feat(pit): buy names under someone else's TLD, paid via CoinPay (#127)

/pit now splits into Yours and Theirs. Yours is the endings you hold;
Theirs is everyone else's, and where an operator has set a price you can
buy a name under it -- foo.whatever without owning .whatever.

A TLD is closed for business until its operator prices it. Minting under
someone's namespace without their say-so is the thing the registry exists
to prevent, so listing is an explicit act and NULL -- where every existing
row starts -- means not for sale. Prices must be positive and finite: zero
or negative would let anyone drain a namespace for free, and NaN would be
stored and then charged.

Checkout reuses the existing CoinPay rails: the same payments/create call
as credit packs, the same webhook, the same conditional-UPDATE claim. That
webhook is the single URL CoinPay posts to, so it now settles whichever
kind of payment the id belongs to.

The name is quoted three times -- rendering, checkout, settlement --
because each gap is a place another buyer lands. An open checkout holds
the name for 30 minutes so two people do not both pay for it, and an
expired hold releases it so an abandoned checkout cannot lock a name
forever. The (tld,label) primary key remains the real arbiter.

When a buyer loses that last race they have paid for a name they cannot
have, so the purchase goes to `refund_due` and is logged rather than
swallowed. Nothing refunds it automatically yet -- that is money, and it
should be a deliberate action, not a side effect.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: ralyodio

apps/pwa/src/migrations/008_moshpit_sales.sql

@@ -0,0 +1,28 @@
+-- Selling names under a TLD you do not own.
+--
+-- A TLD is only open for business once its operator sets a price: minting
+-- under someone's namespace without their say-so is the thing the registry
+-- exists to prevent, so "for sale" has to be an explicit act, and NULL --
+-- the state every existing row starts in -- means not for sale.
+ALTER TABLE moshpit_tlds ADD COLUMN price_usd REAL;
+
+-- One row per CoinPay checkout for a name. Keyed on the payment id, so a
+-- webhook redelivery settles the same row rather than creating a second one.
+CREATE TABLE IF NOT EXISTS moshpit_name_purchases (
+  id          TEXT PRIMARY KEY,
+  tld         TEXT NOT NULL,
+  label       TEXT NOT NULL,
+  user_id     TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  amount_usd  REAL NOT NULL,
+  -- pending -> cleared, or -> refund_due when the name was taken between
+  -- checkout and confirmation. That last state is real money against a name
+  -- the buyer cannot have, so it is recorded rather than swallowed.
+  status      TEXT NOT NULL,
+  created_at  INTEGER NOT NULL,
+  -- How long this checkout holds the name against other buyers. The (tld,label)
+  -- primary key on moshpit_names is still the real arbiter; this only stops the
+  -- ordinary case of two people paying for the same name at the same time.
+  reserved_until INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_name_purchases_name ON moshpit_name_purchases(tld, label);
+CREATE INDEX IF NOT EXISTS idx_name_purchases_user ON moshpit_name_purchases(user_id);

apps/pwa/src/moshpit.mjs

@@ -18,7 +18,7 @@ export {
   normalizeMode, resolutionPreference,
 } from "./lib/moshpit-name.mjs";
 
-const COLS = `tld, user_id, owner_email, alias_of, created_at`;
+const COLS = `tld, user_id, owner_email, alias_of, price_usd, created_at`;
 
 export async function getTld(tld) {
   return get(`SELECT ${COLS} FROM moshpit_tlds WHERE tld = ?`, [tld]);
@@ -263,6 +263,131 @@ async function ownedName(tldInput, labelInput, userId) {
   return { ok: true, tld, label };
 }
 
