@forgesworn/moneyer 0.13.2 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.14.0 - 2026-09-11
+
+- **A plain note is unsigned.** LUD-25 Part 2 certifies `cp1` notes only:
+  a hash has nothing to attest to without disclosing the secret. A rotate,
+  split or merge to a hash output now answers a bare `{"status":"OK"}`,
+  where it used to carry the old Part 1 signature over the hash. `cp1`
+  outputs are certified as before, with `cs1`, on the callback and on the
+  informational GET by `ck1` or `cp1`. The web client no longer attaches
+  the settlement receipt's signature to the note it mints; the receipt
+  still authenticates settlement, and `/verify` still carries it.
+- Graded by lnurlcash-conformance 0.10.0, whose new Part 2 check rotates
+  a note into a `cp1` key, verifies its certificate, and rotates it home.
+
 ## 0.13.2 - 2026-09-11
 
 - An operator name that changes owner drops the branch the previous owner

package/README.md

@@ -151,11 +151,11 @@ against the same endpoints every wallet uses:
   before the invoice exists, invoice QR (tap opens a wallet), LUD-21
   polling with a countdown, and on settlement the note is claimed and
   **immediately rotated** - the preimage any invoice-observer could poll
-  out of verify is dead before the note is shown. The rotated note's
-  signature is verified against the mint's advertised key in front of the
-  user, and the QR arrives under scratch-off silver foil, rubbed away like a scratch card.
+  out of verify is dead before the note is shown. The settlement receipt
+  is verified against the mint's advertised key in front of the user, and
+  the QR arrives under scratch-off silver foil, rubbed away like a scratch card.
 - **Check a note**: live value, spent/unknown/pending classified in plain
-  words, offline signature verification.
+  words, and offline verification of a `cp1` note's certificate.
 - `MONEYER_WALLET_URL` (optional) links minted notes straight into a
   companion web wallet's `#/claim` route.
 
@@ -354,7 +354,8 @@ named or spent, the two kinds mix freely:
 - `GET /w?k1=<ck1>` or `GET /w?p=<cp1>` looks a Part 2 note up, and the
   answer carries `sig`, the mint's certificate for it as `cs1`.
 - `p1`/`p2` on the callback may be `cp1` keys, and the matching `sig`/`sig2`
-  come back as `cs1`. A hash output still gets a plain hex signature.
+  come back as `cs1`. A hash output gets none: a plain note is unsigned by
+  design, since there is nothing to attest to without disclosing the secret.
 - A merge may combine Part 1 secrets and Part 2 `ck1`s in one request.
 
 A recipient checks a Part 2 note offline from its `ck1` and `cs1` alone.

package/dist/server.js

@@ -91,10 +91,13 @@ export const createMoneyer = async (config, deps = {}) => {
     const store = deps.store ?? new NoteStore(config.dbPath);
     const backend = deps.backend ?? backendFor(config);
     const signer = createNoteSigner(config.signingKey);
-    // A cp1 note's certificate is the same signature, carried as cs1.
-    const certify = (ref, amountMsat) => {
-        const sig = signer.sign(ref.id, amountMsat);
-        return ref.cp1 ? encodeCs1(hexToBytes(sig)) : sig;
+    // LUD-25 Part 2 signs cp1 notes only, as cs1. A hash output is a plain
+    // Part 1 note: there is nothing to attest to without disclosing the
+    // secret, so it goes out unsigned.
+    const certify = (ref, amountMsat) => ref.cp1 ? encodeCs1(hexToBytes(signer.sign(ref.id, amountMsat))) : undefined;
+    const certified = (field, ref, amountMsat) => {
+        const sig = certify(ref, amountMsat);
+        return sig ? { [field]: sig } : {};
     };
     const webAssets = deps.webAssets === undefined ? loadWebAssets() : deps.webAssets;
     // Node identity for the discovery endpoint, fetched once, best-effort: a
@@ -928,7 +931,7 @@ export const createMoneyer = async (config, deps = {}) => {
                 ...(signer ? { mintPubkey: signer.pubkey } : {}),
                 // LUD-25 Part 2: a note named by cp1 or ck1 gets its certificate
                 // here, so a wallet need not rotate just to obtain one.
-                ...(ref.cp1 ? { sig: certify(ref, note.amountMsat) } : {})
+                ...certified('sig', ref, note.amountMsat)
             });
         }
         // ---- the mutating callback: melt / rotate / split / merge ----
@@ -1009,12 +1012,8 @@ export const createMoneyer = async (config, deps = {}) => {
                 if (first) {
                     return send({
                         status: 'OK',
-                        ...(signer
-                            ? {
-                                sig: certify(o1, first.amountMsat),
-                                ...(second ? { sig2: certify(o2, second.amountMsat) } : {})
-                            }
-                            : {})
+                        ...certified('sig', o1, first.amountMsat),
+                        ...(second ? certified('sig2', o2, second.amountMsat) : {})
                     });
                 }
             }
@@ -1148,7 +1147,8 @@ export const createMoneyer = async (config, deps = {}) => {
                 }
                 return send({
                     status: 'OK',
-                    ...(signer ? { sig: certify(o1, amount), sig2: certify(o2, changeMsat) } : {})
+                    ...certified('sig', o1, amount),
+                    ...certified('sig2', o2, changeMsat)
                 });
             }
             // rotate (one k1) or merge (several) - the same swap either way.
@@ -1165,7 +1165,7 @@ export const createMoneyer = async (config, deps = {}) => {
                 // same oracle-free reason for a collision as for a dead k1
                 return fail('Invalid or already spent k1.');
             }
-            return send({ status: 'OK', ...(signer ? { sig: certify(o1, mergedMsat) } : {}) });
+            return send({ status: 'OK', ...certified('sig', o1, mergedMsat) });
         }
         return fail('Not found.', 404);
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -60,7 +60,7 @@
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^1.2.4",
     "farrier-kit": "^1.1.3",
-    "lnurlcash-kit": "^0.10.0",
+    "lnurlcash-kit": "^0.13.0",
     "nostr-tools": "2.24.1"
   },
   "devDependencies": {
@@ -70,7 +70,7 @@
     "@types/node": "^24.0.0",
     "animejs": "^4.0.0",
     "happy-dom": "^20.0.0",
-    "lnurlcash-conformance": "^0.8.0",
+    "lnurlcash-conformance": "^0.10.0",
     "playwright": "^1.62.1",
     "typescript": "^5.7.0",
     "uqr": "^0.1.2",