionalPropertyTypes; the isFinite
+                // half keeps a NaN from an unparseable channel capacity out.
+                ...(capacityMsat !== undefined && Number.isFinite(capacityMsat) ? { capacityMsat } : {}),
+                ...(Number.isSafeInteger(numChannels) ? { numChannels } : {}),
+                ...(Number.isSafeInteger(numPeers) ? { numPeers } : {})
+            };
+        }
+    };
+};

package/dist/backends/types.d.ts

@@ -0,0 +1,38 @@
+export type NodeInfo = {
+    alias?: string;
+    uri?: string;
+    color?: string;
+    capacityMsat?: number;
+    numChannels?: number;
+    numPeers?: number;
+};
+export type PaymentOutcome = {
+    preimageHex: string | null;
+    feeMsat: number | null;
+};
+export declare class PaymentFailedError extends Error {
+}
+export declare class PaymentPendingError extends Error {
+}
+export declare class PaymentAlreadyKnownError extends Error {
+}
+export interface LightningBackend {
+    readonly name: string;
+    createInvoice(args: {
+        amountMsat: number;
+        preimageHex: string;
+        memo: string;
+    }): Promise<{
+        pr: string;
+    }>;
+    payInvoice(args: {
+        pr: string;
+        feeLimitMsat: number;
+    }): Promise<PaymentOutcome>;
+    isPaymentComplete(paymentHashHex: string): Promise<boolean>;
+    isInvoiceSettled(paymentHashHex: string): Promise<boolean>;
+    invoicePreimage(paymentHashHex: string): Promise<string | null>;
+    paymentPreimage(paymentHashHex: string): Promise<string | null>;
+    nodeInfo?(): Promise<NodeInfo>;
+    close?(): void | Promise<void>;
+}

package/dist/backends/types.js

@@ -0,0 +1,25 @@
+// The funding source. Every amount is integer milli-satoshis.
+//
+// The one non-negotiable capability is createInvoice with a CALLER-SUPPLIED
+// preimage: a LUD-25 mint invoice's preimage IS the bearer note's spend
+// secret, so the mint must know it for certain before the invoice exists.
+// lnd (r_preimage) and cln (invoice preimage=) support this; phoenixd and
+// NIP-47 make_invoice do not, which is why neither can back a mint.
+// The funding source's immediate answer to the payment attempt was a clean,
+// terminal failure - no route, rejected, expired. Distinct from a dropped
+// connection or timeout, where the payment may still have gone out. Even
+// this "clean" failure is only trusted after isPaymentComplete confirms it:
+// a malicious payee holding a hodl invoice can make a backend report
+// failure while an HTLC it already sent stays locked.
+export class PaymentFailedError extends Error {
+}
+// The payment (or the query about it) has no terminal answer yet. Never to
+// be read as "not paid".
+export class PaymentPendingError extends Error {
+}
+// The funding source already holds a payment for this hash that THIS call
+// did not create - on a shared node, another mint (or the operator) paid
+// it. Nothing went out on our behalf, so the caller's melt is safely
+// restorable; confirming by hash would confirm against foreign money.
+export class PaymentAlreadyKnownError extends Error {
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { bytesToHex, randomBytes } from '@noble/hashes/utils.js';
+import { buildNoteUrl, hashK1 } from 'lnurlcash-kit';
+import { configFromEnv } from "./config.js";
+import { createMoneyer } from "./server.js";
+// moneyer - strike LNURLcash bearer notes.
+//
+//   moneyer            run against the configured MONEYER_* environment
+//   moneyer --dev      in-memory fake funding source, an ephemeral signing
+//                      key, and one funded 21-sat note printed for a wallet
+//                      to play with. Nothing here is payable.
+const { values } = parseArgs({
+    options: {
+        dev: { type: 'boolean', default: false },
+        help: { type: 'boolean', default: false }
+    }
+});
+if (values.help) {
+    console.log([
+        'moneyer - an LNURLcash (LUD-25) mint',
+        '',
+        'Usage: moneyer [--dev]',
+        '',
+        '  --dev   fake funding source, in-memory store, ephemeral signing key,',
+        '          and a funded 21 sat note printed at startup. Unpayable, for',
+        '          wallets to develop against.',
+        '',
+        'Configuration is MONEYER_* environment variables - see README.md.'
+    ].join('\n'));
+    process.exit(0);
+}
+const env = { ...process.env };
+if (values.dev) {
+    env.MONEYER_BACKEND = 'fake';
+    env.MONEYER_DB ??= ':memory:';
+    env.MONEYER_SIGNING_KEY ??= bytesToHex(randomBytes(32));
+}
+const config = configFromEnv(env);
+if (config.backend.kind === 'fake' && !values.dev) {
+    console.error('The fake funding source mints unpayable invoices - refusing to run it outside --dev.');
+    process.exit(1);
+}
+const log = (message) => console.error(`[moneyer] ${message}`);
+const moneyer = await createMoneyer(config, { log });
+console.log(`moneyer listening on ${moneyer.url}`);
+console.log(`  lightning address: ${config.username}@${new URL(config.publicOrigin ?? moneyer.url).host}`);
+if (moneyer.signer)
+    console.log(`  mint pubkey:       ${moneyer.signer.pubkey}`);
+console.log(`  funding source:    ${moneyer.backend.name}`);
+if (values.dev) {
+    const k1 = bytesToHex(randomBytes(32));
+    moneyer.store.creditNote(hashK1(k1), 21_000);
+    console.log(`  a 21 sat note:     ${buildNoteUrl(`${moneyer.url}/w`, k1, 21_000)}`);
+    console.log('\nnothing here is payable - the fake funding source invents its invoices');
+}
+const shutdown = () => {
+    moneyer.close().then(() => process.exit(0), () => process.exit(1));
+};
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);

