How it works
Small tickets, used up as you go.
Not one Lightning payment per thing bought. Your app and the seller's app talk over an encrypted link; the money moves over ordinary XBT Lightning, a small ticket at a time; and shops are found on Nostr.
At a glance
Two apps, one link, and Lightning underneath.
When you buy, you find a shop on Nostr and allow it in spending rules you sign. Your app connects to the seller's app and pays small tickets from your own node as you use the service. The seller counts every byte, token or slice of work and signs a receipt.
When you sell, you point your app at something you already run: a web app such as Jellyfin, a folder of files, an AI model, miners, or your internet connection as a VPN exit. Your app lists it on Nostr, meters every answer, and you are paid into your own node.
The money moves only over Lightning, from your node to theirs. The link and the relays never carry money.
Tickets
Paid as you use it.
Pay a small ticket as the service starts. The seller draws it down, exactly, as it delivers. The next ticket is paid before the credit runs out, so no request waits for a payment.
- A ticket is an ordinary Lightning payment of under 1,000 sat: about 900 at today's shops.
- A prepaid ticket is collected as it arrives; the seller serves from that credit and counts every request against it in millisatoshis. Most calls on mainnet use these.
- The seller signs a receipt for every answer, bound to the request it paid for.
- Credit left with a seller is spent first the next time.
Held tickets
Locked along the route, released as you use it.
Normally the seller picks the secret that unlocks a payment, so the money is the seller's the moment it arrives. With a held ticket the buyer picks the secret, so the payment sits committed along the route and nobody can take it until the buyer releases the secret.
- Built on hold invoices, which Lightning nodes already have.
- Unused held tickets come back: the seller cancels them, or they expire and the money returns by itself.
- The proof of payment is the seller's signed receipt, with the payment on your own node.
- At mainnet's fee rates the wallet prepays rather than holding a ticket through a routing node.
Smaller than a ticket
A fair roll for tiny pieces.
Some pieces are worth less than any payment worth sending: a tenth of a sat for one piece of a file shared by forty sellers. So roll a fair die for each piece. Most rolls pay nothing; now and then one wins and pays an amount worth sending. The odds make the average the price.
- The seller fixes its half of every roll before the session; the buyer adds its half after each piece arrives. Neither can steer a roll, and both can check it.
- Exact on average, uneven in a short run, the way a miner's income is.
Built run on a regtest with 100 sellers paid at once, not in the app's everyday path. Not built a win that pays itself: not before a cryptographer has reviewed it.
Reaching a shop
Named by its key. No web address needed.
A buyer's app reaches a shop over an encrypted link straight to the seller's gateway, through both home routers where it can. The shop's Lightning node signs for each of its link keys, and the buyer's app checks that before it sends anything, so it knows it is talking to the shop it pays.
- Where the two ends can't connect directly, a relay carries the traffic. It is encrypted end to end: the relay never sees what is sent, and never carries money.
- In private mode a shop uses relays only, so buyers never learn its address.
- A shop serves on four link keys, each with its own relay connection: through a relay limited as ours is, one, two and four keys carried 46, 91 and 182 Mbit/s.
- The cost: a 4K film through a relay over a slow path started in 15 to 25 s in our lab, against 1 to 1.5 s straight from the server.
Hashrate
Rented miners, masked jobs.
A seller's miners work for your own gateway, the Stream Gateway (DATUM-compatible) that comes with the app, over an encrypted link. The hashtaker makes the jobs; the hashmaker runs no gateway.
- Every job is masked with a key the gateway holds, so a rented miner can't tell which share is a block and can't withhold one. The renter checks each job before its miners get it, and nothing is paid before the first job has been checked.
- Both apps check every share's proof of work, and you pay as the work arrives, seconds at a time.
- It mines solo, paid to your own address, or on Lazarus Pool, which takes jobs masked with your gateway's own key; a pool that doesn't is refused.
If a shop cheats
A small, stated amount. Then it's blocked.
A shop that cheats can keep at most a ticket or two for each answer it is sending you, plus a small allowance for each request: up to 16 MiB of data at its own price, an AI reply's quoted price, or a request priced by the second up to its limit.
Never past the listing
A price above the listing is refused before anything is paid. A file is never paid past its listed size.
Caught, then blocked
A shop that charges past the bound is blocked by its node, its receipt key and its address, until you lift the block with your approval key.
Capped anyway
One that cheats inside the bound is not caught, which is why your rules cap what any one shop is paid in a day and in a week.
Locked, not lost
Unused held tickets are locked for a few hours at most. The seller serves only from credit it was paid or a ticket it collected.
TICKETS.md states the bound exactly.
What Stream adds
Built on Lightning, not beside it.
Lightning's own routing, liquidity and nodes carry everything. Lightning Stream runs no network and no hub, and never holds anyone's money.
Lightning alone
One invoice, one payment
For one thing, paid in full, before or after it arrives.
Stream on Lightning
Paid as it arrives
Pay per byte, token, second or slice of work. A signed receipt for every answer. Rules you sign. Tickets refilled in time. A cap per seller.