@forgesworn/moneyer 0.11.1 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.13.0 - 2026-09-11
+
+- **Names that pay to the holder's own keys.** `POST /names` takes a `cx1`,
+  a watch-only branch, and the key that owns a name can set or clear one
+  later. A zap to such a name is credited to the holder's next key on the
+  branch, and the gift wrap carries only where to look and the index:
+  `/w?p=<cp1>&amount=&sig=<cs1>&i=`, plus an `i` tag. The mint never holds
+  a secret for it.
+- The index is taken when the zap settles, never when the invoice is made,
+  so an unpaid invoice leaves no gap in the holder's scan. A key that
+  already holds a note is skipped.
+- Names gain two columns, `cx1` and `next_index`, added in place on first
+  start.
+
+## 0.12.0 - 2026-09-11
+
+- LUD-25's renamed parameters are accepted: `p` for the informational
+  GET's hash lookup, `p1`/`p2` for the callback's outputs. The old names
+  `h` and `h`/`h2` keep working, and a wallet may mix them in one request.
+  Sending both spellings of one value with different contents is refused.
+  A retry is matched on the outputs, not the spelling, so a split first
+  sent as `h`/`h2` and retried as `p1`/`p2` is answered as a replay.
+- The callback's missing-output reasons are now `missing p1` and
+  `missing p2` (were `missing h`/`missing h2`), and `p1 and p2 must
+  differ.` The pay callback's `missing h` is unchanged.
+- **LUD-25 Part 2 notes.** A note can be keyed by a public key and spent
+  with a recoverable signature, so the mint never holds anything that could
+  spend it. `comment=cp1…` mints one; `k1=ck1…` looks it up or spends it;
+  `p`, `p1` and `p2` take `cp1` keys; and a Part 2 note's certificate comes
+  back as `cs1`, on the lookup and on every rotate, split and merge. The two
+  kinds mix freely in one merge.
+- A note named twice in one request is now caught by the note each `k1`
+  spends rather than by the `k1` string, since one Part 2 note has many
+  valid `ck1` strings. The store refuses a repeated input as well.
+- Takes lnurlcash-kit 0.10.0.
+
 ## 0.11.1 - 2026-09-07
 
 - Hash lookups report `Note already spent.` for retained burned notes,
@@ -9,6 +45,9 @@
   burned rows are retained already; no database migration is required.
 - Test tooling uses an immutable conformance commit matching this response
   contract. It is a development dependency, not a runtime dependency.
+  Since 2026-09-09 that contract is released as `lnurlcash-conformance`
+  0.8.0 and the pin is the version rather than the commit; the graded bytes
+  are the same ones 0.11.1 shipped against.
 
 ## 0.11.0 - 2026-09-06
 

package/README.md

@@ -344,6 +344,21 @@ preimage then buys nothing: it is an ordinary payment proof, which is why
 there is no race left to run, and no window in which holding the invoice
 is nearly holding the money.
 
+### Or name it by a key (LUD-25 Part 2)
+
+The comment can instead be `cp1<pk>`, a public key. The note is keyed by
+that key and spent with `ck1`, a recoverable signature by its private key,
+so the mint never sees anything that could spend it. Everywhere a note is
+named or spent, the two kinds mix freely:
+
+- `GET /w?k1=<ck1>` or `GET /w?p=<cp1>` looks a Part 2 note up, and the
+  answer carries `sig`, the mint's certificate for it as `cs1`.
+- `p1`/`p2` on the callback may be `cp1` keys, and the matching `sig`/`sig2`
+  come back as `cs1`. A hash output still gets a plain hex signature.
+- A merge may combine Part 1 secrets and Part 2 `ck1`s in one request.
+
+A recipient checks a Part 2 note offline from its `ck1` and `cs1` alone.
+
 Moneyer's earlier `mintToHash` extension remains additive. A compatible
 wallet repeats the same commitment as `h`; it does not replace `comment`:
 
@@ -416,9 +431,10 @@ signatures, nothing burned, nothing minted, no balance moved. A retry is
 a read.
 
 A request is the same request when it names the same input notes and asks
-for the same outputs: the same `h`, the same `h2`, the same `amount`.
+for the same outputs: the same `p1`, the same `p2`, the same `amount`.
 Input order does not matter, because a reordered retry is the same
-operation. Anything else naming a burned note is a double-spend attempt
+operation, and nor does spelling: `h`/`h2`, the older names for
+`p1`/`p2`, name the same outputs. Anything else naming a burned note is a double-spend attempt
 and still gets `Invalid or already spent k1.`, unchanged. Provenance is
 recorded rather than inferred for that reason: matching on "a note exists
 at `h`" alone would let anyone holding a burned `k1` and any outstanding
@@ -526,6 +542,28 @@ A registered name resolves on both rails at once:
 The discovery endpoint advertises `namePriceMsat` while registration is
 open, so a wallet can offer the flow without asking.
 
