lnurlcash-conformance 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,26 @@ Semantic versioning. While the LUD-25 draft is unmerged, `0.x` minor bumps
 may add or tighten checks that a previously-passing mint now fails; pin an
 exact version if you gate CI on the grade.
 
+## 0.11.0 - 2026-09-15
+
+**Amount-bearing certificates and internal-transfer discovery.** Part 2 now
+follows the current `lnurl-wallet` and `lnurl-mint` reference implementations;
+the draft LUD-25 prose may lag this release.
+
+- `cs1` carries `amount_msat` in its human-readable part using BOLT-11's
+  amount suffix rules. The vectors reject the legacy fixed `cs` HRP, and
+  the live grader requires the encoded amount to equal the note's
+  authoritative `maxWithdrawable` before verifying the certificate.
+- `--address` now requires a valid `text/xpub` metadata entry carrying the
+  registered `cx1` plus its next-index hint. The mock address publishes a
+  real branch and advances outputs with the LUD-25 public derivation.
+- Legacy hash mutation outputs are signed by the current references. The
+  grader still accepts an omitted signature because the reference mint may
+  run without an available signer, but verifies every signature it receives.
+- The compliant mock enables secret-free hash lookup by default, matching
+  the current reference wallet and mint. `hashLookup: false` remains an
+  explicit older-SERVICE fixture.
+
 ## 0.10.0 - 2026-09-11
 
 **Signatures belong to cp1 notes.** The Part 2 rewrite of LUD-25 signs a

package/README.md

@@ -48,7 +48,7 @@ for (const c of cases) {
 | `signature.json` | offline verification, both recovery-id orderings, malformed input |
 | `derivation.json` | deterministic note secrets from a BIP39 seed |
 | `cash-derivation.json` | LUD-25's seed-recoverable note secrets under `m/139'`, with BIP-32's own vector 1 |
-| `part2.json` | Part 2: `cp1`/`ck1`/`cs1`/`cx1`, the per-note key tweak, ownership signatures and mint certificates, on the reference wallet's `m/139'/1'` address path |
+| `part2.json` | Part 2: `cp1`/`ck1`/amount-bearing `cs1`/`cx1`, the per-note key tweak, note ownership and mint certificates, on the reference wallet's `m/139'/1'` address path |
 | `bech32.json` | LUD-01 encoding, round trips, corrupted checksums |
 | `url-admission.json` | which URLs may be fetched, and why `data:` must never be |
 | `input-resolution.json` | bech32, LUD-17, Lightning Addresses, bare domains |
@@ -95,7 +95,7 @@ must survive:
 | `--echoWrongK1` | answers the informational GET with a different `k1` |
 | `--lieAboutValue=N` | reports a `maxWithdrawable` it never signed |
 | `--signatureLayout=leading` | emits the recovery id at the other end |
-| `--signatures=false` | issues no Part 1 signatures. Allowed since the Part 2 rewrite: a plain note is unsigned by design, so the grader passes it |
+| `--signatures=false` | issues no Part 1 signatures. Accepted as the reference mint's degraded no-signer mode; the reference wallet will refuse an unsigned successful mutation |
 | `--serverGeneratedSecrets` | hands back a secret it generated — the exposure `h` exists to close |
 | `--meltNeverSettles` | holds every melt in flight, so notes stay `pending` |
 | `--meltAlwaysFails` | fails every payment, restoring the note |
@@ -136,7 +136,7 @@ conforming default explicit. Optional fields stay absent unless requested:
 | `--previousPrivateKey=<hex>` | an old signing key the mock still holds. Its public half joins `previousPubkeys` on its own |
 | `--signWithPreviousKey` | issues every note under that old key while still advertising the new one: the mid-rotation state a mint passes through when the advertisement moves before the signer |
 | `--retriedMutation=replay` | answers a byte-identical repeat of a mutation with the original success. This is the conforming default; use `refuse` only as an adversarial fixture |
-| `--hashLookup=true` | accepts an informational lookup by `h=sha256(k1)` without returning the bearer secret. Off by default because the capability is optional |
+| `--hashLookup=false` | models an older SERVICE with no secret-free informational lookup. The current reference mock accepts `h=sha256(k1)` by default |
 | `--mintToHash` | accepts `h` alongside the mandatory identical comment and enables the additive quote/receipt fields. Off by default; baseline comment-bound minting remains on |
 | `--mintReceipt` | with `--mintToHash`, adds the optional quote commitment and signed LUD-21 settlement receipt |
 | `--mintToHashAdvertisedOn=quote` | narrows which of the three places claim it (`payRequest`, `mintAddress`, `quote`); all three by default. Changes only what is claimed, never what the mint does |

package/mock-mint/index.mjs

@@ -11,6 +11,7 @@
 // Usable as a library (createMockMint) or standalone (npm start).
 
 import {createServer} from 'node:http'
+import {bech32m} from '@scure/base'
 import {sha256} from '@noble/hashes/sha2.js'
 import {secp256k1} from '@noble/curves/secp256k1.js'
 import {bytesToHex, hexToBytes, utf8ToBytes} from '@noble/hashes/utils.js'
@@ -20,6 +21,27 @@ import {pathToFileURL} from 'node:url'
 
 const LSM_PREFIX = 'Lightning Signed Message:'
 
