@forgesworn/moneyer 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 0.16.0 - 2026-09-16
+
+- Bump `@lnurlcash/kit` from 0.14.2 to 0.18.1: the previous pin predated the
+  entire Schnorr `ck1` migration, so any note produced by a current wallet
+  was already unverifiable here. Brings the `ck1`/address-proof sha256
+  digest fix (signing `sha256(message)` instead of the raw string, matching
+  most conforming Schnorr signers) and a legacy-read fallback for notes
+  minted under the intermediate raw-message scheme.
+- `spentRef` follows `recoverNoteOwnershipPubkey`'s new signature: it now
+  takes the `ck1` string directly and returns `{pubkeyXOnly, legacy}` rather
+  than raw recovered bytes.
+- `claimMintedNote` now classifies a melt-in-flight note by catching the
+  kit's own `PendingNoteError`, replacing a `ServiceError{reason:'pending'}`
+  check the kit stopped throwing. The bump had silently broken this: an
+  unhandled `PendingNoteError` would have surfaced to a bound-mint quote's
+  poller as an unreachable-mint error rather than "pending" - untested
+  before this bump, now covered.
+
+## 0.15.0 - 2026-09-15
+
+- Use `@lnurlcash/kit` 0.14 as the protocol implementation. Removed kit
+  convenience APIs that are Moneyer policy remain local rather than becoming
+  changes to the reference wallet package.
+- Match the current reference mint's mutation proof formats: legacy hash
+  outputs receive the raw 65-byte Part 1 signature when signing is available;
+  `cp1` outputs receive an amount-bearing `cs1` certificate. Informational
+  lookup still publishes a certificate only for `cp1` notes.
+- Grade against `lnurlcash-conformance` 0.11, including amount-bearing
+  certificates, Part 2 address ownership and internal transfers.
+- Publish a key-backed name's `cx1:<next-free-index>` as `text/xpub` metadata
+  so a wallet already holding Moneyer notes can pay it by an ordinary
+  rotate/split/merge without Lightning. The hint is derived from current
+  ledger occupancy and public-key output collisions receive the reference
+  retry signal.
+
 ## 0.14.0 - 2026-09-11
 
 - **A plain note is unsigned.** LUD-25 Part 2 certifies `cp1` notes only:

package/README.md

@@ -9,7 +9,7 @@ split, merge and melt it against the withdraw callback. The note's spend
 secret is chosen by the buyer, before the invoice exists, and named to the
 mint only as a hash - so the mint never holds it, and neither does any node
 that forwards the payment. It passes the full
-[lnurlcash-conformance](https://github.com/TheCryptoDonkey/lnurlcash-conformance)
+[lnurlcash-conformance](https://github.com/lnurlcash/lnurlcash-conformance)
 grader, including the spending checks, and the grader runs in this repo's
 own test suite.
 
@@ -43,14 +43,10 @@ lesson, that behaviour is kept deliberately and tested.
 
 ## Run
 
-Not on npm yet - build from source, with the sibling repos it links
-against until those publish:
+Install the published package and build it:
 
 ```bash
-git clone https://github.com/TheCryptoDonkey/lnurlcash-kit
-git clone https://github.com/TheCryptoDonkey/lnurlcash-conformance
 git clone https://github.com/forgesworn/moneyer
-(cd lnurlcash-kit && npm install && npm run build)
 cd moneyer && npm install && npm run build && npm run web:build
 ```
 
@@ -144,7 +140,7 @@ payRequest metadata's fee prose), `version`, and `previousPubkeys`.
 
 `GET /` serves the mint's own site (`web/`, vite + anime.js, built by
 `npm run web:build` into memory-served static files). It is a wallet-grade
-LNURLcash client in its own right, driven entirely by `lnurlcash-kit`
+LNURLcash client in its own right, driven entirely by `@lnurlcash/kit`
 against the same endpoints every wallet uses:
 
 - **Mint a note in the browser**: amount in, fee grossed up and shown
@@ -292,7 +288,7 @@ single mint's implementation.
 LUD-25 gives the fee as a flat `base_fee_msat` plus a ppm cut and says
 nothing about rounding. dni's lnurl-mint, the reference, ceilings it to a
 whole sat on purpose so the mint is never short a sat; moneyer withholds
-the msat-exact amount. Neither is out of spec - lnurlcash-kit's
+the msat-exact amount. Neither is out of spec - `@lnurlcash/kit`'s
 `mintFeeBand` treats anything between the two as the mint keeping its
 word, and the conformance grader accepts both.
 
