@lnurlcash/kit 0.14.0 → 0.14.2

package/README.md

@@ -82,8 +82,9 @@ npm pack --dry-run
 The package and wallet share a version. A wallet tag named `vX.Y.Z` publishes
 `@lnurlcash/kit@X.Y.Z` from the same commit through
 `.github/workflows/release-kit.yml` and npm trusted publishing; releases must
-not be published from a maintainer workstation. The one-time scoped-package
-bootstrap is documented in [RELEASING.md](./RELEASING.md).
+not be published from a maintainer workstation. The release process and
+trusted-publisher configuration are documented in
+[RELEASING.md](./RELEASING.md).
 
 ## Licence
 

package/RELEASING.md

@@ -3,27 +3,13 @@
 The final package is published from `lnurlcash/lnurl-wallet`, not from a
 workstation and not from the old standalone kit repository.
 
-## One-time scoped-package bootstrap
+## Trusted publisher
 
-npm cannot configure a trusted publisher until the package exists. After this
-package source has been reviewed and merged, an `lnurlcash` npm organisation
-owner must make the one exceptional manual publish:
+The one-time scoped-package bootstrap was completed with `0.14.0-rc.0`, then
+`0.14.0` was published by the reviewed OIDC release workflow. Do not repeat the
+manual bootstrap for later releases.
 
-1. Build, test and pack the merged source from a disposable clean checkout,
-   changing only its package version to `0.14.0-rc.0`.
-2. Publish that tarball as a public prerelease with
-   `npm publish --access public --tag next <tarball>`.
-3. Verify that npm shows `@lnurlcash/kit@0.14.0-rc.0` under the `next` tag and
-   that no `latest` tag has been created.
-
-Do not manually publish `0.14.0`: that version is reserved for the reviewed
-OIDC release. The prerelease only creates the scoped package so its trusted
-publisher can be configured; do not recommend it to production consumers.
-
-## One-time trusted-publisher setup
-
-An npm package owner must configure the trusted publisher for
-`@lnurlcash/kit` as:
+The trusted publisher for `@lnurlcash/kit` is configured as:
 
 - provider: GitHub Actions
 - organisation or user: `lnurlcash`
@@ -32,26 +18,31 @@ An npm package owner must configure the trusted publisher for
 - environment: `npm-publish`
 - allowed actions: enable direct `npm publish`
 
-A GitHub repository or organisation administrator should create the
-`npm-publish` environment, restrict it to `v*` tags and require a maintainer
-review. No npm token or GPG key belongs in GitHub secrets; npm uses the
-workflow's short-lived OIDC identity and records provenance.
-
-Do not create a final release until both sides are configured. A missing or
-mismatched trusted publisher should fail closed, but it is not a useful release
-rehearsal.
+The GitHub `npm-publish` environment restricts deployments to tags matching
+`v*.*.*` and requires a maintainer review. No npm token or GPG key belongs in
+GitHub secrets; npm uses the workflow's short-lived OIDC identity and records
+provenance. A missing or mismatched trusted publisher should fail closed.
 
 ## Each release
 
-1. Choose the next version for both the wallet and kit, then update the kit's
-   `package.json` and `CHANGELOG.md` in a reviewed pull request.
+The version is never hand-bumped in `package.json` - `src/lib/package.json`'s
+own checked-in `version` (`0.0.0-dev`) is a placeholder, overwritten by
+`release-kit.yml`'s own `npm version "${RELEASE_TAG#v}" --no-git-tag-version`
+step from whichever tag actually triggered the run. This mirrors how the
+wallet's own displayed version already works (`scripts/git-version.mjs` -
+`git describe --tags`, no hand-bumped field either): cutting a release is just
+tagging a commit, nothing to remember to keep in sync first.
+
+1. (Optional but recommended) Add a `CHANGELOG.md` entry summarising what's
+   new, in a reviewed pull request.
 2. Require the wallet CI and the independent `src/lib` package gate to pass.
-3. Merge, then create the shared `vX.Y.Z` tag at that exact merge commit. The
-   tag must exactly equal `v` plus the version in `src/lib/package.json`.
+3. Merge, then create the shared `vX.Y.Z` tag at that exact merge commit -
+   any valid semver works, npm itself rejects anything else.
 4. Pushing the tag starts both release workflows. The wallet is tested and
-   deployed at `X.Y.Z`; `release-kit.yml` independently rebuilds and tests the
-   package, packs one tarball, performs a dry-run publish and uploads that same
-   tarball through npm OIDC as `@lnurlcash/kit@X.Y.Z`.
+   deployed at `X.Y.Z`; `release-kit.yml` independently sets the package
+   version from the tag, rebuilds and tests the package, packs one tarball,
+   performs a dry-run publish and uploads that same tarball through npm OIDC
+   as `@lnurlcash/kit@X.Y.Z`.
 5. Verify the workflow, npm version, repository metadata and provenance before
    announcing the release.
 

