@forgesworn/moneyer 0.17.0 → 0.17.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.17.1 - 2026-10-06
+
+- **The expiry sweep no longer deletes paid mint invoices.** A mint invoice
+  was recorded as paid only when a wallet came back to `/verify` or to
+  claim its note, and the sweep deleted every unrecorded one an hour past
+  its expiry. A payer whose wallet never came back lost the payment: the
+  funding source kept the money and the note's id went with the row. The
+  sweep, and `moneyer admin sweep`, now ask the funding source first. Paid,
+  the invoice is settled and its note minted; unpaid, the row goes; no
+  answer, the row stays.
+- **lnd: a refused invoice lookup is no longer read as unpaid.** Only a 404
+  (an invoice lnd does not hold) now means unpaid; any other non-2xx throws.
+  A transient lnd error on `/verify` now returns an error instead of "not
+  paid yet".
+
 ## 0.17.0 - 2026-09-26
 
 LUD-25's unified taproot model (lnurl/luds 6e865b1). Every note is now a

package/README.md

@@ -703,7 +703,7 @@ path should not silently create an empty database to answer from.
 | `note <id\|k1>` | one note; 64 hex that names no note is hashed and looked up as the secret |
 | `melts [--pending]` | list melts |
 | `reconcile` | one pending-melt reconcile pass, printing what changed |
-| `sweep` | delete mint invoices whose expiry is provably past |
+| `sweep` | delete expired mint invoices the funding source confirms unpaid, and mint the notes of any it finds paid |
 | `snapshot <path>` | a consistent copy of the database, taken live, refusing to overwrite |
 | `names list\|add <name> <npub>\|rm <name>` | the lightning addresses this mint pays out as notes |
 | `keys rotate` | generate a signing key and print the two environment lines; writes nothing |
@@ -735,8 +735,9 @@ is not.
   Whether that is a channel imbalance or something worse, it is the one
   number a custodial mint must never be relaxed about.
 - **unsettled invoices growing.** Invoices are issued and never paid all
-  day, and the sweep clears the expired ones. A count that climbs through
-  a sweep means invoices are being issued that nobody can pay.
+  day, and the sweep clears the expired ones the funding source confirms
+  unpaid. A count that climbs through a sweep means invoices are being
+  issued that nobody can pay, or that the funding source is not answering.
 
 ## Testing
 

package/THREAT-MODEL.md

@@ -147,9 +147,9 @@ is what notecase and lnurl-wallet do.
 - No rate limiting is built in; put it at the proxy. This matters most for
   `/p/cb`: each unauthenticated call creates a real invoice at the funding
   source. moneyer sweeps its own unsettled invoices once their bolt11
-  expiry has passed, but the node's side of that growth is the operator's
-  to bound (cln's autoclean, or an equivalent cron) - and a proxy limit is
-  what keeps the RPC pile-up and the node database from growing at all.
+  expiry has passed and the funding source confirms them unpaid, but the
+  node's side of that growth is the operator's to bound (cln's autoclean,
+  or an equivalent cron) - and a proxy limit is what keeps the RPC pile-up and the node database from growing at all.
 - A fee-free configuration pays the melt routing-fee floor (0.5% of the
   amount or 5000 msat) out of its own channel balance, and mint-and-melt
   cycling costs a griefer nothing. Set `MONEYER_BASE_FEE_MSAT` to cover the

package/dist/admin.js

@@ -18,7 +18,7 @@ const COMMANDS = [
     ['note <id|k1>', 'one note, by id or by the secret itself'],
     ['melts [--pending]', 'list melts, newest first'],
     ['reconcile', 'resolve melts left in flight, and say what changed'],
-    ['sweep', 'delete mint invoices whose expiry is provably past'],
+    ['sweep', 'delete expired mint invoices the funding source confirms unpaid'],
     ['snapshot <path>', 'a consistent copy of the database, taken live'],
     ['names list|add <name> <npub>|rm <name>', 'the lightning addresses this mint pays out as notes'],
     ['keys rotate', 'generate a signing key and print the two env lines'],
@@ -271,8 +271,10 @@ export const runAdmin = async (argv, deps = {}) => {
                 return 0;
             }
             case 'sweep': {
-                const swept = sweepExpiredMintInvoices(store, now());
+                const { swept, settled } = await sweepExpiredMintInvoices(store, fundingSource(), now());
                 out(`swept ${swept} expired mint invoice${swept === 1 ? '' : 's'}`);
+                if (settled > 0)
+                    out(`found ${settled} paid after all - note${settled === 1 ? '' : 's'} minted`);
                 return 0;
             }
             case 'snapshot': {

