lnurlcash-conformance 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,59 @@ Semantic versioning. While the LUD-25 draft is unmerged, `0.x` minor bumps
 may add or tighten checks that a previously-passing mint now fails; pin an
 exact version if you gate CI on the grade.
 
+## 0.11.0 - 2026-09-15
+
+**Amount-bearing certificates and internal-transfer discovery.** Part 2 now
+follows the current `lnurl-wallet` and `lnurl-mint` reference implementations;
+the draft LUD-25 prose may lag this release.
+
+- `cs1` carries `amount_msat` in its human-readable part using BOLT-11's
+  amount suffix rules. The vectors reject the legacy fixed `cs` HRP, and
+  the live grader requires the encoded amount to equal the note's
+  authoritative `maxWithdrawable` before verifying the certificate.
+- `--address` now requires a valid `text/xpub` metadata entry carrying the
+  registered `cx1` plus its next-index hint. The mock address publishes a
+  real branch and advances outputs with the LUD-25 public derivation.
+- Legacy hash mutation outputs are signed by the current references. The
+  grader still accepts an omitted signature because the reference mint may
+  run without an available signer, but verifies every signature it receives.
+- The compliant mock enables secret-free hash lookup by default, matching
+  the current reference wallet and mint. `hashLookup: false` remains an
+  explicit older-SERVICE fixture.
+
+## 0.10.0 - 2026-09-11
+
+**Signatures belong to cp1 notes.** The Part 2 rewrite of LUD-25 signs a
+`cp1` note only: a plain hash has nothing to attest to without disclosing
+the secret, so a plain note is unsigned by design. The grader follows it.
+
+- `signs the notes it issues` is gone. In its place, `a plain note carries
+  no signature, or one that verifies`: a hash rotate answered with a bare
+  `{"status":"OK"}` passes, and a mint still issuing the old Part 1
+  signature over the hash passes as long as the signature is a true one.
+  `mintPubkey` is no longer demanded of a mint that issues no signature.
+- New, last in the note run: `certifies a cp1 note it issues (Part 2)`.
+  The grader rotates the note into a fresh `cp1` key, requires a `cs1` in
+  `sig` that recovers to `mintPubkey` (or a published previous key) over
+  the key and amount, requires the same certificate again on the
+  informational GET by `ck1`, then rotates home to a plain secret by that
+  `ck1`. A mint that refuses the `cp1` output warns, never fails: Part 2 is
+  optional. The mock mint has no Part 2 yet, so it warns here.
+- `vectors/responses.json` follows: a bare `{"status":"OK"}` to a hash
+  output is now `ok` (it was `unverifiable`), and so is a split that signs
+  only its first hash output. Three cases are new, and carry `output` or
+  `change: "cp1"` to say which kind of note the call mints: a `cp1` output
+  confirmed without a certificate is `unverifiable`, one certified with a
+  `cs1` is `ok`, and a `cp1` change left uncertified is `unverifiable`. A
+  consumer driving these cases picks the output by that field; a hash
+  where it is absent. Other vector prose that called the hash-note
+  signature mandatory now says which output is owed one.
+- CI runs on Node 24.
+
+The withdraw-info vector still rejects a `withdrawRequest` with no
+`mintPubkey`; relaxing that for Part 1-only mints is a wallet-side change
+across every kit and is not in this release.
+
 ## 0.9.0 - 2026-09-11
 
 **Part 2 vectors.** `vectors/part2.json` covers LUD-25 Part 2, notes keyed by

package/README.md

@@ -48,7 +48,7 @@ for (const c of cases) {
 | `signature.json` | offline verification, both recovery-id orderings, malformed input |
 | `derivation.json` | deterministic note secrets from a BIP39 seed |
 | `cash-derivation.json` | LUD-25's seed-recoverable note secrets under `m/139'`, with BIP-32's own vector 1 |
-| `part2.json` | Part 2: `cp1`/`ck1`/`cs1`/`cx1`, the per-note key tweak, ownership signatures and mint certificates, on the reference wallet's `m/139'/1'` address path |
+| `part2.json` | Part 2: `cp1`/`ck1`/amount-bearing `cs1`/`cx1`, the per-note key tweak, note ownership and mint certificates, on the reference wallet's `m/139'/1'` address path |
 | `bech32.json` | LUD-01 encoding, round trips, corrupted checksums |
 | `url-admission.json` | which URLs may be fetched, and why `data:` must never be |
 | `input-resolution.json` | bech32, LUD-17, Lightning Addresses, bare domains |
@@ -95,7 +95,7 @@ must survive:
 | `--echoWrongK1` | answers the informational GET with a different `k1` |
 | `--lieAboutValue=N` | reports a `maxWithdrawable` it never signed |
 | `--signatureLayout=leading` | emits the recovery id at the other end |
-| `--signatures=false` | deliberately violates LUD-25 by issuing no signatures |
+| `--signatures=false` | issues no Part 1 signatures. Accepted as the reference mint's degraded no-signer mode; the reference wallet will refuse an unsigned successful mutation |
 | `--serverGeneratedSecrets` | hands back a secret it generated — the exposure `h` exists to close |
 | `--meltNeverSettles` | holds every melt in flight, so notes stay `pending` |
 | `--meltAlwaysFails` | fails every payment, restoring the note |
@@ -136,7 +136,7 @@ conforming default explicit. Optional fields stay absent unless requested:
 | `--previousPrivateKey=<hex>` | an old signing key the mock still holds. Its public half joins `previousPubkeys` on its own |
 | `--signWithPreviousKey` | issues every note under that old key while still advertising the new one: the mid-rotation state a mint passes through when the advertisement moves before the signer |
 | `--retriedMutation=replay` | answers a byte-identical repeat of a mutation with the original success. This is the conforming default; use `refuse` only as an adversarial fixture |
-| `--hashLookup=true` | accepts an informational lookup by `h=sha256(k1)` without returning the bearer secret. Off by default because the capability is optional |
+| `--hashLookup=false` | models an older SERVICE with no secret-free informational lookup. The current reference mock accepts `h=sha256(k1)` by default |
 | `--mintToHash` | accepts `h` alongside the mandatory identical comment and enables the additive quote/receipt fields. Off by default; baseline comment-bound minting remains on |
 | `--mintReceipt` | with `--mintToHash`, adds the optional quote commitment and signed LUD-21 settlement receipt |
 | `--mintToHashAdvertisedOn=quote` | narrows which of the three places claim it (`payRequest`, `mintAddress`, `quote`); all three by default. Changes only what is claimed, never what the mint does |

package/mock-mint/index.mjs

@@ -11,6 +11,7 @@
 // Usable as a library (createMockMint) or standalone (npm start).
 
 import {createServer} from 'node:http'
+import {bech32m} from '@scure/base'
 import {sha256} from '@noble/hashes/sha2.js'
 import {secp256k1} from '@noble/curves/secp256k1.js'
 import {bytesToHex, hexToBytes, utf8ToBytes} from '@noble/hashes/utils.js'
@@ -20,6 +21,27 @@ import {pathToFileURL} from 'node:url'
 
 const LSM_PREFIX = 'Lightning Signed Message:'
 
