Zappable offer codes and per-name Lightning offers

CLINK offers (noffer): every wallet gets a static offer keypair (synced
across devices, first-minted wins) answering kind-21001 invoice
requests — from open tabs and from the service worker while closed,
which mints against the mirrored state (the record now carries chain-4
and chain-5 key windows) and raises an open-to-receive notification.
Zap requests ride along and their kind-9735 receipts publish once the
payment is claimed. The code is shown in the payment-address card for
pasting into a Nostr profile; the notifier watches and relays kind
21001 alongside NWC.

Payment names also gain a Lightning offer: the registrar creates a
BOLT 12 offer per name on the node and appends lno= to the DNS record;
a settle-forwarder pushes each received payment on to the name's ark
destination from a small float wallet (custody window: seconds between
Lightning settle and the ark send).

Name resolution now runs full client-side DNSSEC validation
(src/dnssec.js): binary DoH, root-anchor chain walk, RSA + ECDSA via
WebCrypto — the resolver is untrusted transport, verified against live
signed zones including the canonical BIP-353 test name.

Co-Authored-By: Claude Fable 5 <[email protected]>

1 files changed, 4 insertions, 3 deletions

diff --git a/src/features/ark.js b/src/features/ark.js
index c8a6b23..5ffd121 100644
--- a/src/features/ark.js
+++ b/src/features/ark.js
@@ -456,15 +456,16 @@ export function arkFeature(ctx) {
   // full manager state plus the chain-3 keys for its live coins and a window
   // of upcoming change indices (the worker cannot derive). nwc.js decides
   // WHEN to mirror (background answering on) and supplies the connections.
-  async function writeBgMirror(connections) {
+  async function writeBgMirror(connections, offer) {
     const cfg = getArkConfig();
     if (!cfg || !ark || !ark.info || !ark.state) return;
     const prev = await loadBg(wallet._cacheKey());
     const rec = buildBg({
       ark: { arkUrl: cfg.ark, esploraUrl: cfg.esplora, network: getNetwork(), serverPubkey: ark.info.serverPubkey },
       mgrState: ark.state,
-      keyFor: (i) => hex.encode(ark._key(i).privkey),
+      keyFor: (chain, i) => hex.encode(ark.account.deriveChild(chain).deriveChild(i).privateKey),
       connections,
+      offer,
     });
     if (prev) rec.spends = prev.spends; // the worker's log survives rewrites
     await saveBg(wallet._cacheKey(), rec);
@@ -1576,7 +1577,7 @@ export function arkFeature(ctx) {
     arkBgReady() { return !!(ark && ark.info && ark.state); },
     // nwc.js calls this (with its connections) whenever the mirror should
     // refresh: on enable, on connection changes, after payments, on a timer.
-    async arkBgWrite(connections) { return writeBgMirror(connections); },
+    async arkBgWrite(connections, offer) { return writeBgMirror(connections, offer); },
     async arkBgSpendableSat() {
       const rec = await loadBg(wallet._cacheKey());
       return ((rec && rec.mgr && rec.mgr.vtxos) || [])