Phase 5: Lightning auto-payout with LNURL-pay and NUT-05 melt

- New lnurl_pay.c/h: LNURL-pay protocol (GET .well-known/lnurlp + callback)
- New lightning_payout.c/h: threshold-based auto-payout with multi-recipient split
- Extended nucula_wallet bridge with nucula_wallet_melt() (NUT-05)
- Config: payout section with multi-mint, multi-recipient, fee_tolerance
- Default: enabled, TollGate@coinos.io, min_payout=128, min_balance=64
- 18 new unit tests (all passing), 134 total

8 files changed, 384 insertions, 0 deletions

diff --git a/main/CMakeLists.txt b/main/CMakeLists.txt
index be4d564..c2aaeb2 100644
--- a/main/CMakeLists.txt
+++ b/main/CMakeLists.txt
@@ -11,6 +11,8 @@ idf_component_register(SRCS "tollgate_main.c"
                             "geohash.c"
                             "wifistr.c"
                             "tollgate_client.c"
+                            "lnurl_pay.c"
+                            "lightning_payout.c"
                     INCLUDE_DIRS "."
                     REQUIRES esp_wifi esp_event esp_netif nvs_flash esp_http_server
                              lwip json esp_http_client mbedtls esp-tls log spiffs
diff --git a/main/config.c b/main/config.c
index c074410..9257397 100644
--- a/main/config.c
+++ b/main/config.c
@@ -26,6 +26,11 @@ esp_err_t tollgate_config_init(void)
     g_config.client_steps_to_buy = 1;
     g_config.client_renewal_threshold_pct = 20;
     g_config.client_retry_interval_ms = 30000;
+    g_config.payout.enabled = true;
+    g_config.payout.fee_tolerance_pct = 10;
+    g_config.payout.check_interval_s = 60;
+    g_config.payout.recipient_count = 0;
+    g_config.payout.mint_count = 0;
 
     esp_vfs_spiffs_conf_t conf = {
         .base_path = "/spiffs",
@@ -166,6 +171,75 @@ esp_err_t tollgate_config_init(void)
     cJSON *client_retry = cJSON_GetObjectItem(root, "client_retry_interval_ms");
     if (client_retry) g_config.client_retry_interval_ms = client_retry->valueint;
 