+const concat = (...parts) => {
+  const out = new Uint8Array(parts.reduce((size, part) => size + part.length, 0))
+  let offset = 0
+  for (const part of parts) {
+    out.set(part, offset)
+    offset += part.length
+  }
+  return out
+}
+
+const taggedHash = (tag, ...parts) => {
+  const tagHash = sha256(utf8ToBytes(tag))
+  return sha256(concat(tagHash, tagHash, ...parts))
+}
+
+const ser32 = value => {
+  const out = new Uint8Array(4)
+  new DataView(out.buffer).setUint32(0, value, false)
+  return out
+}
+
 const noteId = k1 => bytesToHex(sha256(hexToBytes(k1)))
 
 const sigDigest = (noteIdHex, amountMsat) =>
@@ -193,7 +215,9 @@ const DEFAULTS = {
   //   'hidesSpent'     - non-compliant: hides a retained burned h as unknown
   //   'revealsSpent'   - legacy alias for the now-compliant true behaviour
   //   'acceptsBoth'    - non-compliant: accepts k1 and h together
-  hashLookup: false,
+  // Current reference wallet and mint use secret-free informational
+  // lookups by default. Set false only to model an older SERVICE.
+  hashLookup: true,
   // LUD-25 lets a SERVICE refuse an oversized merge outright rather than
   // let the URL be mangled upstream. 0 is no explicit cap; a positive number
   // refuses more than that many k1 with the draft's own reason string.
@@ -244,6 +268,13 @@ const DEFAULTS = {
   // the draft's line 80 behaviour and is now the defect - see
   // docs/COMMENT-IS-MANDATORY.md.
   commentFallsBack: false,
+  // LUD-25 Part 2: a registered Lightning Address with a cx1 against it.
+  // Not a defect - this mint has a key to mint under whatever the comment
+  // says (the next unused one on its branch), so a comment naming no
+  // output is the free text LUD-12 invites and is ignored, not refused.
+  // The note still lands under a branch key and never under the payment
+  // preimage, which is the whole difference from `commentFallsBack`.
+  registeredAddress: false,
   // non-compliant, and narrower: refuse a malformed comment - an empty value
   // included - but fall back when the key is absent entirely. That is the
   // distinction the malformed loop cannot reach, and the commonest way to
@@ -306,6 +337,20 @@ export const createMockMint = async (options = {}) => {
   // below asks exactly what it asked before.
   const boundOutputs = new Map()
 
+  // A deterministic watch-only branch for the registered-address fixture.
+  // It is public test material, not a secret used for value. The mock uses
+  // the actual LUD-25 tweak so its text/xpub hint names the same output its
+  // next quote reserves.
+  const registeredBranchSecret = hexToBytes('44'.repeat(32))
+  const registeredBranchPubkey = secp256k1.getPublicKey(registeredBranchSecret, true).slice(1)
+  const registeredChainCode = sha256(utf8ToBytes('lnurlcash-conformance registered address'))
+  const registeredCx1 = bech32m.encode(
+    'cx',
+    bech32m.toWords(concat(registeredBranchPubkey, registeredChainCode)),
+    200
+  )
+  let registeredIndex = 0
+
   // An id is spoken for if it is a note in any state, the payment hash of
   // an invoice this mint issued, or the output a bound quote is waiting
   // to credit. Minting over any of them hands the output to somebody who
@@ -314,6 +359,19 @@ export const createMockMint = async (options = {}) => {
   const outputIdInUse = id =>
     notes.has(id) || invoices.has(id) || boundOutputs.has(id)
 
+  const nextRegisteredOutput = () => {
+    const branch = secp256k1.Point.fromBytes(concat(Uint8Array.of(0x02), registeredBranchPubkey))
+    for (;;) {
+      const index = registeredIndex++
+      const tweak = BigInt(
+        `0x${bytesToHex(taggedHash('LNURLcash/derive', registeredBranchPubkey, registeredChainCode, ser32(index)))}`
+      )
+      if (tweak >= secp256k1.Point.Fn.ORDER) continue
+      const output = bytesToHex(branch.add(secp256k1.Point.BASE.multiply(tweak)).toBytes(true).slice(1))
+      if (!outputIdInUse(output)) return output
+    }
+  }
+
   // What makes a request the same request: the same input k1 set, the
   // same h, the same h2, the same amount. The inputs are a set rather
   // than a sequence, because a merge naming the same notes in a different
@@ -496,6 +554,9 @@ export const createMockMint = async (options = {}) => {
       if (opts.baseFeeMsat > 0 || opts.feePpm > 0) {
         metadata.push(['text/plain', `Mint fees: ${opts.baseFeeMsat},${opts.feePpm}`])
       }
+      if (opts.registeredAddress) {
+        metadata.push(['text/xpub', `${registeredCx1}:${registeredIndex}`])
+      }
       return send({
         tag: 'payRequest',
         callback: `${origin}/p/cb`,
@@ -720,6 +781,11 @@ export const createMockMint = async (options = {}) => {
             // to compare h.
             boundTo = h
             namedByComment = true
+          } else if (opts.registeredAddress) {
+            // The next unused key on the branch. Claimed as the quote is
+            // issued, so two free-text quotes never name one output.
+            boundTo = nextRegisteredOutput()
+            namedByComment = true
           } else if (
             !opts.commentFallsBack &&
             !(opts.commentFallsBackWhenAbsent && sent === null)
@@ -826,6 +892,16 @@ export const createMockMint = async (options = {}) => {
           minWithdrawable: 0,
           maxWithdrawable: (held?.amountMsat ?? 21000) + opts.lieAboutValue,
           defaultDescription: 'an LNURLcash note',
+          // Keep the mock's optional way-home extension identical for
+          // secret-free and raw-secret lookups. This is test fixture policy,
+          // not a requirement imposed on a reference mint.
+          ...(opts.noteInfoPayLink
+            ? {
+                payLink: opts.payLinkOffOrigin
+                  ? 'https://elsewhere.example/.well-known/lnurlp/mint'
+                  : `${origin}/.well-known/lnurlp/${opts.username}`
+              }
+            : {}),
           mintPubkey: pubkey
         })
       }
@@ -842,12 +918,10 @@ export const createMockMint = async (options = {}) => {
         minWithdrawable: 0,
         maxWithdrawable: note.amountMsat + opts.lieAboutValue,
         defaultDescription: 'an LNURLcash note',
-        // The way home, as the reference mint publishes it. A holder with
-        // nothing but a note can reach the document carrying this mint's
-        // terms and its retired signing keys; without it a wallet that only
-        // ever received notes cannot tell an announced key rotation from a
-        // substituted key, because the document lives under a username the
-        // note never mentions.
+        // Optional way-home extension used by consumer policy tests. A holder
+        // with nothing but a note can then reach the document carrying this
+        // mint's terms and retired signing keys. Reference implementations do
+        // not make this field mandatory on an informational note response.
         ...(opts.noteInfoPayLink
           ? {
               payLink: opts.payLinkOffOrigin

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lnurlcash-conformance",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Language-neutral conformance vectors, an adversarial mock mint, and a grader for LNURLcash (LUD-25) implementations",
   "author": "TheCryptoDonkey",
   "license": "MIT",

package/runner/cli.mjs

@@ -27,10 +27,27 @@ if (positional.length === 0 && !noteArg) {
   lnurlcash-conform <mint> --note=<url> --pr=<invoice>  same, paid amount from the invoice
   lnurlcash-conform <mint> --note=<url> --preimage=<hex> + the bound-mint checks
   lnurlcash-conform <mint> --note=<url> --spend         + the full mutating checks
+  lnurlcash-conform <address> --address              grade a Part 2 registered address
 
 <mint> may be a Lightning Address (mint@example.com), a bare domain, or a
 payRequest URL.
 
