lnurlcash-kit 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.12.0 - 2026-09-11
+
+**A Part 2 branch rooted in a Nostr key.**
+
+- `deriveNostrCashSeed(secretKey)` and `deriveNostrAddressNode(secretKey,
+  host)`: a Part 2 address branch rooted in a Nostr identity key, for a holder
+  with no BIP-39 words. The seed is `HMAC-SHA256(key, "LNURLcash/nostr-seed")`
+  and the path from it is the reference wallet's. heartwood-esp32 derives the
+  same branch on the device, and `test/vectors/nostr-seed.json` is the file
+  both grade against.
+- `deriveCashMaster(seed)`: the BIP-32 master node, exported beside
+  `deriveCashChild` for walking a path the kit does not name, such as
+  nsec-tree's `m/44'/1237'/727'/0'/0'`.
+
+## 0.11.0 - 2026-09-11
+
+**The wire calls take LUD-25 Part 2 notes.**
+
+- A `ck1` goes anywhere a `k1` does. `resolveNoteInput` accepts a note URL
+  carrying one, and rotate, split, merge, melt and `fetchNoteInfo` pass it
+  through.
+- A `cp1` goes anywhere an output does. `requestInvoice` sends it as the
+  comment alone. The `*WithHash` calls send it as `p1`/`p2`, while a hash
+  keeps `h`/`h2`, which every mint understands. That is lnurl-wallet's rule.
+- `fetchNoteInfoByHash` and `buildNoteInfoUrlByHash` take a `cp1`, sent as
+  `p`.
+- `noteIdOf(k1)` is the id a mint files a note under, for either kind.
+  `noteLookupOf(k1)` is what to look it up by without disclosing it.
+- `noteSignatureMessage` and `noteSignatureDigest` build the message over the
+  key for a `ck1`.
+
 ## 0.10.0 - 2026-09-11
 
 **LUD-25 Part 2 building blocks.** Notes keyed by a public key and spent by a

package/README.md

@@ -382,10 +382,14 @@ mint recovers `pk` from it to find the note. The mint's certificate, `cs1…`,
 is the same signature mints already make, over `hex(pk)` instead of a hash.
 So a recipient can check a note offline with nothing but `ck1` and `cs1`.
 
-This release has the building blocks: the four encodings, key derivation and
-ownership signatures. The wire calls that mint to `cp1` and spend with `ck1`
-come next. The names match lnurl-wallet's `src/lib`, so moving to it later is
-an import change.
+The wire calls take both kinds. A `ck1` goes anywhere a `k1` does: a note
+URL, `fetchNoteInfo`, rotate, split, merge and melt. A `cp1` goes anywhere an
+output does: `requestInvoice`'s `h`, and the output of every `*WithHash` call,
+where it is sent as `p1`/`p2` while a hash keeps `h`/`h2`, the same rule as
+lnurl-wallet. `noteIdOf(k1)` gives the id a mint files either kind under, and
+`noteLookupOf(k1)` what to pass `fetchNoteInfoByHash` to check a note without
+disclosing it. The names match lnurl-wallet's `src/lib`, so moving to it
+later is an import change.
 
 ```ts
 import {
@@ -421,6 +425,16 @@ Three things worth knowing:
 `test/vectors/part2.json` was generated from lnurl-wallet and checked against
 lnurl-mint. It moves into lnurlcash-conformance next.
 
+**A branch rooted in a Nostr key.** A holder with no BIP-39 words, such as a
+hardware signer that keeps only its identity key, or a wallet that never made
+any, can still be paid to keys of its own. `deriveNostrAddressNode(secretKey,
+host)` takes the branch from the key that owns the lightning address:
+`HMAC-SHA256(key = secret key, msg = "LNURLcash/nostr-seed")`, then the path
+above unchanged. heartwood-esp32 derives exactly this on the device, graded
+against the same `test/vectors/nostr-seed.json`, so its notes come back from
+its nsec (or the phrase the nsec came from) without the device. This is ours,
+not LUD-25's; a mint sees an ordinary `cx1` either way.
