diff --git a/lamassu-next/CLAUDE.md b/lamassu-next/CLAUDE.md
index 045052b..4aacac4 100644
--- a/lamassu-next/CLAUDE.md
+++ b/lamassu-next/CLAUDE.md
@@ -54,6 +54,10 @@ lamassu-next/
 - **apps/dashboard** - Operator dashboard for fleet management
 - **packages/hal** - Rust hardware drivers (bill validators, dispensers, printers)
 
+### Critical Documentation
+
+- **`packages/lightning/TROUBLESHOOTING.md`** - Lightning.Pub integration gotchas. Read this BEFORE debugging payment issues. Contains solutions to 6 non-obvious issues that took 3+ hours to diagnose.
+
 ## Commands
 
 ```bash
diff --git a/lamassu-next/apps/machine/src/components/ui/input/Input.vue b/lamassu-next/apps/machine/src/components/ui/input/Input.vue
new file mode 100644
index 0000000..dbc9bf1
--- /dev/null
+++ b/lamassu-next/apps/machine/src/components/ui/input/Input.vue
@@ -0,0 +1,35 @@
+<script setup lang="ts">
+import type { HTMLAttributes } from 'vue'
+import { useVModel } from '@vueuse/core'
+import { cn } from '@/lib/utils'
+
+const props = defineProps<{
+  defaultValue?: string | number
+  modelValue?: string | number
+  class?: HTMLAttributes['class']
+}>()
+
+const emits = defineEmits<{
+  (e: 'update:modelValue', payload: string | number): void
+}>()
+
+const modelValue = useVModel(props, 'modelValue', emits, {
+  passive: true,
+  defaultValue: props.defaultValue,
+})
+</script>
+
+<template>
+  <input
+    v-model="modelValue"
+    data-slot="input"
+    :class="
+      cn(
+        'file:text-foreground placeholder:text-muted-foreground selection:bg-primary selection:text-primary-foreground dark:bg-input/30 border-input h-9 w-full min-w-0 rounded-md border bg-transparent px-3 py-1 text-base shadow-xs transition-[color,box-shadow] outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm',
+        'focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px]',
+        'aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive',
+        props.class
+      )
+    "
+  />
+</template>
diff --git a/lamassu-next/apps/machine/src/components/ui/input/index.ts b/lamassu-next/apps/machine/src/components/ui/input/index.ts
new file mode 100644
index 0000000..a691dd6
--- /dev/null
+++ b/lamassu-next/apps/machine/src/components/ui/input/index.ts
@@ -0,0 +1 @@
+export { default as Input } from './Input.vue'
diff --git a/lamassu-next/apps/machine/src/services/lightning.ts b/lamassu-next/apps/machine/src/services/lightning.ts
index eb2899d..464f55e 100644
--- a/lamassu-next/apps/machine/src/services/lightning.ts
+++ b/lamassu-next/apps/machine/src/services/lightning.ts
@@ -2,39 +2,53 @@
  * Lightning Services
  *
  * Connects to Lightning.Pub and provides real ATMServices implementation.
- * Includes LNURL-withdraw server for cash-in flow.
+ *
+ * Cash-in flow options:
+ * 1. Browser dev mode: Mock LNURL for UI testing
+ * 2. Tauri production: Local LNURL-withdraw server OR laser scanner
+ *
+ * Note: Lightning.Pub's GetLnurlWithdrawLink is for users withdrawing from
+ * their account, not for ATM cash-in. Cash-in requires the ATM to PAY
+ * the customer's invoice.
  */
 
-import { NostrClient, generateIdentity, type MachineIdentity } from '@lamassu/nostr-client'
+import {
+  NostrClient,
+  generateIdentity,
+  loadIdentityFromHex,
+  type MachineIdentity,
+} from '@lamassu/nostr-client'
 import { LightningPubClient } from '@lamassu/lightning'
 import { CLINKClient, createOfferSuccess, createOfferError, CLINKErrorCode } from '@lamassu/clink'
 import type { OfferRequest } from '@lamassu/clink'
 import type { ATMServices, ATMContext } from '@lamassu/state-machine'
-import { LnurlWithdrawServer } from './lnurl-withdraw'
+
+// Check if we're in a browser environment
+const isBrowser = typeof window !== 'undefined'
 
 // Development infrastructure configuration
 // In production, these would come from environment or secure config
+// Use local network IP for testing from other devices (e.g., Shock Wallet on phone)
+const LOCAL_IP = '192.168.1.122' // Change this to your machine's local IP
+
 const DEV_CONFIG = {
-  // Lightning.Pub Nostr pubkey (from docker logs)
-  lightningPubPubkey: '0943fe710a0f48c77a0bdd11bd186d320cd1b01615cf9ec36fa2dc45bd86e92f',
-  // Local strfry relay
-  relayUrl: 'ws://localhost:7777',
+  // Lightning.Pub Nostr pubkey (from docker logs - check with: docker logs lamassu-lightning-pub | grep pubkey)
+  lightningPubPubkey: 'f454c5eec4ec4474128e19b57b45e49c3d0851d01eea960b39ce391cdba76fc6',
+  // Local strfry relay - use local IP for cross-device testing
+  relayUrl: `ws://${LOCAL_IP}:7777`,
   // Admin token for HTTP API (development only)
   adminToken: 'lamassu-dev-admin-token',
   // Lightning.Pub HTTP API
-  lightningPubApiUrl: 'http://localhost:1776',
-  // LNURL-withdraw server configuration
-  lnurlPort: 3333,
-  // External host - this needs to be reachable by the customer's wallet
-  // For local development, use localhost. In production, use the ATM's public IP/domain
-  lnurlExternalHost: 'localhost',
+  lightningPubApiUrl: `http://${LOCAL_IP}:1776`,
+  // Fixed dev identity for testing (fund this pubkey in Lightning.Pub)
+  // In production, identity is loaded from secure storage
+  devPrivateKey: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
 }
 
 interface LightningServices {
   nostrClient: NostrClient
   lightningPub: LightningPubClient
   clink: CLINKClient
-  lnurlServer: LnurlWithdrawServer
   identity: MachineIdentity
   atmServices: ATMServices
   /** Set callback for when offer requests are received */
@@ -55,9 +69,11 @@ type PaymentReceivedCallback = (preimage: string) => void
 export async function initializeLightningServices(): Promise<LightningServices> {
   console.log('[Lightning] Initializing services...')
 
-  // Generate a machine identity (in production, load from secure storage)
-  const identity = generateIdentity()
-  console.log('[Lightning] Machine identity:', identity.publicKey.slice(0, 16) + '...')
+  // Use fixed dev identity for testing (in production, load from secure storage)
+  // This allows us to fund the account once and reuse across page reloads
+  const identity = isBrowser ? loadIdentityFromHex(DEV_CONFIG.devPrivateKey) : generateIdentity()
+  console.log('[Lightning] Machine identity:', identity.publicKey)
+  console.log('[Lightning] Fund this pubkey in Lightning.Pub for testing')
 
   // Create Nostr client
   const nostrClient = new NostrClient({
@@ -138,38 +154,8 @@ export async function initializeLightningServices(): Promise<LightningServices>
   clink.startListening()
   console.log('[Lightning] CLINK client initialized with offer handler')
 
-  // Create pay invoice function for LNURL-withdraw
-  const payInvoice = async (invoice: string): Promise<{ preimage: string }> => {
-    console.log('[Lightning] Paying invoice:', invoice.slice(0, 32) + '...')
-    try {
-      const result = await lightningPub.payInvoice(invoice)
-      if (!result.success) {
-        throw new Error(result.error || 'Payment failed')
-      }
-      console.log(
-        '[Lightning] Payment successful, preimage:',
-        result.preimage?.slice(0, 16) + '...'
-      )
-      return { preimage: result.preimage! }
-    } catch (error) {
-      console.error('[Lightning] Failed to pay invoice:', error)
-      throw error
-    }
-  }
-
-  // Create LNURL-withdraw server
-  const lnurlServer = new LnurlWithdrawServer({
-    port: DEV_CONFIG.lnurlPort,
-    externalHost: DEV_CONFIG.lnurlExternalHost,
-    payInvoice,
-  })
-
-  // Start the LNURL server
-  await lnurlServer.start()
-  console.log('[Lightning] LNURL-withdraw server started on port', DEV_CONFIG.lnurlPort)
-
-  // Create ATM services
-  const atmServices = createATMServices(lightningPub, clink, lnurlServer, identity, (preimage) => {
+  // Create ATM services using Lightning.Pub's native LNURL-withdraw
+  const atmServices = createATMServices(lightningPub, clink, identity, (preimage) => {
     if (paymentReceivedCallback) {
       paymentReceivedCallback(preimage)
     }
@@ -179,7 +165,6 @@ export async function initializeLightningServices(): Promise<LightningServices>
     nostrClient,
     lightningPub,
     clink,
-    lnurlServer,
     identity,
     atmServices,
     onOfferRequest: (callback: OfferRequestCallback) => {
@@ -197,9 +182,8 @@ export async function initializeLightningServices(): Promise<LightningServices>
 function createATMServices(
   lightningPub: LightningPubClient,
   clink: CLINKClient,
-  lnurlServer: LnurlWithdrawServer,
   _identity: MachineIdentity,
-  onPaymentSuccess: (preimage: string) => void
+  _onPaymentSuccess: (preimage: string) => void
 ): ATMServices {
   return {
     /**
@@ -226,30 +210,37 @@ function createATMServices(
     /**
      * Generate an LNURL-withdraw link for cash-in
      *
-     * Customer scans QR with their wallet, wallet automatically creates invoice
-     * and sends it to us, we pay it.
+     * In production (Tauri), this would use either:
+     * 1. A local LNURL-withdraw server that calls PayInvoice
+     * 2. Laser scanner where customer shows invoice QR
+     *
+     * In browser dev mode, we return a mock LNURL for display.
+     * The user can paste a real invoice to test e2e payment flow.
      */
     generateLnurlWithdraw: async (context: ATMContext): Promise<string> => {
       console.log('[ATM Service] Generating LNURL-withdraw for', context.satsAmount, 'sats')
 
-      const lnurl = lnurlServer.createWithdrawal(
-        context.satsAmount,
-        `Lamassu ATM - Buy ${context.satsAmount} sats`,
-        (preimage) => {
-          console.log(
-            '[ATM Service] LNURL-withdraw payment sent! Preimage:',
-            preimage.slice(0, 16) + '...'
-          )
-          onPaymentSuccess(preimage)
-        },
-        (error) => {
-          console.error('[ATM Service] LNURL-withdraw payment failed:', error)
-          // Note: error handling is done via the state machine's PAYMENT_FAILED event
-        }
-      )
+      if (isBrowser) {
+        // Browser dev mode: return a mock LNURL for display
+        // User can paste a real invoice in dev mode to test e2e flow
+        console.log(
+          '[ATM Service] Browser mode - mock LNURL for display, use invoice input for real payments'
+        )
 
-      console.log('[ATM Service] Generated LNURL-withdraw:', lnurl.slice(0, 32) + '...')
