@kehto/services 0.10.1 → 0.11.1

package/README.md

@@ -22,7 +22,7 @@ Current draft posture:
 
 - The v1.1 signer service is deleted outright. Its responsibilities split into two: read-only identity lookups go through `createIdentityService` (`getPublicKey`, `getRelays`, `getProfile`, `getFollows`, `getList`, `getZaps`, `getMutes`, `getBlocked`, `getBadges`); signing happens inside the shell as part of `relay.publish` / `relay.publishEncrypted` and is never exposed to napplets.
 - `createKeysService` and `createMediaService` ship real reference backends as of v1.4 (see the dedicated sections below). `createKeysService` attaches a document-level `keydown` listener by default and delivers `keys.action` push envelopes to registered napplets; `createMediaService` mirrors session metadata and playback state to `navigator.mediaSession` and emits `media.command` push envelopes on OS transport events. Both accept a host-bridge option (`HostKeysBridge` / `HostMediaBridge`) so Electron / Tauri / native shells can swap in OS-level backends without re-implementing the wire-protocol bookkeeping.
-- `createNotifyService` (NIP-5D `notify.*` NAP) coexists with the legacy `createNotificationService` (ifc-emit `notifications:*` channel). Both may be registered simultaneously while hosts migrate.
+- `createNotifyService` (NIP-5D `notify.*` NAP) coexists with the legacy `createNotificationService` (inc-emit `notifications:*` channel). Both may be registered simultaneously while hosts migrate.
 
 ## Quick Start
 
@@ -36,13 +36,13 @@ import {
 runtime.registerService(
   'identity',
   createIdentityService({
-    getPublicKey: () => signer.getPublicKey(),
-    getRelays: () => signer.getRelays(),
+    getSigner: () => signer,
     getProfile: (pk) => nostrClient.fetchProfile(pk),
+    getFollows: (pk) => contactListCache.getFollows(pk),
   }),
 );
 
-// Notification service — legacy ifc-emit channel, browser badge fan-out.
+// Notification service — legacy inc-emit channel, browser badge fan-out.
 runtime.registerService(
   'notifications',
   createNotificationService({ onChange: (list) => updateBadge(list) }),
@@ -256,7 +256,7 @@ export interface HostMediaBridge {
   /**
    * Set the playback state for a session. Called on media.state reports
    * whenever the session is the active session. State strings match
-   * nub-media MediaState.status exactly. Implementations MUST be idempotent.
+   * nap-media MediaState.status exactly. Implementations MUST be idempotent.
    */
   setPlaybackState(sessionId: string, state: 'playing' | 'paused' | 'stopped' | 'buffering'): void;
 
@@ -353,9 +353,11 @@ Each factory returns a `ServiceHandler` registrable via `runtime.registerService
 ### Identity NAP
 - `createIdentityService` — `identity.*` reads (`identity:read`). No signing surface; shell mediates signing internally.
 
+`createIdentityService` uses `getSigner()` for `identity.getPublicKey` and `identity.getRelays`. Hosts may also pass optional read-only provider hooks for `getProfile`, `getFollows`, `getList`, `getZaps`, `getMutes`, `getBlocked`, and `getBadges`. These hooks receive the current signer pubkey (or `""` when no signer is connected) and return the payload portion of the corresponding `.result` envelope. Kehto does not query relays itself; the hooks are for hosts that already maintain profile, contact-list, list, zap, moderation, or badge data.
+
 ### Notify NAP
 - `createNotifyService` — canonical `notify.*` envelopes (`notify:send` / `notify:channel`).
-- `createNotificationService` — legacy ifc-emit `notifications:*` channel; coexists with `createNotifyService` until retired.
+- `createNotificationService` — legacy inc-emit `notifications:*` channel; coexists with `createNotifyService` until retired.
 
 ### Relay NAP
 - `createRelayPoolService` — `relay.publish`, `relay.publishEncrypted`, `relay.subscribe` fan-out (`relay:read` / `relay:write`).
@@ -371,8 +373,8 @@ Each factory returns a `ServiceHandler` registrable via `runtime.registerService
 ### Theme NAP
 - `createThemeService` — `theme.get` + `theme.changed` fan-out (`theme:read`). Returns a `ThemeService` with `publishTheme()` / `setTheme()` utilities for host-side updates.
 