+/* ---- selling names under a TLD ---- */
+
+/**
+ * Put a TLD up for sale, or take it down (`null`).
+ *
+ * Minting under someone's namespace without their say-so is exactly what the
+ * registry exists to prevent, so being open for business is an explicit act by
+ * the operator rather than a default. A price of null means closed, and every
+ * TLD that existed before this feature starts there.
+ */
+export async function setTldPrice({ tld: tldInput, userId, priceUsd }) {
+  const tld = normalizeTld(tldInput);
+  if (!tld) return { ok: false, error: "not a valid TLD" };
+  const owner = await getTld(tld);
+  if (!owner) return { ok: false, error: `.${tld} is not registered` };
+  if (owner.user_id !== userId) return { ok: false, error: `you do not own .${tld}` };
+
+  let price = null;
+  if (priceUsd !== null && priceUsd !== undefined && String(priceUsd).trim() !== "") {
+    price = Number(priceUsd);
+    // NaN/Infinity would be stored verbatim and then charged; a negative or
+    // zero price would let anyone drain the namespace for free.
+    if (!Number.isFinite(price) || price <= 0) return { ok: false, error: "price must be a positive number" };
+    if (price > 1_000_000) return { ok: false, error: "price is implausibly large" };
+    price = Math.round(price * 100) / 100;
+  }
+
+  await run(`UPDATE moshpit_tlds SET price_usd = ? WHERE tld = ?`, [price, tld]);
+  await logAction(tld, userId, price === null ? "unlist" : `list:${price}`);
+  return { ok: true, tld, priceUsd: price };
+}
+
+/** TLDs somebody else holds. `forSale` narrows to the ones actually buyable. */
+export async function listTldsNotOwnedBy(userId, { forSale = false, limit = 200 } = {}) {
+  const sql = `SELECT tld, user_id, owner_email, alias_of, price_usd, created_at
+               FROM moshpit_tlds
+               WHERE user_id IS NOT ?${forSale ? " AND price_usd IS NOT NULL" : ""}
+               ORDER BY price_usd IS NULL, created_at DESC LIMIT ?`;
+  return all(sql, [userId ?? "", limit]);
+}
+
+export async function getTldWithPrice(tld) {
+  return get(`SELECT tld, user_id, owner_email, alias_of, price_usd, created_at FROM moshpit_tlds WHERE tld = ?`, [tld]);
+}
+
+/** How long a checkout holds a name against other buyers. */
+export const RESERVATION_MS = 30 * 60 * 1000;
+
+/**
+ * Is this name buyable right now, and for how much?
+ *
+ * Checked before taking money and again before handing the name over, because
+ * the gap between those two is exactly where someone else's purchase lands.
+ */
+export async function quoteName({ tld: tldInput, label: labelInput, buyerId, now = Date.now() }) {
+  const tld = normalizeTld(tldInput);
+  const label = normalizeLabel(labelInput);
+  if (!tld || !label) return { ok: false, error: "not a valid name" };
+
+  const owner = await getTldWithPrice(tld);
+  if (!owner) return { ok: false, error: `.${tld} is not registered` };
+  if (owner.user_id === buyerId) return { ok: false, error: `you own .${tld} — mint names under it for free` };
+  if (owner.price_usd === null || owner.price_usd === undefined) {
+    return { ok: false, error: `.${tld} is not for sale` };
+  }
+  if (await getName(tld, label)) return { ok: false, error: `${label}.${tld} is already taken`, taken: true };
+
+  const held = await get(
+    `SELECT id FROM moshpit_name_purchases
+     WHERE tld = ? AND label = ? AND status = 'pending' AND reserved_until > ? LIMIT 1`,
+    [tld, label, now],
+  );
+  if (held) return { ok: false, error: `${label}.${tld} is in someone's checkout right now — try again shortly`, taken: true };
+
+  return { ok: true, tld, label, priceUsd: owner.price_usd, sellerId: owner.user_id };
+}
+
+/** Record a checkout so the webhook can settle it. */
+export async function openNamePurchase({ paymentId, tld, label, userId, amountUsd, now = Date.now() }) {
+  await run(
+    `INSERT INTO moshpit_name_purchases (id, tld, label, user_id, amount_usd, status, created_at, reserved_until)
+     VALUES (?,?,?,?,?, 'pending', ?, ?)`,
+    [paymentId, tld, label, userId, amountUsd, now, now + RESERVATION_MS],
+  );
+}
+
+/**
+ * Hand over a paid-for name. Idempotent on the payment id.
+ *
+ * The claim is a conditional UPDATE for the same reason the credit ledger uses
+ * one: CoinPay retries a webhook it never got an ack for, so two deliveries can
+ * be in flight at once and both read 'pending' before either write lands.
+ *
+ * If the name went to someone else in the meantime the buyer is owed a refund.
+ * That is money against a name they cannot have, so it is recorded as
+ * `refund_due` and logged rather than quietly dropped.
+ */
+export async function settleNamePurchase(paymentId) {
+  const p = await get(`SELECT * FROM moshpit_name_purchases WHERE id = ? AND status = 'pending'`, [paymentId]);
+  if (!p) return { ok: false, error: "no pending purchase for that payment" };
+
+  const claimed = await run(
+    `UPDATE moshpit_name_purchases SET status = 'settling' WHERE id = ? AND status = 'pending'`, [paymentId]);
+  if (!claimed.rowsAffected) return { ok: false, error: "already settled" };
+
+  try {
+    await run(`INSERT INTO moshpit_names (tld, label, user_id, target, created_at) VALUES (?,?,?,?,?)`,
+      [p.tld, p.label, p.user_id, null, Date.now()]);
+  } catch {
+    await run(`UPDATE moshpit_name_purchases SET status = 'refund_due' WHERE id = ?`, [paymentId]);
+    console.error(`[moshpit] ${p.label}.${p.tld} was taken before payment ${paymentId} settled — refund due to ${p.user_id}`);
+    return { ok: false, error: "name was taken before payment settled", refundDue: true };
+  }
+
+  await run(`UPDATE moshpit_name_purchases SET status = 'cleared' WHERE id = ?`, [paymentId]);
+  await logAction(p.tld, p.user_id, `bought:${p.label}`);
+  return { ok: true, tld: p.tld, label: p.label, userId: p.user_id };
+}
+
+export async function listNamePurchases(userId, limit = 50) {
+  return all(
+    `SELECT id, tld, label, amount_usd, status, created_at FROM moshpit_name_purchases
+     WHERE user_id = ? ORDER BY created_at DESC LIMIT ?`, [userId, limit]);
+}
+
 /* ---- resolution ---- */
 
