@kehto/services 0.16.1 → 0.17.0

package/dist/index.js

@@ -1,71 +1,3 @@
-// src/audio-service.ts
-var AUDIO_SERVICE_VERSION = "1.0.0";
-function createAudioService(options) {
-  const sources = /* @__PURE__ */ new Map();
-  const onChange = options?.onChange;
-  function notify2() {
-    onChange?.(new Map(sources));
-  }
-  const descriptor = {
-    name: "audio",
-    version: AUDIO_SERVICE_VERSION,
-    description: "Audio source registry \u2014 tracks active audio sources per napplet window"
-  };
-  return {
-    descriptor,
-    handleMessage(windowId, message, send) {
-      if (message.type !== "inc.emit") return;
-      const incMessage = message;
-      const topic = typeof incMessage.topic === "string" ? incMessage.topic : void 0;
-      if (!topic?.startsWith("audio:")) return;
-      const action = topic.slice(6);
-      const payload = incMessage.payload && typeof incMessage.payload === "object" ? incMessage.payload : {};
-      switch (action) {
-        case "register": {
-          const nappletClass = typeof payload.nappletClass === "string" ? payload.nappletClass : "";
-          const title = typeof payload.title === "string" ? payload.title : "";
-          sources.set(windowId, { windowId, nappletClass, title, muted: false });
-          notify2();
-          break;
-        }
-        case "unregister": {
-          if (sources.delete(windowId)) {
-            notify2();
-          }
-          break;
-        }
-        case "state-changed": {
-          const source = sources.get(windowId);
-          if (!source) return;
-          if (typeof payload.title === "string") {
-            source.title = payload.title;
-          }
-          notify2();
-          break;
-        }
-        case "mute": {
-          const targetWindowId = typeof payload.windowId === "string" ? payload.windowId : windowId;
-          const muted = payload.muted === true;
-          const source = sources.get(targetWindowId);
-          if (source) {
-            source.muted = muted;
-            notify2();
-          }
-          send({ type: "inc.event", topic: "napplet:audio-muted", payload: { muted } });
-          break;
-        }
-        default:
-          break;
-      }
-    },
-    onWindowDestroyed(windowId) {
-      if (sources.delete(windowId)) {
-        notify2();
-      }
-    }
-  };
-}
-
 // src/notification-service.ts
 var NOTIFICATION_SERVICE_VERSION = "1.0.0";
 var DEFAULT_MAX_PER_WINDOW = 100;
@@ -97,14 +29,11 @@ function enforceLimit(store, list) {
     list.shift();
   }
 }
-function findById(store, id) {
-  for (const [windowId, list] of store.notifications) {
-    const index = list.findIndex((n) => n.id === id);
-    if (index !== -1) {
-      return [windowId, list[index], index];
-    }
-  }
-  return void 0;
+function findById(store, windowId, id) {
+  const list = store.notifications.get(windowId);
+  const index = list?.findIndex((notification) => notification.id === id) ?? -1;
+  if (!list || index === -1) return void 0;
+  return [list[index], index];
 }
 function createNotification(store, windowId, title, body) {
   const notification = {
@@ -121,20 +50,20 @@ function createNotification(store, windowId, title, body) {
   notify(store);
   return notification;
 }
-function dismissNotification(store, id) {
-  const found = findById(store, id);
+function dismissNotification(store, windowId, id) {
+  const found = findById(store, windowId, id);
   if (!found) return;
-  const [foundWindowId, , index] = found;
-  const list = store.notifications.get(foundWindowId);
+  const [, index] = found;
+  const list = store.notifications.get(windowId);
   if (!list) return;
   list.splice(index, 1);
-  if (list.length === 0) store.notifications.delete(foundWindowId);
+  if (list.length === 0) store.notifications.delete(windowId);
   notify(store);
 }
-function markNotificationRead(store, id) {
-  const found = findById(store, id);
+function markNotificationRead(store, windowId, id) {
+  const found = findById(store, windowId, id);
   if (!found) return;
-  const [, notification] = found;
+  const [notification] = found;
   if (!notification.read) {
     notification.read = true;
     notify(store);
@@ -151,12 +80,12 @@ function handleNotifyEnvelope(store, windowId, action, msg, send) {
     }
     case "dismiss": {
       const notifId = typeof msg.notificationId === "string" ? msg.notificationId : "";
-      if (notifId) dismissNotification(store, notifId);
+      if (notifId) dismissNotification(store, windowId, notifId);
       break;
     }
     case "read": {
       const notifId = typeof msg.notificationId === "string" ? msg.notificationId : "";
-      if (notifId) markNotificationRead(store, notifId);
+      if (notifId) markNotificationRead(store, windowId, notifId);
       break;
     }
     case "list": {
@@ -168,34 +97,6 @@ function handleNotifyEnvelope(store, windowId, action, msg, send) {
       break;
   }
 }
-function handleIncNotification(store, windowId, action, payload, send) {
-  switch (action) {
-    case "create": {
-      const title = typeof payload.title === "string" ? payload.title : "";
-      const body = typeof payload.body === "string" ? payload.body : "";
-      const notification = createNotification(store, windowId, title, body);
-      send({ type: "inc.event", topic: "notifications:created", payload: { id: notification.id } });
-      break;
-    }
-    case "dismiss": {
-      const id = typeof payload.id === "string" ? payload.id : "";
-      if (id) dismissNotification(store, id);
-      break;
-    }
-    case "read": {
-      const id = typeof payload.id === "string" ? payload.id : "";
-      if (id) markNotificationRead(store, id);
-      break;
-    }
-    case "list": {
-      const windowNotifs = store.notifications.get(windowId) ?? [];
-      send({ type: "inc.event", topic: "notifications:listed", payload: { notifications: windowNotifs } });
-      break;
-    }
-    default:
-      break;
-  }
-}
 function createNotificationService(options) {
   const store = {
     notifications: /* @__PURE__ */ new Map(),
@@ -203,23 +104,21 @@ function createNotificationService(options) {
     maxPerWindow: options?.maxPerWindow ?? DEFAULT_MAX_PER_WINDOW
   };
   const descriptor = {
-    name: "notifications",
+    name: "notify",
     version: NOTIFICATION_SERVICE_VERSION,
     description: "Notification state registry \u2014 tracks notifications per napplet window"
   };
   return {
     descriptor,
     handleMessage(windowId, message, send) {
-      const msg = message;
-      if (message.type.startsWith("notify.")) {
-        handleNotifyEnvelope(store, windowId, message.type.slice(7), msg, send);
-        return;
-      }
-      if (message.type !== "inc.emit") return;
-      const topic = msg.topic;
-      if (!topic?.startsWith("notifications:")) return;
-      const payload = msg.payload ?? {};
-      handleIncNotification(store, windowId, topic.slice(14), payload, send);
+      if (!message.type.startsWith("notify.")) return;
+      handleNotifyEnvelope(
+        store,
+        windowId,
+        message.type.slice(7),
+        message,
+        send
+      );
     },
     onWindowDestroyed(windowId) {
       if (store.notifications.delete(windowId)) {
@@ -231,16 +130,16 @@ function createNotificationService(options) {
 
 // src/identity-service.ts
 var IDENTITY_SERVICE_VERSION = "1.0.0";
-function sendProviderError(send, result2, fallback, err2) {
+function sendProviderError(send, result2, fallback, _err) {
   send({
     ...result2,
-    error: err2?.message ?? fallback
+    error: fallback
   });
 }
 async function getCurrentPubkey(options) {
-  const currentSigner = options.getSigner();
-  if (!currentSigner?.getPublicKey) return "";
   try {
+    const currentSigner = options.getSigner();
+    if (!currentSigner?.getPublicKey) return "";
     return await currentSigner.getPublicKey() ?? "";
   } catch {
     return "";
@@ -253,46 +152,29 @@ function sendOptionalProviderResult(options, send, fallbackResult, errorFallback
   }
   Promise.resolve(getCurrentPubkey(options)).then((pubkey) => buildResult(pubkey)).then((result2) => send(result2)).catch((err2) => sendProviderError(send, fallbackResult, errorFallback, err2));
 }
-function sendIdentityError(send, id, typeBase, error) {
-  send({ type: `${typeBase}.error`, id, error });
-}
-function sendSignerError(send, id, typeBase, fallback, err2) {
-  sendIdentityError(send, id, typeBase, err2?.message ?? fallback);
-}
 function handleGetPublicKey(options, id, send) {
-  const signer = options.getSigner();
-  if (!signer) {
-    const result2 = {
-      type: "identity.getPublicKey.result",
-      id,
-      pubkey: ""
-    };
-    send(result2);
-    return;
-  }
-  Promise.resolve(signer.getPublicKey?.()).then((pubkey) => {
+  Promise.resolve().then(() => options.getSigner()).then(async (signer) => signer?.getPublicKey ? signer.getPublicKey() : "").catch(() => "").then((pubkey) => {
     const result2 = {
       type: "identity.getPublicKey.result",
       id,
       pubkey: pubkey ?? ""
     };
     send(result2);
-  }).catch((err2) => sendSignerError(send, id, "identity.getPublicKey", "getPublicKey failed", err2));
+  });
 }
 function handleGetRelays(options, id, send) {
-  const signer = options.getSigner();
-  if (!signer) {
-    sendIdentityError(send, id, "identity.getRelays", "no signer configured");
-    return;
-  }
-  Promise.resolve(signer.getRelays?.() ?? {}).then((relays) => {
-    const result2 = {
-      type: "identity.getRelays.result",
-      id,
-      relays
+  const fallbackResult = {
+    type: "identity.getRelays.result",
+    id,
+    relays: {}
+  };
+  Promise.resolve().then(() => options.getSigner()).then(async (signer) => {
+    if (!signer?.getRelays) return fallbackResult;
+    return {
+      ...fallbackResult,
+      relays: await signer.getRelays() ?? {}
     };
-    send(result2);
-  }).catch((err2) => sendSignerError(send, id, "identity.getRelays", "getRelays failed", err2));
+  }).catch(() => ({ ...fallbackResult, error: "identity.getRelays failed" })).then(send);
 }
 function handleReadProvider(options, id, message, send) {
   switch (message.type) {
