@forgesworn/moneyer 0.17.1 → 0.18.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.18.1 - 2026-10-07
+
+- **Bound mint receipts verify in current wallets again.** Since
+  `@lnurlcash/kit` moved to taproot notes, a wallet checks a settled
+  `/verify` receipt's `mint.sig` as a `cs1` over the note's Q. moneyer still
+  sent a bare hex signature over the bearer `h`, which the kit drops as
+  unreadable, so a sealed signer could not confirm a note minted here. The
+  receipt now carries the note's ordinary certificate, and a quote or
+  receipt for a note named by its `cp1` repeats that `cp1` rather than the
+  hex of its Q, which a wallet would read as a bearer `h`.
+- `@lnurlcash/kit` 0.20.2. `moneyer admin verify-note` checks a certificate
+  over the note's Q, or over `sha256(k1)` for a bearer note certified before
+  that, and still reads a pre-`cs1` signature from a note URL's `sig`. The
+  mint page and the live bound-mint check name a quote by its bare `h`.
+
+## 0.18.0 - 2026-10-07
+
+- **A melt that cannot leave is answered with its reason.** The callback
+  used to reply `OK` the moment the note was reserved, so a melt with no
+  route looked like success until the wallet checked again. It now waits up
+  to two seconds for the payment: if the funding source confirms nothing
+  went out, the note is restored first and the answer is `ERROR` with the
+  reason (for lnd, "Could not find a route to pay this invoice."). A
+  payment still in flight, or one that settles, is `OK` as before. The
+  hodl-invoice rule stands: a failure report is acted on only once the
+  funding source confirms it. The invoice itself is still refused if tried
+  again, as it was after a background restore.
+
 ## 0.17.1 - 2026-10-06
 
 - **The expiry sweep no longer deletes paid mint invoices.** A mint invoice

package/README.md

@@ -37,10 +37,13 @@ lesson, that behaviour is kept deliberately and tested.
   from the start.
 - Signs every note it mints with its own mint key (secp256k1, the standard
   `Lightning Signed Message` construction) for LUD-25 offline verification.
-- The melt discipline: reply OK when the note is reserved, pay in the
-  background, burn only on confirmed payment, restore only on confirmed
-  non-payment, and park everything else as pending for reconciliation -
-  which also runs at startup, so a crash mid-melt never guesses.
+- The melt discipline: reserve the note, then give the payment up to two
+  seconds. A payment the funding source confirms never left (no route, say)
+  is answered `ERROR` with its reason and the note is outstanding again;
+  anything else is answered `OK` and finishes in the background. Burn only
+  on confirmed payment, restore only on confirmed non-payment, and park
+  everything else as pending for reconciliation - which also runs at
+  startup, so a crash mid-melt never guesses.
 
 ## Run
 
@@ -417,10 +420,11 @@ The rules:
   true`, so a wallet knows this mint takes the parameter before it asks
   rather than after it pays.
 - When signing and LUD-21 verification are enabled, the quote also carries
-  `mint: {h, amount}`. This is the exact output and net millisatoshi value
-  the invoice will mint; it never carries `sig` before settlement.
+  `mint: {h, amount}`. This is the exact output, in the spelling the wallet
+  named it (a bearer note's hex `h`, or its `cp1`), and the net millisatoshi
+  value the invoice will mint; it never carries `sig` before settlement.
 - Once settled, `/verify` repeats the same `h` and `amount` and adds `sig`,
-  the ordinary LUD-25 signature over `LNURLcash:<amount>:<h>`. A sealed
+  the note's ordinary LUD-25 certificate: a `cs1` over its Q. A sealed
   signer can verify that receipt against the pre-payment commitment and
   pinned `mintPubkey`, then confirm its staged note without exporting `k1`.
 - Claiming needs nothing else. `GET /w?k1=<the secret>` brings the note