package/dist/config.d.ts

@@ -0,0 +1,44 @@
+import type { MintFee } from 'lnurlcash-kit';
+export type BackendConfig = {
+    kind: 'fake';
+} | {
+    kind: 'cln';
+    url: string;
+    rune: string;
+} | {
+    kind: 'lnd';
+    url: string;
+    macaroon: string;
+};
+export type MoneyerConfig = {
+    host: string;
+    port: number;
+    publicOrigin?: string;
+    username: string;
+    description: string;
+    minSendableMsat: number;
+    maxSendableMsat: number;
+    minMintMsat: number;
+    mintFee: MintFee | null;
+    signingKey?: string;
+    dbPath: string;
+    backend: BackendConfig;
+    verify: boolean;
+    walletUrl?: string;
+    maxK1s: number;
+    sunset: boolean;
+};
+export declare const DEFAULTS: {
+    readonly host: "127.0.0.1";
+    readonly port: 3737;
+    readonly username: "mint";
+    readonly description: "an LNURLcash note";
+    readonly minSendableMsat: 1000;
+    readonly maxSendableMsat: 100000000;
+    readonly minMintMsat: 1000;
+    readonly dbPath: "moneyer.sqlite";
+    readonly verify: true;
+    readonly maxK1s: 21;
+    readonly sunset: false;
+};
+export declare const configFromEnv: (env?: NodeJS.ProcessEnv) => MoneyerConfig;

