@kehto/services 0.19.0 → 0.20.0

package/dist/index.js

@@ -373,7 +373,7 @@ function createRelayPoolService(options) {
             send({ type: "relay.eose", subId });
           }
         }, EOSE_FALLBACK_MS);
-        const handle = options.subscribe(filters, (item) => {
+        const handle = options.subscribe(filters, (item, observedRelayUrls) => {
           if (item === "EOSE") {
             clearTimeout(eoseTimer);
             if (!eoseSent) {
@@ -382,7 +382,11 @@ function createRelayPoolService(options) {
             }
             return;
           }
-          send({ type: "relay.event", subId, result: createRelayEventResultWithHints(item, relayUrls2) });
+          send({
+            type: "relay.event",
+            subId,
+            result: createRelayEventResultWithHints(item, observedRelayUrls ?? relayUrls2)
+          });
         }, relayUrls2);
         tracked.set(subKey, { handle, eoseTimer });
         return;
@@ -674,14 +678,14 @@ function createCoordinatedRelay(options) {
           }, timeoutMs);
           const relayHint = typeof relayMessage.relay === "string" && relayMessage.relay.length > 0 ? relayMessage.relay : void 0;
           const relayUrls2 = relayHint ? [relayHint] : options.relayPool.selectRelayTier(filters);
-          tracked.relayHandle = options.relayPool.subscribe(filters, (item) => {
+          tracked.relayHandle = options.relayPool.subscribe(filters, (item, observedRelayUrls) => {
             if (item === "EOSE") {
               clearTimeout(tracked.eoseTimer);
               tracked.relayEose = true;
               maybeSendEose(subKey, subId, send);
               return;
             }
-            deliver2(item, relayUrls2);
+            deliver2(item, observedRelayUrls ?? relayUrls2);
             if (cacheAvailable) {
               try {
                 options.cache.store(item);
@@ -1498,47 +1502,117 @@ function createMediaService(options = {}) {
 
 // src/notify-service.ts
 var NOTIFY_SERVICE_VERSION = "1.0.0";
+function errorText(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function forget(result2, onError) {
+  void Promise.resolve(result2).catch((error) => onError?.(error));
+}
 function createNotifyService(options = {}) {
   let counter = 0;
-  const gen = options.generateId ?? (() => {
-    counter += 1;
-    return `shell-${counter}`;
-  });
-  const defaultGrant = options.defaultGrant ?? true;
+  const generateId2 = options.generateId ?? (() => `shell-${++counter}`);
+  const active = /* @__PURE__ */ new Map();
+  const controlsSent = /* @__PURE__ */ new Set();
   const descriptor = {
     name: "notify",
     version: NOTIFY_SERVICE_VERSION,
-    description: "NIP-5D notify NAP reference handler (stub)"
+    description: "NAP-NOTIFY host-backed notification handler"
+  };
+  const pushControls = (windowId, send) => {
+    if (!options.controls || controlsSent.has(windowId)) return;
+    controlsSent.add(windowId);
+    const message = { type: "notify.controls", controls: [...options.controls] };
+    send(message);
+  };
+  const sendNotification = async (windowId, message, send) => {
+    if (!options.present) {
+      const result2 = {
+        type: "notify.send.result",
+        id: message.id,
+        error: "notification presentation unavailable"
+      };
+      send(result2);
+      return;
+    }
+    const notificationId = generateId2();
+    const windowNotifications = active.get(windowId) ?? /* @__PURE__ */ new Set();
+    windowNotifications.add(notificationId);
+    active.set(windowId, windowNotifications);
+    const ownsWindow = () => active.get(windowId) === windowNotifications;
+    const ownsNotification = () => ownsWindow() && windowNotifications.has(notificationId);
+    const emit = (interaction) => {
+      if (!ownsNotification()) return;
+      if (interaction.type === "notify.dismissed") windowNotifications.delete(notificationId);
+      send(interaction);
+    };
+    try {
+      await options.present({ windowId, notificationId, message, emit });
+      if (!ownsWindow()) {
+        if (options.dismiss) forget(options.dismiss(windowId, notificationId), options.onError);
+        return;
+      }
+      const result2 = {
+        type: "notify.send.result",
+        id: message.id,
+        notificationId
+      };
+      send(result2);
+    } catch (error) {
+      if (!ownsWindow()) return;
+      windowNotifications.delete(notificationId);
+      if (windowNotifications.size === 0) active.delete(windowId);
+      const result2 = {
+        type: "notify.send.result",
+        id: message.id,
+        error: errorText(error)
+      };
+      send(result2);
+    }
+  };
+  const requestPermission = async (windowId, message, send) => {
+    let granted = false;
+    try {
+      granted = options.requestPermission ? await options.requestPermission(windowId, message.channel) : false;
+    } catch (error) {
+      options.onError?.(error);
+    }
+    const result2 = {