+### A name that pays to your own keys (LUD-25 Part 2)
+
+Add `"cx1": "cx1..."` to the registration body, or send `{"name", "cx1"}`
+again later from the key that owns the name, and payments to it stop being
+custodial. A `cx1` is a watch-only branch: from it the mint can work out each
+of the holder's note keys in turn, but never spend one.
+
+When a zap to the name settles, the mint takes the next index on the branch
+and credits the note to that key. It skips any key already holding a note,
+and an invoice nobody pays takes no index at all, so a wallet scanning its
+branch never meets a gap it did not make. The gift wrap still goes to the
+owner's npub, but it carries no secret: a lookup URL,
+`https://mint.example/w?p=<cp1>&amount=<msat>&sig=<cs1>&i=<index>`, plus an
+`i` tag. The wallet derives the key at that index, checks the certificate,
+and spends with its own `ck1`. A wallet that only knows note URLs sees no
+`k1` and passes the wrap by, and the note waits at the mint for a scan of the
+branch.
+
+`"cx1": null` clears the branch and puts the name back on the custodial path.
+Sending a new branch starts it at index 0; sending the same one again keeps
+its place. Zap receipts are unchanged.
+
 ## Reaching the mint over Tor
 
 Set `MONEYER_ONION_URL` to this mint's hidden service address and a request
@@ -586,11 +624,11 @@ clearnet.
 | `/.well-known/lnurlp/<user>` | LUD-16 payRequest; paying mints a note |
 | `/.well-known/lnurlp/<zap name>` | NIP-57 payRequest; paying mints a note *to the name's pubkey* |
 | `/.well-known/lnurlw/<user>` | LUD-25 mint address discovery (experimental) |
-| `/p/cb` | LUD-06 pay callback; issues the mint invoice, and takes an optional `h` naming the note |
+| `/p/cb` | LUD-06 pay callback; issues the mint invoice for the note the `comment` names, a hash or a `cp1` key (`h` is an older spelling for a hash) |
 | `/z/cb/<zap name>` | the zap callback; validates the kind 9734 and issues the invoice |
 | `/verify/<hash>` | LUD-21 verify, for mint invoices and melt payments |
-| `/w` | LUD-03 informational GET; accepts `k1` or the non-disclosing LUD-25 `h=sha256(k1)` check; a live note also carries `payLink` |
-| `/w/cb` | the mutating callback: melt, rotate, split, merge |
+| `/w` | LUD-03 informational GET; accepts `k1` (a secret or a `ck1`) or the non-disclosing LUD-25 `p` check (`sha256(k1)` or a `cp1` key; `h` is its older name, still accepted); a live note also carries `payLink`, and a Part 2 note its `cs1` as `sig` |
+| `/w/cb` | the mutating callback: melt, rotate, split, merge; inputs as secrets or `ck1`s, outputs as `p1`/`p2` hashes or `cp1` keys, or their older names `h`/`h2` |
 | `POST /names` | claim a lightning address, authenticated by NIP-98 |
 | `/.well-known/nostr.json` | NIP-05 for the names this mint serves |
 | `/stats` | what the mint owes, what the node holds, and the coverage between them |

package/THREAT-MODEL.md

@@ -23,7 +23,12 @@ request carrying a callback's query string cannot mutate anything.
 
 **A holder inflating a merge or split with a repeated k1.** Duplicated k1
 parameters in one request are refused outright; they would otherwise count
-one note's value twice into the output.
+one note's value twice into the output. The check is on the note each k1
+spends, not on the k1 string: a Part 2 note's `ck1` is a signature, and one
+note has many valid ones (anyone holding a `ck1` can flip it to `(r, n-s)`,
+and the key's owner can sign again). The store refuses a note named twice
+among a swap's inputs as well, so the rule does not rest on the handler
+alone.
 
 **A holder claiming an output id that already exists.** `h`/`h2` may not
 collide with any existing note, any mint invoice's payment hash, settled
@@ -85,6 +90,14 @@ only the buyer ever held, the preimage is bearer material for nothing, and
 what `/verify` serves is an ordinary payment proof. Wallets should prefer
 that path wherever a mint advertises `mintToHash`.
 
+**What a `cx1` on a name gives away.** A name with a watch-only branch is
+paid to the holder's keys, so the mint never holds a secret for those notes.
+But the mint can work out every key on the branch, so it can link every
+payment to that name, and see when each note is spent. That is no more than
+a custodial name already reveals. A wallet should keep the branch for
+receiving and rotate what arrives onto keys the mint cannot enumerate, which
+is what notecase and lnurl-wallet do.
+
 ## Out of scope
 
 - Compromise of the host or the funding source credentials: at that point

package/dist/names.d.ts

@@ -24,6 +24,8 @@ export type NameGranted = {
     name: string;
     pubkey: string;
     paidMsat: number;
+    cx1: string | null;
+    updated: boolean;
 };
 export declare const isRefusal: (result: NameGranted | NameRefusal) => result is NameRefusal;
 export declare const registerName: (args: {
@@ -32,6 +34,7 @@ export declare const registerName: (args: {
     body: {
         name?: unknown;
         note?: unknown;
+        cx1?: unknown;
     };
     priceMsat: number | undefined;
     reserved: string[];

