lnurlcash-kit 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 Semantic versioning. While the LUD-25 draft is unmerged, `0.x` minor bumps
 may carry breaking changes; pin an exact version.
 
+## 0.2.1 - 2026-08-22
+
+- `WithdrawRequestInfo` carries `payLink`, the way home a SERVICE may
+  publish on a note's informational GET. It is the reverse of the
+  `withdrawLink` a payRequest advertises, and it is the only route a
+  bearer-note wallet has to a mint's discovery document: the document lives
+  under a username the note never mentions and cannot be guessed from the
+  callback. Without it, a WALLET that has only ever received notes cannot
+  read the mint's `previousPubkeys`, so an announced key rotation is
+  indistinguishable from a substituted key and gets refused.
+- A `payLink` on any origin but the note's own is dropped rather than
+  passed on, so a caller can treat its presence as the fact it looks like.
+  Whoever controls the host controls the pin anyway, which is TOFU's own
+  argument, but that argument does not stretch to letting a SERVICE
+  nominate a THIRD party to vouch for its key history, and refusing costs
+  nothing.
+
 ## 0.2.0 - 2026-08-22
 
 ### Deterministic note secrets and restore from a seed

package/dist/index.d.ts

@@ -39,6 +39,7 @@ type WithdrawRequestInfo = {
     maxWithdrawable: number;
     defaultDescription?: string;
     mintPubkey?: string;
+    payLink?: string;
 };
 declare const fetchNoteInfo: (url: string, options?: LnurlcashOptions) => Promise<WithdrawRequestInfo>;
 declare const probeBurnedNote: (url: string, options?: LnurlcashOptions) => Promise<"live" | "gone" | "unknown">;

package/dist/index.js

@@ -649,7 +649,22 @@ var fetchNoteInfo = async (url, options = {}) => {
       "The service echoed back a different k1 than was queried - the note may have been redeemed elsewhere, or the service isn't spec-compliant."
     );
   }
-  return body;
+  const info = body;
+  const payLink = sameOriginPayLink(body.payLink, reqUrl);
+  if (payLink === void 0) delete info.payLink;
+  else info.payLink = payLink;
+  return info;
+};
+var sameOriginPayLink = (value, noteUrl) => {
+  if (typeof value !== "string" || value.length === 0) return void 0;
+  let candidate;
+  try {
+    candidate = new URL(value, noteUrl);
+  } catch {
+    return void 0;
+  }
+  if (candidate.origin !== noteUrl.origin) return void 0;
+  return candidate.toString();
 };
 var probeBurnedNote = async (url, options = {}) => {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lnurlcash-kit",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "LNURLcash (LUD-25) bearer note client for TypeScript - mint, rotate, split, merge, melt, and verify offline",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -60,7 +60,7 @@
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
-    "lnurlcash-conformance": "^0.1.1",
+    "lnurlcash-conformance": "^0.2.2",
     "tsup": "^8.5.0",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"