@forgesworn/moneyer 0.3.1 → 0.3.3

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## [0.3.3] - 2026-08-22
+
+- **Refusals are logged, so an operator can see why a wallet is failing.**
+  A holder reported "notes already spent" on every melt and the journal for
+  that whole day carried startup banners and one invoice sweep - nothing to
+  compare the report against. Refusals now log the method, the path and the
+  reason. Never the query string, because a note URL carries the k1 and log
+  files travel; and never the informational GET, which a single restore
+  walks twenty-odd unknown indexes of by design.
+
+## [0.3.2] - 2026-08-22
+
+- **A note with a melt in flight is no longer advertised as withdrawable.**
+  The mutating callback already refused a pending note; the informational
+  GET did not, so the check LUD-25 points a careful holder at was the one
+  that lied. That is the exact gap a sell-during-melt needs: start a melt,
+  show the buyer a healthy GET, take payment out of band, let the melt
+  settle. `fetchNoteInfo` on a pending note now fails the same way the
+  callback does, and lnurlcash-kit classifies it as `PendingNoteError`, so
+  a wallet parks the note rather than writing it off as unknown. Found by
+  re-reading LUD-25 against dni's lnurl-mint, which has had this guard.
+- A flake in the melt suite: `leaves an unconfirmable outcome pending`
+  slept a fixed 100 ms, which was waiting for an in-flight melt to finish
+  exhausting its confirmations rather than for any state, and reconcile
+  deliberately skips a melt this process still has in flight. It now
+  retries reconcile until it can act.
+
 ## [0.3.1] - 2026-08-22
 
 - **Rounding the fee to a whole sat now really is the default.** 0.3.0

package/dist/server.js

@@ -312,7 +312,20 @@ export const createMoneyer = async (config, deps = {}) => {
             });
             res.end(JSON.stringify(body));
         };
-        const fail = (reason, status = 200) => send({ status: 'ERROR', reason }, status);
+        // Refusals go to the operator's log, because a mint that refuses in
+        // silence cannot be debugged from the outside: a wallet shows its user
+        // "already spent" and the operator has nothing at all to compare it to.
+        //
+        // The PATHNAME only, never the query string: a note URL carries the k1,
+        // and a k1 is the money. And never the informational GET, which a
+        // single restore walks twenty-odd unknown indexes of by design - that
+        // is not news, and burying the rare refusals under it defeats the point.
+        const fail = (reason, status = 200) => {
+            if (requestUrl.pathname !== '/w') {
+                log(`refused ${req.method ?? 'GET'} ${requestUrl.pathname}: ${reason}`);
+            }
+            send({ status: 'ERROR', reason }, status);
+        };
         const knownUser = (user) => user === config.username || user === '_';
         // ---- the mint's face ----
         if (requestUrl.pathname === '/' && (req.method === 'GET' || req.method === 'HEAD')) {
@@ -676,6 +689,16 @@ export const createMoneyer = async (config, deps = {}) => {
                 return fail('Unknown note.');
             if (note.state === 'burned')
                 return fail('Note already spent.');
+            // A note reserved by an in-flight melt is not withdrawable, and must
+            // not be advertised as though it were. LUD-25 makes this GET the way
+            // anyone checks what a note is worth, so answering "live, worth all
+            // of it" about a note halfway out of the door is the exact lie a
+            // sell-during-melt needs: the seller starts a melt, shows the buyer a
+            // healthy GET, takes payment out of band, and the melt settles. Same
+            // reason the mutating callback already gives, and the same one dni's
+            // lnurl-mint gives here.
+            if (note.state === 'pending')
+                return fail('pending');
             // maxWithdrawable states the note's value, as the reference does.
             // minWithdrawable is that value floored to a whole sat: most Lightning
             // wallets can only invoice whole sats, and a note of 94.9 sat that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",