+--address says the target is a LUD-25 Part 2 Lightning Address with a cx1
+registered against it, not a mint payLink. Such an address mints on the next
+unused key of its own branch, so a comment naming no output is the ordinary
+free text LUD-12 invites and must not fail the payment; without this flag the
+stricter payLink rules apply, which require every quote to name its output.
+Declared rather than detected, and it cannot be otherwise: a mint that
+unsafely falls back to a preimage-keyed note answers a free-text comment
+exactly the same way, and the two differ only in what key the note lands
+under, which nothing reveals before settlement. So --address takes the
+operator's word for it. Use it on an address you control or trust; without
+it the strict rules catch the unsafe mint, with it they cannot.
+
+Note that each quote the checks issue claims the next key on the branch,
+whether or not anyone pays it, so grading an address in use costs it a few
+indices.
+
 --paid/--pr name what the note's mint invoice was paid at, and require the
 note to be freshly minted and never rotated: the check compares its value
 against the LUD-25 fee formula. It is read-only.
@@ -52,7 +69,7 @@ let pay
 if (positional[0]) {
   const payUrl = resolveMint(positional[0])
   console.log(`grading ${payUrl}\n`)
-  pay = await gradeMint(payUrl, report)
+  pay = await gradeMint(payUrl, report, {registeredAddress: flags.has('--address')})
 }
 
 const mintFee =

package/runner/index.d.ts

@@ -57,8 +57,31 @@ export declare const applyMintFee: (gross: number, fee: MintFee | null) => numbe
 /** the `Mint fees: base,ppm` line out of a payRequest's metadata array */
 export declare const parseAdvertisedMintFee: (metadata: string) => MintFee | null
 
+export interface InternalTransferHint {
+  cx1: string
+  index: number
+  pubkeyXOnly: Uint8Array
+  chainCode: Uint8Array
+}
+
+/** the `text/xpub` branch and next-index hint out of registered-address metadata */
+export declare const parseInternalTransferHint: (
+  metadata: string
+) => InternalTransferHint | null
+
 /** the read-only mint checks: payRequest, withdrawLink, fees, verify, extensions */
-export declare const gradeMint: (payUrl: string, report: Report) => Promise<void>
+export declare const gradeMint: (
+  payUrl: string,
+  report: Report,
+  options?: {
+    /** Grade as a LUD-25 Part 2 registered Lightning Address rather than a
+     * mint payLink: it mints on the next unused key of its own branch, so a
+     * comment naming no output is free text and must not fail the payment.
+     * Declared, not detected - an unsafe preimage-keyed fallback looks
+     * identical before settlement. */
+    registeredAddress?: boolean
+  }
+) => Promise<void>
 
 /**
  * Read-only. Needs a freshly minted, never-rotated note and what its mint

package/runner/index.mjs

@@ -5,30 +5,24 @@
 // with the thing it grades would agree with that implementation's mistakes,
 // which is the one thing it must never do.
 
-import {bech32} from '@scure/base'
+import {bech32, bech32m} from '@scure/base'
 import {sha256} from '@noble/hashes/sha2.js'
-import {secp256k1} from '@noble/curves/secp256k1.js'
+import {schnorr, secp256k1} from '@noble/curves/secp256k1.js'
 import {bytesToHex, hexToBytes, utf8ToBytes} from '@noble/hashes/utils.js'
 import {randomBytes} from 'node:crypto'
 
 const noteId = k1 => bytesToHex(sha256(hexToBytes(k1)))
 
-const verifySignature = (k1, amountMsat, signatureHex, pubkeyHex) => {
-  let sig
-  try {
-    sig = hexToBytes(signatureHex)
-  } catch {
-    return false
-  }
+// The "Lightning Signed Message" digest every LUD-25 signature is over.
+const signedMessageDigest = message =>
+  sha256(sha256(new Uint8Array([...utf8ToBytes('Lightning Signed Message:'), ...utf8ToBytes(message)])))
+
+// Does a 65-byte recoverable signature recover to that key? Both byte
+// orderings are tried: the spec wants r || s || recovery-id, a node's
+// signmessage emits the recovery id first, and a mint that forgot to
+// reorder is still signing with its own key.
+const recoversTo = (digest, sig, pubkeyHex) => {
   if (sig.length !== 65) return false
-  const digest = sha256(
-    sha256(
-      new Uint8Array([
-        ...utf8ToBytes('Lightning Signed Message:'),
-        ...utf8ToBytes(`LNURLcash:${amountMsat}:${noteId(k1)}`)
-      ])
-    )
-  )
   const leading = new Uint8Array([sig[64], ...sig.subarray(0, 64)])
   for (const candidate of [leading, sig]) {
     try {
@@ -43,6 +37,65 @@ const verifySignature = (k1, amountMsat, signatureHex, pubkeyHex) => {
   return false
 }
 
+// The legacy raw Part 1 signature over a note's hash. Current reference mints
+// issue one when a signer is available, and every one received must be true.
+const verifySignature = (k1, amountMsat, signatureHex, pubkeyHex) => {
+  let sig
+  try {
+    sig = hexToBytes(signatureHex)
+  } catch {
+    return false
+  }
+  return recoversTo(signedMessageDigest(`LNURLcash:${amountMsat}:${noteId(k1)}`), sig, pubkeyHex)
+}
+
+// A Part 2 certificate: cs1 over the note's raw x-only public key.
+const verifyCertificate = (pubkeyHex32, amountMsat, sig, mintPubkeyHex) =>
+  recoversTo(signedMessageDigest(`LNURLcash:${amountMsat}:${pubkeyHex32}`), sig, mintPubkeyHex)
+
+// Part 2's bech32m strings: cp1 (32-byte key), ck1 and cs1 (65-byte
+// signature). cs1 has a variable HRP: "cs" plus the amount under BOLT-11's
+// amount rules. Longer than BIP-173's 90 characters by design.
+const BECH32M_LIMIT = 200
+const encodeCash = (hrp, bytes) => bech32m.encode(hrp, bech32m.toWords(bytes), BECH32M_LIMIT)
+const decodeCash = (hrp, value, length) => {
+  if (typeof value !== 'string') return null
+  try {
+    const {prefix, words} = bech32m.decode(value, BECH32M_LIMIT)
+    if (prefix !== hrp) return null
+    const bytes = bech32m.fromWords(words)
+    return bytes.length === length ? bytes : null
+  } catch {
+    return null
+  }
+}
+
+const AMOUNT_MSAT_PER_UNIT = {'': 1e11, m: 1e8, u: 1e5, n: 100, p: 0.1}
+const amountSuffixMsat = suffix => {
+  const match = suffix.match(/^(\d+)([munp])?$/)
+  if (!match) return null
+  const amount = Number(match[1]) * AMOUNT_MSAT_PER_UNIT[match[2] ?? '']
+  return Number.isSafeInteger(amount) ? amount : null
+}
+
+const decodeCertificate = value => {
+  if (typeof value !== 'string') return null
+  const lower = value.trim().toLowerCase()
+  const sep = lower.lastIndexOf('1')
+  if (sep < 3 || !lower.startsWith('cs')) return null
+  const amountMsat = amountSuffixMsat(lower.slice(2, sep))
+  if (amountMsat === null) return null
+  const signature = decodeCash(lower.slice(0, sep), lower, 65)
+  return signature ? {amountMsat, signature} : null
+}
+
+// The bearer secret of a cp1 note: the key's signature over the fixed
+// message "LNURLcash", r || s || recovery-id, the same value every time.
+const ownershipProof = secretKey => {
+  const lead = secp256k1.sign(signedMessageDigest('LNURLcash'), secretKey, {format: 'recovered', prehash: false})
+  return encodeCash('ck', new Uint8Array([...lead.subarray(1), lead[0]]))
+}
+
 // LUD-17: lnurlw://host/path is https://host/path, or http:// when the host
 // is an onion service (the spec) or loopback (development). A plain
 // https:// or http:// URL passes through untouched, so a caller can hand
@@ -202,6 +255,31 @@ export const parseAdvertisedMintFee = metadata => {
   return null
 }
 