-### Audio (legacy ifc-emit)
-- `createAudioService` — `audio:*` ifc-emit topic handler. Browser-agnostic registry of per-window audio sources; host wires `onChange` to update transport UI.
+### Audio (legacy inc-emit)
+- `createAudioService` — `audio:*` inc-emit topic handler. Browser-agnostic registry of per-window audio sources; host wires `onChange` to update transport UI.
 
 ### Types
 `AudioSource`, `AudioServiceOptions`, `Notification`, `NotificationServiceOptions`, `IdentityServiceOptions`, `RelayPoolServiceOptions`, `CacheServiceOptions`, `CoordinatedRelayOptions`, `KeysServiceOptions`, `MediaServiceOptions`, `NotifyServiceOptions`, `ThemeServiceOptions`, `ThemeService`.

package/dist/cvm-nostr-transport.d.ts

@@ -1,4 +1,4 @@
-import { C as CvmTransport } from './cvm-service-CXcOVQ0m.js';
+import { C as CvmTransport } from './cvm-service-DKIzbiDw.js';
 import '@kehto/runtime';
 
 /**

package/dist/{cvm-service-CXcOVQ0m.d.ts → cvm-service-DKIzbiDw.d.ts}

@@ -4,11 +4,11 @@ import { ServiceHandler } from '@kehto/runtime';
  * cvm-types.ts — NAP-CVM (ContextVM bridge) wire + MCP value types.
  *
  * Kehto-internal model for the NAP-CVM wire contract (upstream draft:
- * napplet/nubs NAP-CVM, namespace `window.napplet.cvm`). The literal `type`
+ * napplet/naps NAP-CVM, namespace `window.napplet.cvm`). The literal `type`
  * strings and field names below MUST match the upstream `@napplet/nap/cvm`
  * envelopes byte-for-byte so the shim client interoperates; the types live
  * here (not imported from `@napplet/core`) per the same convention as
- * NUB-RESOURCE (PROJECT.md Decision #31) to avoid a peer-dependency version
+ * NAP-RESOURCE (PROJECT.md Decision #31) to avoid a peer-dependency version
  * bump.
  *
  * ContextVM transports MCP JSON-RPC over Nostr (kind 25910), optionally

package/dist/index.d.ts

@@ -1,11 +1,12 @@
 import { ServiceHandler, Signer } from '@kehto/runtime';
+import { IdentityGetProfileMessage, IdentityGetProfileResultMessage, IdentityGetFollowsMessage, IdentityGetFollowsResultMessage, IdentityGetListMessage, IdentityGetListResultMessage, IdentityGetZapsMessage, IdentityGetZapsResultMessage, IdentityGetMutesMessage, IdentityGetMutesResultMessage, IdentityGetBlockedMessage, IdentityGetBlockedResultMessage, IdentityGetBadgesMessage, IdentityGetBadgesResultMessage } from '@napplet/nap/identity/types';
 import { NostrFilter, NostrEvent, EventTemplate } from '@napplet/core';
 import { MediaMetadata, MediaAction } from '@napplet/nap/media/types';
 export { MediaAction } from '@napplet/nap/media/types';
 import { NotifySendMessage } from '@napplet/nap/notify/types';
 import { Theme, ThemeChangedMessage } from '@napplet/nap/theme/types';
 import { ConfigSchemaErrorCode, ConfigValues, NappletConfigSchema } from '@napplet/nap/config/types';
-export { a as CvmCloseMessage, b as CvmCloseResultMessage, c as CvmDiscoverMessage, d as CvmDiscoverQuery, e as CvmDiscoverResultMessage, f as CvmEventMessage, g as CvmInboundMessage, h as CvmOutboundMessage, i as CvmRequestMessage, j as CvmRequestOptions, k as CvmRequestResultMessage, l as CvmServer, m as CvmServerRef, n as CvmService, o as CvmServiceOptions, C as CvmTransport, p as CvmTransportError, M as McpContentBlock, q as McpMessage, r as McpTool, s as McpToolResult, t as createCvmService } from './cvm-service-CXcOVQ0m.js';
+export { a as CvmCloseMessage, b as CvmCloseResultMessage, c as CvmDiscoverMessage, d as CvmDiscoverQuery, e as CvmDiscoverResultMessage, f as CvmEventMessage, g as CvmInboundMessage, h as CvmOutboundMessage, i as CvmRequestMessage, j as CvmRequestOptions, k as CvmRequestResultMessage, l as CvmServer, m as CvmServerRef, n as CvmService, o as CvmServiceOptions, C as CvmTransport, p as CvmTransportError, M as McpContentBlock, q as McpMessage, r as McpTool, s as McpToolResult, t as createCvmService } from './cvm-service-DKIzbiDw.js';
 