+      type: "notify.permission.result",
+      id: message.id,
+      granted
+    };
+    send(result2);
   };
   return {
     descriptor,
     handleMessage(windowId, message, send) {
+      pushControls(windowId, send);
       switch (message.type) {
-        case "notify.send": {
-          const m = message;
-          options.onSend?.(windowId, m);
-          const result2 = {
-            type: "notify.send.result",
-            id: m.id,
-            notificationId: gen()
-          };
-          send(result2);
+        case "notify.send":
+          void sendNotification(windowId, message, send);
+          return;
+        case "notify.dismiss": {
+          const notificationId = message.notificationId;
+          const windowNotifications = active.get(windowId);
+          if (!windowNotifications?.delete(notificationId)) return;
+          if (options.dismiss) forget(options.dismiss(windowId, notificationId), options.onError);
+          return;
+        }
+        case "notify.badge": {
+          if (options.setBadge) {
+            const count = Math.max(0, Math.floor(message.count));
+            forget(options.setBadge(windowId, count), options.onError);
+          }
           return;
         }
-        case "notify.dismiss":
-        case "notify.badge":
         case "notify.channel.register":
+          if (options.registerChannel) {
+            forget(options.registerChannel(windowId, message), options.onError);
+          }
           return;
-        case "notify.permission.request": {
-          const m = message;
-          const result2 = {
-            type: "notify.permission.result",
-            id: m.id,
-            granted: defaultGrant
-          };
-          send(result2);
+        case "notify.permission.request":
+          void requestPermission(windowId, message, send);
           return;
-        }
         default: {
           const id = message.id ?? "";
           send({
@@ -1549,7 +1623,16 @@ function createNotifyService(options = {}) {
         }
       }
     },
-    onWindowDestroyed(_windowId) {
+    onWindowDestroyed(windowId) {
+      const windowNotifications = active.get(windowId);
+      active.delete(windowId);
+      controlsSent.delete(windowId);
+      if (options.dismiss && windowNotifications) {
+        for (const notificationId of windowNotifications) {
+          forget(options.dismiss(windowId, notificationId), options.onError);
+        }
+      }
+      if (options.destroyWindow) forget(options.destroyWindow(windowId), options.onError);
     }
   };
 }
@@ -1610,157 +1693,584 @@ function createThemeService(options = {}) {
   return { handler, publishTheme, getCurrentTheme };
 }
 
-// src/config-service.ts
-var CONFIG_SERVICE_VERSION = "1.0.0";
-function validateCoreSubset(schema) {
-  if (typeof schema !== "object" || schema === null || Array.isArray(schema)) {
+// src/config-schema.ts
+var CONFIG_TYPES = /* @__PURE__ */ new Set(["string", "number", "integer", "boolean", "array", "object"]);
+var CONFIG_SCHEMA_KEYS = /* @__PURE__ */ new Set([
+  "$schema",
+  "$version",
+  "type",
+  "properties",
+  "required",
+  "items",
+  "additionalProperties",
+  "default",
+  "title",
+  "description",
+  "enum",
+  "enumDescriptions",
+  "minimum",
+  "maximum",
+  "minLength",
+  "maxLength",
+  "minItems",
+  "maxItems",
+  "format",
+  "deprecationMessage",
+  "markdownDescription"
+]);
+var FORBIDDEN_SCHEMA_KEYS = /* @__PURE__ */ new Set([
+  "$ref",
+  "$defs",
+  "definitions",
+  "pattern",
+  "patternProperties",
+  "propertyNames",
+  "dependencies",
+  "dependentSchemas",
+  "unevaluatedProperties",
+  "oneOf",
+  "anyOf",
+  "allOf",
+  "not",
+  "if",
+  "then",
+  "else"
+]);
+function validateConfigSchema(schema) {
+  if (!isRecord(schema)) {
     return { ok: false, code: "invalid-schema", error: "schema root must be an object" };
   }
-  const s = schema;
-  if ("$ref" in s) {
-    return { ok: false, code: "ref-not-allowed", error: "$ref is not permitted in the Core Subset" };
+  if (schema.type !== "object") {
+    return { ok: false, code: "invalid-schema", error: 'schema root must have type: "object"' };
   }
-  if ("pattern" in s) {
-    return {
-      ok: false,
-      code: "pattern-not-allowed",
-      error: "pattern is not permitted in the Core Subset"
-    };
+  if (schema.$schema !== void 0) {
+    if (typeof schema.$schema !== "string" || !isSupportedSchemaDraft(schema.$schema)) {
+      return { ok: false, code: "unsupported-draft", error: "schema draft is not supported" };
+    }
   }
-  if ("oneOf" in s || "anyOf" in s || "allOf" in s || "not" in s) {
-    return {
-      ok: false,
-      code: "invalid-schema",
-      error: "oneOf/anyOf/allOf/not are not permitted in the Core Subset"
-    };
+  if (schema.$version !== void 0 && (!Number.isSafeInteger(schema.$version) || Number(schema.$version) < 0)) {
+    return { ok: false, code: "invalid-schema", error: "$version must be a non-negative integer" };
