@forgesworn/moneyer 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,95 @@
 # Changelog
 
+## [0.7.0] - 2026-08-26
+
+- **The published node capacity is the announced one.** `nodeCapacity` in
+  the discovery document was summed from lnd's `/v1/channels`, which is an
+  authenticated view of the node and counts private channels. That figure is
+  served to every visitor and goes out in the mint's announcement, so a
+  channel the operator chose not to announce was being sized in public
+  anyway. It now comes from this node's own entry in the public graph -
+  `total_capacity`, the same number any stranger on the network already
+  reads, converted from sats. A node with nothing announced reports zero
+  rather than omitting the field, because zero is the true answer there;
+  only a node that cannot be asked leaves it off. cln never reported
+  capacity and is unaffected.
+
+  Operators should expect the number to fall, and to fall to zero on a mint
+  running entirely on private channels. It was never the figure it claimed
+  to be.
+
+- The web wallet prints a note to a PNG you can send. The plate existed only
+  as HTML over the artwork, which is no use in a message; the same portrait
+  plate composites onto a canvas and comes back as a file - the share sheet
+  where the browser offers one, a download everywhere else. The travelling
+  plate carries the bech32 LNURL rather than the claim link, because a note
+  that leaves in a message is scanned by whatever the recipient already has,
+  and that is usually a Lightning wallet.
+
+- The bundled web wallet names its note on the plain path too, not only when
+  a signed receipt is on offer. It previously fell back to an unnamed mint
+  and then required `verify` to read the preimage - which, with the rule
+  above, a signer-less mint no longer answers. Naming needs no receipt, and
+  the page then claims the secret it chose rather than one the mint
+  publishes.
+
+- **No LUD-21 `verify` on a mint payment that named no output.** LUD-25
+  forbids it, and the reason is concrete: on that path the note's `k1` IS the
+  payment preimage, and `verify` publishes the preimage at a URL anyone who
+  has seen the invoice can build from its payment hash. The note was only as
+  private as the QR it was paid from.
+
+  Both halves are needed. New unnamed invoices get no `verify` field, and
+  `/verify/<hash>` refuses them outright - not advertising a URL does not
+  stop anyone constructing it. A payer on this path still learns the preimage
+  the way any Lightning wallet does, by paying.
+
+  **Invoices quoted before this mint adopted the rule keep their `verify`.**
+  A wallet polling one of those did not pay the invoice itself - that is why
+  it is polling - so the preimage this mint holds is its only route to a note
+  it already owns. Refusing them would not close a hole, it would burn
+  somebody's money. The cutover is written to a new `meta` table the first
+  time a build carrying this code opens the database, and never moves after;
+  persisted rather than taken from process start, or a restart would walk the
+  line forward and strand a quote made minutes earlier under the same build.
+  Old rows drain and the hole closes for everything new.
+
+- The mint accepts a LUD-12 `comment` carrying `hex(h)` as the name of the
+  note being bought, and advertises `commentAllowed: 64` on the payRequest.
+  This is how LUD-25 specifies it; `h` was this mint's own earlier spelling
+  and both are now honoured, so wallets on either keep working. A wallet
+  sending both must agree with itself - minting under one when the other is
+  being watched for would lose the note.
+
+  The two are deliberately not validated alike. Per LUD-25, a `comment` that
+  is not a bare 32-byte hex hash falls back to keying the note by the payment
+  preimage, exactly as no comment does, because a comment is free text in
+  LUD-12 and failing on every stray one would break ordinary payers. A
+  malformed `h` still fails loudly: that is a wallet that meant to name an
+  output and got it wrong.
+
+  This matters beyond conformance. A note minted with no named output has the
+  payment preimage as its spend secret, and until this release the mint
+  served that preimage on its LUD-21 `verify` URL, which anyone holding the
+  invoice can construct. Naming the output is what makes `verify` safe to
+  offer, and the entry above now gates it on exactly that.
+
+## [0.6.1] - 2026-08-24
+
+- The bundled web wallet now accepts a bound mint quote anywhere inside
+  the mint's advertised fee band, then uses the committed amount for the
+  signed receipt and note. A mint that rounds its fee up to a whole sat -
+  including moneyer's production default - no longer makes the page
+  silently abandon the sealed-signer receipt path for a legacy invoice.
+  Browser coverage uses the production `5000 msat + 1000 ppm`, sat-rounded
+  policy and proves the staged quote survives through settlement.
+- A resumable real-node bound-mint release check persists its bearer secret
+  with mode `0600` before requesting a quote, treats payer command output as
+  opaque, validates the settlement preimage and signed receipt, then melts
+  the whole test note to a fresh amountless refund invoice. Interrupted runs
+  resume from the same state file; successful runs scrub the secret and leave
+  no test-note liability behind.
+
 ## [0.6.0] - 2026-08-24
 