 /**
  * @kehto/services — Shared types for reference service implementations.
@@ -171,7 +172,7 @@ declare function createAudioService(options?: AudioServiceOptions): ServiceHandl
 declare function createNotificationService(options?: NotificationServiceOptions): ServiceHandler;
 
 /**
- * identity-service.ts — NIP-5D identity nub reference service.
+ * identity-service.ts — NIP-5D identity nap reference service.
  *
  * MIGRATION from signer-service (v1.1 -> v1.2):
  *   - signer.getPublicKey  -> identity.getPublicKey   (same shell state)
@@ -189,11 +190,12 @@ declare function createNotificationService(options?: NotificationServiceOptions)
  *
  * Handles 9 identity.* request types from @napplet/nap/identity. getPublicKey
  * and getRelays return real values sourced from hooks.auth.getSigner(); the
- * remaining 7 (getProfile/getFollows/getList/getZaps/getMutes/getBlocked/
- * getBadges) are stub-level. Host apps plug real backends via
- * runtime.registerService('identity', realHandler).
+ * remaining read-only queries can be backed by optional host providers. When a
+ * provider is absent, the service keeps returning spec-shaped empty results.
  */
 
+/** A value that may be returned synchronously or through a Promise. */
+type MaybePromise<T> = T | Promise<T>;
 /**
  * Options for creating the identity service.
  *
@@ -212,14 +214,75 @@ interface IdentityServiceOptions {
      * availability can change dynamically.
      */
     getSigner: () => Signer | null;
+    /**
+     * Optional host-backed profile lookup for the current user.
+     *
+     * Kehto does not query relays itself; hosts that already maintain kind-0
+     * metadata can provide it here without replacing the whole identity service.
+     *
+     * @param pubkey - Current signer pubkey, or "" when no signer is connected.
+     * @param message - Original identity.getProfile request envelope.
+     * @returns Profile metadata, or null when unavailable.
+     */
+    getProfile?: (pubkey: string, message: IdentityGetProfileMessage) => MaybePromise<IdentityGetProfileResultMessage['profile']>;
+    /**
+     * Optional host-backed follow-list lookup for the current user.
+     *
+     * @param pubkey - Current signer pubkey, or "" when no signer is connected.
+     * @param message - Original identity.getFollows request envelope.
+     * @returns Hex-encoded followed pubkeys.
+     */
+    getFollows?: (pubkey: string, message: IdentityGetFollowsMessage) => MaybePromise<IdentityGetFollowsResultMessage['pubkeys']>;
+    /**
+     * Optional host-backed categorized-list lookup for the current user.
+     *
+     * @param listType - Requested list category from the wire envelope.
+     * @param pubkey - Current signer pubkey, or "" when no signer is connected.
+     * @param message - Original identity.getList request envelope.
+     * @returns List entries.
+     */
+    getList?: (listType: string, pubkey: string, message: IdentityGetListMessage) => MaybePromise<IdentityGetListResultMessage['entries']>;
+    /**