+// A registered Part 2 address advertises the safe-to-share branch and its
+// best-known next index as ["text/xpub", "cx1...:<i>"]. Parsing it here
+// makes --address assert the actual discovery signal rather than merely
+// trusting the operator's flag.
+export const parseInternalTransferHint = metadata => {
+  let entries
+  try {
+    entries = JSON.parse(metadata)
+  } catch {
+    return null
+  }
+  if (!Array.isArray(entries)) return null
+  for (const entry of entries) {
+    if (!Array.isArray(entry) || entry[0] !== 'text/xpub' || typeof entry[1] !== 'string') continue
+    const sep = entry[1].lastIndexOf(':')
+    if (sep < 0) continue
+    const cx1 = entry[1].slice(0, sep)
+    const index = Number(entry[1].slice(sep + 1))
+    const branch = decodeCash('cx', cx1.toLowerCase(), 64)
+    if (!branch || !Number.isInteger(index) || index < 0 || index > 0xffffffff) continue
+    return {cx1, index, pubkeyXOnly: branch.slice(0, 32), chainCode: branch.slice(32)}
+  }
+  return null
+}
+
 // Resolves what the user typed - a Lightning Address, a bare domain, or a
 // URL - to the payRequest URL to grade.
 export const resolveMint = input => {
@@ -220,7 +298,32 @@ export const resolveMint = input => {
 
 // ---- read-only checks -----------------------------------------------------
 
-export const gradeMint = async (payUrl, report) => {
+// `registeredAddress` grades the target as a LUD-25 Part 2 Lightning
+// Address rather than a mint payLink. The two are the same document to a
+// wallet - both advertise commentAllowed and a withdrawLink, and both
+// mint on payment - but the draft's comment rules are written for the
+// payLink, which has no key to mint under but the one the comment names.
+// A cx1-registered address always has one, the next unused key on its
+// branch, so there a comment naming no output is the ordinary free text
+// LUD-12 invites and is ignored rather than refused (lnurl-mint #46,
+// after every Wallet of Satoshi and Primal payment to such an address
+// failed on a typed message).
+//
+// Deliberately a flag and not a probe. "Returned an invoice for a comment
+// naming no output" is also exactly what a mint falling back to a
+// preimage-keyed note does, and that mint is dangerous - the preimage
+// race the draft's Security considerations describes. Nothing on the wire
+// tells the two apart before settlement: they differ only in what key the
+// note lands under. Guessing would wave the dangerous one through, so the
+// strict payLink rules stay the default and an address is declared.
+//
+// The cost of that is real and worth stating: this flag takes the
+// operator's word, and a preimage-keyed fallback passes under it. It
+// relaxes the comment rules and nothing else, and the draft gives an
+// address no way to say what it is on the wire. A signal it could
+// advertise - so this became detectable rather than declared - is worth
+// raising against LUD-25 Part 2.
+export const gradeMint = async (payUrl, report, {registeredAddress = false} = {}) => {
   let pay
   let mintAddress
   await report.check('payRequest resolves and is well-formed', async () => {
@@ -274,6 +377,14 @@ export const gradeMint = async (payUrl, report) => {
     return `${match[1]} msat + ${match[2]} ppm`
   })
 
+  if (registeredAddress) {
+    await report.check('advertises its cx1 and next index for internal transfers', async () => {
+      const hint = parseInternalTransferHint(pay.metadata)
+      assert(hint, 'no valid ["text/xpub", "cx1...:<i>"] metadata entry')
+      return `index ${hint.index}`
+    })
+  }
+
   let verifyUrl
   await report.check('issues an invoice for the amount requested', async () => {
     const amount = Math.max(pay.minSendable, 1000)
@@ -546,6 +657,19 @@ export const gradeMint = async (payUrl, report) => {
     }
     const spelt = spelling => (spelling === 'comment' ? 'a LUD-12 comment' : 'an h parameter')
 
+    // The behaviour #46 fixed, asserted rather than assumed. Asked once,
+    // not once per malformed value: on an address a quote claims the next
+    // branch index as it is issued, so every probe costs the holder a key
+    // whether or not anyone pays. `gm` is short enough that no mint could
+    // read it as a commitment of any spelling.
+    if (registeredAddress) {
+      const freeText = await quoteAt('comment', 'gm')
+      assert(
+        freeText.status !== 'ERROR' && typeof freeText.pr === 'string',
+        `refused a comment naming no output: ${freeText.reason} - this address mints on its own branch, so an ordinary LUD-12 message must not fail the payment`
+      )
+    }
+
     const advertised = spellingsOf(pay)
     const corroborated = spellingsOf(mintAddress)
     const claimed = [...new Set([...advertised, ...corroborated])]
@@ -622,6 +746,11 @@ export const gradeMint = async (payUrl, report) => {
 
     for (const spelling of probed) {
       for (const [what, value] of malformed) {
+        // Every one of these names no output, which on an address is free
+        // text, already covered above. `h` stays probed either way: it is
+        // a parameter invented for this one purpose, so a malformed one is
+        // a wallet error wherever it is sent.
+        if (spelling === 'comment' && registeredAddress) continue
         const body = await quoteAt(spelling, value)
         if (spelling === 'h') {
           if (!hClaimed) continue
@@ -646,10 +775,20 @@ export const gradeMint = async (payUrl, report) => {
     const bare = new URL(pay.callback)
     bare.searchParams.set('amount', String(amount))
     const unnamed = await get(bare)
-    assert(
-      unnamed.status === 'ERROR' && !unnamed.pr,
-      'issued an invoice for a quote carrying no comment - current LUD-25 requires rejection before invoicing'
-    )
+    if (registeredAddress) {
+      // The draft is explicit that a registered address needs no comment
+      // at all: it derives the next key from its own cx1. Refusing here
+      // would break every plain Lightning payment to the address.
+      assert(
+        unnamed.status !== 'ERROR' && typeof unnamed.pr === 'string',
+        `refused a quote carrying no comment: ${unnamed.reason} - a registered address mints on its own branch, so a payment to it must not need one`
+      )
+    } else {
+      assert(
+        unnamed.status === 'ERROR' && !unnamed.pr,
+        'issued an invoice for a quote carrying no comment - current LUD-25 requires rejection before invoicing'
+      )
+    }
 
     if (hClaimed) {
       const mismatch = new URL(pay.callback)
@@ -706,6 +845,9 @@ export const gradeMint = async (payUrl, report) => {
       }
     }
     if (problems.length > 0) throw soft(problems.join('; '))
+    if (registeredAddress) {
+      return `registered Lightning Address, minting on its own branch: named by ${probed.join(' and ')}; claimed by ${claimedBy.join(', ')}; bound a quote to a hash of the runner's own secret, and honoured one carrying free text and one carrying no comment at all`
+    }
     return `named by ${probed.join(' and ')}; claimed by ${claimedBy.join(', ')}; bound a quote to a hash of the runner's own secret and handled four malformed ones as the draft requires`
   })
 
