# vendure-plugin-bitcoin-lightning-via-clink v0.3.0 released
Bitcoin Lightning payments for Vendure via the CLINK protocol (Nostr-native payment codes). npm: https://www.npmjs.com/package/vendure-plugin-bitcoin-lightning-via-clink | GitHub: https://github.com/WoompaLoompa/vendure-clink
### What's new in v0.3.0
- Rewritten BOLT11 decoder — the previous implementation returned null/0 for payment hash and timestamp on valid invoices; now uses proper bech32 HRP/separator parsing and is verified against the official BOLT11 test vector
- Invoice network validation — new network option (mainnet/testnet/regtest, default mainnet); invoices from a different network are rejected on both webhook and relay paths
- Invoice expiry validation — already-expired invoices are refused
- SSRF protection for relay URLs — localhost, private/loopback/link-local addresses and non-wss schemes are rejected (applied to subscribe, publish, key generation, payment handler)
- Relay settlement now requires proof — preimage + bolt11 must be supplied and the payment hash verified; res:"ok" without proof is refused
- Atomic offer transitions — settlement/expiry only applies from pending state
- Event kind 21001 + p-tag correlation checks on relay receipts
- Testing: 66 unit tests passing (incl. the official BOLT11 test vector and SSRF relay filtering cases).
I have no production store behind this, it's a solo effort validated by unit tests. If you try it in a real shop, feedback and issues are very welcome: https://github.com/WoompaLoompa/vendure-clink/issues
#buildstr #bitcoin #lightning #commerce #vendure #nostr #clink
Bitcoin Lightning payments for Vendure via the CLINK protocol (Nostr-native payment codes). npm: https://www.npmjs.com/package/vendure-plugin-bitcoin-lightning-via-clink | GitHub: https://github.com/WoompaLoompa/vendure-clink
### What's new in v0.3.0
- Rewritten BOLT11 decoder — the previous implementation returned null/0 for payment hash and timestamp on valid invoices; now uses proper bech32 HRP/separator parsing and is verified against the official BOLT11 test vector
- Invoice network validation — new network option (mainnet/testnet/regtest, default mainnet); invoices from a different network are rejected on both webhook and relay paths
- Invoice expiry validation — already-expired invoices are refused
- SSRF protection for relay URLs — localhost, private/loopback/link-local addresses and non-wss schemes are rejected (applied to subscribe, publish, key generation, payment handler)
- Relay settlement now requires proof — preimage + bolt11 must be supplied and the payment hash verified; res:"ok" without proof is refused
- Atomic offer transitions — settlement/expiry only applies from pending state
- Event kind 21001 + p-tag correlation checks on relay receipts
- Testing: 66 unit tests passing (incl. the official BOLT11 test vector and SSRF relay filtering cases).
I have no production store behind this, it's a solo effort validated by unit tests. If you try it in a real shop, feedback and issues are very welcome: https://github.com/WoompaLoompa/vendure-clink/issues
#buildstr #bitcoin #lightning #commerce #vendure #nostr #clink
1
