lnurlcash-kit 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -1,6 +1,51 @@
 # Changelog
 
-## Unreleased
+## 0.9.0 - 2026-09-09
+
+**`fetchMintAddress` reads three more fields.** The reference mint publishes
+them and this dropped all three on the floor, because the parser maps field by
+field and an unrecognised name is discarded by design.
+
+- `nodeUris` - every address the SERVICE's node announces. `nodeUri` is the
+  first of them; a node behind Tor as well as clearnet has more, and a caller
+  that can only reach the other one needs the list. Undefined rather than `[]`
+  when there are none, so `nodeUris?.length` and `'nodeUris' in info` agree.
+- `sunsetDate` - the day the SERVICE plans to close, ISO-8601. Advance warning
+  while there is still time to spend, deliberately not the same thing as a mint
+  that has already stopped minting. Validated as a real calendar day and
+  dropped otherwise: the one thing a WALLET does with this is put it in front
+  of a holder, and a wrong date there is worse than no date.
+- `outstandingNotesMsat` - what the SERVICE says it owes. Its own claim about
+  its own database, with nothing to check it against, so read it next to what
+  the node holds rather than on its own.
+
+## 0.8.1 - 2026-09-04
+
+**`settleNote` could report a burned note as settled, losing it outright.**
+Settling reads what a split's change or a merge's output is really worth, which
+puts `k1` on the wire, so a rotate follows to replace the secret it just
+exposed. That rotate is best-effort by design: a SERVICE that refuses it has
+burned nothing, so keeping the exposed `k1` beats failing the whole settle.
+
+The fallback was a bare `catch`, which also covered a rotate that MAY HAVE
+LANDED - an ambiguous one, an unverifiable one, or a spent-or-unknown refusal,
+which is exactly what a mutation the SERVICE already applied looks like asked a
+second time. In every one of those the SERVICE had burned the `k1` being
+returned and minted a note under `h`, and the fresh secret `rotateNote()`
+attaches to the error was the only copy of it anywhere. Discarding it handed
+back a dead secret shaped like a success and dropped the live one.
+
+- `settleNote` now rethrows anything that could describe an applied mutation:
+  `AmbiguousMintError`, and any error carrying `newSecretsOf(err)`. Only a
+  refusal that burned nothing still returns the exposed `k1`.
+- It also rethrows anything that is not an `LnurlcashError`. The bare `catch`
+  swallowed `TypeError` and friends alongside the protocol errors the fallback
+  was for, so a bug in this library was reported as a settled note too.
+- **Behavioural change, no API change.** A caller that treated `settleNote` as
+  something that never throws now sees these errors. That is the point: each
+  one carries secrets that must be persisted before anything else.
+- Fixed in the sibling implementations the same day - Rust, Go, Python and
+  Kotlin all carried it.
 
 ## 0.8.0 - 2026-09-04
 

package/README.md

@@ -117,8 +117,8 @@ fresh secret got discarded along with the note the service had just minted.
 Node's `fetch` does not retry on its own, but a browser resends an idempotent
 request that failed on a stale pooled connection, and Go and the JDK do the
 same by their own routes — the hazard broke the
-[Kotlin](https://github.com/TheCryptoDonkey/lnurlcash-kotlin) and
-[Go](https://github.com/TheCryptoDonkey/lnurlcash-go) siblings during
+[Kotlin](https://github.com/lnurlcash/lnurlcash-kotlin) and
+[Go](https://github.com/lnurlcash/lnurlcash-go) siblings during
 development, by two different mechanisms.
 
 LUD-25 closed it. A service MUST answer a byte-identical rotate, split or
@@ -319,7 +319,7 @@ still money. Do not mint under it. `restoreFromSeed` walks it alongside the
 specified scheme so none of those notes goes missing.
 