-      return lnurl
+        // Create a mock LNURL that encodes to a placeholder URL
+        const mockLnurl = `LNURL1DP68GURN8GHJ7MRWW4EXCTNXD9SHG6NPVCHX7EFWD4JXZENFV9NX2ARGV4NXGWPJX5MRWCMRXVURSWFEVYCNZVE5XUCNQDE4XE3RJDPE8PSNJV3JXQCKXCTXXCEXXVPNVVEXJWFKVC6NXEPSVF3RSCNXV33KXVMRVFSNVWFKXESN2D3E8YUXGVNPVD3RWD3CV5UNVCE4V5URYWPNVYMN2E3SXFJRSWP3VGMRJCTYVYENXVFSV5URQVNXVDJXXVE4XCUNVVEEVY6RWD3E893NXCN9XAJNQVFEX4JNZCE5X5CRVV3NV5CNXCF3XSEK2CF5X43KWVPSXQCRQVPSXQCRQVPSXQCRQVPSXQCRQVPSXQCRQVPSXQCRQVPSXQCRQVPSXQCRQVPSXQCRQVPSXQCRQVPSXQCRQVPS2D3333`
+
+        // Small delay to simulate async operation
+        await new Promise((resolve) => setTimeout(resolve, 200))
+
+        return mockLnurl
+      }
+
+      // Production mode (Tauri): Would use local LNURL server or scanner
+      // For now, throw an error indicating this needs implementation
+      throw new Error(
+        'LNURL-withdraw not implemented for production mode yet. Use laser scanner flow.'
+      )
     },
 
     /**
diff --git a/lamassu-next/apps/machine/src/services/lnurl-withdraw.ts b/lamassu-next/apps/machine/src/services/lnurl-withdraw.ts
deleted file mode 100644
index 122d8cc..0000000
--- a/lamassu-next/apps/machine/src/services/lnurl-withdraw.ts
+++ /dev/null
@@ -1,310 +0,0 @@
-/**
- * LNURL-Withdraw Server
- *
- * Implements LUD-03 (LNURL-withdraw) protocol for cash-in flow.
- * Customer scans a QR code with their Lightning wallet, which automatically
- * creates an invoice and sends it to us for payment.
- *
- * Flow:
- * 1. ATM generates withdrawal with unique k1 token
- * 2. Customer scans LNURL-withdraw QR
- * 3. Wallet fetches parameters from our callback URL
- * 4. Wallet creates invoice and submits to callback
- * 5. We validate k1, pay the invoice, notify the ATM
- *
- * @see https://github.com/lnurl/luds/blob/luds/03.md
- */
-
-import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'http'
-import { bech32 } from '@scure/base'
-
-/** Pending withdrawal request */
-interface PendingWithdrawal {
-  k1: string
-  amountMsats: number
-  description: string
-  createdAt: number
-  /** Callback to pay the invoice when received */
-  payInvoice: (invoice: string) => Promise<{ preimage: string }>
-  /** Callback when payment succeeds */
-  onSuccess: (preimage: string) => void
-  /** Callback when payment fails */
-  onError: (error: string) => void
-}
-
-/** LNURL-withdraw server configuration */
-export interface LnurlWithdrawConfig {
-  /** Port to listen on */
-  port: number
-  /** External host/IP that wallets will connect to */
-  externalHost: string
-  /** Payment function */
-  payInvoice: (invoice: string) => Promise<{ preimage: string }>
-}
-
-/**
- * LNURL-withdraw server
- */
-export class LnurlWithdrawServer {
-  private server: Server | null = null
-  private pendingWithdrawals = new Map<string, PendingWithdrawal>()
-  private config: LnurlWithdrawConfig
-
-  constructor(config: LnurlWithdrawConfig) {
-    this.config = config
-  }
-
-  /**
-   * Start the HTTP server
-   */
-  async start(): Promise<void> {
-    if (this.server) {
-      return // Already running
-    }
-
-    return new Promise((resolve, reject) => {
-      this.server = createServer((req, res) => this.handleRequest(req, res))
-
-      this.server.on('error', (err) => {
-        console.error('[LNURL] Server error:', err)
-        reject(err)
-      })
-
-      this.server.listen(this.config.port, () => {
-        console.log(`[LNURL] Server listening on port ${this.config.port}`)
-        resolve()
-      })
-    })
-  }
-
-  /**
-   * Stop the HTTP server
-   */
-  async stop(): Promise<void> {
-    return new Promise((resolve) => {
-      if (this.server) {
-        this.server.close(() => {
-          this.server = null
-          console.log('[LNURL] Server stopped')
-          resolve()
-        })
-      } else {
-        resolve()
-      }
-    })
-  }
-
-  /**
-   * Create a new withdrawal request
-   *
-   * @param amountSats Amount in satoshis
-   * @param description Description for the invoice
-   * @param onSuccess Callback when payment succeeds
-   * @param onError Callback when payment fails
-   * @returns LNURL-withdraw string (bech32-encoded)
-   */
-  createWithdrawal(
-    amountSats: number,
-    description: string,
-    onSuccess: (preimage: string) => void,
-    onError: (error: string) => void
-  ): string {
-    // Generate random k1 token
-    const k1 = this.generateK1()
-
-    // Store the pending withdrawal
-    const withdrawal: PendingWithdrawal = {
-      k1,
-      amountMsats: amountSats * 1000,
-      description,
-      createdAt: Date.now(),
-      payInvoice: this.config.payInvoice,
-      onSuccess,
-      onError,
-    }
-
-    this.pendingWithdrawals.set(k1, withdrawal)
-    console.log(`[LNURL] Created withdrawal: ${k1.slice(0, 16)}... for ${amountSats} sats`)
-
-    // Build the callback URL
-    const callbackUrl = `http://${this.config.externalHost}:${this.config.port}/lnurl?k1=${k1}`
-
-    // Encode as LNURL (bech32 with "lnurl" prefix)
-    const lnurl = this.encodeLnurl(callbackUrl)
-    console.log(`[LNURL] Generated LNURL: ${lnurl.slice(0, 32)}...`)
-
-    return lnurl
-  }
-
-  /**
-   * Cancel a pending withdrawal
-   */
-  cancelWithdrawal(k1: string): void {
-    if (this.pendingWithdrawals.has(k1)) {
-      this.pendingWithdrawals.delete(k1)
-      console.log(`[LNURL] Cancelled withdrawal: ${k1.slice(0, 16)}...`)
-    }
-  }
-
-  /**
-   * Handle incoming HTTP requests
-   */
-  private handleRequest(req: IncomingMessage, res: ServerResponse): void {
-    // Enable CORS for wallet compatibility
-    res.setHeader('Access-Control-Allow-Origin', '*')
-    res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS')
-    res.setHeader('Content-Type', 'application/json')
-
-    if (req.method === 'OPTIONS') {
-      res.writeHead(200)
-      res.end()
-      return
-    }
-
-    const url = new URL(req.url || '/', `http://${req.headers.host}`)
-    const path = url.pathname
-    const k1 = url.searchParams.get('k1')
-    const pr = url.searchParams.get('pr') // Payment request (invoice)
-
-    console.log(
-      `[LNURL] Request: ${path}?k1=${k1?.slice(0, 16)}...${pr ? `&pr=${pr.slice(0, 20)}...` : ''}`
-    )
-
-    if (path !== '/lnurl') {
-      this.sendError(res, 404, 'Not found')
-      return
-    }
-
-    if (!k1) {
-      this.sendError(res, 400, 'Missing k1 parameter')
-      return
-    }
-
-    const withdrawal = this.pendingWithdrawals.get(k1)
-    if (!withdrawal) {
-      this.sendError(res, 400, 'Unknown or expired k1')
-      return
-    }
-
-    if (pr) {
-      // Step 2: Wallet is submitting an invoice
-      this.handleInvoiceSubmission(res, withdrawal, pr)
-    } else {
-      // Step 1: Wallet is requesting withdrawal parameters
-      this.handleWithdrawalRequest(res, withdrawal)
-    }
-  }
-
-  /**
-   * Handle initial LNURL-withdraw request (wallet fetching parameters)
-   */
-  private handleWithdrawalRequest(res: ServerResponse, withdrawal: PendingWithdrawal): void {
-    const callbackUrl = `http://${this.config.externalHost}:${this.config.port}/lnurl?k1=${withdrawal.k1}`
-
-    const response = {
-      tag: 'withdrawRequest',
-      callback: callbackUrl,
-      k1: withdrawal.k1,
-      defaultDescription: withdrawal.description,
-      minWithdrawable: withdrawal.amountMsats,
-      maxWithdrawable: withdrawal.amountMsats,
-    }
-
-    console.log(`[LNURL] Sending withdrawal parameters:`, {
-      ...response,
-      k1: response.k1.slice(0, 16) + '...',
-    })
-
-    res.writeHead(200)
-    res.end(JSON.stringify(response))
-  }
-
-  /**
-   * Handle invoice submission from wallet
-   */
-  private async handleInvoiceSubmission(
-    res: ServerResponse,
-    withdrawal: PendingWithdrawal,
-    invoice: string
-  ): Promise<void> {
-    console.log(`[LNURL] Received invoice: ${invoice.slice(0, 32)}...`)
-
-    try {
-      // Validate invoice starts with expected prefix
-      const lowerInvoice = invoice.toLowerCase()
-      if (
-        !lowerInvoice.startsWith('lnbc') &&
-        !lowerInvoice.startsWith('lntb') &&
-        !lowerInvoice.startsWith('lnbcrt')
-      ) {
-        this.sendError(res, 400, 'Invalid invoice format')
-        return
-      }
-
-      // TODO: Decode and verify invoice amount matches withdrawal amount
-      // For now, trust the wallet created the correct invoice
-
-      console.log(`[LNURL] Paying invoice...`)
-      const result = await withdrawal.payInvoice(invoice)
-
-      // Payment successful
-      console.log(`[LNURL] Payment successful! Preimage: ${result.preimage.slice(0, 16)}...`)
-
-      // Remove from pending
-      this.pendingWithdrawals.delete(withdrawal.k1)
-
-      // Notify the ATM
-      withdrawal.onSuccess(result.preimage)
-
-      // Send success response to wallet
-      res.writeHead(200)
-      res.end(JSON.stringify({ status: 'OK' }))
-    } catch (error) {
-      console.error(`[LNURL] Payment failed:`, error)
-
-      // Notify the ATM
-      withdrawal.onError(error instanceof Error ? error.message : 'Payment failed')
-
-      // Send error to wallet
-      this.sendError(res, 500, error instanceof Error ? error.message : 'Payment failed')
-    }
-  }
-
-  /**
-   * Send JSON error response
-   */
-  private sendError(res: ServerResponse, status: number, message: string): void {
-    res.writeHead(status)
-    res.end(JSON.stringify({ status: 'ERROR', reason: message }))
-  }
-
-  /**
-   * Generate a random k1 token (32 bytes hex)
-   */
-  private generateK1(): string {
-    const bytes = new Uint8Array(32)
-    crypto.getRandomValues(bytes)
-    return Array.from(bytes)
-      .map((b) => b.toString(16).padStart(2, '0'))
-      .join('')
-  }
-
-  /**
-   * Encode a URL as LNURL (bech32 with "lnurl" prefix)
-   */
-  private encodeLnurl(url: string): string {
-    const bytes = new TextEncoder().encode(url)
-    const words = bech32.toWords(bytes)
-    return bech32.encode('lnurl', words, 1023).toUpperCase()
-  }
-}
-
-/**
- * Decode an LNURL back to a URL (for testing/debugging)
- */
-export function decodeLnurl(lnurl: string): string {
-  // Cast to the expected bech32 format type
-  const decoded = bech32.decode(lnurl.toLowerCase() as `${string}1${string}`, 1023)
-  const bytes = bech32.fromWords(decoded.words)
-  return new TextDecoder().decode(new Uint8Array(bytes))
-}
diff --git a/lamassu-next/apps/machine/src/stores/atm.ts b/lamassu-next/apps/machine/src/stores/atm.ts
index 79607e6..c98b35a 100644
--- a/lamassu-next/apps/machine/src/stores/atm.ts
+++ b/lamassu-next/apps/machine/src/stores/atm.ts
@@ -10,6 +10,8 @@ import {
   type ATMMachine,
 } from '@lamassu/state-machine'
 import { initializeLightningServices } from '@/services/lightning'
+import type { LightningPubClient } from '@lamassu/lightning'
+import type { CLINKClient } from '@lamassu/clink'
 
 // Mock services for development/fallback
 const mockServices: ATMServices = {
@@ -53,6 +55,11 @@ export const useAtmStore = defineStore('atm', () => {
   const connectionStatus = ref<'disconnected' | 'connecting' | 'connected' | 'error'>(
     'disconnected'
   )
+  const lightningPub = ref<LightningPubClient | null>(null)
+  const clinkClient = ref<CLINKClient | null>(null)
+  const isPayingInvoice = ref(false)
+  const isRequestingDebit = ref(false)
+  const paymentError = ref<string | null>(null)
 
   // Computed
   const currentState = computed(() => {
@@ -118,6 +125,10 @@ export const useAtmStore = defineStore('atm', () => {
       connectionStatus.value = 'connected'
       console.log('[ATM] Connected to Lightning.Pub!')