 /**

apps/pwa/src/routes/credits.mjs

@@ -6,6 +6,7 @@ import { id } from "../lib/crypto.mjs";
 import { grant } from "../lib/credits.mjs";
 import { verifySignature } from "../lib/signature.mjs";
 import { requireAuth } from "../lib/session.mjs";
+import { settleNamePurchase } from "../moshpit.mjs";
 
 export const creditsRouter = Router();
 
@@ -66,6 +67,12 @@ creditsRouter.post("/webhooks/coinpay", async (req, res) => {
   const event = req.body?.type || req.body?.event;
   const payId = req.body?.data?.id || req.body?.payment_id || req.body?.id;
   if (event && CONFIRMED_EVENT.test(event) && payId) {
+    // CoinPay is configured with a single webhook URL, so this endpoint is the
+    // entry point for every kind of payment the app takes. A name purchase and
+    // a credit top-up are different rows in different tables; whichever one
+    // this id belongs to is the one that settles.
+    await settleNamePurchase(payId).catch((e) => console.error("[moshpit] settle failed:", e.message));
+
     const p = await get(`SELECT * FROM credit_purchases WHERE id = ? AND status = 'pending'`, [payId]);
     if (p) {
       // Claim the purchase atomically, the same way /cli/token claims auth

apps/pwa/src/routes/moshpit.mjs

@@ -19,9 +19,11 @@ import {
   getTld, listTlds, listTldsForUser, registerTld, normalizeLabel,
   setAlias, clearAlias, listExempt, setExempt, clearExempt,
   listNames, registerName, setNameTarget, releaseName,
+  setTldPrice, listTldsNotOwnedBy, quoteName, openNamePurchase,
   resolveMoshpitName, normalizeTld, tldRejection,
   normalizeMode, resolutionPreference,
 } from "../moshpit.mjs";
+import { config } from "../config.mjs";
 
 export const moshpitRouter = Router();
 
@@ -145,6 +147,87 @@ moshpitRouter.delete("/api/moshpit/tlds/:tld/names", async (req, res) => {
   res.json({ tld: normalizeTld(req.params.tld), label: normalizeLabel(req.body?.label), released: true });
 });
 