package/dist/addresses.d.ts

@@ -1,6 +1,6 @@
 import { type HashWithdrawRequestInfo } from './request.js';
 import { type Cx1 } from './recoverableNotes.js';
-export declare const registerUsername: (server: string, username: string, cx1: string, indexZeroSecretKey: Uint8Array) => Promise<void>;
+export declare const registerUsername: (server: string, username: string, cx1: string, indexZeroSecretKey: Uint8Array, npub?: string) => Promise<void>;
 export declare const unregisterUsername: (server: string, username: string, indexZeroSecretKey: Uint8Array) => Promise<void>;
 export type AddressScanResult = {
     index: number;

package/dist/index.js

@@ -337,10 +337,14 @@ var requireNoteK1 = (url) => {
 };
 var noteDeclaredAmount = (url) => {
   try {
-    const raw = new URL(url).searchParams.get("amount");
-    if (raw === null) return null;
-    const n = Number(raw);
-    return Number.isFinite(n) ? n : null;
+    const parsed = new URL(url);
+    const raw = parsed.searchParams.get("amount");
+    if (raw !== null) {
+      const n = Number(raw);
+      return Number.isFinite(n) ? n : null;
+    }
+    const sig = parsed.searchParams.get("sig");
+    return sig ? decodeCs1WithAmount(sig)?.amountMsat ?? null : null;
   } catch {
     return null;
   }
@@ -368,10 +372,15 @@ var buildNoteUrl = (withdrawLink, k1, amountMsat) => {
   }
   return url.toString();
 };
+var amountIsImpliedBySignature = (signature) => Boolean(signature) && isCs1WithAmount(signature);
 var withNewK1 = (url, k1, amountMsat, signature) => {
   const newUrl = new URL(url);
   newUrl.searchParams.set("k1", k1);
-  newUrl.searchParams.set("amount", String(amountMsat));
+  if (amountIsImpliedBySignature(signature)) {
+    newUrl.searchParams.delete("amount");
+  } else {
+    newUrl.searchParams.set("amount", String(amountMsat));
+  }
   if (signature) newUrl.searchParams.set("sig", signature);
   else newUrl.searchParams.delete("sig");
   return newUrl.toString();
@@ -379,13 +388,22 @@ var withNewK1 = (url, k1, amountMsat, signature) => {
 var withoutK1 = (url, amountMsat, signature) => {
   const newUrl = new URL(url);
   newUrl.searchParams.delete("k1");
-  newUrl.searchParams.set("amount", String(amountMsat));
+  if (amountIsImpliedBySignature(signature)) {
+    newUrl.searchParams.delete("amount");
+  } else {
+    newUrl.searchParams.set("amount", String(amountMsat));
+  }
   if (signature) newUrl.searchParams.set("sig", signature);
   else newUrl.searchParams.delete("sig");
   return newUrl.toString();
 };
 var withoutSignature = (url) => {
   const newUrl = new URL(url);
+  const sig = newUrl.searchParams.get("sig");
+  if (sig && !newUrl.searchParams.has("amount")) {
+    const decoded = decodeCs1WithAmount(sig);
+    if (decoded) newUrl.searchParams.set("amount", String(decoded.amountMsat));
+  }
   newUrl.searchParams.delete("sig");
   return newUrl.toString();
 };
@@ -1190,9 +1208,10 @@ var addressProofUrl = (server, username, indexZeroSecretKey, action) => {
   );
   return url;
 };
-var registerUsername = async (server, username, cx1, indexZeroSecretKey) => {
+var registerUsername = async (server, username, cx1, indexZeroSecretKey, npub) => {
   const url = addressProofUrl(server, username, indexZeroSecretKey, "register");
   url.searchParams.set("cx1", cx1);
+  if (npub) url.searchParams.set("npub", npub);
   const body = await lnurlFetch(url, "POST");
   if (body?.status !== "OK") {
     throw new Error("SERVICE did not confirm the registration.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lnurlcash/kit",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "LNURLcash (LUD-25) protocol client for TypeScript",
   "author": "dni",
   "contributors": [