 Both schemes ship with
-[conformance vectors](https://github.com/TheCryptoDonkey/lnurlcash-conformance)
+[conformance vectors](https://github.com/lnurlcash/lnurlcash-conformance)
 for the ports.
 
 ```ts
@@ -616,14 +616,14 @@ The reference implementations, both dni's, both MIT:
 
 Everything else built on LNURLcash — the other wallets and mints, the
 hardware vault, the sibling language ports — is indexed in
-[awesome-lnurlcash](https://github.com/TheCryptoDonkey/awesome-lnurlcash).
+[awesome-lnurlcash](https://github.com/lnurlcash/awesome-lnurlcash).
 
 Changes made on extraction are listed in [CHANGELOG.md](CHANGELOG.md); two
 are behavioural fixes worth reading if you are porting from that code.
 
 ## Conformance
 
-Tested against [lnurlcash-conformance](https://github.com/TheCryptoDonkey/lnurlcash-conformance):
+Tested against [lnurlcash-conformance](https://github.com/lnurlcash/lnurlcash-conformance):
 language-neutral vectors plus a mock mint that can be told to misbehave —
 drop a connection mid-mutation, sign in the wrong byte order, lie about a
 note's value, never settle a melt. If you are writing an LNURLcash

package/SECURITY.md

@@ -9,7 +9,7 @@ Only the latest `0.x` release is supported. Pin an exact version.
 
 Report privately through GitHub's advisory form:
 
-<https://github.com/TheCryptoDonkey/lnurlcash-kit/security/advisories/new>
+<https://github.com/lnurlcash/lnurlcash-kit/security/advisories/new>
 
 Please do not open a public issue for anything that could be used to take
 somebody's notes.

package/dist/index.d.ts

@@ -69,6 +69,9 @@ type MintAddressInfo = {
     nodeCapacityMsat?: number;
     nodeNumChannels?: number;
     nodeNumPeers?: number;
+    nodeUris?: string[];
+    sunsetDate?: string;
+    outstandingNotesMsat?: number;
     name?: string;
     description?: string;
     contact?: MintContact;

package/dist/index.js

@@ -904,6 +904,16 @@ var asFees = (value) => {
 };
 var asBoolean = (value) => typeof value === "boolean" ? value : void 0;
 var asPubkeyList = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : void 0;
+var asStringList = (value) => {
+  if (!Array.isArray(value)) return void 0;
+  const entries = value.filter((item) => typeof item === "string" && item.length > 0);
+  return entries.length ? entries : void 0;
+};
+var asIsoDate = (value) => {
+  if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(value)) return void 0;
+  const parsed = /* @__PURE__ */ new Date(`${value}T00:00:00Z`);
+  return !Number.isNaN(parsed.getTime()) && parsed.toISOString().slice(0, 10) === value ? value : void 0;
+};
 var fetchMintAddress = async (url, options = {}) => {
   const body = await lnurlFetch(url, resolveOptions(options));
   if (body?.tag !== "withdrawRequest" || typeof body.callback !== "string" || typeof body.payLink !== "string" || typeof body.maxWithdrawable !== "number") {
@@ -929,6 +939,9 @@ var fetchMintAddress = async (url, options = {}) => {
     nodeCapacityMsat: asNumber(body.nodeCapacity) ?? asNumber(body.nodeCapacityMsat),
     nodeNumChannels: asNumber(body.nodeNumChannels),
     nodeNumPeers: asNumber(body.nodeNumPeers),
+    nodeUris: asStringList(body.nodeUris),
+    sunsetDate: asIsoDate(body.sunsetDate),
+    outstandingNotesMsat: asNumber(body.outstandingNotesMsat),
     name: asString(body.name),
     description: asString(body.description),
     contact: asContact(body.contact),
@@ -1179,7 +1192,13 @@ var settleNote = async (baseUrl, k1, expectedAmountMsat, signature, options = {}
       signature: rotated.signature,
       callback: info.callback
     };
-  } catch {
+  } catch (err) {
+    if (err instanceof AmbiguousMintError || newSecretsOf(err).length > 0) {
+      throw err;
+    }
+    if (!(err instanceof LnurlcashError)) {
+      throw err;
+    }
     return {
       k1,
       amountMsat: info.maxWithdrawable,

package/llms.txt

@@ -164,4 +164,4 @@ ProtocolError          a non-mutating response did not match the spec, which
 ## Conformance
 
 Vectors and an adversarial mock mint:
-https://github.com/TheCryptoDonkey/lnurlcash-conformance
+https://github.com/lnurlcash/lnurlcash-conformance

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lnurlcash-kit",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "LNURLcash (LUD-25) bearer note client for TypeScript - mint, rotate, split, merge, melt, and verify offline",
   "author": "TheCryptoDonkey",
   "license": "MIT",
@@ -9,11 +9,11 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/TheCryptoDonkey/lnurlcash-kit.git"
+    "url": "git+https://github.com/lnurlcash/lnurlcash-kit.git"
   },
-  "homepage": "https://github.com/TheCryptoDonkey/lnurlcash-kit#readme",
+  "homepage": "https://github.com/lnurlcash/lnurlcash-kit#readme",
   "bugs": {
-    "url": "https://github.com/TheCryptoDonkey/lnurlcash-kit/issues"
+    "url": "https://github.com/lnurlcash/lnurlcash-kit/issues"
   },
   "type": "module",
   "sideEffects": false,