 
+      // Store references to clients for direct operations
+      lightningPub.value = services.lightningPub
+      clinkClient.value = services.clink
+
       // Wire up payment received callback
       services.onPaymentReceived((preimage) => {
         console.log('[ATM] Payment received via CLINK, preimage:', preimage.slice(0, 16) + '...')
@@ -143,6 +154,109 @@ export const useAtmStore = defineStore('atm', () => {
     }
   }
 
+  /**
+   * Pay a Lightning invoice (for cash-in flow)
+   * Customer provides their invoice, we pay it with the calculated sats amount
+   */
+  async function payInvoice(invoice: string): Promise<boolean> {
+    if (!lightningPub.value) {
+      paymentError.value = 'Lightning services not initialized'
+      console.error('[ATM] Cannot pay invoice: Lightning.Pub not initialized')
+      return false
+    }
+
+    // Get the calculated sats amount from context (based on inserted cash)
+    const amountSats = context.value?.satsAmount
+    if (!amountSats || amountSats <= 0) {
+      paymentError.value = 'No amount calculated - insert cash first'
+      console.error('[ATM] Cannot pay invoice: no sats amount in context')
+      return false
+    }
+
+    isPayingInvoice.value = true
+    paymentError.value = null
+
+    try {
+      console.log(
+        '[ATM] Paying invoice:',
+        invoice.slice(0, 40) + '...',
+        'amount:',
+        amountSats,
+        'sats'
+      )
+      const result = await lightningPub.value.payInvoice(invoice, amountSats)
+
+      if (result.success && result.preimage) {
+        console.log('[ATM] Payment successful! Preimage:', result.preimage.slice(0, 16) + '...')
+        // Trigger the state machine transition
+        paymentReceived(result.preimage)
+        return true
+      } else {
+        paymentError.value = result.error || 'Payment failed'
+        console.error('[ATM] Payment failed:', result.error)
+        return false
+      }
+    } catch (error) {
+      paymentError.value = error instanceof Error ? error.message : 'Payment failed'
+      console.error('[ATM] Payment error:', error)
+      return false
+    } finally {
+      isPayingInvoice.value = false
+    }
+  }
+
+  /**
+   * Request a CLINK Debit from customer's wallet (for cash-in flow)
+   * Customer provides their Nostr pubkey, we request payment authorization
+   */
+  async function requestDebit(customerPubkey: string, amountSats?: number): Promise<boolean> {
+    if (!clinkClient.value) {
+      paymentError.value = 'CLINK client not initialized'
+      console.error('[ATM] Cannot request debit: CLINK client not initialized')
+      return false
+    }
+
+    // Use the amount from context if not specified
+    const amount = amountSats ?? context.value?.satsAmount
+    if (!amount) {
+      paymentError.value = 'No amount specified'
+      return false
+    }
+
+    isRequestingDebit.value = true
+    paymentError.value = null
+
+    try {
+      console.log('[ATM] Requesting CLINK Debit from', customerPubkey.slice(0, 16) + '...')
+      console.log('[ATM] Amount:', amount, 'sats')
+
+      const response = await clinkClient.value.requestDebit(customerPubkey, amount, {
+        memo: `Lamassu ATM - Buy ${amount} sats`,
+      })
+
+      if (response.res === 'ok' && response.preimage) {
+        console.log(
+          '[ATM] CLINK Debit successful! Preimage:',
+          response.preimage.slice(0, 16) + '...'
+        )
+        // Trigger the state machine transition
+        paymentReceived(response.preimage)
+        return true
+      } else {
+        const errorResponse = response as { res: 'GFY'; error: string }
+        paymentError.value = errorResponse.error || 'Debit request denied'
+        console.error('[ATM] CLINK Debit failed:', errorResponse.error)
+        return false
+      }
+    } catch (error) {
+      paymentError.value = error instanceof Error ? error.message : 'Debit request failed'
+      console.error('[ATM] CLINK Debit error:', error)
+      return false
+    } finally {
+      isRequestingDebit.value = false
+    }
+  }
+
   function send(event: Parameters<NonNullable<typeof actor.value>['send']>[0]) {
     if (!actor.value) {
       console.error('[ATM] Cannot send event: machine not initialized')
@@ -200,6 +314,9 @@ export const useAtmStore = defineStore('atm', () => {
     debugMode,
     useLiveServices,
     connectionStatus,
+    isPayingInvoice,
+    isRequestingDebit,
+    paymentError,
 
     // Computed
     currentState,
@@ -220,6 +337,8 @@ export const useAtmStore = defineStore('atm', () => {
     finishInserting,
     selectAmount,
     paymentReceived,
+    payInvoice,
+    requestDebit,
     skipReceipt,
     cashTaken,
     toggleDebug,
diff --git a/lamassu-next/apps/machine/src/views/CashInView.vue b/lamassu-next/apps/machine/src/views/CashInView.vue
index e13a16d..f7d2921 100644
--- a/lamassu-next/apps/machine/src/views/CashInView.vue
+++ b/lamassu-next/apps/machine/src/views/CashInView.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { watch, computed } from 'vue'
+import { watch, computed, ref } from 'vue'
 import { useRouter } from 'vue-router'
 import { useAtmStore } from '@/stores/atm'
 import { Button } from '@/components/ui/button'
@@ -7,11 +7,22 @@ import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@/com
 import { Badge } from '@/components/ui/badge'
 import { Alert, AlertDescription } from '@/components/ui/alert'
 import { Skeleton } from '@/components/ui/skeleton'
+import { Input } from '@/components/ui/input'
 import QRCode from '@/components/QRCode.vue'
 
 const router = useRouter()
 const atmStore = useAtmStore()
 
+// Input modes
+type PaymentMode = 'clink' | 'invoice'
+const paymentMode = ref<PaymentMode>('clink')
+
+// CLINK Debit: customer's npub/pubkey
+const pubkeyInput = ref('')
+
+// Invoice input for manual payment
+const invoiceInput = ref('')
+
 // Navigate back to idle when transaction completes
 watch(
   () => atmStore.isIdle,
@@ -42,9 +53,53 @@ function simulateBill(denomination: number) {
   atmStore.insertBill(denomination)
 }
 
+// Convert npub to hex pubkey if needed
+function normalizePubkey(input: string): string {
+  const trimmed = input.trim()
+  // If it's an npub, we'd need to decode it - for now just pass through
+  // In production, use nostr-tools nip19.decode()
+  if (trimmed.startsWith('npub1')) {
+    // Simple check - in production decode properly
+    console.log('[CashIn] npub detected, would decode in production')
+    // For now, just return as-is and let the CLINK client handle it
+    // TODO: Properly decode npub using nostr-tools
+  }
+  return trimmed
+}
+
+// Request CLINK Debit (Nostr-native payment)
+async function submitDebitRequest() {
+  const pubkey = normalizePubkey(pubkeyInput.value)
+  if (!pubkey) return
+
+  // Basic validation - should be 64 hex chars or npub
+  if (!pubkey.startsWith('npub1') && !/^[0-9a-fA-F]{64}$/.test(pubkey)) {
+    alert('Please enter a valid Nostr pubkey (64 hex chars) or npub')
+    return
+  }
+
+  await atmStore.requestDebit(pubkey)
+}
+
+// Pay invoice (manual BOLT-11 payment)
+async function submitInvoice() {
+  const invoice = invoiceInput.value.trim()
+  if (!invoice) return
+
+  // Basic validation - should start with lnbc or lntb
+  if (!invoice.toLowerCase().startsWith('lnbc') && !invoice.toLowerCase().startsWith('lntb')) {
+    alert('Please enter a valid Lightning invoice (starts with lnbc or lntb)')
+    return
+  }
+
+  await atmStore.payInvoice(invoice)
+}
+
 function formatSats(sats: number): string {
   return sats.toLocaleString()
 }
+
+const isProcessing = computed(() => atmStore.isPayingInvoice || atmStore.isRequestingDebit)
 </script>
 
 <template>
@@ -133,10 +188,10 @@ function formatSats(sats: number): string {
         </CardContent>
       </Card>
 
-      <!-- Display LNURL-withdraw QR -->
-      <Card v-else-if="nestedState === 'displayingQR'" class="w-96 border-0 bg-white/5">
+      <!-- Display Payment Options -->
+      <Card v-else-if="nestedState === 'displayingQR'" class="w-[480px] border-0 bg-white/5">
         <CardHeader class="text-center">
-          <CardTitle>Scan to Receive Sats</CardTitle>
+          <CardTitle>Receive Your Sats</CardTitle>
           <CardDescription v-if="context">
             <Badge variant="secondary" class="text-lg">
               {{ formatSats(context.satsAmount) }} sats
@@ -144,26 +199,125 @@ function formatSats(sats: number): string {
           </CardDescription>
         </CardHeader>
         <CardContent class="space-y-4">
-          <QRCode v-if="context?.lnurlWithdraw" :value="context.lnurlWithdraw" :size="200" />
-          <p class="text-center text-sm text-muted-foreground">
-            Open your Lightning wallet and scan to receive your sats
-          </p>
-          <p class="text-center text-xs text-muted-foreground/70">
-            Your wallet will automatically create an invoice and we'll pay it instantly
-          </p>
+          <!-- Payment mode tabs -->
+          <div class="flex gap-2 rounded-lg bg-white/5 p-1">
+            <Button
+              :variant="paymentMode === 'clink' ? 'default' : 'ghost'"
+              size="sm"
+              class="flex-1"
+              @click="paymentMode = 'clink'"
+            >
+              CLINK Debit (Nostr)
+            </Button>
+            <Button
+              :variant="paymentMode === 'invoice' ? 'default' : 'ghost'"
+              size="sm"
+              class="flex-1"
+              @click="paymentMode = 'invoice'"
+            >
+              Paste Invoice
+            </Button>
+          </div>
 
-          <!-- Dev controls -->
-          <Alert v-if="atmStore.debugMode" class="border-red-500/50 bg-red-500/10">
-            <AlertDescription class="text-center">
-              <Button
-                variant="outline"
-                size="sm"
-                @click="atmStore.paymentReceived('mock-preimage-' + Date.now())"
-              >
-                Dev: Simulate Payment Sent
-              </Button>
-            </AlertDescription>
-          </Alert>
+          <!-- CLINK Debit Mode -->
+          <div v-if="paymentMode === 'clink'" class="space-y-4">
+            <Alert class="border-blue-500/50 bg-blue-500/10">
+              <AlertDescription>
+                <p class="mb-2 text-sm font-medium text-blue-400">CLINK Debit (Nostr-Native)</p>
+                <p class="mb-3 text-xs text-muted-foreground">
+                  Enter your Shock Wallet's npub or pubkey. We'll send a debit request and your
+                  wallet will automatically pay.