@@ -301,11 +183,11 @@ function handleReadProvider(options, id, message, send) {
         options,
         send,
         { type: "identity.getProfile.result", id, profile: null },
-        "getProfile failed",
+        "identity.getProfile failed",
         options.getProfile ? async (pubkey) => ({
           type: "identity.getProfile.result",
           id,
-          profile: await options.getProfile(pubkey, message)
+          profile: await options.getProfile(pubkey, message) ?? null
         }) : void 0
       );
       return true;
@@ -314,11 +196,11 @@ function handleReadProvider(options, id, message, send) {
         options,
         send,
         { type: "identity.getFollows.result", id, pubkeys: [] },
-        "getFollows failed",
+        "identity.getFollows failed",
         options.getFollows ? async (pubkey) => ({
           type: "identity.getFollows.result",
           id,
-          pubkeys: await options.getFollows(pubkey, message)
+          pubkeys: await options.getFollows(pubkey, message) ?? []
         }) : void 0
       );
       return true;
@@ -330,11 +212,11 @@ function handleReadProvider(options, id, message, send) {
         options,
         send,
         { type: "identity.getZaps.result", id, zaps: [] },
-        "getZaps failed",
+        "identity.getZaps failed",
         options.getZaps ? async (pubkey) => ({
           type: "identity.getZaps.result",
           id,
-          zaps: await options.getZaps(pubkey, message)
+          zaps: await options.getZaps(pubkey, message) ?? []
         }) : void 0
       );
       return true;
@@ -343,11 +225,11 @@ function handleReadProvider(options, id, message, send) {
         options,
         send,
         { type: "identity.getMutes.result", id, pubkeys: [] },
-        "getMutes failed",
+        "identity.getMutes failed",
         options.getMutes ? async (pubkey) => ({
           type: "identity.getMutes.result",
           id,
-          pubkeys: await options.getMutes(pubkey, message)
+          pubkeys: await options.getMutes(pubkey, message) ?? []
         }) : void 0
       );
       return true;
@@ -356,11 +238,11 @@ function handleReadProvider(options, id, message, send) {
         options,
         send,
         { type: "identity.getBlocked.result", id, pubkeys: [] },
-        "getBlocked failed",
+        "identity.getBlocked failed",
         options.getBlocked ? async (pubkey) => ({
           type: "identity.getBlocked.result",
           id,
-          pubkeys: await options.getBlocked(pubkey, message)
+          pubkeys: await options.getBlocked(pubkey, message) ?? []
         }) : void 0
       );
       return true;
@@ -369,11 +251,11 @@ function handleReadProvider(options, id, message, send) {
         options,
         send,
         { type: "identity.getBadges.result", id, badges: [] },
-        "getBadges failed",
+        "identity.getBadges failed",
         options.getBadges ? async (pubkey) => ({
           type: "identity.getBadges.result",
           id,
-          badges: await options.getBadges(pubkey, message)
+          badges: await options.getBadges(pubkey, message) ?? []
         }) : void 0
       );
       return true;
@@ -386,11 +268,11 @@ function handleGetList(options, id, message, send) {
     options,
     send,
     { type: "identity.getList.result", id, entries: [] },
-    "getList failed",
+    "identity.getList failed",
     options.getList ? async (pubkey) => ({
       type: "identity.getList.result",
       id,
-      entries: await options.getList(message.listType, pubkey, message)
+      entries: await options.getList(message.listType, pubkey, message) ?? []
     }) : void 0
   );
 }
@@ -404,9 +286,7 @@ function handleIdentityServiceMessage(options, message, send) {
       handleGetRelays(options, id, send);
       return;
     default:
-      if (!handleReadProvider(options, id, message, send)) {
-        sendIdentityError(send, id, message.type, `Unknown identity method: ${message.type}`);
-      }
+      handleReadProvider(options, id, message, send);
   }
 }
 function createIdentityService(options) {
@@ -430,6 +310,37 @@ import { createRelayEventResultWithHints } from "@kehto/runtime";
 var EOSE_FALLBACK_MS = 15e3;
 function createRelayPoolService(options) {
   const tracked = /* @__PURE__ */ new Map();
+  function publishEvent(relayMessage, resultType, send) {
+    const id = typeof relayMessage.id === "string" ? relayMessage.id : "";
+    const event = relayMessage.event;
+    if (!event || typeof event !== "object") {
+      send({ type: resultType, id, ok: false, error: "invalid event" });
+      return;
+    }
+    if (!options.isAvailable()) {
+      send({ type: resultType, id, ok: false, error: "no relay pool available" });
+      return;
+    }
+    void (async () => {
+      try {
+        await options.publish(event);
+        send({
+          type: resultType,
+          id,
+          ok: true,
+          event,
+          eventId: event.id
+        });
+      } catch (error) {
+        send({
+          type: resultType,
+          id,
+          ok: false,
+          error: error instanceof Error && error.message ? error.message : "publish failed"
+        });
+      }
+    })();
+  }
   return {
     descriptor: {
       name: "relay-pool",
@@ -489,17 +400,11 @@ function createRelayPoolService(options) {
         return;
       }
       if (message.type === "relay.publish") {
-        const event = relayMessage.event;
-        if (event && typeof event === "object" && options.isAvailable()) {
-          options.publish(event);
-        }
+        publishEvent(relayMessage, "relay.publish.result", send);
         return;
       }
       if (message.type === "relay.publishEncrypted") {
-        const event = relayMessage.event;
-        if (event && typeof event === "object" && options.isAvailable()) {
-          options.publish(event);
-        }
+        publishEvent(relayMessage, "relay.publishEncrypted.result", send);
         return;
       }
     },
@@ -651,6 +556,48 @@ function isPlainObject(value) {
 // src/coordinated-relay.ts
 import { createRelayEventResult as createRelayEventResult2, createRelayEventResultWithHints as createRelayEventResultWithHints2 } from "@kehto/runtime";
 var DEFAULT_EOSE_TIMEOUT_MS = 15e3;
+function publishCoordinatedEvent(options, relayMessage, send) {
+  const id = typeof relayMessage.id === "string" ? relayMessage.id : "";
+  const event = relayMessage.event;
+  if (!event || typeof event !== "object") {
+    send({ type: "relay.publish.result", id, ok: false, error: "invalid event" });
+    return;
+  }
+  if (!options.relayPool.isAvailable()) {
+    send({
+      type: "relay.publish.result",
+      id,
+      ok: false,
+      error: "no relay pool available"
+    });
+    return;
+  }
+  void (async () => {
+    try {
+      await options.relayPool.publish(event);
+      if (options.cache.isAvailable()) {
+        try {
+          options.cache.store(event);
+        } catch {
+        }
+      }
+      send({
+        type: "relay.publish.result",
+        id,
+        ok: true,
+        event,
+        eventId: event.id
+      });
+    } catch (error) {
+      send({
+        type: "relay.publish.result",
+        id,
+        ok: false,
+        error: error instanceof Error && error.message ? error.message : "publish failed"
+      });
+    }
+  })();
+}
 function createCoordinatedRelay(options) {
   const timeoutMs = options.eoseTimeoutMs ?? DEFAULT_EOSE_TIMEOUT_MS;
   const subs = /* @__PURE__ */ new Map();
@@ -758,17 +705,7 @@ function createCoordinatedRelay(options) {
         return;
       }
       if (message.type === "relay.publish") {
-        const event = relayMessage.event;
-        if (!event || typeof event !== "object") return;
-        if (options.relayPool.isAvailable()) {
-          options.relayPool.publish(event);
-        }
-        if (options.cache.isAvailable()) {
-          try {
-            options.cache.store(event);
-          } catch {
-          }
-        }
+        publishCoordinatedEvent(options, relayMessage, send);
         return;
       }
     },
@@ -785,8 +722,7 @@ function createCoordinatedRelay(options) {
   };
 }
 
-// src/keys-service.ts
-var KEYS_SERVICE_VERSION = "1.2.0";
+// src/keys-service-internals.ts
 var MODIFIER_ALIASES = {
   ctrl: "ctrl",
   control: "ctrl",
@@ -815,127 +751,242 @@ function parseChord(chord) {
   out.key = keyTok.length === 1 ? keyTok.toUpperCase() : keyTok;
   return out;
 }
+function formatChord(spec) {
+  const parts = [];
+  if (spec.alt) parts.push("Alt");
+  if (spec.ctrl) parts.push("Ctrl");
+  if (spec.shift) parts.push("Shift");
+  if (spec.meta) parts.push("Meta");
+  parts.push(spec.key);
+  return parts.join("+");
+}
+var BROWSER_RESERVED_CTRL_KEYS = /* @__PURE__ */ new Set(["L", "N", "R", "T", "W"]);
+function isReservedKeyChord(spec) {
+  if (spec.key === "Tab" || spec.key === "Escape") return true;
+  if ((spec.ctrl || spec.meta) && !spec.alt && BROWSER_RESERVED_CTRL_KEYS.has(spec.key)) return true;
+  if (spec.alt && !spec.ctrl && !spec.meta && (spec.key === "ArrowLeft" || spec.key === "ArrowRight")) {
+    return true;
+  }
+  return false;
+}
+function chordSpecKey(spec) {
+  return `${spec.ctrl}|${spec.alt}|${spec.shift}|${spec.meta}|${spec.key}`;
+}
+function forwardPayload(m) {
+  return {
+    key: m.key,
+    code: m.code,
+    ctrlKey: m.ctrl,
+    altKey: m.alt,
+    shiftKey: m.shift,
+    metaKey: m.meta
+  };
+}
+function eventKey(ev) {
+  const k = ev.key.length === 1 ? ev.key.toUpperCase() : ev.key;
+  return `${ev.ctrlKey}|${ev.altKey}|${ev.shiftKey}|${ev.metaKey}|${k}`;
+}
+function bindingsForWindow(windowId, registry, windowIndex) {
+  const actionIds = windowIndex.get(windowId);
+  if (!actionIds) return [];
+  const bindings = [];
+  for (const actionId of actionIds) {
+    const entry = registry.get(actionId);
+    if (!entry || entry.windowId !== windowId) continue;
+    bindings.push({ actionId, key: entry.chordString });
+  }
+  return bindings;
+}
+function pushBindings(windowId, registry, windowIndex, send) {
+  const payload = {
+    type: "keys.bindings",
+    bindings: bindingsForWindow(windowId, registry, windowIndex)