package/dist/config.js

@@ -0,0 +1,100 @@
+export const DEFAULTS = {
+    host: '127.0.0.1',
+    port: 3737,
+    username: 'mint',
+    description: 'an LNURLcash note',
+    minSendableMsat: 1000,
+    maxSendableMsat: 100_000_000,
+    minMintMsat: 1000,
+    dbPath: 'moneyer.sqlite',
+    verify: true,
+    maxK1s: 21,
+    sunset: false
+};
+const int = (value, fallback) => {
+    if (value === undefined || value === '')
+        return fallback;
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 0) {
+        throw new Error(`Expected a non-negative integer, got ${JSON.stringify(value)}.`);
+    }
+    return parsed;
+};
+const flag = (value, fallback) => {
+    if (value === undefined || value === '')
+        return fallback;
+    return value !== '0' && value.toLowerCase() !== 'false';
+};
+const HEX32 = /^[0-9a-f]{64}$/i;
+// Reads MONEYER_* from the environment. Throws rather than guessing: a mint
+// that starts with a half-understood configuration is holding other
+// people's money on a misunderstanding.
+export const configFromEnv = (env = process.env) => {
+    const baseFeeMsat = int(env.MONEYER_BASE_FEE_MSAT, 0);
+    const feePpm = int(env.MONEYER_FEE_PPM, 0);
+    if (feePpm >= 1_000_000) {
+        throw new Error('MONEYER_FEE_PPM must be below 1000000 - a 100% fee can never net a note.');
+    }
+    const signingKey = env.MONEYER_SIGNING_KEY;
+    if (signingKey !== undefined && !HEX32.test(signingKey)) {
+        throw new Error('MONEYER_SIGNING_KEY must be 32 bytes of hex.');
+    }
+    const kind = env.MONEYER_BACKEND ?? 'fake';
+    let backend;
+    if (kind === 'fake') {
+        backend = { kind: 'fake' };
+    }
+    else if (kind === 'cln') {
+        if (!env.MONEYER_BACKEND_URL || !env.MONEYER_BACKEND_RUNE) {
+            throw new Error('The cln backend needs MONEYER_BACKEND_URL and MONEYER_BACKEND_RUNE.');
+        }
+        backend = { kind: 'cln', url: env.MONEYER_BACKEND_URL, rune: env.MONEYER_BACKEND_RUNE };
+    }
+    else if (kind === 'lnd') {
+        if (!env.MONEYER_BACKEND_URL || !env.MONEYER_BACKEND_MACAROON) {
+            throw new Error('The lnd backend needs MONEYER_BACKEND_URL and MONEYER_BACKEND_MACAROON.');
+        }
+        backend = { kind: 'lnd', url: env.MONEYER_BACKEND_URL, macaroon: env.MONEYER_BACKEND_MACAROON };
+    }
+    else {
+        throw new Error(`Unknown MONEYER_BACKEND ${JSON.stringify(kind)} - fake, cln or lnd.`);
+    }
+    const minSendableMsat = int(env.MONEYER_MIN_SENDABLE_MSAT, DEFAULTS.minSendableMsat);
+    const maxSendableMsat = int(env.MONEYER_MAX_SENDABLE_MSAT, DEFAULTS.maxSendableMsat);
+    if (minSendableMsat > maxSendableMsat) {
+        throw new Error('MONEYER_MIN_SENDABLE_MSAT exceeds MONEYER_MAX_SENDABLE_MSAT.');
+    }
+    // Wallets are sent to this origin for every callback, so a malformed one
+    // must fail at startup, not as a 500 on the first request.
+    const publicOrigin = env.MONEYER_PUBLIC_ORIGIN;
+    if (publicOrigin) {
+        let protocol;
+        try {
+            protocol = new URL(publicOrigin).protocol;
+        }
+        catch {
+            throw new Error(`MONEYER_PUBLIC_ORIGIN is not a URL: ${JSON.stringify(publicOrigin)}.`);
+        }
+        if (protocol !== 'https:' && protocol !== 'http:') {
+            throw new Error(`MONEYER_PUBLIC_ORIGIN must be http or https, got ${JSON.stringify(publicOrigin)}.`);
+        }
+    }
+    return {
+        host: env.MONEYER_HOST ?? DEFAULTS.host,
+        port: int(env.MONEYER_PORT, DEFAULTS.port),
+        ...(publicOrigin ? { publicOrigin } : {}),
+        username: env.MONEYER_USERNAME ?? DEFAULTS.username,
+        description: env.MONEYER_DESCRIPTION ?? DEFAULTS.description,
+        minSendableMsat,
+        maxSendableMsat,
+        minMintMsat: int(env.MONEYER_MIN_MINT_MSAT, DEFAULTS.minMintMsat),
+        mintFee: baseFeeMsat === 0 && feePpm === 0 ? null : { baseFeeMsat, feePpm },
+        ...(signingKey ? { signingKey: signingKey.toLowerCase() } : {}),
+        dbPath: env.MONEYER_DB ?? DEFAULTS.dbPath,
+        backend,
+        verify: flag(env.MONEYER_VERIFY, DEFAULTS.verify),
+        ...(env.MONEYER_WALLET_URL ? { walletUrl: env.MONEYER_WALLET_URL.replace(/\/+$/, '') } : {}),
+        maxK1s: int(env.MONEYER_MAX_K1S, DEFAULTS.maxK1s),
+        sunset: flag(env.MONEYER_SUNSET, DEFAULTS.sunset)
+    };
+};

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { configFromEnv, DEFAULTS, type MoneyerConfig, type BackendConfig } from './config.ts';
+export { createMoneyer, type Moneyer, type MoneyerDeps } from './server.ts';
+export { NoteStore, NotePendingError, NoteUnavailableError, OutputCollisionError, type NoteRow, type NoteState, type MeltRow, type MintInvoiceRow } from './store.ts';
+export { createNoteSigner, noteIdSignatureDigest, type NoteSigner } from './signing.ts';
+export { PaymentAlreadyKnownError, PaymentFailedError, PaymentPendingError, type LightningBackend, type NodeInfo, type PaymentOutcome } from './backends/types.ts';
+export { createFakeBackend, type FakeBackend, type FakePayMode } from './backends/fake.ts';
+export { createClnBackend } from './backends/cln.ts';
+export { createLndBackend } from './backends/lnd.ts';
+export { fakeBolt11 } from './backends/fake-bolt11.ts';
+export { runMelt, reconcilePendingMelts, type MeltJob, type MeltDeps } from './melt.ts';