+     * Optional host-backed zap receipt lookup for the current user.
+     *
+     * @param pubkey - Current signer pubkey, or "" when no signer is connected.
+     * @param message - Original identity.getZaps request envelope.
+     * @returns Zap receipts.
+     */
+    getZaps?: (pubkey: string, message: IdentityGetZapsMessage) => MaybePromise<IdentityGetZapsResultMessage['zaps']>;
+    /**
+     * Optional host-backed mute-list lookup for the current user.
+     *
+     * @param pubkey - Current signer pubkey, or "" when no signer is connected.
+     * @param message - Original identity.getMutes request envelope.
+     * @returns Hex-encoded muted pubkeys.
+     */
+    getMutes?: (pubkey: string, message: IdentityGetMutesMessage) => MaybePromise<IdentityGetMutesResultMessage['pubkeys']>;
+    /**
+     * Optional host-backed block-list lookup for the current user.
+     *
+     * @param pubkey - Current signer pubkey, or "" when no signer is connected.
+     * @param message - Original identity.getBlocked request envelope.
+     * @returns Hex-encoded blocked pubkeys.
+     */
+    getBlocked?: (pubkey: string, message: IdentityGetBlockedMessage) => MaybePromise<IdentityGetBlockedResultMessage['pubkeys']>;
+    /**
+     * Optional host-backed badge lookup for the current user.
+     *
+     * @param pubkey - Current signer pubkey, or "" when no signer is connected.
+     * @param message - Original identity.getBadges request envelope.
+     * @returns Badges awarded to the user.
+     */
+    getBadges?: (pubkey: string, message: IdentityGetBadgesMessage) => MaybePromise<IdentityGetBadgesResultMessage['badges']>;
 }
 /**
  * Create an identity service that handles NIP-5D identity.* envelope messages.
  *
  * Supports the 9 read-only identity.* request types from @napplet/nap/identity.
  * The two nostr-info queries (getPublicKey, getRelays) resolve through the
- * caller-supplied signer; the remaining 7 return default/empty payloads with
- * spec-correct envelope shapes so napplets always receive a result envelope.
+ * caller-supplied signer; the remaining read-only queries resolve through
+ * optional host providers or return default/empty payloads with spec-correct
+ * envelope shapes so napplets always receive a result envelope.
  *
  * @param options - Identity service configuration (getSigner)
  * @returns A ServiceHandler ready for runtime.registerService('identity', handler)
@@ -241,7 +304,7 @@ declare function createIdentityService(options: IdentityServiceOptions): Service
  *
  * Wraps an existing relay pool implementation (subscribe, publish,
  * selectRelayTier, isAvailable) as a ServiceHandler that receives
- * relay NUB envelope messages and manages subscription lifecycle.
+ * relay NAP envelope messages and manages subscription lifecycle.
  *
  * Handles: relay.subscribe, relay.close, relay.publish, relay.publishEncrypted.
  *
@@ -470,7 +533,7 @@ interface CoordinatedRelayOptions {
 declare function createCoordinatedRelay(options: CoordinatedRelayOptions): ServiceHandler;
 