 - **Bound mint settlement receipts.** A pay callback asked to mint at a

package/dist/backends/lnd.js

@@ -183,12 +183,27 @@ export const createLndBackend = (config) => {
             const color = typeof res.json?.color === 'string' ? `#${res.json.color.replace(/^#/, '')}` : undefined;
             const numChannels = Number(res.json?.num_active_channels);
             const numPeers = Number(res.json?.num_peers);
-            // Total public capacity, best-effort: the macaroon may not carry
-            // offchain:read, and the discovery endpoint works fine without it.
+            // Announced capacity, read from this node's own entry in the public
+            // graph rather than from its channel list. `/v1/channels` is an
+            // authenticated view and counts private channels too; this figure is
+            // published in the discovery document, so summing that would tell the
+            // world what only the operator can see. The graph self-lookup returns
+            // the same `total_capacity` any stranger on the network already
+            // reads, in sats, so it is converted here to keep NodeInfo msat.
+            //
+            // Best-effort, in two flavours: a 404 is a node with nothing
+            // announced, which is a public capacity of zero rather than an
+            // unknown one, while any other failure leaves the field off - the
+            // macaroon may not carry info:read, and the discovery endpoint works
+            // fine without it.
             let capacityMsat;
-            const channels = await json('/v1/channels');
-            if (channels.ok && Array.isArray(channels.json?.channels)) {
-                capacityMsat = channels.json.channels.reduce((sum, channel) => sum + Number(channel.capacity ?? 0) * 1000, 0);
+            const pubkey = res.json?.identity_pubkey;
+            if (typeof pubkey === 'string' && pubkey) {
+                const node = await json(`/v1/graph/node/${pubkey}`);
+                if (node.ok)
+                    capacityMsat = Number(node.json?.total_capacity ?? 0) * 1000;
+                else if (node.status === 404)
+                    capacityMsat = 0;
             }
             // Outbound liquidity, best-effort for the same reason as capacity:
             // the macaroon may not carry offchain:read.

package/dist/live-check.d.ts

@@ -0,0 +1,48 @@
+import { type InvoiceResult } from 'lnurlcash-kit';
+export type LiveCheckStage = 'prepared' | 'quoted' | 'settled' | 'claimed' | 'retiring' | 'retired';
+export type LiveCheckState = {
+    version: 1;
+    stage: LiveCheckStage;
+    payUrl: string;
+    grossMsat: number;
+    h: string;
+    secret?: string;
+    netMsat?: number;
+    mintPubkey?: string;
+    payCallback?: string;
+    withdrawLink?: string;
+    quote?: InvoiceResult;
+    noteCallback?: string;
+    refundPr?: string;
+    refundPaymentHash?: string;
+    meltVerify?: string;
+    paymentPreimageValidated?: true;
+    receiptSignatureValidated?: true;
+    refundSettled?: true;
+    completedAt?: string;
+};
+export type LiveBoundMintCheckOptions = {
+    payUrl: string;
+    grossMsat: number;
+    statePath: string;
+    payInvoice: (pr: string) => Promise<void>;
+    createRefundInvoice: () => Promise<string>;
+    timeoutMs?: number;
+    pollMs?: number;
+    log?: (message: string) => void;
+};
+export type LiveBoundMintCheckResult = {
+    stage: 'retired';
+    payUrl: string;
+    grossMsat: number;
+    netMsat: number;
+    h: string;
+    mintPubkey: string;
+    paymentPreimageValidated: true;
+    receiptSignatureValidated: true;
+    refundSettled: true;
+    completedAt: string;
+};
+export declare const readLiveCheckState: (path: string) => Promise<LiveCheckState>;
+export declare const extractBolt11: (output: string) => string | null;
+export declare const runLiveBoundMintCheck: (options: LiveBoundMintCheckOptions) => Promise<LiveBoundMintCheckResult>;