package/dist/names.js

@@ -1,7 +1,7 @@
 import { sha256 } from '@noble/hashes/sha2.js';
 import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import { verifyEvent } from 'nostr-tools/pure';
-import { hashK1, noteK1 } from 'lnurlcash-kit';
+import { decodeCx1, hashK1, noteK1 } from 'lnurlcash-kit';
 import { NotePendingError, NoteStore, NoteUnavailableError } from "./store.js";
 // Self-service lightning addresses.
 //
@@ -103,8 +103,27 @@ export const registerName = (args) => {
     if ([...ALWAYS_RESERVED, ...args.reserved.map(name => name.toLowerCase())].includes(raw)) {
         return refuse('That name is reserved.', 403);
     }
-    if (store.zapName(raw))
+    // LUD-25 Part 2: a watch-only branch, so payments to the name are minted
+    // to the holder's own keys. Absent leaves it as it is; null clears it.
+    let cx1;
+    if (args.body.cx1 === null) {
+        cx1 = null;
+    }
+    else if (args.body.cx1 !== undefined) {
+        const given = typeof args.body.cx1 === 'string' ? args.body.cx1.trim().toLowerCase() : '';
+        if (!decodeCx1(given))
+            return refuse('That is not a cx1.', 400);
+        cx1 = given;
+    }
+    const existing = store.zapName(raw);
+    if (existing) {
+        // Its owner may set or clear the branch; nobody else may touch it.
+        if (existing.pubkey === pubkey && cx1 !== undefined) {
+            store.setZapNameCx1(raw, cx1);
+            return { name: raw, pubkey, paidMsat: 0, cx1, updated: true };
+        }
         return refuse('That name is taken.', 409);
+    }
     let paidMsat = 0;
     let noteId;
     if (priceMsat === 0) {
@@ -157,7 +176,7 @@ export const registerName = (args) => {
         paidMsat = note.amountMsat;
     }
     try {
-        store.buyZapName({ name: raw, pubkey, ...(noteId ? { noteId } : {}), paidMsat });
+        store.buyZapName({ name: raw, pubkey, ...(noteId ? { noteId } : {}), paidMsat, cx1: cx1 ?? null });
     }
     catch (err) {
         if (err instanceof NotePendingError)
@@ -168,5 +187,5 @@ export const registerName = (args) => {
         // the name and the note together or not at all.
         return refuse('That name is taken.', 409);
     }
-    return { name: raw, pubkey, paidMsat };
+    return { name: raw, pubkey, paidMsat, cx1: cx1 ?? null, updated: false };
 };