 /**
- * keys-service.ts — NIP-5D keys NUB reference document-level listener implementation.
+ * keys-service.ts — NIP-5D keys NAP reference document-level listener implementation.
  *
  * Handles the 3 napplet -> shell request types from @napplet/nap/keys:
  *   - keys.forward          -> invokes options.onForward (hotkey passthrough, fire-and-forget)
@@ -745,7 +808,7 @@ declare function createBrowserMediaBridge(opts?: {
 }): HostMediaBridge;
 
 /**
- * media-service.ts — NIP-5D media NUB reference service (navigator.mediaSession
+ * media-service.ts — NIP-5D media NAP reference service (navigator.mediaSession
  * reference implementation).
  *
  * Handles the napplet-owned subset of @napplet/nap/media:
@@ -777,7 +840,7 @@ declare function createBrowserMediaBridge(opts?: {
  * up the active session's owning napplet, invokes the per-window send callback captured
  * at session.create time, and delivers:
  *   { type: 'media.command', sessionId, action, value? }
- * where action is the nub-media MediaAction literal (play|pause|next|prev|seek) and
+ * where action is the nap-media MediaAction literal (play|pause|next|prev|seek) and
  * value is the seekTime (seconds) for seek.
  *
  * Silent-audio prime: the browser bridge creates a hidden <audio> element with a
@@ -793,10 +856,10 @@ declare function createBrowserMediaBridge(opts?: {
  * destroyed, the next-most-recently-touched session is promoted automatically.
  *
  * Note: this is SEPARATE from packages/services/src/audio-service.ts, which
- * is the legacy ifc-topic-based audio source registry (audio:* topic events
- * over ifc.emit). media-service is the canonical @napplet/nap/media NIP-5D
+ * is the legacy inc-topic-based audio source registry (audio:* topic events
+ * over inc.emit). media-service is the canonical @napplet/nap/media NIP-5D
  * path and they coexist — audio-service continues to track audio sources for
- * shell UI, while media-service handles the NUB protocol envelope surface.
+ * shell UI, while media-service handles the NAP protocol envelope surface.
  *
  * Shell -> Napplet push types (media.command) are emitted here when
  * bridge.onAction callbacks fire — this is the canonical Phase 27 real backend.
@@ -872,7 +935,7 @@ interface HostMediaBridge {
     /**
      * Set the playback state for a session. Called on media.state reports
      * whenever the session is the active session. State strings match
-     * nub-media MediaState.status exactly. Implementations MUST be idempotent.
+     * nap-media MediaState.status exactly. Implementations MUST be idempotent.
      */
     setPlaybackState(sessionId: string, state: 'playing' | 'paused' | 'stopped' | 'buffering'): void;
     /**
@@ -960,13 +1023,13 @@ interface MediaServiceOptions {
     hostBridge?: HostMediaBridge;
 }
 /**
- * Create a media NUB service handler with navigator.mediaSession integration.
+ * Create a media NAP service handler with navigator.mediaSession integration.
  *
  * Implements the 5 napplet->shell media.* request types defined in
  * `@napplet/nap/media`. Only `media.session.create` produces a reply
  * envelope (`media.session.create.result`) — the remaining four
  * (`session.update`, `session.destroy`, `state`, `capabilities`) are
- * fire-and-forget per the NUB spec.
+ * fire-and-forget per the NAP spec.
  *
  * Unknown `media.*` actions produce a `<type>.error` envelope so
  * napplets are never left hanging on a malformed request.
@@ -991,7 +1054,7 @@ declare function createMediaService(options?: MediaServiceOptions): ServiceHandl
 };
 
 /**
- * notify-service.ts — NIP-5D notify NUB reference service (stub-level).
+ * notify-service.ts — NIP-5D notify NAP reference service (stub-level).
  *
  * Handles the 5 napplet -> shell request types from `@napplet/nap/notify`:
  *   - `notify.send`                -> `notify.send.result` (shell-assigned id)
@@ -1006,12 +1069,12 @@ declare function createMediaService(options?: MediaServiceOptions): ServiceHandl
  *
  * Coexistence note: this is SEPARATE from
  * `packages/services/src/notification-service.ts`, which is the legacy
- * ifc-topic-based notification registry (operates on `ifc.emit` topics
+ * inc-topic-based notification registry (operates on `inc.emit` topics
  * under `notifications:*`). `notify-service.ts` is the canonical
  * `@napplet/nap/notify` NIP-5D path and lives alongside the legacy module.
  * If the host app registers this service via
  * `runtime.registerService('notify', ...)`, @napplet/nap/notify messages
- * land here; the legacy ifc-emit topic path remains untouched.
+ * land here; the legacy inc-emit topic path remains untouched.
  *
  * Shell -> napplet push messages (`notify.action`, `notify.clicked`,
  * `notify.dismissed`, `notify.controls`) are not emitted by this stub —
@@ -1074,7 +1137,7 @@ interface NotifyServiceOptions {
 declare function createNotifyService(options?: NotifyServiceOptions): ServiceHandler;
 
 /**
- * theme-service.ts — NIP-5D theme NUB reference service.
+ * theme-service.ts — NIP-5D theme NAP reference service.
  *
  * Handles the single napplet->shell request type from @napplet/nap/theme:
  *   - `theme.get`         -> `theme.get.result { theme }` (current theme)
@@ -1156,7 +1219,7 @@ interface ThemeService {
     getCurrentTheme: () => Theme;
 }
 /**
- * Create a theme service that handles the NIP-5D `theme.*` NUB.
+ * Create a theme service that handles the NIP-5D `theme.*` NAP.
  *
  * Answers `theme.get` with the current theme (default or
  * `options.initialTheme`). Exposes `publishTheme(theme)` for the host app to
@@ -1178,24 +1241,24 @@ interface ThemeService {
 declare function createThemeService(options?: ThemeServiceOptions): ThemeService;
 