+  };
+  send(payload);
+}
+function removeActionFromWindowIndex(actionId, windowIndex) {
+  for (const [wid, set] of windowIndex.entries()) {
+    if (set.delete(actionId) && set.size === 0) windowIndex.delete(wid);
+  }
+}
+
+// src/keys-service.ts
+var KEYS_SERVICE_VERSION = "1.3.0";
+function rememberActionForWindow(windowIndex, windowId, actionId) {
+  if (!windowIndex.has(windowId)) windowIndex.set(windowId, /* @__PURE__ */ new Set());
+  windowIndex.get(windowId).add(actionId);
+}
+function bindActionEntry(registry, windowIndex, actionId, windowId, chord, chordString) {
+  registry.set(actionId, { chord, chordString, windowId });
+  rememberActionForWindow(windowIndex, windowId, actionId);
+}
+function bindActionAndMarkChanged(registry, windowIndex, changedWindowIds, actionId, windowId, chord, chordString) {
+  bindActionEntry(registry, windowIndex, actionId, windowId, chord, chordString);
+  changedWindowIds.add(windowId);
+  return chordString;
+}
+function handleForwardMessage(message, onForward) {
+  onForward?.(forwardPayload(message));
+}
+function sendUnknownKeysMethod(send, message) {
+  const id = message.id ?? "";
+  send({
+    type: `${message.type}.error`,
+    id,
+    error: `Unknown keys method: ${message.type}`
+  });
+}
+function createKeysMessageHandler(options) {
+  return (windowId, message, send) => {
+    switch (message.type) {
+      case "keys.forward":
+        handleForwardMessage(message, options.onForward);
+        return;
+      case "keys.registerAction":
+        options.onRegisterAction(windowId, message, send);
+        return;
+      case "keys.unregisterAction":
+        options.onUnregisterAction(windowId, message, send);
+        return;
+      default:
+        sendUnknownKeysMethod(send, message);
+    }
+  };
+}
+function sendRegisterActionResult(send, message, binding, error) {
+  const result2 = {
+    type: "keys.registerAction.result",
+    id: message.id,
+    actionId: message.action.id,
+    ...binding ? { binding } : {},
+    ...error ? { error } : {}
+  };
+  send(result2);
+}
+function pushChangedBindings(changedWindowIds, registry, windowIndex, sendHandles, fallbackSend) {
+  for (const changedWindowId of changedWindowIds) {
+    const ownerSend = sendHandles.get(changedWindowId) ?? fallbackSend;
+    pushBindings(changedWindowId, registry, windowIndex, ownerSend);
+    if (!windowIndex.has(changedWindowId)) sendHandles.delete(changedWindowId);
+  }
+}
 function createKeysService(options = {}) {
   const descriptor = {
     name: "keys",
     version: KEYS_SERVICE_VERSION,
     description: options.hostBridge ? "NIP-5D keys NAP reference handler (host-bridge delegated)" : "NIP-5D keys NAP reference handler (document-level chord listener)"
   };
-  function chordSpecKey(spec) {
-    return `${spec.ctrl}|${spec.alt}|${spec.shift}|${spec.meta}|${spec.key}`;
-  }
   const reservedChordKeys = /* @__PURE__ */ new Set();
   if (options.reservedChords) {
     for (const chordStr of options.reservedChords) {
       reservedChordKeys.add(chordSpecKey(parseChord(chordStr)));
     }
   }
-  function forwardKey(m) {
-    const k = m.key.length === 1 ? m.key.toUpperCase() : m.key;
-    return `${m.ctrl}|${m.alt}|${m.shift}|${m.meta}|${k}`;
-  }
-  function forwardPayload(m) {
-    return {
-      key: m.key,
-      code: m.code,
-      ctrlKey: m.ctrl,
-      altKey: m.alt,
-      shiftKey: m.shift,
-      metaKey: m.meta
-    };
-  }
-  function eventKey(ev) {
-    const k = ev.key.length === 1 ? ev.key.toUpperCase() : ev.key;
-    return `${ev.ctrlKey}|${ev.altKey}|${ev.shiftKey}|${ev.metaKey}|${k}`;
-  }
+  const isUnavailableBinding = (chord) => reservedChordKeys.has(chordSpecKey(chord)) || isReservedKeyChord(chord);
   if (options.hostBridge) {
     const bridge = options.hostBridge;
     const bridgeWindowActions = /* @__PURE__ */ new Map();
+    const bridgeActionRegistry = /* @__PURE__ */ new Map();
+    const bridgeSendHandles = /* @__PURE__ */ new Map();
     const unsubscribeHandles = /* @__PURE__ */ new Map();
-    return {
-      descriptor,
-      handleMessage(windowId, message, send) {
-        switch (message.type) {
-          case "keys.forward": {
-            const m = message;
-            const reserved = reservedChordKeys.has(forwardKey(m));
-            options.onForward?.(forwardPayload(m));
-            if (reserved) {
-              return;
-            }
-            return;
-          }
-          case "keys.registerAction": {
-            const m = message;
-            if (m.action.defaultKey) {
-              try {
-                const unsubscribe = bridge.subscribe(m.action.defaultKey, (ev) => {
-                  const e = ev;
-                  if ("repeat" in e && e.repeat) return;
-                  options.onForward?.({
-                    key: e.key,
-                    code: e.code,
-                    ctrlKey: e.ctrlKey,
-                    altKey: e.altKey,
-                    shiftKey: e.shiftKey,
-                    metaKey: e.metaKey
-                  });
-                  const payload = {
-                    type: "keys.action",
-                    actionId: m.action.id
-                  };
-                  send(payload);
-                });
-                unsubscribeHandles.set(m.action.id, unsubscribe);
-                if (!bridgeWindowActions.has(windowId)) bridgeWindowActions.set(windowId, /* @__PURE__ */ new Set());
-                bridgeWindowActions.get(windowId).add(m.action.id);
-              } catch (err2) {
-                const id = m.id ?? "";
-                send({
-                  type: "keys.registerAction.error",
-                  id,
-                  error: `bridge subscribe failed: ${err2.message}`
-                });
-                return;
-              }
-            }
-            const result2 = {
-              type: "keys.registerAction.result",
-              id: m.id,
-              actionId: m.action.id,
-              ...m.action.defaultKey ? { binding: m.action.defaultKey } : {}
-            };
-            send(result2);
-            return;
+    const handleBridgeRegisterAction = (windowId, m, send) => {
+      bridgeSendHandles.set(windowId, send);
+      let binding;
+      const changedWindowIds = /* @__PURE__ */ new Set();
+      if (m.action.defaultKey) {
+        try {
+          const chord = parseChord(m.action.defaultKey);
+          const normalizedChord = formatChord(chord);
+          const existingEntry = bridgeActionRegistry.get(m.action.id);
+          const existing = unsubscribeHandles.get(m.action.id);
+          let nextUnsubscribe;
+          if (!isUnavailableBinding(chord)) {
+            nextUnsubscribe = bridge.subscribe(normalizedChord, (ev) => {
+              const e = ev;
+              if ("repeat" in e && e.repeat) return;
+              options.onForward?.({
+                key: e.key,
+                code: e.code,
+                ctrlKey: e.ctrlKey,
+                altKey: e.altKey,
+                shiftKey: e.shiftKey,
+                metaKey: e.metaKey
+              });
+              const payload = {
+                type: "keys.action",
+                actionId: m.action.id
+              };
+              send(payload);
+            });
           }
-          case "keys.unregisterAction": {
-            const m = message;
-            if (m.actionId) {
-              const unsubscribe = unsubscribeHandles.get(m.actionId);
-              if (unsubscribe) {
-                try {
-                  unsubscribe();
-                } catch {
-                }
-                unsubscribeHandles.delete(m.actionId);
-                for (const [wid, set] of bridgeWindowActions.entries()) {
-                  if (set.delete(m.actionId) && set.size === 0) bridgeWindowActions.delete(wid);
-                }
-              }
+          if (existing) {
+            try {
+              existing();
+            } catch {
             }
-            return;
+            unsubscribeHandles.delete(m.action.id);
           }
-          default: {
-            const id = message.id ?? "";
-            send({
-              type: `${message.type}.error`,
-              id,
-              error: `Unknown keys method: ${message.type}`
-            });
-            return;
+          if (existingEntry) changedWindowIds.add(existingEntry.windowId);
+          removeActionFromWindowIndex(m.action.id, bridgeWindowActions);
+          bridgeActionRegistry.delete(m.action.id);
+          if (nextUnsubscribe) {
+            unsubscribeHandles.set(m.action.id, nextUnsubscribe);
+            binding = bindActionAndMarkChanged(
+              bridgeActionRegistry,
+              bridgeWindowActions,
+              changedWindowIds,
+              m.action.id,
+              windowId,
+              chord,
+              normalizedChord
+            );
           }
+        } catch (err2) {
+          sendRegisterActionResult(
+            send,
+            m,
+            void 0,
+            `bridge subscribe failed: ${err2.message}`
+          );
+          return;
         }
-      },
+      }
+      sendRegisterActionResult(send, m, binding);
+      pushChangedBindings(
+        changedWindowIds,
+        bridgeActionRegistry,
+        bridgeWindowActions,
+        bridgeSendHandles,
+        send
+      );
+    };
+    const handleBridgeUnregisterAction = (_windowId, m, send) => {
+      if (!m.actionId) return;
+      const unsubscribe = unsubscribeHandles.get(m.actionId);
+      const entry = bridgeActionRegistry.get(m.actionId);
+      if (!unsubscribe) return;
+      try {
+        unsubscribe();
+      } catch {
+      }
+      unsubscribeHandles.delete(m.actionId);
+      bridgeActionRegistry.delete(m.actionId);
+      removeActionFromWindowIndex(m.actionId, bridgeWindowActions);
+      if (entry) {
+        const ownerSend = bridgeSendHandles.get(entry.windowId) ?? send;
+        pushBindings(entry.windowId, bridgeActionRegistry, bridgeWindowActions, ownerSend);
+        if (!bridgeWindowActions.has(entry.windowId)) {
+          bridgeSendHandles.delete(entry.windowId);
+        }
+      }
+    };
+    return {
+      descriptor,