+    cJSON *payout = cJSON_GetObjectItem(root, "payout");
+    if (payout && cJSON_IsObject(payout)) {
+        cJSON *p_en = cJSON_GetObjectItem(payout, "enabled");
+        if (p_en && cJSON_IsBool(p_en)) g_config.payout.enabled = cJSON_IsTrue(p_en);
+
+        cJSON *p_fee = cJSON_GetObjectItem(payout, "fee_tolerance_pct");
+        if (p_fee) g_config.payout.fee_tolerance_pct = (uint64_t)p_fee->valuedouble;
+
+        cJSON *p_interval = cJSON_GetObjectItem(payout, "check_interval_s");
+        if (p_interval) g_config.payout.check_interval_s = p_interval->valueint;
+
+        cJSON *recipients = cJSON_GetObjectItem(payout, "recipients");
+        if (recipients && cJSON_IsArray(recipients)) {
+            int rcount = cJSON_GetArraySize(recipients);
+            if (rcount > PAYOUT_MAX_RECIPIENTS) rcount = PAYOUT_MAX_RECIPIENTS;
+            for (int i = 0; i < rcount; i++) {
+                cJSON *r = cJSON_GetArrayItem(recipients, i);
+                cJSON *addr = cJSON_GetObjectItem(r, "lightning_address");
+                cJSON *factor = cJSON_GetObjectItem(r, "factor");
+                if (addr && cJSON_IsString(addr)) {
+                    strncpy(g_config.payout.recipients[i].lightning_address, addr->valuestring,
+                            sizeof(g_config.payout.recipients[i].lightning_address) - 1);
+                }
+                if (factor && cJSON_IsNumber(factor)) {
+                    g_config.payout.recipients[i].factor = factor->valuedouble;
+                }
+            }
+            g_config.payout.recipient_count = rcount;
+        }
+
+        cJSON *mints = cJSON_GetObjectItem(payout, "mints");
+        if (mints && cJSON_IsArray(mints)) {
+            int mcount = cJSON_GetArraySize(mints);
+            if (mcount > PAYOUT_MAX_MINTS) mcount = PAYOUT_MAX_MINTS;
+            for (int i = 0; i < mcount; i++) {
+                cJSON *m = cJSON_GetArrayItem(mints, i);
+                cJSON *murl = cJSON_GetObjectItem(m, "url");
+                cJSON *mbal = cJSON_GetObjectItem(m, "min_balance");
+                cJSON *mpay = cJSON_GetObjectItem(m, "min_payout_amount");
+                if (murl && cJSON_IsString(murl)) {
+                    strncpy(g_config.payout.mints[i].url, murl->valuestring,
+                            sizeof(g_config.payout.mints[i].url) - 1);
+                }
+                if (mbal && cJSON_IsNumber(mbal)) {
+                    g_config.payout.mints[i].min_balance = (uint64_t)mbal->valuedouble;
+                }
+                if (mpay && cJSON_IsNumber(mpay)) {
+                    g_config.payout.mints[i].min_payout_amount = (uint64_t)mpay->valuedouble;
+                }
+            }
+            g_config.payout.mint_count = mcount;
+        }
+    }
+
+    if (g_config.payout.mint_count == 0 && g_config.mint_url[0] != '\0') {
+        strncpy(g_config.payout.mints[0].url, g_config.mint_url,
+                sizeof(g_config.payout.mints[0].url) - 1);
+        g_config.payout.mints[0].min_balance = 64;
+        g_config.payout.mints[0].min_payout_amount = 128;
+        g_config.payout.mint_count = 1;
+    }
+
+    if (g_config.payout.recipient_count == 0) {
+        strncpy(g_config.payout.recipients[0].lightning_address, "TollGate@coinos.io",
+                sizeof(g_config.payout.recipients[0].lightning_address) - 1);
+        g_config.payout.recipients[0].factor = 1.0;
+        g_config.payout.recipient_count = 1;
+    }
+
     cJSON_Delete(root);
 
     if (g_config.nostr_relay_count == 0) {
diff --git a/main/config.h b/main/config.h
index 4c6116e..de9f856 100644
--- a/main/config.h
+++ b/main/config.h
@@ -6,6 +6,8 @@
 #include "esp_netif.h"
 #include <stdbool.h>
 
+#include "lightning_payout.h"
+
 #define TOLLGATE_MAX_WIFI_NETWORKS 5
 #define TOLLGATE_MAX_MINT_URLS     3
 #define TOLLGATE_MAX_AP_SSID_LEN   32
@@ -54,6 +56,8 @@ typedef struct {
     int client_steps_to_buy;
     int client_renewal_threshold_pct;
     int client_retry_interval_ms;
+
+    payout_config_t payout;
 } tollgate_config_t;
 