+const concat = (...parts) => {
+  const out = new Uint8Array(parts.reduce((size, part) => size + part.length, 0))
+  let offset = 0
+  for (const part of parts) {
+    out.set(part, offset)
+    offset += part.length
+  }
+  return out
+}
+
+const taggedHash = (tag, ...parts) => {
+  const tagHash = sha256(utf8ToBytes(tag))
+  return sha256(concat(tagHash, tagHash, ...parts))
+}
+
+const ser32 = value => {
+  const out = new Uint8Array(4)
+  new DataView(out.buffer).setUint32(0, value, false)
+  return out
+}
+
 const noteId = k1 => bytesToHex(sha256(hexToBytes(k1)))
 
 const sigDigest = (noteIdHex, amountMsat) =>
@@ -193,7 +215,9 @@ const DEFAULTS = {
   //   'hidesSpent'     - non-compliant: hides a retained burned h as unknown
   //   'revealsSpent'   - legacy alias for the now-compliant true behaviour
   //   'acceptsBoth'    - non-compliant: accepts k1 and h together
-  hashLookup: false,
+  // Current reference wallet and mint use secret-free informational
+  // lookups by default. Set false only to model an older SERVICE.
+  hashLookup: true,
   // LUD-25 lets a SERVICE refuse an oversized merge outright rather than
   // let the URL be mangled upstream. 0 is no explicit cap; a positive number
   // refuses more than that many k1 with the draft's own reason string.
@@ -244,6 +268,13 @@ const DEFAULTS = {
   // the draft's line 80 behaviour and is now the defect - see
   // docs/COMMENT-IS-MANDATORY.md.
   commentFallsBack: false,
+  // LUD-25 Part 2: a registered Lightning Address with a cx1 against it.
+  // Not a defect - this mint has a key to mint under whatever the comment
+  // says (the next unused one on its branch), so a comment naming no
+  // output is the free text LUD-12 invites and is ignored, not refused.
+  // The note still lands under a branch key and never under the payment
+  // preimage, which is the whole difference from `commentFallsBack`.
+  registeredAddress: false,
   // non-compliant, and narrower: refuse a malformed comment - an empty value
   // included - but fall back when the key is absent entirely. That is the
   // distinction the malformed loop cannot reach, and the commonest way to
@@ -306,6 +337,20 @@ export const createMockMint = async (options = {}) => {
   // below asks exactly what it asked before.
   const boundOutputs = new Map()
 
+  // A deterministic watch-only branch for the registered-address fixture.
+  // It is public test material, not a secret used for value. The mock uses
+  // the actual LUD-25 tweak so its text/xpub hint names the same output its
+  // next quote reserves.
+  const registeredBranchSecret = hexToBytes('44'.repeat(32))
+  const registeredBranchPubkey = secp256k1.getPublicKey(registeredBranchSecret, true).slice(1)
+  const registeredChainCode = sha256(utf8ToBytes('lnurlcash-conformance registered address'))
+  const registeredCx1 = bech32m.encode(
+    'cx',
+    bech32m.toWords(concat(registeredBranchPubkey, registeredChainCode)),
+    200
+  )
+  let registeredIndex = 0
+
   // An id is spoken for if it is a note in any state, the payment hash of
   // an invoice this mint issued, or the output a bound quote is waiting
   // to credit. Minting over any of them hands the output to somebody who
@@ -314,6 +359,19 @@ export const createMockMint = async (options = {}) => {
   const outputIdInUse = id =>
     notes.has(id) || invoices.has(id) || boundOutputs.has(id)
 
+  const nextRegisteredOutput = () => {
+    const branch = secp256k1.Point.fromBytes(concat(Uint8Array.of(0x02), registeredBranchPubkey))
+    for (;;) {
+      const index = registeredIndex++
+      const tweak = BigInt(
+        `0x${bytesToHex(taggedHash('LNURLcash/derive', registeredBranchPubkey, registeredChainCode, ser32(index)))}`
+      )
+      if (tweak >= secp256k1.Point.Fn.ORDER) continue
+      const output = bytesToHex(branch.add(secp256k1.Point.BASE.multiply(tweak)).toBytes(true).slice(1))
+      if (!outputIdInUse(output)) return output
+    }
+  }
+
   // What makes a request the same request: the same input k1 set, the
   // same h, the same h2, the same amount. The inputs are a set rather
   // than a sequence, because a merge naming the same notes in a different
@@ -496,6 +554,9 @@ export const createMockMint = async (options = {}) => {
       if (opts.baseFeeMsat > 0 || opts.feePpm > 0) {
         metadata.push(['text/plain', `Mint fees: ${opts.baseFeeMsat},${opts.feePpm}`])
       }
+      if (opts.registeredAddress) {
+        metadata.push(['text/xpub', `${registeredCx1}:${registeredIndex}`])
+      }
       return send({
         tag: 'payRequest',
         callback: `${origin}/p/cb`,
@@ -720,6 +781,11 @@ export const createMockMint = async (options = {}) => {
             // to compare h.
             boundTo = h
             namedByComment = true
+          } else if (opts.registeredAddress) {
+            // The next unused key on the branch. Claimed as the quote is
+            // issued, so two free-text quotes never name one output.
+            boundTo = nextRegisteredOutput()
+            namedByComment = true
           } else if (
             !opts.commentFallsBack &&
             !(opts.commentFallsBackWhenAbsent && sent === null)
@@ -826,6 +892,16 @@ export const createMockMint = async (options = {}) => {
           minWithdrawable: 0,
           maxWithdrawable: (held?.amountMsat ?? 21000) + opts.lieAboutValue,
           defaultDescription: 'an LNURLcash note',
+          // Keep the mock's optional way-home extension identical for
+          // secret-free and raw-secret lookups. This is test fixture policy,
+          // not a requirement imposed on a reference mint.
+          ...(opts.noteInfoPayLink
+            ? {
+                payLink: opts.payLinkOffOrigin
+                  ? 'https://elsewhere.example/.well-known/lnurlp/mint'
+                  : `${origin}/.well-known/lnurlp/${opts.username}`
+              }
+            : {}),
           mintPubkey: pubkey
         })
       }
@@ -842,12 +918,10 @@ export const createMockMint = async (options = {}) => {
         minWithdrawable: 0,
         maxWithdrawable: note.amountMsat + opts.lieAboutValue,
         defaultDescription: 'an LNURLcash note',
-        // The way home, as the reference mint publishes it. A holder with
-        // nothing but a note can reach the document carrying this mint's
-        // terms and its retired signing keys; without it a wallet that only
-        // ever received notes cannot tell an announced key rotation from a
-        // substituted key, because the document lives under a username the
-        // note never mentions.
+        // Optional way-home extension used by consumer policy tests. A holder
+        // with nothing but a note can then reach the document carrying this
+        // mint's terms and retired signing keys. Reference implementations do
+        // not make this field mandatory on an informational note response.
         ...(opts.noteInfoPayLink
           ? {
               payLink: opts.payLinkOffOrigin