package/dist/server.js

@@ -1,7 +1,7 @@
 import { createServer } from 'node:http';
 import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
 import { finalizeEvent } from 'nostr-tools/pure';
-import { applyMintFee, grossUpForMintFee, hashK1 } from 'lnurlcash-kit';
+import { applyMintFee, decodeCk1, decodeCp1, encodeCs1, grossUpForMintFee, hashK1, recoverNoteOwnershipPubkey } from 'lnurlcash-kit';
 import { tryDecodeBolt11 } from 'farrier-kit/bolt11';
 import { NotePendingError, NoteStore, NoteUnavailableError, OutputCollisionError, swapFingerprint } from "./store.js";
 import { createNoteSigner } from "./signing.js";
@@ -19,6 +19,36 @@ import { ANNOUNCE_D_TAG, ANNOUNCE_KIND, announcementContent } from "./announce.j
 import { isRefusal, registerName, validateNip98 } from "./names.js";
 import { CONFIG_TOKEN, loadWebAssets } from "./web-assets.js";
 const HEX32 = /^[0-9a-f]{64}$/;
+// An output or a lookup: a 64-hex hash, or a cp1 key.
+const namedRef = (value) => {
+    if (HEX32.test(value))
+        return { id: value, cp1: false };
+    const pubkey = decodeCp1(value);
+    return pubkey ? { id: bytesToHex(pubkey), cp1: true } : null;
+};
+// What a k1 spends: sha256(k1) for a Part 1 secret, and for a Part 2 ck1 the
+// key its ownership signature recovers to. Different ck1 strings can recover
+// to the same note, so inputs are compared by ref, never by k1 string.
+const spentRef = (k1) => {
+    if (HEX32.test(k1))
+        return { id: hashK1(k1), cp1: false };
+    const signature = decodeCk1(k1);
+    const pubkey = signature ? recoverNoteOwnershipPubkey(signature) : null;
+    return pubkey ? { id: bytesToHex(pubkey), cp1: true } : null;
+};
+// LUD-25 renamed `h` to `p` on the lookup and `h`/`h2` to `p1`/`p2` on the
+// callback. The old names stay accepted; sending both spellings must agree.
+const renamedRef = (q, name, legacy) => {
+    const current = q.get(name)?.toLowerCase();
+    const old = q.get(legacy)?.toLowerCase();
+    const fromCurrent = current === undefined ? undefined : namedRef(current);
+    const fromOld = old === undefined ? undefined : namedRef(old);
+    return {
+        present: current !== undefined || old !== undefined,
+        ref: (fromCurrent !== undefined ? fromCurrent : fromOld) ?? null,
+        conflict: fromCurrent !== undefined && fromOld !== undefined && fromCurrent?.id !== fromOld?.id
+    };
+};
 // The one request body this mint reads. Capped hard: nothing here needs
 // more than a name and a note, and an unbounded read on a public endpoint
 // is a way to run a mint out of memory.
@@ -61,6 +91,11 @@ export const createMoneyer = async (config, deps = {}) => {
     const store = deps.store ?? new NoteStore(config.dbPath);
     const backend = deps.backend ?? backendFor(config);
     const signer = createNoteSigner(config.signingKey);
+    // A cp1 note's certificate is the same signature, carried as cs1.
+    const certify = (ref, amountMsat) => {
+        const sig = signer.sign(ref.id, amountMsat);
+        return ref.cp1 ? encodeCs1(hexToBytes(sig)) : sig;
+    };
     const webAssets = deps.webAssets === undefined ? loadWebAssets() : deps.webAssets;
     // Node identity for the discovery endpoint, fetched once, best-effort: a
     // funding source that cannot answer does not stop the mint serving.
@@ -132,6 +167,7 @@ export const createMoneyer = async (config, deps = {}) => {
             mintFeeLine,
             feeInWords,
             verify: config.verify,
+            certify: (noteId, amountMsat) => certify({ id: noteId, cp1: true }, amountMsat),
             // configFromEnv guarantees this when zap is set; a caller
             // building the config by hand gets the same rule.
             origin: config.publicOrigin ?? (() => {
@@ -163,7 +199,6 @@ export const createMoneyer = async (config, deps = {}) => {
         }
         return null;
     };
-    const resolveNote = async (k1) => resolveNoteId(hashK1(k1));
     // ---- transparency: what the mint owes, and what the node holds ----
     //
     // Cached for 30 seconds so a public endpoint cannot be turned into a
@@ -446,14 +481,19 @@ export const createMoneyer = async (config, deps = {}) => {
             });
             if (isRefusal(result))
                 return fail(result.reason, result.status);
-            log(`name ${result.name} registered to ${result.pubkey.slice(0, 8)} for ${result.paidMsat} msat`);
+            log(result.updated
+                ? `name ${result.name} ${result.cx1 ? 'now pays to a branch' : 'pays out custodially again'}`
+                : `name ${result.name} registered to ${result.pubkey.slice(0, 8)} for ${result.paidMsat} msat`);
             return send({
                 status: 'OK',
                 name: result.name,
                 pubkey: result.pubkey,
                 address: `${result.name}@${host}`,
                 priceMsat: config.namePriceMsat,
-                paidMsat: result.paidMsat
+                paidMsat: result.paidMsat,
+                // With a cx1 the name pays to the holder's own keys; without, as a
+                // note gift-wrapped to them.
+                cx1: result.cx1
             });
         }
         // Every LNURL endpoint below is a GET. The method matters: /w/cb
@@ -630,11 +670,15 @@ export const createMoneyer = async (config, deps = {}) => {
             // commitment. Missing or malformed input is refused before asking the
             // funding source for an invoice. `h` remains an additive compatibility
             // field, but it never substitutes for comment.
+            //
+            // LUD-25 Part 2: the comment may instead be `cp1<pk>`, and the note is
+            // keyed by that key, spent later with a ck1 rather than a secret.
             const askedComment = q.get('comment')?.trim().toLowerCase() ?? null;
-            if (askedComment === null || !HEX32.test(askedComment)) {
-                return fail('a mint quote must name its output with a LUD-12 comment carrying hex(sha256(secret))');
+            const commentRef = askedComment === null ? null : namedRef(askedComment);
+            if (commentRef === null) {
+                return fail('a mint quote must name its output with a LUD-12 comment carrying hex(sha256(secret)) or a cp1 key');
             }
-            const commentOutputId = askedComment;
+            const commentOutputId = commentRef.id;
             const askedOutputId = q.get('h')?.trim().toLowerCase() ?? null;
             if (askedOutputId !== null && !HEX32.test(askedOutputId))
                 return fail('missing h');
@@ -823,18 +867,20 @@ export const createMoneyer = async (config, deps = {}) => {
         // ---- LUD-03 informational GET ----
         if (requestUrl.pathname === '/w') {
             const hasK1 = q.has('k1');
-            const hasH = q.has('h');
             const k1 = q.get('k1')?.toLowerCase();
-            const h = q.get('h')?.toLowerCase();
-            if (hasK1 === hasH ||
-                (hasK1 && (!k1 || !HEX32.test(k1))) ||
-                (hasH && (!h || !HEX32.test(h)))) {
+            const lookup = renamedRef(q, 'p', 'h');
+            if (lookup.conflict)
+                return fail('p and h name different notes');
+            if (hasK1 === lookup.present)
                 return fail('Unknown note.');
-            }
             // LUD-25's hash-only check lets a wallet prove that the note it just
             // bought exists without sending the bearer secret to the service a
-            // second time. `h` is accepted in place of `k1`, never alongside it.
-            const note = h ? await resolveNoteId(h) : await resolveNote(k1);
+            // second time. `p` (or `h`) is accepted in place of `k1`, never
+            // alongside it, and names a Part 2 note by its cp1 key.
+            const ref = hasK1 ? (k1 ? spentRef(k1) : null) : lookup.ref;
+            if (!ref)
+                return fail('Unknown note.');
+            const note = await resolveNoteId(ref.id);
             if (!note)
                 return fail('Unknown note.');
             // Hash lookups protect the secret, not the note's spent state.
@@ -876,7 +922,10 @@ export const createMoneyer = async (config, deps = {}) => {
                 // but a note learns from the note itself that the other door
                 // exists.
                 ...(mirrors.length ? { mirrors } : {}),