+
 ## Minting a note you named yourself
 
 By default the secret of a freshly minted note is the invoice's payment

package/dist/index.d.ts

@@ -262,6 +262,7 @@ type CashNode = {
     chainCode: Uint8Array;
 };
 declare const deriveCashChild: (node: CashNode, index: number) => CashNode;
+declare const deriveCashMaster: (seed: Uint8Array) => CashNode;
 declare const deriveCashRoot: (seed: Uint8Array) => CashNode;
 declare const cashDomainIndices: (root: CashNode, host: string) => number[];
 declare const deriveCashDomainNode: (root: CashNode, host: string) => CashNode;
@@ -293,8 +294,13 @@ declare const deriveNotePubkey: (branchPubkeyXOnly: Uint8Array, chainCode: Uint8
 declare const deriveNoteSecretKey: (branchPrivateKey: Uint8Array, chainCode: Uint8Array, index: number) => Uint8Array;
 declare const signNoteOwnership: (secretKey: Uint8Array) => Uint8Array;
 declare const recoverNoteOwnershipPubkey: (signature: Uint8Array) => Uint8Array | null;
+declare const noteIdOf: (k1: string) => string | null;
+declare const noteLookupOf: (k1: string) => string | null;
 declare const deriveCashAddressNode: (root: CashNode, host: string) => CashNode;
 declare const cashNodeToCx1: (node: CashNode) => Cx1;
+declare const NOSTR_CASH_SEED_LABEL = "LNURLcash/nostr-seed";
+declare const deriveNostrCashSeed: (secretKey: Uint8Array) => Uint8Array;
+declare const deriveNostrAddressNode: (secretKey: Uint8Array, host: string) => CashNode;
 
 declare const PAYMENT_REQUEST_PREFIX = "lnurlcashreq1";
 type PaymentRequestMethodDetails = {
@@ -403,4 +409,4 @@ declare const createClient: (options?: LnurlcashOptions) => {
 };
 type LnurlcashClient = ReturnType<typeof createClient>;
 
-export { AmbiguousMintError, AmbiguousMutationError, type BoundMintCommitment, type CashNode, type Cx1, type DecodeOptions, HashLookupUnsupportedError, type HashedMutationResult, type HashedSplitResult, InsufficientValueError, type InvoiceRequestOptions, type InvoiceResult, type LnurlcashClient, LnurlcashError, type LnurlcashOptions, type MeltResult, type MintAddressInfo, type MintClaim, type MintContact, type MintFee, type MintFeeBand, type NoteInfoByHash, type NoteScheme, NoteSpentError, NoteUnknownError, PAYMENT_REQUEST_PREFIX, type PayRequestInfo, type PaymentRequest, type PaymentRequestMethodDetails, PendingNoteError, ProtocolError, type RandomSecret, RequestRefusedError, type RestoreOptions, type RestoreResult, type RestoredNote, type RotateResult, type SeedRestoreOptions, type SeedRestoreResult, ServiceRejectedError, type SettleForValueOptions, type SettledForValue, type SettledNote, type SignatureCheck, type SplitResult, type UnresolvedIndex, UnverifiableNoteError, type ValidatedBoundMintReceipt, type VerifyResult, type WithdrawRequestInfo, type WithdrawSuccessResponse, applyMintFee, buildNoteInfoUrlByHash, buildNoteUrl, cashDomainIndices, cashNodeFromHex, cashNodeToCx1, cashNodeToHex, cashSecretAt, cashSecretSource, claimMintedNote, classifyNoteError, createClient, decodeBolt11AmountMsat, decodeCk1, decodeCp1, decodeCs1, decodeCx1, decodePaymentRequest, defaultRandomSecret, deriveCashAddressNode, deriveCashChild, deriveCashDomainNode, deriveCashRoot, deriveCashSecret, deriveNotePubkey, deriveNoteRoot, deriveNoteSecret, deriveNoteSecretKey, derivedSecretSource, describeMintFee, encodeCk1, encodeCp1, encodeCs1, encodeCx1, encodePaymentRequest, fetchInvoiceVerification, fetchMintAddress, fetchNoteInfo, fetchNoteInfoByHash, fetchPayRequest, formatFeePercent, fromBech32Lnurl, fromLud17, grossUpForMintFee, hashK1, isAllowedServiceUrl, isBech32Lnurl, isBolt11Invoice, isCk1, isCp1, isCs1, isCx1, isLightningAddress, isPaymentRequest, isPreimage, isValidNoteInput, lightningAddressUsername, meltNote, mergeBatches, mergeNotes, mergeNotesWithHash, mintAddressUrl, mintFeeBand, namesMintOutput, newSecretsOf, noteDeclaredAmount, noteK1, noteSignature, noteSignatureDigest, noteSignatureDigestForHash, noteSignatureMessage, noteSignatureMessageForHash, parseMintFee, paymentRequestAmountMsat, probeBurnedNote, recoverNoteOwnershipPubkey, requestInvoice, requireBoundMintQuote, requireNoteK1, resolveLnurlInput, resolveMintInput, resolveNoteInput, restoreFromSeed, restoreNotes, rotateNote, rotateNoteWithHash, sameInvoice, serverOf, settleNote, settleNoteForValue, signNoteOwnership, splitNote, splitNoteWithHash, toBech32Lnurl, toLud17w, validateBoundMintReceipt, verifyNoteSignature, verifyNoteSignatureAgainst, verifyNoteSignatureHash, verifyNoteSignatureHashAgainst, withNewK1, withinMintFeeBand, withoutK1 };
