v0.25.1

Fixes 0.25.0 for notes held at mints that predate LUD-25's 29 September
renames, the reference lnurl-mint and moneyer before 0.12 among them. Kit
0.20 speaks only the new wire forms, which those mints do not read: 0.25.0
could not look up, receive, check, rotate, split, merge, send or melt a
bearer note there, nor mint at one. Those requests were refused before any
note moved, with one exception: a mint that takes a quote's name only as a
64-hex comment and keys any other comment to the payment preimage
(moneyer 0.7 and 0.8 by default) minted a 0.25.0 quote, which named its
note by cp1, to the preimage. That note never appears under the secret
the wallet chose; it is taken by receiving <mint>/w?k1=<payment preimage>, which the paying wallet holds. Now tested against moneyer 0.17,
moneyer 0.3.1 and lnurlcash-conformance 0.13.1's mock mint.

• A bearer note goes on the wire in forms every mint generation reads, as
  it did before 0.25.0. It is looked up by its own ?k1= (a current mint
  checks the spend in full); a rotate, split or merge names each output's
  64-hex h under both p1 and h (p2 and h2); a mint quote names it
  as both comment and h; a melt sends k1 and pr. A current mint
  reads either name and requires the two to agree. Key-path and
  script-path notes exist only at current mints and are unchanged. A
  restore at an older mint still needs the holder's leave to walk by
  secret, since such a mint has no lookup that keeps the secret back.
• A mint that binds a quote only by h (moneyer before LUD-25's comment)
  can be added and minted at again. It must confirm mintToHash on the
  quote itself, or the invoice is dropped before anyone is shown it.
• An older mint's certificate is taken again, reversing that part of
  0.25.0 for bearer notes: such a mint certifies only over a note's h,
  as 65 bytes of hex or the fixed-HRP cs1, so 0.25.0 refused every
  certified note from one once its key was pinned, and could never take one
  offline. For a 64-hex k1 those verify under the rule they were made
  under, and only a real signature by the mint's key over that note's h
  and amount passes. A rotate at such a mint keeps its sig/sig2, and a
  note carrying one is sent as sig= beside amount=. On a ck1 or cw1
  they still verify nowhere.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.25.1.tgz
size:      215508 bytes
sha256:    bd8222fc917ba0013915cf7097c13086964433460c00de5e05da84e5d8debab7
sha512-Qe4ZZcxYHXGylHb87w+EMYof8ajWYEEHCCLeoAvKd6nmjqV2Cd/5QV1RyS1Puo3B9NJKftGk6RpV56y3IwSEnw==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.25.1.tgz
shasum -a 256 notecase-0.25.1.tgz

v0.24.1

Refreshes undici to clear an advisory (GHSA-3wwx-pv8p-q78v) that stopped 0.24.0 from publishing; 0.24.0 never reached npm, and its contents are below.

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.24.1.tgz
size:      209578 bytes
sha256:    65e40771da47ac8352de21e247f6d03334699f0aadbbeeabf03e05b2043e92cc
sha512-a0XfYkJxCkAAWqKcXrQBRs5Qca3mPqTO78Qrez0agfPzw/3ue/5BMQNFMkjY5LONSHYWV5rB8bPh0xVxsr+1Gg==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.24.1.tgz
shasum -a 256 notecase-0.24.1.tgz

Notecase 0.23.2

Documentation only; no code changes.

• llms.txt gives the signatures of sendOffline and receiveOffline and
  the OfflineSelection and OfflineHandover shapes, including one note URL
  per note. sendOffline returns a Promise although it makes no network
  call.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.23.2.tgz
size:      187686 bytes
sha256:    7fc51aa355e58376f1cb9687a08da8d0654f556c6e87a3da5cf8e37877a6f7c6
sha512-RoDCxOhtnsF3yxVTbFAS3qVCfua0McxyILulg+k/e1pwjV3jPcaRopD6qupp2/MPc+qJWXe2Gh/phclI9BJj2w==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.23.2.tgz
shasum -a 256 notecase-0.23.2.tgz

Notecase 0.23.1

Documentation only; no code changes.

• llms.txt documents the mint flow (startMint, awaitMint, claimMint)
  and the return shapes of receive, send and payWithNwc, checked
  against the current source.
• The README mint example waits with awaitMint. grossMsat is the amount
  paid; the note holds it less the mint fee.
• package.json gains search keywords.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.23.1.tgz
size:      187521 bytes
sha256:    c082dc4ae48f89d095fbfe93b6e32b7c42a05174805a74a7ade15c79866d2a0e
sha512-ip4PQGQNHG+9CG61Jzo1+KIgSQKQEWGPsjL8PKFRd3oem91Iz7bs9N1+C7HKBw2SwGAp505222QOlju+/EyFUQ==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.23.1.tgz
shasum -a 256 notecase-0.23.1.tgz

