v0.3.0 releasedv0.3.0 released

Bitcoin Lightning payments for Vendure via the CLINK protocol (Nostr-native payment codes).

npm: https://www.npmjs.com/package/vendure-plugin-bitcoin-lightning-via-clink
GitHub: https://github.com/WoompaLoompa/vendure-clink

What's new in v0.3.0

• Rewritten BOLT11 decoder — the previous implementation returned null/0 for payment hash and timestamp on valid invoices; now uses proper bech32 HRP/separator parsing and is verified against the official BOLT11 test vector
• Invoice network validation — new network option (mainnet/testnet/regtest, default mainnet); invoices from a different network are rejected on both webhook and relay paths
• Invoice expiry validation — already-expired invoices are refused
• SSRF protection for relay URLs — localhost, private/loopback/link-local addresses and non-wss schemes are rejected (applied to subscribe, publish, key generation, payment handler)
• Relay settlement now requires proof — preimage + bolt11 must be supplied and the payment hash verified; res:"ok" without proof is refused
• Atomic offer transitions — settlement/expiry only applies from pending state
• Event kind 21001 + p-tag correlation checks on relay receipts

Testing: 66 unit tests passing (incl. the official BOLT11 test vector and SSRF relay filtering cases).

I have no production store behind this, it's a solo effort validated by unit tests. If you try it in a real shop, feedback and issues are very welcome: https://github.com/WoompaLoompa/vendure-clink/issues
.