@@ -354,8 +350,8 @@ named or spent, the two kinds mix freely:
 - `GET /w?k1=<ck1>` or `GET /w?p=<cp1>` looks a Part 2 note up, and the
   answer carries `sig`, the mint's certificate for it as `cs1`.
 - `p1`/`p2` on the callback may be `cp1` keys, and the matching `sig`/`sig2`
-  come back as `cs1`. A hash output gets none: a plain note is unsigned by
-  design, since there is nothing to attest to without disclosing the secret.
+  come back as amount-bearing `cs1`. A legacy hash output instead receives
+  the raw 65-byte Part 1 signature used by the reference mint.
 - A merge may combine Part 1 secrets and Part 2 `ck1`s in one request.
 
 A recipient checks a Part 2 note offline from its `ck1` and `cs1` alone.
@@ -411,7 +407,7 @@ whose secret was a preimage could never offer.
 
 The proposed normative wire text, invalid cases and compatibility matrix are
 kept executable in
-[`lnurlcash-conformance`](https://github.com/TheCryptoDonkey/lnurlcash-conformance/blob/main/docs/BOUND-MINT-RECEIPTS.md).
+[`lnurlcash-conformance`](https://github.com/lnurlcash/lnurlcash-conformance/blob/main/docs/BOUND-MINT-RECEIPTS.md).
 
 ## A retried mutation is answered, not refused
 
@@ -555,7 +551,7 @@ and credits the note to that key. It skips any key already holding a note,
 and an invoice nobody pays takes no index at all, so a wallet scanning its
 branch never meets a gap it did not make. The gift wrap still goes to the
 owner's npub, but it carries no secret: a lookup URL,
-`https://mint.example/w?p=<cp1>&amount=<msat>&sig=<cs1>&i=<index>`, plus an
+`https://mint.example/w?p=<cp1>&sig=<amount-bearing-cs1>&i=<index>`, plus an
 `i` tag. The wallet derives the key at that index, checks the certificate,
 and spends with its own `ck1`. A wallet that only knows note URLs sees no
 `k1` and passes the wrap by, and the note waits at the mint for a scan of the
@@ -568,6 +564,13 @@ in `MONEYER_ZAP_NAMES`.
 Sending a new branch starts it at index 0; sending the same one again keeps
 its place. Zap receipts are unchanged.
 
+The name's payRequest also publishes `['text/xpub', '<cx1>:<index>']`, where
+the index is the next key not already present in this mint's ledger. A payer
+already holding a note here can therefore rotate, split or merge straight to
+that `cp1` without creating or routing a Lightning invoice. The index is a
+hint: if another payment wins the key first, Moneyer returns `Output already
+in use.` so the reference kit advances and retries.
+
 ## Reaching the mint over Tor
 
 Set `MONEYER_ONION_URL` to this mint's hidden service address and a request
@@ -707,14 +710,14 @@ against live nodes; treat them as beta until they have.
 ## Dogfood
 
 Part of the ForgeSworn LNURLcash stack: built on
-[`lnurlcash-kit`](https://github.com/TheCryptoDonkey/lnurlcash-kit) (fee
+[`@lnurlcash/kit`](https://github.com/lnurlcash/lnurl-wallet/tree/main/src/lib) (fee
 maths, hashing, signature agreement) and
 [`farrier-kit`](https://github.com/forgesworn/farrier-kit) (BOLT-11
 decoding and preimage verification on the melt path). The companion wallet
 is [`@forgesworn/notecase`](https://github.com/forgesworn/notecase).
 
 Other mints, wallets and libraries speaking the same protocol are indexed
-in [awesome-lnurlcash](https://github.com/TheCryptoDonkey/awesome-lnurlcash).
+in [awesome-lnurlcash](https://github.com/lnurlcash/awesome-lnurlcash).
 
