@forgesworn/moneyer 0.18.0 → 0.18.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.18.1 - 2026-10-07
+
+- **Bound mint receipts verify in current wallets again.** Since
+  `@lnurlcash/kit` moved to taproot notes, a wallet checks a settled
+  `/verify` receipt's `mint.sig` as a `cs1` over the note's Q. moneyer still
+  sent a bare hex signature over the bearer `h`, which the kit drops as
+  unreadable, so a sealed signer could not confirm a note minted here. The
+  receipt now carries the note's ordinary certificate, and a quote or
+  receipt for a note named by its `cp1` repeats that `cp1` rather than the
+  hex of its Q, which a wallet would read as a bearer `h`.
+- `@lnurlcash/kit` 0.20.2. `moneyer admin verify-note` checks a certificate
+  over the note's Q, or over `sha256(k1)` for a bearer note certified before
+  that, and still reads a pre-`cs1` signature from a note URL's `sig`. The
+  mint page and the live bound-mint check name a quote by its bare `h`.
+
 ## 0.18.0 - 2026-10-07
 
 - **A melt that cannot leave is answered with its reason.** The callback

package/README.md

@@ -420,10 +420,11 @@ The rules:
   true`, so a wallet knows this mint takes the parameter before it asks
   rather than after it pays.
 - When signing and LUD-21 verification are enabled, the quote also carries
-  `mint: {h, amount}`. This is the exact output and net millisatoshi value
-  the invoice will mint; it never carries `sig` before settlement.
+  `mint: {h, amount}`. This is the exact output, in the spelling the wallet
+  named it (a bearer note's hex `h`, or its `cp1`), and the net millisatoshi
+  value the invoice will mint; it never carries `sig` before settlement.
 - Once settled, `/verify` repeats the same `h` and `amount` and adds `sig`,
-  the ordinary LUD-25 signature over `LNURLcash:<amount>:<h>`. A sealed
+  the note's ordinary LUD-25 certificate: a `cs1` over its Q. A sealed
   signer can verify that receipt against the pre-payment commitment and
   pinned `mintPubkey`, then confirm its staged note without exporting `k1`.
 - Claiming needs nothing else. `GET /w?k1=<the secret>` brings the note

package/dist/admin.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
 import { secp256k1 } from '@noble/curves/secp256k1.js';
-import { noteDeclaredAmount, noteK1, noteSignature, verifyNoteSignature, verifyNoteSignatureHash } from '@lnurlcash/kit';
+import { encodeCs1WithAmount, hashK1, noteDeclaredAmount, noteK1, noteSignature, verifyNoteSignatureForKey } from '@lnurlcash/kit';
 import { decodeNote, decodeSpend } from "./spend.js";
 import { configFromEnv, pubkeyHex } from "./config.js";
 import { NoteStore } from "./store.js";
@@ -374,7 +374,20 @@ export const runAdmin = async (argv, deps = {}) => {
                 }
                 const id = bytesToHex(spend.outputKey);
                 const declared = noteDeclaredAmount(url);
-                const signature = noteSignature(url);
+                // `c` since the taproot unification; `sig` on a note URL from before.
+                let signature = noteSignature(url);
+                if (!signature) {
+                    try {
+                        signature = new URL(url).searchParams.get('sig');
+                    }
+                    catch { }
+                }
+                // The kit reads only a cs1 now. A certificate from before that was
+                // the bare 65-byte signature in hex, its amount on the URL beside
+                // it: put the amount back into a cs1 so it can still be checked.
+                if (signature && declared !== null && /^[0-9a-f]{130}$/i.test(signature)) {
+                    signature = encodeCs1WithAmount(declared, hexToBytes(signature));
+                }
                 const current = signingPubkey(config);
                 const keys = [...(current ? [current] : []), ...(config.previousSigningPubkeys ?? [])];
                 out(`note id  ${id}`);
@@ -387,9 +400,12 @@ export const runAdmin = async (argv, deps = {}) => {
                     out('signature present, but the URL declares no amount to check it against');
                 }
                 else {
-                    // Over Q, as LUD-25 certifies every note now, or over the note's
-                    // old id for a certificate issued before that.
-                    const signedBy = keys.find(pubkey => verifyNoteSignatureHash(id, declared, signature, pubkey) || verifyNoteSignature(k1, declared, signature, pubkey));
+                    // Over Q, as LUD-25 certifies every note now, or, for a bearer
+                    // note certified before that, over its old id sha256(k1). A key
+                    // note's old id was its key, which is Q already.
+                    const legacyId = spend.kind === 'script' && /^[0-9a-f]{64}$/i.test(k1.trim()) ? hashK1(k1.trim()) : null;
+                    const signedBy = keys.find(pubkey => verifyNoteSignatureForKey(id, declared, signature, pubkey) ||
+                        (legacyId !== null && verifyNoteSignatureForKey(legacyId, declared, signature, pubkey)));
                     out(signedBy === undefined
                         ? 'signature DOES NOT verify against this mint'
                         : `signature verifies against ${signedBy === current ? 'the current key' : `a previous key (${signedBy})`}`);

