Month 7: Subscription Manager + Nostr Chat

Period: July 5 - August 5, 2026 Status: Planned Depends on: Month 6 (NWC Proxy Lite + Lightning Compliance + Listener)

Summary

Month 7 turns LaWallet NWC into something operators can monetize. The headline deliverable is the Subscription Manager: operator-defined paid tiers (monthly or one-time) that unlock perks for users. Nostr Chat (DMs) lands alongside it so users can talk to each other and operators can broadcast to segments.

The legacy "Subscription Manager (admin)" entry from M5 has been renamed to Follower Capture Endpoint; the name is reused here for the paid-tier feature.

---

Goals

• Operator-defined subscription plans (price in sats, monthly or one-time, perk flags)
• Subscription purchase via NWC Proxy Lite invoices; daily expiry cron in apps/listener
• Vanity / premium Lightning address perk
• Email-to-Nostr bridge perk (username+inbox@domain.com)
• Sat allowance perk — TokenAllocation ledger credited monthly, consumed by M8 Agents first
• Nostr Chat — DMs over NIP-17 / NIP-44 (NIP-04 fallback); messages live on relays
• Operator → user broadcast via instance nsec, segmented by tier
• No new containers — all work folds into apps/web and apps/listener

---

Subscription Manager (Paid Tiers)

Plans

• SubscriptionPlan model: name, slug, priceSats, interval (MONTHLY | ONE_TIME), perks (Json), isActive
• Perks stored as flags: vanityAddress, emailBridge, satAllowance (with monthly grant amount)
• Admin UI in Settings → Subscriptions: create / edit / archive plans, view active subscribers

Purchase flow

1. User clicks Subscribe on a plan
2. apps/web mints an invoice via NWC Proxy Lite (M6) addressed to the operator's wallet
3. User pays from their NWC wallet
4. apps/listener receives the payment event, POSTs to apps/web webhook
5. apps/web activates Subscription.status = ACTIVE, sets expiresAt, unlocks perks

Lifecycle

• Daily cron in apps/listener flips expired subscriptions to EXPIRED and revokes perks
• Renewal flow: re-pay before expiry → expiresAt extends by interval

Sat Allowance

• TokenAllocation model: userId, satsRemaining, satsGranted, sourceSubscriptionId?, expiresAt
• Monthly cron credits SUBSCRIPTION_GRANT rows from active subscriptions
• Consumed by M8 Agent runs before falling back to NWC payment
• Never converts to spendable Lightning sats — it's a usage credit

---

Email-to-Nostr Bridge

A subscription perk that bridges incoming email into Nostr DMs.

• Each subscriber gets <username>+inbox@<domain> as a sub-addressed inbox
• MX is handled by an inbound provider (Resend Inbound or Amazon SES)
• Provider POSTs parsed email JSON to POST /api/email-bridge/inbound
• apps/web validates the destination user has the perk active, then forwards to apps/listener
• Listener signs a NIP-44 DM with the instance nsec and publishes to the recipient's preferred relays

---

Nostr Chat (DMs)

Protocol stack

• NIP-17 gift-wrapped DMs as the default
• NIP-44 for the inner encryption
• NIP-04 fallback for legacy clients

Architecture

• Messages live entirely on relays — apps/web does not store message bodies
• ChatThread model stores per-user thread metadata only (last-seen, mute, pinned)
• Frontend consumes the user's preferred relays directly (NIP-65 relay list)
• New chat surface in the user wallet: thread list, message view, compose

Operator → User Broadcast

• Admin UI: Communications → Broadcast — pick a segment (active subscribers, all users, single tier), compose, preview
• Backend signs NIP-44 DMs with the instance nsec introduced in M5 (Follower Capture Endpoint)
• Listener publishes to recipients' preferred relays
• Rate-limited; broadcast log persisted

---

Architecture Notes

• No new containers. Container count stays at 3 (web, listener, nwc-proxy).
• apps/listener gains: subscription expiry cron (daily), email-bridge inbound dispatch, DM publish.
• NWC Proxy Lite (M6) is reused for all subscription invoice creation.
• M5 instance-nsec mechanism is reused for email-bridge DMs and operator broadcast.

---

Acceptance Criteria