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lnurlcash-conformance",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Language-neutral conformance vectors, an adversarial mock mint, and a grader for LNURLcash (LUD-25) implementations",
   "author": "TheCryptoDonkey",
   "license": "MIT",

package/runner/cli.mjs

@@ -27,10 +27,27 @@ if (positional.length === 0 && !noteArg) {
   lnurlcash-conform <mint> --note=<url> --pr=<invoice>  same, paid amount from the invoice
   lnurlcash-conform <mint> --note=<url> --preimage=<hex> + the bound-mint checks
   lnurlcash-conform <mint> --note=<url> --spend         + the full mutating checks
+  lnurlcash-conform <address> --address              grade a Part 2 registered address
 
 <mint> may be a Lightning Address (mint@example.com), a bare domain, or a
 payRequest URL.
 
+--address says the target is a LUD-25 Part 2 Lightning Address with a cx1
+registered against it, not a mint payLink. Such an address mints on the next
+unused key of its own branch, so a comment naming no output is the ordinary
+free text LUD-12 invites and must not fail the payment; without this flag the
+stricter payLink rules apply, which require every quote to name its output.
+Declared rather than detected, and it cannot be otherwise: a mint that
+unsafely falls back to a preimage-keyed note answers a free-text comment
+exactly the same way, and the two differ only in what key the note lands
+under, which nothing reveals before settlement. So --address takes the
+operator's word for it. Use it on an address you control or trust; without
+it the strict rules catch the unsafe mint, with it they cannot.
+
+Note that each quote the checks issue claims the next key on the branch,
+whether or not anyone pays it, so grading an address in use costs it a few
+indices.
+
 --paid/--pr name what the note's mint invoice was paid at, and require the
 note to be freshly minted and never rotated: the check compares its value
 against the LUD-25 fee formula. It is read-only.
@@ -52,7 +69,7 @@ let pay
 if (positional[0]) {
   const payUrl = resolveMint(positional[0])
   console.log(`grading ${payUrl}\n`)
-  pay = await gradeMint(payUrl, report)
+  pay = await gradeMint(payUrl, report, {registeredAddress: flags.has('--address')})
 }
 
 const mintFee =

package/runner/index.d.ts

@@ -57,8 +57,31 @@ export declare const applyMintFee: (gross: number, fee: MintFee | null) => numbe
 /** the `Mint fees: base,ppm` line out of a payRequest's metadata array */
 export declare const parseAdvertisedMintFee: (metadata: string) => MintFee | null
 
+export interface InternalTransferHint {
+  cx1: string
+  index: number
+  pubkeyXOnly: Uint8Array
+  chainCode: Uint8Array
+}
+
+/** the `text/xpub` branch and next-index hint out of registered-address metadata */
+export declare const parseInternalTransferHint: (
+  metadata: string
+) => InternalTransferHint | null
+
 /** the read-only mint checks: payRequest, withdrawLink, fees, verify, extensions */
-export declare const gradeMint: (payUrl: string, report: Report) => Promise<void>
+export declare const gradeMint: (
+  payUrl: string,
+  report: Report,
+  options?: {
+    /** Grade as a LUD-25 Part 2 registered Lightning Address rather than a
+     * mint payLink: it mints on the next unused key of its own branch, so a
+     * comment naming no output is free text and must not fail the payment.
+     * Declared, not detected - an unsafe preimage-keyed fallback looks
+     * identical before settlement. */
+    registeredAddress?: boolean
+  }
+) => Promise<void>
 
 /**
  * Read-only. Needs a freshly minted, never-rotated note and what its mint

package/runner/index.mjs

@@ -37,8 +37,8 @@ const recoversTo = (digest, sig, pubkeyHex) => {
   return false
 }
 
-// A Part 1 signature, over the note's hash. The spec no longer asks for
-// one, but a mint that still issues them must at least issue true ones.
+// The legacy raw Part 1 signature over a note's hash. Current reference mints
+// issue one when a signer is available, and every one received must be true.
 const verifySignature = (k1, amountMsat, signatureHex, pubkeyHex) => {
   let sig
   try {
@@ -54,7 +54,8 @@ const verifyCertificate = (pubkeyHex32, amountMsat, sig, mintPubkeyHex) =>
   recoversTo(signedMessageDigest(`LNURLcash:${amountMsat}:${pubkeyHex32}`), sig, mintPubkeyHex)
 
 // Part 2's bech32m strings: cp1 (32-byte key), ck1 and cs1 (65-byte
-// signature). Longer than BIP-173's 90 characters by design.
+// signature). cs1 has a variable HRP: "cs" plus the amount under BOLT-11's
+// amount rules. Longer than BIP-173's 90 characters by design.
 const BECH32M_LIMIT = 200
 const encodeCash = (hrp, bytes) => bech32m.encode(hrp, bech32m.toWords(bytes), BECH32M_LIMIT)
 const decodeCash = (hrp, value, length) => {
@@ -69,6 +70,25 @@ const decodeCash = (hrp, value, length) => {
   }
 }
 
