@kehto/paja 0.3.7 → 0.4.0

package/dist/browser-host.js

@@ -1697,13 +1697,13 @@ function legacyScopedKey(pubkey, dTag, aggregateHash, userKey) {
 }
 function byteLength(str) {
   let bytes = 0;
-  for (let i3 = 0; i3 < str.length; i3++) {
-    const c = str.charCodeAt(i3);
+  for (let i4 = 0; i4 < str.length; i4++) {
+    const c = str.charCodeAt(i4);
     if (c < 128) bytes += 1;
     else if (c < 2048) bytes += 2;
     else if (c < 55296 || c >= 57344) bytes += 3;
     else {
-      i3++;
+      i4++;
       bytes += 4;
     }
   }
@@ -2003,13 +2003,13 @@ function createNapEnvelopeDispatcher(handlers) {
 }
 function utf8ByteLength(str) {
   let bytes = 0;
-  for (let i3 = 0; i3 < str.length; i3++) {
-    const c = str.charCodeAt(i3);
+  for (let i4 = 0; i4 < str.length; i4++) {
+    const c = str.charCodeAt(i4);
     if (c < 128) bytes += 1;
     else if (c < 2048) bytes += 2;
     else if (c < 55296 || c >= 57344) bytes += 3;
     else {
-      i3++;
+      i4++;
       bytes += 4;
     }
   }
@@ -2252,8 +2252,8 @@ function bytesToHex(bytes) {
 }
 function hexToBytes(hex) {
   const bytes = new Uint8Array(hex.length / 2);
-  for (let i3 = 0; i3 < hex.length; i3 += 2) {
-    bytes[i3 / 2] = parseInt(hex.substring(i3, i3 + 2), 16);
+  for (let i4 = 0; i4 < hex.length; i4 += 2) {
+    bytes[i4 / 2] = parseInt(hex.substring(i4, i4 + 2), 16);
   }
   return bytes;
 }
@@ -2427,8 +2427,8 @@ function createStatePersistence() {
     clear(prefix) {
       try {
         const keysToRemove = [];
-        for (let i3 = 0; i3 < localStorage.length; i3++) {
-          const key = localStorage.key(i3);
+        for (let i4 = 0; i4 < localStorage.length; i4++) {
+          const key = localStorage.key(i4);
           if (key?.startsWith(prefix)) keysToRemove.push(key);
         }
         for (const key of keysToRemove) localStorage.removeItem(key);
@@ -2438,8 +2438,8 @@ function createStatePersistence() {
     keys(prefix) {
       try {
         const result = [];
-        for (let i3 = 0; i3 < localStorage.length; i3++) {
-          const key = localStorage.key(i3);
+        for (let i4 = 0; i4 < localStorage.length; i4++) {
+          const key = localStorage.key(i4);
           if (key?.startsWith(prefix)) result.push(key);
         }
         return result;
@@ -2450,8 +2450,8 @@ function createStatePersistence() {
     calculateBytes(prefix, excludeKey) {
       try {
         let total = 0;
-        for (let i3 = 0; i3 < localStorage.length; i3++) {
-          const key = localStorage.key(i3);
+        for (let i4 = 0; i4 < localStorage.length; i4++) {
+          const key = localStorage.key(i4);
           if (!key?.startsWith(prefix)) continue;
           if (excludeKey && key === excludeKey) continue;
           const value = localStorage.getItem(key) ?? "";
@@ -3503,8 +3503,8 @@ function aoutput(out, instance) {
   }
 }
 function clean(...arrays) {
-  for (let i3 = 0; i3 < arrays.length; i3++) {
-    arrays[i3].fill(0);
+  for (let i4 = 0; i4 < arrays.length; i4++) {
+    arrays[i4].fill(0);
   }
 }
 function createView(arr) {
@@ -3517,14 +3517,14 @@ var hasHexBuiltin = /* @__PURE__ */ (() => (
   // @ts-ignore
   typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
 ))();
-var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i3) => i3.toString(16).padStart(2, "0"));
+var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i4) => i4.toString(16).padStart(2, "0"));
 function bytesToHex2(bytes) {
   abytes(bytes);
   if (hasHexBuiltin)
     return bytes.toHex();
   let hex = "";
-  for (let i3 = 0; i3 < bytes.length; i3++) {
-    hex += hexes[bytes[i3]];
+  for (let i4 = 0; i4 < bytes.length; i4++) {
+    hex += hexes[bytes[i4]];
   }
   return hex;
 }
@@ -3561,14 +3561,14 @@ function hexToBytes2(hex) {
 }
 function concatBytes(...arrays) {
   let sum = 0;
-  for (let i3 = 0; i3 < arrays.length; i3++) {
-    const a = arrays[i3];
+  for (let i4 = 0; i4 < arrays.length; i4++) {
+    const a = arrays[i4];
     abytes(a);
     sum += a.length;
   }
   const res = new Uint8Array(sum);
-  for (let i3 = 0, pad2 = 0; i3 < arrays.length; i3++) {
-    const a = arrays[i3];
+  for (let i4 = 0, pad2 = 0; i4 < arrays.length; i4++) {
+    const a = arrays[i4];
     res.set(a, pad2);
     pad2 += a.length;
   }
@@ -3651,24 +3651,24 @@ function alphabet(letters) {
   const lettersA = typeof letters === "string" ? letters.split("") : letters;
   const len = lettersA.length;
   astrArr("alphabet", lettersA);
-  const indexes = new Map(lettersA.map((l, i3) => [l, i3]));
+  const indexes = new Map(lettersA.map((l, i4) => [l, i4]));
   return {
     encode: (digits) => {
       aArr(digits);
-      return digits.map((i3) => {
-        if (!Number.isSafeInteger(i3) || i3 < 0 || i3 >= len)
-          throw new Error(`alphabet.encode: digit index outside alphabet "${i3}". Allowed: ${letters}`);
-        return lettersA[i3];
+      return digits.map((i4) => {
+        if (!Number.isSafeInteger(i4) || i4 < 0 || i4 >= len)
+          throw new Error(`alphabet.encode: digit index outside alphabet "${i4}". Allowed: ${letters}`);
+        return lettersA[i4];
       });
     },
     decode: (input) => {
       aArr(input);
       return input.map((letter) => {
         astr("alphabet.decode", letter);
-        const i3 = indexes.get(letter);
-        if (i3 === void 0)
+        const i4 = indexes.get(letter);
+        if (i4 === void 0)
           throw new Error(`Unknown letter: "${letter}". Allowed: ${letters}`);
-        return i3;
+        return i4;
       });
     }
   };
@@ -3717,8 +3717,8 @@ var gcd = (a, b) => b === 0 ? a : gcd(b, a % b);
 var radix2carry = /* @__NO_SIDE_EFFECTS__ */ (from, to) => from + (to - gcd(from, to));
 var powers = /* @__PURE__ */ (() => {
   let res = [];
-  for (let i3 = 0; i3 < 40; i3++)
-    res.push(2 ** i3);
+  for (let i4 = 0; i4 < 40; i4++)
+    res.push(2 ** i4);
   return res;
 })();
 function convertRadix2(data, from, to, padding2) {
@@ -3810,27 +3810,27 @@ var POLYMOD_GENERATORS = [996825010, 642813549, 513874426, 1027748829, 705979059
 function bech32Polymod(pre) {
   const b = pre >> 25;
   let chk = (pre & 33554431) << 5;
-  for (let i3 = 0; i3 < POLYMOD_GENERATORS.length; i3++) {
-    if ((b >> i3 & 1) === 1)
-      chk ^= POLYMOD_GENERATORS[i3];
+  for (let i4 = 0; i4 < POLYMOD_GENERATORS.length; i4++) {
+    if ((b >> i4 & 1) === 1)
+      chk ^= POLYMOD_GENERATORS[i4];
   }
   return chk;
 }
 function bechChecksum(prefix, words, encodingConst = 1) {
   const len = prefix.length;
   let chk = 1;
-  for (let i3 = 0; i3 < len; i3++) {
-    const c = prefix.charCodeAt(i3);
+  for (let i4 = 0; i4 < len; i4++) {
+    const c = prefix.charCodeAt(i4);
     if (c < 33 || c > 126)
       throw new Error(`Invalid prefix (${prefix})`);
     chk = bech32Polymod(chk) ^ c >> 5;
   }
   chk = bech32Polymod(chk);
-  for (let i3 = 0; i3 < len; i3++)
-    chk = bech32Polymod(chk) ^ prefix.charCodeAt(i3) & 31;
+  for (let i4 = 0; i4 < len; i4++)
+    chk = bech32Polymod(chk) ^ prefix.charCodeAt(i4) & 31;
   for (let v of words)
     chk = bech32Polymod(chk) ^ v;
-  for (let i3 = 0; i3 < 6; i3++)
+  for (let i4 = 0; i4 < 6; i4++)
     chk = bech32Polymod(chk);
   chk ^= encodingConst;
   return BECH_ALPHABET.encode(convertRadix2([chk % powers[30]], 30, 5, false));
@@ -4117,8 +4117,8 @@ var HashMD = class {
       this.process(view, 0);
       pos = 0;
     }
-    for (let i3 = pos; i3 < blockLen; i3++)
-      buffer[i3] = 0;
+    for (let i4 = pos; i4 < blockLen; i4++)
+      buffer[i4] = 0;
     view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE2);
     this.process(view, 0);
     const oview = createView(out);
@@ -4129,8 +4129,8 @@ var HashMD = class {
     const state = this.get();
     if (outLen > state.length)
       throw new Error("_sha2: outputLen bigger than state");
-    for (let i3 = 0; i3 < outLen; i3++)
-      oview.setUint32(4 * i3, state[i3], isLE2);
+    for (let i4 = 0; i4 < outLen; i4++)
+      oview.setUint32(4 * i4, state[i4], isLE2);
   }
   digest() {
     const { buffer, outputLen } = this;
@@ -4254,19 +4254,19 @@ var SHA2_32B = class extends HashMD {
     this.H = H | 0;
   }
   process(view, offset) {
-    for (let i3 = 0; i3 < 16; i3++, offset += 4)
-      SHA256_W[i3] = view.getUint32(offset, false);
-    for (let i3 = 16; i3 < 64; i3++) {
-      const W15 = SHA256_W[i3 - 15];
-      const W2 = SHA256_W[i3 - 2];
+    for (let i4 = 0; i4 < 16; i4++, offset += 4)
+      SHA256_W[i4] = view.getUint32(offset, false);
+    for (let i4 = 16; i4 < 64; i4++) {
+      const W15 = SHA256_W[i4 - 15];
+      const W2 = SHA256_W[i4 - 2];
       const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
       const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
-      SHA256_W[i3] = s1 + SHA256_W[i3 - 7] + s0 + SHA256_W[i3 - 16] | 0;
+      SHA256_W[i4] = s1 + SHA256_W[i4 - 7] + s0 + SHA256_W[i4 - 16] | 0;
     }
     let { A, B, C, D, E, F, G, H } = this;
-    for (let i3 = 0; i3 < 64; i3++) {
+    for (let i4 = 0; i4 < 64; i4++) {
       const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
-      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i3] + SHA256_W[i3] | 0;
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i4] + SHA256_W[i4] | 0;
       const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
       const T2 = sigma0 + Maj(A, B, C) | 0;
       H = G;
@@ -4364,10 +4364,10 @@ function copyBytes(bytes) {
   return Uint8Array.from(bytes);
 }
 function asciiToBytes(ascii) {
-  return Uint8Array.from(ascii, (c, i3) => {
+  return Uint8Array.from(ascii, (c, i4) => {
     const charCode = c.charCodeAt(0);
     if (c.length !== 1 || charCode > 127) {
-      throw new Error(`string contains non-ASCII character "${ascii[i3]}" with code ${charCode} at position ${i3}`);
+      throw new Error(`string contains non-ASCII character "${ascii[i4]}" with code ${charCode} at position ${i4}`);
     }
     return charCode;
   });
@@ -4399,11 +4399,11 @@ function createHmacDrbg(hashLen, qByteLen, hmacFn) {
   const _maxDrbgIters = 1e3;
   let v = u8n(hashLen);
   let k = u8n(hashLen);
-  let i3 = 0;
+  let i4 = 0;
   const reset = () => {
     v.fill(1);
     k.fill(0);
-    i3 = 0;
+    i4 = 0;
   };
   const h = (...msgs) => hmacFn(k, concatBytes(v, ...msgs));
   const reseed = (seed = NULL) => {
@@ -4415,7 +4415,7 @@ function createHmacDrbg(hashLen, qByteLen, hmacFn) {
     v = h();
   };
   const gen = () => {
-    if (i3++ >= _maxDrbgIters)
+    if (i4++ >= _maxDrbgIters)
       throw new Error("drbg: tried max amount of iterations");
     let len = 0;
     const out = [];
@@ -4523,8 +4523,8 @@ function sqrt5mod8(Fp, n) {
   const n2 = Fp.mul(n, _2n);
   const v = Fp.pow(n2, p5div8);
   const nv = Fp.mul(n, v);
-  const i3 = Fp.mul(Fp.mul(nv, _2n), v);
-  const root = Fp.mul(nv, Fp.sub(i3, Fp.ONE));
+  const i4 = Fp.mul(Fp.mul(nv, _2n), v);
+  const root = Fp.mul(nv, Fp.sub(i4, Fp.ONE));
   assertIsSquare(Fp, root, n);
   return root;
 }
@@ -4581,17 +4581,17 @@ function tonelliShanks(P) {
     while (!Fp.eql(t, Fp.ONE)) {
       if (Fp.is0(t))
         return Fp.ZERO;
-      let i3 = 1;
+      let i4 = 1;
       let t_tmp = Fp.sqr(t);
       while (!Fp.eql(t_tmp, Fp.ONE)) {
-        i3++;
+        i4++;
         t_tmp = Fp.sqr(t_tmp);
-        if (i3 === M)
+        if (i4 === M)
           throw new Error("Cannot find square root");
       }
-      const exponent = _1n2 << BigInt(M - i3 - 1);
+      const exponent = _1n2 << BigInt(M - i4 - 1);
       const b = Fp.pow(c, exponent);
-      M = i3;
+      M = i4;
       c = Fp.sqr(b);
       t = Fp.mul(t, c);
       R = Fp.mul(R, b);
@@ -4659,17 +4659,17 @@ function FpPow(Fp, num2, power) {
 }
 function FpInvertBatch(Fp, nums, passZero = false) {
   const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : void 0);
-  const multipliedAcc = nums.reduce((acc, num2, i3) => {
+  const multipliedAcc = nums.reduce((acc, num2, i4) => {
     if (Fp.is0(num2))
       return acc;
-    inverted[i3] = acc;
+    inverted[i4] = acc;
     return Fp.mul(acc, num2);
   }, Fp.ONE);
   const invertedAcc = Fp.inv(multipliedAcc);
-  nums.reduceRight((acc, num2, i3) => {
+  nums.reduceRight((acc, num2, i4) => {
     if (Fp.is0(num2))
       return acc;
-    inverted[i3] = Fp.mul(acc, inverted[i3]);
+    inverted[i4] = Fp.mul(acc, inverted[i4]);
     return Fp.mul(acc, num2);
   }, invertedAcc);
   return inverted;
@@ -4860,7 +4860,7 @@ function negateCt(condition, item) {
 }
 function normalizeZ(c, points) {
   const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
-  return points.map((p, i3) => c.fromAffine(p.toAffine(invertedZs[i3])));
+  return points.map((p, i4) => c.fromAffine(p.toAffine(invertedZs[i4])));
 }
 function validateW(W, bits) {
   if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
@@ -4943,7 +4943,7 @@ var wNAF = class {
     for (let window2 = 0; window2 < windows; window2++) {
       base = p;
       points.push(base);
-      for (let i3 = 1; i3 < windowSize; i3++) {
+      for (let i4 = 1; i4 < windowSize; i4++) {
         base = base.add(p);
         points.push(base);
       }
@@ -5077,10 +5077,10 @@ function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
   CURVE = Object.freeze(Object.assign({}, CURVE));
   return { CURVE, Fp, Fn };
 }
-function createKeygen(randomSecretKey, getPublicKey3) {
+function createKeygen(randomSecretKey, getPublicKey4) {
