lnurlcash-kit 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.12.1 - 2026-09-11
+
+- `fetchNoteInfo` compares the mint's echoed `k1` with the one it asked
+  about as the note each names (`noteIdOf`), not as strings. One Part 2 note
+  has many valid `ck1`s: anyone can turn one into its high-S twin, and its
+  holder can re-sign, so a mint echoing another spelling of the same note
+  was reported as having handed back a different note. An echo that names no
+  note at all is still refused, and a Part 1 secret compares as it always did.
+
 ## 0.12.0 - 2026-09-11
 
 **A Part 2 branch rooted in a Nostr key.**

package/README.md

@@ -422,8 +422,9 @@ Three things worth knowing:
 - **`i` is any uint32**, serialised as 4 bytes big-endian, never hardened.
   lnurl-wallet and lnurl-mint agree on that; the spec does not say.
 
-`test/vectors/part2.json` was generated from lnurl-wallet and checked against
-lnurl-mint. It moves into lnurlcash-conformance next.
+The tests grade against lnurlcash-conformance's `vectors/part2.json`, built
+from the primitives there and identical to vectors generated from lnurl-wallet
+and checked against lnurl-mint.
 
 **A branch rooted in a Nostr key.** A holder with no BIP-39 words, such as a
 hardware signer that keeps only its identity key, or a wallet that never made
@@ -431,7 +432,7 @@ any, can still be paid to keys of its own. `deriveNostrAddressNode(secretKey,
 host)` takes the branch from the key that owns the lightning address:
 `HMAC-SHA256(key = secret key, msg = "LNURLcash/nostr-seed")`, then the path
 above unchanged. heartwood-esp32 derives exactly this on the device, graded
-against the same `test/vectors/nostr-seed.json`, so its notes come back from
+against the same values as conformance's `vectors/nostr-seed.json`, so its notes come back from
 its nsec (or the phrase the nsec came from) without the device. This is ours,
 not LUD-25's; a mint sees an ordinary `cx1` either way.
 

package/dist/index.js

@@ -967,7 +967,8 @@ var fetchNoteInfo = async (url, options = {}) => {
     requireMintPubkey: opts.requireSignatures
   });
   const queried = noteK1(url);
-  if (queried && body.k1.toLowerCase() !== queried) {
+  const echoed = noteIdOf(body.k1);
+  if (queried && (echoed === null || echoed !== noteIdOf(queried))) {
     throw new ProtocolError(
       "The service echoed back a different k1 than was queried - the note may have been redeemed elsewhere, or the service isn't spec-compliant."
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lnurlcash-kit",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "LNURLcash (LUD-25) bearer note client for TypeScript - mint, rotate, split, merge, melt, and verify offline",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -60,7 +60,7 @@
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
-    "lnurlcash-conformance": "^0.8.0",
+    "lnurlcash-conformance": "^0.9.0",
     "tsup": "^8.5.0",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"