 ## Licence
 

package/dist/admin.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
 import { secp256k1 } from '@noble/curves/secp256k1.js';
-import { hashK1, noteDeclaredAmount, noteK1, noteSignature, verifyNoteSignature } from 'lnurlcash-kit';
+import { hashK1, noteDeclaredAmount, noteK1, noteSignature, verifyNoteSignature } from '@lnurlcash/kit';
 import { configFromEnv, pubkeyHex } from "./config.js";
 import { NoteStore } from "./store.js";
 import { buildStats } from "./stats.js";

package/dist/claim.d.ts

@@ -0,0 +1,15 @@
+/** Result of checking the wallet-chosen secret behind a bound mint quote. */
+export type MintClaim = {
+    state: 'minted' | 'unminted' | 'pending' | 'spent';
+    k1: string;
+    amountMsat: number | null;
+    callback: string | null;
+};
+/**
+ * Inspect the note a wallet named before requesting its invoice.
+ *
+ * This is Moneyer's operational orchestration, not a wire primitive: it
+ * classifies the read-only lookup so the live check can poll an unpaid quote
+ * without mistaking an unreachable mint for an unminted note.
+ */
+export declare const claimMintedNote: (withdrawLink: string, k1: string) => Promise<MintClaim>;

package/dist/claim.js

@@ -0,0 +1,32 @@
+import { NoteSpentError, NoteUnknownError, PendingNoteError, buildNoteUrl, fetchNoteInfo, isPreimage } from '@lnurlcash/kit';
+/**
+ * Inspect the note a wallet named before requesting its invoice.
+ *
+ * This is Moneyer's operational orchestration, not a wire primitive: it
+ * classifies the read-only lookup so the live check can poll an unpaid quote
+ * without mistaking an unreachable mint for an unminted note.
+ */
+export const claimMintedNote = async (withdrawLink, k1) => {
+    const secret = k1.trim().toLowerCase();
+    if (!isPreimage(secret))
+        throw new Error('A note secret must be 32 bytes of hex - nothing was sent.');
+    const blank = { k1: secret, amountMsat: null, callback: null };
+    try {
+        const info = await fetchNoteInfo(buildNoteUrl(withdrawLink, secret));
+        return {
+            state: 'minted',
+            k1: secret,
+            amountMsat: info.maxWithdrawable,
+            callback: info.callback
+        };
+    }
+    catch (error) {
+        if (error instanceof PendingNoteError)
+            return { ...blank, state: 'pending' };
+        if (error instanceof NoteSpentError)
+            return { ...blank, state: 'spent' };
+        if (error instanceof NoteUnknownError)
+            return { ...blank, state: 'unminted' };
+        throw error;
+    }
+};

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { parseArgs } from 'node:util';
 import { bytesToHex, randomBytes } from '@noble/hashes/utils.js';
-import { buildNoteUrl, hashK1 } from 'lnurlcash-kit';
+import { buildNoteUrl, hashK1 } from '@lnurlcash/kit';
 import { configFromEnv } from "./config.js";
 import { createMoneyer } from "./server.js";
 // moneyer - strike LNURLcash bearer notes.

package/dist/config.d.ts

@@ -1,4 +1,4 @@
-import type { MintFee } from 'lnurlcash-kit';
+import type { MintFee } from '@lnurlcash/kit';
 export type BackendConfig = {
     kind: 'fake';
     autoSettle?: boolean;

package/dist/fee-words.js

@@ -4,7 +4,7 @@
 //
 // The raw pair is spelled out deliberately. The machine-readable line
 // beside it in the payRequest metadata is "Mint fees: 5000,1000" - the
-// shape lnurlcash-kit parses, anchored and digits-only, so it cannot
+// shape @lnurlcash/kit parses, anchored and digits-only, so it cannot
 // carry its own units - and a reader who has not parsed LUD-25 reads
 // both numbers as satoshis. A tester who thinks the fee is 5000 sats on
 // a 10k sat mint has been told something alarming and false, so the

package/dist/landing.js

@@ -1,6 +1,6 @@
 import { MINT_KNOWS, MINT_KNOWS_HEADING } from "./privacy.js";
 import { feeInUnits } from "./fee-words.js";
-import { applyMintFee } from 'lnurlcash-kit';
+import { applyMintFee } from '@lnurlcash/kit';
 // The mint's face: one self-contained page at GET /, no build step, no
 // external assets. It states what a visitor needs before trusting a mint
 // with sats: who it is, what it charges, the key its notes verify
@@ -101,7 +101,7 @@ ${config.tosUrl ? `<div class="kv"><span>terms</span><a href="${escapeHtml(confi
 <h2>${escapeHtml(MINT_KNOWS_HEADING)}</h2>
 ${MINT_KNOWS.map(paragraph => `<p>${escapeHtml(paragraph)}</p>`).join('\n')}
 </section>
-<p class="small">Works with any LUD-25 wallet - <a href="https://github.com/forgesworn/notecase">notecase</a> among them. Verify a note offline against the signing key above.<br/>Independent implementation of the <a href="https://github.com/lnurl/luds/pull/301">LNURLcash draft</a> - graded by <a href="https://github.com/TheCryptoDonkey/lnurlcash-conformance">lnurlcash-conformance</a>.</p>
+<p class="small">Works with any LUD-25 wallet - <a href="https://github.com/forgesworn/notecase">notecase</a> among them. Verify a note offline against the signing key above.<br/>Independent implementation of the <a href="https://github.com/lnurl/luds/pull/301">LNURLcash draft</a> - graded by <a href="https://github.com/lnurlcash/lnurlcash-conformance">lnurlcash-conformance</a>.</p>
 </main>
 </body>
 </html>`;