   }
-  if ("if" in s || "then" in s || "else" in s) {
-    return {
-      ok: false,
-      code: "invalid-schema",
-      error: "if/then/else are not permitted in the Core Subset"
-    };
+  return validateSchemaNode(schema, 0, "$");
+}
+function validateSchemaNode(schema, depth, path) {
+  if (schema.type === "object" && depth > 4) {
+    return { ok: false, code: "schema-too-deep", error: `${path} exceeds the four-level object depth limit` };
   }
-  if (s.type !== "object") {
-    return { ok: false, code: "invalid-schema", error: 'schema root must have type: "object"' };
+  for (const key of Object.keys(schema)) {
+    if (FORBIDDEN_SCHEMA_KEYS.has(key)) {
+      const code = key === "$ref" || key === "$defs" || key === "definitions" ? "ref-not-allowed" : key === "pattern" ? "pattern-not-allowed" : "invalid-schema";
+      return { ok: false, code, error: `${key} is not permitted in the Core Subset at ${path}` };
+    }
+    if (!CONFIG_SCHEMA_KEYS.has(key) && !key.startsWith("x-napplet-")) {
+      return { ok: false, code: "invalid-schema", error: `${key} is outside the NAP-CONFIG Core Subset at ${path}` };
+    }
+    if (path !== "$" && (key === "$schema" || key === "$version")) {
+      return { ok: false, code: "invalid-schema", error: `${key} is only valid at the schema root` };
+    }
   }
-  const props = s.properties;
-  if (props !== void 0 && (typeof props !== "object" || props === null)) {
-    return { ok: false, code: "invalid-schema", error: "properties must be an object" };
+  if (typeof schema.type !== "string" || !CONFIG_TYPES.has(schema.type)) {
+    return { ok: false, code: "invalid-schema", error: `${path} has an unsupported or missing type` };
   }
-  if (props) {
-    for (const [key, val] of Object.entries(props)) {
-      if (typeof val !== "object" || val === null) {
-        return {
-          ok: false,
-          code: "invalid-schema",
-          error: `property "${key}" must be an object schema`
-        };
-      }
-      const pv = val;
-      const ALLOWED_TYPES = /* @__PURE__ */ new Set(["string", "number", "boolean", "array", "object"]);
-      if (pv.type !== void 0 && !ALLOWED_TYPES.has(pv.type)) {
-        return {
-          ok: false,
-          code: "invalid-schema",
-          error: `property "${key}" must have type: string|number|boolean|array|object`
-        };
-      }
+  if (schema["x-napplet-secret"] === true && Object.hasOwn(schema, "default")) {
+    return { ok: false, code: "secret-with-default", error: `${path} combines x-napplet-secret with default` };
+  }
+  const annotations = validateAnnotations(schema, path);
+  if (!annotations.ok) return annotations;
+  if (schema.type === "object") return validateObjectSchema(schema, depth, path);
+  if (schema.type === "array") {
+    if (!isRecord(schema.items)) {
+      return { ok: false, code: "invalid-schema", error: `${path}.items must be one homogeneous schema` };
+    }
+    const itemType = schema.items.type;
+    if (itemType === "object" || itemType === "array") {
+      return { ok: false, code: "invalid-schema", error: `${path} arrays may contain primitives only` };
+    }
+    const constraints2 = validateScalarConstraints(schema, path);
+    if (!constraints2.ok) return constraints2;
+    const itemValidation = validateSchemaNode(schema.items, depth, `${path}[]`);
+    if (!itemValidation.ok) return itemValidation;
+    return validateDefault(schema, path);
+  }
+  const constraints = validateScalarConstraints(schema, path);
+  if (!constraints.ok) return constraints;
+  return validateDefault(schema, path);
+}
+function validateObjectSchema(schema, depth, path) {
+  const constraints = validateScalarConstraints(schema, path);
+  if (!constraints.ok) return constraints;
+  if (schema.properties !== void 0 && !isRecord(schema.properties)) {
+    return { ok: false, code: "invalid-schema", error: `${path}.properties must be an object` };
+  }
+  if (schema.required !== void 0 && (!Array.isArray(schema.required) || schema.required.some((key) => typeof key !== "string") || new Set(schema.required).size !== schema.required.length)) {
+    return { ok: false, code: "invalid-schema", error: `${path}.required must contain unique strings` };
+  }
+  if (schema.additionalProperties !== void 0 && typeof schema.additionalProperties !== "boolean") {
+    return { ok: false, code: "invalid-schema", error: `${path}.additionalProperties must be boolean` };
+  }
+  const properties = schema.properties ?? {};
+  if (Array.isArray(schema.required) && schema.required.some((key) => !Object.hasOwn(properties, key))) {
+    return { ok: false, code: "invalid-schema", error: `${path}.required references an undeclared property` };
+  }
+  for (const [key, child] of Object.entries(properties)) {
+    if (!isRecord(child)) {
+      return { ok: false, code: "invalid-schema", error: `${path}.${key} must be an object schema` };
+    }
+    const validation = validateSchemaNode(child, child.type === "object" ? depth + 1 : depth, `${path}.${key}`);