package/dist/index.js

@@ -0,0 +1,23 @@
+// moneyer - an LNURLcash (LUD-25) mint.
+//
+// A bearer note is an ordinary LUD-03 withdrawRequest link whose k1 IS the
+// asset. This SERVICE mints them against a paid invoice whose preimage
+// becomes the note's spend secret, honours rotate/split/merge/melt on the
+// withdraw callback, signs every note it mints for offline verification,
+// and holds the melt discipline: burn only on confirmed payment, restore
+// only on confirmed non-payment, park everything else as pending.
+//
+// Independent implementation. Reference stack (dni, MIT):
+//   spec    https://github.com/lnurl/luds/pull/301
+//   mint    https://github.com/dni/lnurl-mint
+//   wallet  https://github.com/dni/lnurl-wallet
+export { configFromEnv, DEFAULTS } from "./config.js";
+export { createMoneyer } from "./server.js";
+export { NoteStore, NotePendingError, NoteUnavailableError, OutputCollisionError } from "./store.js";
+export { createNoteSigner, noteIdSignatureDigest } from "./signing.js";
+export { PaymentAlreadyKnownError, PaymentFailedError, PaymentPendingError } from "./backends/types.js";
+export { createFakeBackend } from "./backends/fake.js";
+export { createClnBackend } from "./backends/cln.js";
+export { createLndBackend } from "./backends/lnd.js";
+export { fakeBolt11 } from "./backends/fake-bolt11.js";
+export { runMelt, reconcilePendingMelts } from "./melt.js";

package/dist/landing.d.ts

@@ -0,0 +1,8 @@
+import type { MoneyerConfig } from './config.ts';
+import type { NodeInfo } from './backends/types.ts';
+export declare const landingPage: (args: {
+    config: MoneyerConfig;
+    host: string;
+    mintPubkey: string | null;
+    nodeInfo: NodeInfo;
+}) => string;

