Pay Podcasting 2.0 boosts (window.webln.keysend)

CHANGELOG.md

@@ -12,10 +12,18 @@ Update that section alongside this file as part of every release.
 ### Added
 - **Set a status (NIP-38).** A short line about what you are doing, published as kind 30315 and shown beside your name by clients that read it, shown as a small balloon over your banner on the Profile tab, which is also how you edit it. With no status there is no balloon: just a Set status button beside Edit profile. An optional link and an optional expiry ride along; the expiry is a request relays are asked to honor rather than required to, so Sidecar treats an expired status as gone regardless of what a relay still serves. Clearing publishes an empty status rather than a deletion request, because a status is a replaceable event and an empty one overwrites the old text everywhere the old text reached, while a deletion is a request any relay may ignore and anyone already holding it would keep showing. Only the general status is written: the spec's music status is meant to be published by whatever is playing the track, with an expiry matching when it stops, and a signer cannot see that.
 - **Four new sections in the guide.** Key backup, notifications, relays, and themes each had a What's new bullet and no explanation anywhere. Backup opens by saying plainly that a lost profile with no backup means the accounts are gone, since that is the section people go looking for at the worst possible moment.
+- **Keysend, so Podcasting 2.0 boosts work.** `window.webln.keysend` was a one-line stub that rejected every call before it left the page, which meant a boost never reached the wallet and the wallet was never the reason it failed. Boosts are keysend-only — a value split names node public keys and carries its boostagram in a TLV record rather than issuing an invoice — so there was no BOLT11 for the "Pay with Sidecar" card to fall back on either. Sidecar now pays them through your own NWC wallet, and the approval card names the show and the message rather than a bare node key, because 66 characters of hex is not something anyone can make a decision about. A boost is several payments, one per recipient in the split, and the card says so: set a spending limit and the rest of the split is covered by the same approval.
+- **`webln.getInfo` tells the truth about keysend.** The method list reported to pages was a hardcoded four, identical whatever wallet was behind it. Keysend is the one thing Sidecar cannot provide on its own, so it is now advertised only when the connected wallet actually has `pay_keysend` — a site that checks first gets an honest answer and can fall back to an invoice, instead of taking its keysend branch and failing at payment time. The other four are still reported unconditionally; deriving the whole list from the wallet would hide receive flows that work.
+- **Boosts are named in your history.** A keysend carries no invoice, no description and no zap request, so it would otherwise appear as a bare "Sent". Where a boostagram named the show, the row says so. Recorded only for boosts that carry a message: streaming sats emit a payment a minute, and filling the store with those would evict the zap labels it exists for.
 
 ### Changed
 - **The Recent activity screenshot in the guide** predated the verify tap-through, so it is retaken; its alt text now says which rows carry the button and why the row that signed nothing does not.
 
+### Fixed
+- **A site with a spending limit could spend past it in a burst.** The budget was checked before a payment and debited afterwards, in the bookkeeping that deliberately runs after the page has been answered — so the debit landed after the payment lock had already released, and anything queued behind it read a balance nobody had reduced yet. Four splits of one boost therefore cleared a budget with room for two, and two overlapping debits could lose one entirely. Budgets are now reserved in a single step before the money moves, and handed back only when the wallet explicitly refused, which is the one outcome that proves nothing was spent. At the pace a person clicks a zap this was invisible; a boost fires its splits back to back, which is exactly the timing that finds it.
+- **Keysend routing fees are counted against a site's spending limit.** A budget is reserved before the payment, so it can only book the amount — the fee is not known until the wallet answers. That is a rounding error for a zap, which routes to a well-connected LSP, and not for a keysend, which goes to whatever node a podcast's value split names: the first live boost paid a 1 sat fee on a 1 sat leg. Unbooked, a limit drifted by the whole routing cost of every boost, in the direction of letting more through.
+- **Zero and negative payment amounts are no longer covered by a budget.** `covers()` answered the question "is `remaining >= amount`", which says yes to zero even on an exhausted allowance, and yes to a negative — where the debit that followed *added* sats back. Neither could be reached through a BOLT11 invoice, which cannot express either, so this sat unreachable until keysend began taking its amount straight from the page.
+
 ## [1.12.0] — 2026-09-04
 
 ### Added

FEATURES.md

@@ -38,6 +38,10 @@ clients without ever pasting your nsec into a website.
   counterparty, fee, payment hash, preimage.
 - **WebLN** — web apps can pay and make invoices through your wallet, gated by
   approval with an optional per-site daily budget you can edit or revoke any time.
+- **Podcasting 2.0 boosts** — keysend payments with their boostagram, so value-split
+  shows can be boosted straight from the page. The approval card names the show and
+  the message rather than a bare node key, and a boost's splits are covered together
+  by one spending limit. Offered only when your wallet supports keysend.
 - **Pay from any page** — when a site shows a Lightning invoice, a "Pay with
   Sidecar" card appears (only on apps you're signed into). You can also right-click
   a `lightning:` link, a selected invoice, or a QR.

README.md

@@ -56,7 +56,7 @@ Connect) and a composer for posting notes directly from the panel.
   - **Client tag, your call** — posts carry a `client` tag attributing them to Sidecar; turn it off in Settings to post untagged.
 - **Notifications** — a bell in the header shows replies, mentions, reposts, reactions, and zaps for the active account — each with the sender's name, a content preview, and a tap-through that opens the note in your preferred client. Replies and comments can be answered without leaving the panel: the composer opens with what you're answering held above the editor, through the preview and the review countdown both, and follows NIP-10 for notes and NIP-22 for page comments. A web-of-trust sort puts your follows (and anyone ten of them follow) first, gathering everyone else into a counted group at the bottom rather than hiding them — a denylist can't outrun key rotation, but an allowlist that hides is how you miss the one reply that mattered. Muted users (public and private mute lists) are filtered out.
 - **Lightning wallet (NWC)** — connect any self-custody Lightning wallet over Nostr Wallet Connect. Send (BOLT11 or lightning address via LNURL-pay), receive (invoice or your lightning address, with a QR — also surfaced as a card on the wallet page), view live balance (auto-updating via NIP-47 notifications) and paginated history, and back up the connection to your relays — or export it (PIN-gated, with a QR) to move it to another app. New to Lightning? Built-in **wallet suggestions** point you to NWC-capable options. Sidecar never holds your funds.
-- **WebLN provider** — web apps can pay and make invoices through your connected wallet (`window.webln`), gated by an approval prompt with an optional per-site daily budget you can edit or revoke any time.
+- **WebLN provider** — web apps can pay and make invoices through your connected wallet (`window.webln`), gated by an approval prompt with an optional per-site daily budget you can edit or revoke any time. Includes **keysend**, so Podcasting 2.0 boosts and their boostagrams work on shows that split their value.
 - **Pay invoices from any page** — when a Nostr client you're signed into shows a Lightning invoice, a **Pay with Sidecar** card appears so you can pay in a tap. You can also right-click a `lightning:` link, a selected BOLT11 invoice, or a QR image.
 - **Auto-approve zaps** (optional, off by default) — pay zaps without a prompt up to a per-zap limit *and* a daily total you set. Verified zaps only; larger zaps, anything over the daily total, non-zaps, and a locked wallet still ask.
 - **Help & guides** — a built-in guide page, one click from the top bar, walks through accounts, how sites remember who you are, switching accounts, the client families, and the wallet.