   return function keygen(seed) {
     const secretKey = randomSecretKey(seed);
-    return { secretKey, publicKey: getPublicKey3(secretKey) };
+    return { secretKey, publicKey: getPublicKey4(secretKey) };
   };
 }
 
@@ -5103,12 +5103,12 @@ var _HMAC = class {
     const blockLen = this.blockLen;
     const pad2 = new Uint8Array(blockLen);
     pad2.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-    for (let i3 = 0; i3 < pad2.length; i3++)
-      pad2[i3] ^= 54;
+    for (let i4 = 0; i4 < pad2.length; i4++)
+      pad2[i4] ^= 54;
     this.iHash.update(pad2);
     this.oHash = hash.create();
-    for (let i3 = 0; i3 < pad2.length; i3++)
-      pad2[i3] ^= 54 ^ 92;
+    for (let i4 = 0; i4 < pad2.length; i4++)
+      pad2[i4] ^= 54 ^ 92;
     this.oHash.update(pad2);
     clean(pad2);
   }
@@ -5765,7 +5765,7 @@ function ecdh(Point, ecdhOpts = {}) {
   function randomSecretKey(seed = randomBytes_(lengths.seed)) {
     return mapHashToField(abytes(seed, lengths.seed, "seed"), Fn.ORDER);
   }
-  function getPublicKey3(secretKey, isCompressed = true) {
+  function getPublicKey4(secretKey, isCompressed = true) {
     return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);
   }
   function isProbPub(item) {
@@ -5791,8 +5791,8 @@ function ecdh(Point, ecdhOpts = {}) {
     isValidPublicKey,
     randomSecretKey
   };
-  const keygen = createKeygen(randomSecretKey, getPublicKey3);
-  return Object.freeze({ getPublicKey: getPublicKey3, getSharedSecret, keygen, Point, utils, lengths });
+  const keygen = createKeygen(randomSecretKey, getPublicKey4);
+  return Object.freeze({ getPublicKey: getPublicKey4, getSharedSecret, keygen, Point, utils, lengths });
 }
 function ecdsa(Point, hash, ecdsaOpts = {}) {
   ahash(hash);
@@ -5808,7 +5808,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
   const hmac2 = ecdsaOpts.hmac || ((key, msg) => hmac(hash, key, msg));
   const { Fp, Fn } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
-  const { keygen, getPublicKey: getPublicKey3, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);
+  const { keygen, getPublicKey: getPublicKey4, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);
   const defaultSigOpts = {
     prehash: true,
     lowS: typeof ecdsaOpts.lowS === "boolean" ? ecdsaOpts.lowS : true,
@@ -6014,7 +6014,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
   }
   return Object.freeze({
     keygen,
-    getPublicKey: getPublicKey3,
+    getPublicKey: getPublicKey4,
     getSharedSecret,
     utils,
     lengths,
@@ -6300,8 +6300,8 @@ function u32(arr) {
   return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
 }
 function clean2(...arrays) {
-  for (let i3 = 0; i3 < arrays.length; i3++) {
-    arrays[i3].fill(0);
+  for (let i4 = 0; i4 < arrays.length; i4++) {
+    arrays[i4].fill(0);
   }
 }
 function createView2(arr) {
@@ -6327,8 +6327,8 @@ function equalBytes(a, b) {
   if (a.length !== b.length)
     return false;
   let diff = 0;
-  for (let i3 = 0; i3 < a.length; i3++)
-    diff |= a[i3] ^ b[i3];
+  for (let i4 = 0; i4 < a.length; i4++)
+    diff |= a[i4] ^ b[i4];
   return diff === 0;
 }
 var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
@@ -6508,8 +6508,8 @@ function createCipher(core, opts) {
 }
 
 // ../../node_modules/.pnpm/@noble+ciphers@2.1.1/node_modules/@noble/ciphers/_poly1305.js
-function u8to16(a, i3) {
-  return a[i3++] & 255 | (a[i3++] & 255) << 8;
+function u8to16(a, i4) {
+  return a[i4++] & 255 | (a[i4++] & 255) << 8;
 }
 var Poly1305 = class {
   blockLen = 16;
@@ -6542,8 +6542,8 @@ var Poly1305 = class {
     this.r[7] = (t5 >>> 11 | t6 << 5) & 8065;
     this.r[8] = (t6 >>> 8 | t7 << 8) & 8191;
     this.r[9] = t7 >>> 5 & 127;
-    for (let i3 = 0; i3 < 8; i3++)
-      this.pad[i3] = u8to16(key, 16 + 2 * i3);
+    for (let i4 = 0; i4 < 8; i4++)
+      this.pad[i4] = u8to16(key, 16 + 2 * i4);
   }
   process(data, offset, isLast = false) {
     const hibit = isLast ? 0 : 1 << 11;
@@ -6658,10 +6658,10 @@ var Poly1305 = class {
     const g = new Uint16Array(10);
     let c = h[1] >>> 13;
     h[1] &= 8191;
-    for (let i3 = 2; i3 < 10; i3++) {
-      h[i3] += c;
-      c = h[i3] >>> 13;
-      h[i3] &= 8191;
+    for (let i4 = 2; i4 < 10; i4++) {
+      h[i4] += c;
+      c = h[i4] >>> 13;
+      h[i4] &= 8191;
     }
     h[0] += c * 5;
     c = h[0] >>> 13;
@@ -6673,18 +6673,18 @@ var Poly1305 = class {
     g[0] = h[0] + 5;
     c = g[0] >>> 13;
     g[0] &= 8191;
-    for (let i3 = 1; i3 < 10; i3++) {
-      g[i3] = h[i3] + c;
-      c = g[i3] >>> 13;
-      g[i3] &= 8191;
+    for (let i4 = 1; i4 < 10; i4++) {
+      g[i4] = h[i4] + c;
+      c = g[i4] >>> 13;
+      g[i4] &= 8191;
     }
     g[9] -= 1 << 13;
     let mask = (c ^ 1) - 1;
-    for (let i3 = 0; i3 < 10; i3++)
-      g[i3] &= mask;
+    for (let i4 = 0; i4 < 10; i4++)
+      g[i4] &= mask;
     mask = ~mask;
-    for (let i3 = 0; i3 < 10; i3++)
-      h[i3] = h[i3] & mask | g[i3];
+    for (let i4 = 0; i4 < 10; i4++)
+      h[i4] = h[i4] & mask | g[i4];
     h[0] = (h[0] | h[1] << 13) & 65535;
     h[1] = (h[1] >>> 3 | h[2] << 10) & 65535;
     h[2] = (h[2] >>> 6 | h[3] << 7) & 65535;
@@ -6695,9 +6695,9 @@ var Poly1305 = class {
     h[7] = (h[8] >>> 8 | h[9] << 5) & 65535;
     let f = h[0] + pad2[0];
     h[0] = f & 65535;
-    for (let i3 = 1; i3 < 8; i3++) {
-      f = (h[i3] + pad2[i3] | 0) + (f >>> 16) | 0;
-      h[i3] = f & 65535;
+    for (let i4 = 1; i4 < 8; i4++) {
+      f = (h[i4] + pad2[i4] | 0) + (f >>> 16) | 0;
+      h[i4] = f & 65535;
     }
     clean2(g);
   }
@@ -6741,9 +6741,9 @@ var Poly1305 = class {
     }
     this.finalize();
     let opos = 0;
-    for (let i3 = 0; i3 < 8; i3++) {
-      out[opos++] = h[i3] >>> 0;
-      out[opos++] = h[i3] >>> 8;
+    for (let i4 = 0; i4 < 8; i4++) {
+      out[opos++] = h[i4] >>> 0;
+      out[opos++] = h[i4] >>> 8;
     }
     return out;
   }
@@ -6853,8 +6853,8 @@ function chachaCore(s, k, n, out, cnt, rounds = 20) {
   out[oi++] = y14 + x14 | 0;
   out[oi++] = y15 + x15 | 0;
 }
-function hchacha(s, k, i3, out) {
-  let x00 = s[0], x01 = s[1], x02 = s[2], x03 = s[3], x04 = k[0], x05 = k[1], x06 = k[2], x07 = k[3], x08 = k[4], x09 = k[5], x10 = k[6], x11 = k[7], x12 = i3[0], x13 = i3[1], x14 = i3[2], x15 = i3[3];
+function hchacha(s, k, i4, out) {
+  let x00 = s[0], x01 = s[1], x02 = s[2], x03 = s[3], x04 = k[0], x05 = k[1], x06 = k[2], x07 = k[3], x08 = k[4], x09 = k[5], x10 = k[6], x11 = k[7], x12 = i4[0], x13 = i4[1], x14 = i4[2], x15 = i4[3];
   for (let r = 0; r < 20; r += 2) {
     x00 = x00 + x04 | 0;
     x12 = rotl(x12 ^ x00, 16);
@@ -7492,11 +7492,11 @@ function parseChord(chord) {
   if (chord.length === 0) throw new Error("empty chord");
   const parts = chord.split("+");
   const out = { ctrl: false, alt: false, shift: false, meta: false, key: "" };
-  for (let i3 = 0; i3 < parts.length - 1; i3++) {
-    const tok = parts[i3].trim().toLowerCase();
+  for (let i4 = 0; i4 < parts.length - 1; i4++) {
+    const tok = parts[i4].trim().toLowerCase();
     if (tok.length === 0) continue;
     const slot = MODIFIER_ALIASES[tok];
-    if (!slot) throw new Error(`unknown modifier: ${parts[i3]}`);
+    if (!slot) throw new Error(`unknown modifier: ${parts[i4]}`);
     out[slot] = true;
   }
   const keyTok = parts[parts.length - 1].trim();
@@ -8393,8 +8393,8 @@ function arrayBufferToBase64(buf) {
   const bytes = new Uint8Array(buf);
   const CHUNK = 32768;
   let binary = "";
-  for (let i3 = 0; i3 < bytes.length; i3 += CHUNK) {
-    binary += String.fromCharCode(...bytes.subarray(i3, i3 + CHUNK));
+  for (let i4 = 0; i4 < bytes.length; i4 += CHUNK) {
+    binary += String.fromCharCode(...bytes.subarray(i4, i4 + CHUNK));
   }
   return btoa(binary);
 }
@@ -10500,7 +10500,7 @@ function createDevServices(pool, getSimulation, onThemeService, confirmRequest,
   }
   return services;
 }
-function createPajaAdapter(config, getSimulation, onThemeService, confirmRequest, signerProvider) {
+function createPajaAdapter(config, getSimulation, onThemeService, confirmRequest, signerProvider, getIdentity) {
   const pool = createMemoryRelayPool(getSimulation, confirmRequest);
   const workerRelayEvents = [];
   return {
@@ -10540,10 +10540,13 @@ function createPajaAdapter(config, getSimulation, onThemeService, confirmRequest
     crypto: {
       verifyEvent: async () => true
     },
-    onNip5dIframeCreate: () => ({
-      dTag: config.window.dTag,
-      aggregateHash: config.window.aggregateHash
-    })
+    onNip5dIframeCreate: () => {
+      const identity = getIdentity?.();
+      return {
+        dTag: identity?.dTag ?? config.window.dTag,
+        aggregateHash: identity?.aggregateHash ?? config.window.aggregateHash
+      };
+    }
   };
 }
 
@@ -10567,14 +10570,14 @@ function mul(a, b) {
 }
 var sbox = /* @__PURE__ */ (() => {
   const t = new Uint8Array(256);
-  for (let i3 = 0, x = 1; i3 < 256; i3++, x ^= mul2(x))
-    t[i3] = x;
+  for (let i4 = 0, x = 1; i4 < 256; i4++, x ^= mul2(x))
+    t[i4] = x;
   const box = new Uint8Array(256);
   box[0] = 99;
-  for (let i3 = 0; i3 < 255; i3++) {
-    let x = t[255 - i3];
+  for (let i4 = 0; i4 < 255; i4++) {
+    let x = t[255 - i4];
     x |= x << 8;
-    box[t[i3]] = (x ^ x >> 4 ^ x >> 5 ^ x >> 6 ^ x >> 7 ^ 99) & 255;
+    box[t[i4]] = (x ^ x >> 4 ^ x >> 5 ^ x >> 6 ^ x >> 7 ^ 99) & 255;
   }
   clean2(t);
   return box;
@@ -10592,12 +10595,12 @@ function genTtable(sbox2, fn) {
   const T01 = new Uint32Array(256 * 256);
   const T23 = new Uint32Array(256 * 256);
   const sbox22 = new Uint16Array(256 * 256);
-  for (let i3 = 0; i3 < 256; i3++) {
+  for (let i4 = 0; i4 < 256; i4++) {
     for (let j = 0; j < 256; j++) {
-      const idx = i3 * 256 + j;
-      T01[idx] = T0[i3] ^ T1[j];
-      T23[idx] = T2[i3] ^ T3[j];
-      sbox22[idx] = sbox2[i3] << 8 | sbox2[j];
+      const idx = i4 * 256 + j;
+      T01[idx] = T0[i4] ^ T1[j];
+      T23[idx] = T2[i4] ^ T3[j];
+      sbox22[idx] = sbox2[i4] << 8 | sbox2[j];
     }
   }
   return { sbox: sbox2, sbox2: sbox22, T0, T1, T2, T3, T01, T23 };
@@ -10606,8 +10609,8 @@ var tableEncoding = /* @__PURE__ */ genTtable(sbox, (s) => mul(s, 3) << 24 | s <
 var tableDecoding = /* @__PURE__ */ genTtable(invSbox, (s) => mul(s, 11) << 24 | mul(s, 13) << 16 | mul(s, 9) << 8 | mul(s, 14));
 var xPowers = /* @__PURE__ */ (() => {
   const p = new Uint8Array(16);
-  for (let i3 = 0, x = 1; i3 < 16; i3++, x = mul2(x))
-    p[i3] = x;
+  for (let i4 = 0, x = 1; i4 < 16; i4++, x = mul2(x))
+    p[i4] = x;
   return p;
 })();
 function expandKeyLE(key) {
@@ -10623,13 +10626,13 @@ function expandKeyLE(key) {
   const subByte = (n) => applySbox(sbox2, n, n, n, n);
   const xk = new Uint32Array(len + 28);
   xk.set(k32);
-  for (let i3 = Nk; i3 < xk.length; i3++) {
-    let t = xk[i3 - 1];
-    if (i3 % Nk === 0)
-      t = subByte(rotr32_8(t)) ^ xPowers[i3 / Nk - 1];
-    else if (Nk > 6 && i3 % Nk === 4)
+  for (let i4 = Nk; i4 < xk.length; i4++) {
+    let t = xk[i4 - 1];
+    if (i4 % Nk === 0)
+      t = subByte(rotr32_8(t)) ^ xPowers[i4 / Nk - 1];
+    else if (Nk > 6 && i4 % Nk === 4)
       t = subByte(t);
-    xk[i3] = xk[i3 - Nk] ^ t;
+    xk[i4] = xk[i4 - Nk] ^ t;
   }
   clean2(...toClean);
   return xk;
@@ -10640,15 +10643,15 @@ function expandKeyDecLE(key) {
   const Nk = encKey.length;
   const { sbox2 } = tableEncoding;
   const { T0, T1, T2, T3 } = tableDecoding;
-  for (let i3 = 0; i3 < Nk; i3 += 4) {
+  for (let i4 = 0; i4 < Nk; i4 += 4) {
     for (let j = 0; j < 4; j++)
-      xk[i3 + j] = encKey[Nk - i3 - 4 + j];
+      xk[i4 + j] = encKey[Nk - i4 - 4 + j];
   }
   clean2(encKey);
-  for (let i3 = 4; i3 < Nk - 4; i3++) {
-    const x = xk[i3];
+  for (let i4 = 4; i4 < Nk - 4; i4++) {
+    const x = xk[i4];
     const w = applySbox(sbox2, x, x, x, x);
-    xk[i3] = T0[w & 255] ^ T1[w >>> 8 & 255] ^ T2[w >>> 16 & 255] ^ T3[w >>> 24];
+    xk[i4] = T0[w & 255] ^ T1[w >>> 8 & 255] ^ T2[w >>> 16 & 255] ^ T3[w >>> 24];
   }
   return xk;
 }
@@ -10663,7 +10666,7 @@ function encrypt(xk, s0, s1, s2, s3) {
   let k = 0;
   s0 ^= xk[k++], s1 ^= xk[k++], s2 ^= xk[k++], s3 ^= xk[k++];
   const rounds = xk.length / 4 - 2;
-  for (let i3 = 0; i3 < rounds; i3++) {
+  for (let i4 = 0; i4 < rounds; i4++) {
     const t02 = xk[k++] ^ apply0123(T01, T23, s0, s1, s2, s3);
     const t12 = xk[k++] ^ apply0123(T01, T23, s1, s2, s3, s0);
     const t22 = xk[k++] ^ apply0123(T01, T23, s2, s3, s0, s1);
@@ -10681,7 +10684,7 @@ function decrypt(xk, s0, s1, s2, s3) {
   let k = 0;
   s0 ^= xk[k++], s1 ^= xk[k++], s2 ^= xk[k++], s3 ^= xk[k++];
   const rounds = xk.length / 4 - 2;
-  for (let i3 = 0; i3 < rounds; i3++) {
+  for (let i4 = 0; i4 < rounds; i4++) {
     const t02 = xk[k++] ^ apply0123(T01, T23, s0, s3, s2, s1);
     const t12 = xk[k++] ^ apply0123(T01, T23, s1, s0, s3, s2);
     const t22 = xk[k++] ^ apply0123(T01, T23, s2, s1, s0, s3);
@@ -10730,8 +10733,8 @@ function validatePCKS(data, pcks5) {
   if (lastByte <= 0 || lastByte > 16)
     throw new Error("aes/pcks5: wrong padding");
   const out = data.subarray(0, -lastByte);
-  for (let i3 = 0; i3 < lastByte; i3++)
-    if (data[len - i3 - 1] !== lastByte)
+  for (let i4 = 0; i4 < lastByte; i4++)
+    if (data[len - i4 - 1] !== lastByte)
       throw new Error("aes/pcks5: wrong padding");
   return out;
 }
@@ -10740,8 +10743,8 @@ function padPCKS(left) {
   const tmp32 = u32(tmp);
   tmp.set(left);
   const paddingByte = BLOCK_SIZE - left.length;