 /**
- * config-service.ts — NUB-CONFIG reference service (9th NUB domain, v1.7 Phase 39).
+ * config-service.ts — NAP-CONFIG reference service (9th NAP domain, v1.7 Phase 39).
  *
- * Shell-side reference implementation for the canonical NUB-CONFIG wire
+ * Shell-side reference implementation for the canonical NAP-CONFIG wire
  * protocol (`@napplet/nap/config`, published at `^0.3.0`). Handles the full
  * 8-message discriminated union: 5 napplet→shell request types + 3
  * shell→napplet result/push types.
  *
  * ──────────────────────────── SCOPE BOUNDARY (CONFIG-04) ─────────────────────────
- * NUB-CONFIG is **shell-managed per-napplet configuration**. Napplets observe
+ * NAP-CONFIG is **shell-managed per-napplet configuration**. Napplets observe
  * values via `config.get` (one-shot) or `config.subscribe` (snapshot + live
  * push). The shell is the **sole writer** — there is intentionally **NO**
  * `config.set` wire message. Napplets cannot mutate configuration values;
  * the shell owns persistence and the update flow.
  *
- * Do NOT use this service as a general key-value store. NUB-STORAGE
+ * Do NOT use this service as a general key-value store. NAP-STORAGE
  * (`state:read` / `state:write`) remains the general KV surface. Using
- * NUB-CONFIG to store e.g. `{ lastScrollPosition: 420 }` is an anti-pattern
- * (H-07 in PITFALLS.md) — such state belongs in NUB-STORAGE.
+ * NAP-CONFIG to store e.g. `{ lastScrollPosition: 420 }` is an anti-pattern
+ * (H-07 in PITFALLS.md) — such state belongs in NAP-STORAGE.
  * ──────────────────────────────────────────────────────────────────────────────────
  *
  * Host integration: provide `getValues()` returning the current
@@ -1284,7 +1347,7 @@ interface ConfigServiceOptions {
     openSettings?: (windowId: string, section: string | undefined) => void;
 }
 /**
- * NUB-CONFIG reference service bundle — `handler` to register with the
+ * NAP-CONFIG reference service bundle — `handler` to register with the
  * runtime, `publishValues` for the host app to push updates live to all
  * subscribed napplets.
  */
@@ -1302,7 +1365,7 @@ interface ConfigService {
     publishValues(values: ConfigValues): void;
 }
 /**
- * Create a NUB-CONFIG reference service.
+ * Create a NAP-CONFIG reference service.
  *
  * Shell-writes, napplet-reads. Handles the full `@napplet/nap/config` wire
  * protocol: `config.get` (correlated snapshot), `config.subscribe` /
@@ -1320,7 +1383,7 @@ interface ConfigService {
  *
  * @see ConfigServiceOptions for the options shape.
  * @see packages/services/src/theme-service.ts for the sibling pattern.
- * @see SCOPE BOUNDARY comment at the top of this file re: NUB-STORAGE separation.
+ * @see SCOPE BOUNDARY comment at the top of this file re: NAP-STORAGE separation.
  *
  * @example
  * ```ts
@@ -1339,9 +1402,9 @@ interface ConfigService {
 declare function createConfigService(options: ConfigServiceOptions): ConfigService;
 
 /**
- * resource-service.ts — NUB-RESOURCE reference service (10th NUB domain, v1.7 Phase 40).
+ * resource-service.ts — NAP-RESOURCE reference service (10th NAP domain, v1.7 Phase 40).
  *
- * Shell-side reference implementation for the canonical NUB-RESOURCE wire
+ * Shell-side reference implementation for the canonical NAP-RESOURCE wire
  * protocol (`internal-resource.ts` in @kehto/shell/src/types; kehto-internal
  * model per PROJECT.md Decision #31 — diverges from upstream `@napplet/nap/
  * resource` in field names + error vocabulary). Handles the canonical
@@ -1350,12 +1413,12 @@ declare function createConfigService(options: ConfigServiceOptions): ConfigServi
  *   Outbound: resource.bytes.result, resource.bytes.error
  *
  * ──────────────────────── SCOPE BOUNDARY (RESOURCE-01) ────────────────────────
- * NUB-RESOURCE is an **authenticated fetch proxy** — read-only, atomic.
+ * NAP-RESOURCE is an **authenticated fetch proxy** — read-only, atomic.
  *
  * This service is NOT responsible for:
  *   - Streaming / chunked responses (host-app concern)
  *   - Response caching / conditional requests (host-app concern)
