@forgesworn/moneyer 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.16.0 - 2026-09-16
+
+- Bump `@lnurlcash/kit` from 0.14.2 to 0.18.1: the previous pin predated the
+  entire Schnorr `ck1` migration, so any note produced by a current wallet
+  was already unverifiable here. Brings the `ck1`/address-proof sha256
+  digest fix (signing `sha256(message)` instead of the raw string, matching
+  most conforming Schnorr signers) and a legacy-read fallback for notes
+  minted under the intermediate raw-message scheme.
+- `spentRef` follows `recoverNoteOwnershipPubkey`'s new signature: it now
+  takes the `ck1` string directly and returns `{pubkeyXOnly, legacy}` rather
+  than raw recovered bytes.
+- `claimMintedNote` now classifies a melt-in-flight note by catching the
+  kit's own `PendingNoteError`, replacing a `ServiceError{reason:'pending'}`
+  check the kit stopped throwing. The bump had silently broken this: an
+  unhandled `PendingNoteError` would have surfaced to a bound-mint quote's
+  poller as an unreachable-mint error rather than "pending" - untested
+  before this bump, now covered.
+
 ## 0.15.0 - 2026-09-15
 
 - Use `@lnurlcash/kit` 0.14 as the protocol implementation. Removed kit

package/README.md

@@ -717,7 +717,7 @@ decoding and preimage verification on the melt path). The companion wallet
 is [`@forgesworn/notecase`](https://github.com/forgesworn/notecase).
 
 Other mints, wallets and libraries speaking the same protocol are indexed
-in [awesome-lnurlcash](https://github.com/TheCryptoDonkey/awesome-lnurlcash).
+in [awesome-lnurlcash](https://github.com/lnurlcash/awesome-lnurlcash).
 
 ## Licence
 

package/dist/claim.js

@@ -1,4 +1,4 @@
-import { NoteSpentError, NoteUnknownError, ServiceError, buildNoteUrl, fetchNoteInfo, isPreimage } from '@lnurlcash/kit';
+import { NoteSpentError, NoteUnknownError, PendingNoteError, buildNoteUrl, fetchNoteInfo, isPreimage } from '@lnurlcash/kit';
 /**
  * Inspect the note a wallet named before requesting its invoice.
  *
@@ -21,9 +21,8 @@ export const claimMintedNote = async (withdrawLink, k1) => {
         };
     }
     catch (error) {
-        if (error instanceof ServiceError && error.reason.trim().toLowerCase() === 'pending') {
+        if (error instanceof PendingNoteError)
             return { ...blank, state: 'pending' };
-        }
         if (error instanceof NoteSpentError)
             return { ...blank, state: 'spent' };
         if (error instanceof NoteUnknownError)

package/dist/landing.js

@@ -101,7 +101,7 @@ ${config.tosUrl ? `<div class="kv"><span>terms</span><a href="${escapeHtml(confi
 <h2>${escapeHtml(MINT_KNOWS_HEADING)}</h2>
 ${MINT_KNOWS.map(paragraph => `<p>${escapeHtml(paragraph)}</p>`).join('\n')}
 </section>
-<p class="small">Works with any LUD-25 wallet - <a href="https://github.com/forgesworn/notecase">notecase</a> among them. Verify a note offline against the signing key above.<br/>Independent implementation of the <a href="https://github.com/lnurl/luds/pull/301">LNURLcash draft</a> - graded by <a href="https://github.com/TheCryptoDonkey/lnurlcash-conformance">lnurlcash-conformance</a>.</p>
+<p class="small">Works with any LUD-25 wallet - <a href="https://github.com/forgesworn/notecase">notecase</a> among them. Verify a note offline against the signing key above.<br/>Independent implementation of the <a href="https://github.com/lnurl/luds/pull/301">LNURLcash draft</a> - graded by <a href="https://github.com/lnurlcash/lnurlcash-conformance">lnurlcash-conformance</a>.</p>
 </main>
 </body>
 </html>`;

package/dist/server.js

@@ -1,7 +1,7 @@
 import { createServer } from 'node:http';
 import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils.js';
 import { finalizeEvent } from 'nostr-tools/pure';
-import { applyMintFee, decodeCk1, decodeCp1, encodeCs1WithAmount, grossUpForMintFee, hashK1, recoverNoteOwnershipPubkey } from '@lnurlcash/kit';
+import { applyMintFee, decodeCp1, encodeCs1WithAmount, grossUpForMintFee, hashK1, recoverNoteOwnershipPubkey } from '@lnurlcash/kit';
 import { tryDecodeBolt11 } from 'farrier-kit/bolt11';
 import { NotePendingError, NoteStore, NoteUnavailableError, OutputCollisionError, swapFingerprint } from "./store.js";
 import { createNoteSigner } from "./signing.js";
@@ -32,9 +32,8 @@ const namedRef = (value) => {
 const spentRef = (k1) => {
     if (HEX32.test(k1))
         return { id: hashK1(k1), cp1: false };
-    const signature = decodeCk1(k1);
-    const pubkey = signature ? recoverNoteOwnershipPubkey(signature) : null;
-    return pubkey ? { id: bytesToHex(pubkey), cp1: true } : null;
+    const owner = recoverNoteOwnershipPubkey(k1);
+    return owner ? { id: bytesToHex(owner.pubkeyXOnly), cp1: true } : null;
 };
 // LUD-25 renamed `h` to `p` on the lookup and `h`/`h2` to `p1`/`p2` on the
 // callback. The old names stay accepted; sending both spellings must agree.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/moneyer",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "An LNURLcash (LUD-25) mint - strikes Lightning bearer notes. Independent implementation, cln/lnd funding sources, SQLite, zero HTTP framework.",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -56,7 +56,7 @@
     "live:bound-mint": "npm run build && node scripts/live-bound-mint-check.mjs"
   },
   "dependencies": {
-    "@lnurlcash/kit": "0.14.2",
+    "@lnurlcash/kit": "0.18.1",
     "@noble/curves": "^2.3.0",
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^1.2.4",
@@ -70,7 +70,7 @@
     "@types/node": "^24.0.0",
     "animejs": "^4.0.0",
     "happy-dom": "^20.0.0",
-    "lnurlcash-conformance": "0.11.0",
+    "lnurlcash-conformance": "0.11.1",
     "playwright": "^1.62.1",
     "typescript": "^5.7.0",
     "uqr": "^0.1.2",