-  for (let i3 = BLOCK_SIZE - paddingByte; i3 < BLOCK_SIZE; i3++)
-    tmp[i3] = paddingByte;
+  for (let i4 = BLOCK_SIZE - paddingByte; i4 < BLOCK_SIZE; i4++)
+    tmp[i4] = paddingByte;
   return tmp32;
 }
 var cbc = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 16 }, function aescbc(key, iv, opts = {}) {
@@ -10756,17 +10759,17 @@ var cbc = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 16 }, functio
         toClean.push(_iv = copyBytes2(_iv));
       const n32 = u32(_iv);
       let s0 = n32[0], s1 = n32[1], s2 = n32[2], s3 = n32[3];
-      let i3 = 0;
-      for (; i3 + 4 <= b.length; ) {
-        s0 ^= b[i3 + 0], s1 ^= b[i3 + 1], s2 ^= b[i3 + 2], s3 ^= b[i3 + 3];
+      let i4 = 0;
+      for (; i4 + 4 <= b.length; ) {
+        s0 ^= b[i4 + 0], s1 ^= b[i4 + 1], s2 ^= b[i4 + 2], s3 ^= b[i4 + 3];
         ({ s0, s1, s2, s3 } = encrypt(xk, s0, s1, s2, s3));
-        o[i3++] = s0, o[i3++] = s1, o[i3++] = s2, o[i3++] = s3;
+        o[i4++] = s0, o[i4++] = s1, o[i4++] = s2, o[i4++] = s3;
       }
       if (pcks5) {
-        const tmp32 = padPCKS(plaintext.subarray(i3 * 4));
+        const tmp32 = padPCKS(plaintext.subarray(i4 * 4));
         s0 ^= tmp32[0], s1 ^= tmp32[1], s2 ^= tmp32[2], s3 ^= tmp32[3];
         ({ s0, s1, s2, s3 } = encrypt(xk, s0, s1, s2, s3));
-        o[i3++] = s0, o[i3++] = s1, o[i3++] = s2, o[i3++] = s3;
+        o[i4++] = s0, o[i4++] = s1, o[i4++] = s2, o[i4++] = s3;
       }
       clean2(...toClean);
       return _out;
@@ -10786,11 +10789,11 @@ var cbc = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 16 }, functio
       const b = u32(ciphertext);
       const o = u32(dst);
       let s0 = n32[0], s1 = n32[1], s2 = n32[2], s3 = n32[3];
-      for (let i3 = 0; i3 + 4 <= b.length; ) {
+      for (let i4 = 0; i4 + 4 <= b.length; ) {
         const ps0 = s0, ps1 = s1, ps2 = s2, ps3 = s3;
-        s0 = b[i3 + 0], s1 = b[i3 + 1], s2 = b[i3 + 2], s3 = b[i3 + 3];
+        s0 = b[i4 + 0], s1 = b[i4 + 1], s2 = b[i4 + 2], s3 = b[i4 + 3];
         const { s0: o0, s1: o1, s2: o2, s3: o3 } = decrypt(xk, s0, s1, s2, s3);
-        o[i3++] = o0 ^ ps0, o[i3++] = o1 ^ ps1, o[i3++] = o2 ^ ps2, o[i3++] = o3 ^ ps3;
+        o[i4++] = o0 ^ ps0, o[i4++] = o1 ^ ps1, o[i4++] = o2 ^ ps2, o[i4++] = o3 ^ ps3;
       }
       clean2(...toClean);
       return validatePCKS(dst, pcks5);
@@ -10811,9 +10814,9 @@ function encryptBlock(xk, block2) {
 }
 function dbl(block2) {
   let carry = 0;
-  for (let i3 = BLOCK_SIZE - 1; i3 >= 0; i3--) {
-    const newCarry = (block2[i3] & 128) >>> 7;
-    block2[i3] = block2[i3] << 1 | carry;
+  for (let i4 = BLOCK_SIZE - 1; i4 >= 0; i4--) {
+    const newCarry = (block2[i4] & 128) >>> 7;
+    block2[i4] = block2[i4] << 1 | carry;
     carry = newCarry;
   }
   if (carry) {
@@ -10824,8 +10827,8 @@ function dbl(block2) {
 function xorBlock(a, b) {
   if (a.length !== b.length)
     throw new Error("xorBlock: blocks must have same length");
-  for (let i3 = 0; i3 < a.length; i3++) {
-    a[i3] = a[i3] ^ b[i3];
+  for (let i4 = 0; i4 < a.length; i4++) {
+    a[i4] = a[i4] ^ b[i4];
   }
   return a;
 }
@@ -10883,8 +10886,8 @@ var _CMAC = class {
       m_last = xorBlock(padded, this.k2);
     }
     let x = new Uint8Array(BLOCK_SIZE);
-    for (let i3 = 0; i3 < n - 1; i3++) {
-      const m_i = buffer.subarray(i3 * BLOCK_SIZE, (i3 + 1) * BLOCK_SIZE);
+    for (let i4 = 0; i4 < n - 1; i4++) {
+      const m_i = buffer.subarray(i4 * BLOCK_SIZE, (i4 + 1) * BLOCK_SIZE);
       xorBlock(x, m_i);
       encryptBlock(this.xk, x);
     }
@@ -13848,211 +13851,1886 @@ function renderSignerStatus(state, signerPubkey) {
   controls.replaceChildren(devButton, nip07Button, bunkerInput, bunkerButton);
 }
 
-// src/browser-host.ts
-var bridgeRef = null;
-function readConfig() {
-  const script = document.getElementById("kehto-paja-config");
-  if (!script?.textContent) {
-    throw new Error("Missing Kehto Paja config.");
+// ../../node_modules/.pnpm/nostr-tools@2.23.3_typescript@5.9.3/node_modules/nostr-tools/lib/esm/pool.js
+var verifiedSymbol3 = /* @__PURE__ */ Symbol("verified");
+var isRecord3 = (obj) => obj instanceof Object;
+function validateEvent3(event) {
+  if (!isRecord3(event))
+    return false;
+  if (typeof event.kind !== "number")
+    return false;
+  if (typeof event.content !== "string")
+    return false;
+  if (typeof event.created_at !== "number")
+    return false;
+  if (typeof event.pubkey !== "string")
+    return false;
+  if (!event.pubkey.match(/^[a-f0-9]{64}$/))
+    return false;
+  if (!Array.isArray(event.tags))
+    return false;
+  for (let i22 = 0; i22 < event.tags.length; i22++) {
+    let tag = event.tags[i22];
+    if (!Array.isArray(tag))
+      return false;
+    for (let j = 0; j < tag.length; j++) {
+      if (typeof tag[j] !== "string")
+        return false;
+    }
   }
-  return JSON.parse(script.textContent);
+  return true;
 }
-async function readLatestConfig(fallback) {
+var utf8Decoder4 = new TextDecoder("utf-8");
+var utf8Encoder4 = new TextEncoder();
+function normalizeURL2(url) {
   try {
-    const response = await fetch("/__kehto/config.json", { cache: "no-store" });
-    if (!response.ok) return fallback;
-    return await response.json();
-  } catch (error) {
-    console.warn("[paja] config refresh failed; using embedded config", error);
-    return fallback;
+    if (url.indexOf("://") === -1)
+      url = "wss://" + url;
+    let p = new URL(url);
+    if (p.protocol === "http:")
+      p.protocol = "ws:";
+    else if (p.protocol === "https:")
+      p.protocol = "wss:";
+    p.pathname = p.pathname.replace(/\/+/g, "/");
+    if (p.pathname.endsWith("/"))
+      p.pathname = p.pathname.slice(0, -1);
+    if (p.port === "80" && p.protocol === "ws:" || p.port === "443" && p.protocol === "wss:")
+      p.port = "";
+    p.searchParams.sort();
+    p.hash = "";
+    return p.toString();
+  } catch (e) {
+    throw new Error(`Invalid URL: ${url}`);
   }
 }
-function setTargetUrlDisplay(config, frame) {
-  const targetEl = document.querySelector(".target");
-  if (targetEl) {
-    targetEl.textContent = config.target.url;
-    targetEl.setAttribute("title", config.target.url);
+var JS3 = class {
+  generateSecretKey() {
+    return schnorr.utils.randomSecretKey();
+  }
+  getPublicKey(secretKey) {
+    return bytesToHex2(schnorr.getPublicKey(secretKey));
   }
-  frame.dataset.targetUrl = config.target.url;
+  finalizeEvent(t, secretKey) {
+    const event = t;
+    event.pubkey = bytesToHex2(schnorr.getPublicKey(secretKey));
+    event.id = getEventHash3(event);
+    event.sig = bytesToHex2(schnorr.sign(hexToBytes2(getEventHash3(event)), secretKey));
+    event[verifiedSymbol3] = true;
+    return event;
+  }
+  verifyEvent(event) {
+    if (typeof event[verifiedSymbol3] === "boolean")
+      return event[verifiedSymbol3];
+    try {
+      const hash = getEventHash3(event);
+      if (hash !== event.id) {
+        event[verifiedSymbol3] = false;
+        return false;
+      }
+      const valid = schnorr.verify(hexToBytes2(event.sig), hexToBytes2(hash), hexToBytes2(event.pubkey));
+      event[verifiedSymbol3] = valid;
+      return valid;
+    } catch (err) {
+      event[verifiedSymbol3] = false;
+      return false;
+    }
+  }
+};
+function serializeEvent3(evt) {
+  if (!validateEvent3(evt))
+    throw new Error("can't serialize event with wrong or missing properties");
+  return JSON.stringify([0, evt.pubkey, evt.created_at, evt.kind, evt.tags, evt.content]);
 }
-function setStatus(state, status) {
-  state.status = status;
-  const statusEl = document.getElementById("lifecycle-status");
-  if (statusEl) statusEl.textContent = status;
+function getEventHash3(event) {
+  let eventHash = sha256(utf8Encoder4.encode(serializeEvent3(event)));
+  return bytesToHex2(eventHash);
 }
-function setSimulationStatus(state) {
-  const statusEl = document.getElementById("simulation-status");
-  if (statusEl) statusEl.textContent = summarizePajaSimulation(state.simulation);
-  const themeSelect = document.getElementById("simulation-theme");
-  if (themeSelect instanceof HTMLSelectElement) themeSelect.value = state.simulation.theme.mode;
-  renderPajaDevtools(state, { bridge: bridgeRef, devSignerPubkey: PAJA_DEV_SIGNER_PUBKEY });
+var i3 = new JS3();
+var generateSecretKey3 = i3.generateSecretKey;
+var getPublicKey3 = i3.getPublicKey;
+var finalizeEvent3 = i3.finalizeEvent;
+var verifyEvent3 = i3.verifyEvent;
+var ClientAuth2 = 22242;
+function matchFilter(filter, event) {
+  if (filter.ids && filter.ids.indexOf(event.id) === -1) {
+    return false;
+  }
+  if (filter.kinds && filter.kinds.indexOf(event.kind) === -1) {
+    return false;
+  }
+  if (filter.authors && filter.authors.indexOf(event.pubkey) === -1) {
+    return false;
+  }
+  for (let f in filter) {
+    if (f[0] === "#") {
+      let tagName = f.slice(1);
+      let values = filter[`#${tagName}`];
+      if (values && !event.tags.find(([t, v]) => t === f.slice(1) && values.indexOf(v) !== -1))
+        return false;
+    }
+  }
+  if (filter.since && event.created_at < filter.since)
+    return false;
+  if (filter.until && event.created_at > filter.until)
+    return false;
+  return true;
 }
-function getFrame() {
-  const frame = document.getElementById("napplet-frame");
-  if (!(frame instanceof HTMLIFrameElement)) {
-    throw new Error("Missing Kehto Paja iframe.");
+function matchFilters(filters, event) {
+  for (let i22 = 0; i22 < filters.length; i22++) {
+    if (matchFilter(filters[i22], event)) {
+      return true;
+    }
   }
-  frame.sandbox.add("allow-scripts");
-  frame.sandbox.remove("allow-same-origin");
-  return frame;
+  return false;
 }
-function confirmPajaRequest(state, request) {
-  const event = request.event;
-  const kind = typeof event.kind === "number" ? event.kind : "unknown";
-  const content = typeof event.content === "string" && event.content.length > 0 ? `
-
-${event.content.slice(0, 240)}` : "";
-  const allowed = window.confirm(`Paja ${request.action} request
-kind: ${kind}${content}`);
-  appendPajaMessageLog(state, "paja", {
-    type: `paja.${request.action}.${allowed ? "confirmed" : "denied"}`,
-    kind
-  });
-  return allowed;
+function getHex642(json, field) {
+  let len = field.length + 3;
+  let idx = json.indexOf(`"${field}":`) + len;
+  let s = json.slice(idx).indexOf(`"`) + idx + 1;
+  return json.slice(s, s + 64);
+}
+function getSubscriptionId2(json) {
+  let idx = json.slice(0, 22).indexOf(`"EVENT"`);
+  if (idx === -1)
+    return null;
+  let pstart = json.slice(idx + 7 + 1).indexOf(`"`);
+  if (pstart === -1)
+    return null;
+  let start = idx + 7 + 1 + pstart;
+  let pend = json.slice(start + 1, 80).indexOf(`"`);
+  if (pend === -1)
+    return null;
+  let end = start + 1 + pend;
+  return json.slice(start + 1, end);
 }
-function getTargetIdentity2(config) {
+function makeAuthEvent2(relayURL, challenge2) {
   return {
-    pubkey: "",
-    dTag: config.window.dTag,
-    aggregateHash: config.window.aggregateHash
+    kind: ClientAuth2,
+    created_at: Math.floor(Date.now() / 1e3),
+    tags: [
+      ["relay", relayURL],
+      ["challenge", challenge2]
+    ],
+    content: ""
   };
 }
-function registerFrameForGeneration(bridge, frame, config, generation) {
-  const win = frame.contentWindow;
-  if (!win) return null;
-  const windowId = `${config.window.id}:${generation}`;
-  originRegistry.register(win, windowId, {
-    dTag: config.window.dTag,
-    aggregateHash: config.window.aggregateHash
-  });
-  bridge.runtime.sessionRegistry.register(windowId, {
-    ...getTargetIdentity2(config),
-    windowId,
-    origin: "null",
-    type: "napplet",
-    registeredAt: Date.now(),
-    instanceId: `${windowId}:${Date.now()}`,
-    provenance: "nip-5d"
-  });
-  return windowId;
-}
-function navigateFrame(bridge, frame, config, generation) {
-  const windowId = registerFrameForGeneration(bridge, frame, config, generation);
-  frame.src = config.target.url;
-  return windowId;
-}
-function createHostSignerController(getState) {
-  return createPajaSignerController({
-    confirmRequest: (request) => confirmPajaRequest(getState(), request),
-    onChange(signer) {
-      const state = getState();
-      if (!state) return;
-      state.signer = signer;
-      appendPajaMessageLog(state, "paja", {
-        type: `paja.signer.${signer.method}.${signer.status}`,
-        pubkey: signer.pubkey,
-        relay: signer.relay,
-        error: signer.error
-      });
-      setSimulationStatus(state);
-      if (signer.status === "connected") state.reload();
-    }
-  });
-}
-function installPajaControlListeners(state) {
-  document.getElementById("reload-target")?.addEventListener("click", () => {
-    state.reload();
-  });
-  document.getElementById("simulation-theme")?.addEventListener("change", (event) => {
-    const target = event.target;
-    if (!(target instanceof HTMLSelectElement)) return;
-    if (target.value === "dark" || target.value === "light") {
-      state.setThemeMode(target.value);
+var SendingOnClosedConnection = class extends Error {
+  constructor(message, relay) {
+    super(`Tried to send message '${message} on a closed connection to ${relay}.`);
+    this.name = "SendingOnClosedConnection";
+  }
+};
+var AbstractRelay = class {
+  url;
+  _connected = false;
+  onclose = null;
+  onnotice = (msg) => console.debug(`NOTICE from ${this.url}: ${msg}`);
