v1.0.2 update released in GH and npm

Security Hardening

• BOLT11 invoice validation: mainnet bc prefix, amount match, reasonable expiry; payment_hash extracted and stored on the session
• Webhook HMAC-SHA256 signature verification via CLINK_WEBHOOK_SECRET env var or webhookSecret option
• Webhook correlation: session existence, amount, and payment_hash matched before confirming; idempotent handling
• SSRF protection: relay URLs restricted to wss://, rejecting localhost/.local, private/loopback/CGNAT/link-local IPs, and unsafe IPv6 ranges
• nDebit validation: decode and validate debit pointers (type, pubkey, relay); requires safe relay and valid merchantPubkey
• k1 correlation key on debit requests (<subscription_id>:<count>)

Added

• webhookSecret and merchantPubkey configuration options
• payment_hash on payment sessions; debit_pubkey/debit_relay on subscription data
• bolt11 and nostr-tools dependencies
• Expanded test suite (130 tests, 5 suites) with coverage thresholds met

npm: https://www.npmjs.com/package/medusa-plugin-bitcoin-lightning-via-clink
GitHub: https://github.com/WoompaLoompa/medusa-clink
.