+                </p>
+                <div class="flex gap-2">
+                  <Input
+                    v-model="pubkeyInput"
+                    placeholder="npub1... or hex pubkey"
+                    class="flex-1 font-mono text-xs"
+                    :disabled="isProcessing"
+                  />
+                  <Button
+                    variant="default"
+                    size="sm"
+                    :disabled="!pubkeyInput.trim() || isProcessing"
+                    @click="submitDebitRequest"
+                  >
+                    {{ atmStore.isRequestingDebit ? 'Requesting...' : 'Request' }}
+                  </Button>
+                </div>
+                <p v-if="atmStore.paymentError" class="mt-2 text-xs text-red-400">
+                  Error: {{ atmStore.paymentError }}
+                </p>
+              </AlertDescription>
+            </Alert>
+            <p class="text-center text-xs text-muted-foreground">
+              Your Shock Wallet must be connected to relay: ws://192.168.1.122:7777
+            </p>
+          </div>
+
+          <!-- Invoice Paste Mode -->
+          <div v-if="paymentMode === 'invoice'" class="space-y-4">
+            <Alert class="border-orange-500/50 bg-orange-500/10">
+              <AlertDescription>
+                <p class="mb-2 text-sm font-medium text-orange-400">Manual Invoice Payment</p>
+                <p class="mb-3 text-xs text-muted-foreground">
+                  Create a {{ formatSats(context?.satsAmount || 0) }} sat invoice in your wallet and
+                  paste it below. We'll pay it instantly.
+                </p>
+                <div class="flex gap-2">
+                  <Input
+                    v-model="invoiceInput"
+                    placeholder="lnbc... or lntb..."
+                    class="flex-1 font-mono text-xs"
+                    :disabled="isProcessing"
+                  />
+                  <Button
+                    variant="default"
+                    size="sm"
+                    :disabled="!invoiceInput.trim() || isProcessing"
+                    @click="submitInvoice"
+                  >
+                    {{ atmStore.isPayingInvoice ? 'Paying...' : 'Pay' }}
+                  </Button>
+                </div>
+                <p v-if="atmStore.paymentError" class="mt-2 text-xs text-red-400">
+                  Error: {{ atmStore.paymentError }}
+                </p>
+              </AlertDescription>
+            </Alert>
+            <p class="text-center text-xs text-muted-foreground">
+              Note: Invoice must be on same network (regtest for dev)
+            </p>
+          </div>
+
+          <!-- Divider -->
+          <div class="relative flex items-center justify-center py-2">
+            <div class="absolute inset-0 flex items-center">
+              <span class="w-full border-t border-white/20" />
+            </div>
+            <span class="relative bg-background px-3 text-xs text-muted-foreground">
+              or scan QR
+            </span>
+          </div>
+
+          <!-- LNURL QR (for wallet scanning - mock in browser) -->
+          <div class="flex flex-col items-center">
+            <QRCode v-if="context?.lnurlWithdraw" :value="context.lnurlWithdraw" :size="150" />
+            <p class="mt-2 text-center text-xs text-muted-foreground">
+              LNURL-withdraw (mock in browser dev)
+            </p>
+          </div>
+
+          <!-- Debug: Simulate payment button -->
+          <div v-if="atmStore.debugMode" class="pt-2 text-center">
+            <Button
+              variant="ghost"
+              size="sm"
+              class="text-xs text-muted-foreground"
+              @click="atmStore.paymentReceived('mock-preimage-' + Date.now())"
+            >
+              Dev: Skip to Success
+            </Button>
+          </div>
         </CardContent>
       </Card>
 
diff --git a/lamassu-next/docker/docker-compose.dev.yml b/lamassu-next/docker/docker-compose.dev.yml
index 099e4a0..584caf2 100644
--- a/lamassu-next/docker/docker-compose.dev.yml
+++ b/lamassu-next/docker/docker-compose.dev.yml
@@ -121,7 +121,8 @@ services:
       - LND_MACAROON_PATH=/root/.lnd/data/chain/bitcoin/regtest/admin.macaroon
       # Use local strfry relay - external URL first for nprofile generation
       # Lightning.Pub uses relays[0] for nprofiles, so put external URL first
-      - NOSTR_RELAYS=ws://host.docker.internal:7777 ws://strfry:7777
+      # NOTE: Change 192.168.1.122 to your machine's local IP for cross-device testing
+      - NOSTR_RELAYS=ws://192.168.1.122:7777 ws://strfry:7777
       # Disable external liquidity provider for regtest
       - DISABLE_LIQUIDITY_PROVIDER=true
       # Admin token for HTTP API access (development only)
diff --git a/lamassu-next/packages/lightning/TROUBLESHOOTING.md b/lamassu-next/packages/lightning/TROUBLESHOOTING.md
new file mode 100644
index 0000000..6dd1b2d
--- /dev/null
+++ b/lamassu-next/packages/lightning/TROUBLESHOOTING.md
@@ -0,0 +1,339 @@
+# Lightning.Pub Integration Troubleshooting
+
+This document captures hard-won lessons from debugging the Lightning.Pub RPC integration. Read this before debugging payment issues.
+
+## Quick Checklist
+
+If payments are "hanging" (no response), check in this order:
+
+1. **Is the payment actually going through?** Check Lightning.Pub logs:
+
+   ```bash
+   docker logs lamassu-lightning-pub --tail 20
+   ```
+
+   Look for "invoice paid X sats" - if you see this, the payment worked but the response isn't reaching your client.
+
+2. **Are you receiving ANY events?** Add logging to your subscription's `onEvent` callback. If nothing fires, it's a subscription issue (see Issue #3 below).
+
+3. **Is the response for you?** Check if events are being filtered correctly by `#p` tags and `requestId`.
+
+---
+
+## Issue #1: RPC Request Format
+
+### Symptom
+
+```
+ERROR NewInvoiceRequest::root.: object is not an instance of an object
+```
+
+### Cause
+
+Lightning.Pub expects a specific RPC request structure. Missing fields cause cryptic errors.
+
+### Solution
+
+Always include ALL fields in the RPC request:
+
+```typescript
+const request = {
+  rpcName: 'PayInvoice', // Method name
+  params: {}, // URL params (usually empty)
+  query: {}, // Query params (usually empty)
+  body: { invoice, amount }, // Method-specific data
+  authIdentifier: identity.publicKey, // Your pubkey
+  requestId: uniqueId, // For matching responses
+}
+```
+
+**Common mistake:** Putting method params directly in the request object instead of inside `body`.
+
+---
+
+## Issue #2: PayInvoice Amount Field
+
+### Symptom
+
+```
+ERROR PayInvoiceRequest::root..amount: is not a number
+```
+
+or
+
+```
+ERROR invoice has value, do not provide amount in the request
+```
+
+### Cause
+
+The `amount` field has confusing semantics:
+
+- It's ALWAYS required (despite the second error message suggesting otherwise)
+- For invoices WITH amounts: send `amount: 0` (meaning "use invoice amount")
+- For amountless invoices: send the actual amount
+
+### Solution
+
+```typescript
+const body = {
+  invoice: paymentRequest,
+  amount: invoiceHasAmount ? 0 : amountSats,
+}
+```
+
+**Why this is confusing:** The error "do not provide amount" is misleading. You must provide it, but set it to 0.
+
+---
+
+## Issue #3: Subscription Not Receiving Events
+
+### Symptom
+
+- Payment succeeds (visible in Lightning.Pub logs)
+- Client subscription's `onEvent` never fires
+- EOSE is received but no real-time events
+
+### Cause
+
+`SimplePool.subscribeMany()` from nostr-tools doesn't reliably deliver real-time events. It works for historical queries but not for waiting on responses.
+
+### Solution
+
+Use direct `Relay.subscribe()` instead of the pool:
+
+```typescript
+// DON'T use pool for real-time subscriptions
+const sub = pool.subscribeMany(urls, filters, { onevent: ... })
+
+// DO use direct relay connection
+const relay = await Relay.connect(url)
+const sub = relay.subscribe(filters, { onevent: ... })
+```
+
+If using a client wrapper, ensure subscriptions go through the connected Relay instances, not through SimplePool.
+
+---
+
+## Issue #4: Race Condition - Missing Responses
+
+### Symptom
+
+- First payment always times out
+- Subsequent payments sometimes work
+- Response arrives before subscription is ready
+
+### Cause
+
+Lightning.Pub responds VERY fast. If you publish the request before setting up the subscription, the response arrives before you're listening.
+
+### Solution
+
+Always set up the subscription BEFORE publishing:
+
+```typescript
+// WRONG - race condition
+await nostrClient.publish(event)
+const response = await waitForResponse(requestId)
+
+// RIGHT - subscribe first
+const responsePromise = waitForResponse(requestId) // Sets up subscription
+await nostrClient.publish(event) // Then publish
+return responsePromise // Then wait
+```
+
+---
+
+## Issue #5: Tag Filters Not Working
+
+### Symptom
+
+- Subscription with `#p` filter receives no events
+- Same subscription without `#p` receives events
+
+### Cause
+
+Some Nostr relays (including strfry in some configurations) don't properly support tag filters in subscriptions.