+  onauth;
+  baseEoseTimeout = 4400;
+  publishTimeout = 4400;
+  pingFrequency = 29e3;
+  pingTimeout = 2e4;
+  resubscribeBackoff = [1e4, 1e4, 1e4, 2e4, 2e4, 3e4, 6e4];
+  openSubs = /* @__PURE__ */ new Map();
+  enablePing;
+  enableReconnect;
+  idleSince = Date.now();
+  ongoingOperations = 0;
+  reconnectTimeoutHandle;
+  pingIntervalHandle;
+  reconnectAttempts = 0;
+  skipReconnection = false;
+  connectionPromise;
+  openCountRequests = /* @__PURE__ */ new Map();
+  openEventPublishes = /* @__PURE__ */ new Map();
+  ws;
+  challenge;
+  authPromise;
+  serial = 0;
+  verifyEvent;
+  _WebSocket;
+  constructor(url, opts) {
+    this.url = normalizeURL2(url);
+    this.verifyEvent = opts.verifyEvent;
+    this._WebSocket = opts.websocketImplementation || WebSocket;
+    this.enablePing = opts.enablePing;
+    this.enableReconnect = opts.enableReconnect || false;
+  }
+  static async connect(url, opts) {
+    const relay = new AbstractRelay(url, opts);
+    await relay.connect(opts);
+    return relay;
+  }
+  closeAllSubscriptions(reason) {
+    for (let [_, sub] of this.openSubs) {
+      sub.close(reason);
+    }
+    this.openSubs.clear();
+    for (let [_, ep] of this.openEventPublishes) {
+      ep.reject(new Error(reason));
+    }
+    this.openEventPublishes.clear();
+    for (let [_, cr] of this.openCountRequests) {
+      cr.reject(new Error(reason));
+    }
+    this.openCountRequests.clear();
+  }
+  get connected() {
+    return this._connected;
+  }
+  async reconnect() {
+    const backoff = this.resubscribeBackoff[Math.min(this.reconnectAttempts, this.resubscribeBackoff.length - 1)];
+    this.reconnectAttempts++;
+    this.reconnectTimeoutHandle = setTimeout(async () => {
+      try {
+        await this.connect();
+      } catch (err) {
+      }
+    }, backoff);
+  }
+  handleHardClose(reason) {
+    if (this.pingIntervalHandle) {
+      clearInterval(this.pingIntervalHandle);
+      this.pingIntervalHandle = void 0;
     }
-  });
-  document.getElementById("message-filter")?.addEventListener("input", (event) => {
-    const target = event.target;
-    if (!(target instanceof HTMLInputElement)) return;
-    state.messageFilter = target.value;
-    renderPajaMessageLog(state);
-  });
-  document.getElementById("clear-log")?.addEventListener("click", () => {
-    state.clearLog();
-  });
-}
-async function installPajaHost() {
-  const config = await readLatestConfig(readConfig());
-  const frame = getFrame();
-  setTargetUrlDisplay(config, frame);
-  let currentSimulation = config.simulation;
-  const getSimulation = () => currentSimulation;
-  let themeService = null;
-  let stateRef = null;
-  const signerController = createHostSignerController(() => stateRef);
-  const adapter = createPajaAdapter(config, getSimulation, (theme) => {
-    themeService = theme;
-  }, (request) => confirmPajaRequest(stateRef, request), signerController);
-  const bridge = createShellBridge(adapter);
-  bridgeRef = bridge;
-  installPajaOriginRegistryProxy(originRegistry, () => stateRef);
-  const capabilities = buildShellCapabilities(adapter);
-  const services = Object.keys(adapter.services ?? {}).sort();
-  let currentWindowId = null;
-  let initReceivedGeneration = -1;
-  const state = {
-    config,
-    capabilities,
-    services,
-    simulation: currentSimulation,
-    signer: signerController.getState(),
-    generation: 0,
-    status: "booting",
-    messageFilter: "",
-    messageLog: [],
-    reload() {
-      if (currentWindowId) {
-        bridge.runtime.destroyWindow(currentWindowId);
-        bridge.runtime.sessionRegistry.unregister(currentWindowId);
-        originRegistry.unregister(currentWindowId);
+    this._connected = false;
+    this.connectionPromise = void 0;
+    this.idleSince = void 0;
+    if (this.enableReconnect && !this.skipReconnection) {
+      this.reconnect();
+    } else {
+      this.onclose?.();
+      this.closeAllSubscriptions(reason);
+    }
+  }
+  async connect(opts) {
+    let connectionTimeoutHandle;
+    if (this.connectionPromise)
+      return this.connectionPromise;
+    this.challenge = void 0;
+    this.authPromise = void 0;
+    this.skipReconnection = false;
+    this.connectionPromise = new Promise((resolve, reject) => {
+      if (opts?.timeout) {
+        connectionTimeoutHandle = setTimeout(() => {
+          reject("connection timed out");
+          this.connectionPromise = void 0;
+          this.skipReconnection = true;
+          this.onclose?.();
+          this.handleHardClose("relay connection timed out");
+        }, opts.timeout);
+      }
+      if (opts?.abort) {
+        opts.abort.onabort = reject;
       }
-      this.generation += 1;
-      initReceivedGeneration = -1;
-      setStatus(this, "reloading");
-      currentWindowId = navigateFrame(bridge, frame, config, this.generation);
-    },
-    setThemeMode(mode) {
-      currentSimulation = {
-        ...currentSimulation,
-        theme: {
-          ...currentSimulation.theme,
-          mode
+      try {
+        this.ws = new this._WebSocket(this.url);
+      } catch (err) {
+        clearTimeout(connectionTimeoutHandle);
+        reject(err);
+        return;
+      }
+      this.ws.onopen = () => {
+        if (this.reconnectTimeoutHandle) {
+          clearTimeout(this.reconnectTimeoutHandle);
+          this.reconnectTimeoutHandle = void 0;
+        }
+        clearTimeout(connectionTimeoutHandle);
+        this._connected = true;
+        const isReconnection = this.reconnectAttempts > 0;
+        this.reconnectAttempts = 0;
+        for (const sub of this.openSubs.values()) {
+          sub.eosed = false;
+          if (isReconnection) {
+            for (let f = 0; f < sub.filters.length; f++) {
+              if (sub.lastEmitted) {
+                sub.filters[f].since = sub.lastEmitted + 1;
+              }
+            }
+          }
+          sub.fire();
+        }
+        if (this.enablePing) {
+          this.pingIntervalHandle = setInterval(() => this.pingpong(), this.pingFrequency);
         }
+        resolve();
       };
-      this.simulation = currentSimulation;
-      themeService?.publishTheme(createDevTheme(currentSimulation.theme.mode, currentSimulation.theme.values));
-      setSimulationStatus(this);
-    },
+      this.ws.onerror = () => {
+        clearTimeout(connectionTimeoutHandle);
+        reject("connection failed");
+        this.connectionPromise = void 0;
+        this.skipReconnection = true;
+        this.onclose?.();
+        this.handleHardClose("relay connection failed");
+      };
+      this.ws.onclose = (ev) => {
+        clearTimeout(connectionTimeoutHandle);
+        reject(ev.message || "websocket closed");
+        this.handleHardClose("relay connection closed");
+      };
+      this.ws.onmessage = this._onmessage.bind(this);
+    });
+    return this.connectionPromise;
+  }
+  waitForPingPong() {
+    return new Promise((resolve) => {
+      ;
+      this.ws.once("pong", () => resolve(true));
+      this.ws.ping();
+    });
+  }
+  waitForDummyReq() {
+    return new Promise((resolve, reject) => {
+      if (!this.connectionPromise)
+        return reject(new Error(`no connection to ${this.url}, can't ping`));
+      try {
+        const sub = this.subscribe(
+          [{ ids: ["aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"], limit: 0 }],
+          {
+            label: "<forced-ping>",
+            oneose: () => {
+              resolve(true);
+              sub.close();
+            },
+            onclose() {
+              resolve(true);
+            },
+            eoseTimeout: this.pingTimeout + 1e3
+          }
+        );
+      } catch (err) {
+        reject(err);
+      }
+    });
+  }
+  async pingpong() {
+    if (this.ws?.readyState === 1) {
+      const result = await Promise.any([
+        this.ws && this.ws.ping && this.ws.once ? this.waitForPingPong() : this.waitForDummyReq(),
+        new Promise((res) => setTimeout(() => res(false), this.pingTimeout))
+      ]);
+      if (!result) {
+        if (this.ws?.readyState === this._WebSocket.OPEN) {
+          this.ws?.close();
+        }
+      }
+    }
+  }
+  async send(message) {
+    if (!this.connectionPromise)
+      throw new SendingOnClosedConnection(message, this.url);
+    this.connectionPromise.then(() => {
+      this.ws?.send(message);
+    });
+  }
+  async auth(signAuthEvent) {
+    const challenge2 = this.challenge;
+    if (!challenge2)
+      throw new Error("can't perform auth, no challenge was received");
+    if (this.authPromise)
+      return this.authPromise;
+    this.authPromise = new Promise(async (resolve, reject) => {
+      try {
+        let evt = await signAuthEvent(makeAuthEvent2(this.url, challenge2));
+        let timeout = setTimeout(() => {
+          let ep = this.openEventPublishes.get(evt.id);
+          if (ep) {
+            ep.reject(new Error("auth timed out"));
+            this.openEventPublishes.delete(evt.id);
+          }
+        }, this.publishTimeout);
+        this.openEventPublishes.set(evt.id, { resolve, reject, timeout });
+        this.send('["AUTH",' + JSON.stringify(evt) + "]");
+      } catch (err) {
+        console.warn("subscribe auth function failed:", err);
+      }
+    });
+    return this.authPromise;
+  }
+  async publish(event) {
+    this.idleSince = void 0;
+    this.ongoingOperations++;
+    const ret = new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        const ep = this.openEventPublishes.get(event.id);
+        if (ep) {
+          ep.reject(new Error("publish timed out"));
+          this.openEventPublishes.delete(event.id);
+        }
+      }, this.publishTimeout);
+      this.openEventPublishes.set(event.id, { resolve, reject, timeout });
+    });
+    this.send('["EVENT",' + JSON.stringify(event) + "]");
+    this.ongoingOperations--;
+    if (this.ongoingOperations === 0)
+      this.idleSince = Date.now();
+    return ret;
+  }
+  async count(filters, params) {
+    this.serial++;
+    const id = params?.id || "count:" + this.serial;
+    const ret = new Promise((resolve, reject) => {
+      this.openCountRequests.set(id, { resolve, reject });
+    });
+    this.send('["COUNT","' + id + '",' + JSON.stringify(filters).substring(1));
+    return ret;
+  }
+  subscribe(filters, params) {
+    if (params.label !== "<forced-ping>") {
+      this.idleSince = void 0;
+      this.ongoingOperations++;
+    }
+    const sub = this.prepareSubscription(filters, params);
+    sub.fire();
+    if (params.abort) {
+      params.abort.onabort = () => sub.close(String(params.abort.reason || "<aborted>"));
+    }
+    return sub;
+  }
+  prepareSubscription(filters, params) {
+    this.serial++;
+    const id = params.id || (params.label ? params.label + ":" : "sub:") + this.serial;
+    const sub = new Subscription(this, id, filters, params);
+    this.openSubs.set(id, sub);
+    return sub;
+  }
+  close() {
+    this.skipReconnection = true;
+    if (this.reconnectTimeoutHandle) {
+      clearTimeout(this.reconnectTimeoutHandle);
+      this.reconnectTimeoutHandle = void 0;
+    }
+    if (this.pingIntervalHandle) {
+      clearInterval(this.pingIntervalHandle);
+      this.pingIntervalHandle = void 0;
+    }
+    this.closeAllSubscriptions("relay connection closed by us");
+    this._connected = false;
+    this.idleSince = void 0;
+    this.onclose?.();
+    if (this.ws?.readyState === this._WebSocket.OPEN) {
+      this.ws?.close();
+    }
+  }
+  _onmessage(ev) {
+    const json = ev.data;
+    if (!json) {
+      return;
+    }
+    const subid = getSubscriptionId2(json);
+    if (subid) {
+      const so = this.openSubs.get(subid);
+      if (!so) {
+        return;
+      }
+      const id = getHex642(json, "id");
+      const alreadyHave = so.alreadyHaveEvent?.(id);
+      so.receivedEvent?.(this, id);
+      if (alreadyHave) {
+        return;
+      }
+    }
+    try {
+      let data = JSON.parse(json);
+      switch (data[0]) {
+        case "EVENT": {
+          const so = this.openSubs.get(data[1]);
+          const event = data[2];
+          if (this.verifyEvent(event) && matchFilters(so.filters, event)) {
+            so.onevent(event);
+          } else {
+            so.oninvalidevent?.(event);
+          }
+          if (!so.lastEmitted || so.lastEmitted < event.created_at)
+            so.lastEmitted = event.created_at;
+          return;
+        }
+        case "COUNT": {
+          const id = data[1];
+          const payload = data[2];
+          const cr = this.openCountRequests.get(id);
+          if (cr) {
+            cr.resolve(payload.count);
+            this.openCountRequests.delete(id);
+          }
+          return;
+        }
+        case "EOSE": {
+          const so = this.openSubs.get(data[1]);
+          if (!so)
+            return;
+          so.receivedEose();
+          return;
+        }
+        case "OK": {
+          const id = data[1];
+          const ok = data[2];
+          const reason = data[3];
+          const ep = this.openEventPublishes.get(id);
+          if (ep) {
+            clearTimeout(ep.timeout);
+            if (ok)
+              ep.resolve(reason);
+            else
+              ep.reject(new Error(reason));
+            this.openEventPublishes.delete(id);
+          }
+          return;
+        }
+        case "CLOSED": {
+          const id = data[1];