+/* ---- the market ---- */
+
+/** TLDs other people hold. `?for_sale=1` narrows to the buyable ones. */
+moshpitRouter.get("/api/moshpit/market", async (req, res) => {
+  const tlds = await listTldsNotOwnedBy(req.user?.id ?? null, { forSale: Boolean(req.query.for_sale) });
+  res.json({
+    tlds: tlds.map((t) => ({
+      tld: t.tld, alias_of: t.alias_of, price_usd: t.price_usd,
+      for_sale: t.price_usd !== null && t.price_usd !== undefined,
+    })),
+  });
+});
+
+/** What a name would cost, and whether it can be bought at all. */
+moshpitRouter.get("/api/moshpit/tlds/:tld/quote", async (req, res) => {
+  const q = await quoteName({ tld: req.params.tld, label: req.query.label, buyerId: req.user?.id ?? null });
+  if (!q.ok) return bad(res, q.error, q.taken ? 409 : 400);
+  res.json({ tld: q.tld, label: q.label, price_usd: q.priceUsd });
+});
+
+moshpitRouter.put("/api/moshpit/tlds/:tld/price", async (req, res) => {
+  if (!req.user) return unauthorized(res);
+  const result = await setTldPrice({ tld: req.params.tld, userId: req.user.id, priceUsd: req.body?.price_usd });
+  if (!result.ok) return bad(res, result.error || "could not set that price");
+  res.json({ tld: result.tld, price_usd: result.priceUsd });
+});
+
+/**
+ * Start a CoinPay checkout for `label.tld`.
+ *
+ * The quote is taken again here rather than trusted from the page the buyer was
+ * looking at: prices change, and names get taken, between rendering and
+ * clicking. settleNamePurchase checks a third time, because the gap between
+ * paying and confirming is where the last race lives.
+ */
+async function startCheckout(req, res, { json }) {
+  const q = await quoteName({ tld: req.params.tld, label: req.body?.label, buyerId: req.user.id });
+  if (!q.ok) {
+    return json ? bad(res, q.error, q.taken ? 409 : 400) : back(res, { err: q.error });
+  }
+  if (!config.coinpay.businessId) {
+    const msg = "payments are not configured yet";
+    return json ? bad(res, msg, 503) : back(res, { err: msg });
+  }
+
+  try {
+    const r = await fetch(`${config.coinpay.apiBase}/api/payments/create`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        business_id: config.coinpay.businessId,
+        amount: q.priceUsd,
+        currency: "USD",
+        payment_method: "both",
+        metadata: { app: "moshcode", kind: "moshpit_name", user_id: req.user.id, tld: q.tld, label: q.label },
+        redirect_url: `${config.origin}/pit?bought=${encodeURIComponent(`${q.label}.${q.tld}`)}`,
+      }),
+    });
+    const pay = await r.json();
+    const payId = pay.id || pay.payment_id;
+    if (!payId) throw new Error("no payment id in response");
+
+    // Recorded before the buyer leaves for the payment page: the webhook can
+    // arrive before they are redirected back, and with no row it has nothing
+    // to settle.
+    await openNamePurchase({ paymentId: payId, tld: q.tld, label: q.label, userId: req.user.id, amountUsd: q.priceUsd });
+
+    const url = pay.hosted_url || pay.url || `${config.coinpay.apiBase}/pay/${payId}`;
+    return json ? res.status(201).json({ payment_id: payId, checkout_url: url, price_usd: q.priceUsd }) : res.redirect(url);
+  } catch (e) {
+    console.error("[moshpit] checkout failed:", e.message);
+    const msg = "could not start checkout";
+    return json ? bad(res, msg, 502) : back(res, { err: msg });
+  }
+}
+
+moshpitRouter.post("/api/moshpit/tlds/:tld/buy", async (req, res) => {
+  if (!req.user) return unauthorized(res);
+  return startCheckout(req, res, { json: true });
+});
+
 /**
  * Resolve a name, and say what a resolver should DO with the answer.
  *
@@ -196,13 +279,16 @@ const PIT_CSS = `
 .pit-names{margin-top:12px;padding-top:10px;border-top:1px dashed var(--line)}
 .pit-name{background:var(--bg-tint);border-radius:8px;padding:6px 10px;margin-bottom:6px}
 .pit-name .mono{min-width:150px}
+.pit-forsale{border-color:color-mix(in srgb,var(--acid) 35%,var(--line))}
 .pit-msg{border-radius:8px;padding:10px 14px;margin:14px 0;font-family:var(--mono);font-size:.84rem}
 .pit-msg.err{border:1px solid var(--danger);color:var(--danger)}
 .pit-msg.ok{border:1px solid var(--acid);color:var(--acid)}`;
 
+const forSale = (t) => t.price_usd !== null && t.price_usd !== undefined;
+
 moshpitRouter.get("/pit", async (req, res) => {
-  const [registry, mine, bal] = await Promise.all([
-    listTlds(50),
+  const [theirs, mine, bal] = await Promise.all([
+    listTldsNotOwnedBy(req.user?.id ?? null, { limit: 100 }),
     req.user ? listTldsForUser(req.user.id) : [],
     req.user ? balance(req.user.id) : 0,
   ]);
@@ -263,13 +349,42 @@ moshpitRouter.get("/pit", async (req, res) => {
               (exemptions.get(t.tld) || []).map((l) => `${esc(l)}.${esc(t.tld)}`).join(" · ") || "none held back"
             }</span>
           </form>` : ""}
+          <form method="post" action="/pit/${esc(t.tld)}/price" class="pit-row">
+            ${csrfInput(req)}
+            <span class="mono faint" style="font-size:.72rem">sell names for $</span>
+            <input name="price_usd" inputmode="decimal" placeholder="0.00"
+                   value="${t.price_usd === null || t.price_usd === undefined ? "" : esc(String(t.price_usd))}"
+                   autocomplete="off" style="min-width:90px">
+            <button class="btn" type="submit">${forSale(t) ? "Update price" : "List for sale"}</button>
+            ${forSale(t) ? `<button class="btn" type="submit" name="unlist" value="1">Unlist</button>` : ""}
+            <span class="mono ${forSale(t) ? "acid" : "faint"}" style="font-size:.72rem">${
+              forSale(t) ? `anyone can buy a name under .${esc(t.tld)}` : "closed — only you can mint here"
+            }</span>
+          </form>
         </div>`).join("")
       : `<p class="dim">You don't hold a TLD yet. Claim one above.</p>`;
 