package/dist/admin.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
 import { secp256k1 } from '@noble/curves/secp256k1.js';
-import { noteDeclaredAmount, noteK1, noteSignature, verifyNoteSignature, verifyNoteSignatureHash } from '@lnurlcash/kit';
+import { encodeCs1WithAmount, hashK1, noteDeclaredAmount, noteK1, noteSignature, verifyNoteSignatureForKey } from '@lnurlcash/kit';
 import { decodeNote, decodeSpend } from "./spend.js";
 import { configFromEnv, pubkeyHex } from "./config.js";
 import { NoteStore } from "./store.js";
@@ -374,7 +374,20 @@ export const runAdmin = async (argv, deps = {}) => {
                 }
                 const id = bytesToHex(spend.outputKey);
                 const declared = noteDeclaredAmount(url);
-                const signature = noteSignature(url);
+                // `c` since the taproot unification; `sig` on a note URL from before.
+                let signature = noteSignature(url);
+                if (!signature) {
+                    try {
+                        signature = new URL(url).searchParams.get('sig');
+                    }
+                    catch { }
+                }
+                // The kit reads only a cs1 now. A certificate from before that was
+                // the bare 65-byte signature in hex, its amount on the URL beside
+                // it: put the amount back into a cs1 so it can still be checked.
+                if (signature && declared !== null && /^[0-9a-f]{130}$/i.test(signature)) {
+                    signature = encodeCs1WithAmount(declared, hexToBytes(signature));
+                }
                 const current = signingPubkey(config);
                 const keys = [...(current ? [current] : []), ...(config.previousSigningPubkeys ?? [])];
                 out(`note id  ${id}`);
@@ -387,9 +400,12 @@ export const runAdmin = async (argv, deps = {}) => {
                     out('signature present, but the URL declares no amount to check it against');
                 }
                 else {
-                    // Over Q, as LUD-25 certifies every note now, or over the note's
-                    // old id for a certificate issued before that.
-                    const signedBy = keys.find(pubkey => verifyNoteSignatureHash(id, declared, signature, pubkey) || verifyNoteSignature(k1, declared, signature, pubkey));
+                    // Over Q, as LUD-25 certifies every note now, or, for a bearer
+                    // note certified before that, over its old id sha256(k1). A key
+                    // note's old id was its key, which is Q already.
+                    const legacyId = spend.kind === 'script' && /^[0-9a-f]{64}$/i.test(k1.trim()) ? hashK1(k1.trim()) : null;
+                    const signedBy = keys.find(pubkey => verifyNoteSignatureForKey(id, declared, signature, pubkey) ||
+                        (legacyId !== null && verifyNoteSignatureForKey(legacyId, declared, signature, pubkey)));
                     out(signedBy === undefined
                         ? 'signature DOES NOT verify against this mint'
                         : `signature verifies against ${signedBy === current ? 'the current key' : `a previous key (${signedBy})`}`);

package/dist/live-check.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { lstat, open, readFile, rename, unlink } from 'node:fs/promises';
 import { decodeBolt11 } from 'farrier-kit/bolt11';
-import { NoteSpentError, PendingNoteError, buildNoteUrl, decodeBolt11AmountMsat, fetchInvoiceVerification, fetchPayRequest, hashK1, isBolt11Invoice, isPreimage, meltNote, probeBurnedNote, requestInvoice, requireBoundMintQuote, validateBoundMintReceipt, withinMintFeeBand } from '@lnurlcash/kit';
+import { NoteSpentError, PendingNoteError, buildNoteUrl, decodeBolt11AmountMsat, fetchInvoiceVerification, fetchPayRequest, hashK1, isBolt11Invoice, isPreimage, meltNote, probeBurnedNote, requestInvoiceShort, requireBoundMintQuote, validateBoundMintReceipt, withinMintFeeBand } from '@lnurlcash/kit';
 import { claimMintedNote } from "./claim.js";
 const stages = new Set(['prepared', 'quoted', 'settled', 'claimed', 'retiring', 'retired']);
 const errno = (error) => error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
@@ -216,7 +216,9 @@ export const runLiveBoundMintCheck = async (options) => {
         if (state.grossMsat < pay.minSendable || state.grossMsat > pay.maxSendable) {
             throw new Error(`Test amount is outside the mint range ${pay.minSendable}-${pay.maxSendable} msat.`);
         }
-        const quote = await requestInvoice(pay.callback, state.grossMsat, state.h);
+        // Named by the bare h, which the kit reads as a bearer note's h and
+        // normalises to its Q on both sides of the comparison below.
+        const quote = await requestInvoiceShort(pay.callback, state.grossMsat, state.h);
         if (!quote.verify || !quote.mint)
             throw new Error('Mint did not bind this quote to h and a verification URL.');
         const netMsat = quote.mint.amountMsat;