+          const so = this.openSubs.get(id);
+          if (!so)
+            return;
+          so.closed = true;
+          so.close(data[2]);
+          return;
+        }
+        case "NOTICE": {
+          this.onnotice(data[1]);
+          return;
+        }
+        case "AUTH": {
+          this.challenge = data[1];
+          if (this.onauth) {
+            this.auth(this.onauth);
+          }
+          return;
+        }
+        default: {
+          const so = this.openSubs.get(data[1]);
+          so?.oncustom?.(data);
+          return;
+        }
+      }
+    } catch (err) {
+      try {
+        const [_, __, event] = JSON.parse(json);
+        console.warn(`[nostr] relay ${this.url} error processing message:`, err, event);
+      } catch (_) {
+        console.warn(`[nostr] relay ${this.url} error processing message:`, err);
+      }
+      return;
+    }
+  }
+};
+var Subscription = class {
+  relay;
+  id;
+  lastEmitted;
+  closed = false;
+  eosed = false;
+  filters;
+  alreadyHaveEvent;
+  receivedEvent;
+  onevent;
+  oninvalidevent;
+  oneose;
+  onclose;
+  oncustom;
+  eoseTimeout;
+  eoseTimeoutHandle;
+  constructor(relay, id, filters, params) {
+    if (filters.length === 0)
+      throw new Error("subscription can't be created with zero filters");
+    this.relay = relay;
+    this.filters = filters;
+    this.id = id;
+    this.alreadyHaveEvent = params.alreadyHaveEvent;
+    this.receivedEvent = params.receivedEvent;
+    this.eoseTimeout = params.eoseTimeout || relay.baseEoseTimeout;
+    this.oneose = params.oneose;
+    this.onclose = params.onclose;
+    this.oninvalidevent = params.oninvalidevent;
+    this.onevent = params.onevent || ((event) => {
+      console.warn(
+        `onevent() callback not defined for subscription '${this.id}' in relay ${this.relay.url}. event received:`,
+        event
+      );
+    });
+  }
+  fire() {
+    this.relay.send('["REQ","' + this.id + '",' + JSON.stringify(this.filters).substring(1));
+    this.eoseTimeoutHandle = setTimeout(this.receivedEose.bind(this), this.eoseTimeout);
+  }
+  receivedEose() {
+    if (this.eosed)
+      return;
+    clearTimeout(this.eoseTimeoutHandle);
+    this.eosed = true;
+    this.oneose?.();
+  }
+  close(reason = "closed by caller") {
+    if (!this.closed && this.relay.connected) {
+      try {
+        this.relay.send('["CLOSE",' + JSON.stringify(this.id) + "]");
+      } catch (err) {
+        if (err instanceof SendingOnClosedConnection) {
+        } else {
+          throw err;
+        }
+      }
+      this.closed = true;
+    }
+    this.relay.openSubs.delete(this.id);
+    this.relay.ongoingOperations--;
+    if (this.relay.ongoingOperations === 0)
+      this.relay.idleSince = Date.now();
+    this.onclose?.(reason);
+  }
+};
+var alwaysTrue = (t) => {
+  t[verifiedSymbol3] = true;
+  return true;
+};
+var AbstractSimplePool = class {
+  relays = /* @__PURE__ */ new Map();
+  seenOn = /* @__PURE__ */ new Map();
+  trackRelays = false;
+  verifyEvent;
+  enablePing;
+  enableReconnect;
+  automaticallyAuth;
+  trustedRelayURLs = /* @__PURE__ */ new Set();
+  onRelayConnectionFailure;
+  onRelayConnectionSuccess;
+  allowConnectingToRelay;
+  maxWaitForConnection;
+  _WebSocket;
+  constructor(opts) {
+    this.verifyEvent = opts.verifyEvent;
+    this._WebSocket = opts.websocketImplementation;
+    this.enablePing = opts.enablePing;
+    this.enableReconnect = opts.enableReconnect || false;
+    this.automaticallyAuth = opts.automaticallyAuth;
+    this.onRelayConnectionFailure = opts.onRelayConnectionFailure;
+    this.onRelayConnectionSuccess = opts.onRelayConnectionSuccess;
+    this.allowConnectingToRelay = opts.allowConnectingToRelay;
+    this.maxWaitForConnection = opts.maxWaitForConnection || 3e3;
+  }
+  async ensureRelay(url, params) {
+    url = normalizeURL2(url);
+    let relay = this.relays.get(url);
+    if (!relay) {
+      relay = new AbstractRelay(url, {
+        verifyEvent: this.trustedRelayURLs.has(url) ? alwaysTrue : this.verifyEvent,
+        websocketImplementation: this._WebSocket,
+        enablePing: this.enablePing,
+        enableReconnect: this.enableReconnect
+      });
+      relay.onclose = () => {
+        this.relays.delete(url);
+      };
+      this.relays.set(url, relay);
+    }
+    if (this.automaticallyAuth) {
+      const authSignerFn = this.automaticallyAuth(url);
+      if (authSignerFn) {
+        relay.onauth = authSignerFn;
+      }
+    }
+    try {
+      await relay.connect({
+        timeout: params?.connectionTimeout,
+        abort: params?.abort
+      });
+    } catch (err) {
+      this.relays.delete(url);
+      throw err;
+    }
+    return relay;
+  }
+  close(relays) {
+    relays.map(normalizeURL2).forEach((url) => {
+      this.relays.get(url)?.close();
+      this.relays.delete(url);
+    });
+  }
+  subscribe(relays, filter, params) {
+    const request = [];
+    const uniqUrls = [];
+    for (let i22 = 0; i22 < relays.length; i22++) {
+      const url = normalizeURL2(relays[i22]);
+      if (!request.find((r) => r.url === url)) {
+        if (uniqUrls.indexOf(url) === -1) {
+          uniqUrls.push(url);
+          request.push({ url, filter });
+        }
+      }
+    }
+    return this.subscribeMap(request, params);
+  }
+  subscribeMany(relays, filter, params) {
+    return this.subscribe(relays, filter, params);
+  }
+  subscribeMap(requests, params) {
+    const grouped = /* @__PURE__ */ new Map();
+    for (const req of requests) {
+      const { url, filter } = req;
+      if (!grouped.has(url))
+        grouped.set(url, []);
+      grouped.get(url).push(filter);
+    }
+    const groupedRequests = Array.from(grouped.entries()).map(([url, filters]) => ({ url, filters }));
+    if (this.trackRelays) {
+      params.receivedEvent = (relay, id) => {
+        let set = this.seenOn.get(id);
+        if (!set) {
+          set = /* @__PURE__ */ new Set();
+          this.seenOn.set(id, set);
+        }
+        set.add(relay);
+      };
+    }
+    const _knownIds = /* @__PURE__ */ new Set();
+    const subs = [];
+    const eosesReceived = [];
+    let handleEose = (i22) => {
+      if (eosesReceived[i22])
+        return;
+      eosesReceived[i22] = true;
+      if (eosesReceived.filter((a) => a).length === groupedRequests.length) {
+        params.oneose?.();
+        handleEose = () => {
+        };
+      }
+    };
+    const closesReceived = [];
+    let handleClose = (i22, reason) => {
+      if (closesReceived[i22])
+        return;
+      handleEose(i22);
+      closesReceived[i22] = reason;
+      if (closesReceived.filter((a) => a).length === groupedRequests.length) {
+        params.onclose?.(closesReceived);
+        handleClose = () => {
+        };
+      }
+    };
+    const localAlreadyHaveEventHandler = (id) => {
+      if (params.alreadyHaveEvent?.(id)) {
+        return true;
+      }
+      const have = _knownIds.has(id);
+      _knownIds.add(id);
+      return have;
+    };
+    const allOpened = Promise.all(
+      groupedRequests.map(async ({ url, filters }, i22) => {
+        if (this.allowConnectingToRelay?.(url, ["read", filters]) === false) {
+          handleClose(i22, "connection skipped by allowConnectingToRelay");
+          return;
+        }
+        let relay;
+        try {
+          relay = await this.ensureRelay(url, {
+            connectionTimeout: this.maxWaitForConnection < (params.maxWait || 0) ? Math.max(params.maxWait * 0.8, params.maxWait - 1e3) : this.maxWaitForConnection,
+            abort: params.abort
+          });
+        } catch (err) {
+          this.onRelayConnectionFailure?.(url);
+          handleClose(i22, err?.message || String(err));
+          return;
+        }
+        this.onRelayConnectionSuccess?.(url);
+        let subscription = relay.subscribe(filters, {
+          ...params,
+          oneose: () => handleEose(i22),
+          onclose: (reason) => {
+            if (reason.startsWith("auth-required: ") && params.onauth) {
+              relay.auth(params.onauth).then(() => {
+                relay.subscribe(filters, {
+                  ...params,
+                  oneose: () => handleEose(i22),
+                  onclose: (reason2) => {
+                    handleClose(i22, reason2);
+                  },
+                  alreadyHaveEvent: localAlreadyHaveEventHandler,
+                  eoseTimeout: params.maxWait,
+                  abort: params.abort
+                });
+              }).catch((err) => {
+                handleClose(i22, `auth was required and attempted, but failed with: ${err}`);
+              });
+            } else {
+              handleClose(i22, reason);
+            }
+          },
+          alreadyHaveEvent: localAlreadyHaveEventHandler,
+          eoseTimeout: params.maxWait,
+          abort: params.abort
+        });
+        subs.push(subscription);
+      })
+    );
+    return {
+      async close(reason) {
+        await allOpened;
+        subs.forEach((sub) => {
+          sub.close(reason);
+        });
+      }
+    };
+  }
+  subscribeEose(relays, filter, params) {
+    let subcloser;
+    subcloser = this.subscribe(relays, filter, {
+      ...params,
+      oneose() {
+        const reason = "closed automatically on eose";
+        if (subcloser)
+          subcloser.close(reason);
+        else
+          params.onclose?.(relays.map((_) => reason));
+      }
+    });
+    return subcloser;
+  }
+  subscribeManyEose(relays, filter, params) {
+    return this.subscribeEose(relays, filter, params);
+  }
+  async querySync(relays, filter, params) {
+    return new Promise(async (resolve) => {
+      const events = [];
+      this.subscribeEose(relays, filter, {
+        ...params,
+        onevent(event) {
+          events.push(event);
+        },
+        onclose(_) {
+          resolve(events);
+        }
+      });
+    });
+  }
+  async get(relays, filter, params) {
+    filter.limit = 1;
+    const events = await this.querySync(relays, filter, params);
+    events.sort((a, b) => b.created_at - a.created_at);
+    return events[0] || null;
+  }
+  publish(relays, event, params) {
+    return relays.map(normalizeURL2).map(async (url, i22, arr) => {
+      if (arr.indexOf(url) !== i22) {
+        return Promise.reject("duplicate url");
+      }
+      if (this.allowConnectingToRelay?.(url, ["write", event]) === false) {
+        return Promise.reject("connection skipped by allowConnectingToRelay");
+      }
+      let r;
+      try {
+        r = await this.ensureRelay(url, {
+          connectionTimeout: this.maxWaitForConnection < (params?.maxWait || 0) ? Math.max(params.maxWait * 0.8, params.maxWait - 1e3) : this.maxWaitForConnection,
+          abort: params?.abort
+        });
+      } catch (err) {
+        this.onRelayConnectionFailure?.(url);
+        return String("connection failure: " + String(err));
+      }
+      return r.publish(event).catch(async (err) => {
+        if (err instanceof Error && err.message.startsWith("auth-required: ") && params?.onauth) {
+          await r.auth(params.onauth);
+          return r.publish(event);
+        }
+        throw err;
+      }).then((reason) => {
+        if (this.trackRelays) {
+          let set = this.seenOn.get(event.id);
+          if (!set) {
+            set = /* @__PURE__ */ new Set();
+            this.seenOn.set(event.id, set);
+          }
+          set.add(r);
+        }
+        return reason;
+      });
+    });
+  }
+  listConnectionStatus() {
+    const map = /* @__PURE__ */ new Map();
+    this.relays.forEach((relay, url) => map.set(url, relay.connected));
+    return map;
+  }
+  destroy() {
+    this.relays.forEach((conn) => conn.close());
+    this.relays = /* @__PURE__ */ new Map();
+  }
+  pruneIdleRelays(idleThresholdMs = 1e4) {
+    const prunedUrls = [];
+    for (const [url, relay] of this.relays) {
+      if (relay.idleSince && Date.now() - relay.idleSince >= idleThresholdMs) {
+        this.relays.delete(url);
+        prunedUrls.push(url);
+        relay.close();
+      }
+    }
+    return prunedUrls;
+  }
+};
+var _WebSocket3;
+try {
+  _WebSocket3 = WebSocket;
+} catch {
+}
+var SimplePool = class extends AbstractSimplePool {
+  constructor(options) {
+    super({ verifyEvent: verifyEvent3, websocketImplementation: _WebSocket3, maxWaitForConnection: 3e3, ...options });
+  }
+};
+
+// ../nip/dist/chunk-2J3CSGKL.js
+function computeAggregateHash(entries) {
+  const lines = entries.map((entry) => `${entry.sha256} ${entry.path}
+`);
+  lines.sort();
+  return bytesToHex2(sha256(new TextEncoder().encode(lines.join(""))));
+}
+function pathEntriesFromTags(tags) {
+  const entries = [];
+  for (const tag of tags) {
+    if (tag[0] === "path" && typeof tag[1] === "string" && typeof tag[2] === "string" && tag[1].length > 0 && tag[2].length > 0) {
+      entries.push({ path: tag[1], sha256: tag[2] });
+    }
+  }
+  return entries;
+}
+function aggregateTagValue(tags) {
+  for (const tag of tags) {
+    if (tag[0] === "x" && tag[2] === "aggregate" && typeof tag[1] === "string" && tag[1].length > 0) {
+      return tag[1];
+    }
+  }
+  return void 0;
+}
+
+// ../nip/dist/chunk-CDBUCFLP.js
+var MIB = 1024 * 1024;
+var NAPPLET_ARTIFACT_CACHE_NAME = "kehto:napplet-artifacts:v1";
+var SCHEMA_VERSION = 1;
+var DEFAULT_BASE_URL = "https://kehto.invalid";
+var DEFAULT_UNKNOWN_BUDGET_BYTES = 32 * MIB;