+      handleMessage: createKeysMessageHandler({
+        onForward: options.onForward,
+        onRegisterAction: handleBridgeRegisterAction,
+        onUnregisterAction: handleBridgeUnregisterAction
+      }),
       onWindowDestroyed(windowId) {
         const actions = bridgeWindowActions.get(windowId);
         if (!actions) return;
@@ -948,8 +999,10 @@ function createKeysService(options = {}) {
             }
           }
           unsubscribeHandles.delete(actionId);
+          bridgeActionRegistry.delete(actionId);
         }
         bridgeWindowActions.delete(windowId);
+        bridgeSendHandles.delete(windowId);
       },
       destroy() {
         for (const unsubscribe of unsubscribeHandles.values()) {
@@ -959,7 +1012,9 @@ function createKeysService(options = {}) {
           }
         }
         unsubscribeHandles.clear();
+        bridgeActionRegistry.clear();
         bridgeWindowActions.clear();
+        bridgeSendHandles.clear();
       }
     };
   }
@@ -1003,8 +1058,7 @@ function createKeysService(options = {}) {
         if (send) {
           const payload = {
             type: "keys.action",
-            actionId,
-            chord: entry.chord
+            actionId
           };
           send(payload);
         }
@@ -1012,76 +1066,56 @@ function createKeysService(options = {}) {
     }
   };
   target.addEventListener("keydown", listener);
-  return {
-    descriptor,
-    handleMessage(windowId, message, send) {
-      switch (message.type) {
-        case "keys.forward": {
-          const m = message;
-          const reserved = reservedChordKeys.has(forwardKey(m));
-          options.onForward?.(forwardPayload(m));
-          if (reserved) return;
-          return;
-        }
-        case "keys.registerAction": {
-          const m = message;
-          sendHandles.set(windowId, send);
-          if (m.action.defaultKey) {
-            try {
-              const chord = parseChord(m.action.defaultKey);
-              actionRegistry.set(m.action.id, {
-                chord,
-                chordString: m.action.defaultKey,
-                windowId
-              });
-              if (!windowActions.has(windowId)) windowActions.set(windowId, /* @__PURE__ */ new Set());
-              windowActions.get(windowId).add(m.action.id);
-            } catch (err2) {
-              const id = m.id ?? "";
-              send({
-                type: "keys.registerAction.error",
-                id,
-                error: `invalid chord: ${err2.message}`
-              });
-              return;
-            }
-          }
-          const result2 = {
-            type: "keys.registerAction.result",
-            id: m.id,
-            actionId: m.action.id,
-            ...m.action.defaultKey ? { binding: m.action.defaultKey } : {}
-          };
-          send(result2);
-          return;
+  const handleDocumentRegisterAction = (windowId, m, send) => {
+    sendHandles.set(windowId, send);
+    let binding;
+    const changedWindowIds = /* @__PURE__ */ new Set();
+    if (m.action.defaultKey) {
+      try {
+        const chord = parseChord(m.action.defaultKey);
+        const normalizedChord = formatChord(chord);
+        const existing = actionRegistry.get(m.action.id);
+        if (existing) {
+          changedWindowIds.add(existing.windowId);
+          removeActionFromWindowIndex(m.action.id, windowActions);
+          actionRegistry.delete(m.action.id);
         }
-        case "keys.unregisterAction": {
-          const m = message;
-          if (m.actionId && actionRegistry.has(m.actionId)) {
-            const entry = actionRegistry.get(m.actionId);
-            actionRegistry.delete(m.actionId);
-            const set = windowActions.get(entry.windowId);
-            if (set) {
-              set.delete(m.actionId);
-              if (set.size === 0) {
-                windowActions.delete(entry.windowId);
-                sendHandles.delete(entry.windowId);
-              }
-            }
-          }
-          return;
-        }
-        default: {
-          const id = message.id ?? "";
-          send({
-            type: `${message.type}.error`,
-            id,
-            error: `Unknown keys method: ${message.type}`
-          });
-          return;
+        if (!isUnavailableBinding(chord)) {
+          binding = bindActionAndMarkChanged(actionRegistry, windowActions, changedWindowIds, m.action.id, windowId, chord, normalizedChord);
         }
+      } catch (err2) {
+        sendRegisterActionResult(
+          send,
+          m,
+          void 0,
+          `invalid chord: ${err2.message}`
+        );
+        return;
       }
-    },
+    }
+    sendRegisterActionResult(send, m, binding);
+    pushChangedBindings(changedWindowIds, actionRegistry, windowActions, sendHandles, send);
+  };
+  const handleDocumentUnregisterAction = (_windowId, m, send) => {
+    if (!m.actionId || !actionRegistry.has(m.actionId)) return;
+    const entry = actionRegistry.get(m.actionId);
+    actionRegistry.delete(m.actionId);
+    const set = windowActions.get(entry.windowId);
+    if (set) {
+      set.delete(m.actionId);
+      if (set.size === 0) windowActions.delete(entry.windowId);
+    }
+    const ownerSend = sendHandles.get(entry.windowId) ?? send;
+    pushBindings(entry.windowId, actionRegistry, windowActions, ownerSend);
+    if (!windowActions.has(entry.windowId)) sendHandles.delete(entry.windowId);
+  };
+  return {
+    descriptor,
+    handleMessage: createKeysMessageHandler({
+      onForward: options.onForward,
+      onRegisterAction: handleDocumentRegisterAction,
+      onUnregisterAction: handleDocumentUnregisterAction
+    }),
     onWindowDestroyed(windowId) {
       const actions = windowActions.get(windowId);
       if (actions) {
@@ -1531,8 +1565,15 @@ var DEFAULT_THEME = {
   // fonts, background, title intentionally undefined — all optional per
   // @napplet/nap/theme Theme interface.
 };
+function isCompleteTheme(theme) {
+  const colors = theme?.colors;
+  return typeof colors?.background === "string" && typeof colors.text === "string" && typeof colors.primary === "string";
+}
+function normalizeTheme(theme) {
+  return isCompleteTheme(theme) ? theme : DEFAULT_THEME;
+}
 function createThemeService(options = {}) {
-  let currentTheme = options.initialTheme ?? DEFAULT_THEME;
+  let currentTheme = normalizeTheme(options.initialTheme);
   const descriptor = {
     name: "theme",
     version: THEME_SERVICE_VERSION,
@@ -1551,19 +1592,15 @@ function createThemeService(options = {}) {
         send(result2);
         return;
       }
-      send({
-        type: `${message.type}.error`,
-        id,
-        error: `Unknown theme method: ${message.type}`
-      });
+      return;
     },
     // Theme service has no per-window state to clean up.
     onWindowDestroyed(_windowId) {
     }
   };
   function publishTheme(theme) {
-    currentTheme = theme;
-    const envelope = { type: "theme.changed", theme };
+    currentTheme = normalizeTheme(theme);
+    const envelope = { type: "theme.changed", theme: currentTheme };
     options.onBroadcast?.(envelope);
     return envelope;
   }
@@ -2070,8 +2107,9 @@ function sanitizePublishOptions(raw) {
   const out = {};
   const relays = stringArray(raw.relays);
   if (relays) out.relays = relays;
-  const targetAuthors = stringArray(raw.targetAuthors);
-  if (targetAuthors) out.targetAuthors = targetAuthors;
+  if (typeof raw.toOutbox === "boolean") out.toOutbox = raw.toOutbox;
+  const toInboxes = stringArray(raw.toInboxes);
+  if (toInboxes) out.toInboxes = toInboxes;
   return Object.keys(out).length > 0 ? out : void 0;
 }
 function sanitizeTarget(raw) {
@@ -2293,9 +2331,33 @@ function allowed(ctx, urls) {
   }
   return [...out];
 }
+async function resolveRequiredRelays(ctx, pubkeys, direction) {
+  const useWrite = direction === "read";
+  const relays = /* @__PURE__ */ new Set();
+  const missingAuthors = [];
+  const deniedAuthors = [];
+  const uniquePubkeys = [...new Set(pubkeys)];
+  if (uniquePubkeys.length === 0) return { relays: [], missingAuthors, deniedAuthors };
+  const lists = await ctx.loadRelayLists(uniquePubkeys);
+  for (const pubkey of uniquePubkeys) {
+    const entry = lists.get(pubkey);
+    const candidateRelays = entry ? useWrite ? entry.write : entry.read : void 0;
+    if (!candidateRelays || candidateRelays.length === 0) {
+      missingAuthors.push(pubkey);
+      continue;
+    }
+    const allowedRelays = allowed(ctx, candidateRelays);
+    if (allowedRelays.length === 0) {
+      deniedAuthors.push(pubkey);
+      continue;
+    }
+    for (const url of allowedRelays) relays.add(url);
+  }
+  return { relays: [...relays], missingAuthors, deniedAuthors };
+}
 async function resolvePlan(ctx, pubkeys, direction, relayHints) {
   const useWrite = direction === "read";
-  const collected = /* @__PURE__ */ new Set();
+  const discovered = /* @__PURE__ */ new Set();
   const missingAuthors = [];
   let sawNip65 = false;
   if (pubkeys.length > 0) {
@@ -2305,25 +2367,46 @@ async function resolvePlan(ctx, pubkeys, direction, relayHints) {
       const relays2 = entry ? useWrite ? entry.write : entry.read : void 0;
       if (relays2 && relays2.length > 0) {
         sawNip65 = true;
-        for (const url of relays2) collected.add(url);
+        for (const url of relays2) discovered.add(url);
       } else {
         missingAuthors.push(pubkey);
       }
     }
   }
-  for (const url of relayHints ?? []) collected.add(url);
-  let relays = allowed(ctx, collected);
+  const hintRelays = allowed(ctx, relayHints ?? []);
+  let relays = allowed(ctx, discovered);
   let source;
-  if (relays.length === 0) {
-    relays = allowed(ctx, ctx.fallbackRelays);
-    source = "fallback";
-  } else {
+  if (relays.length > 0) {
     source = sawNip65 ? "nip65" : "policy";
+  } else {
+    relays = allowed(ctx, ctx.fallbackRelays);
+    source = relays.length > 0 ? "fallback" : "policy";
+  }
+  for (const url of hintRelays) {
+    if (!relays.includes(url)) relays.push(url);
   }
+  if (relays.length === 0) source = "fallback";
   const plan = { relays, source };
   if (missingAuthors.length > 0) plan.missingAuthors = missingAuthors;
