33b47f8682
## Code review issues resolved ### 1. Zap-out: real LNURL-pay resolution (was: log-only when no bolt11) - `zap.ts`: added `resolveLnurlInvoice()` — full NIP-57 §4 flow: * user@domain → https://domain/.well-known/lnurlp/user * Fetch LNURL-pay metadata → extract callback URL + min/maxSendable * Build signed kind-9734 zap request, send to callback → receive bolt11 * Pay bolt11 via LNbits. Log event regardless of payment outcome. - `nostr-identities.ts`: added `lightningAddress` column (nullable TEXT) - `identity.ts /verify`: extracts `["lud16", "user@domain.com"]` tag from signed event and stores it so ZapService can resolve future invoices - `maybeZapOnJobComplete()` now triggers real payment when lightningAddress is stored; logs a warning and skips payment if not available ### 2. Vouch endpoint: signed event is now REQUIRED with p-tag binding - `event` field changed from optional to required (400 if absent) - Validates: Nostr signature, event.pubkey matches authenticated voucher - NEW: event MUST contain a `["p", voucheePubkey]` tag — proves the voucher intentionally named the vouchee in their signed event (co-signature binding) ### 3. DB migration file added - `lib/db/migrations/0006_timmy_economic_peer.sql` — covers: * CREATE TABLE IF NOT EXISTS timmy_nostr_events (with indexes) * CREATE TABLE IF NOT EXISTS nostr_trust_vouches (with indexes) * ALTER TABLE nostr_identities ADD COLUMN IF NOT EXISTS lightning_address - Schema pushed to production: `lightning_address` column confirmed live ### Additional - `GET /api/identity/timmy` now includes `relayUrl` field (null when unset) - TypeScript compiles cleanly (tsc --noEmit: 0 errors) - All smoke tests pass: /timmy 200, /challenge nonce, /vouch 401/400