Aljaz Ceru 4a34066a1d grantless: refuse silent amount raises, stricter bolt11 shape, payment-safe UI errors ...

- resolveZapAmount: recipient minimum above the intended zap aborts with a
  clear message (hostile minSendable can no longer inflate an auto-paid NWC
  zap); only clamping DOWN is allowed; unit-tested
- decodeBolt11: reject mixed-case bech32 and invoices without a payment_hash
  tag (unreceivable invoices no longer reach recovery QRs); crafted test
  fixtures now carry payment hashes; signature delegation to wallets
  documented (recovery-from-sig adds no integrity for no-n-tag invoices)
- zap()/retry: post-payment UI failures can never report a paid zap as
  failed (double-pay guard); finishZap preference handling exception-safe
- QR wording: bound invoices say payment 'should' publish the receipt via
  the recipient's server

2026-08-17 21:38:34 +02:00

..

zap-core.test.js

grantless: refuse silent amount raises, stricter bolt11 shape, payment-safe UI errors

2026-08-17 21:38:34 +02:00