+const AMOUNT_MSAT_PER_UNIT = {'': 1e11, m: 1e8, u: 1e5, n: 100, p: 0.1}
+const amountSuffixMsat = suffix => {
+  const match = suffix.match(/^(\d+)([munp])?$/)
+  if (!match) return null
+  const amount = Number(match[1]) * AMOUNT_MSAT_PER_UNIT[match[2] ?? '']
+  return Number.isSafeInteger(amount) ? amount : null
+}
+
+const decodeCertificate = value => {
+  if (typeof value !== 'string') return null
+  const lower = value.trim().toLowerCase()
+  const sep = lower.lastIndexOf('1')
+  if (sep < 3 || !lower.startsWith('cs')) return null
+  const amountMsat = amountSuffixMsat(lower.slice(2, sep))
+  if (amountMsat === null) return null
+  const signature = decodeCash(lower.slice(0, sep), lower, 65)
+  return signature ? {amountMsat, signature} : null
+}
+
 // The bearer secret of a cp1 note: the key's signature over the fixed
 // message "LNURLcash", r || s || recovery-id, the same value every time.
 const ownershipProof = secretKey => {
@@ -235,6 +255,31 @@ export const parseAdvertisedMintFee = metadata => {
   return null
 }
 
+// A registered Part 2 address advertises the safe-to-share branch and its
+// best-known next index as ["text/xpub", "cx1...:<i>"]. Parsing it here
+// makes --address assert the actual discovery signal rather than merely
+// trusting the operator's flag.
+export const parseInternalTransferHint = metadata => {
+  let entries
+  try {
+    entries = JSON.parse(metadata)
+  } catch {
+    return null
+  }
+  if (!Array.isArray(entries)) return null
+  for (const entry of entries) {
+    if (!Array.isArray(entry) || entry[0] !== 'text/xpub' || typeof entry[1] !== 'string') continue
+    const sep = entry[1].lastIndexOf(':')
+    if (sep < 0) continue
+    const cx1 = entry[1].slice(0, sep)
+    const index = Number(entry[1].slice(sep + 1))
+    const branch = decodeCash('cx', cx1.toLowerCase(), 64)
+    if (!branch || !Number.isInteger(index) || index < 0 || index > 0xffffffff) continue
+    return {cx1, index, pubkeyXOnly: branch.slice(0, 32), chainCode: branch.slice(32)}
+  }
+  return null
+}
+
 // Resolves what the user typed - a Lightning Address, a bare domain, or a
 // URL - to the payRequest URL to grade.
 export const resolveMint = input => {
@@ -253,7 +298,32 @@ export const resolveMint = input => {
 
 // ---- read-only checks -----------------------------------------------------
 
-export const gradeMint = async (payUrl, report) => {
+// `registeredAddress` grades the target as a LUD-25 Part 2 Lightning
+// Address rather than a mint payLink. The two are the same document to a
+// wallet - both advertise commentAllowed and a withdrawLink, and both
+// mint on payment - but the draft's comment rules are written for the
+// payLink, which has no key to mint under but the one the comment names.
+// A cx1-registered address always has one, the next unused key on its
+// branch, so there a comment naming no output is the ordinary free text
+// LUD-12 invites and is ignored rather than refused (lnurl-mint #46,
+// after every Wallet of Satoshi and Primal payment to such an address
+// failed on a typed message).
+//
+// Deliberately a flag and not a probe. "Returned an invoice for a comment
+// naming no output" is also exactly what a mint falling back to a
+// preimage-keyed note does, and that mint is dangerous - the preimage
+// race the draft's Security considerations describes. Nothing on the wire
+// tells the two apart before settlement: they differ only in what key the
+// note lands under. Guessing would wave the dangerous one through, so the
+// strict payLink rules stay the default and an address is declared.
+//
+// The cost of that is real and worth stating: this flag takes the
+// operator's word, and a preimage-keyed fallback passes under it. It
+// relaxes the comment rules and nothing else, and the draft gives an
+// address no way to say what it is on the wire. A signal it could
+// advertise - so this became detectable rather than declared - is worth
+// raising against LUD-25 Part 2.
+export const gradeMint = async (payUrl, report, {registeredAddress = false} = {}) => {
   let pay
   let mintAddress
   await report.check('payRequest resolves and is well-formed', async () => {
@@ -307,6 +377,14 @@ export const gradeMint = async (payUrl, report) => {
     return `${match[1]} msat + ${match[2]} ppm`
   })
 
+  if (registeredAddress) {
+    await report.check('advertises its cx1 and next index for internal transfers', async () => {
+      const hint = parseInternalTransferHint(pay.metadata)
+      assert(hint, 'no valid ["text/xpub", "cx1...:<i>"] metadata entry')
+      return `index ${hint.index}`
+    })
+  }
+
   let verifyUrl
   await report.check('issues an invoice for the amount requested', async () => {
     const amount = Math.max(pay.minSendable, 1000)
@@ -579,6 +657,19 @@ export const gradeMint = async (payUrl, report) => {
     }
     const spelt = spelling => (spelling === 'comment' ? 'a LUD-12 comment' : 'an h parameter')
 
+    // The behaviour #46 fixed, asserted rather than assumed. Asked once,
+    // not once per malformed value: on an address a quote claims the next
+    // branch index as it is issued, so every probe costs the holder a key
+    // whether or not anyone pays. `gm` is short enough that no mint could
+    // read it as a commitment of any spelling.
+    if (registeredAddress) {
+      const freeText = await quoteAt('comment', 'gm')
+      assert(
+        freeText.status !== 'ERROR' && typeof freeText.pr === 'string',
+        `refused a comment naming no output: ${freeText.reason} - this address mints on its own branch, so an ordinary LUD-12 message must not fail the payment`
+      )
+    }
+
     const advertised = spellingsOf(pay)
     const corroborated = spellingsOf(mintAddress)
     const claimed = [...new Set([...advertised, ...corroborated])]
@@ -655,6 +746,11 @@ export const gradeMint = async (payUrl, report) => {
 