-                ...(signer ? { mintPubkey: signer.pubkey } : {})
+                ...(signer ? { mintPubkey: signer.pubkey } : {}),
+                // LUD-25 Part 2: a note named by cp1 or ck1 gets its certificate
+                // here, so a wallet need not rotate just to obtain one.
+                ...(ref.cp1 ? { sig: certify(ref, note.amountMsat) } : {})
             });
         }
         // ---- the mutating callback: melt / rotate / split / merge ----
@@ -884,8 +933,12 @@ export const createMoneyer = async (config, deps = {}) => {
             const k1s = q.getAll('k1').map(value => value.toLowerCase());
             const pr = q.get('pr');
             const amountRaw = q.get('amount');
-            const h = q.get('h')?.toLowerCase();
-            const h2 = q.get('h2')?.toLowerCase();
+            // One ref per output from here on, so the replay match below treats
+            // `p1=X` and `h=X` as the same request.
+            const out1 = renamedRef(q, 'p1', 'h');
+            const out2 = renamedRef(q, 'p2', 'h2');
+            const o1 = out1.ref;
+            const o2 = out2.ref;
             if (k1s.length === 0)
                 return fail('Missing k1.');
             if (k1s.length > config.maxK1s)
@@ -896,19 +949,29 @@ export const createMoneyer = async (config, deps = {}) => {
             // Hash parameters are checked before any note resolves, so an
             // invalid or missing hash can never burn anything.
             if (!pr) {
-                if (!h || !HEX32.test(h))
-                    return fail('missing h');
-                if (amountRaw !== null && (!h2 || !HEX32.test(h2)))
-                    return fail('missing h2');
-                if (h2 !== undefined && h2 === h)
-                    return fail('h and h2 must differ.');
+                if (out1.conflict)
+                    return fail('p1 and h name different outputs');
+                if (out2.conflict)
+                    return fail('p2 and h2 name different outputs');
+                if (!o1)
+                    return fail('missing p1');
+                if (amountRaw !== null && !o2)
+                    return fail('missing p2');
+                if (o2 && o2.id === o1.id)
+                    return fail('p1 and p2 must differ.');
             }
             if (config.sunset && amountRaw !== null) {
                 return fail('This mint is sunsetting - splitting is disabled.');
             }
-            // A repeated k1 would count one note's value twice on the way into a
-            // merge or split. Atomic refusal, same as an invalid one.
-            if (new Set(k1s).size !== k1s.length)
+            // A note named twice would count its value twice on the way into a
+            // merge or split. Compared by the note each k1 spends, since two
+            // different ck1 strings can spend the same one. Atomic refusal, same
+            // as an invalid k1.
+            const spent = k1s.map(spentRef);
+            if (spent.some(ref => ref === null))
+                return fail('Invalid or already spent k1.');
+            const spentIds = spent.map(ref => ref.id);
+            if (new Set(spentIds).size !== spentIds.length)
                 return fail('Invalid or already spent k1.');
             // ---- the retried mutation ----
             //
@@ -925,39 +988,36 @@ export const createMoneyer = async (config, deps = {}) => {
             // balance: it is a read. The signature is deterministic over the
             // output id and its amount, so it is recomputed rather than stored.
             // Anything else naming a burned input is a double-spend attempt and
-            // still gets today's reason string, unchanged.
-            // Every k1 has to be hex before it can be hashed into a
-            // fingerprint; a malformed one falls through to the loop below and
-            // gets the same refusal it always did.
-            const fingerprint = pr !== null || !k1s.every(k1 => HEX32.test(k1))
+            // still gets today's reason string, unchanged. The fingerprint is
+            // over note ids, so a hex request fingerprints exactly as it did
+            // before Part 2 and replays from before an upgrade still match.
+            const fingerprint = pr !== null
                 ? null
                 : swapFingerprint({
-                    inputIds: k1s.map(hashK1),
-                    h: h,
-                    h2,
+                    inputIds: spentIds,
+                    h: o1.id,
+                    h2: o2?.id,
                     ...(amountRaw !== null ? { amountMsat: Number(amountRaw) } : {})
                 });
             const alreadyMinted = fingerprint === null ? null : store.swapByFingerprint(fingerprint);
             if (alreadyMinted) {
-                const first = alreadyMinted.find(output => output.id === h);
-                const second = h2 === undefined ? undefined : alreadyMinted.find(output => output.id === h2);
+                const first = alreadyMinted.find(output => output.id === o1.id);
+                const second = o2 ? alreadyMinted.find(output => output.id === o2.id) : undefined;
                 if (first) {
                     return send({
                         status: 'OK',
                         ...(signer
                             ? {
-                                sig: signer.sign(first.id, first.amountMsat),
-                                ...(second ? { sig2: signer.sign(second.id, second.amountMsat) } : {})
+                                sig: certify(o1, first.amountMsat),
+                                ...(second ? { sig2: certify(o2, second.amountMsat) } : {})
                             }
                             : {})
                     });
                 }
             }
             const found = [];
-            for (const k1 of k1s) {
-                if (!HEX32.test(k1))
-                    return fail('Invalid or already spent k1.');
-                const note = await resolveNote(k1);
+            for (const id of spentIds) {
+                const note = await resolveNoteId(id);
                 if (!note || note.state === 'burned')
                     return fail('Invalid or already spent k1.');
                 if (note.state === 'pending')
@@ -1072,8 +1132,8 @@ export const createMoneyer = async (config, deps = {}) => {
                     return fail('insufficient value');
                 try {
                     store.swap(inputIds, [
-                        { id: h, amountMsat: amount },
-                        { id: h2, amountMsat: changeMsat }
+                        { id: o1.id, amountMsat: amount },
+                        { id: o2.id, amountMsat: changeMsat }
                     ], fingerprint ?? undefined);
                 }
                 catch (err) {
@@ -1085,7 +1145,7 @@ export const createMoneyer = async (config, deps = {}) => {
                 }
                 return send({
                     status: 'OK',
-                    ...(signer ? { sig: signer.sign(h, amount), sig2: signer.sign(h2, changeMsat) } : {})
+                    ...(signer ? { sig: certify(o1, amount), sig2: certify(o2, changeMsat) } : {})
                 });
             }
             // rotate (one k1) or merge (several) - the same swap either way.
@@ -1094,7 +1154,7 @@ export const createMoneyer = async (config, deps = {}) => {
             // of one - the refund is exactly 0.
             const mergedMsat = totalMsat + (inputIds.length - 1) * baseFeeMsat;
             try {
-                store.swap(inputIds, [{ id: h, amountMsat: mergedMsat }], fingerprint ?? undefined);
+                store.swap(inputIds, [{ id: o1.id, amountMsat: mergedMsat }], fingerprint ?? undefined);
             }
             catch (err) {
                 if (err instanceof NotePendingError)
@@ -1102,7 +1162,7 @@ export const createMoneyer = async (config, deps = {}) => {
                 // same oracle-free reason for a collision as for a dead k1
                 return fail('Invalid or already spent k1.');
             }
-            return send({ status: 'OK', ...(signer ? { sig: signer.sign(h, mergedMsat) } : {}) });
+            return send({ status: 'OK', ...(signer ? { sig: certify(o1, mergedMsat) } : {}) });
         }
         return fail('Not found.', 404);
     };

