Enable Cashu access tokens automatically when ACL is active (v0.44.2)

- Add automatic Cashu issuer/verifier initialization when ACL mode is not 'none'
- Use memory store for keyset management with proper TTL configuration
- Import cashuiface package for AllowAllChecker implementation
- ACL handles authorization; CAT provides token-based authentication

Files modified:
- app/main.go: Add Cashu system initialization when ACL active
- pkg/version/version: Bump to v0.44.2

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/main.go

@@ -23,6 +23,10 @@ import (
 	"next.orly.dev/pkg/protocol/nip43"
 	"next.orly.dev/pkg/protocol/publish"
 	"next.orly.dev/pkg/bunker"
+	"next.orly.dev/pkg/cashu/issuer"
+	"next.orly.dev/pkg/cashu/keyset"
+	"next.orly.dev/pkg/cashu/verifier"
+	cashuiface "next.orly.dev/pkg/interfaces/cashu"
 	"next.orly.dev/pkg/ratelimit"
 	"next.orly.dev/pkg/spider"
 	dsync "next.orly.dev/pkg/sync"
@@ -162,6 +166,27 @@ func Run(
 		}
 	}
 
+	// Initialize Cashu access token system when ACL is active
+	if cfg.ACLMode != "none" {
+		// Create keyset manager with memory store (keys are regenerated each restart)
+		keysetStore := keyset.NewMemoryStore()
+		keysetManager := keyset.NewManager(keysetStore, keyset.DefaultActiveWindow, keyset.DefaultVerifyWindow)
+
+		// Initialize keyset manager (creates initial keyset)
+		if err := keysetManager.Init(); err != nil {
+			log.E.F("failed to initialize Cashu keyset manager: %v", err)
+		} else {
+			// Create issuer with permissive checker (ACL handles authorization)
+			issuerCfg := issuer.DefaultConfig()
+			l.CashuIssuer = issuer.New(keysetManager, cashuiface.AllowAllChecker{}, issuerCfg)
+
+			// Create verifier for validating tokens
+			l.CashuVerifier = verifier.New(keysetManager, cashuiface.AllowAllChecker{}, verifier.DefaultConfig())
+
+			log.I.F("Cashu access token system enabled (ACL mode: %s)", cfg.ACLMode)
+		}
+	}
+
 	// Initialize spider manager based on mode (only for Badger backend)
 	if badgerDB, ok := db.(*database.D); ok && cfg.SpiderMode != "none" {
 		if l.spiderManager, err = spider.New(ctx, badgerDB, l.publishers, cfg.SpiderMode); chk.E(err) {

pkg/database/compact_event.go

@@ -355,7 +355,7 @@ func decodeTagElement(r io.Reader, resolver SerialResolver) (elem []byte, err er
 		return elem, nil
 
 	case TagElementPubkeySerial:
-		// Pubkey serial: 5 bytes -> lookup full pubkey -> return as 32-byte binary
+		// Pubkey serial: 5 bytes -> lookup full pubkey -> return as 33-byte binary
 		serial, err := readUint40(r)
 		if err != nil {
 			return nil, err
@@ -364,11 +364,14 @@ func decodeTagElement(r io.Reader, resolver SerialResolver) (elem []byte, err er
 		if err != nil {
 			return nil, err
 		}
-		// Return as 32-byte binary (nostr library optimized format)
-		return pubkey, nil
+		// Return as 33-byte binary (32 bytes + null terminator) for tag.Marshal detection
+		result := make([]byte, 33)
+		copy(result, pubkey)
+		result[32] = 0 // null terminator
+		return result, nil
 
 	case TagElementEventSerial:
-		// Event serial: 5 bytes -> lookup full event ID -> return as 32-byte binary
+		// Event serial: 5 bytes -> lookup full event ID -> return as 33-byte binary
 		serial, err := readUint40(r)
 		if err != nil {
 			return nil, err
@@ -377,15 +380,20 @@ func decodeTagElement(r io.Reader, resolver SerialResolver) (elem []byte, err er
 		if err != nil {
 			return nil, err
 		}
-		// Return as 32-byte binary
-		return eventId, nil
+		// Return as 33-byte binary (32 bytes + null terminator) for tag.Marshal detection
+		result := make([]byte, 33)
+		copy(result, eventId)
+		result[32] = 0 // null terminator
+		return result, nil
 
 	case TagElementEventIdFull:
 		// Full event ID: 32 bytes (for unknown/forward references)
-		elem = make([]byte, 32)
-		if _, err = io.ReadFull(r, elem); err != nil {
+		// Return as 33-byte binary (32 bytes + null terminator) for tag.Marshal detection
+		elem = make([]byte, 33)
+		if _, err = io.ReadFull(r, elem[:32]); err != nil {
 			return nil, err
 		}
+		elem[32] = 0 // null terminator
 		return elem, nil
 
 	default:

pkg/version/version

@@ -1 +1 @@
-v0.44.0
+v0.44.2