   return plan;
 }
+function discoveredReadRelays(ctx, authors, lists) {
+  const relays = /* @__PURE__ */ new Set();
+  const missingAuthors = [];
+  for (const author of new Set(authors)) {
+    const writeRelays = lists.get(author)?.write;
+    if (!writeRelays || writeRelays.length === 0) {
+      missingAuthors.push(author);
+      continue;
+    }
+    for (const url of allowed(ctx, writeRelays)) relays.add(url);
+  }
+  return { relays: [...relays], missingAuthors };
+}
+function immediateReadRelays(ctx, relayHints) {
+  const hints = allowed(ctx, relayHints ?? []);
+  return hints.length > 0 ? hints : allowed(ctx, ctx.fallbackRelays);
+}
 function recordRelay(collector, id, relayUrl) {
   let set = collector.relayMap.get(id);
   if (!set) {
@@ -2332,81 +2415,166 @@ function recordRelay(collector, id, relayUrl) {
   }
   set.add(relayUrl);
 }
-function admitEvent(ctx, collector, event) {
-  if (collector.seen.has(event.id)) return;
-  collector.verifications.push(
-    ctx.verify(event).then((ok) => {
-      if (ok && !collector.seen.has(event.id)) collector.seen.set(event.id, event);
-      else if (!ok) collector.relayMap.delete(event.id);
-    })
-  );
-}
-function buildCollectResult(collector, timedOut) {
-  const events = [...collector.seen.values()].map(
-    (event) => createRelayEventResultWithHints3(event, [...collector.relayMap.get(event.id) ?? []])
-  );
-  return { events, incomplete: timedOut };
-}
-function collectFromRelays(ctx, filters, relayUrls2, timeoutMs) {
-  return new Promise((resolve) => {
-    const collector = { seen: /* @__PURE__ */ new Map(), relayMap: /* @__PURE__ */ new Map(), verifications: [] };
-    const handles = [];
-    let eoseCount = 0;
-    let finished = false;
-    let timedOut = false;
-    function finalize() {
-      if (finished) return;
-      finished = true;
-      clearTimeout(timer);
-      for (const handle of handles) {
-        try {
-          handle.unsubscribe();
-        } catch {
-        }
-      }
-      void Promise.all(collector.verifications).then(() => resolve(buildCollectResult(collector, timedOut)));
+function collectedEventResult(collector, event) {
+  return createRelayEventResultWithHints3(event, [...collector.relayMap.get(event.id) ?? []]);
+}
+function admitEvent(ctx, collector, event, sink, isOpen, onSettled) {
+  if (collector.admitted.has(event.id)) return;
+  collector.admitted.add(event.id);
+  collector.pendingVerifications += 1;
+  void ctx.verify(event).then((ok) => {
+    if (!isOpen()) return;
+    if (!ok) {
+      collector.relayMap.delete(event.id);
+      return;
     }
-    const timer = setTimeout(() => {
-      timedOut = true;
-      finalize();
-    }, timeoutMs);
-    for (const relayUrl of relayUrls2) {
-      handles.push(relayPoolSubscribe(ctx, filters, relayUrl, (item) => {
-        if (finished) return;
-        if (item === "EOSE") {
-          eoseCount += 1;
-          if (eoseCount >= relayUrls2.length) finalize();
-          return;
-        }
-        recordRelay(collector, item.id, relayUrl);
-        admitEvent(ctx, collector, item);
-      }));
+    collector.seen.set(event.id, event);
+    try {
+      sink.event(collectedEventResult(collector, event));
+    } catch {
     }
-    if (relayUrls2.length === 0) finalize();
+  }).finally(() => {
+    collector.pendingVerifications -= 1;
+    onSettled();
   });
 }
+function buildQueryResult(collector, options, incomplete, subscribedAny) {
+  let events = [...collector.seen.values()].map((event) => collectedEventResult(collector, event));
+  if (options?.limit !== void 0 && events.length > options.limit) {
+    events = [...events].sort((a, b) => b.event.created_at - a.event.created_at).slice(0, options.limit);
+  }
+  const result2 = { events };
+  if (incomplete || !subscribedAny) result2.incomplete = true;
+  if (!subscribedAny) result2.error = "relay list unavailable";
+  return result2;
+}
 function relayPoolSubscribe(ctx, filters, relayUrl, cb) {
   return ctx.relayPool.subscribe(filters, [relayUrl], cb);
 }
-async function queryImpl(ctx, filters, options) {
+function startQueryImpl(ctx, filters, options, sink) {
   if (!ctx.relayPool.isAvailable()) {
-    return { events: [], incomplete: true, error: "relay list unavailable" };
+    return {
+      result: Promise.resolve({ events: [], incomplete: true, error: "relay list unavailable" }),
+      close() {
+      }
+    };
   }
   const authors = deriveAuthors(filters, options?.authors);
-  const plan = await resolvePlan(ctx, authors, "read", options?.relays);
-  if (plan.relays.length === 0) {
-    return { events: [], incomplete: true, error: "relay list unavailable" };
-  }
-  const timeoutMs = options?.timeoutMs ?? ctx.defaultTimeoutMs;
-  const collected = await collectFromRelays(ctx, filters, plan.relays, timeoutMs);
-  const incomplete = collected.incomplete || (plan.missingAuthors?.length ?? 0) > 0;
-  let events = collected.events;
-  if (options?.limit !== void 0 && events.length > options.limit) {
-    events = [...events].sort((a, b) => b.event.created_at - a.event.created_at).slice(0, options.limit);
+  const collector = {
+    seen: /* @__PURE__ */ new Map(),
+    admitted: /* @__PURE__ */ new Set(),
+    relayMap: /* @__PURE__ */ new Map(),
+    pendingVerifications: 0
+  };
+  const handles = /* @__PURE__ */ new Map();
+  const activeRelays = /* @__PURE__ */ new Set();
+  const eoseRelays = /* @__PURE__ */ new Set();
+  let discoveryPending = authors.length > 0;
+  let incomplete = false;
+  let subscribedAny = false;
+  let finished = false;
+  let resolveResult;
+  const result2 = new Promise((resolve) => {
+    resolveResult = resolve;
+  });
+  let timer;
+  function closeHandles() {
+    for (const handle of handles.values()) {
+      try {
+        handle.unsubscribe();
+      } catch {
+      }
+    }
+    handles.clear();
+  }
+  function finalize(forceIncomplete = false) {
+    if (finished) return;
+    finished = true;
+    incomplete ||= forceIncomplete;
+    clearTimeout(timer);
+    closeHandles();
+    resolveResult(buildQueryResult(collector, options, incomplete, subscribedAny));
+  }
+  function maybeFinalize() {
+    if (finished || discoveryPending || collector.pendingVerifications > 0) return;
+    if (activeRelays.size === 0 || eoseRelays.size >= activeRelays.size) finalize();
+  }
+  function attachRelay(relayUrl) {
+    if (finished || activeRelays.has(relayUrl)) return;
+    activeRelays.add(relayUrl);
+    try {
+      const handle = relayPoolSubscribe(ctx, filters, relayUrl, (item) => {
+        if (finished) return;
+        if (item === "EOSE") {
+          eoseRelays.add(relayUrl);
+          maybeFinalize();
+          return;
+        }
+        recordRelay(collector, item.id, relayUrl);
+        admitEvent(ctx, collector, item, sink, () => !finished, maybeFinalize);
+      });
+      subscribedAny = true;
+      if (finished) {
+        try {
+          handle.unsubscribe();
+        } catch {
+        }
+      } else {
+        handles.set(relayUrl, handle);
+      }
+    } catch {
+      activeRelays.delete(relayUrl);
+      incomplete = true;
+    }
   }
-  const result2 = { events };
-  if (incomplete) result2.incomplete = true;
-  return result2;
+  function attachMany(relayUrls2) {
+    for (const relayUrl of relayUrls2) attachRelay(relayUrl);
+  }
+  timer = setTimeout(() => finalize(true), options?.timeoutMs ?? ctx.defaultTimeoutMs);
+  if (authors.length === 0) {
+    discoveryPending = false;
+    attachMany(allowed(ctx, [...ctx.fallbackRelays, ...options?.relays ?? []]));
+    maybeFinalize();
+  } else {
+    let loaded;
+    try {
+      loaded = ctx.loadRelayLists(authors);
+    } catch {
+      discoveryPending = false;
+      incomplete = true;
+      attachMany(immediateReadRelays(ctx, options?.relays));
+      maybeFinalize();
+      return { result: result2, close: () => finalize(true) };
+    }
+    if (loaded instanceof Map) {
+      const discovery = discoveredReadRelays(ctx, authors, loaded);
+      discoveryPending = false;
+      incomplete ||= discovery.missingAuthors.length > 0;
+      const initial = allowed(ctx, [...options?.relays ?? [], ...discovery.relays]);
+      attachMany(initial.length > 0 ? initial : allowed(ctx, ctx.fallbackRelays));
+      maybeFinalize();
+    } else {
+      attachMany(immediateReadRelays(ctx, options?.relays));
+      void Promise.resolve(loaded).then((lists) => {
+        if (finished) return;
+        const discovery = discoveredReadRelays(ctx, authors, lists);
+        discoveryPending = false;
+        incomplete ||= discovery.missingAuthors.length > 0;
+        attachMany(discovery.relays);
+        maybeFinalize();
+      }).catch(() => {
+        if (finished) return;
+        discoveryPending = false;
+        incomplete = true;
+        maybeFinalize();
+      });
+    }
+  }
+  return { result: result2, close: () => finalize(true) };
+}
+function queryImpl(ctx, filters, options) {
+  return startQueryImpl(ctx, filters, options, { event: () => {
+  } }).result;
 }
 async function getEventImpl(ctx, eventId, options) {
   if (typeof eventId !== "string" || eventId.length === 0) {
@@ -2430,57 +2598,138 @@ async function getEventImpl(ctx, eventId, options) {
   return result2;
 }
 function closeLiveSub(sub) {
-  for (const handle of sub.handles) {
+  for (const handle of sub.handles.values()) {
     try {
       handle.unsubscribe();
     } catch {
     }
   }
-  sub.handles.length = 0;
+  sub.handles.clear();
 }
 function attachLiveRelay(ctx, sub, filters, relayUrl, sink) {
-  sub.handles.push(relayPoolSubscribe(ctx, filters, relayUrl, (item) => {
-    if (sub.closed) return;
-    if (item === "EOSE") return;
-    if (sub.seen.has(item.id)) return;
-    void ctx.verify(item).then((ok) => {
-      if (!ok || sub.closed || sub.seen.has(item.id)) return;
-      sub.seen.add(item.id);
-      sink.event(createRelayEventResultWithHints3(item, [relayUrl]));
+  if (sub.closed || sub.relays.has(relayUrl)) return false;
+  sub.relays.add(relayUrl);
+  try {
+    const handle = relayPoolSubscribe(ctx, filters, relayUrl, (item) => {
+      if (sub.closed || item === "EOSE" || sub.admitted.has(item.id)) return;