+export { AmbiguousMintError, AmbiguousMutationError, type BoundMintCommitment, type CashNode, type Cx1, type DecodeOptions, HashLookupUnsupportedError, type HashedMutationResult, type HashedSplitResult, InsufficientValueError, type InvoiceRequestOptions, type InvoiceResult, type LnurlcashClient, LnurlcashError, type LnurlcashOptions, type MeltResult, type MintAddressInfo, type MintClaim, type MintContact, type MintFee, type MintFeeBand, NOSTR_CASH_SEED_LABEL, type NoteInfoByHash, type NoteScheme, NoteSpentError, NoteUnknownError, PAYMENT_REQUEST_PREFIX, type PayRequestInfo, type PaymentRequest, type PaymentRequestMethodDetails, PendingNoteError, ProtocolError, type RandomSecret, RequestRefusedError, type RestoreOptions, type RestoreResult, type RestoredNote, type RotateResult, type SeedRestoreOptions, type SeedRestoreResult, ServiceRejectedError, type SettleForValueOptions, type SettledForValue, type SettledNote, type SignatureCheck, type SplitResult, type UnresolvedIndex, UnverifiableNoteError, type ValidatedBoundMintReceipt, type VerifyResult, type WithdrawRequestInfo, type WithdrawSuccessResponse, applyMintFee, buildNoteInfoUrlByHash, buildNoteUrl, cashDomainIndices, cashNodeFromHex, cashNodeToCx1, cashNodeToHex, cashSecretAt, cashSecretSource, claimMintedNote, classifyNoteError, createClient, decodeBolt11AmountMsat, decodeCk1, decodeCp1, decodeCs1, decodeCx1, decodePaymentRequest, defaultRandomSecret, deriveCashAddressNode, deriveCashChild, deriveCashDomainNode, deriveCashMaster, deriveCashRoot, deriveCashSecret, deriveNostrAddressNode, deriveNostrCashSeed, deriveNotePubkey, deriveNoteRoot, deriveNoteSecret, deriveNoteSecretKey, derivedSecretSource, describeMintFee, encodeCk1, encodeCp1, encodeCs1, encodeCx1, encodePaymentRequest, fetchInvoiceVerification, fetchMintAddress, fetchNoteInfo, fetchNoteInfoByHash, fetchPayRequest, formatFeePercent, fromBech32Lnurl, fromLud17, grossUpForMintFee, hashK1, isAllowedServiceUrl, isBech32Lnurl, isBolt11Invoice, isCk1, isCp1, isCs1, isCx1, isLightningAddress, isPaymentRequest, isPreimage, isValidNoteInput, lightningAddressUsername, meltNote, mergeBatches, mergeNotes, mergeNotesWithHash, mintAddressUrl, mintFeeBand, namesMintOutput, newSecretsOf, noteDeclaredAmount, noteIdOf, noteK1, noteLookupOf, noteSignature, noteSignatureDigest, noteSignatureDigestForHash, noteSignatureMessage, noteSignatureMessageForHash, parseMintFee, paymentRequestAmountMsat, probeBurnedNote, recoverNoteOwnershipPubkey, requestInvoice, requireBoundMintQuote, requireNoteK1, resolveLnurlInput, resolveMintInput, resolveNoteInput, restoreFromSeed, restoreNotes, rotateNote, rotateNoteWithHash, sameInvoice, serverOf, settleNote, settleNoteForValue, signNoteOwnership, splitNote, splitNoteWithHash, toBech32Lnurl, toLud17w, validateBoundMintReceipt, verifyNoteSignature, verifyNoteSignatureAgainst, verifyNoteSignatureHash, verifyNoteSignatureHashAgainst, withNewK1, withinMintFeeBand, withoutK1 };

package/dist/index.js

@@ -1,8 +1,8 @@
 import { bech32, base64urlnopad, bech32m } from '@scure/base';
+import { secp256k1 } from '@noble/curves/secp256k1.js';
 import { hmac } from '@noble/hashes/hmac.js';
 import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import { utf8ToBytes, bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
-import { secp256k1 } from '@noble/curves/secp256k1.js';
 
 // src/urls.ts
 var isBech32Lnurl = (data) => data.trim().toUpperCase().startsWith("LNURL1");
@@ -120,104 +120,6 @@ var serverOf = (url) => {
     return url;
   }
 };
-var hashK1 = (k1) => bytesToHex(sha256(hexToBytes(k1)));
-var defaultRandomSecret = () => bytesToHex(crypto.getRandomValues(new Uint8Array(32)));
-var isPreimage = (value) => /^[0-9a-fA-F]{64}$/.test(value.trim());
-var NOTE_DERIVATION_DOMAIN = utf8ToBytes("lnurlcash-note-v1");
-var deriveNoteRoot = (seed) => hmac(sha256, NOTE_DERIVATION_DOMAIN, seed);
-var requireIndex = (index) => {
-  if (!Number.isSafeInteger(index) || index < 0) {
-    throw new RangeError(
-      `A note index must be a non-negative integer, not ${index}.`
-    );
-  }
-  return index;
-};
-var deriveNoteSecret = (root, host, index) => bytesToHex(hmac(sha256, root, utf8ToBytes(`${host}:${requireIndex(index)}`)));
-var derivedSecretSource = (root, host, start = 0) => {
-  let next = requireIndex(start);
-  const source = (() => deriveNoteSecret(root, host, next++));
-  source.index = () => next;
-  return source;
-};
-
-// src/note.ts
-var noteK1 = (url) => {
-  try {
-    return new URL(url).searchParams.get("k1")?.toLowerCase() ?? null;
-  } catch {
-    return null;
-  }
-};
-var requireNoteK1 = (url) => {
-  const k1 = noteK1(url);
-  if (!k1) {
-    throw new Error(
-      "This note carries no secret in its URL - it may be held on a device."
