@forgesworn/moneyer 0.18.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.19.0 - 2026-10-07
+
+- **A failed melt's invoice can be tried again.** Once the funding source
+  confirms a melt never paid, the note is restored as before, and now the
+  invoice is free again too: the payee is still waiting on it, so a wallet
+  can melt into it a second time, from the same note or a different one,
+  instead of asking for a fresh invoice. lnd sends a hash whose payment
+  failed again; a backend that refuses it restores the note, as for any
+  payment the node already holds. An invoice that paid, or whose melt is
+  still unresolved, is refused as before. The retry reuses the melt's row, so
+  `moneyer admin melts` and the restored count in the lifetime totals show
+  the latest attempt only.
+- lnd's "invoice is already paid" refusal, sent when a shared node paid the
+  hash between the mint's pre-check and its send, is now read as a payment
+  the node already holds, like its other two refusals. It used to fall
+  through as an ambiguous failure, which the payment tracker would then
+  have confirmed as paid against somebody else's payment, burning the note.
+
+## 0.18.1 - 2026-10-07
+
+- **Bound mint receipts verify in current wallets again.** Since
+  `@lnurlcash/kit` moved to taproot notes, a wallet checks a settled
+  `/verify` receipt's `mint.sig` as a `cs1` over the note's Q. moneyer still
+  sent a bare hex signature over the bearer `h`, which the kit drops as
+  unreadable, so a sealed signer could not confirm a note minted here. The
+  receipt now carries the note's ordinary certificate, and a quote or
+  receipt for a note named by its `cp1` repeats that `cp1` rather than the
+  hex of its Q, which a wallet would read as a bearer `h`.
+- `@lnurlcash/kit` 0.20.2. `moneyer admin verify-note` checks a certificate
+  over the note's Q, or over `sha256(k1)` for a bearer note certified before
+  that, and still reads a pre-`cs1` signature from a note URL's `sig`. The
+  mint page and the live bound-mint check name a quote by its bare `h`.
+
 ## 0.18.0 - 2026-10-07
 
 - **A melt that cannot leave is answered with its reason.** The callback

package/README.md

@@ -43,7 +43,9 @@ lesson, that behaviour is kept deliberately and tested.
   anything else is answered `OK` and finishes in the background. Burn only
   on confirmed payment, restore only on confirmed non-payment, and park
   everything else as pending for reconciliation - which also runs at
-  startup, so a crash mid-melt never guesses.
+  startup, so a crash mid-melt never guesses. An invoice whose melt was
+  restored may be melted into again, from that note or another; one that
+  paid or is still unresolved is refused.
 
 ## Run
 
@@ -420,10 +422,11 @@ The rules:
   true`, so a wallet knows this mint takes the parameter before it asks
   rather than after it pays.
 - When signing and LUD-21 verification are enabled, the quote also carries
-  `mint: {h, amount}`. This is the exact output and net millisatoshi value
-  the invoice will mint; it never carries `sig` before settlement.
+  `mint: {h, amount}`. This is the exact output, in the spelling the wallet
+  named it (a bearer note's hex `h`, or its `cp1`), and the net millisatoshi
+  value the invoice will mint; it never carries `sig` before settlement.
 - Once settled, `/verify` repeats the same `h` and `amount` and adds `sig`,
-  the ordinary LUD-25 signature over `LNURLcash:<amount>:<h>`. A sealed
+  the note's ordinary LUD-25 certificate: a `cs1` over its Q. A sealed
   signer can verify that receipt against the pre-payment commitment and
   pinned `mintPubkey`, then confirm its staged note without exporting `k1`.
 - Claiming needs nothing else. `GET /w?k1=<the secret>` brings the note
@@ -470,7 +473,8 @@ at `h`" alone would let anyone holding a burned `k1` and any outstanding
 note id draw a success out of the mint.
 
 The melt path is untouched: melts are deduplicated by payment hash, which
-is a different question with a different answer.
+is a different question with a different answer (a restored melt's
+invoice excepted - see the melt discipline above).
 