package/dist/live-check.js

@@ -0,0 +1,378 @@
+import { randomBytes } from 'node:crypto';
+import { lstat, open, readFile, rename, unlink } from 'node:fs/promises';
+import { decodeBolt11 } from 'farrier-kit/bolt11';
+import { NoteSpentError, PendingNoteError, buildNoteUrl, claimMintedNote, decodeBolt11AmountMsat, fetchInvoiceVerification, fetchPayRequest, hashK1, isBolt11Invoice, isPreimage, meltNote, probeBurnedNote, requestInvoice, requireBoundMintQuote, validateBoundMintReceipt, withinMintFeeBand } from 'lnurlcash-kit';
+const stages = new Set(['prepared', 'quoted', 'settled', 'claimed', 'retiring', 'retired']);
+const errno = (error) => error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
+const serialise = (state) => `${JSON.stringify(state, null, 2)}\n`;
+const writeNewState = async (path, state) => {
+    const handle = await open(path, 'wx', 0o600);
+    try {
+        await handle.writeFile(serialise(state), 'utf8');
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+};
+const assertSecureStateFile = async (path) => {
+    const stat = await lstat(path);
+    if (!stat.isFile())
+        throw new Error(`Live-check state is not a regular file: ${path}`);
+    if (typeof process.getuid === 'function') {
+        if (stat.uid !== process.getuid())
+            throw new Error(`Live-check state is not owned by this user: ${path}`);
+        if ((stat.mode & 0o077) !== 0)
+            throw new Error(`Live-check state must have mode 0600: ${path}`);
+    }
+};
+const replaceState = async (path, state) => {
+    await assertSecureStateFile(path);
+    const temporary = `${path}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+    try {
+        await writeNewState(temporary, state);
+        await rename(temporary, path);
+    }
+    catch (error) {
+        await unlink(temporary).catch(() => { });
+        throw error;
+    }
+};
+const validateState = (value) => {
+    if (!value || typeof value !== 'object')
+        throw new Error('Live-check state is not an object.');
+    const state = value;
+    if (state.version !== 1 || !state.stage || !stages.has(state.stage))
+        throw new Error('Unsupported live-check state.');
+    if (typeof state.payUrl !== 'string' ||
+        typeof state.grossMsat !== 'number' ||
+        !Number.isSafeInteger(state.grossMsat) ||
+        state.grossMsat <= 0 ||
+        typeof state.h !== 'string' ||
+        !/^[0-9a-f]{64}$/.test(state.h)) {
+        throw new Error('Live-check state is incomplete.');
+    }
+    if (state.stage !== 'retired') {
+        if (typeof state.secret !== 'string' || !isPreimage(state.secret) || hashK1(state.secret) !== state.h) {
+            throw new Error('Live-check state does not contain the secret committed by h.');
+        }
+    }
+    return state;
+};
+export const readLiveCheckState = async (path) => {
+    await assertSecureStateFile(path);
+    return validateState(JSON.parse(await readFile(path, 'utf8')));
+};
+const loadOrCreateState = async (options) => {
+    let state;
+    try {
+        state = await readLiveCheckState(options.statePath);
+    }
+    catch (error) {
+        if (errno(error) !== 'ENOENT')
+            throw error;
+        const secret = randomBytes(32).toString('hex');
+        state = {
+            version: 1,
+            stage: 'prepared',
+            payUrl: options.payUrl,
+            grossMsat: options.grossMsat,
+            secret,
+            h: hashK1(secret)
+        };
+        try {
+            // This fsync completes before a quote exists. A crash from here on
+            // can lose an index or an unpaid invoice, never the bearer secret.
+            await writeNewState(options.statePath, state);
+        }
+        catch (writeError) {
+            if (errno(writeError) !== 'EEXIST')
+                throw writeError;
+            state = await readLiveCheckState(options.statePath);
+        }
+    }
+    if (state.payUrl !== options.payUrl || state.grossMsat !== options.grossMsat) {
+        throw new Error('Existing live-check state belongs to a different mint or amount.');
+    }
+    return state;
+};
+const stringsIn = (value) => {
+    if (typeof value === 'string')
+        return [value];
+    if (Array.isArray(value))
+        return value.flatMap(stringsIn);
+    if (value && typeof value === 'object')
+        return Object.values(value).flatMap(stringsIn);
+    return [];
+};
+// `lncli` has emitted JSON in some versions and a display table in others.
+// The release check only needs an invoice from the refund command; it does
+// not treat either presentation as an API contract.
+export const extractBolt11 = (output) => {
+    const trimmed = output.trim();
+    if (isBolt11Invoice(trimmed))
+        return trimmed;
+    try {
+        for (const candidate of stringsIn(JSON.parse(trimmed))) {
+            if (isBolt11Invoice(candidate))
+                return candidate.trim();
+        }
+    }
+    catch {
+        // Human-readable output is handled below.
+    }
+    for (const match of output.matchAll(/ln(?:bc|tb|bcrt|tbs|sb)[0-9]*[munp]?1[a-z0-9]+/gi)) {
+        if (isBolt11Invoice(match[0]))
+            return match[0].trim();
+    }
+    return null;
+};
+const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+const waitForSettled = async (verifyUrl, timeoutMs, pollMs) => {
+    const deadline = Date.now() + timeoutMs;
+    let lastError;
+    while (Date.now() <= deadline) {
+        try {
+            const verification = await fetchInvoiceVerification(verifyUrl);
+            if (verification.settled)