-    );
-  }
-  return k1;
-};
-var noteDeclaredAmount = (url) => {
-  try {
-    const raw = new URL(url).searchParams.get("amount");
-    if (raw === null) return null;
-    const n = Number(raw);
-    return Number.isFinite(n) ? n : null;
-  } catch {
-    return null;
-  }
-};
-var noteSignature = (url) => {
-  try {
-    return new URL(url).searchParams.get("sig");
-  } catch {
-    return null;
-  }
-};
-var resolveNoteInput = (value) => {
-  const url = resolveLnurlInput(value);
-  const k1 = url ? noteK1(url) : null;
-  if (!url || !k1 || !isPreimage(k1)) return null;
-  return url;
-};
-var isValidNoteInput = (value) => resolveNoteInput(value) !== null;
-var buildNoteInfoUrlByHash = (withdrawLink, h) => {
-  const hex = h.trim().toLowerCase();
-  if (!/^[0-9a-f]{64}$/.test(hex)) {
-    throw new Error("A note hash must be 32 bytes of hex.");
-  }
-  const url = new URL(fromLud17(withdrawLink.trim()));
-  url.searchParams.delete("k1");
-  url.searchParams.delete("amount");
-  url.searchParams.delete("sig");
-  url.searchParams.set("h", hex);
-  return url.toString();
-};
-var buildNoteUrl = (withdrawLink, k1, amountMsat) => {
-  const url = new URL(fromLud17(withdrawLink.trim()));
-  url.searchParams.set("k1", k1.trim().toLowerCase());
-  if (amountMsat !== void 0) {
-    url.searchParams.set("amount", String(amountMsat));
-  }
-  return url.toString();
-};
-var withNewK1 = (url, k1, amountMsat, signature) => {
-  const newUrl = new URL(url);
-  newUrl.searchParams.set("k1", k1.toLowerCase());
-  newUrl.searchParams.set("amount", String(amountMsat));
-  if (signature) newUrl.searchParams.set("sig", signature);
-  else newUrl.searchParams.delete("sig");
-  return newUrl.toString();
-};
-var withoutK1 = (url, amountMsat, signature) => {
-  const newUrl = new URL(url);
-  newUrl.searchParams.delete("k1");
-  newUrl.searchParams.set("amount", String(amountMsat));
-  if (signature) newUrl.searchParams.set("sig", signature);
-  else newUrl.searchParams.delete("sig");
-  return newUrl.toString();
-};
 var HARDENED = 2147483648;
 var CURVE_N = secp256k1.Point.Fn.ORDER;
 var MASTER_KEY_DOMAIN = utf8ToBytes("Bitcoin seed");
@@ -252,6 +154,7 @@ var deriveCashChild = (node, index) => {
   }
   return { privateKey: to32Bytes(key), chainCode: material.slice(32) };
 };
+var deriveCashMaster = (seed) => masterFrom(seed);
 var masterFrom = (seed) => {
   if (seed.length < 16 || seed.length > 64) {
     throw new RangeError(
@@ -272,7 +175,7 @@ var cashDomainIndices = (root, host) => {
   return [0, 4, 8, 12].map((offset) => readUint32BE(material, offset));
 };
 var deriveCashDomainNode = (root, host) => cashDomainIndices(root, host).reduce(deriveCashChild, root);
-var requireIndex2 = (index) => {
+var requireIndex = (index) => {
   if (!Number.isSafeInteger(index) || index < 0 || index >= HARDENED) {
     throw new RangeError(
       `A note index must be an integer in [0, 2^31), not ${index}.`
@@ -281,7 +184,7 @@ var requireIndex2 = (index) => {
   return index;
 };
 var cashSecretAt = (domainNode, index) => bytesToHex(
-  deriveCashChild(domainNode, requireIndex2(index) + HARDENED).privateKey
+  deriveCashChild(domainNode, requireIndex(index) + HARDENED).privateKey
 );