+    if (!validation.ok) return validation;
+  }
+  return validateDefault(schema, path);
+}
+function validateScalarConstraints(schema, path) {
+  const numericKeys = schema.type === "number" || schema.type === "integer" ? ["minimum", "maximum"] : [];
+  const countKeys = schema.type === "string" ? ["minLength", "maxLength"] : schema.type === "array" ? ["minItems", "maxItems"] : [];
+  for (const key of ["minimum", "maximum", "minLength", "maxLength", "minItems", "maxItems"]) {
+    if (schema[key] !== void 0 && !numericKeys.includes(key) && !countKeys.includes(key)) {
+      return { ok: false, code: "invalid-schema", error: `${path}.${key} does not apply to ${String(schema.type)}` };
+    }
+  }
+  for (const key of numericKeys) {
+    if (schema[key] !== void 0 && (typeof schema[key] !== "number" || !Number.isFinite(schema[key]))) {
+      return { ok: false, code: "invalid-schema", error: `${path}.${key} must be a finite number` };
+    }
+  }
+  for (const key of countKeys) {
+    if (schema[key] !== void 0 && (!Number.isSafeInteger(schema[key]) || Number(schema[key]) < 0)) {
+      return { ok: false, code: "invalid-schema", error: `${path}.${key} must be a non-negative integer` };
+    }
+  }
+  if (typeof schema.minimum === "number" && typeof schema.maximum === "number" && schema.minimum > schema.maximum) {
+    return { ok: false, code: "invalid-schema", error: `${path}.minimum cannot exceed maximum` };
+  }
+  if (typeof schema.minLength === "number" && typeof schema.maxLength === "number" && schema.minLength > schema.maxLength) {
+    return { ok: false, code: "invalid-schema", error: `${path}.minLength cannot exceed maxLength` };
+  }
+  if (typeof schema.minItems === "number" && typeof schema.maxItems === "number" && schema.minItems > schema.maxItems) {
+    return { ok: false, code: "invalid-schema", error: `${path}.minItems cannot exceed maxItems` };
+  }
+  if (schema.enum !== void 0) {
+    if (!Array.isArray(schema.enum) || schema.enum.length === 0) {
+      return { ok: false, code: "invalid-schema", error: `${path}.enum must be a non-empty array` };
+    }
+    if (schema.enum.some((value) => !isPrimitiveForType(value, String(schema.type)))) {
+      return { ok: false, code: "invalid-schema", error: `${path}.enum contains a value outside its declared type` };
+    }
+    if (new Set(schema.enum.map((value) => JSON.stringify(value))).size !== schema.enum.length) {
+      return { ok: false, code: "invalid-schema", error: `${path}.enum values must be unique` };
     }
   }
   return { ok: true };
 }
-function createConfigService(options) {
-  const subscribers = /* @__PURE__ */ new Map();
-  const descriptor = {
-    name: "config",
-    version: CONFIG_SERVICE_VERSION,
-    description: "NAP-CONFIG reference service \u2014 shell-writes, napplet-reads configuration"
-  };
-  const handler = {
-    descriptor,
-    handleMessage(windowId, message, send) {
-      switch (message.type) {
-        case "config.get": {
-          const m = message;
-          const reply = {
-            type: "config.values",
-            id: m.id,
-            values: options.getValues()
-          };
-          send(reply);
-          return;
-        }
-        case "config.subscribe": {
-          subscribers.set(windowId, send);
-          const push = {
-            type: "config.values",
-            values: options.getValues()
-          };
-          send(push);
-          options.onSubscribe?.(windowId);
-          return;
-        }
-        case "config.unsubscribe": {
-          subscribers.delete(windowId);
-          options.onUnsubscribe?.(windowId);
-          return;
-        }
-        case "config.registerSchema": {
-          const m = message;
-          const validation = options.registerSchema ? options.registerSchema(windowId, m.schema, m.version) : validateCoreSubset(m.schema);
-          const result2 = validation.ok ? { type: "config.registerSchema.result", id: m.id, ok: true } : {
-            type: "config.registerSchema.result",
-            id: m.id,
-            ok: false,
-            code: validation.code,
-            error: validation.error
-          };
-          send(result2);
-          return;
-        }
-        case "config.openSettings": {
-          const m = message;
-          options.openSettings?.(windowId, m.section);
-          return;
-        }
-        default:
-          return;
+function validateAnnotations(schema, path) {
+  for (const key of ["title", "description", "format", "x-napplet-section", "deprecationMessage", "markdownDescription"]) {
+    if (schema[key] !== void 0 && typeof schema[key] !== "string") {
+      return { ok: false, code: "invalid-schema", error: `${path}.${key} must be a string` };
+    }
+  }
+  if (schema["x-napplet-secret"] !== void 0 && typeof schema["x-napplet-secret"] !== "boolean") {
+    return { ok: false, code: "invalid-schema", error: `${path}.x-napplet-secret must be boolean` };