package/dist/landing.js

@@ -0,0 +1,63 @@
+import { applyMintFee } from 'lnurlcash-kit';
+// The mint's face: one self-contained page at GET /, no build step, no
+// external assets. It states what a visitor needs before trusting a mint
+// with sats: who it is, what it charges, the key its notes verify
+// against, and how to pay it. Anything fancier belongs to the product
+// site, not the money service.
+const escapeHtml = (value) => value.replace(/[&<>"']/g, char => `&#${char.charCodeAt(0)};`);
+export const landingPage = (args) => {
+    const { config, host, mintPubkey, nodeInfo } = args;
+    const address = `${config.username}@${host}`;
+    const fee = config.mintFee;
+    const feeLine = fee
+        ? `${fee.baseFeeMsat > 0 ? `${fee.baseFeeMsat} msat flat` : ''}${fee.baseFeeMsat > 0 && fee.feePpm > 0 ? ' + ' : ''}${fee.feePpm > 0 ? `${fee.feePpm / 10_000}%` : ''}`
+        : 'none';
+    const maxNet = fee ? applyMintFee(config.maxSendableMsat, fee) : config.maxSendableMsat;
+    const sats = (msat) => `${(msat / 1000).toLocaleString('en-GB')} sat`;
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>${escapeHtml(host)} - an LNURLcash mint</title>
+<meta name="description" content="A moneyer strikes Lightning bearer notes. Pay ${escapeHtml(address)} and the invoice's preimage becomes your note."/>
+<style>
+:root{--bg:#0e0f12;--raise:#16181d;--line:rgba(226,233,242,.09);--ink:#eef1f6;--dim:#98a0ac;--accent:#c9ced8;--accent-deep:#8f97a4}
+@media(prefers-color-scheme:light){:root{--bg:#f3f4f6;--raise:#fff;--line:rgba(30,38,50,.12);--ink:#1c2027;--dim:#6b7380;--accent:#6f7784;--accent-deep:#4d545f}}
+*{box-sizing:border-box;margin:0}
+body{background:var(--bg);color:var(--ink);font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;-webkit-font-smoothing:antialiased;min-height:100vh;display:grid;place-items:center;padding:28px;
+background-image:radial-gradient(900px 420px at 50% -160px,rgba(201,206,216,.13),transparent 70%)}
+main{max-width:560px;width:100%;display:flex;flex-direction:column;gap:18px;animation:rise .6s cubic-bezier(.2,.7,.2,1) both}
+@keyframes rise{from{opacity:0;transform:translateY(16px)}}
+.mark{width:64px;height:64px;color:var(--accent);animation:glow 3.2s ease-in-out infinite}
+@keyframes glow{50%{filter:drop-shadow(0 0 14px rgba(201,206,216,.5))}}
+h1{font-size:clamp(30px,7vw,40px);letter-spacing:-.5px}
+h1 small{display:block;font-size:16px;color:var(--dim);font-weight:500;margin-top:8px;line-height:1.5}
+.addr{display:flex;align-items:center;gap:12px;background:linear-gradient(135deg,var(--accent),var(--accent-deep));color:#14161b;border-radius:20px;padding:20px 22px;font-weight:750;font-size:clamp(17px,4.6vw,22px);word-break:break-all;box-shadow:0 14px 38px -14px rgba(160,170,185,.5)}
+.addr svg{width:26px;height:26px;flex:none}
+.card{background:var(--raise);border:1px solid var(--line);border-radius:20px;padding:20px 22px;display:flex;flex-direction:column;gap:12px}
+.kv{display:flex;justify-content:space-between;gap:16px;font-size:15px}
+.kv span{color:var(--dim)}
+.kv code{font-family:ui-monospace,Menlo,monospace;font-size:12.5px;word-break:break-all;text-align:right}
+p.small{color:var(--dim);font-size:13.5px;line-height:1.65;text-align:center}
+a{color:var(--accent)}
+</style>
+</head>
+<body>
+<main>
+<svg class="mark" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="9"/><path d="M12 7.6v8.8"/><path d="M15.4 9.4c-.7-1.1-1.9-1.8-3.4-1.8-2 0-3.6 1.1-3.6 2.7 0 3.4 7.2 1.8 7.2 5 0 1.6-1.6 2.7-3.6 2.7-1.5 0-2.7-.7-3.4-1.8"/></svg>
+<h1>${escapeHtml(nodeInfo.alias ?? 'moneyer')}<small>An LNURLcash mint. Pay the address below and the invoice's payment preimage <em>is</em> your bearer note - money as a secret you hold.</small></h1>
+<div class="addr"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M13 2 4.5 13.5H11L9.5 22 18 10.5h-6.5L13 2z"/></svg>${escapeHtml(address)}</div>
+<div class="card">
+<div class="kv"><span>mints</span><b>${sats(config.minSendableMsat)} to ${sats(config.maxSendableMsat)}</b></div>
+<div class="kv"><span>mint fee</span><b>${escapeHtml(feeLine)}</b></div>
+<div class="kv"><span>largest note</span><b>${sats(maxNet)}</b></div>
+${mintPubkey ? `<div class="kv"><span>notes signed by</span><code>${escapeHtml(mintPubkey)}</code></div>` : '<div class="kv"><span>note signatures</span><b>not offered</b></div>'}
+${nodeInfo.uri ? `<div class="kv"><span>node</span><code>${escapeHtml(nodeInfo.uri)}</code></div>` : ''}
+${config.sunset ? '<div class="kv"><span>status</span><b>sunsetting - redeem only</b></div>' : ''}
+</div>
+<p class="small">Works with any LUD-25 wallet - <a href="https://github.com/forgesworn/notecase">notecase</a> among them. Verify a note offline against the signing key above.<br/>Independent implementation of the <a href="https://github.com/lnurl/luds/pull/301">LNURLcash draft</a> - graded by <a href="https://github.com/TheCryptoDonkey/lnurlcash-conformance">lnurlcash-conformance</a>.</p>
+</main>
+</body>
+</html>`;
+};

package/dist/melt.d.ts

@@ -0,0 +1,17 @@
+import { type LightningBackend } from './backends/types.ts';
+import type { NoteStore } from './store.ts';
+export type MeltJob = {
+    paymentHash: string;
+    noteId: string;
+    pr: string;
+    amountMsat: number;
+};
+export type MeltDeps = {
+    store: NoteStore;
+    backend: LightningBackend;
+    feeLimitMsat: (amountMsat: number) => number;
+    confirmDelaysMs?: number[];
+    log?: (message: string) => void;
+};
+export declare const runMelt: (job: MeltJob, deps: MeltDeps) => Promise<void>;
+export declare const reconcilePendingMelts: (store: NoteStore, backend: LightningBackend, inFlight: ReadonlySet<string>, log?: (message: string) => void) => Promise<void>;