Notecase 0.23.0

• Hand out the spec's address branch, m/139'/d1..d4 with the hashing key
  at m/139'/0, for recovery words and for a words-less wallet's Nostr key.
  lnurl-wallet moved to it the same day (#166), so a name it registered from
  the same words was paid to keys notecase never walked, and notecase could
  not sign to move or release it. Pinned to lnurl-wallet's own vector and to
  conformance 0.13.0's part2.json and nostr-seed.json.
• Keep the old m/139'/1' branches, words and Nostr key, for everything
  already on them: key notes still receive, address scan and heartwood
  recovery walk both, and a name still pointing there is proven by its old
  index-0 key. address keys moves such a name onto the new branch.
  Nothing is handed out on the old path again.
• Heartwood firmware still derives the old path. Notes it is paid still
  collect and recover as before.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.23.0.tgz
size:      186716 bytes
sha256:    70cb2d88685a7aae783d8c68560571e185a3f8aa28cfe188237660f4d24e09e2
sha512-vJS+W8iE/kxAj4pgbLpnvP4cRvqrnjXHktP56ap9DhF7GDkmunf3wvGbquuKL00cFweduqmRAZdeUOpb3l163A==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.23.0.tgz
shasum -a 256 notecase-0.23.0.tgz

Notecase 0.22.0

Deploy moneyer 0.16.0 (or any mint on @lnurlcash/kit >= 0.18.1) first.
This version signs note ownership as a Schnorr ck1 over
sha256("LNURLcash"). A mint still on kit 0.14 does not recognise that
shape and answers "Unknown note." for it.

• Move to @lnurlcash/kit 0.18.1. Ownership proofs and address proofs now
  sign a sha256 digest, which the reference mint requires for
  register/unregister and checks first for spending. Notes already held as
  the older 65-byte ECDSA ck1 (including every note a heartwood exports)
  or the raw-message Schnorr ck1 still read, look up and spend.
• Fix noteIdOf for the kit's new recoverNoteOwnershipPubkey, which takes
  the ck1 string and returns {pubkeyXOnly, legacy}. Without this every
  Part 2 note id broke.
• Recovery's probe no longer throws on a probe note with a melt in flight:
  the kit now raises PendingNoteError for it, not ServiceError.
• The address branch is unchanged, still under m/139'/1', matching
  heartwood firmware and the names already registered to it. Moving to the
  spec's literal m/139'/d1..d4 needs a migration that keeps scanning the
  old branch, so it is deliberately not part of this release.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.22.0.tgz
size:      185678 bytes
sha256:    aebd93a891d74dbb98d88d382d5d80938482f9fc1994ed978ef81010841fa069
sha512-BHaGUKjsUWkFilgkSOmjbZFLk8M8u7h5jIk/F+GYWlck6YKl+ukdVOL+3Bj6XitCGZ9L53wSRQy5smWdx0RQ0g==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.22.0.tgz
shasum -a 256 notecase-0.22.0.tgz

Notecase 0.21.0

• Move the protocol boundary from the archived unscoped package to
  @lnurlcash/kit 0.14. Notecase-owned recovery, payment-request, fee, key
  derivation and per-wallet transport policy remain local rather than being
  dropped or pushed into the reference wallet package.

• Accept amount-bearing cs1 certificates throughout device storage and
  encrypted backup validation. Legacy raw mutation signatures remain valid;
  a reference mint running without a signer is retained and reconciled rather
  than losing the newly disclosed output.

• Recovery uses secret-free hash lookup first. Raw-k1 fallback is a separate
  path used only after the holder explicitly allows secret disclosure.

• Replace the obsolete proof-free /register compatibility path with the
  reference mint's signed POST/DELETE /p/{username} flow. Software wallets
  prove control with the branch's index-0 key and may publish their npub for
  NIP-05; Heartwood registration is refused until the device can make that
  proof, rather than treating a public cx1 as ownership.

• Remember the public branch currently registered so a branch migration is
  signed by the old index-0 key, as the reference mint requires, before the
  replacement branch becomes current.

• A linked heartwood's notes are now written down, note by note, every time
  this wallet lists the locker: the device's id, the amount, the mint host,
  the state, the label, and for a note paid to the device's own keys its
  index on the branch. The inventory rides along in notecase backup and
  comes back on a restore; an older backup that has none restores unchanged.

  The locker is a till, not a vault. A bearer note IS its secret, so the
  device keeps its notes out of every backup on purpose - a restored copy on
  a second board is a double-spend. What that leaves unsaid is that a board
  which dies takes its notes with it, unrecoverably, and until now its owner
  could not even say what was lost. Backing up the inventory rather than the
  secrets carries no new risk and makes the loss legible: nothing here spends
  anything, and nothing here comes back if the board is gone, but it names
  exactly what existed and is what you show a mint. Collect promptly and keep
  little on the device (heartwood-esp32#86).

• heartwood notes no longer just fails when the device cannot be reached.
  It falls back to the last reading, dated and plainly marked as past, and
  says that these are the device's notes rather than this wallet's. Asking
  what is on a locker is not moving money, and a board that is asleep, off
  its relay or dead is exactly when the question gets asked. A device that
  answers is unchanged, and one that answers with fewer notes than last time
  replaces the reading rather than merging into it.