     for (const spelling of probed) {
       for (const [what, value] of malformed) {
+        // Every one of these names no output, which on an address is free
+        // text, already covered above. `h` stays probed either way: it is
+        // a parameter invented for this one purpose, so a malformed one is
+        // a wallet error wherever it is sent.
+        if (spelling === 'comment' && registeredAddress) continue
         const body = await quoteAt(spelling, value)
         if (spelling === 'h') {
           if (!hClaimed) continue
@@ -679,10 +775,20 @@ export const gradeMint = async (payUrl, report) => {
     const bare = new URL(pay.callback)
     bare.searchParams.set('amount', String(amount))
     const unnamed = await get(bare)
-    assert(
-      unnamed.status === 'ERROR' && !unnamed.pr,
-      'issued an invoice for a quote carrying no comment - current LUD-25 requires rejection before invoicing'
-    )
+    if (registeredAddress) {
+      // The draft is explicit that a registered address needs no comment
+      // at all: it derives the next key from its own cx1. Refusing here
+      // would break every plain Lightning payment to the address.
+      assert(
+        unnamed.status !== 'ERROR' && typeof unnamed.pr === 'string',
+        `refused a quote carrying no comment: ${unnamed.reason} - a registered address mints on its own branch, so a payment to it must not need one`
+      )
+    } else {
+      assert(
+        unnamed.status === 'ERROR' && !unnamed.pr,
+        'issued an invoice for a quote carrying no comment - current LUD-25 requires rejection before invoicing'
+      )
+    }
 
     if (hClaimed) {
       const mismatch = new URL(pay.callback)
@@ -739,6 +845,9 @@ export const gradeMint = async (payUrl, report) => {
       }
     }
     if (problems.length > 0) throw soft(problems.join('; '))
+    if (registeredAddress) {
+      return `registered Lightning Address, minting on its own branch: named by ${probed.join(' and ')}; claimed by ${claimedBy.join(', ')}; bound a quote to a hash of the runner's own secret, and honoured one carrying free text and one carrying no comment at all`
+    }
     return `named by ${probed.join(' and ')}; claimed by ${claimedBy.join(', ')}; bound a quote to a hash of the runner's own secret and handled four malformed ones as the draft requires`
   })
 
@@ -1095,17 +1204,19 @@ export const gradeNote = async (noteUrl, report, options = {}) => {
       ? 'the signature verifies against neither the advertised mintPubkey nor any published previous key'
       : 'the signature does not verify against the advertised mintPubkey and amount'
 
-  await report.check('a plain note carries no signature, or one that verifies', async () => {
-    // LUD-25 Part 2 signs cp1 notes only: a hash has nothing to attest to
-    // without disclosing the secret, so a plain note is unsigned by
-    // design. A mint that still issues the old Part 1 signature over the
-    // hash is harmless, as long as the signature is a true one.
-    if (currentSig === null) return 'unsigned, as Part 2 specifies for a plain note'
+  await report.check('a legacy hash mutation signature verifies when present', async () => {
+    // The reference mint can operate without a signing backend and then has
+    // no signature to return. That mode remains usable by tolerant clients,
+    // but the committed reference wallet requires a signature after a
+    // successful mutation, so omission is an interoperability warning.
+    if (currentSig === null) {
+      throw soft('unsigned legacy output: accepted as no-signer mode, but strict reference-wallet clients may refuse it')
+    }
     assert(info.mintPubkey, 'a sig with no mintPubkey advertised verifies against nothing')
     assert(isCompressedPubkey(info.mintPubkey), 'mintPubkey is not a 33-byte compressed secp256k1 key')
     const signedBy = signerOf(key => verifySignature(current, info.maxWithdrawable, currentSig, key))
     assert(signedBy, unverified())
-    return `a legacy Part 1 signature, ${describeSigner(signedBy)}`
+    return `legacy Part 1 signature ${describeSigner(signedBy)}`
   })
 
   await report.check('reports a spent hash distinguishably from an unknown hash', async () => {
@@ -1476,9 +1587,13 @@ export const gradeNote = async (noteUrl, report, options = {}) => {
     assert(info.mintPubkey, 'issued a cp1 note with no mintPubkey advertised - nothing to verify its certificate against')
     assert(isCompressedPubkey(info.mintPubkey), 'mintPubkey is not a 33-byte compressed secp256k1 key')
     const pubkeyHex = bytesToHex(pubkey)
-    const certificate = decodeCash('cs', body.sig, 65)
-    assert(certificate, `the rotate to a cp1 output returned no cs1 certificate in sig (got ${JSON.stringify(body.sig)})`)
-    const signedBy = signerOf(key => verifyCertificate(pubkeyHex, info.maxWithdrawable, certificate, key))
+    const certificate = decodeCertificate(body.sig)
+    assert(certificate, `the rotate to a cp1 output returned no amount-bearing cs1 certificate in sig (got ${JSON.stringify(body.sig)})`)
+    assert(
+      certificate.amountMsat === info.maxWithdrawable,
+      `the cs1 says ${certificate.amountMsat} msat but the note is worth ${info.maxWithdrawable} msat`
+    )
+    const signedBy = signerOf(key => verifyCertificate(pubkeyHex, certificate.amountMsat, certificate.signature, key))
     assert(signedBy, unverified())
 