+var DEFAULT_SOFT_CEILING_BYTES = 128 * MIB;
+var DEFAULT_HARD_CEILING_BYTES = 256 * MIB;
+var DEFAULT_FOREGROUND_TTL_MS = 15 * 60 * 1e3;
+var DEFAULT_BACKGROUND_TTL_MS = 60 * 60 * 1e3;
+function emptyIndex(now2) {
+  return {
+    schemaVersion: SCHEMA_VERSION,
+    updatedAt: now2,
+    blobs: {},
+    aggregates: {},
+    coordinates: {}
+  };
+}
+function aggregateKey(dTag, aggregateHash) {
+  return `${encodeURIComponent(dTag)}:${aggregateHash}`;
+}
+function coordinateKey(kind, pubkey, dTag) {
+  return `${kind}:${pubkey}:${encodeURIComponent(dTag)}`;
+}
+function isCoordinateFresh(coordinate, options = {}) {
+  const now2 = options.now ?? Date.now();
+  const ttl = options.background ? coordinate.backgroundTtlMs : coordinate.foregroundTtlMs;
+  return ttl === Number.POSITIVE_INFINITY || now2 - coordinate.lastResolvedAt <= ttl;
+}
+function byteLength2(bytes) {
+  return bytes.byteLength;
+}
+function encodeKeyPart(value) {
+  return encodeURIComponent(value).replaceAll("%2F", "%252F");
+}
+function cloneBytes(bytes) {
+  return new Uint8Array(bytes);
+}
+function responseBody(bytes) {
+  return cloneBytes(bytes).buffer;
+}
+function normalizeBaseUrl(baseUrl) {
+  return baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+}
+function resolveBaseUrl(baseUrl) {
+  if (baseUrl) return normalizeBaseUrl(baseUrl);
+  const maybeLocation = globalThis;
+  if (maybeLocation.location?.origin) return normalizeBaseUrl(maybeLocation.location.origin);
+  return normalizeBaseUrl(DEFAULT_BASE_URL);
+}
+async function responseBytes(response) {
+  return new Uint8Array(await response.arrayBuffer());
+}
+async function responseJson(response) {
+  return response.json();
+}
+function refCounts(index) {
+  const counts = {};
+  for (const aggregate of Object.values(index.aggregates)) {
+    for (const hash of aggregate.blobHashes) counts[hash] = (counts[hash] ?? 0) + 1;
+  }
+  return counts;
+}
+function cachedSize(index) {
+  const blobBytes = Object.values(index.blobs).reduce((sum, entry) => sum + entry.size, 0);
+  const aggregateBytes = Object.values(index.aggregates).reduce((sum, entry) => sum + entry.size, 0);
+  return blobBytes + aggregateBytes;
+}
+var CacheStorageNappletArtifactCache = class {
+  cacheStorage;
+  storage;
+  cacheName;
+  baseUrl;
+  now;
+  activeAggregates = /* @__PURE__ */ new Set();
+  onDiagnostic;
+  unknownBudgetBytes;
+  softCeilingBytes;
+  hardCeilingBytes;
+  cachePromise;
+  constructor(options = {}) {
+    const maybeCacheStorage = options.cacheStorage ?? globalThis.caches;
+    if (!maybeCacheStorage) {
+      throw new Error("Cache Storage is unavailable");
+    }
+    this.cacheStorage = maybeCacheStorage;
+    this.storage = options.storage ?? globalThis.navigator?.storage;
+    this.cacheName = options.cacheName ?? NAPPLET_ARTIFACT_CACHE_NAME;
+    this.baseUrl = resolveBaseUrl(options.baseUrl);
+    this.now = options.now ?? Date.now;
+    this.onDiagnostic = options.onDiagnostic;
+    this.unknownBudgetBytes = options.unknownBudgetBytes ?? DEFAULT_UNKNOWN_BUDGET_BYTES;
+    this.softCeilingBytes = options.softCeilingBytes ?? DEFAULT_SOFT_CEILING_BYTES;
+    this.hardCeilingBytes = options.hardCeilingBytes ?? DEFAULT_HARD_CEILING_BYTES;
+  }
+  async readBlob(sha256Hex) {
+    try {
+      const cache2 = await this.open();
+      const response = await cache2.match(this.blobUrl(sha256Hex));
+      if (!response) return void 0;
+      const bytes = await responseBytes(response);
+      const index = await this.readIndex(cache2);
+      const entry = index.blobs[sha256Hex];
+      if (entry) {
+        entry.lastAccessed = this.now();
+        index.updatedAt = entry.lastAccessed;
+        await this.writeIndex(cache2, index);
+      }
+      return bytes;
+    } catch (cause) {
+      this.diagnostic({ type: "cache-read-failed", message: `failed to read blob ${sha256Hex}`, cause });
+      return void 0;
+    }
+  }
+  async deleteBlob(sha256Hex) {
+    try {
+      const cache2 = await this.open();
+      await cache2.delete(this.blobUrl(sha256Hex));
+      const index = await this.readIndex(cache2);
+      delete index.blobs[sha256Hex];
+      index.updatedAt = this.now();
+      await this.writeIndex(cache2, index);
+    } catch (cause) {
+      this.diagnostic({ type: "cache-delete-failed", message: `failed to delete blob ${sha256Hex}`, cause });
+    }
+  }
+  async writeVerifiedResolution(input) {
+    try {
+      await this.writeVerifiedResolutionOnce(input);
+    } catch (firstCause) {
+      try {
+        await this.prune(input.now ?? this.now());
+        await this.writeVerifiedResolutionOnce(input);
+      } catch (cause) {
+        this.diagnostic({
+          type: "cache-write-failed",
+          message: "failed to write verified napplet artifacts after prune retry",
+          cause: cause ?? firstCause
+        });
+      }
+    }
+  }
+  async writeCoordinate(input) {
+    const cache2 = await this.open();
+    const now2 = this.now();
+    const index = await this.readIndex(cache2);
+    const key = coordinateKey(input.kind, input.pubkey, input.dTag);
+    index.coordinates[key] = {
+      key,
+      kind: input.kind,
+      pubkey: input.pubkey,
+      dTag: input.dTag,
+      aggregateHash: input.aggregateHash,
+      lastResolvedAt: input.lastResolvedAt ?? now2,
+      foregroundTtlMs: input.foregroundTtlMs ?? DEFAULT_FOREGROUND_TTL_MS,
+      backgroundTtlMs: input.backgroundTtlMs ?? DEFAULT_BACKGROUND_TTL_MS
+    };
+    index.updatedAt = now2;
+    await this.writeIndex(cache2, index);
+  }
+  async getCoordinate(input, options = {}) {
+    const cache2 = await this.open();
+    const index = await this.readIndex(cache2);
+    const coordinate = index.coordinates[coordinateKey(input.kind, input.pubkey, input.dTag)];
+    if (!coordinate) return void 0;
+    return { ...coordinate, fresh: isCoordinateFresh(coordinate, options) };
+  }
+  async touchAggregate(dTag, aggregateHash, now2 = this.now()) {
+    const cache2 = await this.open();
+    const index = await this.readIndex(cache2);
+    const key = aggregateKey(dTag, aggregateHash);
+    const aggregate = index.aggregates[key];
+    if (!aggregate) return;
+    aggregate.lastAccessed = now2;
+    for (const hash of aggregate.blobHashes) {
+      if (index.blobs[hash]) index.blobs[hash].lastAccessed = now2;
+    }
+    index.updatedAt = now2;
+    await this.writeIndex(cache2, index);
+  }
+  markAggregateActive(dTag, aggregateHash) {
+    this.activeAggregates.add(aggregateKey(dTag, aggregateHash));
+  }
+  releaseAggregateActive(dTag, aggregateHash) {
+    this.activeAggregates.delete(aggregateKey(dTag, aggregateHash));
+  }
+  async prune(now2 = this.now()) {
+    try {
+      const cache2 = await this.open();
+      const index = await this.readIndex(cache2);
+      let size = cachedSize(index);
+      const budget = await this.budgetBytes();
+      const hardBudget = await this.hardBudgetBytes();
+      const shouldPrune = size > budget || await this.originPressureHigh();
+      if (!shouldPrune) return;
+      this.rewriteRefCounts(index);
+      for (const [hash, blob] of Object.entries(index.blobs)) {
+        if (size <= budget) break;
+        if (blob.refCount > 0) continue;
+        await cache2.delete(this.blobUrl(hash));
+        delete index.blobs[hash];
+        size -= blob.size;
+      }
+      const currentAggregateHashes = new Set(
+        Object.values(index.coordinates).map((coordinate) => coordinate.aggregateHash)
+      );
+      const aggregates = Object.values(index.aggregates).filter((entry) => !this.activeAggregates.has(entry.key)).sort((a, b) => {
+        const currentA = currentAggregateHashes.has(a.aggregateHash) ? 1 : 0;
+        const currentB = currentAggregateHashes.has(b.aggregateHash) ? 1 : 0;
+        if (currentA !== currentB) return currentA - currentB;
+        return a.lastAccessed - b.lastAccessed;
+      });
+      for (const aggregate of aggregates) {
+        if (size <= budget) break;
+        await cache2.delete(this.aggregateUrl(aggregate.key));
+        delete index.aggregates[aggregate.key];
+        size -= aggregate.size;
+        this.rewriteRefCounts(index);
+      }
+      if (size > hardBudget) {
+        const active = Object.values(index.aggregates).filter((entry) => this.activeAggregates.has(entry.key)).sort((a, b) => a.lastAccessed - b.lastAccessed);
+        for (const aggregate of active) {
+          if (size <= hardBudget) break;
+          await cache2.delete(this.aggregateUrl(aggregate.key));
+          delete index.aggregates[aggregate.key];
+          size -= aggregate.size;
+        }
+      }
+      this.rewriteRefCounts(index);
+      for (const [hash, blob] of Object.entries(index.blobs)) {
+        if (blob.refCount === 0) {
+          await cache2.delete(this.blobUrl(hash));
+          delete index.blobs[hash];
+        }
+      }
+      index.updatedAt = now2;
+      await this.writeIndex(cache2, index);
+    } catch (cause) {
+      this.diagnostic({ type: "cache-prune-failed", message: "failed to prune napplet artifact cache", cause });
+    }
+  }
+  async snapshotIndex() {
+    return this.readIndex(await this.open());
+  }
+  async writeVerifiedResolutionOnce(input) {
+    const cache2 = await this.open();
+    const now2 = input.now ?? this.now();
+    const index = await this.readIndex(cache2);
+    const blobHashes = [];
+    for (const pathEntry of input.manifest.paths) {
+      const bytes = input.files.get(pathEntry.path);
+      if (!bytes) continue;
+      blobHashes.push(pathEntry.sha256);
+      await cache2.put(this.blobUrl(pathEntry.sha256), new Response(responseBody(bytes)));
+      index.blobs[pathEntry.sha256] = {
+        size: byteLength2(bytes),
+        lastAccessed: now2,
+        refCount: index.blobs[pathEntry.sha256]?.refCount ?? 0
+      };
+    }
+    const key = aggregateKey(input.manifest.dTag, input.manifest.aggregateHash);
+    const record = {
+      schemaVersion: SCHEMA_VERSION,
+      dTag: input.manifest.dTag,
+      aggregateHash: input.manifest.aggregateHash,
+      manifest: {
+        kind: input.manifest.kind,
+        pubkey: input.manifest.pubkey,
+        dTag: input.manifest.dTag,
+        paths: input.manifest.paths.map((entry) => ({ path: entry.path, sha256: entry.sha256 })),
+        requires: [...input.manifest.requires],
+        ...input.manifest.title === void 0 ? {} : { title: input.manifest.title },
+        ...input.manifest.description === void 0 ? {} : { description: input.manifest.description }
+      },
+      indexHtml: input.indexHtml,
+      blobHashes,
+      writtenAt: now2
+    };
+    const aggregateBytes = new TextEncoder().encode(JSON.stringify(record));
+    await cache2.put(this.aggregateUrl(key), new Response(responseBody(aggregateBytes), {
+      headers: { "content-type": "application/json" }
+    }));
+    const coordKey = coordinateKey(input.manifest.kind, input.manifest.pubkey, input.manifest.dTag);
+    index.aggregates[key] = {
+      dTag: input.manifest.dTag,
+      aggregateHash: input.manifest.aggregateHash,
+      key,
+      blobHashes,
+      size: byteLength2(aggregateBytes),
+      lastAccessed: now2,
+      coordinateKey: coordKey
+    };
+    index.coordinates[coordKey] = {
+      key: coordKey,
+      kind: input.manifest.kind,
+      pubkey: input.manifest.pubkey,
+      dTag: input.manifest.dTag,
+      aggregateHash: input.manifest.aggregateHash,
+      lastResolvedAt: now2,
+      foregroundTtlMs: DEFAULT_FOREGROUND_TTL_MS,
+      backgroundTtlMs: DEFAULT_BACKGROUND_TTL_MS
+    };
+    this.rewriteRefCounts(index);
+    index.updatedAt = now2;
+    await this.writeIndex(cache2, index);
+    await this.prune(now2);
+  }
+  async open() {
+    this.cachePromise ??= this.cacheStorage.open(this.cacheName);
+    return this.cachePromise;
+  }
+  indexUrl() {
+    return new URL("__kehto_napplet_cache/index.json", this.baseUrl).toString();
+  }
+  blobUrl(hash) {
+    return new URL(`__kehto_napplet_cache/blob/${encodeKeyPart(hash)}`, this.baseUrl).toString();
+  }
+  aggregateUrl(key) {
+    return new URL(`__kehto_napplet_cache/aggregate/${encodeKeyPart(key)}.json`, this.baseUrl).toString();
+  }
+  async readIndex(cache2) {
+    const response = await cache2.match(this.indexUrl());
+    if (!response) return emptyIndex(this.now());
+    try {
+      const index = await responseJson(response);
+      if (index.schemaVersion !== SCHEMA_VERSION) return emptyIndex(this.now());
+      return index;
+    } catch {
+      return emptyIndex(this.now());
+    }
+  }
+  async writeIndex(cache2, index) {
+    await cache2.put(this.indexUrl(), new Response(JSON.stringify(index), {
+      headers: { "content-type": "application/json" }
+    }));
+  }
+  rewriteRefCounts(index) {
+    const counts = refCounts(index);
+    for (const [hash, blob] of Object.entries(index.blobs)) {
+      blob.refCount = counts[hash] ?? 0;
+    }
+  }
+  async budgetBytes() {
+    const estimate = await this.estimateStorage();
+    if (!estimate?.quota) return this.unknownBudgetBytes;
+    return Math.min(this.softCeilingBytes, Math.floor(estimate.quota * 0.1));
+  }
+  async hardBudgetBytes() {
+    const estimate = await this.estimateStorage();
+    if (!estimate?.quota) return this.unknownBudgetBytes;
+    return Math.min(this.hardCeilingBytes, Math.floor(estimate.quota * 0.2));
+  }
+  async originPressureHigh() {