package/dist/live-check.d.ts

@@ -1,4 +1,4 @@
-import { type InvoiceResult } from 'lnurlcash-kit';
+import { type InvoiceResult } from '@lnurlcash/kit';
 export type LiveCheckStage = 'prepared' | 'quoted' | 'settled' | 'claimed' | 'retiring' | 'retired';
 export type LiveCheckState = {
     version: 1;

package/dist/live-check.js

@@ -1,7 +1,8 @@
 import { randomBytes } from 'node:crypto';
 import { lstat, open, readFile, rename, unlink } from 'node:fs/promises';
 import { decodeBolt11 } from 'farrier-kit/bolt11';
-import { NoteSpentError, PendingNoteError, buildNoteUrl, claimMintedNote, decodeBolt11AmountMsat, fetchInvoiceVerification, fetchPayRequest, hashK1, isBolt11Invoice, isPreimage, meltNote, probeBurnedNote, requestInvoice, requireBoundMintQuote, validateBoundMintReceipt, withinMintFeeBand } from 'lnurlcash-kit';
+import { NoteSpentError, PendingNoteError, buildNoteUrl, decodeBolt11AmountMsat, fetchInvoiceVerification, fetchPayRequest, hashK1, isBolt11Invoice, isPreimage, meltNote, probeBurnedNote, requestInvoice, requireBoundMintQuote, validateBoundMintReceipt, withinMintFeeBand } from '@lnurlcash/kit';
+import { claimMintedNote } from "./claim.js";
 const stages = new Set(['prepared', 'quoted', 'settled', 'claimed', 'retiring', 'retired']);
 const errno = (error) => error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
 const serialise = (state) => `${JSON.stringify(state, null, 2)}\n`;
@@ -215,7 +216,7 @@ export const runLiveBoundMintCheck = async (options) => {
         if (state.grossMsat < pay.minSendable || state.grossMsat > pay.maxSendable) {
             throw new Error(`Test amount is outside the mint range ${pay.minSendable}-${pay.maxSendable} msat.`);
         }
-        const quote = await requestInvoice(pay.callback, state.grossMsat, { h: state.h });
+        const quote = await requestInvoice(pay.callback, state.grossMsat, state.h);
         if (!quote.verify || !quote.mint)
             throw new Error('Mint did not bind this quote to h and a verification URL.');
         const netMsat = quote.mint.amountMsat;

package/dist/names.js

@@ -1,7 +1,7 @@
 import { sha256 } from '@noble/hashes/sha2.js';
 import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 import { verifyEvent } from 'nostr-tools/pure';
-import { decodeCx1, hashK1, noteK1 } from 'lnurlcash-kit';
+import { decodeCx1, hashK1, noteK1 } from '@lnurlcash/kit';
 import { NotePendingError, NoteStore, NoteUnavailableError } from "./store.js";
 // Self-service lightning addresses.
 //