+  }
+  if (schema["x-napplet-secret"] === true && schema.type !== "string") {
+    return { ok: false, code: "invalid-schema", error: `${path}.x-napplet-secret applies only to strings` };
+  }
+  if (schema["x-napplet-order"] !== void 0 && (typeof schema["x-napplet-order"] !== "number" || !Number.isFinite(schema["x-napplet-order"]) || schema["x-napplet-order"] < 0)) {
+    return { ok: false, code: "invalid-schema", error: `${path}.x-napplet-order must be a non-negative number` };
+  }
+  if (schema.enumDescriptions !== void 0 && (!Array.isArray(schema.enumDescriptions) || schema.enumDescriptions.some((value) => typeof value !== "string") || !Array.isArray(schema.enum) || schema.enumDescriptions.length !== schema.enum.length)) {
+    return { ok: false, code: "invalid-schema", error: `${path}.enumDescriptions must parallel enum` };
+  }
+  return { ok: true };
+}
+function validateDefault(schema, path) {
+  if (!Object.hasOwn(schema, "default")) return { ok: true };
+  if (!configValueConforms(schema, schema.default, path === "$")) {
+    return { ok: false, code: "invalid-schema", error: `${path}.default does not validate against its schema` };
+  }
+  return { ok: true };
+}
+function configValuesConform(schema, value) {
+  return configValueConforms(schema, value, true);
+}
+function configValueConforms(schema, value, topLevel) {
+  if (Array.isArray(schema.enum) && !schema.enum.some((item) => Object.is(item, value))) return false;
+  if (schema.type === "string") {
+    return typeof value === "string" && withinLength(value.length, schema.minLength, schema.maxLength);
+  }
+  if (schema.type === "number") {
+    return typeof value === "number" && Number.isFinite(value) && withinLength(value, schema.minimum, schema.maximum);
+  }
+  if (schema.type === "integer") {
+    return Number.isSafeInteger(value) && withinLength(value, schema.minimum, schema.maximum);
+  }
+  if (schema.type === "boolean") return typeof value === "boolean";
+  if (schema.type === "array") {
+    return Array.isArray(value) && isRecord(schema.items) && withinLength(value.length, schema.minItems, schema.maxItems) && value.every((item) => configValueConforms(schema.items, item, false));
+  }
+  if (schema.type === "object") {
+    if (!isRecord(value)) return false;
+    const properties = isRecord(schema.properties) ? schema.properties : {};
+    if (Array.isArray(schema.required) && schema.required.some((key) => typeof key === "string" && !Object.hasOwn(value, key))) {
+      return false;
+    }
+    return Object.entries(value).every(([key, child]) => {
+      const childSchema = properties[key];
+      return isRecord(childSchema) ? configValueConforms(childSchema, child, false) : allowsAdditionalProperties(schema, topLevel) && cloneJsonConfigValue(child) !== void 0;
+    });
+  }
+  return false;
+}
+function allowsAdditionalProperties(schema, topLevel) {
+  return schema.additionalProperties === true || !topLevel && schema.additionalProperties === void 0;
+}
+function isPrimitiveForType(value, type) {
+  if (type === "string") return typeof value === "string";
+  if (type === "number") return typeof value === "number" && Number.isFinite(value);
+  if (type === "integer") return Number.isSafeInteger(value);
+  if (type === "boolean") return typeof value === "boolean";
+  return false;
+}
+function isSupportedSchemaDraft(value) {
+  return /^https?:\/\/json-schema\.org\/(?:draft-0?7\/schema#?|draft\/2019-09\/schema#?|draft\/2020-12\/schema#?)$/u.test(value);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function resolveConfigValues(schema, values) {
+  return resolveObjectValues(schema, isRecord(values) ? values : {}, {}, true);
+}
+function resolveObjectValues(schema, input, inheritedDefault, topLevel) {
+  const output = {};
+  const ownDefault = isRecord(schema.default) ? schema.default : {};
+  const defaults = { ...inheritedDefault, ...ownDefault };
+  for (const [key, childValue] of Object.entries(schema.properties ?? {})) {
+    if (!isRecord(childValue)) continue;
+    const candidate = Object.hasOwn(input, key) ? input[key] : defaults[key];
+    const resolved = resolveConfigValue(childValue, candidate);
+    if (resolved !== void 0) setConfigValue(output, key, resolved);
+  }
+  if (allowsAdditionalProperties(schema, topLevel)) {
+    const properties = isRecord(schema.properties) ? schema.properties : {};
+    for (const [key, candidate] of Object.entries({ ...defaults, ...input })) {
+      if (Object.hasOwn(properties, key)) continue;
+      const resolved = cloneJsonConfigValue(candidate);
+      if (resolved !== void 0) setConfigValue(output, key, resolved);
+    }
+  }
+  return output;
+}
+function resolveConfigValue(schema, candidate) {
+  const value = candidate === void 0 ? schema.default : candidate;
+  if (value === void 0) return void 0;
+  const resolved = resolveTypedConfigValue(schema, value);
+  if (resolved !== void 0) return resolved;