+    const estimate = await this.estimateStorage();
+    if (!estimate?.quota || estimate.usage === void 0) return false;
+    return estimate.usage / estimate.quota >= 0.8;
+  }
+  async estimateStorage() {
+    if (!this.storage?.estimate) return void 0;
+    try {
+      return this.storage.estimate();
+    } catch (cause) {
+      this.diagnostic({
+        type: "storage-estimate-unavailable",
+        message: "storage estimate failed; using unknown quota cache budget",
+        cause
+      });
+      return void 0;
+    }
+  }
+  diagnostic(diagnostic) {
+    this.onDiagnostic?.(diagnostic);
+  }
+};
+async function openNappletArtifactCache(options = {}) {
+  const cacheStorage = options.cacheStorage ?? globalThis.caches;
+  if (!cacheStorage) return void 0;
+  const storage = options.storage ?? globalThis.navigator?.storage;
+  if (options.requireStorageEstimate && !storage?.estimate) {
+    options.onDiagnostic?.({
+      type: "storage-estimate-unavailable",
+      message: "storage estimates are unavailable; using network-only loading"
+    });
+    return void 0;
+  }
+  try {
+    const cache2 = new CacheStorageNappletArtifactCache({ ...options, cacheStorage, storage });
+    await cache2.snapshotIndex();
+    return cache2;
+  } catch (cause) {
+    options.onDiagnostic?.({
+      type: "cache-open-failed",
+      message: "Cache Storage napplet artifact cache could not be opened",
+      cause
+    });
+    return void 0;
+  }
+}
+var NAPPLET_KIND_SNAPSHOT = 5129;
+var NAPPLET_KIND_ROOT = 15129;
+var NAPPLET_KIND_NAMED = 35129;
+var NAPPLET_KINDS = [
+  NAPPLET_KIND_SNAPSHOT,
+  NAPPLET_KIND_ROOT,
+  NAPPLET_KIND_NAMED
+];
+function isNappletManifestKind(kind) {
+  return NAPPLET_KINDS.includes(kind);
+}
+var NappletResolutionError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "NappletResolutionError";
+    this.code = code;
+  }
+};
+function firstTagValue(tags, name) {
+  for (const tag of tags) {
+    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) return tag[1];
+  }
+  return void 0;
+}
+function allTagValues(tags, name) {
+  const out = [];
+  for (const tag of tags) {
+    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) out.push(tag[1]);
+  }
+  return out;
+}
+function archetypesFromTags(tags) {
+  const out = [];
+  for (const tag of tags) {
+    if (tag[0] !== "archetype") continue;
+    if (typeof tag[1] !== "string" || tag[1].length === 0) continue;
+    out.push(
+      typeof tag[2] === "string" && tag[2].length > 0 ? { slug: tag[1], nap: tag[2] } : { slug: tag[1] }
+    );
+  }
+  return out;
+}
+function parseNappletManifest(event) {
+  if (!isNappletManifestKind(event.kind)) {
+    throw new NappletResolutionError("invalid-manifest", `not a NIP-5D napplet kind: ${event.kind}`);
+  }
+  const paths = pathEntriesFromTags(event.tags);
+  if (paths.length === 0) {
+    throw new NappletResolutionError("invalid-manifest", "manifest has no path tags");
+  }
+  const aggregateHash = aggregateTagValue(event.tags);
+  if (!aggregateHash) {
+    throw new NappletResolutionError("invalid-manifest", "manifest has no aggregate x tag");
+  }
+  return {
+    kind: event.kind,
+    pubkey: event.pubkey,
+    dTag: firstTagValue(event.tags, "d") ?? "",
+    paths,
+    aggregateHash,
+    servers: allTagValues(event.tags, "server"),
+    requires: allTagValues(event.tags, "requires"),
+    archetypes: archetypesFromTags(event.tags),
+    title: firstTagValue(event.tags, "title"),
+    description: firstTagValue(event.tags, "description"),
+    source: firstTagValue(event.tags, "source")
+  };
+}
+function verifyManifestSignature(event) {
+  try {
+    return verifyEvent(event);
+  } catch {
+    return false;
+  }
+}
+function verifyBlobHash(bytes, sha256Hex) {
+  return bytesToHex2(sha256(bytes)) === sha256Hex;
+}
+function stripTrailingSlash(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+async function fetchBlob(servers, sha256Hex, fetchBytes) {
+  for (const server of servers) {
+    const url = `${stripTrailingSlash(server)}/${sha256Hex}`;
+    try {
+      const bytes = await fetchBytes(url);
+      if (verifyBlobHash(bytes, sha256Hex)) return bytes;
+    } catch {
+    }
+  }
+  throw new NappletResolutionError("blob-unavailable", `no server served blob ${sha256Hex}`);
+}
+var INDEX_PATHS = ["/index.html", "index.html", "/"];
+function defaultDecode(bytes) {
+  return new TextDecoder().decode(bytes);
+}
+async function resolveNapplet(options) {
+  const { event, fetchBlob: fetchBlobBytes, textDecode = defaultDecode, cache: cache2 } = options;
+  if (!verifyManifestSignature(event)) {
+    throw new NappletResolutionError("invalid-signature", "manifest signature is invalid");
+  }
+  const manifest = parseNappletManifest(event);
+  const recomputed = computeAggregateHash(manifest.paths);
+  if (recomputed !== manifest.aggregateHash) {
+    throw new NappletResolutionError(
+      "aggregate-mismatch",
+      `recomputed aggregate ${recomputed} != manifest ${manifest.aggregateHash}`
+    );
+  }
+  const files = /* @__PURE__ */ new Map();
+  for (const entry of manifest.paths) {
+    let bytes = await cache2?.readBlob(entry.sha256);
+    if (bytes && !verifyBlobHash(bytes, entry.sha256)) {
+      await cache2?.deleteBlob(entry.sha256);
+      bytes = void 0;
+    }
+    bytes ??= await fetchBlobBytes(entry.sha256, manifest.servers);
+    if (!verifyBlobHash(bytes, entry.sha256)) {
+      throw new NappletResolutionError(
+        "blob-hash-mismatch",
+        `blob for ${entry.path} does not match hash ${entry.sha256}`
+      );
+    }
+    files.set(entry.path, bytes);
+  }
+  const indexEntry = manifest.paths.find((e) => INDEX_PATHS.includes(e.path));
+  if (!indexEntry) {
+    throw new NappletResolutionError("missing-index", "manifest has no /index.html entry");
+  }
+  const indexHtml = textDecode(files.get(indexEntry.path));
+  await cache2?.writeVerifiedResolution({ event, manifest, files, indexHtml });
+  return {
+    dTag: manifest.dTag,
+    aggregateHash: manifest.aggregateHash,
+    files,
+    indexHtml,
+    manifest
+  };
+}
+
+// src/runtime-resolver.ts
+var PAJA_NAPPLET_MANIFEST_KIND = 35129;
+function decodePajaPointer(value) {
+  const trimmed = value.trim();
+  const decoded = decode(trimmed);
+  if (decoded.type === "naddr") {
+    return {
+      type: "naddr",
+      value: trimmed,
+      identifier: decoded.data.identifier,
+      pubkey: decoded.data.pubkey,
+      kind: decoded.data.kind,
+      relays: [...decoded.data.relays ?? []]
+    };
+  }
+  if (decoded.type === "nevent") {
+    return {
+      type: "nevent",
+      value: trimmed,
+      id: decoded.data.id,
+      ...decoded.data.author ? { author: decoded.data.author } : {},
+      ...decoded.data.kind ? { kind: decoded.data.kind } : {},
+      relays: [...decoded.data.relays ?? []]
+    };
+  }
+  throw new Error(`Expected naddr or nevent pointer, got ${decoded.type}.`);
+}
+async function resolvePajaPointer(value, options = {}) {
+  const pointer = decodePajaPointer(value);
+  const relays = uniqueRelayUrls([...pointer.relays, ...options.relays ?? []]);
+  if (relays.length === 0) {
+    throw new Error("Pointer does not include relay hints; add a relay-bearing naddr or nevent.");
+  }
+  const pool = options.pool ?? new SimplePool();
+  const ownsPool = options.pool === void 0;
+  try {
+    const event = await resolvePointerEvent(pointer, pool, relays, options.maxWaitMs ?? 5e3);
+    const blossomServers = [...options.blossomServers ?? []];
+    const resolved = await resolveNapplet({
+      event,
+      cache: await openNappletArtifactCache({ requireStorageEstimate: false }),
+      fetchBlob: (sha256Hex, servers) => fetchBlob([...servers, ...blossomServers], sha256Hex, async (url) => {
+        const response = await (options.fetcher ?? fetch)(url);
+        if (!response.ok) throw new Error(`[paja-runtime] blob ${url}: ${response.status}`);
+        return new Uint8Array(await response.arrayBuffer());
+      })
+    });
+    return {
+      pointer,
+      event,
+      relays,
+      blossomServers,
+      dTag: resolved.dTag,
+      aggregateHash: resolved.aggregateHash,
+      indexHtml: resolved.indexHtml,
+      manifest: resolved.manifest
+    };
+  } finally {
+    if (ownsPool) {
+      pool.close?.(relays);
+      pool.destroy?.();
+    }
+  }
+}
+function injectPajaRuntimeCsp(html, origins) {
+  const value = origins.length > 0 ? `connect-src ${[...new Set(origins)].sort().join(" ")}` : "connect-src 'none'";
+  const meta = `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(value)}">`;
+  if (/<head[^>]*>/i.test(html)) {
+    return html.replace(/<head[^>]*>/i, (open) => `${open}${meta}`);
+  }
+  if (/<html[^>]*>/i.test(html)) {
+    return html.replace(/<html[^>]*>/i, (open) => `${open}<head>${meta}</head>`);
+  }
+  return `${meta}${html}`;
+}
+async function resolvePointerEvent(pointer, pool, relays, maxWaitMs) {
+  const filter = pointer.type === "naddr" ? addressableFilter(pointer) : eventFilter(pointer);
+  const events = await pool.querySync([...relays], filter, {
+    maxWait: maxWaitMs,
+    label: "kehto-paja-runtime"
+  });
+  const event = events.filter((candidate) => matchesPointer(pointer, candidate)).sort((a, b) => b.created_at - a.created_at)[0];
+  if (!event) {
+    throw new Error(`No napplet manifest event found for ${pointer.type} pointer.`);
+  }
+  if (event.kind !== PAJA_NAPPLET_MANIFEST_KIND) {
+    throw new Error(`Pointer resolved kind ${event.kind}; expected ${PAJA_NAPPLET_MANIFEST_KIND}.`);
+  }
+  return event;
+}
+function addressableFilter(pointer) {
+  if (pointer.kind !== PAJA_NAPPLET_MANIFEST_KIND) {
+    throw new Error(`naddr kind ${pointer.kind} is not a napplet manifest kind.`);
+  }
+  return {
+    kinds: [PAJA_NAPPLET_MANIFEST_KIND],
+    authors: [pointer.pubkey],
+    "#d": [pointer.identifier],
+    limit: 1
+  };
+}
+function eventFilter(pointer) {
+  return {
+    ids: [pointer.id],
+    ...pointer.kind ? { kinds: [pointer.kind] } : {},
+    ...pointer.author ? { authors: [pointer.author] } : {},
+    limit: 1
+  };
+}
+function matchesPointer(pointer, event) {
+  if (pointer.type === "nevent") {
+    if (event.id !== pointer.id) return false;
+    if (pointer.author && event.pubkey !== pointer.author) return false;
+    if (pointer.kind && event.kind !== pointer.kind) return false;
+    return true;
+  }
+  return event.kind === pointer.kind && event.pubkey === pointer.pubkey && event.tags.some((tag) => tag[0] === "d" && tag[1] === pointer.identifier);
+}
+function uniqueRelayUrls(values) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const url = normalizeRelayUrl(value);
+    if (!url || seen.has(url)) continue;
+    seen.add(url);
+    out.push(url);
+  }
+  return out;
+}
+function normalizeRelayUrl(value) {
+  const raw = value.trim();
+  if (!raw) return void 0;
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "wss:" && url.protocol !== "ws:") return void 0;
+    url.hash = "";
+    url.search = "";
+    return url.href.replace(/\/$/, "");
+  } catch {
+    return void 0;
+  }
+}
+function escapeAttribute(value) {
+  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+
+// src/browser-host.ts
+var bridgeRef = null;
+function readConfig() {
+  const script = document.getElementById("kehto-paja-config");
+  if (!script?.textContent) {
+    throw new Error("Missing Kehto Paja config.");
+  }
+  return JSON.parse(script.textContent);
+}
+async function readLatestConfig(fallback) {
+  try {
+    const response = await fetch(new URL("./__kehto/config.json", window.location.href), { cache: "no-store" });
+    if (!response.ok) return fallback;
+    return await response.json();
+  } catch (error) {
+    console.warn("[paja] config refresh failed; using embedded config", error);
+    return fallback;
+  }
+}
+function setTargetUrlDisplay(config, frame) {
+  const label = getTargetLabel(config);
+  const targetEl = document.querySelector(".target");
+  if (targetEl) {
+    targetEl.textContent = label;
+    targetEl.setAttribute("title", label);
+  }
+  frame.dataset.targetUrl = label;
+}
+function getTargetLabel(config) {
+  if (config.target.mode === "runtime-pointer") return config.target.pointer?.value ?? "runtime pointer";
+  return config.target.url;
+}
+function readInitialPointerValue(config) {
+  if (config.target.mode !== "runtime-pointer") return "";
+  const params = new URLSearchParams(window.location.search);
+  return params.get("naddr") ?? params.get("nevent") ?? params.get("pointer") ?? config.target.pointer?.value ?? "";
+}
+function connectOrigins(urls) {
+  const out = /* @__PURE__ */ new Set();
+  for (const value of urls) {
+    try {
+      const url = new URL(value);
+      if (url.protocol === "wss:" || url.protocol === "ws:") {
+        out.add(value.replace(/\/$/, ""));
+      } else {
+        out.add(url.origin);
+      }
+    } catch {
+    }
+  }
+  return [...out];
+}
+function setStatus(state, status) {
+  state.status = status;
+  const statusEl = document.getElementById("lifecycle-status");
+  if (statusEl) statusEl.textContent = status;
+}
+function setSimulationStatus(state) {
+  const statusEl = document.getElementById("simulation-status");
+  if (statusEl) statusEl.textContent = summarizePajaSimulation(state.simulation);
+  const themeSelect = document.getElementById("simulation-theme");