     // The informational GET by ck1 delivers the certificate again, so a
@@ -1491,10 +1606,14 @@ export const gradeNote = async (noteUrl, report, options = {}) => {
       lookup.maxWithdrawable === info.maxWithdrawable,
       `value changed across a rotate to cp1: ${info.maxWithdrawable} -> ${lookup.maxWithdrawable}`
     )
-    const again = decodeCash('cs', lookup.sig, 65)
-    assert(again, 'the informational GET by ck1 returned no cs1 certificate')
+    const again = decodeCertificate(lookup.sig)
+    assert(again, 'the informational GET by ck1 returned no amount-bearing cs1 certificate')
+    assert(
+      again.amountMsat === lookup.maxWithdrawable,
+      `the informational cs1 says ${again.amountMsat} msat but the note is worth ${lookup.maxWithdrawable} msat`
+    )
     assert(
-      signerOf(key => verifyCertificate(pubkeyHex, info.maxWithdrawable, again, key)),
+      signerOf(key => verifyCertificate(pubkeyHex, again.amountMsat, again.signature, key)),
       'the certificate on the informational GET does not verify'
     )
 

package/vectors/note-url.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "spec": "LUD-25 draft (lnurl/luds#301)",
-  "description": "A note is an ordinary LUD-03 withdrawRequest URL whose k1 IS the asset. `amount` alongside it is only a claim by whoever encoded the note - the authoritative value is always maxWithdrawable from an informational GET. A SERVICE returning a rotate, split or merge to a cp1 output MUST include its certificate in `sig` (and `sig2` for the second split output); a plain hash output carries none, and a legacy Part 1 signature on one is harmless where it verifies.",
+  "description": "A note is an ordinary LUD-03 withdrawRequest URL whose k1 IS the asset. `amount` alongside it is only a claim by whoever encoded the note - the authoritative value is always maxWithdrawable from an informational GET. An amount-bearing cs1 carries that same declared amount itself, so the current reference wallet omits the duplicate `amount` query parameter and reads it from `sig`. A SERVICE returning a rotate, split or merge to a cp1 output MUST include that certificate in `sig` (and `sig2` for the second split output). A legacy hash output may instead carry the reference mint's raw Part 1 signature when a signer is available; it never carries cs1.",
   "parse": [
     {
       "url": "https://mint.example/w?k1=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&amount=21000",
@@ -22,6 +22,13 @@
       "declaredAmountMsat": 21000,
       "signature": "ababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababab"
     },
+    {
+      "url": "https://mint.example/w?k1=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&sig=cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "k1": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "declaredAmountMsat": 21000,
+      "signature": "cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "why": "an amount-bearing cs1 carries the declared amount without a duplicate amount query parameter"
+    },
     {
       "url": "https://mint.example/w",
       "k1": null,
@@ -78,6 +85,14 @@
       "amountMsat": 5000,
       "signature": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
       "expect": "https://mint.example/w?k1=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb&amount=5000&sig=cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
+    },
+    {
+      "url": "https://mint.example/w?k1=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&amount=21000",
+      "k1": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "amountMsat": 21000,
+      "signature": "cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "expect": "https://mint.example/w?k1=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb&sig=cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "why": "the cs1 already carries amount_msat, so the current reference wallet omits the duplicate amount parameter"
     }
   ],
   "withoutK1": [
@@ -87,6 +102,13 @@
       "signature": null,
       "expect": "https://mint.example/w?amount=5000",
       "why": "a device-backed note keeps the URL template but never the secret"
+    },
+    {
+      "url": "https://mint.example/w?k1=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&amount=21000",
+      "amountMsat": 21000,
+      "signature": "cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "expect": "https://mint.example/w?sig=cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "why": "a secret-free mirror also avoids duplicating the amount already encoded in cs1"
     }
   ]
 }