-  const registryHtml = registry.length
-    ? `<ul class="mono dim" style="line-height:1.9;padding-left:18px">${registry.map((t) =>
-        `<li><span class="acid">.${esc(t.tld)}</span>${t.alias_of ? ` → .${esc(t.alias_of)}` : ""}</li>`).join("")}</ul>`
-    : `<p class="dim">Nothing claimed yet.</p>`;
+  // Sorted so the ones you can actually act on come first.
+  const theirsHtml = theirs.length
+    ? theirs.map((t) => `
+      <div class="pit-tld${forSale(t) ? " pit-forsale" : ""}">
+        <div class="pit-row" style="margin:0;justify-content:space-between">
+          <h3 class="${forSale(t) ? "acid" : "dim"}" style="font-family:var(--mono);font-size:1.05rem;text-transform:none">
+            .${esc(t.tld)}${t.alias_of ? `<span class="faint"> → .${esc(t.alias_of)}</span>` : ""}
+          </h3>
+          <span class="pill${forSale(t) ? " on" : ""}">${forSale(t) ? `$${esc(String(t.price_usd))} a name` : "not for sale"}</span>
+        </div>
+        ${forSale(t) ? (req.user ? `
+        <form method="post" action="/pit/${esc(t.tld)}/buy" class="pit-row">
+          ${csrfInput(req)}
+          <input name="label" placeholder="the name you want" autocomplete="off" spellcheck="false" required>
+          <span class="mono faint">.${esc(t.tld)}</span>
+          <button class="btn acid" type="submit">Buy for $${esc(String(t.price_usd))}</button>
+        </form>`
+        : `<p class="mono faint" style="font-size:.72rem;margin:8px 0 0"><a class="acid" href="/">Sign in</a> to buy a name here.</p>`)
+        : ""}
+      </div>`).join("")
+    : `<p class="dim">Nobody else holds a TLD yet.</p>`;
 
   res.type("html").send(page({
     title: "moshcode ▸ the pit",
@@ -288,9 +403,18 @@ moshpitRouter.get("/pit", async (req, res) => {
   ${msg}
   ${req.user ? claimForm(req) : ""}
   <h2 style="margin-top:34px;font-size:1.2rem">Yours</h2>
+  <p class="dim" style="max-width:62ch;margin:4px 0 14px">
+    Endings you hold. Names under them are yours to mint for nothing — or put a price on the
+    ending and let anyone buy one.
+  </p>
   ${mineHtml}
-  <h2 style="margin-top:34px;font-size:1.2rem">The registry</h2>
-  ${registryHtml}
+  <h2 style="margin-top:34px;font-size:1.2rem">Theirs</h2>
+  <p class="dim" style="max-width:62ch;margin:4px 0 14px">
+    Endings somebody else holds. Where the operator has set a price you can buy a name under it —
+    <span class="mono">foo.whatever</span> without owning <span class="mono">.whatever</span>. Paid in crypto
+    through CoinPay; the name lands the moment the payment confirms.
+  </p>
+  ${theirsHtml}
 </main>${footer}`,
   }));
 });
@@ -338,6 +462,21 @@ moshpitRouter.post("/pit/:tld/names", requireAuth, async (req, res) => {
   back(res, { ok: done });
 });
 
+moshpitRouter.post("/pit/:tld/price", requireAuth, async (req, res) => {
+  const result = await setTldPrice({
+    tld: req.params.tld, userId: req.user.id,
+    priceUsd: req.body?.unlist ? null : req.body?.price_usd,
+  });
+  if (!result.ok) return back(res, { err: result.error || "could not set that price" });
+  back(res, {
+    ok: result.priceUsd === null
+      ? `.${result.tld} is no longer for sale.`
+      : `.${result.tld} names now cost $${result.priceUsd}.`,
+  });
+});
+
+moshpitRouter.post("/pit/:tld/buy", requireAuth, (req, res) => startCheckout(req, res, { json: false }));
+
 moshpitRouter.post("/pit/:tld/exempt", requireAuth, async (req, res) => {
   const result = await setExempt({ tld: req.params.tld, label: req.body?.label, userId: req.user.id });
   if (!result.ok) return back(res, { err: result.error || "could not exempt that name" });