package/dist/store.d.ts

@@ -53,6 +53,8 @@ export type ZapNameRow = {
     createdAt: number;
     paidMsat: number;
     source: 'env' | 'self';
+    cx1: string | null;
+    nextIndex: number;
 };
 export type NoteListRow = NoteRow & {
     createdAt: number;
@@ -126,16 +128,27 @@ export declare class NoteStore {
     unsettledZapInvoices(): ZapInvoiceRow[];
     deleteUnsettledZapInvoice(paymentHash: string): void;
     settleZapInvoice(paymentHash: string, noteId: string, wrapJson: string, receiptJson: string | null): boolean;
+    settleZapInvoiceToKey(paymentHash: string, keyAt: (index: number) => string | null, build: (noteId: string, index: number) => {
+        wrapJson: string;
+        receiptJson: string | null;
+    }): {
+        noteId: string;
+        index: number;
+    } | null;
     unpublishedZaps(): ZapInvoiceRow[];
     markZapPublished(paymentHash: string): void;
+    private static readonly NAME_COLUMNS;
+    private nameRow;
     zapName(name: string): ZapNameRow | null;
     zapNames(): ZapNameRow[];
+    setZapNameCx1(name: string, cx1: string | null): void;
     putOperatorZapName(name: string, pubkey: string): void;
     buyZapName(args: {
         name: string;
         pubkey: string;
         noteId?: string;
         paidMsat: number;
+        cx1?: string | null;
     }): void;
     removeZapName(name: string): boolean;
     zapNameCountFor(pubkey: string): number;

package/dist/store.js

@@ -117,6 +117,12 @@ export class NoteStore {
         // Two invoices may not name the same note. SQLite counts NULLs as
         // distinct, so every unbound invoice still fits.
         this.db.exec('CREATE UNIQUE INDEX IF NOT EXISTS mint_invoices_output_id ON mint_invoices (output_id)');
+        const nameColumns = this.db.prepare('PRAGMA table_info(zap_names)').all().map(column => column.name);
+        if (!nameColumns.includes('cx1'))
+            this.db.exec('ALTER TABLE zap_names ADD COLUMN cx1 TEXT');
+        if (!nameColumns.includes('next_index')) {
+            this.db.exec('ALTER TABLE zap_names ADD COLUMN next_index INTEGER NOT NULL DEFAULT 0');
+        }
         this.db.exec('CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);');
         // The moment this mint stopped publishing preimages for notes nobody
         // named. Written once, the first time a build carrying this code opens
@@ -214,6 +220,11 @@ export class NoteStore {
     // a secret the mint really did mint a note against.
     swap(inputIds, outputs, fingerprint) {
         this.tx(() => {
+            // Every input is checked before any is burned, so a note named twice
+            // would pass both checks and be counted twice by the caller.
+            if (new Set(inputIds).size !== inputIds.length) {
+                throw new NoteUnavailableError('a note is named twice among the inputs');
+            }
             for (const id of inputIds)
                 this.assertOutstanding(id);
             for (const output of outputs)
@@ -435,6 +446,39 @@ export class NoteStore {
         });
     }
     // Settled zaps whose wrap has not yet reached a relay.
+    // A zap to a name with a cx1, minted to the next unused key on its
+    // branch. The index is taken here, at settlement, never when the invoice
+    // is made, so an invoice nobody pays leaves no gap in the holder's scan.
+    // A key that already names a note is skipped, as LUD-25 requires.
+    // `keyAt` answers null for an index that yields no usable key.
+    settleZapInvoiceToKey(paymentHash, keyAt, build) {
+        return this.tx(() => {
+            const row = this.zapInvoiceByHash(paymentHash);
+            if (!row || row.settled)
+                return null;
+            const name = this.zapName(row.name);
+            if (!name?.cx1)
+                return null;
+            let index = name.nextIndex;
+            let noteId = null;
+            for (let tries = 0; tries < 1000 && noteId === null; tries++) {
+                const candidate = keyAt(index);
+                if (candidate !== null && !this.outputIdInUse(candidate))
+                    noteId = candidate;
+                else
+                    index += 1;
+            }
+            if (noteId === null)
+                throw new Error(`no free key on the branch of ${row.name}`);
+            this.insertNote(noteId, row.netMsat);
+            this.db.prepare('UPDATE zap_names SET next_index = ? WHERE name = ?').run(index + 1, row.name);
+            const { wrapJson, receiptJson } = build(noteId, index);
+            this.db
+                .prepare('UPDATE zap_invoices SET settled = 1, note_id = ?, wrap_json = ?, receipt_json = ?, settled_at = ? WHERE payment_hash = ?')
+                .run(noteId, wrapJson, receiptJson, Date.now(), paymentHash);
+            return { noteId, index };
+        });
+    }
     unpublishedZaps() {
         const rows = this.db
             .prepare(`SELECT ${NoteStore.ZAP_COLUMNS} FROM zap_invoices WHERE settled = 1 AND published_at IS NULL`)
@@ -453,25 +497,36 @@ export class NoteStore {
     // One table for both kinds: names the operator set in the environment
     // and names people registered themselves. The lookup path that serves a
     // zap does not care which is which, so there is one of it.
+    static NAME_COLUMNS = 'name, pubkey, created_at, paid_msat, source, cx1, next_index';
+    nameRow(row) {
+        return {
+            name: row.name,
+            pubkey: row.pubkey,
+            createdAt: row.created_at,
+            paidMsat: row.paid_msat,
+            source: row.source,
+            cx1: row.cx1 ?? null,
+            nextIndex: row.next_index
+        };
+    }
     zapName(name) {
         const row = this.db
-            .prepare('SELECT name, pubkey, created_at, paid_msat, source FROM zap_names WHERE name = ?')
+            .prepare(`SELECT ${NoteStore.NAME_COLUMNS} FROM zap_names WHERE name = ?`)
             .get(name.toLowerCase());
-        if (!row)
-            return null;
-        return { name: row.name, pubkey: row.pubkey, createdAt: row.created_at, paidMsat: row.paid_msat, source: row.source };
+        return row ? this.nameRow(row) : null;
     }
     zapNames() {
         const rows = this.db
-            .prepare('SELECT name, pubkey, created_at, paid_msat, source FROM zap_names ORDER BY name')
+            .prepare(`SELECT ${NoteStore.NAME_COLUMNS} FROM zap_names ORDER BY name`)
             .all();
-        return rows.map(row => ({
-            name: row.name,
-            pubkey: row.pubkey,
-            createdAt: row.created_at,
-            paidMsat: row.paid_msat,
-            source: row.source
-        }));
+        return rows.map(row => this.nameRow(row));
+    }
+    // A new branch starts at index 0; the same branch sent again keeps its
+    // place, so re-registering cannot walk the holder's keys backwards.
+    setZapNameCx1(name, cx1) {
+        this.db
+            .prepare('UPDATE zap_names SET next_index = CASE WHEN cx1 IS ? THEN next_index ELSE 0 END, cx1 = ? WHERE name = ?')
+            .run(cx1, cx1, name.toLowerCase());
     }
     // The operator's own names, re-applied at every startup. Idempotent, and
     // the environment wins: it is the operator's mint, and a name they put
@@ -494,8 +549,8 @@ export class NoteStore {
                 this.setNoteState(args.noteId, 'burned');
             }
             this.db
-                .prepare("INSERT INTO zap_names (name, pubkey, created_at, paid_msat, source) VALUES (?, ?, ?, ?, 'self')")
-                .run(args.name.toLowerCase(), args.pubkey, Date.now(), args.paidMsat);
+                .prepare("INSERT INTO zap_names (name, pubkey, created_at, paid_msat, source, cx1) VALUES (?, ?, ?, ?, 'self', ?)")
+                .run(args.name.toLowerCase(), args.pubkey, Date.now(), args.paidMsat, args.cx1 ?? null);
         });
     }
     removeZapName(name) {