package/dist/server.js

@@ -1,7 +1,7 @@
 import { createServer } from 'node:http';
 import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
 import { finalizeEvent } from 'nostr-tools/pure';
-import { applyMintFee, decodeCk1, decodeCp1, encodeCs1, grossUpForMintFee, hashK1, recoverNoteOwnershipPubkey } from 'lnurlcash-kit';
+import { applyMintFee, decodeCp1, encodeCs1WithAmount, grossUpForMintFee, hashK1, recoverNoteOwnershipPubkey } from '@lnurlcash/kit';
 import { tryDecodeBolt11 } from 'farrier-kit/bolt11';
 import { NotePendingError, NoteStore, NoteUnavailableError, OutputCollisionError, swapFingerprint } from "./store.js";
 import { createNoteSigner } from "./signing.js";
@@ -32,9 +32,8 @@ const namedRef = (value) => {
 const spentRef = (k1) => {
     if (HEX32.test(k1))
         return { id: hashK1(k1), cp1: false };
-    const signature = decodeCk1(k1);
-    const pubkey = signature ? recoverNoteOwnershipPubkey(signature) : null;
-    return pubkey ? { id: bytesToHex(pubkey), cp1: true } : null;
+    const owner = recoverNoteOwnershipPubkey(k1);
+    return owner ? { id: bytesToHex(owner.pubkeyXOnly), cp1: true } : null;
 };
 // LUD-25 renamed `h` to `p` on the lookup and `h`/`h2` to `p1`/`p2` on the
 // callback. The old names stay accepted; sending both spellings must agree.
@@ -92,9 +91,13 @@ export const createMoneyer = async (config, deps = {}) => {
     const backend = deps.backend ?? backendFor(config);
     const signer = createNoteSigner(config.signingKey);
     // LUD-25 Part 2 signs cp1 notes only, as cs1. A hash output is a plain
-    // Part 1 note: there is nothing to attest to without disclosing the
-    // secret, so it goes out unsigned.
-    const certify = (ref, amountMsat) => ref.cp1 ? encodeCs1(hexToBytes(signer.sign(ref.id, amountMsat))) : undefined;
+    // Match the reference mint's wire format: legacy hash outputs carry the
+    // compact signature as hex, while public-key outputs carry the same
+    // signature and amount in a cs1 certificate.
+    const certify = (ref, amountMsat) => {
+        const signature = signer.sign(ref.id, amountMsat);
+        return ref.cp1 ? encodeCs1WithAmount(amountMsat, hexToBytes(signature)) : signature;
+    };
     const certified = (field, ref, amountMsat) => {
         const sig = certify(ref, amountMsat);
         return sig ? { [field]: sig } : {};
@@ -123,7 +126,7 @@ export const createMoneyer = async (config, deps = {}) => {
         if (!config.mintFee)
             return 0;
         const exact = grossMsat - applyMintFee(grossMsat, config.mintFee);
-        // Both readings sit inside lnurlcash-kit's mintFeeBand, so a wallet
+        // Both readings sit inside @lnurlcash/kit's mintFeeBand, so a wallet
         // is not misled either way - it is told the range up front.
         //
         // Absent means ON, the same as DEFAULTS and MONEYER_ROUND_FEE_TO_SAT:
@@ -280,7 +283,7 @@ export const createMoneyer = async (config, deps = {}) => {
         ...(nodeInfo.uri ? { nodeUri: nodeInfo.uri } : {}),
         ...(nodeInfo.color ? { nodeColor: nodeInfo.color } : {}),
         // nodeCapacity is the name the reference mint, the conformance
-        // mock and lnurlcash-kit all use; nodeCapacityMsat was ours alone
+        // mock and @lnurlcash/kit all use; nodeCapacityMsat was ours alone
         // and only survived a round trip through the kit's rest-spread.
         // Both go out for one release, then the old name goes.
         ...(nodeInfo.capacityMsat !== undefined
@@ -929,9 +932,10 @@ export const createMoneyer = async (config, deps = {}) => {
                 // exists.
                 ...(mirrors.length ? { mirrors } : {}),
                 ...(signer ? { mintPubkey: signer.pubkey } : {}),
-                // LUD-25 Part 2: a note named by cp1 or ck1 gets its certificate
-                // here, so a wallet need not rotate just to obtain one.
-                ...certified('sig', ref, note.amountMsat)
+                // Part 2: a note named by cp1 or ck1 gets its certificate here, so
+                // a wallet need not rotate just to obtain one. The reference mint
+                // omits the legacy raw signature from this informational response.
+                ...(ref.cp1 ? certified('sig', ref, note.amountMsat) : {})
             });
         }
         // ---- the mutating callback: melt / rotate / split / merge ----
@@ -1141,6 +1145,8 @@ export const createMoneyer = async (config, deps = {}) => {
                 catch (err) {
                     if (err instanceof NotePendingError)
                         return fail('pending');
+                    if (err instanceof OutputCollisionError && (o1.cp1 || o2.cp1))
+                        return fail('Output already in use.');
                     // OutputCollisionError shares the dead-k1 reason on purpose:
                     // which table the id collided with is an oracle nobody is owed.
                     return fail('Invalid or already spent k1.');
@@ -1162,6 +1168,8 @@ export const createMoneyer = async (config, deps = {}) => {
             catch (err) {
                 if (err instanceof NotePendingError)
                     return fail('pending');
+                if (err instanceof OutputCollisionError && o1.cp1)
+                    return fail('Output already in use.');
                 // same oracle-free reason for a collision as for a dead k1
                 return fail('Invalid or already spent k1.');
             }

