v1.1.1

Fixed

• isPrivateIpLiteral no longer fails open on scope-suffixed IPv6 literals:
  a zone ID (fe80::1%lo0, as returned by mDNS, /etc/hosts or a custom
  createPinnedFetch resolve seam) is stripped before classification, and an
  unparseable string that still looks like an IPv6 literal now classifies as
  private rather than public.
• createPinnedFetch refuses plaintext http: by default. The pin proves you
  reached the address you resolved, which means nothing on a cleartext channel.
  Pass the new allowHttp option for local development only.
• verifyInvoiceCommitment validates expectedMsats before the decode
  attempt, so the requireDecodable: false deferral path refuses NaN,
  fractional and negative amounts instead of reporting ok: true.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      farrier-kit-1.1.1.tgz
size:      131450 bytes
sha256:    72aedf2d83c9cc013e056c843507a77ece5e5f0788ed68a027000a63b77362fc
sha512-j02M+spI2AGLI5m9Fq+Q/GimRcjzDue7ATC+IoontDigKkbXIkjEfLbD5N/HFVFuQG43U18iJwowBbA1EY1WMA==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/farrier-kit/-/farrier-kit-1.1.1.tgz
shasum -a 256 farrier-kit-1.1.1.tgz