+                return verification;
+        }
+        catch (error) {
+            lastError = error;
+        }
+        await sleep(pollMs);
+    }
+    const detail = lastError instanceof Error ? ` Last response: ${lastError.message}` : '';
+    throw new Error(`Timed out waiting for settlement.${detail}`);
+};
+const existingVerification = async (verifyUrl) => {
+    try {
+        return await fetchInvoiceVerification(verifyUrl);
+    }
+    catch {
+        return null;
+    }
+};
+const requireQuotedState = (state) => {
+    if (!state.secret ||
+        state.netMsat === undefined ||
+        !state.mintPubkey ||
+        !state.payCallback ||
+        !state.withdrawLink ||
+        !state.quote?.verify) {
+        throw new Error('Quoted live-check state is incomplete.');
+    }
+    const commitment = requireBoundMintQuote(state.quote, state.h, state.netMsat);
+    if (commitment.signature !== undefined)
+        throw new Error('The pre-payment commitment unexpectedly carries a signature.');
+    return {
+        secret: state.secret,
+        netMsat: state.netMsat,
+        mintPubkey: state.mintPubkey,
+        payCallback: state.payCallback,
+        withdrawLink: state.withdrawLink,
+        quote: state.quote
+    };
+};
+const retiredResult = (state) => {
+    if (state.stage !== 'retired' ||
+        state.netMsat === undefined ||
+        !state.mintPubkey ||
+        !state.completedAt ||
+        state.paymentPreimageValidated !== true ||
+        state.receiptSignatureValidated !== true ||
+        state.refundSettled !== true) {
+        throw new Error('Retired live-check state is incomplete.');
+    }
+    return {
+        stage: 'retired',
+        payUrl: state.payUrl,
+        grossMsat: state.grossMsat,
+        netMsat: state.netMsat,
+        h: state.h,
+        mintPubkey: state.mintPubkey,
+        paymentPreimageValidated: true,
+        receiptSignatureValidated: true,
+        refundSettled: true,
+        completedAt: state.completedAt
+    };
+};
+export const runLiveBoundMintCheck = async (options) => {
+    if (!Number.isSafeInteger(options.grossMsat) || options.grossMsat <= 0)
+        throw new Error('grossMsat must be a positive integer.');
+    new URL(options.payUrl);
+    const timeoutMs = options.timeoutMs ?? 60_000;
+    const pollMs = options.pollMs ?? 500;
+    const log = options.log ?? (() => { });
+    let state = await loadOrCreateState(options);
+    if (state.stage === 'retired')
+        return retiredResult(state);
+    if (state.stage === 'prepared') {
+        const pay = await fetchPayRequest(state.payUrl);
+        if (!pay.mintToHash || !pay.mintPubkey || !pay.withdrawLink) {
+            throw new Error('Mint does not advertise the bound-mint receipt capabilities required by this check.');
+        }
+        if (state.grossMsat < pay.minSendable || state.grossMsat > pay.maxSendable) {
+            throw new Error(`Test amount is outside the mint range ${pay.minSendable}-${pay.maxSendable} msat.`);
+        }
+        const quote = await requestInvoice(pay.callback, state.grossMsat, { h: state.h });
+        if (!quote.verify || !quote.mint)
+            throw new Error('Mint did not bind this quote to h and a verification URL.');
+        const netMsat = quote.mint.amountMsat;
+        if (!Number.isSafeInteger(netMsat) || netMsat <= 0)
+            throw new Error('Mint committed an invalid net note amount.');
+        const feeAccepted = pay.mintFee
+            ? withinMintFeeBand(state.grossMsat, netMsat, pay.mintFee)
+            : netMsat === state.grossMsat;
+        if (!feeAccepted)
+            throw new Error('Mint committed a net amount outside its advertised fee band.');
+        const commitment = requireBoundMintQuote(quote, state.h, netMsat);
+        if (commitment.signature !== undefined)
+            throw new Error('The pre-payment commitment unexpectedly carries a signature.');
+        state = {
+            ...state,
+            stage: 'quoted',
+            netMsat,
+            mintPubkey: pay.mintPubkey,
+            payCallback: pay.callback,
+            withdrawLink: pay.withdrawLink,
+            quote
+        };
+        await replaceState(options.statePath, state);
+        log(`quote committed ${netMsat} msat at the staged note hash`);
+    }
+    const quoted = requireQuotedState(state);
+    if (state.stage === 'quoted') {
+        let verification = await fetchInvoiceVerification(quoted.quote.verify);
+        if (!verification.settled) {
+            let payerError;
+            try {
+                // Stdout is deliberately outside this interface. Exit status says
+                // whether the command believes it paid; /verify supplies the proof.
+                await options.payInvoice(quoted.quote.pr);
+            }
+            catch (error) {
+                payerError = error;
+            }
+            try {
+                verification = await waitForSettled(quoted.quote.verify, timeoutMs, pollMs);
+            }
+            catch (error) {
+                if (payerError instanceof Error) {
+                    throw new Error(`${error instanceof Error ? error.message : String(error)} Payer command: ${payerError.message}`);
+                }
+                throw error;
+            }
+        }
+        const receipt = validateBoundMintReceipt(quoted.quote, verification, state.h, quoted.netMsat, quoted.mintPubkey);
+        const paymentHash = decodeBolt11(quoted.quote.pr).paymentHashHex;
+        if (!verification.preimage || hashK1(verification.preimage) !== paymentHash) {
