@forgesworn/moneyer 0.18.1 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.19.0 - 2026-10-07
+
+- **A failed melt's invoice can be tried again.** Once the funding source
+  confirms a melt never paid, the note is restored as before, and now the
+  invoice is free again too: the payee is still waiting on it, so a wallet
+  can melt into it a second time, from the same note or a different one,
+  instead of asking for a fresh invoice. lnd sends a hash whose payment
+  failed again; a backend that refuses it restores the note, as for any
+  payment the node already holds. An invoice that paid, or whose melt is
+  still unresolved, is refused as before. The retry reuses the melt's row, so
+  `moneyer admin melts` and the restored count in the lifetime totals show
+  the latest attempt only.
+- lnd's "invoice is already paid" refusal, sent when a shared node paid the
+  hash between the mint's pre-check and its send, is now read as a payment
+  the node already holds, like its other two refusals. It used to fall
+  through as an ambiguous failure, which the payment tracker would then
+  have confirmed as paid against somebody else's payment, burning the note.
+
 ## 0.18.1 - 2026-10-07
 
 - **Bound mint receipts verify in current wallets again.** Since

package/README.md

@@ -43,7 +43,9 @@ lesson, that behaviour is kept deliberately and tested.
   anything else is answered `OK` and finishes in the background. Burn only
   on confirmed payment, restore only on confirmed non-payment, and park
   everything else as pending for reconciliation - which also runs at
-  startup, so a crash mid-melt never guesses.
+  startup, so a crash mid-melt never guesses. An invoice whose melt was
+  restored may be melted into again, from that note or another; one that
+  paid or is still unresolved is refused.
 
 ## Run
 
@@ -471,7 +473,8 @@ at `h`" alone would let anyone holding a burned `k1` and any outstanding
 note id draw a success out of the mint.
 
 The melt path is untouched: melts are deduplicated by payment hash, which
-is a different question with a different answer.
+is a different question with a different answer (a restored melt's
+invoice excepted - see the melt discipline above).
 
 This is moneyer's own behaviour. The LUD-25 draft says nothing about
 retries yet; the suggested wording is on lnurl/luds#301 as a SHOULD.

package/dist/backends/fake.js

@@ -65,8 +65,10 @@ export const createFakeBackend = (options = {}) => {
             if (!paymentHashHex)
                 throw new PaymentFailedError('That is not a decodable invoice.');
             // Real nodes dedupe sends by payment hash: a hash this node already
-            // holds a payment for is refused, exactly as lnd and cln refuse it.
-            if (payments.has(paymentHashHex)) {
+            // paid, or is still paying, is refused exactly as lnd and cln refuse
+            // it. One whose every attempt failed may be sent again, as on both.
+            const earlier = payments.get(paymentHashHex);
+            if (earlier && earlier.status !== 'failed') {
                 throw new PaymentAlreadyKnownError('this node already has a payment for that hash');
             }
             const preimageHex = knownPreimages.get(paymentHashHex) ?? null;

package/dist/backends/lnd.js

@@ -122,7 +122,10 @@ export const createLndBackend = (config) => {
                 // lnd refuses a send whose payment hash it already holds - on a
                 // shared node that is somebody else's payment, and nothing went
                 // out for THIS call. Distinct from ambiguity: safely restorable.
-                if (error && /already exists|AlreadyExists|payment is in transition/i.test(error)) {
+                // Its three refusals (lnd 0.20, payments/db/errors.go): one being
+                // created, one in flight, one that succeeded. A hash whose payment
+                // failed is not refused - lnd sends it again.
+                if (error && /already exists|AlreadyExists|payment is in transition|invoice is already paid/i.test(error)) {
                     throw new PaymentAlreadyKnownError('lnd already has a payment for this hash');
                 }
                 // The stream ended without a terminal status - genuinely ambiguous.