@@ -1046,28 +1188,35 @@ export const gradeNote = async (noteUrl, report, options = {}) => {
     return 'burned the old secret, minted the new'
   })
 
-  await report.check('signs the notes it issues', async () => {
-    assert(info.mintPubkey, 'no mintPubkey advertised - offline verification is mandatory')
-    assert(isCompressedPubkey(info.mintPubkey), 'mintPubkey is not a 33-byte compressed secp256k1 key')
-    assert(currentSig, 'the rotate returned no sig - offline verification is mandatory')
-    // A mint that has rotated its signing key may publish the old ones as
-    // previousPubkeys, so notes it issued before the rotation still
-    // verify. Any key it currently stands behind is an acceptable signer
-    // for grading purposes. That is a narrower claim than it looks: it
-    // says the signature is genuine, not that a wallet should accept the
-    // new key - LUD-25 puts that decision with the holder.
-    const signedBy = [info.mintPubkey, ...previousPubkeys].find(key =>
-      verifySignature(current, info.maxWithdrawable, currentSig, key)
-    )
-    assert(
-      signedBy,
-      previousPubkeys.length > 0
-        ? 'the signature verifies against neither the advertised mintPubkey nor any published previous key'
-        : 'the signature does not verify against the advertised mintPubkey and amount'
-    )
-    return signedBy === info.mintPubkey
+  // A mint that has rotated its signing key may publish the old ones as
+  // previousPubkeys, so notes it issued before the rotation still verify.
+  // Any key it currently stands behind is an acceptable signer for grading
+  // purposes. That is a narrower claim than it looks: it says the
+  // signature is genuine, not that a wallet should accept the new key -
+  // LUD-25 puts that decision with the holder.
+  const signerOf = verifies => [info.mintPubkey, ...previousPubkeys].find(key => verifies(key))
+  const describeSigner = signedBy =>
+    signedBy === info.mintPubkey
       ? 'verified offline'
       : `verified offline against a previous signing key (${signedBy.slice(0, 16)}...)`
+  const unverified = () =>
+    previousPubkeys.length > 0
+      ? 'the signature verifies against neither the advertised mintPubkey nor any published previous key'
+      : 'the signature does not verify against the advertised mintPubkey and amount'
+
+  await report.check('a legacy hash mutation signature verifies when present', async () => {
+    // The reference mint can operate without a signing backend and then has
+    // no signature to return. That mode remains usable by tolerant clients,
+    // but the committed reference wallet requires a signature after a
+    // successful mutation, so omission is an interoperability warning.
+    if (currentSig === null) {
+      throw soft('unsigned legacy output: accepted as no-signer mode, but strict reference-wallet clients may refuse it')
+    }
+    assert(info.mintPubkey, 'a sig with no mintPubkey advertised verifies against nothing')
+    assert(isCompressedPubkey(info.mintPubkey), 'mintPubkey is not a 33-byte compressed secp256k1 key')
+    const signedBy = signerOf(key => verifySignature(current, info.maxWithdrawable, currentSig, key))
+    assert(signedBy, unverified())
+    return `legacy Part 1 signature ${describeSigner(signedBy)}`
   })
 
   await report.check('reports a spent hash distinguishably from an unknown hash', async () => {
@@ -1095,12 +1244,10 @@ export const gradeNote = async (noteUrl, report, options = {}) => {
   })
 
   await report.check('keeps signatures off the informational endpoint', async () => {
-    // LUD-25: "Signatures are only ever delivered in the
-    // withdrawSuccessResponse of a rotate, split or merge, the
-    // informational endpoint never returns one." A mint that hands one out
-    // here lets anyone holding only a note's PUBLIC url mint a certificate
-    // for it, and invites a wallet to treat the informational answer as an
-    // offline proof when it is an online one.
+    // A plain note has no certificate, so its informational GET carries no
+    // sig. Part 2 does hand out a cs1 here for a cp1 note, and the Part 2
+    // check below expects it; this probe is by hex k1, where one would
+    // invite a wallet to treat an online answer as an offline proof.
     const here = new URL(url)
     here.searchParams.set('k1', current)
     const body = await get(here)
@@ -1418,6 +1565,69 @@ export const gradeNote = async (noteUrl, report, options = {}) => {
     return body.reason
   })
 
+  // LUD-25 Part 2. The spec's one MUST for signatures lives here: a cp1
+  // note is a public key, and the SERVICE certifies every one it issues
+  // with a cs1 over (key, amount) that recovers to mintPubkey. Part 2 is
+  // optional, so a SERVICE that refuses the cp1 output warns rather than
+  // fails. Last, because the note comes back as a plain secret only if
+  // the rotate home succeeds.
+  await report.check('certifies a cp1 note it issues (Part 2)', async () => {
+    const secretKey = secp256k1.utils.randomSecretKey()
+    const pubkey = schnorr.getPublicKey(secretKey)
+    const cp1 = encodeCash('cp', pubkey)
+    const out = new URL(info.callback)
+    out.searchParams.append('k1', current)
+    out.searchParams.append('p1', cp1)
+    const body = await get(out)
+    if (body.status === 'ERROR') throw soft(`Part 2 not offered: a cp1 output was refused (${body.reason})`)
+    // The plain secret is burned either way; from here the bearer secret
+    // is the key's ownership proof, until the rotate home below.
+    const ck1 = ownershipProof(secretKey)
+    current = ck1
+    assert(info.mintPubkey, 'issued a cp1 note with no mintPubkey advertised - nothing to verify its certificate against')
+    assert(isCompressedPubkey(info.mintPubkey), 'mintPubkey is not a 33-byte compressed secp256k1 key')
+    const pubkeyHex = bytesToHex(pubkey)
+    const certificate = decodeCertificate(body.sig)
+    assert(certificate, `the rotate to a cp1 output returned no amount-bearing cs1 certificate in sig (got ${JSON.stringify(body.sig)})`)
+    assert(
+      certificate.amountMsat === info.maxWithdrawable,
+      `the cs1 says ${certificate.amountMsat} msat but the note is worth ${info.maxWithdrawable} msat`
+    )
+    const signedBy = signerOf(key => verifyCertificate(pubkeyHex, certificate.amountMsat, certificate.signature, key))
+    assert(signedBy, unverified())
+
+    // The informational GET by ck1 delivers the certificate again, so a
+    // holder need not rotate just to obtain one.
+    const byKey = new URL(url)
+    byKey.searchParams.set('k1', ck1)
+    const lookup = await get(byKey)
+    assert(lookup.status !== 'ERROR', `the cp1 note is not spendable by its ck1: ${lookup.reason}`)
+    assert(
+      lookup.maxWithdrawable === info.maxWithdrawable,
+      `value changed across a rotate to cp1: ${info.maxWithdrawable} -> ${lookup.maxWithdrawable}`
+    )
+    const again = decodeCertificate(lookup.sig)
+    assert(again, 'the informational GET by ck1 returned no amount-bearing cs1 certificate')
+    assert(
+      again.amountMsat === lookup.maxWithdrawable,
+      `the informational cs1 says ${again.amountMsat} msat but the note is worth ${lookup.maxWithdrawable} msat`
+    )
+    assert(
+      signerOf(key => verifyCertificate(pubkeyHex, again.amountMsat, again.signature, key)),
+      'the certificate on the informational GET does not verify'
+    )
+
+    // Home: back to a plain secret, spent by the ck1.
+    const fresh = bytesToHex(randomBytes(32))
+    const home = new URL(info.callback)
+    home.searchParams.append('k1', ck1)
+    home.searchParams.append('p1', noteId(fresh))
+    const back = await get(home)
+    assert(back.status === 'OK', `the cp1 note could not be rotated back to a plain secret by its ck1: ${back.reason}`)
+    current = fresh
+    return `${describeSigner(signedBy)}; the plain note it rotated home to is ${back.sig === undefined ? 'unsigned' : 'still signed the Part 1 way'}`
+  })
+
   return {finalSecret: current, noteUrl: (() => {
     const u = new URL(url)
     u.searchParams.set('k1', current)