• heartwood rename <id> <label> relabels a note the device holds, over the
  relay and on one hold. A label is what heartwood notes shows and the one
  thing that can be wrong without anything being lost, and until now it could
  only be corrected over the cable, which a WiFi-standalone board does not
  have. Needs firmware that serves heartwood_note_rename
  (heartwood-esp32#96); older firmware answers that the method is unknown.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.21.0.tgz
size:      185249 bytes
sha256:    e0bb8bd4ab0374f076190f8625517ea0d5c319a9a72b16d81e03c58ff44ecce2
sha512-CPhOx9ZeoH7BW/dFlV6x1/mdi0Cc+2UyO586Z4Geav6PxBhtAz/oR9/KWatnBHtrrrCWoxZjC/y4+UNitwV5fQ==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.21.0.tgz
shasum -a 256 notecase-0.21.0.tgz

v0.20.0

• A hold the device is waiting for is asked for again every few seconds,
  with the terminal bell, until it is answered or the call gives up. Said
  once into a terminal nobody is watching, a card is missed and the command
  reports a timeout that reads like a fault. The bell only rings on a
  terminal, so piped output is unchanged.

• Lightning-address claims now work with the reference lnurl-mint as well
  as Moneyer. Notecase detects its free, first-come /register route without
  changing state and registers the wallet's or linked heartwood's cx1
  branch. The reference route does not prove Nostr ownership or send a relay
  wrap, so the web wallet now has Check address for payments alongside
  the existing CLI address scans.

• balance says what a linked heartwood holds, uncollected, from the last
  time this wallet reached it, with when that was. Seeing money never waits
  on a relay round trip and never needs a button press; heartwood notes
  and heartwood collect refresh the reading, and heartwood notes now
  totals what is on the device. The signer's notes are not folded into this
  wallet's balance: they are not its money until collected.

• A collect no longer promises a second hold. Firmware that takes
  heartwood-esp32#129 writes a note off on the same hold that released it,
  so the step now says to hold again only if the device asks.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.20.0.tgz
size:      163345 bytes
sha256:    9e16118e3e931dca840a8e9ddaec5caa1e3e5b458e657889bf6fedc705539090
sha512-r+xkj3AnHygCVQF6eErKrRqyN744QjMQF8c8TN82TK1JkHtTqyyv+C1afxhFw+W8Yv4kDIQl+bt+qNqOK8auSg==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.20.0.tgz
shasum -a 256 notecase-0.20.0.tgz

v0.19.1

• lnurlcash-kit 0.13.0, where a plain note is unsigned: LUD-25 Part 2
  certifies cp1 notes only, and a rotate, split or merge to a hash can
  now come back with no signature. This wallet already took those; it
  still checks any signature a note does carry against the mint's pinned
  key. The kit's new requireMintPubkey is off here, so a mint that
  publishes no signing key is still received from, as before.
• lnurlcash-kit 0.12.1: a note-info answer that names the queried note by
  another of its ck1 strings is accepted. One note has many valid ck1s,
  so the echo is compared by the note it names, not as a string.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.19.1.tgz
size:      159504 bytes
sha256:    74b050ca09e5965865a984f2ba9cb602daa33a09da82151fe0e4c33d8a1dd11b
sha512-qJV8+lMaIG0yVPwEkPC7UHMpH1Q+A91FiiR+5aaVqeWzO8PW/T3Woov3VAOGnI+77njPx5GCzcO1cSNj0Ofpyg==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.19.1.tgz
shasum -a 256 notecase-0.19.1.tgz

v0.19.0

A lost heartwood's notes come back without it.

• heartwood recover rebuilds the branch a heartwood's lightning address was
  paid on from its master's nsec or BIP-39 phrase, prompted for and never
  taken on the command line, and takes every live note on it into this
  wallet. The secret has to open the master's npub (--npub, or the linked
  heartwood's) or nothing is derived. An nsec is tried as both a bunker and
  a tree-nsec master; heartwood's typed recovery words are not read yet.
• A wallet with no recovery words is paid to its own keys: its branch comes
  from its Nostr key (lnurlcash-kit 0.12.0's deriveNostrAddressNode), so
  address claim and address keys no longer need words. A note paid on
  that branch still lands after the wallet gains words, and address scan
  walks both branches.

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      forgesworn-notecase-0.19.0.tgz
size:      159192 bytes
sha256:    91107ecfbf75191d3f9728f91996f2c76a51dbbe7bbf77e66aceb78fdd2e9bed
sha512-rADbbOX6XNrnyrvtzAAyNOvXvNLlc89EBSli0YIwBH1PKtnzV6NO+kTDl6jngmAYo+cpfNX9djQ4m+3B3/osFw==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/@forgesworn/notecase/-/notecase-0.19.0.tgz
shasum -a 256 notecase-0.19.0.tgz