Cashu TS 5.0.0-rc.10

This release adds the draft Nutroot specification, gated on version 3 (BLS) keysets. Note, there are a few more v5 breaking changes since rc.09, please check the migration-5.0.0.md document.

Upgrading from rc.9: read these even if you never touch a v3 keyset

• customRequest transports: requestBody can now be a string and must be sent byte-for-byte (NUT-22 signs those bytes). A transport that re-serializes it sends quoted JSON and every POST fails at the mint. Serialize only when it is an object.
• createLockedMintQuote is removed and createMintQuoteBolt11(amount, pubkey, description?) now requires the pubkey. The wallet stores no quote lock keys: persist the privkey from createQuoteLockKey() with the quote, or a seedless wallet loses it.
• Encoding a proof whose dleq lacks r now throws, and decoding drops such a block. Expect this on proofs persisted by older versions or received from other wallets.
• P2PKBuilder alias, asP2PK(), keepAsP2PK() and { type: 'p2pk' } are gone: use LockBuilder, asLocked(), keepAsLocked(), { type: 'lock' }. Lock keys must be 33-byte compressed hex.
• getKeyset('') throws; only undefined selects the default keyset.
• countersReserved emits counterKey (was keysetId), and seeded wallets also reserve QUOTE_COUNTER_KEY. A custom CounterSource must accept it.
• Previews lose keysetId and mint previews lose payload; signature/signatures/amounts move onto the preview.
• Auth: setCAT clears refresh token and expiry, OIDCAuth.devicePoll is removed (use startDeviceAuth().poll()), and PKCE accepts only S256.

The v3-only changes (spend_info persistence, minting from a quote object, leaves/blindKeys) are documented in migration-5.0.0.md and matter once a mint serves a BLS keyset.

What's Changed

• chore(deps): bump replace-in-file from 8.4.0 to 9.0.0 by @dependabot[bot] in https://github.com/cashubtc/cashu-ts/pull/1065
• chore(deps): bump @types/node from 25.6.0 to 26.2.0 by @dependabot[bot] in https://github.com/cashubtc/cashu-ts/pull/1064
• chore(deps): bump typescript-eslint from 8.67.0 to 8.68.0 in the eslint group by @dependabot[bot] in https://github.com/cashubtc/cashu-ts/pull/1061
• chore(deps): bump @eslint/js from 9.39.4 to 9.39.5 in the dev-tooling group by @dependabot[bot] in https://github.com/cashubtc/cashu-ts/pull/1062
• chore(deps): bump the commitlint packages to 21.2.2 by @dependabot[bot] in https://github.com/cashubtc/cashu-ts/pull/1063
• chore: group the commitlint and vite bumps with their families by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1074
• chore: drop four unused devDependencies by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1075
• chore(deps): bump @types/node from 26.2.0 to 26.4.0 in the dev-tooling group across 1 directory by @dependabot[bot] in https://github.com/cashubtc/cashu-ts/pull/1076
• chore(deps): bump lint-staged from 16.4.0 to 17.3.0 by @dependabot[bot] in https://github.com/cashubtc/cashu-ts/pull/1078
• fix(utils): guard the keysetIds argument of getDecodedToken by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1084
• fix(transport): never retry a request carrying a Blind-auth header by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1090
• feat(nutroot): nutroot secrets for v3 keysets (NUT-10) by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/950
• feat(nutroot): adapt NIP-07 browser signers to both lock families by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1005
• fix(nutroot): tighten v3 spending, requests and melt outputs by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1092
• fix(wallet): normalise quote amounts in WebSocket updates by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1088
• fix(wallet): unblind melt change and restore with the keyset the mint signed under by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1081
• feat(events): polling fallback behind every NUT-17 subscription by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1072
• feat(nut14): preimage option for spending HTLC inputs by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1071
• test: import LockBuilder and the BLS helpers statically by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1093
• perf(wallet): restore only the counters a scan needs by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/964
• feat(wallet): accept a custom hash-to-curve for proof state checks by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1080
• fix(wallet): unblind swap and mint outputs with the keyset the mint signed under by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1095
• fix(utils): tighten UTF-8, CBOR and TLV decoding by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1097
• fix(nut26): reject repeated singular TLV tags and untyped policy flags by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1099
• fix(nut11): reject malformed P2PK tag values and bound key lists by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1101
• fix(nut11): bind SIG_INPUTS signatures to the secret and honour overlapping HTLC refunds by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1104
• fix(nut11): validate a SIG_ALL signing package before signing it by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1106
• refactor(crypto): sign and verify P2PK over a digest by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1108
• fix(crypto): validate helper inputs at the boundary by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1111
• fix(wallet): require a 64-byte seed at construction by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1113
• fix(model): tighten Amount construction and strict wire JSON parsing by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1114
• fix(mint): validate and bound mint response shapes by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1116
• fix(mint): strip wallet fields from inputs and bind melt responses by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1118
• test(wallet): give the restore state-check scan a 15s budget by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1120
• fix(transport): bound the WebSocket queue and tear down cleanly by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1121
• fix(model): validate persisted outputs and pin the hash-to-curve counter by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1123
• fix(transport): scope request logs, merge headers case-insensitively, sanitize log context by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1125
• feat(crypto): hash the transcript plainly, tag the BAT message by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1129
• fix(wallet): enforce payment-request terms and guard counters, previews and cache age by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1127
• chore(deps): bump the dev-tooling group with 4 updates by @dependabot[bot] in https://github.com/cashubtc/cashu-ts/pull/1132
• fix(core): reject incomplete DLEQ proofs on encode and decode by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1135
• chore(deps): bump typescript-eslint from 8.68.0 to 8.69.0 in the eslint group by @dependabot[bot] in https://github.com/cashubtc/cashu-ts/pull/1131
• fix(auth): install OIDC tokens through the session they belong to by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1137
• chore(ci): run the auth demo against a live mint by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1139
• fix(wallet): bind created quotes to what was asked for by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1141
• fix(wallet): keep the keychain consistent across refreshes and cache loads by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1143
• fix(auth): bound OIDC reads and delays, refuse redirects and non-S256 PKCE by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1145
• fix: throw CTSError from the last four bare Error sites, and lint for it by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1147
• docs: note that getKeyset looks up an explicit empty id in the v5 migration guide by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1148
• refactor(wallet)!: drop the wire payload from mint previews by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1150
• chore(main): release 5.0.0-rc.10 by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/1086

Full Changelog: https://github.com/cashubtc/cashu-ts/compare/v5.0.0-rc.9...v5.0.0-rc.10