package/dist/signing.js

@@ -6,7 +6,7 @@ import { bytesToHex, hexToBytes, utf8ToBytes } from '@noble/hashes/utils.js';
 //
 //   "LNURLcash:" || amount_msat || ":" || note_id
 //
-// where note_id is hex(sha256(k1)). lnurlcash-kit's noteSignatureDigest
+// where note_id is hex(sha256(k1)). @lnurlcash/kit's noteSignatureDigest
 // takes the SECRET and hashes it itself, which a wallet holds and a mint
 // never does - so the digest is rebuilt here from the id. The two must
 // agree byte for byte; the test suite proves they do by verifying every
@@ -21,7 +21,7 @@ export const signDigestRecoverable = (digest, privateKeyHex) => {
     return bytesToHex(new Uint8Array([...lead.subarray(1), lead[0]]));
 };
 // Does this signature recover to that public key? Both byte orders are
-// tried for the same reason lnurlcash-kit tries both: recovery-id-first is
+// tried for the same reason @lnurlcash/kit tries both: recovery-id-first is
 // what noble emits, recovery-id-last is what the wire carries.
 export const recoversToPubkey = (digest, signatureHex, pubkeyHex) => {
     let wireSig;

package/dist/stats.js

@@ -79,7 +79,7 @@ export const verifyStatsSignature = (stats, signatureHex, mintPubkeyHex) => {
         return false;
     }
     const target = mintPubkeyHex.trim().toLowerCase();
-    // Both byte orders are tried for the same reason lnurlcash-kit tries
+    // Both byte orders are tried for the same reason @lnurlcash/kit tries
     // both: recovery-id-first is what noble emits, recovery-id-last is what
     // the wire carries.
     const recoveryIdFirst = new Uint8Array([wireSig[64], ...wireSig.subarray(0, 64)]);

package/dist/zap.js

@@ -1,5 +1,5 @@
 import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
-import { decodeCx1, deriveNotePubkey, encodeCp1, hashK1 } from 'lnurlcash-kit';
+import { decodeCx1, deriveNotePubkey, encodeCp1, hashK1 } from '@lnurlcash/kit';
 import { tryDecodeBolt11 } from 'farrier-kit/bolt11';
 import { finalizeEvent, getPublicKey } from 'nostr-tools/pure';
 import { SimplePool } from 'nostr-tools/pool';
@@ -78,11 +78,13 @@ export const inboxRelays = async (transport, pubkey, lookOn) => {
         return [];
     return [...new Set(latest.tags.filter(t => t[0] === 'relay' && t[1]).map(t => t[1]))];
 };
-const metadataFor = (name, host, mintFeeLine, feeInWords = null) => {
+const metadataFor = (name, host, mintFeeLine, feeInWords = null, internalTransfer) => {
     const metadata = [
         ['text/plain', `Zap ${name}@${host}: arrives as a Lightning bearer note${feeInWords ? ` (${feeInWords})` : ''}`],
         ['text/identifier', `${name}@${host}`]
     ];
+    if (internalTransfer)
+        metadata.push(['text/xpub', internalTransfer]);
     if (mintFeeLine)
         metadata.push(['text/plain', mintFeeLine]);
     return JSON.stringify(metadata);
@@ -102,14 +104,32 @@ export const createZapBridge = (deps) => {
     const isZapName = (name) => store.zapName(name.toLowerCase()) !== null;
     const payRequest = (name) => {
         const lowered = name.toLowerCase();
-        if (!isZapName(lowered))
+        const registered = store.zapName(lowered);
+        if (!registered)
             return null;
+        let internalTransfer;
+        const branch = decodeCx1(registered.cx1 ?? '');
+        if (branch) {
+            let index = registered.nextIndex;
+            for (let tries = 0; tries < 1000; tries++, index++) {
+                try {
+                    const noteId = bytesToHex(deriveNotePubkey(branch.pubkeyXOnly, branch.chainCode, index));
+                    if (!store.outputIdInUse(noteId)) {
+                        internalTransfer = `${registered.cx1}:${index}`;
+                        break;
+                    }
+                }
+                catch {
+                    // A vanishingly rare unusable tweak consumes this public index.
+                }
+            }
+        }
         return {
             tag: 'payRequest',
             callback: `${origin}/z/cb/${lowered}`,
             minSendable: deps.minSendableMsat,
             maxSendable: deps.maxSendableMsat,
-            metadata: metadataFor(lowered, host, deps.mintFeeLine, deps.feeInWords),
+            metadata: metadataFor(lowered, host, deps.mintFeeLine, deps.feeInWords, internalTransfer),
             allowsNostr: true,
             nostrPubkey: pubkey
             // Deliberately no withdrawLink: the preimage of this invoice is NOT
@@ -204,7 +224,7 @@ export const createZapBridge = (deps) => {
     // the certificate, and the index `i` the holder derives the key at. A
     // reader that knows only note URLs sees no k1 and passes it by, and the
     // note waits at the mint for a scan to find it.
-    const buildKeyWrap = (row, noteId, index) => wrap(row, [...wrapTags(row), ['i', String(index)]], `${origin}/w?p=${encodeCp1(hexToBytes(noteId))}&amount=${row.netMsat}&sig=${deps.certify(noteId, row.netMsat)}&i=${index}`);
+    const buildKeyWrap = (row, noteId, index) => wrap(row, [...wrapTags(row), ['i', String(index)]], `${origin}/w?p=${encodeCp1(hexToBytes(noteId))}&sig=${deps.certify(noteId, row.netMsat)}&i=${index}`);
     // NIP-57 receipt, without the preimage tag: it is optional there, and
     // here it would only invite someone to mistake it for the note.
     const buildReceipt = (row) => {