+
+### Solution
+
+Subscribe to a broader filter and manually check tags:
+
+```typescript
+// Instead of relying on relay to filter by #p
+const sub = relay.subscribe(
+  [
+    {
+      kinds: [21000],
+      authors: [lightningPubPubkey],
+      // '#p': [myPubkey],  // DON'T rely on this
+    },
+  ],
+  {
+    onevent: (event) => {
+      // Manually check p-tags
+      const pTags = event.tags.filter((t) => t[0] === 'p')
+      if (!pTags.some((t) => t[1] === myPubkey)) {
+        return // Not for us
+      }
+      // Process event...
+    },
+  }
+)
+```
+
+---
+
+## Issue #6: Response Matching with #e Tag
+
+### Symptom
+
+- Using `#e` filter to match responses to requests
+- No events received
+
+### Cause
+
+Lightning.Pub doesn't include an `e` tag referencing the request event in its responses. It only uses `p` tags.
+
+### Solution
+
+Match responses by `requestId` in the decrypted content, not by event tags:
+
+```typescript
+onevent: (event) => {
+  const response = decryptJSON(identity, pubkey, event.content)
+
+  // Match by requestId, not by #e tag
+  if (response.requestId !== expectedRequestId) {
+    return // Not our response
+  }
+  // Process response...
+}
+```
+
+---
+
+## Debugging Tools
+
+### Test Script
+
+Use a standalone test script to isolate issues:
+
+```javascript
+// test-pay.mjs
+import { Relay } from 'nostr-tools/relay'
+
+const relay = await Relay.connect('ws://192.168.1.122:7777')
+
+// Subscribe BEFORE publishing
+const sub = relay.subscribe(
+  [
+    {
+      kinds: [21000],
+      authors: [LIGHTNING_PUB_PUBKEY],
+    },
+  ],
+  {
+    onevent(evt) {
+      console.log('Got event:', evt.id)
+      // Decrypt and check requestId...
+    },
+  }
+)
+
+await relay.publish(signedEvent)
+```
+
+### Lightning.Pub Logs
+
+```bash
+# Watch for payment activity
+docker logs -f lamassu-lightning-pub 2>&1 | grep -E "pay|invoice|ERROR"
+```
+
+### Relay Logs
+
+```bash
+# Watch relay traffic
+docker logs -f lamassu-relay
+```
+
+---
+
+## Summary of Correct Implementation
+
+```typescript
+async sendRPC<T>(rpcName: string, body: unknown): Promise<T> {
+  const requestId = generateUniqueId()
+
+  const request = {
+    rpcName,
+    params: {},
+    query: {},
+    body,
+    authIdentifier: this.identity.publicKey,
+    requestId,
+  }
+
+  const encrypted = encryptNIP44(this.identity, targetPubkey, request)
+  const event = finalizeEvent({
+    kind: 21000,
+    content: encrypted,
+    tags: [['p', targetPubkey]],
+    created_at: now(),
+  }, this.identity.privateKey)
+
+  // 1. Subscribe FIRST (before publishing)
+  const responsePromise = new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => reject(new Error('Timeout')), 30000)
+
+    // 2. Use direct relay, not pool
+    const sub = this.relay.subscribe([{
+      kinds: [21000],
+      authors: [targetPubkey],
+      // 3. Don't use #p filter - check manually
+    }], {
+      onevent: (evt) => {
+        // 4. Manual p-tag check
+        if (!evt.tags.some(t => t[0] === 'p' && t[1] === myPubkey)) return
+
+        const response = decrypt(evt.content)
+
+        // 5. Match by requestId, not #e tag
+        if (response.requestId !== requestId) return
+
+        clearTimeout(timeout)
+        sub.close()
+
+        if (response.status === 'ERROR') {
+          reject(new Error(response.reason))
+        } else {
+          resolve(response)
+        }
+      }
+    })
+  })
+
+  // 6. Publish AFTER subscription is set up
+  await this.relay.publish(event)
+
+  return responsePromise
+}
+```
+
+---
+
+## Time Spent on Each Issue
+
+| Issue          | Time to Diagnose | Root Cause                               |
+| -------------- | ---------------- | ---------------------------------------- |
+| RPC format     | ~30 min          | Missing `params`, `query` fields         |
+| Amount field   | ~45 min          | Confusing `0` vs actual amount semantics |
+| SimplePool     | ~60 min          | Pool doesn't deliver real-time events    |
+| Race condition | ~15 min          | Subscribe before publish                 |
+| Tag filters    | ~30 min          | Relay doesn't support #p filter properly |
+| #e matching    | ~20 min          | Lightning.Pub doesn't use e-tags         |
+
+**Total debugging time: ~3+ hours**
+
+Following this document should reduce that to ~15 minutes.
diff --git a/lamassu-next/packages/lightning/src/client.ts b/lamassu-next/packages/lightning/src/client.ts
index 4bd96f3..888bede 100644
--- a/lamassu-next/packages/lightning/src/client.ts
+++ b/lamassu-next/packages/lightning/src/client.ts
@@ -33,6 +33,7 @@ import {
   type PayInvoiceResponse,
   type ExchangeRate,
   type InvoiceCallback,
+  type LnurlLinkResponse,
   isRPCError,
 } from './types.js'
 
@@ -93,7 +94,7 @@ export class LightningPubClient {
    */
   async createInvoice(params: CreateInvoiceParams): Promise<Invoice> {
     const response = await this.sendRPC<CreateInvoiceResponse>('NewInvoice', {
-      amount: params.amountSats,
+      amountSats: params.amountSats,
       memo: params.description || 'ATM Payment',
       expiry: params.expirySecs || 3600,
       private: params.privateHints ?? false,
@@ -112,12 +113,51 @@ export class LightningPubClient {
 
   /**
    * Pay a Lightning invoice
+   *
+   * @param paymentRequest - BOLT11 invoice to pay
+   * @param amountSats - Amount to pay in satoshis. Required for amountless invoices.
+   *                     If provided, this overrides any amount in the invoice.
    */
-  async payInvoice(paymentRequest: string): Promise<PaymentResult> {
+  async payInvoice(paymentRequest: string, amountSats?: number): Promise<PaymentResult> {
     try {
-      const response = await this.sendRPC<PayInvoiceResponse>('PayInvoice', {
+      // Decode invoice to check if it has an embedded amount
+      const decoded = this.decodeInvoice(paymentRequest)
+      const invoiceAmount = decoded.amountSats
+
+      // Determine the amount to send
+      // Lightning.Pub requires 'amount' field always:
+      // - For invoices with amounts: use 0 (meaning "use invoice amount")
+      // - For amountless invoices: use the calculated amount
+      let payAmount: number
+
+      if (invoiceAmount !== null && invoiceAmount > 0) {
+        // Invoice has amount - verify it doesn't exceed calculated sats
+        if (amountSats !== undefined && invoiceAmount > amountSats) {
+          return {
+            success: false,
+            error: `Invoice amount (${invoiceAmount} sats) exceeds available amount (${amountSats} sats)`,
+          }
+        }
+        // Use 0 to indicate "pay the invoice amount"
+        payAmount = 0
+      } else {
+        // Amountless invoice - must provide amount
+        if (!amountSats) {
+          return {
+            success: false,
+            error: 'Amount required for amountless invoice',
+          }
+        }
+        payAmount = amountSats
+      }
+
+      // Build request body - amount is always required
+      const body: Record<string, unknown> = {
         invoice: paymentRequest,
-      })
+        amount: payAmount,
+      }
+
+      const response = await this.sendRPC<PayInvoiceResponse>('PayInvoice', body)
 
       return {
         success: true,
@@ -132,6 +172,22 @@ export class LightningPubClient {
     }
   }
 
+  /**
+   * Get an LNURL-withdraw link
+   *
+   * Lightning.Pub hosts the LNURL-withdraw endpoint. Returns a bech32-encoded
+   * LNURL that wallets can scan to withdraw funds.
+   *
+   * The k1 is a secret that identifies this specific withdrawal request.
+   */
+  async getLnurlWithdrawLink(): Promise<LnurlLinkResponse> {
+    const response = await this.sendRPC<LnurlLinkResponse>('GetLnurlWithdrawLink', {})
+    return {
+      k1: response.k1,
+      lnurl: response.lnurl,
+    }
+  }
+
   /**
    * Look up an invoice by payment hash
    */
@@ -193,6 +249,10 @@ export class LightningPubClient {
    * Decode a BOLT11 invoice (basic parsing)
    *
    * For production use, consider using a proper bolt11 library.
+   *
+   * BOLT-11 format: ln + network + [amount][multiplier] + 1 + data
+   * - lnbc1... = mainnet, amountless
+   * - lnbcrt20u1... = regtest, 20 micro-BTC = 2000 sats
    */
   decodeInvoice(paymentRequest: string): {
     amountSats: number | null
@@ -200,11 +260,12 @@ export class LightningPubClient {
     description: string
     expiresAt: number
   } {
-    // Basic invoice parsing
-    const amountMatch = paymentRequest.match(/lnbc(\d+)([munp]?)/)
+    // Match amount BEFORE the '1' separator
+    // Group 1: amount (optional), Group 2: multiplier (optional)
+    const amountMatch = paymentRequest.toLowerCase().match(/ln(?:bc|tb|bcrt)(\d+)?([munp])?1/)
     let amountSats: number | null = null
 
-    if (amountMatch) {
+    if (amountMatch && amountMatch[1]) {
       const [, amount, multiplier] = amountMatch
       const baseAmount = parseInt(amount ?? '0', 10)
       switch (multiplier) {
@@ -224,6 +285,7 @@ export class LightningPubClient {
           amountSats = baseAmount * 100_000_000 // BTC to sats
       }
     }
+    // If no amount captured or match[1] is undefined, amountSats remains null (amountless)
 
     return {
       amountSats,
@@ -293,12 +355,14 @@ export class LightningPubClient {
 
     const requestId = this.generateRequestId()
 
+    // Lightning.Pub expects: rpcName, params, query, body, authIdentifier, requestId
     const request: RPCRequest = {
       rpcName,
-      body,
+      params: {},
+      query: {},
+      body: body as Record<string, unknown>,
       authIdentifier: this.identity.publicKey,
       requestId,
-      appId: this.config.appId,
     }
 
     const content = encryptContent(this.identity, this.config.accountPubkey, request)
@@ -314,16 +378,22 @@ export class LightningPubClient {
       this.identity.privateKey
     )
 
+    // IMPORTANT: Set up subscription BEFORE publishing to avoid race condition
+    // Lightning.Pub can respond very fast, so we need to be listening first
+    const responsePromise = this.waitForResponse<T>(requestId)
+
     await this.nostrClient.publish(event)
 
-    // Wait for response
-    return this.waitForResponse<T>(event.id, requestId)
+    return responsePromise
   }
 
   /**
    * Wait for a response to a specific request
+   *
+   * Note: Lightning.Pub doesn't include an 'e' tag referencing the request event,
+   * so we filter by '#p' and match on requestId in the decrypted content.