+  return candidate !== void 0 && schema.default !== void 0 ? resolveTypedConfigValue(schema, schema.default) : void 0;
+}
+function resolveTypedConfigValue(schema, value) {
+  if (schema.enum && Array.isArray(schema.enum) && !schema.enum.some((item) => Object.is(item, value))) return void 0;
+  switch (schema.type) {
+    case "object": {
+      if (!isRecord(value)) return void 0;
+      const resolved = resolveObjectValues(schema, value, {}, false);
+      return Array.isArray(schema.required) && schema.required.some((key) => typeof key === "string" && !Object.hasOwn(resolved, key)) ? void 0 : resolved;
+    }
+    case "array": {
+      if (!Array.isArray(value) || !isRecord(schema.items) || !withinLength(value.length, schema.minItems, schema.maxItems)) {
+        return void 0;
       }
-    },
-    onWindowDestroyed(windowId) {
-      subscribers.delete(windowId);
+      const resolved = value.map((item) => resolveConfigValue(schema.items, item));
+      if (resolved.some((item) => item === void 0)) return void 0;
+      return resolved;
     }
-  };
-  function publishValues(values) {
-    const envelope = {
+    case "string":
+      return typeof value === "string" && withinLength(value.length, schema.minLength, schema.maxLength) ? value : void 0;
+    case "number":
+      return typeof value === "number" && Number.isFinite(value) && withinLength(value, schema.minimum, schema.maximum) ? value : void 0;
+    case "integer":
+      return Number.isSafeInteger(value) && withinLength(value, schema.minimum, schema.maximum) ? value : void 0;
+    case "boolean":
+      return typeof value === "boolean" ? value : void 0;
+    default:
+      return void 0;
+  }
+}
+function cloneJsonConfigValue(value, seen = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+  if (typeof value !== "object" || seen.has(value)) return void 0;
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      const output = value.map((item) => cloneJsonConfigValue(item, seen));
+      return output.some((item) => item === void 0) ? void 0 : output;
+    }
+    const entries = [];
+    for (const [key, child] of Object.entries(value)) {
+      const resolved = cloneJsonConfigValue(child, seen);
+      if (resolved === void 0) return void 0;
+      entries.push([key, resolved]);
+    }
+    return Object.fromEntries(entries);
+  } finally {
+    seen.delete(value);
+  }
+}
+function setConfigValue(output, key, value) {
+  Object.defineProperty(output, key, { value, enumerable: true, configurable: true, writable: true });
+}
+function withinLength(value, minimum, maximum) {
+  return (typeof minimum !== "number" || value >= minimum) && (typeof maximum !== "number" || value <= maximum);
+}
+
+// src/config-service.ts
+var CONFIG_SERVICE_VERSION = "1.0.0";
+function createConfigService(options) {
+  return new ConfigServiceController(options);
+}
+var ConfigServiceController = class {
+  constructor(options) {
+    this.options = options;
+    this.handler = {
+      descriptor: {
+        name: "config",
+        version: CONFIG_SERVICE_VERSION,
+        description: "NAP-CONFIG reference service \u2014 shell-writes, napplet-reads configuration"
+      },
+      handleMessage: (windowId, message, send) => this.handleMessage(windowId, message, send),
+      onWindowDestroyed: (windowId) => this.destroyWindow(windowId)
+    };
+  }
+  options;
+  subscribers = /* @__PURE__ */ new Map();
+  schemas = /* @__PURE__ */ new Map();
+  handler;
+  getSchema(windowId) {
+    const schema = this.schemas.get(windowId)?.schema;
+    return schema ? structuredClone(schema) : null;
+  }
+  getValues(windowId) {
+    const schema = this.schemas.get(windowId)?.schema;
+    if (!schema) return null;
+    const values = resolveConfigValues(schema, this.options.getValues(windowId));
+    return configValuesConform(schema, values) ? values : null;
+  }
+  publishValues(values, windowId) {
+    if (windowId) {
+      this.publishWindowValues(windowId, values);
+      return;
+    }
+    for (const target of this.subscribers.keys()) this.publishWindowValues(target, values);
+  }
+  handleMessage(windowId, message, send) {
+    switch (message.type) {
+      case "config.get":
+        this.handleGet(windowId, message, send);
+        return;
+      case "config.subscribe":
+        this.handleSubscribe(windowId, send);
+        return;
+      case "config.unsubscribe":
+        this.subscribers.delete(windowId);
+        this.options.onUnsubscribe?.(windowId);
+        return;
+      case "config.registerSchema":
+        this.handleRegisterSchema(windowId, message, send);
+        return;
+      case "config.openSettings":
+        this.handleOpenSettings(windowId, message, send);
+        return;
+      default:
+        return;
+    }
+  }
+  handleGet(windowId, message, send) {
+    const values = this.readValues(windowId, send);
+    if (values === void 0) return;
+    if (!values) {
+      this.sendValuesUnavailable(send, windowId);
+      return;