package/vectors/part2.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "spec": "LUD-25 draft (lnurl/luds#301)",
-  "description": "LUD-25 Part 2: notes keyed by a public key and spent by a recoverable signature. Every branch is the reference wallet's address path under a BIP39 seed (no passphrase): cashRoot is m/139', domainIndices are the four raw uint32 read big-endian from HMAC-SHA256(key = the private key at m/139'/1'/0, msg = utf8(host)), and addressNode is m/139'/1'/d1/d2/d3/d4 as privateKey||chainCode hex. branchPubkey is its x-only key (branchParity says whether the full point has even y) and cx1 is bech32m(\"cx\", branchPubkey || chainCode). Each note: t = tagged_hash(\"LNURLcash/derive\", branchPubkey || chainCode || ser32_be(index)); notePubkey = x(lift_x(branchPubkey) + t*G), which a watcher holding only the cx1 computes; noteSecretKey = ((branchParity even ? p : n - p) + t) mod n. ownershipSignature is RFC6979 ECDSA, low-S, over sha256(sha256(\"Lightning Signed Message:\" || \"LNURLcash\")), laid out r || s || recovery id, and ck1 is its bech32m(\"ck\") encoding: the value that spends the note. A certificate is the same signature shape by the mint key over sha256(sha256(\"Lightning Signed Message:\" || \"LNURLcash:<amount_msat>:<hex(notePubkey)>\")), encoded bech32m(\"cs\"). All four strings are bech32m with no length limit; all-uppercase is valid and mixed case is not (BIP-350). Values match vectors generated from lnurl-wallet src/lib and confirmed against lnurl-mint.",
+  "description": "LUD-25 Part 2: notes keyed by a public key and spent by a recoverable signature. Every branch is the reference wallet's address path under a BIP39 seed (no passphrase): cashRoot is m/139', domainIndices are the four raw uint32 read big-endian from HMAC-SHA256(key = the private key at m/139'/1'/0, msg = utf8(host)), and addressNode is m/139'/1'/d1/d2/d3/d4 as privateKey||chainCode hex. branchPubkey is its x-only key (branchParity says whether the full point has even y) and cx1 is bech32m(\"cx\", branchPubkey || chainCode). Each note: t = tagged_hash(\"LNURLcash/derive\", branchPubkey || chainCode || ser32_be(index)); notePubkey = x(lift_x(branchPubkey) + t*G), which a watcher holding only the cx1 computes; noteSecretKey = ((branchParity even ? p : n - p) + t) mod n. ownershipSignature is RFC6979 ECDSA, low-S, over sha256(sha256(\"Lightning Signed Message:\" || \"LNURLcash\")), laid out r || s || recovery id, and ck1 is its bech32m(\"ck\") encoding: the value that spends the note. Register/update/unregister proofs use that same signature shape from index zero over \"LNURLcash:<action>:<username>\", separating both action and name. A certificate is the same signature shape by the mint key over sha256(sha256(\"Lightning Signed Message:\" || \"LNURLcash:<amount_msat>:<hex(notePubkey)>\")); its bech32m HRP is \"cs\" plus the amount encoded by BOLT-11 rules. All four strings are bech32m with no length limit; all-uppercase is valid and mixed case is not (BIP-350). Values match vectors generated from lnurl-wallet src/lib and confirmed against lnurl-mint.",
   "conventions": {
     "addressBranch": "m/139'/1'/d1/d2/d3/d4",
     "hashingKey": "m/139'/1'/0",
@@ -11,7 +11,9 @@
     "ownershipMessage": "LNURLcash",
     "ownershipDigest": "c92e46d0c00a23e46b68442e4c0e22d8983bc74158da73d6c33b6f0fdc970e6e",
     "signatureLayout": "r || s || recovery id (0..3), RFC6979, low-S",
-    "certificateMessage": "LNURLcash:<amount_msat>:<hex(pk)>"
+    "addressProofMessage": "LNURLcash:<register|unregister>:<username>",
+    "certificateMessage": "LNURLcash:<amount_msat>:<hex(pk)>",
+    "certificateHrp": "cs || BOLT11_amount_suffix(amount_msat)"
   },
   "mint": {
     "privateKey": "da6ec5c4342514114ee493a55ddc06d085d61eb78f0b7163e07cdb7f1f66ac05",
@@ -626,7 +628,7 @@
       "message": "LNURLcash:1000:b52e0b9dcd39edd137cf4b6794d0d2a55f13c9aa968078394d49159651b5a02f",
       "digest": "3234532c63de08043753a7b7404f4c243a540f378d4865dd16a2f5c71bec1e31",
       "signature": "b2c850964a82eee8d33ed8ca321fe500c15f9fa42e7e57416542e27596aacfb67c3e8206fff2acf0260c7d27d2b63f0fa9e36a1bfc2b19924d5e9db6c1187b5300",
-      "cs1": "cs1kty9p9j2sthw35e7mr9ry8l9qrq4l8ay9el9wst9gt38t942e7m8c05zqmll9t8sycx86f7jkclsl20rdgdlc2cejfx4a8dkcyv8k5cqte7psz"
+      "cs1": "cs10n1kty9p9j2sthw35e7mr9ry8l9qrq4l8ay9el9wst9gt38t942e7m8c05zqmll9t8sycx86f7jkclsl20rdgdlc2cejfx4a8dkcyv8k5cqaqz8vc"
     },
     {
       "notePubkey": "068a32f78dd15c688a9972f6507e1b9d9ca6f97317095997c3bf1dde53a78db9",
@@ -634,7 +636,7 @@
       "message": "LNURLcash:21000:068a32f78dd15c688a9972f6507e1b9d9ca6f97317095997c3bf1dde53a78db9",
       "digest": "4fe334bdb45cecd25336877cba4319a00444bca5ae97bbb2f29874e0c0baaee1",
       "signature": "09605e77950bce2f2739288d4d0b4871e9aa8e7009e198a55c706c1ef886167023d54dceb4ecf72f33ee066a87b7a97a11a1003056ef5454cd04555b510ea66c01",
-      "cs1": "cs1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp3yj3cv"
+      "cs1": "cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt"
     },
     {
       "notePubkey": "831613eb24856343694e81cb8e1b0b1b5582f76f0bd3db5443cfcb6d96eb8fb7",
@@ -642,7 +644,7 @@
       "message": "LNURLcash:99999:831613eb24856343694e81cb8e1b0b1b5582f76f0bd3db5443cfcb6d96eb8fb7",
       "digest": "95f155dc7805a62e459359668cd4bdb3c95d38fd21276067f9fc33307f28059e",
       "signature": "a9160631f5f10517161335160b004d7828191731c536431ca07f2109e1e9fb7d157a0d8863b343653aaa16574dac9813db100341fb61c08950a01137a5c9ac9a01",
-      "cs1": "cs14ytqvv047yz3w9snx5tqkqzd0q5pj9e3c5myx89q0ussnc0fld7327sd3p3mxsm9824pv46d4jvp8kcsqdqlkcwq39g2qyfh5hy6exspa2guz2"
+      "cs1": "cs999990p14ytqvv047yz3w9snx5tqkqzd0q5pj9e3c5myx89q0ussnc0fld7327sd3p3mxsm9824pv46d4jvp8kcsqdqlkcwq39g2qyfh5hy6exsp5x36tn"
     },
     {
       "notePubkey": "2d0a844a516b08def2cfb284142542c8775dcffd88768180986bc03a1d489bf4",
@@ -650,7 +652,36 @@
       "message": "LNURLcash:100000000:2d0a844a516b08def2cfb284142542c8775dcffd88768180986bc03a1d489bf4",
       "digest": "100eb3e508b8a2d32733d7ac3846ea477a5f9120c93071eb4521057a916dce0e",
       "signature": "8b2daf986ad84609246c87227c6f92bc2b24b660f72487a7afc5e21f0594aaaf0ab85c79e7a934499e0f9b4e5ae74123946f915c5ba928537e35829d18655cf900",
-      "cs1": "cs13vk6lxr2mprqjfrvsu38cmujhs4jfdnq7ujg0fa0ch3p7pv542hs4wzu08n6jdzfnc8eknj6uaqj89r0j9w9h2fg2dlrtq5arpj4e7gqmdth9n"
+      "cs1": "cs1m13vk6lxr2mprqjfrvsu38cmujhs4jfdnq7ujg0fa0ch3p7pv542hs4wzu08n6jdzfnc8eknj6uaqj89r0j9w9h2fg2dlrtq5arpj4e7gqrmgxlj"
+    }
+  ],
+  "addressProofs": [
+    {
+      "action": "register",
+      "username": "alice",
+      "message": "LNURLcash:register:alice",
+      "digest": "0344528a8e7629117ae8d369e279614848df2551132ca060d646806529d94977",
+      "indexZeroSecretKey": "c809325604f901c494bebab0f02d74d43cb3d58c143b753c2b749d1733288f64",
+      "indexZeroPubkey": "b52e0b9dcd39edd137cf4b6794d0d2a55f13c9aa968078394d49159651b5a02f",
+      "signature": "18037cd57993de939a5edec704319dd6221650878c5682b98108d7869ae447366210853b212dbf2b48202a22b3371c6e5635444d726edef2c7db472fdd8df3b200"
+    },
+    {
+      "action": "unregister",
+      "username": "alice",
+      "message": "LNURLcash:unregister:alice",
+      "digest": "6a6679a4bf19a30ef180677f873140cad9d3929ec3ee7937f9da00a72251ca73",
+      "indexZeroSecretKey": "c809325604f901c494bebab0f02d74d43cb3d58c143b753c2b749d1733288f64",
+      "indexZeroPubkey": "b52e0b9dcd39edd137cf4b6794d0d2a55f13c9aa968078394d49159651b5a02f",
+      "signature": "351af0eaad099b834cc7019207de9fe87e2b384653c87d406d8dc5e1c88fa95d3b48149403cf5d223136c29756861cb397778aac93a2265e8b28ef0cd934ac5301"
+    },
+    {
+      "action": "register",
+      "username": "bob",
+      "message": "LNURLcash:register:bob",
+      "digest": "3994b99587e99411398be24188193db7a7e8e682b45574448019890c36c4b2c5",
+      "indexZeroSecretKey": "c809325604f901c494bebab0f02d74d43cb3d58c143b753c2b749d1733288f64",
+      "indexZeroPubkey": "b52e0b9dcd39edd137cf4b6794d0d2a55f13c9aa968078394d49159651b5a02f",
+      "signature": "4864ac3e78ecdffded8e764527489e684e4caef30edb0c5cb11106e70022711f4d495f4fa35bcb6dfe3e92e93301ae7f307bf1e94a40514bc4249c20e0ec0d2a00"
     }
   ],
   "valid": [
@@ -702,6 +733,11 @@
       "value": "ck18pf5gt7jfqyrxkyy5ssk7y4t9lauyknjpzjnaf2wppq4y3a68vnn92xvfama804vp27hjyn6h6dy5qz6j5vwy4st8uhe3tqv6thyhfgq0xh4cd",
       "why": "a ck1 is not a cs1"
     },
+    {
+      "type": "cs1",
+      "value": "cs1kty9p9j2sthw35e7mr9ry8l9qrq4l8ay9el9wst9gt38t942e7m8c05zqmll9t8sycx86f7jkclsl20rdgdlc2cejfx4a8dkcyv8k5cqte7psz",
+      "why": "legacy fixed cs HRP carries no amount"
+    },
     {
       "type": "cx1",
       "value": "cx1k5hqh8wd88kazd70fdnef5xj54038jd2j6q8sw2dfy2ev5d45qhsnvwp55",