package/dist/live-check.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { lstat, open, readFile, rename, unlink } from 'node:fs/promises';
 import { decodeBolt11 } from 'farrier-kit/bolt11';
-import { NoteSpentError, PendingNoteError, buildNoteUrl, decodeBolt11AmountMsat, fetchInvoiceVerification, fetchPayRequest, hashK1, isBolt11Invoice, isPreimage, meltNote, probeBurnedNote, requestInvoice, requireBoundMintQuote, validateBoundMintReceipt, withinMintFeeBand } from '@lnurlcash/kit';
+import { NoteSpentError, PendingNoteError, buildNoteUrl, decodeBolt11AmountMsat, fetchInvoiceVerification, fetchPayRequest, hashK1, isBolt11Invoice, isPreimage, meltNote, probeBurnedNote, requestInvoiceShort, requireBoundMintQuote, validateBoundMintReceipt, withinMintFeeBand } from '@lnurlcash/kit';
 import { claimMintedNote } from "./claim.js";
 const stages = new Set(['prepared', 'quoted', 'settled', 'claimed', 'retiring', 'retired']);
 const errno = (error) => error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
@@ -216,7 +216,9 @@ export const runLiveBoundMintCheck = async (options) => {
         if (state.grossMsat < pay.minSendable || state.grossMsat > pay.maxSendable) {
             throw new Error(`Test amount is outside the mint range ${pay.minSendable}-${pay.maxSendable} msat.`);
         }
-        const quote = await requestInvoice(pay.callback, state.grossMsat, state.h);
+        // Named by the bare h, which the kit reads as a bearer note's h and
+        // normalises to its Q on both sides of the comparison below.
+        const quote = await requestInvoiceShort(pay.callback, state.grossMsat, state.h);
         if (!quote.verify || !quote.mint)
             throw new Error('Mint did not bind this quote to h and a verification URL.');
         const netMsat = quote.mint.amountMsat;

package/dist/server.js

@@ -5,7 +5,7 @@ import { applyMintFee, encodeCs1WithAmount, grossUpForMintFee, hashK1 } from '@l
 import { tryDecodeBolt11 } from 'farrier-kit/bolt11';
 import { NotePendingError, NoteStore, NoteUnavailableError, OutputCollisionError, swapFingerprint } from "./store.js";
 import { createNoteSigner } from "./signing.js";
-import { bearerNoteId, decodeNote, decodeSpend, spendDomainOf, verifySpend } from "./spend.js";
+import { bearerNoteId, decodeNote, decodeSpend, encodeCp1, spendDomainOf, verifySpend } from "./spend.js";
 import { createKernelVerifier } from "./kernel.js";
 import { describeFee } from "./fee-words.js";
 import { createFakeBackend } from "./backends/fake.js";
@@ -25,6 +25,10 @@ const namedRef = (value) => {
     const q = decodeNote(value);
     return q ? { q, named: HEX32.test(value) ? value : q } : null;
 };
+// The name a quote or receipt repeats back, in the spelling the wallet used.
+// A wallet reads bare hex there as a bearer note's h, so a note named by its
+// cp1 has to come back as that cp1, never as the hex of its Q.
+const echoedName = (q, named) => (named === q ? encodeCp1(hexToBytes(q)) : named);
 const INVALID_K1 = 'Invalid or already spent k1.';
 // LUD-25's own reason for an output that names a note already credited.
 const IN_USE = 'already in use';
@@ -839,7 +843,7 @@ export const createMoneyer = async (config, deps = {}) => {
                 // value this invoice will mint. It is only offered when /verify can
                 // later authenticate settlement with this mint's signing key.
                 ...(config.verify && signer
-                    ? { mint: { h: commentRef.named, amount: net } }
+                    ? { mint: { h: echoedName(commentRef.q, commentRef.named), amount: net } }
                     : {}),
                 // Every current-draft mint quote is comment-bound, so the LUD-21
                 // preimage is ordinary settlement proof and safe to disclose after
@@ -879,19 +883,21 @@ export const createMoneyer = async (config, deps = {}) => {
                     preimage: preimageHex,
                     pr: invoice.pr,
                     // Repeating h and amount binds this response to the quote. The
-                    // ordinary note signature appears only once value exists at h.
-                    // The receipt signs exactly the `h` it repeats - what the wallet
-                    // named, a bearer note's h or a cp1's Q - since that is what a
-                    // receipt validator checks it over. The note's own certificate,
-                    // the cs1 over its Q, comes from the withdraw endpoint.
+                    // signature appears only once value exists there, and it is the
+                    // note's ordinary certificate: a cs1 over its Q, which is what a
+                    // receipt validator derives from the repeated name and checks.
+                    // A quote from before notes were keyed by Q stored the bearer h
+                    // as its output and no separate name.
                     ...(currentInvoice.outputId !== null && signer
                         ? (() => {
+                            const legacy = currentInvoice.outputNamed === null;
+                            const q = legacy ? bearerNoteId(currentInvoice.outputId) : currentInvoice.outputId;
                             const named = currentInvoice.outputNamed ?? currentInvoice.outputId;
                             return {
                                 mint: {
-                                    h: named,
+                                    h: echoedName(q, named),
                                     amount: currentInvoice.netMsat,
-                                    ...(settled ? { sig: signer.sign(named, currentInvoice.netMsat) } : {})
+                                    ...(settled ? { sig: certify(q, currentInvoice.netMsat) } : {})
                                 }
                             };
                         })()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -74,7 +74,7 @@
     "live:bound-mint": "npm run build && node scripts/live-bound-mint-check.mjs"
   },
   "dependencies": {
-    "@lnurlcash/kit": "0.18.1",
+    "@lnurlcash/kit": "0.20.2",
     "@noble/curves": "^2.3.0",
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^1.2.4",