+    }
+    const reply = {
       type: "config.values",
+      id: message.id,
       values
     };
-    for (const send of subscribers.values()) {
-      try {
-        send(envelope);
-      } catch {
-      }
+    send(reply);
+  }
+  handleSubscribe(windowId, send) {
+    this.subscribers.set(windowId, send);
+    const values = this.readValues(windowId, send);
+    if (values === void 0) return;
+    if (!values) {
+      this.sendValuesUnavailable(send, windowId);
+      return;
     }
+    send({ type: "config.values", values });
+    this.options.onSubscribe?.(windowId);
+  }
+  handleRegisterSchema(windowId, message, send) {
+    const nextVersion = message.version ?? readSchemaVersion(message.schema);
+    let validation = this.validateRegistration(windowId, message, nextVersion);
+    if (validation.ok) validation = this.persistRegisteredSchema(windowId, message.schema, nextVersion);
+    const result2 = validation.ok ? { type: "config.registerSchema.result", id: message.id, ok: true } : {
+      type: "config.registerSchema.result",
+      id: message.id,
+      ok: false,
+      code: validation.code,
+      error: validation.error
+    };
+    send(result2);
+    if (validation.ok) this.publishWindowValues(windowId);
   }
-  return { handler, publishValues };
+  validateRegistration(windowId, message, nextVersion) {
+    let validation = validateConfigSchema(message.schema);
+    if (validation.ok && message.version !== void 0 && (!Number.isSafeInteger(message.version) || message.version < 0)) {
+      validation = { ok: false, code: "invalid-schema", error: "version must be a non-negative integer" };
+    }
+    const priorVersion = this.schemas.get(windowId)?.version;
+    if (validation.ok && priorVersion !== void 0 && nextVersion !== void 0 && nextVersion < priorVersion) {
+      validation = { ok: false, code: "version-conflict", error: "schema version cannot move backwards" };
+    }
+    if (!validation.ok || !this.options.registerSchema) return validation;
+    try {
+      return this.options.registerSchema(windowId, message.schema, message.version);
+    } catch (cause) {
+      return {
+        ok: false,
+        code: "invalid-schema",
+        error: cause instanceof Error ? cause.message : "host schema policy failed"
+      };
+    }
+  }
+  persistRegisteredSchema(windowId, schema, version) {
+    try {
+      const resolved = resolveConfigValues(schema, this.options.getValues(windowId));
+      this.options.saveValues?.(windowId, resolved);
+      this.schemas.set(windowId, {
+        schema: structuredClone(schema),
+        ...version !== void 0 ? { version } : {}
+      });
+      return { ok: true };
+    } catch (cause) {
+      return {
+        ok: false,
+        code: "invalid-schema",
+        error: cause instanceof Error ? cause.message : "host configuration persistence failed"
+      };
+    }
+  }
+  handleOpenSettings(windowId, message, send) {
+    const record = this.schemas.get(windowId);
+    if (!record) {
+      sendSchemaError(send, "no-schema", "no configuration schema is registered");
+      return;
+    }
+    let values;
+    try {
+      values = resolveConfigValues(record.schema, this.options.getValues(windowId));
+    } catch (cause) {
+      sendSchemaError(
+        send,
+        "invalid-schema",
+        cause instanceof Error ? cause.message : "host configuration read failed"
+      );
+      return;
+    }
+    const section = message.section && schemaHasSection(record.schema, message.section) ? message.section : void 0;
+    this.options.openSettings?.(windowId, section, {
+      schema: structuredClone(record.schema),
+      values,
+      commit: (next) => this.commitValues(windowId, next)
+    });
+  }
+  commitValues(windowId, values) {
+    const schema = this.schemas.get(windowId)?.schema;
+    if (!schema) throw new Error("no configuration schema is registered");
+    const resolved = resolveConfigValues(schema, values);
+    if (!configValuesConform(schema, resolved)) {
+      throw new Error("required configuration values are missing or invalid");
+    }
+    this.options.saveValues?.(windowId, resolved);
+    this.publishWindowValues(windowId, resolved);
+    return resolved;
+  }
+  publishWindowValues(windowId, supplied) {
+    const send = this.subscribers.get(windowId);
+    const schema = this.schemas.get(windowId)?.schema;
+    if (!send || !schema) return;
+    const values = supplied ? resolveConfigValues(schema, supplied) : this.getValues(windowId);
+    if (!values || !configValuesConform(schema, values)) return;
+    try {
+      send({ type: "config.values", values });
+    } catch {
+      this.subscribers.delete(windowId);
+    }
+  }
+  readValues(windowId, send) {
+    try {
+      return this.getValues(windowId);
+    } catch (cause) {
+      sendSchemaError(
+        send,
+        "invalid-schema",
+        cause instanceof Error ? cause.message : "host configuration read failed"
+      );