+            throw new Error('The settlement preimage does not prove the quoted invoice.');
+        }
+        if (!receipt.signature)
+            throw new Error('The settled receipt has no signature.');
+        state = { ...state, stage: 'settled' };
+        await replaceState(options.statePath, state);
+        log('settlement preimage and bound receipt signature validated');
+    }
+    if (state.stage === 'settled') {
+        const claim = await claimMintedNote(quoted.withdrawLink, quoted.secret);
+        if (claim.state !== 'minted' || claim.amountMsat !== quoted.netMsat || !claim.callback) {
+            throw new Error('The staged secret did not claim the committed note.');
+        }
+        state = { ...state, stage: 'claimed', noteCallback: claim.callback };
+        await replaceState(options.statePath, state);
+        log('the staged secret claimed the committed note');
+    }
+    if (state.stage === 'claimed') {
+        if (!state.noteCallback)
+            throw new Error('Claimed live-check state has no note callback.');
+        const refundOutput = await options.createRefundInvoice();
+        const refundPr = extractBolt11(refundOutput);
+        if (!refundPr)
+            throw new Error('Refund command did not emit a BOLT11 invoice.');
+        if (decodeBolt11AmountMsat(refundPr) !== null) {
+            throw new Error('Refund invoice must be amountless so the mint retires the entire test note.');
+        }
+        const refundPaymentHash = decodeBolt11(refundPr).paymentHashHex;
+        const meltVerify = new URL(`/verify/${refundPaymentHash}`, quoted.withdrawLink).toString();
+        // Persist the exact refund invoice before asking the mint to pay it.
+        // A crash after the callback can therefore resume without inventing a
+        // second payment target or losing the note secret.
+        state = { ...state, stage: 'retiring', refundPr, refundPaymentHash, meltVerify };
+        await replaceState(options.statePath, state);
+    }
+    if (state.stage === 'retiring') {
+        if (!state.noteCallback || !state.refundPr || !state.meltVerify) {
+            throw new Error('Retiring live-check state is incomplete.');
+        }
+        let verification = await existingVerification(state.meltVerify);
+        if (verification === null) {
+            try {
+                const result = await meltNote(state.noteCallback, quoted.secret, state.refundPr);
+                if (result.verify && result.verify !== state.meltVerify) {
+                    throw new Error('Mint returned a different verification URL for the refund melt.');
+                }
+            }
+            catch (error) {
+                if (!(error instanceof PendingNoteError) && !(error instanceof NoteSpentError))
+                    throw error;
+            }
+            verification = await existingVerification(state.meltVerify);
+        }
+        if (!verification?.settled) {
+            try {
+                verification = await waitForSettled(state.meltVerify, timeoutMs, pollMs);
+            }
+            catch (error) {
+                // A cleanly failed melt restores the note. Clear the used refund
+                // invoice but retain the secret, so the same command can retry with
+                // a fresh amountless invoice rather than stranding value.
+                const claim = await claimMintedNote(quoted.withdrawLink, quoted.secret).catch(() => null);
+                if (claim?.state === 'minted' && claim.callback) {
+                    state = {
+                        version: 1,
+                        stage: 'claimed',
+                        payUrl: state.payUrl,
+                        grossMsat: state.grossMsat,
+                        h: state.h,
+                        secret: quoted.secret,
+                        netMsat: quoted.netMsat,
+                        mintPubkey: quoted.mintPubkey,
+                        payCallback: quoted.payCallback,
+                        withdrawLink: quoted.withdrawLink,
+                        quote: quoted.quote,
+                        noteCallback: claim.callback
+                    };
+                    await replaceState(options.statePath, state);
+                    throw new Error(`Refund melt failed cleanly and the note was restored; rerun to use a fresh invoice. ${error instanceof Error ? error.message : ''}`);
+                }
+                throw error;
+            }
+        }
+        const noteUrl = buildNoteUrl(quoted.withdrawLink, quoted.secret, quoted.netMsat);
+        const deadline = Date.now() + timeoutMs;
+        while ((await probeBurnedNote(noteUrl)) !== 'gone') {
+            if (Date.now() > deadline)
+                throw new Error('Refund settled but the test note is not yet recorded as burned.');
+            await sleep(pollMs);
+        }
+        const completedAt = new Date().toISOString();
+        state = {
+            version: 1,
+            stage: 'retired',
+            payUrl: state.payUrl,
+            grossMsat: state.grossMsat,
+            netMsat: quoted.netMsat,
+            h: state.h,
+            mintPubkey: quoted.mintPubkey,
+            paymentPreimageValidated: true,
+            receiptSignatureValidated: true,
+            refundSettled: true,
+            completedAt
+        };
+        await replaceState(options.statePath, state);
+        log('refund settled and the test note was burned; bearer secret scrubbed from state');
+    }
+    return retiredResult(state);
+};