package/vectors/lifecycle.json

@@ -58,7 +58,7 @@
         "the connection drops after the SERVICE applied it",
         "the HTTP stack silently resends the identical request"
       ],
-      "requirement": "a SERVICE MUST recognize the byte-identical retry from the same k1 set, h, h2 and amount, and return the original success with the same sig and sig2 without moving balance again. A WALLET still persists every fresh output secret before sending the first request and keeps it across an ambiguous transport failure. A request that changes any recorded field is a genuine double-spend attempt and gets the ordinary already-spent refusal."
+      "requirement": "a SERVICE MUST recognize the byte-identical retry from the same k1 set, h, h2 and amount, and return the original success, with the same sig and sig2 where the outputs had any, without moving balance again. A WALLET still persists every fresh output secret before sending the first request and keeps it across an ambiguous transport failure. A request that changes any recorded field is a genuine double-spend attempt and gets the ordinary already-spent refusal."
     },
     {
       "name": "settle a merge or split output",

package/vectors/note-url.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "spec": "LUD-25 draft (lnurl/luds#301)",
-  "description": "A note is an ordinary LUD-03 withdrawRequest URL whose k1 IS the asset. `amount` alongside it is only a claim by whoever encoded the note - the authoritative value is always maxWithdrawable from an informational GET. A SERVICE returning a rotate, split or merge MUST include the offline-verification signature in `sig` (and `sig2` for the second split output).",
+  "description": "A note is an ordinary LUD-03 withdrawRequest URL whose k1 IS the asset. `amount` alongside it is only a claim by whoever encoded the note - the authoritative value is always maxWithdrawable from an informational GET. An amount-bearing cs1 carries that same declared amount itself, so the current reference wallet omits the duplicate `amount` query parameter and reads it from `sig`. A SERVICE returning a rotate, split or merge to a cp1 output MUST include that certificate in `sig` (and `sig2` for the second split output). A legacy hash output may instead carry the reference mint's raw Part 1 signature when a signer is available; it never carries cs1.",
   "parse": [
     {
       "url": "https://mint.example/w?k1=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&amount=21000",
@@ -22,6 +22,13 @@
       "declaredAmountMsat": 21000,
       "signature": "ababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababab"
     },
+    {
+      "url": "https://mint.example/w?k1=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&sig=cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "k1": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "declaredAmountMsat": 21000,
+      "signature": "cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "why": "an amount-bearing cs1 carries the declared amount without a duplicate amount query parameter"
+    },
     {
       "url": "https://mint.example/w",
       "k1": null,
@@ -78,6 +85,14 @@
       "amountMsat": 5000,
       "signature": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
       "expect": "https://mint.example/w?k1=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb&amount=5000&sig=cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
+    },
+    {
+      "url": "https://mint.example/w?k1=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&amount=21000",
+      "k1": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "amountMsat": 21000,
+      "signature": "cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "expect": "https://mint.example/w?k1=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb&sig=cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "why": "the cs1 already carries amount_msat, so the current reference wallet omits the duplicate amount parameter"
     }
   ],
   "withoutK1": [
@@ -87,6 +102,13 @@
       "signature": null,
       "expect": "https://mint.example/w?amount=5000",
       "why": "a device-backed note keeps the URL template but never the secret"
+    },
+    {
+      "url": "https://mint.example/w?k1=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&amount=21000",
+      "amountMsat": 21000,
+      "signature": "cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "expect": "https://mint.example/w?sig=cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt",
+      "why": "a secret-free mirror also avoids duplicating the amount already encoded in cs1"
     }
   ]
 }