+      sub.admitted.add(item.id);
+      void ctx.verify(item).then((ok) => {
+        if (!ok || sub.closed || sub.seen.has(item.id)) return;
+        sub.seen.add(item.id);
+        sink.event(createRelayEventResultWithHints3(item, [relayUrl]));
+      });
     });
-  }));
+    if (sub.closed) {
+      try {
+        handle.unsubscribe();
+      } catch {
+      }
+    } else {
+      sub.handles.set(relayUrl, handle);
+    }
+    return true;
+  } catch {
+    sub.relays.delete(relayUrl);
+    return false;
+  }
 }
 function startSubscription(ctx, filters, options, sink) {
   const authors = deriveAuthors(filters, options?.authors);
-  const sub = { handles: [], seen: /* @__PURE__ */ new Set(), closed: false };
-  void resolvePlan(ctx, authors, "read", options?.relays).then((plan) => {
-    if (sub.closed) return;
-    if (plan.relays.length === 0) {
-      sink.closed("relay list unavailable");
-      return;
+  const sub = {
+    handles: /* @__PURE__ */ new Map(),
+    relays: /* @__PURE__ */ new Set(),
+    admitted: /* @__PURE__ */ new Set(),
+    seen: /* @__PURE__ */ new Set(),
+    closed: false
+  };
+  let discoveryOpen = authors.length > 0;
+  let discoveryTimer;
+  function attachMany(relayUrls2) {
+    for (const relayUrl of relayUrls2) attachLiveRelay(ctx, sub, filters, relayUrl, sink);
+  }
+  function closeUnavailable() {
+    if (sub.closed || sub.handles.size > 0) return;
+    sub.closed = true;
+    sink.closed("relay list unavailable");
+  }
+  if (!ctx.relayPool.isAvailable()) {
+    closeUnavailable();
+  } else if (authors.length === 0) {
+    discoveryOpen = false;
+    attachMany(immediateReadRelays(ctx, options?.relays));
+    closeUnavailable();
+  } else {
+    let loaded;
+    try {
+      loaded = ctx.loadRelayLists(authors);
+    } catch {
+      discoveryOpen = false;
+      attachMany(immediateReadRelays(ctx, options?.relays));
+      closeUnavailable();
+      loaded = /* @__PURE__ */ new Map();
     }
-    for (const relayUrl of plan.relays) attachLiveRelay(ctx, sub, filters, relayUrl, sink);
-  }).catch((err2) => {
-    if (!sub.closed) sink.closed(err2 instanceof Error ? err2.message : "subscribe failed");
-  });
+    if (discoveryOpen && loaded instanceof Map) {
+      const discovery = discoveredReadRelays(ctx, authors, loaded);
+      discoveryOpen = false;
+      const initial = allowed(ctx, [...options?.relays ?? [], ...discovery.relays]);
+      attachMany(initial.length > 0 ? initial : allowed(ctx, ctx.fallbackRelays));
+      closeUnavailable();
+    } else if (discoveryOpen) {
+      attachMany(immediateReadRelays(ctx, options?.relays));
+      discoveryTimer = setTimeout(() => {
+        discoveryOpen = false;
+        closeUnavailable();
+      }, options?.timeoutMs ?? ctx.defaultTimeoutMs);
+      void Promise.resolve(loaded).then((lists) => {
+        if (!discoveryOpen || sub.closed) return;
+        discoveryOpen = false;
+        clearTimeout(discoveryTimer);
+        attachMany(discoveredReadRelays(ctx, authors, lists).relays);
+        closeUnavailable();
+      }).catch(() => {
+        if (!discoveryOpen || sub.closed) return;
+        discoveryOpen = false;
+        clearTimeout(discoveryTimer);
+        closeUnavailable();
+      });
+    }
+  }
   return {
     close() {
       if (sub.closed) return;
       sub.closed = true;
+      discoveryOpen = false;
+      clearTimeout(discoveryTimer);
       closeLiveSub(sub);
     }
   };
 }
 async function resolvePublishTargets(ctx, signed, options) {
   const targets = /* @__PURE__ */ new Set();
-  const authorPlan = await resolvePlan(ctx, [signed.pubkey], "read");
-  for (const url of authorPlan.relays) targets.add(url);
-  if (options?.targetAuthors && options.targetAuthors.length > 0) {
-    const inboxPlan = await resolvePlan(ctx, options.targetAuthors, "write");
-    for (const url of inboxPlan.relays) targets.add(url);
+  const requiredTargets = /* @__PURE__ */ new Set();
+  if (options?.toOutbox !== false) {
+    const outboxPlan = await resolveRequiredRelays(ctx, [signed.pubkey], "read");
+    if (outboxPlan.missingAuthors.length > 0) return { relayUrls: [], requiredRelayUrls: [], error: "relay list unavailable" };
+    if (outboxPlan.deniedAuthors.length > 0) return { relayUrls: [], requiredRelayUrls: [], error: "policy denied" };
+    for (const url of outboxPlan.relays) {
+      targets.add(url);
+      requiredTargets.add(url);
+    }
+  }
+  if (options?.toInboxes && options.toInboxes.length > 0) {
+    const inboxPlan = await resolveRequiredRelays(ctx, options.toInboxes, "write");
+    if (inboxPlan.missingAuthors.length > 0) return { relayUrls: [], requiredRelayUrls: [], error: "relay list unavailable" };
+    if (inboxPlan.deniedAuthors.length > 0) return { relayUrls: [], requiredRelayUrls: [], error: "policy denied" };
+    for (const url of inboxPlan.relays) {
+      targets.add(url);
+      requiredTargets.add(url);
+    }
   }
   for (const url of options?.relays ?? []) targets.add(url);
-  return allowed(ctx, targets);
+  return {
+    relayUrls: allowed(ctx, targets),
+    requiredRelayUrls: allowed(ctx, requiredTargets)
+  };
 }
 async function publishImpl(ctx, template, options) {
   if (!ctx.signEvent) return { ok: false, error: "publish denied" };
@@ -2491,7 +2740,11 @@ async function publishImpl(ctx, template, options) {
   } catch (err2) {
     return { ok: false, error: err2 instanceof Error ? err2.message : "sign failed" };
   }
-  const relayUrls2 = await resolvePublishTargets(ctx, signed, options);
+  const publishTargets = await resolvePublishTargets(ctx, signed, options);
+  if (publishTargets.error) {
+    return { ok: false, event: signed, eventId: signed.id, error: publishTargets.error };
+  }
+  const relayUrls2 = publishTargets.relayUrls;
   if (relayUrls2.length === 0) return { ok: false, event: signed, eventId: signed.id, error: "relay list unavailable" };
   let relays;
   try {
@@ -2499,7 +2752,7 @@ async function publishImpl(ctx, template, options) {
   } catch (err2) {
     return { ok: false, event: signed, eventId: signed.id, error: err2 instanceof Error ? err2.message : "publish failed" };
   }
-  const ok = Object.values(relays).some(Boolean);
+  const ok = publishTargets.requiredRelayUrls.length > 0 ? publishTargets.requiredRelayUrls.every((url) => relays[url] === true) : Object.values(relays).some(Boolean);
   const result2 = { ok, event: signed, eventId: signed.id, relays };
   if (!ok) result2.error = "publish denied";
   return result2;
@@ -2534,6 +2787,7 @@ function createRelayPoolOutboxRouter(options) {
   return {
     getEvent: (eventId, eventOptions) => getEventImpl(ctx, eventId, eventOptions),
     query: (filters, queryOptions) => queryImpl(ctx, filters, queryOptions),
+    queryStream: (filters, queryOptions, sink) => startQueryImpl(ctx, filters, queryOptions, sink),
     subscribe: (filters, subscribeOptions, sink) => startSubscription(ctx, filters, subscribeOptions, sink),
     publish: (template, publishOptions) => publishImpl(ctx, template, publishOptions),
     resolveRelays: (target) => {
@@ -2695,6 +2949,7 @@ function createHttpUploader(options) {
   const digest = options.digestSha256 ?? defaultDigestSha256;
   const nowS = options.now ?? (() => Math.floor(Date.now() / 1e3));
   const defaultRail = options.defaultRail ?? firstConfiguredRail(rails);
+  const inFlight = /* @__PURE__ */ new Map();
   async function upload(request, ctx) {
     const rail = request.rail ?? defaultRail;
     const config = rail === "nip96" ? rails.nip96 : rail === "blossom" ? rails.blossom : void 0;
@@ -2705,18 +2960,32 @@ function createHttpUploader(options) {
     if (!server) {
       return failed(ctx.uploadId, rail, "no server configured");
     }
-    const bytes = await toBytes(request.data);
-    const sha256 = await digest(bytes);
+    const controller = new AbortController();
+    inFlight.set(ctx.uploadId, controller);
+    let sha256;
     try {
-      return rail === "nip96" ? await uploadNip96({ request, ctx, server, bytes, sha256, signEvent, fetchFn, nowS }) : await uploadBlossom({ request, ctx, server, bytes, sha256, signEvent, fetchFn, nowS });
+      const bytes = await toBytes(request.data);
+      sha256 = await digest(bytes);
+      if (controller.signal.aborted) {
+        return cancelled(ctx.uploadId, rail, sha256);
+      }
+      return rail === "nip96" ? await uploadNip96({ request, ctx, server, bytes, sha256, signEvent, fetchFn, nowS, controller }) : await uploadBlossom({ request, ctx, server, bytes, sha256, signEvent, fetchFn, nowS, controller });
     } catch (err2) {
+      if (controller.signal.aborted) {
+        return cancelled(ctx.uploadId, rail, sha256);
+      }
       return failed(ctx.uploadId, rail, toErrorMessage3(err2), sha256);
+    } finally {
+      inFlight.delete(ctx.uploadId);
     }
   }
-  return { upload };
+  function cancel(uploadId) {
+    inFlight.get(uploadId)?.abort();
+  }
+  return { upload, cancel };
 }
 async function uploadNip96(args) {
-  const { request, ctx, server, bytes, sha256, signEvent, fetchFn, nowS } = args;
+  const { request, ctx, server, bytes, sha256, signEvent, fetchFn, nowS, controller } = args;
   const auth = await signEvent({
     kind: KIND_NIP98,
     created_at: nowS(),
@@ -2732,10 +3001,12 @@ async function uploadNip96(args) {
   if (request.caption !== void 0) form.append("caption", request.caption);
   if (request.mimeType !== void 0) form.append("content_type", request.mimeType);
   if (request.noTransform) form.append("no_transform", "true");
+  emitUploading(ctx, "nip96", bytes.byteLength, nowS);
   const res = await fetchFn(server, {
     method: "POST",
     headers: { Authorization: nostrAuthHeader(auth) },
-    body: form
+    body: form,
+    signal: controller.signal
   });
   if (!res.ok) {
     return failed(ctx.uploadId, "nip96", `server rejected (HTTP ${res.status})`, sha256);
@@ -2773,7 +3044,7 @@ function fromNip94Tags(uploadId, rail, tags, fallbackSize, fallbackSha) {
   return result2;
 }
 async function uploadBlossom(args) {
-  const { request, ctx, server, bytes, sha256, signEvent, fetchFn, nowS } = args;