package/llms.txt

@@ -5,13 +5,13 @@ paying an invoice it issues mints a note whose spend secret is the
 invoice's payment preimage, or a secret the buyer named with `h` on the
 pay callback. ESM-only. MIT.
 
-Install: not yet on npm - build from source (see README)
+Install: npm install @forgesworn/moneyer
 Run: node dist/cli.js --dev   (fake funding source, prints a funded note)
 
 Draft spec: https://github.com/lnurl/luds/pull/301
-Conformance: https://github.com/TheCryptoDonkey/lnurlcash-conformance
+Conformance: https://github.com/lnurlcash/lnurlcash-conformance
 Companion wallet: @forgesworn/notecase
-Client library to build against a mint: lnurlcash-kit
+Client library to build against a mint: @lnurlcash/kit
 
 ## Rules this SERVICE follows (and any mint MUST)
 
@@ -95,5 +95,7 @@ POST /names                 claim a name (NIP-98; the signer owns it); body {nam
                             The owner may resend {name, cx1} to set a branch, or cx1: null to clear it
 /z/cb/{name}                zap invoice for a name. With a cx1 the settled note is credited to the
                             holder's next key, and the kind 2525 gift wrap carries no secret:
-                            /w?p=<cp1>&amount=&sig=<cs1>&i=<index> plus an `i` tag. The index is
+                            /w?p=<cp1>&sig=<amount-bearing-cs1>&i=<index> plus an `i` tag. The index is
                             taken at settlement, never at the invoice, and occupied keys are skipped
+                            Its payRequest metadata publishes text/xpub = cx1:<next-free-index> for
+                            same-mint rotate/split/merge transfers; a raced key returns "already in use"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -56,11 +56,11 @@
     "live:bound-mint": "npm run build && node scripts/live-bound-mint-check.mjs"
   },
   "dependencies": {
+    "@lnurlcash/kit": "0.18.1",
     "@noble/curves": "^2.3.0",
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^1.2.4",
     "farrier-kit": "^1.1.3",
-    "lnurlcash-kit": "^0.13.0",
     "nostr-tools": "2.24.1"
   },
   "devDependencies": {
@@ -70,7 +70,7 @@
     "@types/node": "^24.0.0",
     "animejs": "^4.0.0",
     "happy-dom": "^20.0.0",
-    "lnurlcash-conformance": "^0.10.0",
+    "lnurlcash-conformance": "0.11.1",
     "playwright": "^1.62.1",
     "typescript": "^5.7.0",
     "uqr": "^0.1.2",