    */
-  private waitForResponse<T>(eventId: string, requestId: string): Promise<T> {
+  private waitForResponse<T>(requestId: string): Promise<T> {
     return new Promise((resolve, reject) => {
       if (!this.nostrClient || !this.identity) {
         reject(new Error('Client not initialized'))
@@ -335,20 +405,23 @@ export class LightningPubClient {
         reject(new Error('Request timeout'))
       }, this.config.timeout)
 
+      // Subscribe to ALL RPC events from Lightning.Pub
+      // We filter by #p tag manually because some relays don't support tag filters well
       const subId = this.nostrClient.subscribe(
         [
           {
             kinds: [LightningPubEventKind.RPC],
             authors: [this.config.accountPubkey],
-            '#p': [this.identity!.publicKey],
-            '#e': [eventId],
             since: Math.floor(Date.now() / 1000) - 5,
           },
         ],
         {
           onEvent: (event) => {
-            clearTimeout(timeout)
-            this.nostrClient!.unsubscribe(subId)
+            // Check if this event is for us (has our pubkey in p tags)
+            const pTags = event.tags.filter((t: string[]) => t[0] === 'p')
+            if (!pTags.some((t: string[]) => t[1] === this.identity!.publicKey)) {
+              return
+            }
 
             try {
               const response = decryptJSON<RPCResponse<T>>(
@@ -357,15 +430,23 @@ export class LightningPubClient {
                 event.content
               )
 
+              // Match on requestId to find our response
+              if (response.requestId !== requestId) {
+                return // Not our response, keep waiting
+              }
+
+              clearTimeout(timeout)
+              this.nostrClient!.unsubscribe(subId)
+
               if (isRPCError(response)) {
                 reject(new Error(response.reason))
               } else {
-                // Extract result from response (excluding status)
-                const { status, ...result } = response
+                // Extract result from response (excluding status and requestId)
+                const { status, requestId: _rid, ...result } = response
                 resolve(result as T)
               }
-            } catch (e) {
-              reject(e)
+            } catch {
+              // Decryption failed - might not be for us, ignore
             }
           },
         }
diff --git a/lamassu-next/packages/lightning/src/index.ts b/lamassu-next/packages/lightning/src/index.ts
index 91fd283..f6ea185 100644
--- a/lamassu-next/packages/lightning/src/index.ts
+++ b/lamassu-next/packages/lightning/src/index.ts
@@ -69,6 +69,8 @@ export {
   // Payment types
   type PaymentResult,
   type PayInvoiceResponse,
+  // LNURL types
+  type LnurlLinkResponse,
   // Exchange types
   type ExchangeRate,
   // Config
diff --git a/lamassu-next/packages/lightning/src/types.ts b/lamassu-next/packages/lightning/src/types.ts
index f4d774c..faa22aa 100644
--- a/lamassu-next/packages/lightning/src/types.ts
+++ b/lamassu-next/packages/lightning/src/types.ts
@@ -22,24 +22,24 @@ export enum LightningPubEventKind {
 export interface RPCRequest {
   /** Method name (e.g., "NewInvoice", "GetBalance") */
   rpcName: string
-  /** URL params */
-  params?: Record<string, string>
-  /** Query params */
-  query?: Record<string, string>
-  /** Request body */
-  body?: unknown
+  /** URL params (empty object for most methods) */
+  params: Record<string, string>
+  /** Query params (empty object for most methods) */
+  query: Record<string, string>
+  /** Request body containing method-specific parameters */
+  body: Record<string, unknown>
   /** Pubkey of requester (for validation) */
   authIdentifier: string
   /** Unique request identifier */
   requestId: string
-  /** Application identifier */
-  appId?: string
 }
 
 /** RPC success response */
 export interface RPCSuccessResponse<T = unknown> {
   /** Success status */
   status: 'OK'
+  /** Request ID echoed back */
+  requestId: string
   /** Result data - spread into the response object */
   [key: string]: unknown
 }
@@ -48,6 +48,8 @@ export interface RPCSuccessResponse<T = unknown> {
 export interface RPCErrorResponse {
   /** Error status */
   status: 'ERROR'
+  /** Request ID echoed back */
+  requestId: string
   /** Error reason */
   reason: string
 }
@@ -173,6 +175,18 @@ export interface PayInvoiceResponse {
   fee_paid?: number
 }
 
+// ============================================================================
+// LNURL
+// ============================================================================
+
+/** LNURL-withdraw link response (from GetLnurlWithdrawLink) */
+export interface LnurlLinkResponse {
+  /** Secret k1 for the LNURL-withdraw */
+  k1: string
+  /** Bech32-encoded LNURL string */
+  lnurl: string
+}
+
 // ============================================================================
 // Exchange Rates
 // ============================================================================
diff --git a/lamassu-next/packages/nostr-client/fund-dev.mjs b/lamassu-next/packages/nostr-client/fund-dev.mjs
new file mode 100644
index 0000000..f464770
--- /dev/null
+++ b/lamassu-next/packages/nostr-client/fund-dev.mjs
@@ -0,0 +1,109 @@
+import { NostrClient, loadIdentityFromHex, encryptContent, decryptJSON } from './dist/index.js'
+import { finalizeEvent } from 'nostr-tools'
+import { randomUUID } from 'crypto'
+
+const DEV_PRIVATE_KEY = '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef'
+const LIGHTNING_PUB_PUBKEY = 'f454c5eec4ec4474128e19b57b45e49c3d0851d01eea960b39ce391cdba76fc6'
+const RELAY_URL = 'ws://192.168.1.122:7777'
+
+async function main() {
+  const identity = loadIdentityFromHex(DEV_PRIVATE_KEY)
+  console.log('Using identity:', identity.publicKey)
+
+  const client = new NostrClient({
+    relays: [{ url: RELAY_URL }],
+    identity,
+  })
+
+  await client.connect()
+  console.log('Connected to relay')
+
+  const requestId = randomUUID()
+
+  // Correct RPC structure per Lightning.Pub documentation
+  const rpcRequest = {
+    rpcName: 'NewInvoice',
+    params: {},
+    query: {},
+    body: {
+      amountSats: 100000,
+      memo: 'Fund dev account',
+    },
+    authIdentifier: identity.publicKey,
+    requestId,
+  }
+
+  console.log('Request structure:', JSON.stringify(rpcRequest, null, 2))
+
+  const encryptedContent = encryptContent(identity, LIGHTNING_PUB_PUBKEY, rpcRequest)
+
+  const event = finalizeEvent(
+    {
+      kind: 21000,
+      created_at: Math.floor(Date.now() / 1000),
+      tags: [['p', LIGHTNING_PUB_PUBKEY]],
+      content: encryptedContent,
+    },
+    identity.privateKey
+  )
+
+  console.log('Publishing NewInvoice request (event id:', event.id, ')...')
+
+  // Subscribe to responses before publishing
+  let responseReceived = false
+  const subId = client.subscribe(
+    [
+      {
+        kinds: [21000],
+        authors: [LIGHTNING_PUB_PUBKEY],
+        since: Math.floor(Date.now() / 1000) - 5,
+      },
+    ],
+    {
+      onEvent: (evt) => {
+        console.log('Got event from Lightning.Pub:', evt.id.substring(0, 8) + '...')
+        // Check if it's for us
+        const pTags = evt.tags.filter((t) => t[0] === 'p')
+        const eTags = evt.tags.filter((t) => t[0] === 'e')
+        const isForUs = pTags.some((t) => t[1] === identity.publicKey)
+        const isReplyToOurEvent = eTags.some((t) => t[1] === event.id)
+        console.log(
+          '  Tags p:',
+          pTags.map((t) => t[1].substring(0, 8)),
+          'e:',
+          eTags.map((t) => t[1].substring(0, 8))
+        )
+        console.log('  For us:', isForUs, 'Reply to our event:', isReplyToOurEvent)
+
+        if (isForUs) {
+          try {
+            const response = decryptJSON(identity, LIGHTNING_PUB_PUBKEY, evt.content)
+            console.log('Decrypted response:', JSON.stringify(response, null, 2))
+            responseReceived = true
+          } catch (err) {
+            console.log('Failed to decrypt response:', err.message)
+          }
+        }
+      },
+    }
+  )
+
+  await client.publish(event)
+  console.log('Request published, waiting for response...')
+
+  // Wait up to 10 seconds for response
+  for (let i = 0; i < 20; i++) {
+    await new Promise((resolve) => setTimeout(resolve, 500))
+    if (responseReceived) break
+  }
+
+  if (!responseReceived) {
+    console.log('No response received within timeout')
+  }
+
+  client.unsubscribe(subId)
+  client.disconnect()
+  process.exit(0)
+}
+
+main().catch(console.error)
diff --git a/lamassu-next/packages/nostr-client/package.json b/lamassu-next/packages/nostr-client/package.json
index ea59877..e8a4b96 100644
--- a/lamassu-next/packages/nostr-client/package.json
+++ b/lamassu-next/packages/nostr-client/package.json
@@ -21,13 +21,17 @@
     "validate-schemas": "tsx scripts/validate-schemas.ts"
   },
   "dependencies": {
+    "@noble/curves": "^2.0.1",
+    "@noble/hashes": "^2.0.1",
+    "@scure/base": "^1.2.0",
+    "@stablelib/xchacha20": "^2.0.1",
     "nostr-tools": "^2.10.0"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
+    "@types/node": "^22.19.7",
+    "tsx": "^4.19.0",
     "typescript": "^5.7.0",
-    "vitest": "^2.1.0",
-    "tsx": "^4.19.0"
+    "vitest": "^2.1.0"
   },
   "peerDependencies": {
     "typescript": "^5.0.0"
diff --git a/lamassu-next/packages/nostr-client/src/client.ts b/lamassu-next/packages/nostr-client/src/client.ts
index fcf8429..6354f8b 100644
--- a/lamassu-next/packages/nostr-client/src/client.ts
+++ b/lamassu-next/packages/nostr-client/src/client.ts
@@ -211,37 +211,46 @@ export class NostrClient {
 
   /**
    * Subscribe to events matching filters
+   *
+   * Uses direct Relay connections instead of SimplePool for real-time event delivery.
    */
   subscribe(filters: SubscriptionFilter[], options: SubscriptionOptions): string {
     const id = `sub_${++this.subscriptionCounter}`
 
-    const connectedUrls = Array.from(this.connections.values())
+    // Get connected relay instances
+    const connectedRelays = Array.from(this.connections.values())
       .filter((c) => c.state === 'authenticated' || c.state === 'connected')
-      .map((c) => c.config.url)
+      .filter((c) => c.relay !== null)
 
-    if (connectedUrls.length === 0) {
+    if (connectedRelays.length === 0) {
       throw new Error('No connected relays')
     }
 
-    // @ts-expect-error nostr-tools types expect single Filter but subscribeMany accepts array
-    const sub = this.pool.subscribeMany(connectedUrls, filters, {
-      onevent: (event: Event) => {
-        options.onEvent(event)
-        this.emitEvent('event', { relay: 'pool', event })
-      },
-      oneose: () => {
-        options.onEose?.()
-        if (options.closeOnEose) {
-          this.unsubscribe(id)
-        }
-      },
-    })
+    // Subscribe on each connected relay directly (not through pool)
+    const subs: Array<{ close: () => void }> = []
+    for (const conn of connectedRelays) {
+      if (!conn.relay) continue
+
+      const sub = conn.relay.subscribe(filters as Filter[], {
+        onevent: (event: Event) => {
+          options.onEvent(event)
+          this.emitEvent('event', { relay: conn.config.url, event })
+        },
+        oneose: () => {
+          options.onEose?.()
+          if (options.closeOnEose) {
+            this.unsubscribe(id)
+          }
+        },
+      })
+      subs.push(sub)
+    }
 
     this.subscriptions.set(id, {
       id,
       filters: filters as unknown as Filter[],
       options,
-      close: () => sub.close(),
+      close: () => subs.forEach((s) => s.close()),
     })
 
     return id
diff --git a/lamassu-next/packages/nostr-client/src/encryption.ts b/lamassu-next/packages/nostr-client/src/encryption.ts
index 7371b8e..8d6a1d3 100644
--- a/lamassu-next/packages/nostr-client/src/encryption.ts
+++ b/lamassu-next/packages/nostr-client/src/encryption.ts
@@ -1,20 +1,237 @@
 /**
  * NIP-44 Encryption utilities
  *
- * Used for encrypting sensitive data in events (machine status,
- * transaction records, operator commands).