+  const { request, ctx, server, bytes, sha256, signEvent, fetchFn, nowS, controller } = args;
   const auth = await signEvent({
     kind: KIND_BLOSSOM_AUTH,
     created_at: nowS(),
@@ -2787,33 +3058,65 @@ async function uploadBlossom(args) {
   const endpoint = `${trimTrailingSlash(server)}/upload`;
   const headers = { Authorization: nostrAuthHeader(auth) };
   if (request.mimeType) headers["Content-Type"] = request.mimeType;
+  emitUploading(ctx, "blossom", bytes.byteLength, nowS);
   const res = await fetchFn(endpoint, {
     method: "PUT",
     headers,
-    body: bytesToArrayBuffer(bytes)
+    body: bytesToArrayBuffer(bytes),
+    signal: controller.signal
   });
   if (!res.ok) {
     return failed(ctx.uploadId, "blossom", `server rejected (HTTP ${res.status})`, sha256);
   }
   const blob = await res.json();
-  if (!blob.url) {
+  if (typeof blob.url !== "string" || blob.url.length === 0) {
     return failed(ctx.uploadId, "blossom", "server returned no url", sha256);
   }
+  if (typeof blob.sha256 !== "string" || blob.sha256.length === 0) {
+    return failed(ctx.uploadId, "blossom", "server returned no sha256", sha256);
+  }
+  if (blob.sha256 !== sha256) {
+    return failed(ctx.uploadId, "blossom", "server returned mismatched sha256", sha256);
+  }
+  if (!Number.isSafeInteger(blob.size) || (blob.size ?? -1) < 0) {
+    return failed(ctx.uploadId, "blossom", "server returned invalid size", sha256);
+  }
+  if (blob.size !== bytes.byteLength) {
+    return failed(ctx.uploadId, "blossom", "server returned mismatched size", sha256);
+  }
+  const mimeType = blob.type ?? request.mimeType;
+  const nip94 = [["url", blob.url]];
+  if (mimeType) nip94.push(["m", mimeType]);
+  nip94.push(["x", sha256], ["size", String(bytes.byteLength)]);
   const result2 = {
     ok: true,
     uploadId: ctx.uploadId,
     status: "complete",
     rail: "blossom",
     url: blob.url,
-    sha256: blob.sha256 ?? sha256,
-    size: blob.size ?? bytes.byteLength
+    sha256,
+    size: bytes.byteLength,
+    nip94
   };
-  if (blob.type) result2.mimeType = blob.type;
+  if (mimeType) result2.mimeType = mimeType;
   return result2;
 }
 function failed(uploadId, rail, error, sha256) {
   return { ok: false, uploadId, status: "failed", rail, error, ...sha256 ? { sha256 } : {} };
 }
+function cancelled(uploadId, rail, sha256) {
+  return { ok: false, uploadId, status: "cancelled", rail, error: "user cancelled", ...sha256 ? { sha256 } : {} };
+}
+function emitUploading(ctx, rail, bytesTotal, nowS) {
+  ctx.onStatus({
+    ok: true,
+    uploadId: ctx.uploadId,
+    status: "uploading",
+    rail,
+    bytesTotal,
+    updatedAt: nowS() * 1e3
+  });
+}
 function firstConfiguredRail(rails) {
   if (rails.nip96?.servers?.length) return "nip96";
   if (rails.blossom?.servers?.length) return "blossom";
@@ -2863,42 +3166,125 @@ function toErrorMessage4(err2) {
   if (typeof err2 === "string") return err2;
   return "intent request failed";
 }
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+function validateIntentRequest(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return { error: "invalid convention" };
+  }
+  const request = value;
+  if (typeof request.archetype !== "string" || request.archetype.length === 0 || typeof request.action !== "string" || request.action.length === 0 || typeof request.convention !== "string" || request.convention.length === 0) {
+    return { error: "invalid convention" };
+  }
+  const match = /^napplet:([^/?#\s]+)\/([^/?#\s]+)$/.exec(request.convention);
+  if (!match || match[1] !== request.archetype || match[2] !== request.action) {
+    return { error: "invalid convention" };
+  }
+  const allowedKeys = ["archetype", "action", "convention", "payload", "handler", "behavior"];
+  if (Object.keys(request).some((key) => !allowedKeys.includes(key))) {
+    return { error: "invoke rejected" };
+  }
+  if (hasOwn(request, "handler") && request.handler !== void 0 && (typeof request.handler !== "string" || request.handler.length === 0)) {
+    return { error: "invoke rejected" };
+  }
+  let behavior;
+  if (hasOwn(request, "behavior") && request.behavior !== void 0) {
+    if (typeof request.behavior !== "object" || request.behavior === null || Array.isArray(request.behavior)) {
+      return { error: "invoke rejected" };
+    }
+    const record = request.behavior;
+    if (Object.keys(record).some((key) => key !== "focus" && key !== "reuse") || hasOwn(record, "focus") && typeof record.focus !== "boolean" || hasOwn(record, "reuse") && typeof record.reuse !== "boolean") {
+      return { error: "invoke rejected" };
+    }
+    behavior = {
+      ...record.focus === void 0 ? {} : { focus: record.focus },
+      ...record.reuse === void 0 ? {} : { reuse: record.reuse }
+    };
+  }
+  return {
+    request: {
+      archetype: request.archetype,
+      action: request.action,
+      convention: request.convention,
+      ...hasOwn(request, "payload") ? { payload: request.payload } : {},
+      ...typeof request.handler === "string" ? { handler: request.handler } : {},
+      ...behavior === void 0 ? {} : { behavior }
+    }
+  };
+}
+function settleResolverCall(call, send, resultType, id, onValue) {
+  let pending;
+  try {
+    pending = Promise.resolve(call());
+  } catch (error) {
+    send({ type: resultType, id, error: toErrorMessage4(error) });
+    return;
+  }
+  pending.then((value) => send(onValue(value))).catch((error) => send({ type: resultType, id, error: toErrorMessage4(error) }));
+}
+function rejectInvoke(send, id) {
+  send({
+    type: "intent.invoke.result",
+    id,
+    result: { ok: false, error: "invoke rejected" }
+  });
+}
 function createIntentService(options) {
   if (!options || typeof options.resolver !== "object" || options.resolver === null) {
     throw new Error("createIntentService: options.resolver is required");
   }
   const { resolver } = options;
-  const windows = /* @__PURE__ */ new Map();
-  resolver.onChanged?.((availability) => {
-    for (const send of windows.values()) {
-      send({ type: "intent.changed", availability });
-    }
-  });
-  function settle6(call, send, resultType, id, onValue) {
-    let pending;
-    try {
-      pending = Promise.resolve(call());
-    } catch (err2) {
-      send({ type: resultType, id, error: toErrorMessage4(err2) });
-      return;
-    }
-    pending.then((value) => send(onValue(value))).catch((err2) => send({ type: resultType, id, error: toErrorMessage4(err2) }));
-  }
+  let runtimeContext;
+  let unsubscribeChanged;
   function handleInvoke(windowId, msg, send) {
     const m = msg;
     const id = m.id ?? "";
-    const request = m.request;
-    if (!request || typeof request !== "object" || typeof request.archetype !== "string" || request.archetype.length === 0) {
-      send({ type: "intent.invoke.result", id, error: "invalid request" });
+    const validation = validateIntentRequest(m.request);
+    if ("error" in validation) {
+      send({
+        type: "intent.invoke.result",
+        id,
+        result: { ok: false, error: validation.error }
+      });
       return;
     }
-    settle6(
-      () => resolver.invoke(request, { windowId }),
-      send,
-      "intent.invoke.result",
-      id,
-      (result2) => ({ type: "intent.invoke.result", id, result: result2 })
-    );
+    const sender = runtimeContext?.resolveDTag(windowId);
+    if (!sender) {
+      rejectInvoke(send, id);
+      return;
+    }
+    let pending;
+    try {
+      pending = Promise.resolve(resolver.invoke(validation.request, { sender }));
+    } catch {
+      rejectInvoke(send, id);
+      return;
+    }
+    void pending.then(
+      (outcome) => {
+        if (outcome.result.ok && (!("retained" in outcome) || typeof outcome.retained.start !== "function")) {
+          rejectInvoke(send, id);
+          return;
+        }
+        send({
+          type: "intent.invoke.result",
+          id,
+          result: outcome.result
+        });
+        if (!outcome.result.ok || !("retained" in outcome)) return;
+        try {
+          const started = outcome.retained.start();
+          void Promise.resolve(started).catch(() => {
+          });
+        } catch {
+        }
+      },
+      () => {
+        rejectInvoke(send, id);
+      }
+    ).catch(() => {
+    });
   }
   function handleAvailable(msg, send) {
     const m = msg;
@@ -2908,7 +3294,7 @@ function createIntentService(options) {
       return;
     }
     const archetype = m.archetype;
-    settle6(
+    settleResolverCall(
       () => resolver.available(archetype),
       send,
       "intent.available.result",
@@ -2919,7 +3305,7 @@ function createIntentService(options) {
   function handleHandlers(msg, send) {
     const m = msg;
     const id = m.id ?? "";
-    settle6(
+    settleResolverCall(
       () => resolver.handlers(),
       send,
       "intent.handlers.result",
@@ -2929,8 +3315,31 @@ function createIntentService(options) {
   }
   return {
     descriptor: INTENT_DESCRIPTOR,
+    onRegistered(context) {
+      try {
+        unsubscribeChanged?.();
+      } catch {
+      }
+      runtimeContext = context;
+      unsubscribeChanged = resolver.onChanged?.((availability) => {
+        const current = runtimeContext;
+        if (!current) return;
+        const message = { type: "intent.changed", availability };
+        for (const windowId of current.listWindowIds()) {
+          current.sendToEligibleNapplet(windowId, message);
+        }
+      });
+    },
+    onUnregistered() {
+      const unsubscribe = unsubscribeChanged;
+      unsubscribeChanged = void 0;
+      runtimeContext = void 0;
+      try {
+        unsubscribe?.();
+      } catch {
+      }
+    },
     handleMessage(windowId, message, send) {
-      windows.set(windowId, send);
       switch (message.type) {
         case "intent.invoke":
           handleInvoke(windowId, message, send);
@@ -2944,9 +3353,6 @@ function createIntentService(options) {
         default:
           return;
       }
-    },
-    onWindowDestroyed(windowId) {
-      windows.delete(windowId);
     }
   };
 }
@@ -2960,91 +3366,126 @@ function candidatesFor(catalog, archetype, defaultHandler) {
     candidates.push({