- *   - Upload / POST body construction (NUB-RESOURCE v1.7 is read-only)
+ *   - Upload / POST body construction (NAP-RESOURCE v1.7 is read-only)
  *   - Redirect limits, MIME sniffing, SVG rasterization (host-fetch concern)
  *   - Private-IP blocking, SSRF mitigation (host-provided-fetch responsibility)
  *
@@ -1374,7 +1437,7 @@ declare function createConfigService(options: ConfigServiceOptions): ConfigServi
  * const resourceSvc = createResourceService({
  *   fetch: (url, init) => globalThis.fetch(url, init),
  *   isOriginGranted: (origin, grants) => grants.includes(origin),
- *   getConnectGrants: (dTag, hash) => connectStore.getOrigins(dTag, hash),
+ *   getConnectGrants: (dTag, hash) => myOriginGrantStore.getOrigins(dTag, hash),
  *   resolveIdentity: (windowId) => sessionRegistry.getEntryByWindowId(windowId) ?? null,
  * });
  * runtime.registerService('resource', resourceSvc);
@@ -1423,8 +1486,8 @@ interface ResourceServiceOptions {
      * Returns the list of allowed fetch origins for the given napplet identity.
      * Called on every `resource.bytes` request — must be synchronous and fast.
      *
-     * Typically wraps `connectStore.getOrigins(dTag, aggregateHash)` from
-     * @kehto/shell.
+     * Host-supplied grant source (e.g. a static per-dTag allowlist map, or any
+     * other host-controlled policy). Returns an empty array to deny all origins.
      *
      * H-03 prevention: REQUIRED from day one — factory throws on construction
      * if omitted.
@@ -1452,7 +1515,7 @@ interface ResourceServiceOptions {
  */
 type ResourceService = ServiceHandler;
 /**
- * Create a NUB-RESOURCE reference service.
+ * Create a NAP-RESOURCE reference service.
  *
  * Implements canonical 4-message protocol: `resource.bytes` (napplet → shell
  * fetch request), `resource.cancel` (napplet → shell in-flight cancellation),
@@ -1477,7 +1540,7 @@ type ResourceService = ServiceHandler;
  * const svc = createResourceService({
  *   fetch: (url, init) => globalThis.fetch(url, init),
  *   isOriginGranted: (origin, grants) => grants.includes(origin),
- *   getConnectGrants: (dTag, hash) => connectStore.getOrigins(dTag, hash),
+ *   getConnectGrants: (dTag, hash) => myOriginGrantStore.getOrigins(dTag, hash),
  *   resolveIdentity: (windowId) => sessionRegistry.getEntryByWindowId(windowId) ?? null,
  * });
  * runtime.registerService('resource', svc);
@@ -1690,7 +1753,7 @@ interface RelayListEntry {
 /**
  * Relay pool contract the router drives. Implementors adapt their pool library
  * (nostr-tools SimplePool, applesauce-relay, etc.). Unlike the lower-level
- * relay NUB pool, both methods take an explicit relay-URL set so the router
+ * relay NAP pool, both methods take an explicit relay-URL set so the router
  * controls outbox routing and can attribute events to the relay they arrived on.
  */
 interface OutboxRelayPool {
@@ -1985,7 +2048,7 @@ declare function createHttpUploader(options: HttpUploaderOptions): Uploader;
  * intent-types.ts — NAP-INTENT (archetype intent dispatch) value types.
  *
  * Kehto-internal model for the NAP-INTENT wire contract (upstream draft:
- * napplet/nubs NAP-INTENT, namespace `window.napplet.intent`). The installed
+ * napplet/naps NAP-INTENT, namespace `window.napplet.intent`). The installed
  * `@napplet/core` peer predates these types, so — as with {@link ./cvm-types} —
  * kehto defines them here, wire-compatible with the upstream shapes, rather
  * than redefining the generic NIP-5D envelope.
@@ -2338,4 +2401,4 @@ interface ManifestArchetypeInput {
  */
 declare function manifestToIntentCatalogEntry(manifest: ManifestArchetypeInput): IntentCatalogEntry;
 