+  if (themeSelect instanceof HTMLSelectElement) themeSelect.value = state.simulation.theme.mode;
+  renderPajaDevtools(state, { bridge: bridgeRef, devSignerPubkey: PAJA_DEV_SIGNER_PUBKEY });
+}
+function setPointerStatus(state, message) {
+  state.pointerStatus = message;
+  const statusEl = document.getElementById("runtime-pointer-status");
+  if (statusEl) statusEl.textContent = message;
+}
+function getFrame() {
+  const frame = document.getElementById("napplet-frame");
+  if (!(frame instanceof HTMLIFrameElement)) {
+    throw new Error("Missing Kehto Paja iframe.");
+  }
+  frame.sandbox.add("allow-scripts");
+  frame.sandbox.remove("allow-same-origin");
+  return frame;
+}
+function confirmPajaRequest(state, request) {
+  const event = request.event;
+  const kind = typeof event.kind === "number" ? event.kind : "unknown";
+  const content = typeof event.content === "string" && event.content.length > 0 ? `
+
+${event.content.slice(0, 240)}` : "";
+  const allowed = window.confirm(`Paja ${request.action} request
+kind: ${kind}${content}`);
+  appendPajaMessageLog(state, "paja", {
+    type: `paja.${request.action}.${allowed ? "confirmed" : "denied"}`,
+    kind
+  });
+  return allowed;
+}
+function getTargetIdentity2(config, resolvedTarget) {
+  return {
+    pubkey: "",
+    dTag: resolvedTarget?.dTag ?? config.window.dTag,
+    aggregateHash: resolvedTarget?.aggregateHash ?? config.window.aggregateHash
+  };
+}
+function registerFrameForGeneration(bridge, frame, config, generation, resolvedTarget) {
+  const win = frame.contentWindow;
+  if (!win) return null;
+  const windowId = `${config.window.id}:${generation}`;
+  const identity = getTargetIdentity2(config, resolvedTarget);
+  originRegistry.register(win, windowId, {
+    dTag: identity.dTag,
+    aggregateHash: identity.aggregateHash
+  });
+  bridge.runtime.sessionRegistry.register(windowId, {
+    ...identity,
+    windowId,
+    origin: "null",
+    type: "napplet",
+    registeredAt: Date.now(),
+    instanceId: `${windowId}:${Date.now()}`,
+    provenance: "nip-5d"
+  });
+  return windowId;
+}
+function navigateFrame(bridge, frame, config, generation, resolvedTarget) {
+  if (config.target.mode === "runtime-pointer") {
+    if (!resolvedTarget) {
+      frame.removeAttribute("src");
+      frame.srcdoc = "<!doctype html><html><body></body></html>";
+      return null;
+    }
+    const windowId2 = registerFrameForGeneration(bridge, frame, config, generation, resolvedTarget);
+    frame.removeAttribute("src");
+    frame.srcdoc = injectPajaRuntimeCsp(
+      resolvedTarget.indexHtml,
+      connectOrigins([...resolvedTarget.relays, ...resolvedTarget.blossomServers])
+    );
+    return windowId2;
+  }
+  const windowId = registerFrameForGeneration(bridge, frame, config, generation, resolvedTarget);
+  frame.src = config.target.url;
+  return windowId;
+}
+function createHostSignerController(getState) {
+  return createPajaSignerController({
+    confirmRequest: (request) => confirmPajaRequest(getState(), request),
+    onChange(signer) {
+      const state = getState();
+      if (!state) return;
+      state.signer = signer;
+      appendPajaMessageLog(state, "paja", {
+        type: `paja.signer.${signer.method}.${signer.status}`,
+        pubkey: signer.pubkey,
+        relay: signer.relay,
+        error: signer.error
+      });
+      setSimulationStatus(state);
+      if (signer.status === "connected") state.reload();
+    }
+  });
+}
+function installPajaControlListeners(state) {
+  document.getElementById("reload-target")?.addEventListener("click", () => {
+    state.reload();
+  });
+  document.getElementById("simulation-theme")?.addEventListener("change", (event) => {
+    const target = event.target;
+    if (!(target instanceof HTMLSelectElement)) return;
+    if (target.value === "dark" || target.value === "light") {
+      state.setThemeMode(target.value);
+    }
+  });
+  document.getElementById("message-filter")?.addEventListener("input", (event) => {
+    const target = event.target;
+    if (!(target instanceof HTMLInputElement)) return;
+    state.messageFilter = target.value;
+    renderPajaMessageLog(state);
+  });
+  document.getElementById("clear-log")?.addEventListener("click", () => {
+    state.clearLog();
+  });
+  document.getElementById("runtime-pointer-form")?.addEventListener("submit", (event) => {
+    event.preventDefault();
+    const input = document.getElementById("runtime-pointer-input");
+    if (!(input instanceof HTMLInputElement)) return;
+    void state.loadPointer(input.value);
+  });
+}
+function createPajaBrowserState(context) {
+  const { config, frame, bridge, adapter, signerController, capabilities, runtime } = context;
+  return {
+    config,
+    capabilities,
+    services: Object.keys(adapter.services ?? {}).sort(),
+    simulation: runtime.currentSimulation,
+    signer: signerController.getState(),
+    resolvedTarget: null,
+    pointerValue: readInitialPointerValue(config),
+    pointerStatus: config.target.mode === "runtime-pointer" ? "idle" : "",
+    generation: 0,
+    status: "booting",
+    messageFilter: "",
+    messageLog: [],
+    reload() {
+      if (runtime.currentWindowId) {
+        bridge.runtime.destroyWindow(runtime.currentWindowId);
+        bridge.runtime.sessionRegistry.unregister(runtime.currentWindowId);
+        originRegistry.unregister(runtime.currentWindowId);
+      }
+      this.generation += 1;
+      runtime.initReceivedGeneration = -1;
+      setStatus(this, "reloading");
+      runtime.currentWindowId = navigateFrame(bridge, frame, config, this.generation, this.resolvedTarget);
+    },
+    setThemeMode(mode) {
+      runtime.currentSimulation = {
+        ...runtime.currentSimulation,
+        theme: {
+          ...runtime.currentSimulation.theme,
+          mode
+        }
+      };
+      this.simulation = runtime.currentSimulation;
+      runtime.themeService?.publishTheme(createDevTheme(runtime.currentSimulation.theme.mode, runtime.currentSimulation.theme.values));
+      setSimulationStatus(this);
+    },
     setDomainEnabled(domain, enabled) {
-      currentSimulation = {
-        ...currentSimulation,
+      runtime.currentSimulation = {
+        ...runtime.currentSimulation,
         capabilities: {
           domains: {
-            ...currentSimulation.capabilities.domains,
+            ...runtime.currentSimulation.capabilities.domains,
             [domain]: enabled
           },
           disabledDomains: PAJA_SIMULATION_DOMAINS.filter(
-            (entry) => entry === domain ? !enabled : !currentSimulation.capabilities.domains[entry]
+            (entry) => entry === domain ? !enabled : !runtime.currentSimulation.capabilities.domains[entry]
           )
         }
       };
-      this.simulation = currentSimulation;
-      this.services = Object.keys(adapter.services ?? {}).filter((name) => currentSimulation.capabilities.domains[name] !== false).sort();
+      this.simulation = runtime.currentSimulation;
+      this.services = Object.keys(adapter.services ?? {}).filter((name) => runtime.currentSimulation.capabilities.domains[name] !== false).sort();
       setSimulationStatus(this);
       appendPajaMessageLog(this, "paja", { type: `paja.interface.${enabled ? "enabled" : "disabled"}`, domain });
       this.reload();
     },
     setAclCapability(capability, enabled) {
-      const identity = getTargetIdentity2(config);
+      const identity = getTargetIdentity2(config, this.resolvedTarget);
       if (enabled) bridge.runtime.aclState.grant(identity.pubkey, identity.dTag, identity.aggregateHash, capability);
       else bridge.runtime.aclState.revoke(identity.pubkey, identity.dTag, identity.aggregateHash, capability);
       bridge.runtime.aclState.persist();
@@ -14068,6 +15746,40 @@ async function installPajaHost() {
     connectBunker(uri) {
       return signerController.connectBunker(uri);
     },
+    async loadPointer(value) {
+      if (config.target.mode !== "runtime-pointer") return;
+      const pointer = value.trim();
+      const input = document.getElementById("runtime-pointer-input");
+      if (input instanceof HTMLInputElement) input.value = pointer;
+      this.pointerValue = pointer;
+      if (!pointer) {
+        setPointerStatus(this, "idle");
+        return;
+      }
+      setPointerStatus(this, "resolving");
+      setStatus(this, "booting");
+      appendPajaMessageLog(this, "paja", { type: "paja.pointer.resolve", pointer });
+      try {
+        this.resolvedTarget = await resolvePajaPointer(pointer, {
+          relays: config.target.pointer?.relays ?? [],
+          blossomServers: config.target.pointer?.blossomServers ?? [],
+          maxWaitMs: config.target.pointer?.maxWaitMs
+        });
+        setPointerStatus(this, `${this.resolvedTarget.dTag}:${this.resolvedTarget.aggregateHash.slice(0, 12)}`);
+        appendPajaMessageLog(this, "paja", {
+          type: "paja.pointer.resolved",
+          dTag: this.resolvedTarget.dTag,
+          aggregateHash: this.resolvedTarget.aggregateHash
+        });
+        this.reload();
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        this.resolvedTarget = null;
+        setPointerStatus(this, message);
+        setStatus(this, "error");
+        appendPajaMessageLog(this, "paja", { type: "paja.pointer.error", error: message });
+      }
+    },
     clearLog() {
       this.messageLog.length = 0;
       renderPajaMessageLog(this);
@@ -14077,20 +15789,52 @@ async function installPajaHost() {
         generation: this.generation,
         status: this.status,
         iframeCount: document.querySelectorAll("iframe").length,
-        initSent: initReceivedGeneration === this.generation,
+        initSent: runtime.initReceivedGeneration === this.generation,
         services: this.services,
-        simulation: currentSimulation,
+        simulation: runtime.currentSimulation,
         signer: this.signer,
+        resolvedTarget: this.resolvedTarget,
+        pointerStatus: this.pointerStatus,
         messageLog: [...this.messageLog]
       };
     }
   };
+}
+async function installPajaHost() {
+  const config = await readLatestConfig(readConfig());
+  const frame = getFrame();
+  setTargetUrlDisplay(config, frame);
+  const runtime = {
+    currentSimulation: config.simulation,
+    themeService: null,
+    currentWindowId: null,
+    initReceivedGeneration: -1
+  };
+  const getSimulation = () => runtime.currentSimulation;
+  let stateRef = null;
+  const signerController = createHostSignerController(() => stateRef);
+  const adapter = createPajaAdapter(config, getSimulation, (theme) => {
+    runtime.themeService = theme;
+  }, (request) => confirmPajaRequest(stateRef, request), signerController, () => getTargetIdentity2(config, stateRef?.resolvedTarget));
+  const bridge = createShellBridge(adapter);
+  bridgeRef = bridge;
+  installPajaOriginRegistryProxy(originRegistry, () => stateRef);
+  const capabilities = buildShellCapabilities(adapter);
+  const state = createPajaBrowserState({
+    config,
+    frame,
+    bridge,
+    adapter,
+    signerController,
+    capabilities,
+    runtime
+  });
   stateRef = state;
   window.__KEHTO_PAJA__ = state;
   window.addEventListener("message", (event) => {
     if (event.source !== frame.contentWindow) return;
-    appendPajaMessageLog(state, "napplet->shell", event.data, currentWindowId ?? void 0);
-    const proxiedSource = createPajaPostMessageProxy(event.source, state, currentWindowId ?? void 0);
+    appendPajaMessageLog(state, "napplet->shell", event.data, runtime.currentWindowId ?? void 0);
+    const proxiedSource = createPajaPostMessageProxy(event.source, state, runtime.currentWindowId ?? void 0);
     const syntheticEvent = new Proxy(event, {
       get(target, prop) {
         if (prop === "source") return proxiedSource;
@@ -14101,13 +15845,13 @@ async function installPajaHost() {
     bridge.handleMessage(syntheticEvent);
     const data = event.data;
     if (data && typeof data === "object" && data.type === "shell.ready") {
-      initReceivedGeneration = state.generation;
+      runtime.initReceivedGeneration = state.generation;
       setStatus(state, "ready");
     }
   });
   frame.addEventListener("load", () => {
     if (state.status === "booting" || state.status === "reloading") {
-      registerFrameForGeneration(bridge, frame, config, state.generation);
+      runtime.currentWindowId = registerFrameForGeneration(bridge, frame, config, state.generation, state.resolvedTarget);
     }
   });
   frame.addEventListener("error", () => {
@@ -14116,7 +15860,15 @@ async function installPajaHost() {
   installPajaControlListeners(state);
   setStatus(state, "booting");
   setSimulationStatus(state);
-  currentWindowId = navigateFrame(bridge, frame, config, state.generation);
+  setPointerStatus(state, state.pointerStatus);
+  if (config.target.mode === "runtime-pointer") {
+    const input = document.getElementById("runtime-pointer-input");
+    if (input instanceof HTMLInputElement) input.value = state.pointerValue;
+    if (state.pointerValue) void state.loadPointer(state.pointerValue);
+    else runtime.currentWindowId = navigateFrame(bridge, frame, config, state.generation, state.resolvedTarget);
+  } else {
+    runtime.currentWindowId = navigateFrame(bridge, frame, config, state.generation, state.resolvedTarget);
+  }
 }
 try {
   void installPajaHost().catch((error) => {