package/dist/melt.d.ts

@@ -7,6 +7,14 @@ export type MeltJob = {
     amountMsat: number;
     payAmountMsat?: number;
 };
+export type MeltOutcome = {
+    kind: 'paid';
+} | {
+    kind: 'restored';
+    reason: string;
+} | {
+    kind: 'unresolved';
+};
 export type MeltDeps = {
     store: NoteStore;
     backend: LightningBackend;
@@ -14,5 +22,5 @@ export type MeltDeps = {
     confirmDelaysMs?: number[];
     log?: (message: string) => void;
 };
-export declare const runMelt: (job: MeltJob, deps: MeltDeps) => Promise<void>;
+export declare const runMelt: (job: MeltJob, deps: MeltDeps) => Promise<MeltOutcome>;
 export declare const reconcilePendingMelts: (store: NoteStore, backend: LightningBackend, inFlight: ReadonlySet<string>, log?: (message: string) => void) => Promise<void>;

package/dist/melt.js

@@ -2,7 +2,7 @@ import { verifyPreimage } from 'farrier-kit/preimage';
 import { PaymentAlreadyKnownError, PaymentFailedError, PaymentPendingError } from "./backends/types.js";
 const DEFAULT_CONFIRM_DELAYS_MS = [0, 2_000, 4_000, 9_000, 16_000];
 const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
-const confirmThenSettle = async (job, deps) => {
+const confirmThenSettle = async (job, deps, reason) => {
     const log = deps.log ?? (() => { });
     for (const delay of deps.confirmDelaysMs ?? DEFAULT_CONFIRM_DELAYS_MS) {
         if (delay > 0)
@@ -11,12 +11,11 @@ const confirmThenSettle = async (job, deps) => {
             const complete = await deps.backend.isPaymentComplete(job.paymentHash);
             if (complete) {
                 deps.store.finalizeMelt(job.paymentHash);
+                return { kind: 'paid' };
             }
-            else {
-                log(`melt ${job.noteId}: confirmed not paid - restoring`);
-                deps.store.restoreMelt(job.paymentHash);
-            }
-            return;
+            log(`melt ${job.noteId}: confirmed not paid - restoring`);
+            deps.store.restoreMelt(job.paymentHash);
+            return { kind: 'restored', reason };
         }
         catch (err) {
             if (!(err instanceof PaymentPendingError)) {
@@ -25,6 +24,7 @@ const confirmThenSettle = async (job, deps) => {
         }
     }
     log(`melt ${job.noteId}: payment status unconfirmable - note left pending for reconciliation`);
+    return { kind: 'unresolved' };
 };
 export const runMelt = async (job, deps) => {
     const log = deps.log ?? (() => { });
@@ -47,23 +47,26 @@ export const runMelt = async (job, deps) => {
             // lands between that check and the send.
             log(`melt ${job.noteId}: the funding source already knew this hash - restored (shared-node replay?)`);
             deps.store.restoreMelt(job.paymentHash);
-            return;
+            return { kind: 'restored', reason: 'Invoice already used by an earlier melt - use a fresh one.' };
         }
-        if (!(err instanceof PaymentFailedError)) {
+        // A clean failure's message is the backend's reason, written for a
+        // wallet ("Could not find a route..."); an ambiguous one is transport
+        // detail, so a wallet gets a plain sentence instead.
+        const clean = err instanceof PaymentFailedError;
+        if (!clean) {
             log(`melt ${job.noteId}: payment attempt failed ambiguously (${err.message})`);
         }
-        await confirmThenSettle(job, deps);
-        return;
+        return confirmThenSettle(job, deps, clean ? err.message : 'Payment failed.');
     }
     if (outcome.preimageHex !== null && !verifyPreimage(outcome.preimageHex, job.paymentHash)) {
         // The backend claims success with a preimage that does not settle this
         // invoice. That is a statement about the evidence, not the money - fall
         // back to the tracker rather than trusting either way.
         log(`melt ${job.noteId}: backend preimage does not settle this invoice - reconfirming`);
-        await confirmThenSettle(job, deps);
-        return;
+        return confirmThenSettle(job, deps, 'Payment failed.');
     }
     deps.store.finalizeMelt(job.paymentHash);
+    return { kind: 'paid' };
 };
 // Resolves melts an earlier process left pending - a crash mid-melt, or an
 // outcome that could not be confirmed at the time. Melts whose attempt is