 This is moneyer's own behaviour. The LUD-25 draft says nothing about
 retries yet; the suggested wording is on lnurl/luds#301 as a SHOULD.

package/dist/admin.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
 import { secp256k1 } from '@noble/curves/secp256k1.js';
-import { noteDeclaredAmount, noteK1, noteSignature, verifyNoteSignature, verifyNoteSignatureHash } from '@lnurlcash/kit';
+import { encodeCs1WithAmount, hashK1, noteDeclaredAmount, noteK1, noteSignature, verifyNoteSignatureForKey } from '@lnurlcash/kit';
 import { decodeNote, decodeSpend } from "./spend.js";
 import { configFromEnv, pubkeyHex } from "./config.js";
 import { NoteStore } from "./store.js";
@@ -374,7 +374,20 @@ export const runAdmin = async (argv, deps = {}) => {
                 }
                 const id = bytesToHex(spend.outputKey);
                 const declared = noteDeclaredAmount(url);
-                const signature = noteSignature(url);
+                // `c` since the taproot unification; `sig` on a note URL from before.
+                let signature = noteSignature(url);
+                if (!signature) {
+                    try {
+                        signature = new URL(url).searchParams.get('sig');
+                    }
+                    catch { }
+                }
+                // The kit reads only a cs1 now. A certificate from before that was
+                // the bare 65-byte signature in hex, its amount on the URL beside
+                // it: put the amount back into a cs1 so it can still be checked.
+                if (signature && declared !== null && /^[0-9a-f]{130}$/i.test(signature)) {
+                    signature = encodeCs1WithAmount(declared, hexToBytes(signature));
+                }
                 const current = signingPubkey(config);
                 const keys = [...(current ? [current] : []), ...(config.previousSigningPubkeys ?? [])];
                 out(`note id  ${id}`);
@@ -387,9 +400,12 @@ export const runAdmin = async (argv, deps = {}) => {
                     out('signature present, but the URL declares no amount to check it against');
                 }
                 else {
-                    // Over Q, as LUD-25 certifies every note now, or over the note's
-                    // old id for a certificate issued before that.
-                    const signedBy = keys.find(pubkey => verifyNoteSignatureHash(id, declared, signature, pubkey) || verifyNoteSignature(k1, declared, signature, pubkey));
+                    // Over Q, as LUD-25 certifies every note now, or, for a bearer
+                    // note certified before that, over its old id sha256(k1). A key
+                    // note's old id was its key, which is Q already.
+                    const legacyId = spend.kind === 'script' && /^[0-9a-f]{64}$/i.test(k1.trim()) ? hashK1(k1.trim()) : null;
+                    const signedBy = keys.find(pubkey => verifyNoteSignatureForKey(id, declared, signature, pubkey) ||
+                        (legacyId !== null && verifyNoteSignatureForKey(legacyId, declared, signature, pubkey)));
                     out(signedBy === undefined
                         ? 'signature DOES NOT verify against this mint'
                         : `signature verifies against ${signedBy === current ? 'the current key' : `a previous key (${signedBy})`}`);

package/dist/backends/fake.js

@@ -65,8 +65,10 @@ export const createFakeBackend = (options = {}) => {
             if (!paymentHashHex)
                 throw new PaymentFailedError('That is not a decodable invoice.');
             // Real nodes dedupe sends by payment hash: a hash this node already
-            // holds a payment for is refused, exactly as lnd and cln refuse it.
-            if (payments.has(paymentHashHex)) {
+            // paid, or is still paying, is refused exactly as lnd and cln refuse
+            // it. One whose every attempt failed may be sent again, as on both.
+            const earlier = payments.get(paymentHashHex);
+            if (earlier && earlier.status !== 'failed') {
                 throw new PaymentAlreadyKnownError('this node already has a payment for that hash');
             }
             const preimageHex = knownPreimages.get(paymentHashHex) ?? null;

package/dist/backends/lnd.js

@@ -122,7 +122,10 @@ export const createLndBackend = (config) => {
                 // lnd refuses a send whose payment hash it already holds - on a
                 // shared node that is somebody else's payment, and nothing went
                 // out for THIS call. Distinct from ambiguity: safely restorable.
-                if (error && /already exists|AlreadyExists|payment is in transition/i.test(error)) {
+                // Its three refusals (lnd 0.20, payments/db/errors.go): one being
+                // created, one in flight, one that succeeded. A hash whose payment
+                // failed is not refused - lnd sends it again.
+                if (error && /already exists|AlreadyExists|payment is in transition|invoice is already paid/i.test(error)) {
                     throw new PaymentAlreadyKnownError('lnd already has a payment for this hash');
                 }
                 // The stream ended without a terminal status - genuinely ambiguous.