+ * Supports both:
+ * - v1: Lightning.Pub's custom format (xchacha20, used for kind 21000)
+ * - v2: Standard NIP-44 v2 (used for other kinds)
+ *
+ * NOTE: Lightning.Pub currently only supports NIP-44 v1 for kind 21000 RPC.
+ * A contribution to support v2 would be welcome:
+ * https://github.com/shocknet/Lightning.Pub
  */
 
 import { nip44 } from 'nostr-tools'
+import { bytesToHex, hexToBytes } from 'nostr-tools/utils'
+import { secp256k1 } from '@noble/curves/secp256k1.js'
+import { sha256 } from '@noble/hashes/sha2.js'
 import type { MachineIdentity } from './types.js'
 
+const V1_ENCRYPTION_VERSION = 1
+
+// Base64 utilities that work in both browser and Node
+function base64Encode(bytes: Uint8Array): string {
+  if (typeof btoa !== 'undefined') {
+    let binary = ''
+    for (let i = 0; i < bytes.length; i++) {
+      binary += String.fromCharCode(bytes[i]!)
+    }
+    return btoa(binary)
+  }
+  return Buffer.from(bytes).toString('base64')
+}
+
+function base64Decode(str: string): Uint8Array {
+  if (typeof atob !== 'undefined') {
+    const binary = atob(str)
+    const bytes = new Uint8Array(binary.length)
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i)
+    }
+    return bytes
+  }
+  return new Uint8Array(Buffer.from(str, 'base64'))
+}
+
+// Crypto random bytes
+function getRandomBytes(length: number): Uint8Array {
+  if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+    return crypto.getRandomValues(new Uint8Array(length))
+  }
+  // Node.js fallback
+  const { randomBytes } = require('crypto') as typeof import('crypto')
+  return new Uint8Array(randomBytes(length))
+}
+
+// XChaCha20 implementation
+function rotl(a: number, b: number): number {
+  return ((a << b) | (a >>> (32 - b))) >>> 0
+}
+
+function quarterRound(state: Uint32Array, a: number, b: number, c: number, d: number): void {
+  state[a] = (state[a]! + state[b]!) >>> 0
+  state[d] = rotl(state[d]! ^ state[a]!, 16)
+  state[c] = (state[c]! + state[d]!) >>> 0
+  state[b] = rotl(state[b]! ^ state[c]!, 12)
+  state[a] = (state[a]! + state[b]!) >>> 0
+  state[d] = rotl(state[d]! ^ state[a]!, 8)
+  state[c] = (state[c]! + state[d]!) >>> 0
+  state[b] = rotl(state[b]! ^ state[c]!, 7)
+}
+
+function chacha20Block(key: Uint8Array, nonce: Uint8Array, counter: number): Uint8Array {
+  const state = new Uint32Array(16)
+  const keyBuf = new ArrayBuffer(32)
+  new Uint8Array(keyBuf).set(key)
+  const nonceBuf = new ArrayBuffer(12)
+  new Uint8Array(nonceBuf).set(nonce)
+  const view = new DataView(keyBuf)
+  const nonceView = new DataView(nonceBuf)
+
+  // "expand 32-byte k"
+  state[0] = 0x61707865
+  state[1] = 0x3320646e
+  state[2] = 0x79622d32
+  state[3] = 0x6b206574
+
+  for (let i = 0; i < 8; i++) {
+    state[4 + i] = view.getUint32(i * 4, true)
+  }
+
+  state[12] = counter >>> 0
+  for (let i = 0; i < 3; i++) {
+    state[13 + i] = nonceView.getUint32(i * 4, true)
+  }
+
+  const working = new Uint32Array(state)
+
+  for (let i = 0; i < 10; i++) {
+    quarterRound(working, 0, 4, 8, 12)
+    quarterRound(working, 1, 5, 9, 13)
+    quarterRound(working, 2, 6, 10, 14)
+    quarterRound(working, 3, 7, 11, 15)
+    quarterRound(working, 0, 5, 10, 15)
+    quarterRound(working, 1, 6, 11, 12)
+    quarterRound(working, 2, 7, 8, 13)
+    quarterRound(working, 3, 4, 9, 14)
+  }
+
+  const output = new Uint8Array(64)
+  const outView = new DataView(output.buffer)
+  for (let i = 0; i < 16; i++) {
+    outView.setUint32(i * 4, (working[i]! + state[i]!) >>> 0, true)
+  }
+
+  return output
+}
+
+function hchacha20(key: Uint8Array, nonce: Uint8Array): Uint8Array {
+  const state = new Uint32Array(16)
+  const keyBuf = new ArrayBuffer(32)
+  new Uint8Array(keyBuf).set(key)
+  const nonceBuf = new ArrayBuffer(16)
+  new Uint8Array(nonceBuf).set(nonce)
+  const keyView = new DataView(keyBuf)
+  const nonceView = new DataView(nonceBuf)
+
+  state[0] = 0x61707865
+  state[1] = 0x3320646e
+  state[2] = 0x79622d32
+  state[3] = 0x6b206574
+
+  for (let i = 0; i < 8; i++) {
+    state[4 + i] = keyView.getUint32(i * 4, true)
+  }
+
+  for (let i = 0; i < 4; i++) {
+    state[12 + i] = nonceView.getUint32(i * 4, true)
+  }
+
+  for (let i = 0; i < 10; i++) {
+    quarterRound(state, 0, 4, 8, 12)
+    quarterRound(state, 1, 5, 9, 13)
+    quarterRound(state, 2, 6, 10, 14)
+    quarterRound(state, 3, 7, 11, 15)
+    quarterRound(state, 0, 5, 10, 15)
+    quarterRound(state, 1, 6, 11, 12)
+    quarterRound(state, 2, 7, 8, 13)
+    quarterRound(state, 3, 4, 9, 14)
+  }
+
+  const result = new Uint8Array(32)
+  const resultView = new DataView(result.buffer)
+  resultView.setUint32(0, state[0]!, true)
+  resultView.setUint32(4, state[1]!, true)
+  resultView.setUint32(8, state[2]!, true)
+  resultView.setUint32(12, state[3]!, true)
+  resultView.setUint32(16, state[12]!, true)
+  resultView.setUint32(20, state[13]!, true)
+  resultView.setUint32(24, state[14]!, true)
+  resultView.setUint32(28, state[15]!, true)
+
+  return result
+}
+
+function xchacha20Encrypt(key: Uint8Array, nonce: Uint8Array, data: Uint8Array): Uint8Array {
+  const subkey = hchacha20(key, nonce.subarray(0, 16))
+  const chacha20Nonce = new Uint8Array(12)
+  chacha20Nonce.set(nonce.subarray(16, 24), 4)
+
+  const result = new Uint8Array(data.length)
+  let counter = 0
+
+  for (let offset = 0; offset < data.length; offset += 64) {
+    const block = chacha20Block(subkey, chacha20Nonce, counter++)
+    const remaining = Math.min(64, data.length - offset)
+    for (let i = 0; i < remaining; i++) {
+      result[offset + i] = data[offset + i]! ^ block[i]!
+    }
+  }
+
+  return result
+}
+
 /**
- * Encrypt content for a recipient using NIP-44
+ * Get shared secret for v1 encryption (Lightning.Pub format)
  *
- * @param identity - Sender's identity (machine)
- * @param recipientPubkey - Recipient's public key (hex)
- * @param content - Content to encrypt (will be JSON stringified if object)
- * @returns Encrypted string
+ * NIP-44 v1 key derivation:
+ *   sha256(secp256k1.getSharedSecret(privKey, "02" + pubKey).slice(1, 33))
+ *
+ * This differs from v2 which uses HKDF instead of plain SHA-256.