 void tollgate_config_derive_unique(tollgate_config_t *cfg);
diff --git a/main/lightning_payout.c b/main/lightning_payout.c
new file mode 100644
index 0000000..42593a9
--- /dev/null
+++ b/main/lightning_payout.c
@@ -0,0 +1,93 @@
+#include "lightning_payout.h"
+#include "lnurl_pay.h"
+#include "nucula_wallet.h"
+#include "esp_log.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include <string.h>
+#include <math.h>
+
+static const char *TAG = "ln_payout";
+
+static payout_config_t s_config;
+static int64_t s_last_check_ms = 0;
+
+static int64_t get_time_ms(void) {
+    return (int64_t)(xTaskGetTickCount() * portTICK_PERIOD_MS);
+}
+
+esp_err_t lightning_payout_init(const payout_config_t *config)
+{
+    if (!config) return ESP_FAIL;
+    memcpy(&s_config, config, sizeof(s_config));
+    s_last_check_ms = get_time_ms();
+    ESP_LOGI(TAG, "Payout initialized: %d mints, %d recipients, interval=%ds",
+             s_config.mint_count, s_config.recipient_count, s_config.check_interval_s);
+    return ESP_OK;
+}
+
+static esp_err_t payout_one(const char *lightning_address, uint64_t amount_sats, uint64_t fee_tolerance_pct)
+{
+    if (amount_sats == 0) return ESP_OK;
+
+    char bolt11[LNURL_MAX_BOLT11_LEN];
+    esp_err_t err = lnurl_get_invoice(lightning_address, amount_sats, bolt11, sizeof(bolt11));
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Failed to get invoice for %s (%llu sats)", lightning_address, (unsigned long long)amount_sats);
+        return err;
+    }
+
+    uint64_t max_cost = amount_sats + (amount_sats * fee_tolerance_pct / 100);
+    err = nucula_wallet_melt(bolt11, max_cost);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Melt failed for %s", lightning_address);
+        return err;
+    }
+
+    ESP_LOGI(TAG, "Payout: %llu sats -> %s", (unsigned long long)amount_sats, lightning_address);
+    return ESP_OK;
+}
+
+void lightning_payout_tick(void)
+{
+    if (!s_config.enabled) return;
+    if (s_config.recipient_count == 0) return;
+
+    int64_t now = get_time_ms();
+    int64_t elapsed = now - s_last_check_ms;
+    int64_t interval_ms = (int64_t)s_config.check_interval_s * 1000;
+    if (elapsed < interval_ms) return;
+
+    s_last_check_ms = now;
+
+    uint64_t balance = nucula_wallet_balance();
+
+    for (int m = 0; m < s_config.mint_count; m++) {
+        const payout_mint_config_t *mc = &s_config.mints[m];
+
+        if (balance < mc->min_payout_amount) {
+            ESP_LOGI(TAG, "Balance %llu < min_payout %llu for %s, skipping",
+                     (unsigned long long)balance, (unsigned long long)mc->min_payout_amount, mc->url);
+            continue;
+        }
+
+        uint64_t payout_pool = balance - mc->min_balance;
+        if (payout_pool == 0) continue;
+
+        ESP_LOGI(TAG, "Payout pool: %llu sats (balance=%llu - reserve=%llu)",
+                 (unsigned long long)payout_pool, (unsigned long long)balance,
+                 (unsigned long long)mc->min_balance);
+
+        for (int r = 0; r < s_config.recipient_count; r++) {
+            const payout_recipient_t *recip = &s_config.recipients[r];
+            if (recip->factor <= 0.0 || recip->lightning_address[0] == '\0') continue;
+
+            uint64_t share = (uint64_t)round((double)payout_pool * recip->factor);
+            if (share == 0) continue;
+
+            payout_one(recip->lightning_address, share, s_config.fee_tolerance_pct);
+        }
+
+        balance = nucula_wallet_balance();
+    }
+}
diff --git a/main/lightning_payout.h b/main/lightning_payout.h
new file mode 100644
index 0000000..d353902
--- /dev/null
+++ b/main/lightning_payout.h
@@ -0,0 +1,37 @@
+#ifndef LIGHTNING_PAYOUT_H
+#define LIGHTNING_PAYOUT_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#define PAYOUT_MAX_RECIPIENTS     4