 var deriveCashSecret = (root, host, index) => cashSecretAt(deriveCashDomainNode(root, host), index);
 var cashNodeToHex = (node) => bytesToHex(node.privateKey) + bytesToHex(node.chainCode);
@@ -296,11 +199,33 @@ var cashNodeFromHex = (hex) => {
 };
 var cashSecretSource = (root, host, start = 0) => {
   const domainNode = deriveCashDomainNode(root, host);
-  let next = requireIndex2(start);
+  let next = requireIndex(start);
   const source = (() => cashSecretAt(domainNode, next++));
   source.index = () => next;
   return source;
 };
+var hashK1 = (k1) => bytesToHex(sha256(hexToBytes(k1)));
+var defaultRandomSecret = () => bytesToHex(crypto.getRandomValues(new Uint8Array(32)));
+var isPreimage = (value) => /^[0-9a-fA-F]{64}$/.test(value.trim());
+var NOTE_DERIVATION_DOMAIN = utf8ToBytes("lnurlcash-note-v1");
+var deriveNoteRoot = (seed) => hmac(sha256, NOTE_DERIVATION_DOMAIN, seed);
+var requireIndex2 = (index) => {
+  if (!Number.isSafeInteger(index) || index < 0) {
+    throw new RangeError(
+      `A note index must be a non-negative integer, not ${index}.`
+    );
+  }
+  return index;
+};
+var deriveNoteSecret = (root, host, index) => bytesToHex(hmac(sha256, root, utf8ToBytes(`${host}:${requireIndex2(index)}`)));
+var derivedSecretSource = (root, host, start = 0) => {
+  let next = requireIndex2(start);
+  const source = (() => deriveNoteSecret(root, host, next++));
+  source.index = () => next;
+  return source;
+};
+
+// src/recoverable.ts
 var encodeFixed = (hrp, bytes, length) => {
   if (bytes.length !== length) {
     throw new RangeError(`A ${hrp}1 payload is ${length} bytes, not ${bytes.length}.`);
@@ -404,11 +329,111 @@ var recoverNoteOwnershipPubkey = (signature) => {
     return null;
   }
 };
+var noteIdOf = (k1) => {
+  if (typeof k1 !== "string") return null;
+  const value = k1.trim().toLowerCase();
+  if (isPreimage(value)) return hashK1(value);
+  const signature = decodeCk1(value);
+  const pubkey = signature ? recoverNoteOwnershipPubkey(signature) : null;
+  return pubkey ? bytesToHex(pubkey) : null;
+};
+var noteLookupOf = (k1) => {
+  const id = noteIdOf(k1);
+  if (id === null) return null;
+  return isCk1(k1.trim().toLowerCase()) ? encodeCp1(hexToBytes(id)) : id;
+};
 var deriveCashAddressNode = (root, host) => deriveCashDomainNode(deriveCashChild(root, 1 + 2147483648), host);
 var cashNodeToCx1 = (node) => ({
   pubkeyXOnly: secp256k1.getPublicKey(node.privateKey, true).slice(1),
   chainCode: node.chainCode.slice()
 });
+var NOSTR_CASH_SEED_LABEL = "LNURLcash/nostr-seed";
+var deriveNostrCashSeed = (secretKey) => {
+  if (!(secretKey instanceof Uint8Array) || secretKey.length !== 32) {
+    throw new RangeError("A Nostr secret key is 32 bytes.");
+  }
+  return hmac(sha256, secretKey, utf8ToBytes(NOSTR_CASH_SEED_LABEL));
+};
+var deriveNostrAddressNode = (secretKey, host) => deriveCashAddressNode(deriveCashRoot(deriveNostrCashSeed(secretKey)), host);
+
+// src/note.ts
+var noteK1 = (url) => {
+  try {
+    return new URL(url).searchParams.get("k1")?.toLowerCase() ?? null;
+  } catch {
+    return null;
+  }
+};
+var requireNoteK1 = (url) => {
+  const k1 = noteK1(url);
+  if (!k1) {
+    throw new Error(
+      "This note carries no secret in its URL - it may be held on a device."