-export { type AudioServiceOptions, type AudioSource, type CacheServiceOptions, type CatalogIntentResolver, type CatalogIntentResolverOptions, type ConfigSchemaValidation, type ConfigService, type ConfigServiceOptions, type CoordinatedRelayOptions, type HostCacheBridge, type HostKeyEvent, type HostKeysBridge, type HostMediaBridge, type HttpUploaderOptions, type HttpUploaderRails, type IdentityServiceOptions, type IntentArchetypeSupport, type IntentAvailability, type IntentBehavior, type IntentCandidate, type IntentCatalogEntry, type IntentHandlerPreference, type IntentOpenParams, type IntentRequest, type IntentResolver, type IntentResolverContext, type IntentResult, type IntentServiceOptions, type IntentWindowController, type KeysServiceOptions, type ManifestArchetypeInput, type MediaMetadataLike, type MediaPlaybackOwner, type MediaServiceOptions, type MediaSessionCreateOptions, type MediaSessionTarget, type MediaSourceRef, type NostrTag, type Notification, type NotificationServiceOptions, type NotifyServiceOptions, type OutboxPublishOptions, type OutboxPublishResult, type OutboxQueryOptions, type OutboxRelayPlan, type OutboxRelayPool, type OutboxResult, type OutboxRouter, type OutboxRouterSubscription, type OutboxServiceOptions, type OutboxStrategy, type OutboxSubscribeOptions, type OutboxSubscriptionSink, type OutboxTarget, type RailServerConfig, type RelayListEntry, type RelayPoolOutboxRouterOptions, type RelayPoolServiceOptions, type ResourceService, type ResourceServiceOptions, type SignEvent, type ThemeService, type ThemeServiceOptions, type UploadDimensions, type UploadRail, type UploadRequest, type UploadResult, type UploadServiceOptions, type UploadState, type UploadStatus, type Uploader, type UploaderContext, createAudioService, createBrowserMediaBridge, createCacheService, createCatalogIntentResolver, createConfigService, createCoordinatedRelay, createHttpUploader, createIdentityService, createIntentService, createKeysService, createMediaService, createNotificationService, createNotifyService, createOutboxService, createRelayPoolOutboxRouter, createRelayPoolService, createResourceService, createThemeService, createUploadService, manifestToIntentCatalogEntry };
+export { type AudioServiceOptions, type AudioSource, type CacheServiceOptions, type CatalogIntentResolver, type CatalogIntentResolverOptions, type ConfigSchemaValidation, type ConfigService, type ConfigServiceOptions, type CoordinatedRelayOptions, type HostCacheBridge, type HostKeyEvent, type HostKeysBridge, type HostMediaBridge, type HttpUploaderOptions, type HttpUploaderRails, type IdentityServiceOptions, type IntentArchetypeSupport, type IntentAvailability, type IntentBehavior, type IntentCandidate, type IntentCatalogEntry, type IntentHandlerPreference, type IntentOpenParams, type IntentRequest, type IntentResolver, type IntentResolverContext, type IntentResult, type IntentServiceOptions, type IntentWindowController, type KeysServiceOptions, type ManifestArchetypeInput, type MaybePromise, type MediaMetadataLike, type MediaPlaybackOwner, type MediaServiceOptions, type MediaSessionCreateOptions, type MediaSessionTarget, type MediaSourceRef, type NostrTag, type Notification, type NotificationServiceOptions, type NotifyServiceOptions, type OutboxPublishOptions, type OutboxPublishResult, type OutboxQueryOptions, type OutboxRelayPlan, type OutboxRelayPool, type OutboxResult, type OutboxRouter, type OutboxRouterSubscription, type OutboxServiceOptions, type OutboxStrategy, type OutboxSubscribeOptions, type OutboxSubscriptionSink, type OutboxTarget, type RailServerConfig, type RelayListEntry, type RelayPoolOutboxRouterOptions, type RelayPoolServiceOptions, type ResourceService, type ResourceServiceOptions, type SignEvent, type ThemeService, type ThemeServiceOptions, type UploadDimensions, type UploadRail, type UploadRequest, type UploadResult, type UploadServiceOptions, type UploadState, type UploadStatus, type Uploader, type UploaderContext, createAudioService, createBrowserMediaBridge, createCacheService, createCatalogIntentResolver, createConfigService, createCoordinatedRelay, createHttpUploader, createIdentityService, createIntentService, createKeysService, createMediaService, createNotificationService, createNotifyService, createOutboxService, createRelayPoolOutboxRouter, createRelayPoolService, createResourceService, createThemeService, createUploadService, manifestToIntentCatalogEntry };