package/dist/server.d.ts

@@ -25,6 +25,7 @@ export type MoneyerDeps = {
     store?: NoteStore;
     log?: (message: string) => void;
     confirmDelaysMs?: number[];
+    meltAnswerWindowMs?: number;
     webAssets?: WebAssets | null;
     nostr?: NostrTransport;
     zapPollMs?: number;

package/dist/server.js

@@ -5,7 +5,7 @@ import { applyMintFee, encodeCs1WithAmount, grossUpForMintFee, hashK1 } from '@l
 import { tryDecodeBolt11 } from 'farrier-kit/bolt11';
 import { NotePendingError, NoteStore, NoteUnavailableError, OutputCollisionError, swapFingerprint } from "./store.js";
 import { createNoteSigner } from "./signing.js";
-import { bearerNoteId, decodeNote, decodeSpend, spendDomainOf, verifySpend } from "./spend.js";
+import { bearerNoteId, decodeNote, decodeSpend, encodeCp1, spendDomainOf, verifySpend } from "./spend.js";
 import { createKernelVerifier } from "./kernel.js";
 import { describeFee } from "./fee-words.js";
 import { createFakeBackend } from "./backends/fake.js";
@@ -25,6 +25,10 @@ const namedRef = (value) => {
     const q = decodeNote(value);
     return q ? { q, named: HEX32.test(value) ? value : q } : null;
 };
+// The name a quote or receipt repeats back, in the spelling the wallet used.
+// A wallet reads bare hex there as a bearer note's h, so a note named by its
+// cp1 has to come back as that cp1, never as the hex of its Q.
+const echoedName = (q, named) => (named === q ? encodeCp1(hexToBytes(q)) : named);
 const INVALID_K1 = 'Invalid or already spent k1.';
 // LUD-25's own reason for an output that names a note already credited.
 const IN_USE = 'already in use';
@@ -45,6 +49,9 @@ const renamedRef = (q, name, legacy) => {
 // more than a name and a note, and an unbounded read on a public endpoint
 // is a way to run a mint out of memory.
 const MAX_BODY_BYTES = 8 * 1024;
+// How long a melt callback waits for the payment's outcome before answering
+// OK. Long enough for a no-route failure, short against a wallet's timeout.
+const MELT_ANSWER_WINDOW_MS = 2_000;
 const readBody = async (req, limit = MAX_BODY_BYTES) => {
     const chunks = [];
     let size = 0;
@@ -836,7 +843,7 @@ export const createMoneyer = async (config, deps = {}) => {
                 // value this invoice will mint. It is only offered when /verify can
                 // later authenticate settlement with this mint's signing key.
                 ...(config.verify && signer
-                    ? { mint: { h: commentRef.named, amount: net } }
+                    ? { mint: { h: echoedName(commentRef.q, commentRef.named), amount: net } }
                     : {}),
                 // Every current-draft mint quote is comment-bound, so the LUD-21
                 // preimage is ordinary settlement proof and safe to disclose after
@@ -876,19 +883,21 @@ export const createMoneyer = async (config, deps = {}) => {
                     preimage: preimageHex,
                     pr: invoice.pr,
                     // Repeating h and amount binds this response to the quote. The
-                    // ordinary note signature appears only once value exists at h.
-                    // The receipt signs exactly the `h` it repeats - what the wallet
-                    // named, a bearer note's h or a cp1's Q - since that is what a
-                    // receipt validator checks it over. The note's own certificate,
-                    // the cs1 over its Q, comes from the withdraw endpoint.
+                    // signature appears only once value exists there, and it is the
+                    // note's ordinary certificate: a cs1 over its Q, which is what a
+                    // receipt validator derives from the repeated name and checks.
+                    // A quote from before notes were keyed by Q stored the bearer h