package/vectors/responses.json

@@ -1,10 +1,10 @@
 {
   "version": 1,
   "spec": "LUD-25 draft (lnurl/luds#301)",
-  "description": "Classifying a SERVICE response. The distinction that matters for funds is definitive-rejection versus ambiguous-outcome: a parsed {\"status\":\"ERROR\"} means the request was processed and refused, while a transport failure, an unparseable body, or a 200 that does not confirm means the mutation MAY have landed - and for rotate/split/merge the WALLET-generated secrets are then the only copy of the outputs, so they must ride the error rather than be discarded. A confirmed mutation carrying no signature is its own outcome: it definitely landed, so the secrets matter more than ever, and the SERVICE is non-conforming. `op` says which call each case is driven through - a melt is the one mutation with no signature to return.",
+  "description": "Classifying a SERVICE response. The distinction that matters for funds is definitive-rejection versus ambiguous-outcome: a parsed {\"status\":\"ERROR\"} means the request was processed and refused, while a transport failure, an unparseable body, or a 200 that does not confirm means the mutation MAY have landed - and for rotate/split/merge the WALLET-generated secrets are then the only copy of the outputs, so they must ride the error rather than be discarded. A confirmed mutation missing a signature the output or caller requires is its own outcome: it definitely landed, so the secrets matter more than ever. `op` says which call each case is driven through - a melt is the one mutation with no signature to return.",
   "outcomes": {
     "ok": "the operation is confirmed",
-    "unverifiable": "the mutation is confirmed but a cp1 output came back without its cs1 certificate. LUD-25 Part 2 requires one on every cp1 output of a rotate, split or merge, so this SERVICE is non-conforming - but the note EXISTS at the key the WALLET disclosed, and its private key is the only key to that value. Keep the key; report the mint. A plain hash output is unsigned by design and is never this outcome",
+    "unverifiable": "the mutation is confirmed but a cp1 output came back without its required cs1 certificate, or a legacy hash output came back without the raw signature a strict caller required. The note EXISTS at the output the WALLET disclosed, so keep its secret even while reporting the missing proof",
     "pending": "this k1 has another operation in flight (a melt); retry shortly",
     "spent": "the SERVICE is authoritative that the note is already burned; a holder may lock it as spent",
     "unknown": "the SERVICE does not recognise this note; surface it, do not silently lock it",
@@ -91,7 +91,7 @@
       },
       "expect": "ok",
       "signature": "ababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababab",
-      "why": "both outputs are plain hash notes, owed nothing; a mint may still issue the old Part 1 signature over one of them, and that is harmless where it verifies"
+      "why": "both outputs are legacy hash notes; tolerant callers can retain a landed output without proof, while a strict caller may require both raw Part 1 signatures"
     },
     {
       "name": "melt success with a LUD-21 style proof",