+    );
+  }
+  return k1;
+};
+var noteDeclaredAmount = (url) => {
+  try {
+    const raw = new URL(url).searchParams.get("amount");
+    if (raw === null) return null;
+    const n = Number(raw);
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  }
+};
+var noteSignature = (url) => {
+  try {
+    return new URL(url).searchParams.get("sig");
+  } catch {
+    return null;
+  }
+};
+var resolveNoteInput = (value) => {
+  const url = resolveLnurlInput(value);
+  const k1 = url ? noteK1(url) : null;
+  if (!url || !k1 || noteIdOf(k1) === null) return null;
+  return url;
+};
+var isValidNoteInput = (value) => resolveNoteInput(value) !== null;
+var buildNoteInfoUrlByHash = (withdrawLink, h) => {
+  const value = h.trim().toLowerCase();
+  const key = isCp1(value);
+  if (!key && !/^[0-9a-f]{64}$/.test(value)) {
+    throw new Error("A note hash must be 32 bytes of hex, or a cp1 key.");
+  }
+  const url = new URL(fromLud17(withdrawLink.trim()));
+  url.searchParams.delete("k1");
+  url.searchParams.delete("amount");
+  url.searchParams.delete("sig");
+  url.searchParams.set(key ? "p" : "h", value);
+  return url.toString();
+};
+var buildNoteUrl = (withdrawLink, k1, amountMsat) => {
+  const url = new URL(fromLud17(withdrawLink.trim()));
+  url.searchParams.set("k1", k1.trim().toLowerCase());
+  if (amountMsat !== void 0) {
+    url.searchParams.set("amount", String(amountMsat));
+  }
+  return url.toString();
+};
+var withNewK1 = (url, k1, amountMsat, signature) => {
+  const newUrl = new URL(url);
+  newUrl.searchParams.set("k1", k1.toLowerCase());
+  newUrl.searchParams.set("amount", String(amountMsat));
+  if (signature) newUrl.searchParams.set("sig", signature);
+  else newUrl.searchParams.delete("sig");
+  return newUrl.toString();
+};
+var withoutK1 = (url, amountMsat, signature) => {
+  const newUrl = new URL(url);
+  newUrl.searchParams.delete("k1");
+  newUrl.searchParams.set("amount", String(amountMsat));
+  if (signature) newUrl.searchParams.set("sig", signature);
+  else newUrl.searchParams.delete("sig");
+  return newUrl.toString();
+};
 
 // src/errors.ts
 var LnurlcashError = class extends Error {
@@ -851,9 +876,14 @@ var describeMintFee = (fee) => [
   fee.feePpm > 0 ? `${formatFeePercent(fee.feePpm)}% of the amount paid` : null
 ].filter(Boolean).join(" + ");
 var LIGHTNING_SIGNED_MESSAGE_PREFIX = utf8ToBytes("Lightning Signed Message:");
-var noteSignatureMessage = (k1, amountMsat) => noteSignatureMessageForHash(hashK1(k1), amountMsat);
+var requireNoteId = (k1) => {
+  const id = noteIdOf(k1);
+  if (id === null) throw new Error("A k1 is 32 bytes of hex or a ck1.");
+  return id;
+};
+var noteSignatureMessage = (k1, amountMsat) => noteSignatureMessageForHash(requireNoteId(k1), amountMsat);
 var noteSignatureMessageForHash = (h, amountMsat) => `LNURLcash:${amountMsat}:${h.trim().toLowerCase()}`;
-var noteSignatureDigest = (k1, amountMsat) => noteSignatureDigestForHash(hashK1(k1), amountMsat);
+var noteSignatureDigest = (k1, amountMsat) => noteSignatureDigestForHash(requireNoteId(k1), amountMsat);
 var noteSignatureDigestForHash = (h, amountMsat) => sha256(
   sha256(
     new Uint8Array([
@@ -864,22 +894,10 @@ var noteSignatureDigestForHash = (h, amountMsat) => sha256(
 );
 var NO_MATCH = { valid: false, pubkey: null };
 var verifyNoteSignatureAgainst = (k1, amountMsat, signatureHex, mintPubkeys) => {
-  const h = signedNoteId(k1);
+  const h = noteIdOf(k1);
   if (h === null) return NO_MATCH;
   return verifyNoteSignatureHashAgainst(h, amountMsat, signatureHex, mintPubkeys);
 };
-var signedNoteId = (k1) => {
-  const ownership = decodeCk1(k1);
-  if (ownership) {
-    const pubkey = recoverNoteOwnershipPubkey(ownership);
-    return pubkey ? bytesToHex(pubkey) : null;
-  }
-  try {
-    return hashK1(k1);
-  } catch {
-    return null;
-  }
-};
 var verifyNoteSignatureHashAgainst = (h, amountMsat, signatureHex, mintPubkeys) => {
   const targets = (Array.isArray(mintPubkeys) ? mintPubkeys : [mintPubkeys]).filter((key) => typeof key === "string").map((key) => key.trim().toLowerCase());