package/dist/server.js

@@ -3,7 +3,7 @@ import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
 import { finalizeEvent } from 'nostr-tools/pure';
 import { applyMintFee, encodeCs1WithAmount, grossUpForMintFee, hashK1 } from '@lnurlcash/kit';
 import { tryDecodeBolt11 } from 'farrier-kit/bolt11';
-import { NotePendingError, NoteStore, NoteUnavailableError, OutputCollisionError, swapFingerprint } from "./store.js";
+import { InvoiceUsedError, NotePendingError, NoteStore, NoteUnavailableError, OutputCollisionError, swapFingerprint } from "./store.js";
 import { createNoteSigner } from "./signing.js";
 import { bearerNoteId, decodeNote, decodeSpend, encodeCp1, spendDomainOf, verifySpend } from "./spend.js";
 import { createKernelVerifier } from "./kernel.js";
@@ -1137,8 +1137,14 @@ export const createMoneyer = async (config, deps = {}) => {
                 }
                 // The funding source dedupes payments by hash, so a second melt
                 // into the same invoice would be "confirmed" against the first
-                // payment and burn its note without moving funds.
-                if (store.meltByHash(paymentHash)) {
+                // payment and burn its note without moving funds. A melt that was
+                // restored is the exception: the funding source confirmed it never
+                // paid, lnd sends a hash whose payment failed again (it refuses
+                // only one being created, in flight or paid), and the payee is
+                // still waiting on that invoice. A backend that refuses anyway
+                // throws PaymentAlreadyKnownError and the note restores.
+                const earlier = store.meltByHash(paymentHash);
+                if (earlier && earlier.outcome !== 'restored') {
                     return fail('Invoice already used by an earlier melt - use a fresh one.');
                 }
                 // A shared funding source is a supported deployment (DEPLOY.md),
@@ -1167,7 +1173,10 @@ export const createMoneyer = async (config, deps = {}) => {
                         return fail('pending');
                     if (err instanceof NoteUnavailableError)
                         return fail(INVALID_K1);
-                    return fail('Invoice already used by an earlier melt - use a fresh one.');
+                    if (err instanceof InvoiceUsedError)
+                        return fail('Invoice already used by an earlier melt - use a fresh one.');
+                    log(`melt reservation failed: ${err.message}`);
+                    return fail('Temporarily unable to melt - try again shortly.');
                 }
                 inFlight.add(paymentHash);
                 const melt = runMelt({

package/dist/store.d.ts

@@ -82,6 +82,8 @@ export declare class NoteUnavailableError extends Error {
 }
 export declare class OutputCollisionError extends Error {
 }
+export declare class InvoiceUsedError extends Error {
+}
 export declare class NoteStore {
     private db;
     readonly readOnly: boolean;

package/dist/store.js

@@ -30,6 +30,10 @@ export class NoteUnavailableError extends Error {
 // can learn that id's preimage take the output.
 export class OutputCollisionError extends Error {
 }
+// An earlier melt into this invoice paid it, or has not yet resolved. Only
+// one the funding source confirmed never paid may be melted into again.
+export class InvoiceUsedError extends Error {
+}
 export class NoteStore {
     db;
     readOnly;
@@ -329,14 +333,22 @@ export class NoteStore {
         return parsed.map(([id, amountMsat]) => ({ id, amountMsat }));
     }
     // Reserves a note for a melt and records the melt, atomically. The melts
-    // row is keyed by the invoice's payment hash; a duplicate hash means an
-    // earlier melt already used this invoice and the INSERT itself refuses.
+    // row is keyed by the invoice's payment hash. An earlier melt into the
+    // same invoice may be retried only once it was restored - the funding
+    // source confirmed nothing went out - and the retry takes over its row.
+    // One that paid, or is still unresolved, refuses the reservation.
     markPending(noteId, paymentHash, pr, amountMsat) {
         this.tx(() => {
             this.assertOutstanding(noteId);
-            this.db
-                .prepare('INSERT INTO melts (payment_hash, note_id, pr, amount_msat, outcome, created_at) VALUES (?, ?, ?, ?, NULL, ?)')
+            const written = this.db
+                .prepare(`INSERT INTO melts (payment_hash, note_id, pr, amount_msat, outcome, created_at) VALUES (?, ?, ?, ?, NULL, ?)
+           ON CONFLICT (payment_hash) DO UPDATE SET
+             note_id = excluded.note_id, pr = excluded.pr, amount_msat = excluded.amount_msat,
+             outcome = NULL, created_at = excluded.created_at, resolved_at = NULL
+           WHERE melts.outcome = 'restored'`)
                 .run(paymentHash, noteId, pr, amountMsat, Date.now());
+            if (written.changes !== 1)
+                throw new InvoiceUsedError('an earlier melt already used this invoice');
             this.setNoteState(noteId, 'pending');
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",