+ */
+function getConversationKeyV1(privateKey: Uint8Array, publicKey: string): Uint8Array {
+  // Compute ECDH shared point with compressed pubkey (02 prefix for even y)
+  const compressedPubkey = hexToBytes('02' + publicKey)
+  const sharedPoint = secp256k1.getSharedSecret(privateKey, compressedPubkey)
+  // Take x-coordinate only (skip the 0x04 prefix byte) and hash with SHA-256
+  return sha256(sharedPoint.slice(1, 33))
+}
+
+/**
+ * Encrypt content using v1 format (Lightning.Pub's format for kind 21000)
+ */
+export function encryptV1(content: string, sharedSecret: Uint8Array): string {
+  const nonce = getRandomBytes(24)
+  const plaintext = new TextEncoder().encode(content)
+  const ciphertext = xchacha20Encrypt(sharedSecret, nonce, plaintext)
+
+  const payload = new Uint8Array(1 + nonce.length + ciphertext.length)
+  payload[0] = V1_ENCRYPTION_VERSION
+  payload.set(nonce, 1)
+  payload.set(ciphertext, 25)
+
+  return base64Encode(payload)
+}
+
+/**
+ * Decrypt content using v1 format (Lightning.Pub's format)
+ */
+export function decryptV1(content: string, sharedSecret: Uint8Array): string {
+  const buf = base64Decode(content)
+
+  if (buf[0] !== V1_ENCRYPTION_VERSION) {
+    throw new Error('Encryption version unsupported')
+  }
+
+  const nonce = buf.subarray(1, 25)
+  const ciphertext = buf.subarray(25)
+  const plaintext = xchacha20Encrypt(sharedSecret, nonce, ciphertext) // XChaCha20 is symmetric
+
+  return new TextDecoder().decode(plaintext)
+}
+
+/**
+ * Encrypt content for Lightning.Pub RPC (kind 21000)
+ * Uses v1 format that Lightning.Pub expects
  */
 export function encryptContent(
   identity: MachineIdentity,
@@ -22,37 +239,25 @@ export function encryptContent(
   content: unknown
 ): string {
   const plaintext = typeof content === 'string' ? content : JSON.stringify(content)
-
-  const conversationKey = nip44.v2.utils.getConversationKey(identity.privateKey, recipientPubkey)
-
-  return nip44.v2.encrypt(plaintext, conversationKey)
+  const sharedSecret = getConversationKeyV1(identity.privateKey, recipientPubkey)
+  return encryptV1(plaintext, sharedSecret)
 }
 
 /**
- * Decrypt content from a sender using NIP-44
- *
- * @param identity - Recipient's identity (machine)
- * @param senderPubkey - Sender's public key (hex)
- * @param ciphertext - Encrypted content
- * @returns Decrypted string
+ * Decrypt content from Lightning.Pub RPC (kind 21000)
+ * Uses v1 format
  */
 export function decryptContent(
   identity: MachineIdentity,
   senderPubkey: string,
   ciphertext: string
 ): string {
-  const conversationKey = nip44.v2.utils.getConversationKey(identity.privateKey, senderPubkey)
-
-  return nip44.v2.decrypt(ciphertext, conversationKey)
+  const sharedSecret = getConversationKeyV1(identity.privateKey, senderPubkey)
+  return decryptV1(ciphertext, sharedSecret)
 }
 
 /**
  * Decrypt and parse JSON content
- *
- * @param identity - Recipient's identity
- * @param senderPubkey - Sender's public key
- * @param ciphertext - Encrypted content
- * @returns Parsed JSON object
  */
 export function decryptJSON<T = unknown>(
   identity: MachineIdentity,
@@ -62,3 +267,23 @@ export function decryptJSON<T = unknown>(
   const plaintext = decryptContent(identity, senderPubkey, ciphertext)
   return JSON.parse(plaintext) as T
 }
+
+// Also export v2 functions for other use cases (non-RPC encrypted messages)
+export const encryptContentV2 = (
+  identity: MachineIdentity,
+  recipientPubkey: string,
+  content: unknown
+): string => {
+  const plaintext = typeof content === 'string' ? content : JSON.stringify(content)
+  const conversationKey = nip44.v2.utils.getConversationKey(identity.privateKey, recipientPubkey)
+  return nip44.v2.encrypt(plaintext, conversationKey)
+}
+
+export const decryptContentV2 = (
+  identity: MachineIdentity,
+  senderPubkey: string,
+  ciphertext: string
+): string => {
+  const conversationKey = nip44.v2.utils.getConversationKey(identity.privateKey, senderPubkey)
+  return nip44.v2.decrypt(ciphertext, conversationKey)
+}
diff --git a/lamassu-next/packages/nostr-client/test-pay.mjs b/lamassu-next/packages/nostr-client/test-pay.mjs
new file mode 100644
index 0000000..257cfc4
--- /dev/null
+++ b/lamassu-next/packages/nostr-client/test-pay.mjs
@@ -0,0 +1,114 @@
+import { NostrClient, loadIdentityFromHex, encryptContent, decryptJSON } from './dist/index.js'
+import { Relay } from 'nostr-tools/relay'
+import { finalizeEvent } from 'nostr-tools'
+import { randomUUID } from 'crypto'
+
+const DEV_PRIVATE_KEY = '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef'
+const LIGHTNING_PUB_PUBKEY = 'f454c5eec4ec4474128e19b57b45e49c3d0851d01eea960b39ce391cdba76fc6'
+const RELAY_URL = 'ws://192.168.1.122:7777'
+
+// Get a fresh invoice from Alice first:
+// docker exec lamassu-lnd-alice lncli --network=regtest addinvoice --amt 1000
+const TEST_INVOICE = process.argv[2]
+
+if (!TEST_INVOICE) {
+  console.log('Usage: node test-pay.mjs <invoice>')
+  console.log(
+    'Generate invoice: docker exec lamassu-lnd-alice lncli --network=regtest addinvoice --amt 1000'
+  )
+  process.exit(1)
+}
+
+async function main() {
+  const identity = loadIdentityFromHex(DEV_PRIVATE_KEY)
+  console.log('Using identity:', identity.publicKey)
+
+  console.log('Connecting to relay...')
+  const relay = await Relay.connect(RELAY_URL)
+  console.log('Connected!')
+
+  const requestId = randomUUID()
+
+  // Check if invoice has amount (look for pattern before '1' separator)
+  const amountMatch = TEST_INVOICE.toLowerCase().match(/ln(?:bc|tb|bcrt)(\d+)?([munp])?1/)
+  const hasAmount = amountMatch && amountMatch[1]
+  console.log('Invoice amount match:', amountMatch ? amountMatch.slice(0, 3) : null)
+  console.log('Has embedded amount:', hasAmount)
+
+  // Build body - amount is always required (use 0 for invoices with embedded amounts)
+  const body = {
+    invoice: TEST_INVOICE,
+    amount: hasAmount ? 0 : 2000, // 0 means "use invoice amount"
+  }
+  console.log('Body amount:', body.amount, hasAmount ? '(use invoice amount)' : '(explicit amount)')
+
+  const rpcRequest = {
+    rpcName: 'PayInvoice',
+    params: {},
+    query: {},
+    body,
+    authIdentifier: identity.publicKey,
+    requestId,
+  }
+
+  console.log('\nRequest structure:', JSON.stringify(rpcRequest, null, 2))
+
+  const encryptedContent = encryptContent(identity, LIGHTNING_PUB_PUBKEY, rpcRequest)
+
+  const event = finalizeEvent(
+    {
+      kind: 21000,
+      created_at: Math.floor(Date.now() / 1000),
+      tags: [['p', LIGHTNING_PUB_PUBKEY]],
+      content: encryptedContent,
+    },
+    identity.privateKey
+  )
+
+  console.log('\nPublishing PayInvoice request (event id:', event.id.substring(0, 16) + '...)...')
+
+  // Subscribe to responses
+  const filter = {
+    kinds: [21000],
+    authors: [LIGHTNING_PUB_PUBKEY],
+    since: Math.floor(Date.now() / 1000) - 5,
+  }
+
+  let responseReceived = false
+  const sub = relay.subscribe([filter], {
+    onevent(evt) {
+      // Check if for us
+      const pTags = evt.tags.filter((t) => t[0] === 'p')
+      if (!pTags.some((t) => t[1] === identity.publicKey)) return
+
+      console.log('\nGot response event:', evt.id.substring(0, 16) + '...')
+      try {
+        const response = decryptJSON(identity, LIGHTNING_PUB_PUBKEY, evt.content)
+        console.log('Response:', JSON.stringify(response, null, 2))
+        if (response.requestId === requestId) {
+          responseReceived = true
+        }
+      } catch (err) {
+        console.log('Failed to decrypt:', err.message)
+      }
+    },
+  })
+
+  await relay.publish(event)
+  console.log('Request published, waiting for response...')
+
+  // Wait for response
+  for (let i = 0; i < 20; i++) {
+    await new Promise((r) => setTimeout(r, 500))
+    if (responseReceived) break
+  }
+
+  if (!responseReceived) {
+    console.log('\nNo response received for our requestId within timeout')
+  }
+
+  sub.close()
+  relay.close()
+}
+
+main().catch(console.error)
diff --git a/lamassu-next/pnpm-lock.yaml b/lamassu-next/pnpm-lock.yaml
index 9f0ebde..86f7df9 100644
--- a/lamassu-next/pnpm-lock.yaml
+++ b/lamassu-next/pnpm-lock.yaml
@@ -162,12 +162,24 @@ importers:
 
   packages/nostr-client:
     dependencies:
+      '@noble/curves':
+        specifier: ^2.0.1
+        version: 2.0.1
+      '@noble/hashes':
+        specifier: ^2.0.1
+        version: 2.0.1
+      '@scure/base':
+        specifier: ^1.2.0
+        version: 1.2.6
+      '@stablelib/xchacha20':
+        specifier: ^2.0.1
+        version: 2.0.1
       nostr-tools:
         specifier: ^2.10.0
         version: 2.19.4(typescript@5.9.3)
     devDependencies:
       '@types/node':
-        specifier: ^22.0.0
+        specifier: ^22.19.7
         version: 22.19.7
       tsx:
         specifier: ^4.19.0
@@ -900,6 +912,21 @@ packages:
   '@scure/bip39@1.2.1':
     resolution: {integrity: sha512-Z3/Fsz1yr904dduJD0NpiyRHhRYHdcnyh73FZWiV+/qhWi83wNJ3NWolYqCEN+ZWsUz2TWwajJggcRE9r1zUYg==}
 
+  '@stablelib/binary@2.0.1':
+    resolution: {integrity: sha512-U9iAO8lXgEDONsA0zPPSgcf3HUBNAqHiJmSHgZz62OvC3Hi2Bhc5kTnQ3S1/L+sthDTHtCMhcEiklmIly6uQ3w==}
+
+  '@stablelib/chacha@2.0.1':
+    resolution: {integrity: sha512-lS1FqtNqofxe2vLkRsLli2m3x/XanUyAYRphLhdHumKeIsLbjbCXdCq3Pf/eWiO7G3QlSG5ViqnoVjktzfLWMg==}
+
+  '@stablelib/int@2.0.1':
+    resolution: {integrity: sha512-Ht63fQp3wz/F8U4AlXEPb7hfJOIILs8Lq55jgtD7KueWtyjhVuzcsGLSTAWtZs3XJDZYdF1WcSKn+kBtbzupww==}
+
+  '@stablelib/wipe@2.0.1':
+    resolution: {integrity: sha512-1eU2K9EgOcV4qc9jcP6G72xxZxEm5PfeI5H55l08W95b4oRJaqhmlWRc4xZAm6IVSKhVNxMi66V67hCzzuMTAg==}
+
+  '@stablelib/xchacha20@2.0.1':
+    resolution: {integrity: sha512-k55pNv7gIM4mUPU00+nJYTxKiUVNwAtsgrridC0aIU5cVbw9u6qP99x8ENu5eiwOEhZUNg+p3tTOLooCeAOJQA==}
+
   '@swc/helpers@0.5.18':
     resolution: {integrity: sha512-TXTnIcNJQEKwThMMqBXsZ4VGAza6bvN4pa41Rkqoio6QBKMvo+5lexeTMScGCIxtzgQJzElcvIltani+adC5PQ==}
 
@@ -2124,7 +2151,7 @@ snapshots:
   '@scure/bip32@1.3.1':
     dependencies:
       '@noble/curves': 1.1.0
-      '@noble/hashes': 1.3.1
+      '@noble/hashes': 1.3.2
       '@scure/base': 1.1.1
 
   '@scure/bip32@1.7.0':
@@ -2135,9 +2162,28 @@ snapshots:
 
   '@scure/bip39@1.2.1':
     dependencies:
-      '@noble/hashes': 1.3.1
+      '@noble/hashes': 1.3.2
       '@scure/base': 1.1.1
 
+  '@stablelib/binary@2.0.1':
+    dependencies:
+      '@stablelib/int': 2.0.1
+
+  '@stablelib/chacha@2.0.1':
+    dependencies:
+      '@stablelib/binary': 2.0.1
+      '@stablelib/wipe': 2.0.1
+
+  '@stablelib/int@2.0.1': {}
+
+  '@stablelib/wipe@2.0.1': {}
+
+  '@stablelib/xchacha20@2.0.1':
+    dependencies:
+      '@stablelib/binary': 2.0.1
+      '@stablelib/chacha': 2.0.1
+      '@stablelib/wipe': 2.0.1
+
   '@swc/helpers@0.5.18':
     dependencies:
       tslib: 2.8.1