       dTag: entry.dTag,
       ...entry.title === void 0 ? {} : { title: entry.title },
-      actions: support.actions,
-      protocols: support.protocols,
+      actions: [...support.actions],
+      conventions: [...support.conventions],
+      contracts: support.contracts.map((contract) => ({
+        convention: contract.convention,
+        ...contract.eventKinds === void 0 ? {} : { eventKinds: [...contract.eventKinds] }
+      })),
       ...entry.dTag === defaultHandler ? { isDefault: true } : {}
     });
   }
   return candidates;
 }
-function fail(archetype, action, error) {
-  return { ok: false, archetype, action, handled: false, error };
+function reject(error) {
+  return { ok: false, error };
 }
 function createCatalogIntentResolver(options) {
   if (!options || typeof options.loadCatalog !== "function") {
     throw new Error("createCatalogIntentResolver: options.loadCatalog is required");
   }
-  if (!options.windows || typeof options.windows.open !== "function") {
-    throw new Error("createCatalogIntentResolver: options.windows is required");
+  if (!options.targets || typeof options.targets.retain !== "function") {
+    throw new Error("createCatalogIntentResolver: options.targets is required");
   }
-  const { loadCatalog, windows, getDefaultHandler, chooseHandler, defaultProtocol } = options;
+  const {
+    loadCatalog,
+    targets,
+    getDefaultHandler,
+    chooseHandler,
+    authorizeExplicitHandler
+  } = options;
   const listeners = /* @__PURE__ */ new Set();
   async function availabilityFor(archetype) {
     const catalog = await loadCatalog();
-    const def = getDefaultHandler?.(archetype);
-    const candidates = candidatesFor(catalog, archetype, def);
+    const defaultHandler = getDefaultHandler?.(archetype);
+    const candidates = candidatesFor(catalog, archetype, defaultHandler);
     return {
       archetype,
       available: candidates.length > 0,
       candidates,
-      hasDefault: def !== void 0 && candidates.some((c) => c.dTag === def)
+      hasDefault: defaultHandler !== void 0 && candidates.some((candidate) => candidate.dTag === defaultHandler)
     };
   }
-  async function pickHandler(archetype, candidates, preference, callerWindowId) {
+  async function chooseCompatible(request, candidates, sender) {
+    if (!chooseHandler) {
+      return request.handler === "choose" ? { error: "user cancelled" } : { error: "invoke rejected" };
+    }
+    const picked = await chooseHandler(request.archetype, candidates, sender);
+    if (picked === void 0) return { error: "user cancelled" };
+    const candidate = candidates.find((item) => item.dTag === picked);
+    return candidate ? { candidate } : { error: "invoke rejected" };
+  }
+  async function pickHandler(request, compatible, sender) {
+    const preference = request.handler;
     if (typeof preference === "string" && preference !== "default" && preference !== "choose") {
-      return preference;
+      const candidate = compatible.find((item) => item.dTag === preference);
+      if (!candidate || !authorizeExplicitHandler) return { error: "invoke rejected" };
+      let authorized = false;
+      try {
+        authorized = await authorizeExplicitHandler(sender, preference, request, candidate);
+      } catch {
+        return { error: "invoke rejected" };
+      }
+      return authorized ? { candidate } : { error: "invoke rejected" };
     }
     if (preference === "choose") {
-      const picked = await chooseHandler?.(archetype, candidates, callerWindowId);
-      return picked ?? null;
+      return chooseCompatible(request, compatible, sender);
     }
-    const def = getDefaultHandler?.(archetype);
-    if (def !== void 0 && candidates.some((c) => c.dTag === def)) return def;
-    if (candidates.length === 1) return candidates[0].dTag;
-    if (chooseHandler) {
-      const picked = await chooseHandler(archetype, candidates, callerWindowId);
-      return picked ?? null;
+    const defaultCandidate = compatible.find((candidate) => candidate.isDefault === true);
+    if (preference === "default") {
+      return defaultCandidate ? { candidate: defaultCandidate } : { error: "invoke rejected" };
     }
-    return candidates[0].dTag;
+    if (defaultCandidate) return { candidate: defaultCandidate };
+    if (compatible.length === 1) return { candidate: compatible[0] };
+    return chooseCompatible(request, compatible, sender);
   }
   async function invoke(request, context) {
-    const archetype = request.archetype;
-    const action = request.action ?? "open";
     const catalog = await loadCatalog();
-    const candidates = candidatesFor(catalog, archetype, getDefaultHandler?.(archetype));
-    if (candidates.length === 0) return fail(archetype, action, "no handler");
-    const pickedDTag = await pickHandler(archetype, candidates, request.handler, context.windowId);
-    if (pickedDTag === null) return fail(archetype, action, "user cancelled");
-    const handler = candidates.find((c) => c.dTag === pickedDTag);
-    if (!handler) return fail(archetype, action, "no handler");
-    if (!handler.actions.includes(action)) return fail(archetype, action, "unsupported action");
-    const protocol = request.protocol ?? defaultProtocol?.(archetype) ?? handler.protocols[0];
-    if (protocol !== void 0 && handler.protocols.length > 0 && !handler.protocols.includes(protocol)) {
-      return fail(archetype, action, "unsupported protocol");
+    const defaultHandler = getDefaultHandler?.(request.archetype);
+    const candidates = candidatesFor(catalog, request.archetype, defaultHandler);
+    if (candidates.length === 0) return { result: reject("no handler") };
+    const compatible = candidates.filter((candidate) => candidate.contracts.some((contract) => contract.convention === request.convention));
+    if (compatible.length === 0) return { result: reject("unsupported convention") };
+    const sender = context.sender;
+    if (typeof sender !== "string" || sender.length === 0) {
+      return { result: reject("invoke rejected") };
     }
-    let windowId;
+    const selected = await pickHandler(request, compatible, sender);
+    if ("error" in selected) return { result: reject(selected.error) };
+    const delivery = Object.freeze({
+      sender,
+      archetype: request.archetype,
+      action: request.action,
+      convention: request.convention,
+      ...request.payload === void 0 ? {} : { payload: request.payload }
+    });
+    const behavior = request.behavior === void 0 ? void 0 : Object.freeze({
+      ...request.behavior.focus === void 0 ? {} : { focus: request.behavior.focus },
+      ...request.behavior.reuse === void 0 ? {} : { reuse: request.behavior.reuse }
+    });
+    const params = Object.freeze({
+      handler: selected.candidate.dTag,
+      delivery,
+      ...behavior === void 0 ? {} : { behavior }
+    });
+    let retained;
     try {
-      const opened = await windows.open({
-        dTag: handler.dTag,
-        archetype,
-        action,
-        ...protocol === void 0 ? {} : { protocol },
-        ...request.payload === void 0 ? {} : { payload: request.payload },
-        ...request.behavior === void 0 ? {} : { behavior: request.behavior },
-        callerWindowId: context.windowId
-      });
-      windowId = opened.windowId;
+      retained = await targets.retain(params);
     } catch {
-      return fail(archetype, action, "invoke failed");
+      return { result: reject("invoke rejected") };
+    }
+    if (!retained || typeof retained.start !== "function") {
+      return { result: reject("invoke rejected") };
     }
     return {
-      ok: true,
-      archetype,
-      action,
-      handled: true,
-      handler: handler.dTag,
-      windowId,
-      ...protocol === void 0 ? {} : { protocol }
+      result: {
+        ok: true,
+        archetype: request.archetype,
+        action: request.action,
+        convention: request.convention,
+        handler: selected.candidate.dTag
+      },
+      retained
     };
   }
   async function handlers() {
@@ -3053,7 +3494,7 @@ function createCatalogIntentResolver(options) {
     for (const entry of catalog) {
       for (const slug of Object.keys(entry.archetypes)) archetypes.add(slug);
     }
-    return Promise.all([...archetypes].map((a) => availabilityFor(a)));
+    return Promise.all([...archetypes].map((archetype) => availabilityFor(archetype)));
   }
   return {
     invoke,
@@ -3073,14 +3514,35 @@ function createCatalogIntentResolver(options) {
 }
 
 // src/manifest-intent-catalog.ts
-var DEFAULT_ACTIONS = ["open"];
+function actionFromConvention(slug, convention) {
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
+    throw new TypeError("manifest archetype slug is invalid");
+  }
+  const match = /^napplet:([^/?#\s]+)\/([^/?#\s]+)$/.exec(convention);
+  if (!match || match[1] !== slug) {
+    throw new TypeError("manifest archetype convention is invalid or mismatched");
+  }
+  return match[2];
+}
 function manifestToIntentCatalogEntry(manifest) {
   const archetypes = {};
-  for (const { slug, nap } of manifest.archetypes) {
-    archetypes[slug] = {
-      actions: [...DEFAULT_ACTIONS],
-      protocols: nap ? [nap] : []
+  for (const { slug, convention, eventKinds } of manifest.archetypes) {
+    const action = actionFromConvention(slug, convention);
+    if (eventKinds?.some((kind) => !Number.isSafeInteger(kind) || kind < 0)) {
+      throw new TypeError("manifest archetype event kinds must be unsigned safe integers");
+    }
+    const support = archetypes[slug] ??= {
+      actions: [],
+      conventions: [],
+      contracts: []
+    };
+    const contract = {
+      convention,
+      ...eventKinds === void 0 || eventKinds.length === 0 ? {} : { eventKinds: [...eventKinds] }
     };
+    support.contracts.push(contract);
+    if (!support.actions.includes(action)) support.actions.push(action);
+    if (!support.conventions.includes(convention)) support.conventions.push(convention);
   }
   return {
     dTag: manifest.dTag,
@@ -4569,7 +5031,6 @@ function createCordnDmAdapter(options) {
 }
 export {
   DmMemoryStore,
-  createAudioService,
   createBleService,
   createBrowserMediaBridge,
   createCacheService,