package/dist/server.js

@@ -551,6 +551,12 @@ export const createMoneyer = async (config, deps = {}) => {
                 // lightning address never reads that document, and this has to be
                 // known BEFORE paying, not after.
                 mintToHash: true,
+                // The same capability in the spelling LUD-25 specifies: the output
+                // hash rides in a LUD-12 comment, so 64 characters is exactly what
+                // a hex-encoded 32-byte hash needs. Advertised alongside
+                // `mintToHash` rather than instead of it, so wallets on either
+                // spelling can name a note.
+                commentAllowed: 64,
                 disposable: false
             });
         }
@@ -596,13 +602,33 @@ export const createMoneyer = async (config, deps = {}) => {
             // collision gets the same reason a colliding output gets on the
             // withdraw callback: which table an id already sits in is an oracle
             // nobody is owed.
-            const askedOutputId = q.get('h');
-            const outputId = askedOutputId === null ? null : askedOutputId.toLowerCase();
-            if (outputId !== null) {
-                if (!HEX32.test(outputId))
-                    return fail('missing h');
-                if (store.outputIdInUse(outputId))
-                    return fail('Invalid or already spent k1.');
+            // Two spellings of one thing. LUD-25 puts the output hash in a LUD-12
+            // `comment`; `h` is this mint's own earlier name for it, kept so the
+            // wallets that adopted it keep working.
+            //
+            // They are NOT validated the same way, and that asymmetry is the
+            // spec's. A malformed `comment` MUST fall back to keying the note by
+            // the preimage, exactly as no comment at all does - a comment is a
+            // free-text field in LUD-12 and a mint cannot treat every stray one
+            // as a failed mint. A malformed `h` is a wallet that meant to name an
+            // output and got it wrong, so it still fails loudly rather than
+            // quietly minting a note the wallet is not expecting.
+            const askedComment = q.get('comment')?.trim().toLowerCase() ?? null;
+            const commentOutputId = askedComment !== null && HEX32.test(askedComment) ? askedComment : null;
+            const askedOutputId = q.get('h')?.trim().toLowerCase() ?? null;
+            if (askedOutputId !== null && !HEX32.test(askedOutputId))
+                return fail('missing h');
+            // A wallet sending both should send the same hash in both; ours does.
+            // Disagreement is a bug in the caller, and picking a winner would
+            // mint a note under a hash one half of it is not watching for.
+            if (commentOutputId !== null &&
+                askedOutputId !== null &&
+                commentOutputId !== askedOutputId) {
+                return fail('comment and h name different outputs');
+            }
+            const outputId = commentOutputId ?? askedOutputId;
+            if (outputId !== null && store.outputIdInUse(outputId)) {
+                return fail('Invalid or already spent k1.');
             }
             // The preimage is the future note's spend secret unless `h` named
             // one; its hash is the invoice's payment hash either way. Generated
@@ -660,7 +686,15 @@ export const createMoneyer = async (config, deps = {}) => {
                 ...(outputId !== null && config.verify && signer
                     ? { mint: { h: outputId, amount: net } }
                     : {}),
-                ...(config.verify ? { verify: `${origin}/verify/${paymentHash}` } : {})
+                // LUD-25: a SERVICE MUST NOT offer verify on a mint payment that
+                // named no output. There the note's k1 IS the preimage, and verify
+                // hands it to whoever holds the URL - which anyone who has seen the
+                // invoice can build from its payment hash. A wallet on this path
+                // learns the preimage from paying the invoice, the way any Lightning
+                // wallet already keeps it.
+                ...(config.verify && outputId !== null
+                    ? { verify: `${origin}/verify/${paymentHash}` }
+                    : {})
             });
         }
         // ---- LUD-21 verify: mint invoices and melt payments ----
@@ -671,6 +705,14 @@ export const createMoneyer = async (config, deps = {}) => {
             const paymentHash = verifyMatch[1].toLowerCase();
             const invoice = store.mintInvoiceByHash(paymentHash);
             if (invoice) {
+                // The other half of the rule above, and the half that matters: not
+                // advertising the URL does not stop anyone building it. Refused for
+                // an unnamed invoice quoted since this mint adopted the rule, and
+                // still honoured for one quoted before it, whose payer has no other
+                // way to reach a note they already own.
+                if (invoice.outputId === null && invoice.createdAt >= store.unnamedVerifyCutover()) {
+                    return fail('Not found.', 404);
+                }
                 if (!invoice.settled && (await backend.isInvoiceSettled(paymentHash))) {
                     store.settleMintInvoice(paymentHash);
                 }