   if (targets.length === 0) return NO_MATCH;
@@ -1141,12 +1159,16 @@ var meltNote = async (callback, k1, pr, options = {}) => {
     pr: typeof body.pr === "string" ? body.pr : void 0
   };
 };
+var outputParam = (value, which) => {
+  const cp1 = isCp1(value.trim().toLowerCase());
+  return [cp1 ? `p${which}` : which === 1 ? "h" : "h2", value];
+};
 var rotateNoteWithHash = async (callback, k1, h, options = {}) => {
   const body = await replayableCallbackRequest(
     callback,
     [
       ["k1", k1],
-      ["h", h]
+      outputParam(h, 1)
     ],
     options
   );
@@ -1158,8 +1180,8 @@ var splitNoteWithHash = async (callback, k1s, amountMsat, h, h2, options = {}) =
     [
       ...k1s.map((k1) => ["k1", k1]),
       ["amount", String(amountMsat)],
-      ["h", h],
-      ["h2", h2]
+      outputParam(h, 1),
+      outputParam(h2, 2)
     ],
     options
   );
@@ -1171,7 +1193,7 @@ var splitNoteWithHash = async (callback, k1s, amountMsat, h, h2, options = {}) =
 var mergeNotesWithHash = async (callback, k1s, h, options = {}) => {
   const body = await replayableCallbackRequest(
     callback,
-    [...k1s.map((k1) => ["k1", k1]), ["h", h]],
+    [...k1s.map((k1) => ["k1", k1]), outputParam(h, 1)],
     options
   );
   return { signature: requireSignature(body.sig, options, "merge") };
@@ -1367,14 +1389,17 @@ var requestInvoice = async (payCallback, amountMsat, options = {}) => {
   const cbUrl = new URL(payCallback);
   cbUrl.searchParams.set("amount", String(amountMsat));
   if (options.h !== void 0) {
-    if (!isPreimage(options.h)) {
+    const h = options.h.trim().toLowerCase();
+    if (isCp1(h)) {
+      cbUrl.searchParams.set("comment", h);
+    } else if (isPreimage(h)) {
+      cbUrl.searchParams.set("comment", h);
+      cbUrl.searchParams.set("h", h);
+    } else {
       throw new RequestRefusedError(
-        "An output hash must be 32 bytes of hex - no invoice was requested."
+        "An output must be 32 bytes of hex or a cp1 key - no invoice was requested."
       );
     }
-    const h = options.h.trim().toLowerCase();
-    cbUrl.searchParams.set("comment", h);
-    cbUrl.searchParams.set("h", h);
   }
   const body = await lnurlFetch(cbUrl, resolveOptions(options));
   if (typeof body?.pr !== "string") {
@@ -1722,4 +1747,4 @@ var createClient = (options = {}) => ({
   settleNoteForValue: (noteUrl, terms) => settleNoteForValue(noteUrl, terms, options)
 });
 
-export { AmbiguousMintError, AmbiguousMutationError, HashLookupUnsupportedError, InsufficientValueError, LnurlcashError, NoteSpentError, NoteUnknownError, PAYMENT_REQUEST_PREFIX, PendingNoteError, ProtocolError, RequestRefusedError, ServiceRejectedError, UnverifiableNoteError, applyMintFee, buildNoteInfoUrlByHash, buildNoteUrl, cashDomainIndices, cashNodeFromHex, cashNodeToCx1, cashNodeToHex, cashSecretAt, cashSecretSource, claimMintedNote, classifyNoteError, createClient, decodeBolt11AmountMsat, decodeCk1, decodeCp1, decodeCs1, decodeCx1, decodePaymentRequest, defaultRandomSecret, deriveCashAddressNode, deriveCashChild, deriveCashDomainNode, deriveCashRoot, deriveCashSecret, deriveNotePubkey, deriveNoteRoot, deriveNoteSecret, deriveNoteSecretKey, derivedSecretSource, describeMintFee, encodeCk1, encodeCp1, encodeCs1, encodeCx1, encodePaymentRequest, fetchInvoiceVerification, fetchMintAddress, fetchNoteInfo, fetchNoteInfoByHash, fetchPayRequest, formatFeePercent, fromBech32Lnurl, fromLud17, grossUpForMintFee, hashK1, isAllowedServiceUrl, isBech32Lnurl, isBolt11Invoice, isCk1, isCp1, isCs1, isCx1, isLightningAddress, isPaymentRequest, isPreimage, isValidNoteInput, lightningAddressUsername, meltNote, mergeBatches, mergeNotes, mergeNotesWithHash, mintAddressUrl, mintFeeBand, namesMintOutput, newSecretsOf, noteDeclaredAmount, noteK1, noteSignature, noteSignatureDigest, noteSignatureDigestForHash, noteSignatureMessage, noteSignatureMessageForHash, parseMintFee, paymentRequestAmountMsat, probeBurnedNote, recoverNoteOwnershipPubkey, requestInvoice, requireBoundMintQuote, requireNoteK1, resolveLnurlInput, resolveMintInput, resolveNoteInput, restoreFromSeed, restoreNotes, rotateNote, rotateNoteWithHash, sameInvoice, serverOf, settleNote, settleNoteForValue, signNoteOwnership, splitNote, splitNoteWithHash, toBech32Lnurl, toLud17w, validateBoundMintReceipt, verifyNoteSignature, verifyNoteSignatureAgainst, verifyNoteSignatureHash, verifyNoteSignatureHashAgainst, withNewK1, withinMintFeeBand, withoutK1 };
