javascript-solid-server 0.0.134 → 0.0.136

package/.claude/settings.local.json

@@ -343,7 +343,13 @@
       "Bash(sed -i 's/\"currency\":\"sats\"/\"currency\":\"tbtc4\"/g' /home/melvin/articles/solid-402.html /home/melvin/articles/solid-pay.html /home/melvin/articles/solid-balance.html)",
       "WebFetch(domain:lists.w3.org)",
       "Bash(git:*)",
-      "Bash(npm publish:*)"
+      "Bash(npm publish:*)",
+      "WebFetch(domain:git-mark.com)",
+      "WebFetch(domain:w3id.org)",
+      "WebFetch(domain:webledgers.github.io)",
+      "Bash(\\\\\"git config:*)",
+      "Read(//usr/local/lib/node_modules/gitmark-test/**)",
+      "WebFetch(domain:nip98.com)"
     ]
   }
 }

package/docs/payments.md

@@ -73,8 +73,10 @@ jss start --pay --pay-cost 10 --pay-address your-address --pay-token PODS --pay-
 | Method | Path | Description |
 |--------|------|-------------|
 | GET | `/pay/.info` | Public: cost, token info, chains, pool |
-| GET | `/pay/.balance` | Check your balance (NIP-98 auth) |
-| POST | `/pay/.deposit` | Deposit sats via TXO URI or MRC20 state proof |
+| GET | `/pay/.address` | Public: pod's taproot deposit address (optional `?user=did:nostr:...` for per-user address) |
+| GET | `/pay/.balance` | Check your balance (NIP-98 auth) — also auto-detects new deposits |
+| POST | `/pay/.deposit` | Deposit sats via TXO URI, claim `{txid, vout, chain}`, or MRC20 state proof |
+| POST | `/pay/.withdraw-sats` | Withdraw sats as a TXO voucher URI |
 | POST | `/pay/.buy` | Buy tokens with sat balance (requires `--pay-token`) |
 | POST | `/pay/.withdraw` | Withdraw balance as portable tokens (requires `--pay-token`) |
 | GET | `/pay/.offers` | List open sell orders (secondary market) |
@@ -86,41 +88,61 @@ jss start --pay --pay-cost 10 --pay-address your-address --pay-token PODS --pay-
 
 ### How It Works
 
-1. Authenticate with NIP-98 (Nostr HTTP Auth)
-2. Check balance at `/pay/.balance`
-3. Deposit sats by POSTing a TXO URI to `/pay/.deposit`
+1. Get your deposit address: `GET /pay/.address?user=did:nostr:YOUR_PUBKEY`
+2. Send sats to that address from any Bitcoin wallet
+3. Check balance at `/pay/.balance` — deposits are auto-detected
 4. Access paid resources — each request deducts the configured cost
-5. Optionally buy tokens (`/pay/.buy`) or withdraw as portable tokens (`/pay/.withdraw`)
-6. Balance tracked in a [Web Ledger](https://webledgers.org/) at `/.well-known/webledgers/webledgers.json`
+5. Withdraw sats as a portable voucher: `POST /pay/.withdraw-sats`
+6. Optionally buy tokens (`/pay/.buy`) or withdraw as portable tokens (`/pay/.withdraw`)
+7. Balance tracked in a [Web Ledger](https://webledgers.org/) at `/.well-known/webledgers/webledgers.json`
+
+Each user gets a unique taproot deposit address derived from the pod's master key + their identity. The pod auto-detects deposits by scanning the mempool API when you check your balance.
 
 ### Example
 
 ```bash
-# Check balance
+# Get your deposit address
+curl http://localhost:4443/pay/.address?chain=tbtc4&user=did:nostr:YOUR_PUBKEY
+# → {"address": "tb1p...", "chain": "tbtc4", "pubkey": "02..."}
+
+# Send sats to that address, then check balance (auto-detects deposits)
 curl -H "Authorization: Nostr <base64-event>" http://localhost:4443/pay/.balance
 
-# Deposit (post a confirmed transaction output)
+# Or deposit manually with a TXO voucher URI
 curl -X POST -H "Authorization: Nostr <base64-event>" \
   http://localhost:4443/pay/.deposit \
-  -d "txid:vout"
+  -d "txo:tbtc4:txid:vout?amount=X&key=Y"
+
+# Or claim a deposit to the pod's address
+curl -X POST -H "Authorization: Nostr <base64-event>" \
+  -H "Content-Type: application/json" \
+  http://localhost:4443/pay/.deposit \
+  -d '{"txid": "abc...", "vout": 0, "chain": "tbtc4"}'
 
 # Access paid resource
 curl -H "Authorization: Nostr <base64-event>" http://localhost:4443/pay/my-resource
 
+# Withdraw sats as a portable TXO voucher
+curl -X POST -H "Authorization: Nostr <base64-event>" \
+  -H "Content-Type: application/json" \
+  http://localhost:4443/pay/.withdraw-sats \
+  -d '{"amount": 10000, "chain": "tbtc4"}'
+# → {"voucher": "txo:tbtc4:txid:0?amount=10000&key=...", ...}
+
 # Buy tokens with sat balance
 curl -X POST -H "Authorization: Nostr <base64-event>" \
   -H "Content-Type: application/json" \
   http://localhost:4443/pay/.buy \
-  -d '{"amount": 100}'
+  -d '{"amount": 100, "currency": "tbtc4"}'
 
 # Withdraw entire balance as portable tokens
 curl -X POST -H "Authorization: Nostr <base64-event>" \
   -H "Content-Type: application/json" \
   http://localhost:4443/pay/.withdraw \
-  -d '{"all": true}'
+  -d '{"all": true, "currency": "tbtc4"}'
 ```
 