+                    // as its output and no separate name.
                     ...(currentInvoice.outputId !== null && signer
                         ? (() => {
+                            const legacy = currentInvoice.outputNamed === null;
+                            const q = legacy ? bearerNoteId(currentInvoice.outputId) : currentInvoice.outputId;
                             const named = currentInvoice.outputNamed ?? currentInvoice.outputId;
                             return {
                                 mint: {
-                                    h: named,
+                                    h: echoedName(q, named),
                                     amount: currentInvoice.netMsat,
-                                    ...(settled ? { sig: signer.sign(named, currentInvoice.netMsat) } : {})
+                                    ...(settled ? { sig: certify(q, currentInvoice.netMsat) } : {})
                                 }
                             };
                         })()
@@ -1161,17 +1170,34 @@ export const createMoneyer = async (config, deps = {}) => {
                     return fail('Invoice already used by an earlier melt - use a fresh one.');
                 }
                 inFlight.add(paymentHash);
-                void runMelt({
+                const melt = runMelt({
                     paymentHash,
                     noteId: inputIds[0],
                     pr: pr.trim(),
                     amountMsat: totalMsat,
                     ...(payAmountMsat !== null ? { payAmountMsat } : {})
                 }, { store, backend, feeLimitMsat: meltFeeLimitMsat, log, ...(deps.confirmDelaysMs ? { confirmDelaysMs: deps.confirmDelaysMs } : {}) })
-                    .catch(err => log(`melt ${inputIds[0]}: ${err.message}`))
+                    .catch((err) => {
+                    log(`melt ${inputIds[0]}: ${err.message}`);
+                    return { kind: 'unresolved' };
+                })
                     .finally(() => inFlight.delete(paymentHash));
-                // Replied before the payment resolves, per LUD-03: OK means the
-                // melt is requested and the note reserved, never that it settled.
+                // A payment that cannot leave usually says so within a second (lnd
+                // answers no-route before sending any HTLC), so wait briefly: a
+                // melt the funding source has confirmed never went out is answered
+                // with its reason, and the note is already outstanding again. Any
+                // other outcome, or none yet, is OK as LUD-03 has it: the melt is
+                // requested and the note reserved, never that it settled.
+                let windowTimer;
+                const outcome = await Promise.race([
+                    melt,
+                    new Promise(resolve => {
+                        windowTimer = setTimeout(() => resolve(null), deps.meltAnswerWindowMs ?? MELT_ANSWER_WINDOW_MS);
+                    })
+                ]);
+                clearTimeout(windowTimer);
+                if (outcome?.kind === 'restored')
+                    return fail(outcome.reason);
                 return send({
                     status: 'OK',
                     ...(config.verify ? { pr: pr.trim(), verify: `${origin}/verify/${paymentHash}` } : {})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.17.1",
+  "version": "0.18.1",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -74,7 +74,7 @@
     "live:bound-mint": "npm run build && node scripts/live-bound-mint-check.mjs"
   },
   "dependencies": {
-    "@lnurlcash/kit": "0.18.1",
+    "@lnurlcash/kit": "0.20.2",
     "@noble/curves": "^2.3.0",
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^1.2.4",