+#define PAYOUT_MAX_MINTS          3
+#define PAYOUT_MAX_ADDR_LEN       128
+
+typedef struct {
+    char lightning_address[PAYOUT_MAX_ADDR_LEN];
+    double factor;
+} payout_recipient_t;
+
+typedef struct {
+    char url[256];
+    uint64_t min_balance;
+    uint64_t min_payout_amount;
+} payout_mint_config_t;
+
+typedef struct {
+    bool enabled;
+    payout_mint_config_t mints[PAYOUT_MAX_MINTS];
+    int mint_count;
+    payout_recipient_t recipients[PAYOUT_MAX_RECIPIENTS];
+    int recipient_count;
+    uint64_t fee_tolerance_pct;
+    int check_interval_s;
+} payout_config_t;
+
+esp_err_t lightning_payout_init(const payout_config_t *config);
+
+void lightning_payout_tick(void);
+
+#endif
diff --git a/main/lnurl_pay.c b/main/lnurl_pay.c
new file mode 100644
index 0000000..bf3a932
--- /dev/null
+++ b/main/lnurl_pay.c
@@ -0,0 +1,156 @@
+#include "lnurl_pay.h"
+#include "esp_log.h"
+#include "esp_http_client.h"
+#include "esp_crt_bundle.h"
+#include "cJSON.h"
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static const char *TAG = "lnurl_pay";
+
+static esp_err_t http_get_json(const char *url, char *resp_buf, size_t resp_buf_size, int *status_out)
+{
+    esp_http_client_config_t config = {
+        .url = url,
+        .method = HTTP_METHOD_GET,
+        .timeout_ms = 15000,
+        .crt_bundle_attach = esp_crt_bundle_attach,
+    };
+    esp_http_client_handle_t client = esp_http_client_init(&config);
+    if (!client) return ESP_FAIL;
+
+    esp_err_t err = esp_http_client_open(client, 0);
+    if (err != ESP_OK) {
+        esp_http_client_cleanup(client);
+        return ESP_FAIL;
+    }
+
+    int content_length = esp_http_client_fetch_headers(client);
+    (void)content_length;
+    int status = esp_http_client_get_status_code(client);
+    if (status_out) *status_out = status;
+
+    int resp_len = esp_http_client_read(client, resp_buf, resp_buf_size - 1);
+    esp_http_client_cleanup(client);
+
+    if (resp_len < 0) return ESP_FAIL;
+    resp_buf[resp_len] = '\0';
+    return ESP_OK;
+}
+
+esp_err_t lnurl_get_invoice(const char *lightning_address, uint64_t amount_sats,
+                            char *bolt11_out, size_t bolt11_out_size)
+{
+    if (!lightning_address || !bolt11_out) return ESP_FAIL;
+
+    const char *at = strchr(lightning_address, '@');
+    if (!at) {
+        ESP_LOGE(TAG, "Invalid lightning address: missing '@'");
+        return ESP_FAIL;
+    }
+
+    size_t user_len = at - lightning_address;
+    char username[64];
+    if (user_len >= sizeof(username)) return ESP_FAIL;
+    memcpy(username, lightning_address, user_len);
+    username[user_len] = '\0';
+
+    const char *domain = at + 1;
+
+    char url[512];
+    snprintf(url, sizeof(url), "https://%s/.well-known/lnurlp/%s", domain, username);
+
+    ESP_LOGI(TAG, "LNURL-pay step 1: GET %s", url);
+
+    char *resp_buf = malloc(4096);
+    if (!resp_buf) return ESP_ERR_NO_MEM;
+
+    int status = 0;
+    esp_err_t err = http_get_json(url, resp_buf, 4096, &status);
+    if (err != ESP_OK || status != 200) {
+        ESP_LOGE(TAG, "LNURL-pay step 1 failed: status=%d err=%s", status, esp_err_to_name(err));
+        free(resp_buf);
+        return ESP_FAIL;
+    }
+
+    cJSON *root = cJSON_Parse(resp_buf);
+    if (!root) {
+        ESP_LOGE(TAG, "LNURL-pay step 1: invalid JSON");
+        free(resp_buf);
+        return ESP_FAIL;
+    }
+
+    cJSON *callback = cJSON_GetObjectItemCaseSensitive(root, "callback");
+    if (!callback || !cJSON_IsString(callback)) {
+        ESP_LOGE(TAG, "LNURL-pay step 1: missing callback");
+        cJSON_Delete(root);
+        free(resp_buf);
+        return ESP_FAIL;
+    }
+
+    char callback_url[512];
