v1.8.6 - Hotfix P0: macaroon exp (ms vs s)

Hotfix P0 - Macaroon expiration units (ms vs s)

All real Lightning tokens were immediately rejected because providers stored exp in Unix seconds (~1.7B) while verify.ts compared against Date.now() in milliseconds (~1.7T).

Changes

• All 5 TS providers: exp: Date.now() + 3_600_000 (was Math.floor(Date.now()/1000) + 3600)
• All providers: AbortSignal.timeout() (15s createInvoice, 10s checkPayment)
• verify.ts: token length guard (>4096 chars rejected)

Also

• Docs: rate-limit guide, BudgetTracker concurrency warning, mock wallet snippet, testnet column
• VSCode extension v1.8.5: Pro status auto-refreshes within 30s of payment

Tests

478 TS / 127 Python / 20+ Go / 36 Rust - all passing

Upgrade immediately - v1.8.5 on npm is deprecated.

v1.8.2 - Improved MCP tool descriptions

What's changed

MCP Server

• Improved descriptions for all 4 tools (l402_fetch, l402_balance, l402_spending_report, l402_set_budget)
• Added side-effect warnings, flow details, when-to-use / when-NOT-to-use guidance
• Bumped MCP server version string to 1.8.2

Cloudflare Worker

• Webhook deduplication via KV (processed paymentHash, TTL 7 days) prevents double-splits on Svix retries

Install

npm install l402-kit@1.8.2
npx l402-kit-mcp

v1.8.1 — MCP server + Glama release

feat: add Glama score badge to README