package/dist/live-check.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { lstat, open, readFile, rename, unlink } from 'node:fs/promises';
 import { decodeBolt11 } from 'farrier-kit/bolt11';
-import { NoteSpentError, PendingNoteError, buildNoteUrl, decodeBolt11AmountMsat, fetchInvoiceVerification, fetchPayRequest, hashK1, isBolt11Invoice, isPreimage, meltNote, probeBurnedNote, requestInvoice, requireBoundMintQuote, validateBoundMintReceipt, withinMintFeeBand } from '@lnurlcash/kit';
+import { NoteSpentError, PendingNoteError, buildNoteUrl, decodeBolt11AmountMsat, fetchInvoiceVerification, fetchPayRequest, hashK1, isBolt11Invoice, isPreimage, meltNote, probeBurnedNote, requestInvoiceShort, requireBoundMintQuote, validateBoundMintReceipt, withinMintFeeBand } from '@lnurlcash/kit';
 import { claimMintedNote } from "./claim.js";
 const stages = new Set(['prepared', 'quoted', 'settled', 'claimed', 'retiring', 'retired']);
 const errno = (error) => error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
@@ -216,7 +216,9 @@ export const runLiveBoundMintCheck = async (options) => {
         if (state.grossMsat < pay.minSendable || state.grossMsat > pay.maxSendable) {
             throw new Error(`Test amount is outside the mint range ${pay.minSendable}-${pay.maxSendable} msat.`);
         }
-        const quote = await requestInvoice(pay.callback, state.grossMsat, state.h);
+        // Named by the bare h, which the kit reads as a bearer note's h and
+        // normalises to its Q on both sides of the comparison below.
+        const quote = await requestInvoiceShort(pay.callback, state.grossMsat, state.h);
         if (!quote.verify || !quote.mint)
             throw new Error('Mint did not bind this quote to h and a verification URL.');
         const netMsat = quote.mint.amountMsat;

package/dist/server.js

@@ -3,9 +3,9 @@ import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
 import { finalizeEvent } from 'nostr-tools/pure';
 import { applyMintFee, encodeCs1WithAmount, grossUpForMintFee, hashK1 } from '@lnurlcash/kit';
 import { tryDecodeBolt11 } from 'farrier-kit/bolt11';
-import { NotePendingError, NoteStore, NoteUnavailableError, OutputCollisionError, swapFingerprint } from "./store.js";
+import { InvoiceUsedError, NotePendingError, NoteStore, NoteUnavailableError, OutputCollisionError, swapFingerprint } from "./store.js";
 import { createNoteSigner } from "./signing.js";
-import { bearerNoteId, decodeNote, decodeSpend, spendDomainOf, verifySpend } from "./spend.js";
+import { bearerNoteId, decodeNote, decodeSpend, encodeCp1, spendDomainOf, verifySpend } from "./spend.js";
 import { createKernelVerifier } from "./kernel.js";
 import { describeFee } from "./fee-words.js";
 import { createFakeBackend } from "./backends/fake.js";
@@ -25,6 +25,10 @@ const namedRef = (value) => {
     const q = decodeNote(value);
     return q ? { q, named: HEX32.test(value) ? value : q } : null;
 };
+// The name a quote or receipt repeats back, in the spelling the wallet used.
+// A wallet reads bare hex there as a bearer note's h, so a note named by its
+// cp1 has to come back as that cp1, never as the hex of its Q.
+const echoedName = (q, named) => (named === q ? encodeCp1(hexToBytes(q)) : named);
 const INVALID_K1 = 'Invalid or already spent k1.';
 // LUD-25's own reason for an output that names a note already credited.
 const IN_USE = 'already in use';
@@ -839,7 +843,7 @@ export const createMoneyer = async (config, deps = {}) => {
                 // value this invoice will mint. It is only offered when /verify can
                 // later authenticate settlement with this mint's signing key.
                 ...(config.verify && signer
-                    ? { mint: { h: commentRef.named, amount: net } }
+                    ? { mint: { h: echoedName(commentRef.q, commentRef.named), amount: net } }
                     : {}),
                 // Every current-draft mint quote is comment-bound, so the LUD-21
                 // preimage is ordinary settlement proof and safe to disclose after
@@ -879,19 +883,21 @@ export const createMoneyer = async (config, deps = {}) => {
                     preimage: preimageHex,
                     pr: invoice.pr,
                     // Repeating h and amount binds this response to the quote. The
-                    // ordinary note signature appears only once value exists at h.
-                    // The receipt signs exactly the `h` it repeats - what the wallet
-                    // named, a bearer note's h or a cp1's Q - since that is what a
-                    // receipt validator checks it over. The note's own certificate,
-                    // the cs1 over its Q, comes from the withdraw endpoint.
+                    // signature appears only once value exists there, and it is the
+                    // note's ordinary certificate: a cs1 over its Q, which is what a
+                    // receipt validator derives from the repeated name and checks.
+                    // A quote from before notes were keyed by Q stored the bearer h
+                    // as its output and no separate name.
                     ...(currentInvoice.outputId !== null && signer
                         ? (() => {
+                            const legacy = currentInvoice.outputNamed === null;
+                            const q = legacy ? bearerNoteId(currentInvoice.outputId) : currentInvoice.outputId;
                             const named = currentInvoice.outputNamed ?? currentInvoice.outputId;
                             return {
                                 mint: {
-                                    h: named,
+                                    h: echoedName(q, named),
                                     amount: currentInvoice.netMsat,
-                                    ...(settled ? { sig: signer.sign(named, currentInvoice.netMsat) } : {})
+                                    ...(settled ? { sig: certify(q, currentInvoice.netMsat) } : {})
                                 }
                             };
                         })()
@@ -1131,8 +1137,14 @@ export const createMoneyer = async (config, deps = {}) => {
                 }
                 // The funding source dedupes payments by hash, so a second melt
                 // into the same invoice would be "confirmed" against the first
-                // payment and burn its note without moving funds.
-                if (store.meltByHash(paymentHash)) {
+                // payment and burn its note without moving funds. A melt that was
+                // restored is the exception: the funding source confirmed it never
+                // paid, lnd sends a hash whose payment failed again (it refuses
+                // only one being created, in flight or paid), and the payee is
+                // still waiting on that invoice. A backend that refuses anyway
+                // throws PaymentAlreadyKnownError and the note restores.
+                const earlier = store.meltByHash(paymentHash);
+                if (earlier && earlier.outcome !== 'restored') {
                     return fail('Invoice already used by an earlier melt - use a fresh one.');
                 }
                 // A shared funding source is a supported deployment (DEPLOY.md),
@@ -1161,7 +1173,10 @@ export const createMoneyer = async (config, deps = {}) => {
                         return fail('pending');
                     if (err instanceof NoteUnavailableError)
                         return fail(INVALID_K1);
-                    return fail('Invoice already used by an earlier melt - use a fresh one.');
+                    if (err instanceof InvoiceUsedError)
+                        return fail('Invoice already used by an earlier melt - use a fresh one.');
+                    log(`melt reservation failed: ${err.message}`);
+                    return fail('Temporarily unable to melt - try again shortly.');
                 }
                 inFlight.add(paymentHash);
                 const melt = runMelt({