package/vectors/part2.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "spec": "LUD-25 draft (lnurl/luds#301)",
-  "description": "LUD-25 Part 2: notes keyed by a public key and spent by a recoverable signature. Every branch is the reference wallet's address path under a BIP39 seed (no passphrase): cashRoot is m/139', domainIndices are the four raw uint32 read big-endian from HMAC-SHA256(key = the private key at m/139'/1'/0, msg = utf8(host)), and addressNode is m/139'/1'/d1/d2/d3/d4 as privateKey||chainCode hex. branchPubkey is its x-only key (branchParity says whether the full point has even y) and cx1 is bech32m(\"cx\", branchPubkey || chainCode). Each note: t = tagged_hash(\"LNURLcash/derive\", branchPubkey || chainCode || ser32_be(index)); notePubkey = x(lift_x(branchPubkey) + t*G), which a watcher holding only the cx1 computes; noteSecretKey = ((branchParity even ? p : n - p) + t) mod n. ownershipSignature is RFC6979 ECDSA, low-S, over sha256(sha256(\"Lightning Signed Message:\" || \"LNURLcash\")), laid out r || s || recovery id, and ck1 is its bech32m(\"ck\") encoding: the value that spends the note. A certificate is the same signature shape by the mint key over sha256(sha256(\"Lightning Signed Message:\" || \"LNURLcash:<amount_msat>:<hex(notePubkey)>\")), encoded bech32m(\"cs\"). All four strings are bech32m with no length limit; all-uppercase is valid and mixed case is not (BIP-350). Values match vectors generated from lnurl-wallet src/lib and confirmed against lnurl-mint.",
+  "description": "LUD-25 Part 2: notes keyed by a public key and spent by a recoverable signature. Every branch is the reference wallet's address path under a BIP39 seed (no passphrase): cashRoot is m/139', domainIndices are the four raw uint32 read big-endian from HMAC-SHA256(key = the private key at m/139'/1'/0, msg = utf8(host)), and addressNode is m/139'/1'/d1/d2/d3/d4 as privateKey||chainCode hex. branchPubkey is its x-only key (branchParity says whether the full point has even y) and cx1 is bech32m(\"cx\", branchPubkey || chainCode). Each note: t = tagged_hash(\"LNURLcash/derive\", branchPubkey || chainCode || ser32_be(index)); notePubkey = x(lift_x(branchPubkey) + t*G), which a watcher holding only the cx1 computes; noteSecretKey = ((branchParity even ? p : n - p) + t) mod n. ownershipSignature is RFC6979 ECDSA, low-S, over sha256(sha256(\"Lightning Signed Message:\" || \"LNURLcash\")), laid out r || s || recovery id, and ck1 is its bech32m(\"ck\") encoding: the value that spends the note. Register/update/unregister proofs use that same signature shape from index zero over \"LNURLcash:<action>:<username>\", separating both action and name. A certificate is the same signature shape by the mint key over sha256(sha256(\"Lightning Signed Message:\" || \"LNURLcash:<amount_msat>:<hex(notePubkey)>\")); its bech32m HRP is \"cs\" plus the amount encoded by BOLT-11 rules. All four strings are bech32m with no length limit; all-uppercase is valid and mixed case is not (BIP-350). Values match vectors generated from lnurl-wallet src/lib and confirmed against lnurl-mint.",
   "conventions": {
     "addressBranch": "m/139'/1'/d1/d2/d3/d4",
     "hashingKey": "m/139'/1'/0",
@@ -11,7 +11,9 @@
     "ownershipMessage": "LNURLcash",
     "ownershipDigest": "c92e46d0c00a23e46b68442e4c0e22d8983bc74158da73d6c33b6f0fdc970e6e",
     "signatureLayout": "r || s || recovery id (0..3), RFC6979, low-S",
-    "certificateMessage": "LNURLcash:<amount_msat>:<hex(pk)>"
+    "addressProofMessage": "LNURLcash:<register|unregister>:<username>",
+    "certificateMessage": "LNURLcash:<amount_msat>:<hex(pk)>",
+    "certificateHrp": "cs || BOLT11_amount_suffix(amount_msat)"
   },
   "mint": {
     "privateKey": "da6ec5c4342514114ee493a55ddc06d085d61eb78f0b7163e07cdb7f1f66ac05",
@@ -626,7 +628,7 @@
       "message": "LNURLcash:1000:b52e0b9dcd39edd137cf4b6794d0d2a55f13c9aa968078394d49159651b5a02f",
       "digest": "3234532c63de08043753a7b7404f4c243a540f378d4865dd16a2f5c71bec1e31",
       "signature": "b2c850964a82eee8d33ed8ca321fe500c15f9fa42e7e57416542e27596aacfb67c3e8206fff2acf0260c7d27d2b63f0fa9e36a1bfc2b19924d5e9db6c1187b5300",
-      "cs1": "cs1kty9p9j2sthw35e7mr9ry8l9qrq4l8ay9el9wst9gt38t942e7m8c05zqmll9t8sycx86f7jkclsl20rdgdlc2cejfx4a8dkcyv8k5cqte7psz"
+      "cs1": "cs10n1kty9p9j2sthw35e7mr9ry8l9qrq4l8ay9el9wst9gt38t942e7m8c05zqmll9t8sycx86f7jkclsl20rdgdlc2cejfx4a8dkcyv8k5cqaqz8vc"
     },
     {
       "notePubkey": "068a32f78dd15c688a9972f6507e1b9d9ca6f97317095997c3bf1dde53a78db9",
@@ -634,7 +636,7 @@
       "message": "LNURLcash:21000:068a32f78dd15c688a9972f6507e1b9d9ca6f97317095997c3bf1dde53a78db9",
       "digest": "4fe334bdb45cecd25336877cba4319a00444bca5ae97bbb2f29874e0c0baaee1",
       "signature": "09605e77950bce2f2739288d4d0b4871e9aa8e7009e198a55c706c1ef886167023d54dceb4ecf72f33ee066a87b7a97a11a1003056ef5454cd04555b510ea66c01",
-      "cs1": "cs1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp3yj3cv"
+      "cs1": "cs210n1p9s9uau4p08z7fee9zx56z6gw8564rnsp8se3f2uwpkpa7yxzecz842de66weae0x0hqv658k75h5ydpqqc9dm652nxsg42m2y82vmqp9qy0pt"
     },
     {
       "notePubkey": "831613eb24856343694e81cb8e1b0b1b5582f76f0bd3db5443cfcb6d96eb8fb7",
@@ -642,7 +644,7 @@
       "message": "LNURLcash:99999:831613eb24856343694e81cb8e1b0b1b5582f76f0bd3db5443cfcb6d96eb8fb7",
       "digest": "95f155dc7805a62e459359668cd4bdb3c95d38fd21276067f9fc33307f28059e",
       "signature": "a9160631f5f10517161335160b004d7828191731c536431ca07f2109e1e9fb7d157a0d8863b343653aaa16574dac9813db100341fb61c08950a01137a5c9ac9a01",
-      "cs1": "cs14ytqvv047yz3w9snx5tqkqzd0q5pj9e3c5myx89q0ussnc0fld7327sd3p3mxsm9824pv46d4jvp8kcsqdqlkcwq39g2qyfh5hy6exspa2guz2"
+      "cs1": "cs999990p14ytqvv047yz3w9snx5tqkqzd0q5pj9e3c5myx89q0ussnc0fld7327sd3p3mxsm9824pv46d4jvp8kcsqdqlkcwq39g2qyfh5hy6exsp5x36tn"
     },
     {
       "notePubkey": "2d0a844a516b08def2cfb284142542c8775dcffd88768180986bc03a1d489bf4",
@@ -650,7 +652,36 @@
       "message": "LNURLcash:100000000:2d0a844a516b08def2cfb284142542c8775dcffd88768180986bc03a1d489bf4",
       "digest": "100eb3e508b8a2d32733d7ac3846ea477a5f9120c93071eb4521057a916dce0e",
       "signature": "8b2daf986ad84609246c87227c6f92bc2b24b660f72487a7afc5e21f0594aaaf0ab85c79e7a934499e0f9b4e5ae74123946f915c5ba928537e35829d18655cf900",
-      "cs1": "cs13vk6lxr2mprqjfrvsu38cmujhs4jfdnq7ujg0fa0ch3p7pv542hs4wzu08n6jdzfnc8eknj6uaqj89r0j9w9h2fg2dlrtq5arpj4e7gqmdth9n"
+      "cs1": "cs1m13vk6lxr2mprqjfrvsu38cmujhs4jfdnq7ujg0fa0ch3p7pv542hs4wzu08n6jdzfnc8eknj6uaqj89r0j9w9h2fg2dlrtq5arpj4e7gqrmgxlj"
+    }
+  ],
+  "addressProofs": [
+    {
+      "action": "register",
+      "username": "alice",
+      "message": "LNURLcash:register:alice",
+      "digest": "0344528a8e7629117ae8d369e279614848df2551132ca060d646806529d94977",
+      "indexZeroSecretKey": "c809325604f901c494bebab0f02d74d43cb3d58c143b753c2b749d1733288f64",
+      "indexZeroPubkey": "b52e0b9dcd39edd137cf4b6794d0d2a55f13c9aa968078394d49159651b5a02f",
+      "signature": "18037cd57993de939a5edec704319dd6221650878c5682b98108d7869ae447366210853b212dbf2b48202a22b3371c6e5635444d726edef2c7db472fdd8df3b200"
+    },
+    {
+      "action": "unregister",
+      "username": "alice",
+      "message": "LNURLcash:unregister:alice",
+      "digest": "6a6679a4bf19a30ef180677f873140cad9d3929ec3ee7937f9da00a72251ca73",
+      "indexZeroSecretKey": "c809325604f901c494bebab0f02d74d43cb3d58c143b753c2b749d1733288f64",
+      "indexZeroPubkey": "b52e0b9dcd39edd137cf4b6794d0d2a55f13c9aa968078394d49159651b5a02f",
+      "signature": "351af0eaad099b834cc7019207de9fe87e2b384653c87d406d8dc5e1c88fa95d3b48149403cf5d223136c29756861cb397778aac93a2265e8b28ef0cd934ac5301"
+    },
+    {
+      "action": "register",
+      "username": "bob",
+      "message": "LNURLcash:register:bob",
+      "digest": "3994b99587e99411398be24188193db7a7e8e682b45574448019890c36c4b2c5",
+      "indexZeroSecretKey": "c809325604f901c494bebab0f02d74d43cb3d58c143b753c2b749d1733288f64",
+      "indexZeroPubkey": "b52e0b9dcd39edd137cf4b6794d0d2a55f13c9aa968078394d49159651b5a02f",
+      "signature": "4864ac3e78ecdffded8e764527489e684e4caef30edb0c5cb11106e70022711f4d495f4fa35bcb6dfe3e92e93301ae7f307bf1e94a40514bc4249c20e0ec0d2a00"
     }
   ],
   "valid": [
@@ -702,6 +733,11 @@
       "value": "ck18pf5gt7jfqyrxkyy5ssk7y4t9lauyknjpzjnaf2wppq4y3a68vnn92xvfama804vp27hjyn6h6dy5qz6j5vwy4st8uhe3tqv6thyhfgq0xh4cd",
       "why": "a ck1 is not a cs1"
     },
+    {
+      "type": "cs1",
+      "value": "cs1kty9p9j2sthw35e7mr9ry8l9qrq4l8ay9el9wst9gt38t942e7m8c05zqmll9t8sycx86f7jkclsl20rdgdlc2cejfx4a8dkcyv8k5cqte7psz",
+      "why": "legacy fixed cs HRP carries no amount"
+    },
     {
       "type": "cx1",
       "value": "cx1k5hqh8wd88kazd70fdnef5xj54038jd2j6q8sw2dfy2ev5d45qhsnvwp55",