package/dist/store.d.ts

@@ -11,6 +11,7 @@ export type MintInvoiceRow = {
     netMsat: number;
     settled: boolean;
     outputId: string | null;
+    createdAt: number;
 };
 export type MeltRow = {
     paymentHash: string;
@@ -83,6 +84,7 @@ export declare class NoteStore {
     constructor(path: string, options?: {
         readOnly?: boolean;
     });
+    unnamedVerifyCutover(): number;
     private tx;
     noteById(id: string): NoteRow | null;
     private insertNote;

package/dist/store.js

@@ -117,6 +117,29 @@ export class NoteStore {
         // Two invoices may not name the same note. SQLite counts NULLs as
         // distinct, so every unbound invoice still fits.
         this.db.exec('CREATE UNIQUE INDEX IF NOT EXISTS mint_invoices_output_id ON mint_invoices (output_id)');
+        this.db.exec('CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);');
+        // The moment this mint stopped publishing preimages for notes nobody
+        // named. Written once, the first time a build carrying this code opens
+        // the database, and never moved after.
+        //
+        // It has to be persisted rather than taken from process start, or a
+        // restart would walk the line forward and strand a quote made minutes
+        // earlier under the same build. Invoices older than it keep their
+        // verify: a wallet polling one of those did not pay the invoice itself
+        // - that is why it is polling - so the preimage this mint holds is its
+        // only route to a note it already owns. Refusing those retroactively
+        // would not close a hole, it would burn somebody's money. They drain.
+        this.db
+            .prepare("INSERT OR IGNORE INTO meta (key, value) VALUES ('unnamed_verify_cutover', ?)")
+            .run(String(Date.now()));
+    }
+    // Invoices quoted at or after this instant get no verify if they named no
+    // output. See the migration above for why it is not simply "now".
+    unnamedVerifyCutover() {
+        const row = this.db
+            .prepare("SELECT value FROM meta WHERE key = 'unnamed_verify_cutover'")
+            .get();
+        return row ? Number(row.value) : 0;
     }
     tx(fn) {
         this.db.exec('BEGIN IMMEDIATE');
@@ -294,7 +317,7 @@ export class NoteStore {
     }
     mintInvoiceByHash(paymentHash) {
         const row = this.db
-            .prepare('SELECT payment_hash, pr, gross_msat, net_msat, settled, output_id FROM mint_invoices WHERE payment_hash = ?')
+            .prepare('SELECT payment_hash, pr, gross_msat, net_msat, settled, output_id, created_at FROM mint_invoices WHERE payment_hash = ?')
             .get(paymentHash);
         if (!row)
             return null;
@@ -304,7 +327,8 @@ export class NoteStore {
             grossMsat: row.gross_msat,
             netMsat: row.net_msat,
             settled: row.settled === 1,
-            outputId: row.output_id
+            outputId: row.output_id,
+            createdAt: row.created_at
         };
     }
     // The invoice a payer bound to this note id, if any. The lookup a claim
@@ -320,7 +344,7 @@ export class NoteStore {
     // expired invoices - so it is dead weight, and every /p/cb call adds one.
     unsettledMintInvoices() {
         const rows = this.db
-            .prepare('SELECT payment_hash, pr, gross_msat, net_msat, settled, output_id FROM mint_invoices WHERE settled = 0')
+            .prepare('SELECT payment_hash, pr, gross_msat, net_msat, settled, output_id, created_at FROM mint_invoices WHERE settled = 0')
             .all();
         return rows.map(row => ({
             paymentHash: row.payment_hash,
@@ -328,7 +352,8 @@ export class NoteStore {
             grossMsat: row.gross_msat,
             netMsat: row.net_msat,
             settled: false,
-            outputId: row.output_id
+            outputId: row.output_id,
+            createdAt: row.created_at
         }));
     }
     // Conditional on STILL unsettled: a settle landing between the sweep's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -32,6 +32,7 @@
   "files": [
     "dist",
     "web/dist",
+    "scripts/live-bound-mint-check.mjs",
     "LICENSE",
     "README.md",
     "CHANGELOG.md",
@@ -51,7 +52,8 @@
     "web:dev": "vite web",
     "web:build": "vite build web",
     "web:preview": "vite preview web",
-    "typecheck:web": "tsc -p web"
+    "typecheck:web": "tsc -p web",
+    "live:bound-mint": "npm run build && node scripts/live-bound-mint-check.mjs"
   },
   "dependencies": {
     "@noble/curves": "^2.3.0",