package/dist/store.d.ts

@@ -82,6 +82,8 @@ export declare class NoteUnavailableError extends Error {
 }
 export declare class OutputCollisionError extends Error {
 }
+export declare class InvoiceUsedError extends Error {
+}
 export declare class NoteStore {
     private db;
     readonly readOnly: boolean;

package/dist/store.js

@@ -30,6 +30,10 @@ export class NoteUnavailableError extends Error {
 // can learn that id's preimage take the output.
 export class OutputCollisionError extends Error {
 }
+// An earlier melt into this invoice paid it, or has not yet resolved. Only
+// one the funding source confirmed never paid may be melted into again.
+export class InvoiceUsedError extends Error {
+}
 export class NoteStore {
     db;
     readOnly;
@@ -329,14 +333,22 @@ export class NoteStore {
         return parsed.map(([id, amountMsat]) => ({ id, amountMsat }));
     }
     // Reserves a note for a melt and records the melt, atomically. The melts
-    // row is keyed by the invoice's payment hash; a duplicate hash means an
-    // earlier melt already used this invoice and the INSERT itself refuses.
+    // row is keyed by the invoice's payment hash. An earlier melt into the
+    // same invoice may be retried only once it was restored - the funding
+    // source confirmed nothing went out - and the retry takes over its row.
+    // One that paid, or is still unresolved, refuses the reservation.
     markPending(noteId, paymentHash, pr, amountMsat) {
         this.tx(() => {
             this.assertOutstanding(noteId);
-            this.db
-                .prepare('INSERT INTO melts (payment_hash, note_id, pr, amount_msat, outcome, created_at) VALUES (?, ?, ?, ?, NULL, ?)')
+            const written = this.db
+                .prepare(`INSERT INTO melts (payment_hash, note_id, pr, amount_msat, outcome, created_at) VALUES (?, ?, ?, ?, NULL, ?)
+           ON CONFLICT (payment_hash) DO UPDATE SET
+             note_id = excluded.note_id, pr = excluded.pr, amount_msat = excluded.amount_msat,
+             outcome = NULL, created_at = excluded.created_at, resolved_at = NULL
+           WHERE melts.outcome = 'restored'`)
                 .run(paymentHash, noteId, pr, amountMsat, Date.now());
+            if (written.changes !== 1)
+                throw new InvoiceUsedError('an earlier melt already used this invoice');
             this.setNoteState(noteId, 'pending');
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -74,7 +74,7 @@
     "live:bound-mint": "npm run build && node scripts/live-bound-mint-check.mjs"
   },
   "dependencies": {
-    "@lnurlcash/kit": "0.18.1",
+    "@lnurlcash/kit": "0.20.2",
     "@noble/curves": "^2.3.0",
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^1.2.4",