-Deposit verification uses the mempool API (default: testnet4). The `X-Balance` and `X-Cost` headers are returned on successful paid requests. Buy and withdraw return portable MRC20 proofs with Bitcoin anchor data for independent verification.
+Three deposit methods: (1) send to your per-user address and check balance (auto-detected), (2) TXO voucher URI with private key, (3) claim a txid after sending to the pod's address. The `X-Balance`, `X-Cost`, and `X-Pay-Currency` headers are returned on successful paid requests. Buy and withdraw return portable MRC20 proofs with Bitcoin anchor data for independent verification.
 
 ### Secondary Market
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "javascript-solid-server",
-  "version": "0.0.134",
+  "version": "0.0.136",
   "description": "A minimal, fast Solid server",
   "main": "src/index.js",
   "type": "module",

package/src/handlers/pay.js

@@ -311,6 +311,49 @@ export function createPayHandler(options = {}) {
         return reply.code(401).send({ error: 'NIP-98 authentication required' });
       }
       const didUri = pubkeyToDidNostr(pubkey);
+
+      // Auto-detect deposits to user's tweaked address (Phase 3)
+      if (payChains) {
+        try {
+          const kp = await loadOrCreateKeypair();
+          const utxos = await loadUtxos();
+          const ledger = await readLedger();
+          let credited = 0;
+
+          for (const chainId of payChains) {
+            const chain = CHAIN_REGISTRY[chainId];
+            const network = chainId === 'btc' ? 'mainnet' : (chainId === 'tbtc3' ? 'testnet' : 'testnet4');
+            const userAddr = btAddress(kp.pubkey, [didUri], network);
+
+            const resp = await fetch(`${chain.explorer}/address/${userAddr}/utxo`);
+            if (!resp.ok) continue;
+            const addrUtxos = await resp.json();
+
+            for (const u of addrUtxos) {
+              if (utxos.find(x => x.txid === u.txid && x.vout === u.vout)) continue;
+              // New UTXO — fetch tx for scriptpubkey, then auto-credit
+              let scriptpubkey = '';
+              try {
+                const txResp = await fetch(`${chain.explorer}/tx/${u.txid}`);
+                if (txResp.ok) {
+                  const txData = await txResp.json();
+                  scriptpubkey = txData.vout?.[u.vout]?.scriptpubkey || '';
+                }
+              } catch { /* best effort */ }
+              const currency = chain.unit;
+              credit(ledger, didUri, u.value, currency);
+              utxos.push({ txid: u.txid, vout: u.vout, amount: u.value, scriptpubkey, chain: chainId, tweak: didUri, spent: false });
+              credited += u.value;
+            }
+          }
+
+          if (credited > 0) {
+            await writeLedger(ledger);
+            await saveUtxos(utxos);
+          }
+        } catch { /* scan failure is non-fatal */ }
+      }
+
       const ledger = await readLedger();
       const response = {
         did: didUri,

package/src/notifications/websocket.js

@@ -204,11 +204,18 @@ export function broadcast(url) {
   // Notify direct subscribers
   notifySubscribers(url);
 
-  // Also notify container subscribers (parent directory)
-  // This allows subscribing to a container and getting notified of all child changes
-  const containerUrl = getParentContainer(url);
-  if (containerUrl && containerUrl !== url) {
+  // Walk up all ancestor containers so subscribing to a root
+  // catches changes in nested paths (e.g. /db/mydata/ catches /db/mydata/issues/1)
+  // Stop at the origin root to avoid climbing past the hostname
+  let originRoot;
+  try { originRoot = new URL(url).origin + '/'; } catch (e) { return; }
+
+  let currentUrl = url;
+  let containerUrl = getParentContainer(currentUrl);
+  while (containerUrl && containerUrl !== currentUrl && containerUrl.length >= originRoot.length) {
     notifySubscribers(containerUrl);
+    currentUrl = containerUrl;
+    containerUrl = getParentContainer(currentUrl);
   }
 }