package/dist/zap.d.ts

@@ -31,6 +31,7 @@ export type ZapBridgeDeps = {
     feeInWords: string | null;
     verify: boolean;
     origin: string;
+    certify: (noteIdHex: string, amountMsat: number) => string;
     log?: (message: string) => void;
     now?: () => number;
 };

package/dist/zap.js

@@ -1,5 +1,5 @@
 import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
-import { hashK1 } from 'lnurlcash-kit';
+import { decodeCx1, deriveNotePubkey, encodeCp1, hashK1 } from 'lnurlcash-kit';
 import { tryDecodeBolt11 } from 'farrier-kit/bolt11';
 import { finalizeEvent, getPublicKey } from 'nostr-tools/pure';
 import { SimplePool } from 'nostr-tools/pool';
@@ -171,8 +171,7 @@ export const createZapBridge = (deps) => {
         store.recordZapInvoice({ paymentHash, name: lowered, recipient, pr, grossMsat: amountMsat, netMsat: net, zapRequest });
         return { pr, ...(deps.verify ? { verify: `${origin}/verify/${paymentHash}` } : {}) };
     };
-    // The note as the recipient's wallet will paste it, wrapped to them.
-    const buildWrap = (row, k1) => {
+    const wrapTags = (row) => {
         const tags = [
             ['p', row.recipient],
             ['amount', String(row.netMsat)],
@@ -192,15 +191,20 @@ export const createZapBridge = (deps) => {
             // older one simply does not see this.
             tags.push(['description', row.zapRequest]);
         }
-        const rumor = {
-            kind: NOTE_KIND,
-            pubkey,
-            created_at: Math.floor(now() / 1000),
-            tags,
-            content: `${origin}/w?k1=${k1}&amount=${row.netMsat}`
-        };
+        return tags;
+    };
+    const wrap = (row, tags, content) => {
+        const rumor = { kind: NOTE_KIND, pubkey, created_at: Math.floor(now() / 1000), tags, content };
         return wrapEvent(rumor, secret, row.recipient);
     };
+    // The note as the recipient's wallet will paste it, wrapped to them.
+    const buildWrap = (row, k1) => wrap(row, wrapTags(row), `${origin}/w?k1=${k1}&amount=${row.netMsat}`);
+    // A zap to a name with a cx1: the note already belongs to the holder's
+    // key, so the wrap carries no secret at all, only where to look (`p`),
+    // the certificate, and the index `i` the holder derives the key at. A
+    // reader that knows only note URLs sees no k1 and passes it by, and the
+    // note waits at the mint for a scan to find it.
+    const buildKeyWrap = (row, noteId, index) => wrap(row, [...wrapTags(row), ['i', String(index)]], `${origin}/w?p=${encodeCp1(hexToBytes(noteId))}&amount=${row.netMsat}&sig=${deps.certify(noteId, row.netMsat)}&i=${index}`);
     // NIP-57 receipt, without the preimage tag: it is optional there, and
     // here it would only invite someone to mistake it for the note.
     const buildReceipt = (row) => {
@@ -222,6 +226,27 @@ export const createZapBridge = (deps) => {
             }
             if (!paid)
                 continue;
+            const branch = decodeCx1(store.zapName(row.name)?.cx1 ?? '');
+            if (branch) {
+                const receipt = buildReceipt(row);
+                const keyAt = (index) => {
+                    try {
+                        return bytesToHex(deriveNotePubkey(branch.pubkeyXOnly, branch.chainCode, index));
+                    }
+                    catch {
+                        return null;
+                    }
+                };
+                const landed = store.settleZapInvoiceToKey(row.paymentHash, keyAt, (noteId, index) => ({
+                    wrapJson: JSON.stringify(buildKeyWrap(row, noteId, index)),
+                    receiptJson: receipt ? JSON.stringify(receipt) : null
+                }));
+                if (landed) {
+                    minted += 1;
+                    log(`zap: ${row.name} received ${row.netMsat} msat; note minted to key ${landed.index}, wrap parked`);
+                }
+                continue;
+            }
             const k1 = bytesToHex(randomBytes(32));
             const noteId = hashK1(k1);
             const wrap = buildWrap(row, k1);

