Lamppost
Author a yard-sale item. It is signed by your own signer, its photo goes to Blossom, its offer is minted on your own node over CLINK, and the listing goes to public relays. Nothing here has a server of ours behind it.
1 · Your signer
Nothing in this app ever sees your key. It asks your signer to sign, and your signer decides.
In Amber: Scan a QR Code.
We are asking for these permissions up front, which is what makes the whole publish
cost one approval instead of one per event:
If your signer asks you to approve every single signature, its policy discarded the request. In Amber that is the “Approve basic actions” sign policy — change it to either of the “Manually approve…” options and reconnect. Nothing is broken; it just costs one tap per kind instead of one in total.
Signed in as
2 · Your node optional
No node — items will publish as cash-only, with no Buy button.
Run node spike/authorize-manage.ts once, on the machine with your node, and
paste the line it writes. This pointer addresses your account, so it stays in this
browser — it is never published and never sent anywhere but your own node.
3 · Your sale
This is the masthead at the top of your storefront, and it is one signed event that every item points at. Publish it once, then again whenever the details change or you want a new item listed in order.
4 · The item
5 · Your sale so far
Read straight off the public relays with no credential at all — the same events any visitor sees, which is why this list can exist in a page that holds no key.
Notes are encrypted to your own key and published as one event. Nobody else can read them — not a relay, not us, not a buyer. Nothing of ours stores them either; they live on the same relays as the sale, which is why they survive you closing this tab.
One sticker per unsold item, each with the item’s name, its price and a QR that opens that item’s page. Stick them on the things. Somebody scans a mug and lands on the mug, where they can pay for it — a code that pays directly would have to skip the refund address, and your node declines a payment it could not give back.
What is not here is what each sale was worth. CLINK Manage’s only resource is
the offer — there is no invoice or settlement resource anywhere in CLINK — and the
node’s own call for it, GetUserOfferInvoices, rides a request kind a signer
holding your key on your phone cannot construct. So a browser that never touches your
key cannot read your sales, and that is the cost of the custody claim rather than a
missing feature. Run node spike/sales-report.ts on the machine with your
node for amounts, timestamps and refund pointers.
6 · Give the watcher its ladder
Every future stock state of this item is now signed and waiting. Your watcher publishes them as things sell, which is how it updates the sale while holding no key of yours at all. It cannot get them off a relay — publishing the sold-out one would mark the item sold immediately — so you carry them across.
7 · Publish the sale as a website
Your storefront is a handful of static files. They go to Blossom servers as blobs, and a signed manifest on the relays says which blob is which path. That manifest is the whole site: no host, no DNS, no certificate, no account. It is served at your own npub, which is how the page knows whose sale to read.
Any NIP-5A host will serve it — the gateway is only where you point people. Changing it changes the URL printed on the flyer’s tear-off tabs, so set it before you deploy.
Gateways cache for an hour and serve the previous version until it lapses, while the relays and Blossom update in seconds. Do not redeploy on the day of the sale.