+    strncpy(callback_url, callback->valuestring, sizeof(callback_url) - 1);
+
+    cJSON *min_sendable = cJSON_GetObjectItemCaseSensitive(root, "minSendable");
+    cJSON *max_sendable = cJSON_GetObjectItemCaseSensitive(root, "maxSendable");
+
+    uint64_t amount_msat = amount_sats * 1000;
+    if (min_sendable && cJSON_IsNumber(min_sendable) && amount_msat < (uint64_t)min_sendable->valuedouble) {
+        ESP_LOGE(TAG, "Amount %llumsat below min %g", (unsigned long long)amount_msat, min_sendable->valuedouble);
+        cJSON_Delete(root);
+        free(resp_buf);
+        return ESP_FAIL;
+    }
+    if (max_sendable && cJSON_IsNumber(max_sendable) && amount_msat > (uint64_t)max_sendable->valuedouble) {
+        ESP_LOGE(TAG, "Amount %llumsat above max %g", (unsigned long long)amount_msat, max_sendable->valuedouble);
+        cJSON_Delete(root);
+        free(resp_buf);
+        return ESP_FAIL;
+    }
+
+    cJSON_Delete(root);
+
+    char callback_with_amount[768];
+    snprintf(callback_with_amount, sizeof(callback_with_amount), "%s%samount=%llu",
+             callback_url, strchr(callback_url, '?') ? "&" : "?",
+             (unsigned long long)amount_msat);
+
+    free(resp_buf);
+
+    ESP_LOGI(TAG, "LNURL-pay step 2: GET %s", callback_with_amount);
+
+    resp_buf = malloc(4096);
+    if (!resp_buf) return ESP_ERR_NO_MEM;
+
+    err = http_get_json(callback_with_amount, resp_buf, 4096, &status);
+    if (err != ESP_OK || status != 200) {
+        ESP_LOGE(TAG, "LNURL-pay step 2 failed: status=%d", status);
+        free(resp_buf);
+        return ESP_FAIL;
+    }
+
+    root = cJSON_Parse(resp_buf);
+    free(resp_buf);
+    if (!root) return ESP_FAIL;
+
+    cJSON *pr = cJSON_GetObjectItemCaseSensitive(root, "pr");
+    if (!pr || !cJSON_IsString(pr)) {
+        ESP_LOGE(TAG, "LNURL-pay step 2: missing 'pr' (bolt11)");
+        cJSON_Delete(root);
+        return ESP_FAIL;
+    }
+
+    size_t pr_len = strlen(pr->valuestring);
+    if (pr_len >= bolt11_out_size) {
+        ESP_LOGE(TAG, "BOLT11 too long: %zu >= %zu", pr_len, bolt11_out_size);
+        cJSON_Delete(root);
+        return ESP_FAIL;
+    }
+
+    memcpy(bolt11_out, pr->valuestring, pr_len + 1);
+    cJSON_Delete(root);
+
+    ESP_LOGI(TAG, "Got BOLT11 invoice (%zu bytes) for %llu sats", pr_len, (unsigned long long)amount_sats);
+    return ESP_OK;
+}
diff --git a/main/lnurl_pay.h b/main/lnurl_pay.h
new file mode 100644
index 0000000..8969e38
--- /dev/null
+++ b/main/lnurl_pay.h
@@ -0,0 +1,14 @@
+#ifndef LNURL_PAY_H
+#define LNURL_PAY_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stddef.h>
+
+#define LNURL_MAX_BOLT11_LEN 2048
+#define LNURL_MAX_ADDR_LEN   128
+
+esp_err_t lnurl_get_invoice(const char *lightning_address, uint64_t amount_sats,
+                            char *bolt11_out, size_t bolt11_out_size);
+
+#endif
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index d4dcf0d..3f83923 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -20,6 +20,7 @@
 #include "nucula_wallet.h"
 #include "wifistr.h"
 #include "tollgate_client.h"
+#include "lightning_payout.h"
 
 #define MAX_STA_RETRY 5
 static const char *TAG = "tollgate_main";
@@ -89,6 +90,8 @@ static void ip_event_handler(void *arg, esp_event_base_t event_base,
         const tollgate_config_t *cfg = tollgate_config_get();
         nucula_wallet_init(cfg->mint_url);
 
+        lightning_payout_init(&cfg->payout);
+
         char gw_ip_str[16];
         snprintf(gw_ip_str, sizeof(gw_ip_str), IPSTR, IP2STR(&event->ip_info.gw));
         tollgate_client_on_sta_connected(gw_ip_str);
@@ -282,5 +285,6 @@ void app_main(void)
         vTaskDelay(pdMS_TO_TICKS(1000));
         session_tick();
         tollgate_client_tick();
+        lightning_payout_tick();
     }
 }