Add Nostr Wallet Connect (NIP-47) — hal as a wallet service

Other apps can connect over nostr and pay from this wallet without touching
its keys, within a per-payment and daily budget the user sets, revocable at
any time. hal holds no native Lightning balance, so every operation runs over
Ark: pay_invoice takes the swap bridge when configured and falls back to the
ASP's lightning-send, make_invoice mints on the ASP. NWC availability
therefore tracks Ark availability.

- kinds 13194/23194/23195, nip44_v2 and nip04, replying in whichever scheme
  the request used; every request gets a reply so clients never hang
- each connection gets its own service keypair, so revoking one can't affect
  the others and none is tied to the user's nostr identity
- budgets are checked BEFORE spending, not reconciled after
- requests are ignored unless signed by that connection's client key, and
  replayed/stale events (>120s) can't re-trigger a payment
- Settings card to create, show (URI + QR) and revoke connections, and it
  says plainly that this only works while a tab is open

tools/nwc-test.js drives it as a real client: both encryption schemes, budget
refusal with a genuine over-limit invoice, unsupported-method errors, and a
request from an unauthorized key being ignored.

Co-Authored-By: Claude Fable 5 <[email protected]>

1 files changed, 13 insertions, 0 deletions

diff --git a/src/i18n.js b/src/i18n.js
index 91fef4b..b9371e7 100644
--- a/src/i18n.js
+++ b/src/i18n.js
@@ -435,6 +435,19 @@ const STR = {
     arkLnPayFailed: 'Payment failed',
     arkLnRefunded: 'Payment failed — funds returned to your Ark balance.',
     arkLnPaidTitle: 'Paid!',
+    nwcTitle: 'Nostr Wallet Connect',
+    nwcDesc: 'Let another app pay from this wallet over nostr — it never sees your keys, only spends within the limits you set, and you can cut it off at any time. Payments go out over Ark.',
+    nwcTabWarning: 'Only works while Hal is open in a tab — it is not an always-on service.',
+    nwcAdd: 'Add a connection',
+    nwcAppName: 'App name (e.g. Damus)',
+    nwcMaxPayment: 'Max per payment (sats)',
+    nwcDailyBudget: 'Daily budget (sats)',
+    nwcCreate: 'Create connection',
+    nwcShow: 'Show connection string',
+    nwcCopy: 'Copy connection string',
+    nwcRevoke: 'Revoke',
+    nwcRevoked: 'Revoked {name}',
+    nwcLimits: 'Max {max}/payment · {day}/day · {spent} spent today',
     arkBridgeTitle: 'Lightning swap bridge',
     arkBridgeDesc: 'Optional third-party service that pays Lightning invoices from your Ark balance, usually cheaper than the Ark server itself. Trustless: your sats are locked in a hash contract the bridge can only take by actually paying your invoice.',
     arkBridgeUrl: 'Bridge URL',