+export { AmbiguousMintError, AmbiguousMutationError, HashLookupUnsupportedError, InsufficientValueError, LnurlcashError, NOSTR_CASH_SEED_LABEL, NoteSpentError, NoteUnknownError, PAYMENT_REQUEST_PREFIX, PendingNoteError, ProtocolError, RequestRefusedError, ServiceRejectedError, UnverifiableNoteError, applyMintFee, buildNoteInfoUrlByHash, buildNoteUrl, cashDomainIndices, cashNodeFromHex, cashNodeToCx1, cashNodeToHex, cashSecretAt, cashSecretSource, claimMintedNote, classifyNoteError, createClient, decodeBolt11AmountMsat, decodeCk1, decodeCp1, decodeCs1, decodeCx1, decodePaymentRequest, defaultRandomSecret, deriveCashAddressNode, deriveCashChild, deriveCashDomainNode, deriveCashMaster, deriveCashRoot, deriveCashSecret, deriveNostrAddressNode, deriveNostrCashSeed, deriveNotePubkey, deriveNoteRoot, deriveNoteSecret, deriveNoteSecretKey, derivedSecretSource, describeMintFee, encodeCk1, encodeCp1, encodeCs1, encodeCx1, encodePaymentRequest, fetchInvoiceVerification, fetchMintAddress, fetchNoteInfo, fetchNoteInfoByHash, fetchPayRequest, formatFeePercent, fromBech32Lnurl, fromLud17, grossUpForMintFee, hashK1, isAllowedServiceUrl, isBech32Lnurl, isBolt11Invoice, isCk1, isCp1, isCs1, isCx1, isLightningAddress, isPaymentRequest, isPreimage, isValidNoteInput, lightningAddressUsername, meltNote, mergeBatches, mergeNotes, mergeNotesWithHash, mintAddressUrl, mintFeeBand, namesMintOutput, newSecretsOf, noteDeclaredAmount, noteIdOf, noteK1, noteLookupOf, noteSignature, noteSignatureDigest, noteSignatureDigestForHash, noteSignatureMessage, noteSignatureMessageForHash, parseMintFee, paymentRequestAmountMsat, probeBurnedNote, recoverNoteOwnershipPubkey, requestInvoice, requireBoundMintQuote, requireNoteK1, resolveLnurlInput, resolveMintInput, resolveNoteInput, restoreFromSeed, restoreNotes, rotateNote, rotateNoteWithHash, sameInvoice, serverOf, settleNote, settleNoteForValue, signNoteOwnership, splitNote, splitNoteWithHash, toBech32Lnurl, toLud17w, validateBoundMintReceipt, verifyNoteSignature, verifyNoteSignatureAgainst, verifyNoteSignatureHash, verifyNoteSignatureHashAgainst, withNewK1, withinMintFeeBand, withoutK1 };

package/llms.txt

@@ -64,6 +64,15 @@ deriveNoteSecretKey(p, chainCode, i) -> sk negates p first when P has odd y
 signNoteOwnership(sk) -> 65 bytes          RFC6979 over fixed "LNURLcash"
 recoverNoteOwnershipPubkey(sig) -> pk | null
 verifyNoteSignature also takes a ck1 as k1 and a cs1 as the signature
+deriveCashMaster(seed) -> CashNode   the BIP-32 master, for walking a path the kit does not name
+deriveNostrCashSeed(secretKey) -> 32-byte seed   HMAC-SHA256(key, "LNURLcash/nostr-seed")
+deriveNostrAddressNode(secretKey, host) -> CashNode   the address path from that seed;
+  a branch for a holder with no BIP-39 words (heartwood-esp32 derives the same)
+noteIdOf(k1) -> id | null   sha256(k1) for a secret, the recovered key for a
+  ck1. One note has many valid ck1 strings: compare notes by this, not by k1
+noteLookupOf(k1) -> string  hash, or cp1 for a ck1; for fetchNoteInfoByHash
+Wire: a ck1 goes wherever a k1 does; a cp1 wherever an output does
+  (requestInvoice h, *WithHash outputs: cp1 sent as p1/p2, hash as h/h2)
 deriveNoteRoot(seedBytes) -> Uint8Array    LEGACY, pre-spec. Do not mint under
 deriveNoteSecret(root, host, index) -> k1  it; still scanned so old notes live.
 derivedSecretSource(root, host, start) -> RandomSecret & {index()}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lnurlcash-kit",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "LNURLcash (LUD-25) bearer note client for TypeScript - mint, rotate, split, merge, melt, and verify offline",
   "author": "TheCryptoDonkey",
   "license": "MIT",