package/vectors/responses.json

@@ -1,10 +1,10 @@
 {
   "version": 1,
   "spec": "LUD-25 draft (lnurl/luds#301)",
-  "description": "Classifying a SERVICE response. The distinction that matters for funds is definitive-rejection versus ambiguous-outcome: a parsed {\"status\":\"ERROR\"} means the request was processed and refused, while a transport failure, an unparseable body, or a 200 that does not confirm means the mutation MAY have landed - and for rotate/split/merge the WALLET-generated secrets are then the only copy of the outputs, so they must ride the error rather than be discarded. A confirmed mutation carrying no signature is its own outcome: it definitely landed, so the secrets matter more than ever, and the SERVICE is non-conforming. `op` says which call each case is driven through - a melt is the one mutation with no signature to return.",
+  "description": "Classifying a SERVICE response. The distinction that matters for funds is definitive-rejection versus ambiguous-outcome: a parsed {\"status\":\"ERROR\"} means the request was processed and refused, while a transport failure, an unparseable body, or a 200 that does not confirm means the mutation MAY have landed - and for rotate/split/merge the WALLET-generated secrets are then the only copy of the outputs, so they must ride the error rather than be discarded. A confirmed mutation missing a signature the output or caller requires is its own outcome: it definitely landed, so the secrets matter more than ever. `op` says which call each case is driven through - a melt is the one mutation with no signature to return.",
   "outcomes": {
     "ok": "the operation is confirmed",
-    "unverifiable": "the mutation is confirmed but carries no signature. LUD-25 requires one on every rotate, split and merge, so this SERVICE is non-conforming - but the note EXISTS at the hash the WALLET disclosed, and its secret is the only key to that value. Keep the secret; report the mint",
+    "unverifiable": "the mutation is confirmed but a cp1 output came back without its required cs1 certificate, or a legacy hash output came back without the raw signature a strict caller required. The note EXISTS at the output the WALLET disclosed, so keep its secret even while reporting the missing proof",
     "pending": "this k1 has another operation in flight (a melt); retry shortly",
     "spent": "the SERVICE is authoritative that the note is already burned; a holder may lock it as spent",
     "unknown": "the SERVICE does not recognise this note; surface it, do not silently lock it",
@@ -19,8 +19,43 @@
       "body": {
         "status": "OK"
       },
+      "expect": "ok",
+      "why": "a bare OK is the conforming answer for a plain hash output since the Part 2 rewrite: the note is real, the WALLET keeps its secret, and nobody the holder hands it to can check it offline, which is what a plain note is. Only a cp1 output is owed a certificate"
+    },
+    {
+      "name": "cp1 output confirmed without a certificate",
+      "op": "mutation",
+      "output": "cp1",
+      "http": 200,
+      "body": {
+        "status": "OK"
+      },
+      "expect": "unverifiable",
+      "why": "a cp1 output is owed a cs1 certificate in sig; without one the note it names cannot be verified offline, which is the whole reason to hold a cp1 note. The note exists at the key the WALLET disclosed"
+    },
+    {
+      "name": "cp1 output certified",
+      "op": "mutation",
+      "output": "cp1",
+      "http": 200,
+      "body": {
+        "status": "OK",
+        "sig": "cs14w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2atdv6a53"
+      },
+      "expect": "ok",
+      "signature": "cs14w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2at4w46h2atdv6a53"
+    },
+    {
+      "name": "a split to a cp1 change that certifies only its first output",
+      "op": "split",
+      "change": "cp1",
+      "http": 200,
+      "body": {
+        "status": "OK",
+        "sig": "ababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababab"
+      },
       "expect": "unverifiable",
-      "why": "a bare OK was a conforming rotate answer while offline verification was optional. It is not one now: the note is real and the WALLET must keep its secret, but nobody the holder hands it to can check it"
+      "why": "the change is a cp1 note and is owed its certificate in sig2 exactly as the first output would be; the change is not a lesser note"
     },
     {
       "name": "success with an offline-verification signature",
@@ -54,8 +89,9 @@
         "status": "OK",
         "sig": "ababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababab"
       },
-      "expect": "unverifiable",
-      "why": "both outputs of a split are notes and both need a signature; the change is not a lesser note"
+      "expect": "ok",
+      "signature": "ababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababababab",
+      "why": "both outputs are legacy hash notes; tolerant callers can retain a landed output without proof, while a strict caller may require both raw Part 1 signatures"
     },
     {
       "name": "melt success with a LUD-21 style proof",

package/vectors/retried-mutation.json

@@ -10,7 +10,7 @@
   ],
   "provenance": "Recorded, never inferred. A SERVICE links the burned inputs to the outputs they minted and matches against that. Matching on \"a note exists at h\" alone would let anyone holding a burned k1 and any outstanding note id pull a success out of the SERVICE.",
   "outcomes": {
-    "replay": "the original success, byte for byte: the same status, the same sig and sig2, and no balance moved",
+    "replay": "the original success, byte for byte: the same status, the same sig and sig2 where the outputs had any, and no balance moved",
     "double-spend": "refused exactly as any other attempt to spend a burned secret, with the reason string unchanged"
   },
   "cases": [