package/scripts/live-bound-mint-check.mjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+// A resumable, real-sats bound-mint release check.
+//
+// The payer command receives the mint invoice as its final argument. Its
+// stdout is intentionally ignored: lnd has emitted JSON and tables across
+// versions, while Moneyer's /verify response is the settlement proof that
+// matters. The refund command receives no added arguments and must print an
+// amountless BOLT11 invoice; Moneyer melts the whole test note back to it.
+import {spawnSync} from 'node:child_process'
+import {resolve} from 'node:path'
+import {runLiveBoundMintCheck} from '../dist/live-check.js'
+
+const usage = `usage:
+  npm run live:bound-mint -- \\
+    --pay-url https://mint.example/.well-known/lnurlp/mint \\
+    --amount-sat 56 \\
+    --state /secure/path/moneyer-live-check.json \\
+    --payer <command...> \\
+    --refund <command...>
+
+The payer command gets the BOLT11 invoice as its final argument. The refund
+command must emit a fresh amountless BOLT11 invoice on stdout. State is mode
+0600 and resumable; rerun the exact command after any interruption.`
+
+const failUsage = message => {
+  if (message) console.error(message)
+  console.error(usage)
+  process.exit(2)
+}
+
+const args = process.argv.slice(2)
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(usage)
+  process.exit(0)
+}
+
+const payerAt = args.indexOf('--payer')
+const refundAt = args.indexOf('--refund')
+if (payerAt < 0 || refundAt < 0 || refundAt <= payerAt) failUsage('Both --payer and --refund commands are required.')
+
+const optionArgs = args.slice(0, payerAt)
+const payerArgv = args.slice(payerAt + 1, refundAt)
+const refundArgv = args.slice(refundAt + 1)
+if (payerArgv.length === 0 || refundArgv.length === 0) failUsage('Command markers may not be empty.')
+
+const values = new Map()
+for (let index = 0; index < optionArgs.length; index += 2) {
+  const name = optionArgs[index]
+  const value = optionArgs[index + 1]
+  if (!name?.startsWith('--') || value === undefined) failUsage(`Invalid option near ${name ?? '(end)'}.`)
+  if (!['--pay-url', '--amount-sat', '--state', '--timeout-seconds'].includes(name)) failUsage(`Unknown option ${name}.`)
+  values.set(name, value)
+}
+
+const payUrl = values.get('--pay-url')
+const amountSat = Number(values.get('--amount-sat'))
+const stateValue = values.get('--state')
+const timeoutSeconds = values.has('--timeout-seconds') ? Number(values.get('--timeout-seconds')) : 60
+if (!payUrl || !stateValue) failUsage('--pay-url, --amount-sat and --state are required.')
+if (!Number.isSafeInteger(amountSat) || amountSat <= 0) failUsage('--amount-sat must be a positive whole number.')
+if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) failUsage('--timeout-seconds must be positive.')
+
+const runCommand = (argv, appended = []) => {
+  const [program, ...commandArgs] = argv
+  const result = spawnSync(program, [...commandArgs, ...appended], {
+    encoding: 'utf8',
+    maxBuffer: 4 * 1024 * 1024,
+    timeout: timeoutSeconds * 1000
+  })
+  if (result.error) throw result.error
+  if (result.status !== 0) {
+    const detail = result.stderr.trim().slice(0, 500)
+    throw new Error(`command exited ${result.status}${detail ? `: ${detail}` : ''}`)
+  }
+  return result.stdout
+}
+
+const statePath = resolve(stateValue)
+try {
+  const result = await runLiveBoundMintCheck({
+    payUrl,
+    grossMsat: amountSat * 1000,
+    statePath,
+    timeoutMs: timeoutSeconds * 1000,
+    payInvoice: async pr => {
+      // Deliberately do not parse or print this output. Settlement is proved
+      // independently by the invoice preimage and signed mint receipt.
+      runCommand(payerArgv, [pr])
+    },
+    createRefundInvoice: async () => runCommand(refundArgv),
+    log: message => console.error(`[live-check] ${message}`)
+  })
+  console.log(JSON.stringify(result, null, 2))
+} catch (error) {
+  console.error(`[live-check] ${error instanceof Error ? error.message : String(error)}`)
+  console.error(`[live-check] state retained at ${statePath}; rerun the exact command to resume`)
+  process.exitCode = 1
+}