package/dist/backends/lnd.js

@@ -158,9 +158,16 @@ export const createLndBackend = (config) => {
                 throw new Error('lnd did not report a payment status.');
             return result;
         },
+        // 404 is lnd's answer for an invoice it does not hold, which can never
+        // settle. Any other refusal is no answer at all, and reading it as
+        // "unpaid" would let the expiry sweep delete a paid invoice's row.
         async isInvoiceSettled(paymentHashHex) {
             const res = await json(`/v1/invoice/${paymentHashHex}`);
-            return res.ok && Boolean(res.json?.settled);
+            if (res.status === 404)
+                return false;
+            if (!res.ok)
+                throw new Error(`lnd invoice lookup failed: HTTP ${res.status}`);
+            return Boolean(res.json?.settled);
         },
         async invoicePreimage(paymentHashHex) {
             const res = await json(`/v1/invoice/${paymentHashHex}`);

package/dist/server.d.ts

@@ -33,4 +33,7 @@ export type MoneyerDeps = {
 };
 export { describeFee } from './fee-words.ts';
 export declare const createMoneyer: (config: MoneyerConfig, deps?: MoneyerDeps) => Promise<Moneyer>;
-export declare const sweepExpiredMintInvoices: (store: NoteStore, nowMs?: number) => number;
+export declare const sweepExpiredMintInvoices: (store: NoteStore, backend: Pick<LightningBackend, "isInvoiceSettled">, nowMs?: number) => Promise<{
+    swept: number;
+    settled: number;
+}>;

package/dist/server.js

@@ -1262,9 +1262,12 @@ export const createMoneyer = async (config, deps = {}) => {
     // otherwise grow by one dead row per /p/cb call forever. The timer is
     // unref'd so it never keeps the process alive.
     const housekeeping = async () => {
-        const swept = sweepExpiredMintInvoices(store) + (zap?.sweep() ?? 0);
+        const { swept: mintSwept, settled } = await sweepExpiredMintInvoices(store, backend);
+        const swept = mintSwept + (zap?.sweep() ?? 0);
         if (swept > 0)
             log(`swept ${swept} expired mint invoice${swept === 1 ? '' : 's'}`);
+        if (settled > 0)
+            log(`found ${settled} expired mint invoice${settled === 1 ? '' : 's'} paid after all - note${settled === 1 ? '' : 's'} minted`);
         await reconcilePendingMelts(store, backend, inFlight, log);
         reconciledAt = Date.now();
     };
@@ -1337,15 +1340,25 @@ export const createMoneyer = async (config, deps = {}) => {
         }
     };
 };
-// Deletes unsettled mint invoices whose bolt11 expiry is comfortably past,
-// returning the count swept. The invoice's own timestamp + expiry are the
-// proof - a funding source refuses to settle an expired invoice, so the
-// row can never mint a note again. The hour's margin keeps the delete
-// unambiguously behind every implementation's reading of that expiry, and
-// an undecodable invoice is kept: no proof, no delete. The delete itself is
-// conditional on the row still being unsettled, so a settle racing the
-// sweep always wins.
-export const sweepExpiredMintInvoices = (store, nowMs = Date.now()) => {
+// Clears mint invoices this mint has not seen paid once their bolt11 expiry
+// is comfortably past, returning how many it deleted and how many it found
+// paid after all.
+//
+// "Unsettled" here is only this mint's record. A payment is recorded when a
+// wallet comes back to /verify or to claim its note, so a payer whose wallet
+// never comes back - a closed tab, an invoice paid from another app - leaves
+// a row that reads unsettled while the funding source holds the money.
+// Deleting that row would strand the payment for good: the note's id lives
+// only here. So the funding source is asked first. Paid, the invoice is
+// settled and its note minted, exactly as a /verify would have. Unpaid, the
+// expiry is the proof it never can be, and the row goes. No answer, no
+// delete.
+//
+// The hour's margin keeps the delete unambiguously behind every
+// implementation's reading of that expiry, an undecodable invoice is kept,
+// and the delete is conditional on the row still being unsettled, so a
+// settle racing the sweep always wins.
+export const sweepExpiredMintInvoices = async (store, backend, nowMs = Date.now()) => {
     const stale = [];
     for (const invoice of store.unsettledMintInvoices()) {
         const decoded = tryDecodeBolt11(invoice.pr);
@@ -1355,7 +1368,24 @@ export const sweepExpiredMintInvoices = (store, nowMs = Date.now()) => {
         if (nowMs > expiresAtMs + 3_600_000)
             stale.push(invoice.paymentHash);
     }
-    for (const paymentHash of stale)
-        store.deleteUnsettledMintInvoice(paymentHash);
-    return stale.length;
+    let swept = 0;
+    let settled = 0;
+    for (const paymentHash of stale) {
+        let paid;
+        try {
+            paid = await backend.isInvoiceSettled(paymentHash);
+        }
+        catch {
+            continue;
+        }
+        if (paid) {
+            store.settleMintInvoice(paymentHash);
+            settled++;
+        }
+        else {
+            store.deleteUnsettledMintInvoice(paymentHash);
+            swept++;
+        }
+    }
+    return { swept, settled };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",