package/llms.txt

@@ -25,10 +25,13 @@ Client library to build against a mint: lnurlcash-kit
    inside the invoice. `h` is an additive alias for the same commitment and
    never replaces the comment. Because the note is not keyed by the
    preimage, a funding source whose node chooses its own preimages
-   (phoenixd, NIP-47 make_invoice) can back a mint.
+   (phoenixd, NIP-47 make_invoice) can back a mint. LUD-25 Part 2: the
+   comment may instead be `cp1<pk>`, and the note is keyed by that key.
 2. Mutations are atomic: all named k1 burn and all outputs mint, or
-   nothing happens. Duplicate k1 in one request is refused.
-3. h/h2 are WALLET-supplied hashes; the mint never generates a
+   nothing happens. A note named twice in one request is refused, compared
+   by the note each k1 spends: one Part 2 note has many valid ck1 strings.
+3. p1/p2 (older names h/h2, still accepted; both spellings of one output
+   must agree) are WALLET-supplied hashes or cp1 keys; the mint never generates a
    replacement secret, and refuses output ids that already exist as
    notes, as mint-invoice payment hashes, or as a note another payer has
    already bought with `h`. A malformed `h` on the pay callback is
@@ -56,8 +59,8 @@ Client library to build against a mint: lnurlcash-kit
    part applies at mint time only.
 7. Reason strings are protocol surface: 'pending',
    'Invalid or already spent k1.', 'Unknown note.', 'Note already spent.',
-   'missing h', 'missing h2', 'insufficient value' - wallets classify on
-   them.
+   'missing p1', 'missing p2' (withdraw callback), 'missing h' (pay
+   callback), 'insufficient value' - wallets classify on them.
 8. minSendable must survive the mint's own fee (grossUpForMintFee of the
    dust floor), or the mint advertises an amount it will refuse.
 
@@ -84,7 +87,13 @@ NoteStore - SQLite store; notes by sha256(k1), never secrets
 
 /.well-known/lnurlp/{user}  LUD-16 payRequest (mints)
 /.well-known/lnurlw/{user}  LUD-25 mint address (experimental)
-/p/cb                       LUD-06 pay callback (optional h names the note)
+/p/cb                       LUD-06 pay callback (comment names the note: hash or cp1)
 /verify/{payment_hash}      LUD-21 verify (mint invoices AND melt payments)
-/w                          LUD-03 informational GET by k1 or hash-only h
-/w/cb                       melt / rotate / split / merge
+/w                          LUD-03 informational GET by k1 (secret or ck1) or p (hash or cp1, older h); a cp1 note carries its cs1 as sig
+/w/cb                       melt / rotate / split / merge; inputs secrets or ck1, outputs p1/p2 hashes or cp1 (or older h/h2); cp1 outputs certified as cs1
+POST /names                 claim a name (NIP-98; the signer owns it); body {name, note?, cx1?}.
+                            The owner may resend {name, cx1} to set a branch, or cx1: null to clear it
+/z/cb/{name}                zap invoice for a name. With a cx1 the settled note is credited to the
+                            holder's next key, and the kind 2525 gift wrap carries no secret:
+                            /w?p=<cp1>&amount=&sig=<cs1>&i=<index> plus an `i` tag. The index is
+                            taken at settlement, never at the invoice, and occupied keys are skipped

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.11.1",
+  "version": "0.13.0",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -60,7 +60,7 @@
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^1.2.4",
     "farrier-kit": "^1.1.3",
-    "lnurlcash-kit": "^0.7.0",
+    "lnurlcash-kit": "^0.10.0",
     "nostr-tools": "2.24.1"
   },
   "devDependencies": {
@@ -70,7 +70,7 @@
     "@types/node": "^24.0.0",
     "animejs": "^4.0.0",
     "happy-dom": "^20.0.0",
-    "lnurlcash-conformance": "https://codeload.github.com/lnurlcash/lnurlcash-conformance/tar.gz/6c6aee66cf1b6cba72a03af976ecec113f470c9e",
+    "lnurlcash-conformance": "^0.8.0",
     "playwright": "^1.62.1",
     "typescript": "^5.7.0",
     "uqr": "^0.1.2",