+      return void 0;
+    }
+  }
+  sendValuesUnavailable(send, windowId) {
+    if (!this.schemas.has(windowId)) {
+      sendSchemaError(send, "no-schema", "no configuration schema is registered");
+      return;
+    }
+    sendSchemaError(send, "invalid-schema", "configuration requires valid values before delivery");
+  }
+  destroyWindow(windowId) {
+    this.subscribers.delete(windowId);
+    this.schemas.delete(windowId);
+    this.options.onWindowDestroyed?.(windowId);
+  }
+};
+function sendSchemaError(send, code, error) {
+  send({ type: "config.schemaError", code, error });
+}
+function readSchemaVersion(schema) {
+  const version = schema.$version;
+  return Number.isSafeInteger(version) && Number(version) >= 0 ? Number(version) : void 0;
+}
+function schemaHasSection(schema, section) {
+  const properties = schema.properties;
+  if (!isRecord2(properties)) return false;
+  for (const child of Object.values(properties)) {
+    if (!isRecord2(child)) continue;
+    if (child["x-napplet-section"] === section) return true;
+    if (child.type === "object" && schemaHasSection(child, section)) return true;
+  }
+  return false;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/resource-service.ts
 var RESOURCE_SERVICE_VERSION = "1.0.0";
-function arrayBufferToBase64(buf) {
-  const bytes = new Uint8Array(buf);
-  const CHUNK = 32768;
-  let binary = "";
-  for (let i = 0; i < bytes.length; i += CHUNK) {
-    binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
-  }
-  return btoa(binary);
-}
+var ResourceServiceError = class extends Error {
+  /**
+   * @param code - Canonical NAP-RESOURCE error code.
+   * @param message - Diagnostic detail safe to return to the napplet.
+   */
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ResourceServiceError";
+  }
+  code;
+};
 var DEFAULT_RESOURCE_INFO = {
-  schemes: [{ scheme: "https", enabled: true }]
+  schemes: []
 };
+function requestKey(windowId, requestId) {
+  return `${windowId}\0${requestId}`;
+}
 function assertResourceOptions(options) {
   if (typeof options?.fetch !== "function" || typeof options?.isOriginGranted !== "function" || typeof options?.getConnectGrants !== "function" || typeof options?.resolveIdentity !== "function") {
     throw new Error(
@@ -1769,43 +2279,31 @@ function assertResourceOptions(options) {
   }
 }
 function trackRequest(state, requestId, windowId, controller) {
-  state.inFlight.set(requestId, { controller, windowId });
+  const key = requestKey(windowId, requestId);
+  state.inFlight.set(key, { controller, windowId, requestId });
   if (!state.perWindow.has(windowId)) {
     state.perWindow.set(windowId, /* @__PURE__ */ new Set());
   }
-  state.perWindow.get(windowId).add(requestId);
+  state.perWindow.get(windowId).add(key);
 }
-function untrackRequest(state, requestId) {
-  const entry = state.inFlight.get(requestId);
+function untrackRequest(state, windowId, requestId) {
+  const key = requestKey(windowId, requestId);
+  const entry = state.inFlight.get(key);
   if (entry) {
-    state.inFlight.delete(requestId);
-    state.perWindow.get(entry.windowId)?.delete(requestId);
+    state.inFlight.delete(key);
+    state.perWindow.get(entry.windowId)?.delete(key);
   }
 }
-function sendResourceError(send, requestId, code, message, error = toResourceError(code), type = "resource.bytes.error") {
+function sendResourceError(send, requestId, message, error, type = "resource.bytes.error") {
   send({
     type,
     id: requestId,
-    requestId,
     error,
-    code,
     message
   });
 }
-function sendBytesManyError(send, requestId, code, message, error) {
-  sendResourceError(send, requestId, code, message, error, "resource.bytesMany.error");
-}
-function toResourceError(code) {
-  switch (code) {
-    case "denied":
-      return "blocked-by-policy";
-    case "invalid-url":
-      return "invalid-request";
-    case "canceled":
-      return "timeout";
-    case "network-error":
-      return "network-error";
-  }
+function sendBytesManyError(send, requestId, message, error) {
+  sendResourceError(send, requestId, message, error, "resource.bytesMany.error");
 }
 function parseResourceUrl(url) {
   try {
@@ -1814,15 +2312,8 @@ function parseResourceUrl(url) {
     return null;
   }
 }
-function collectResponseHeaders(response) {
-  const headers = {};
-  response.headers.forEach((value, key) => {
-    headers[key] = value;
-  });
-  return headers;
-}
 function responseMime(response) {
-  return response.headers.get("content-type") || "application/octet-stream";
+  return response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() || "application/octet-stream";
 }
 function responseBlob(buffer, mime) {
   return new Blob([buffer], { type: mime });
@@ -1866,13 +2357,22 @@ function resourceInvalidRequest(url, message) {
     ok: false,
     url,
     error: "invalid-request",
-    code: "invalid-url",
     message
   };
 }
-async function fetchResourceItem(options, identity, url, init, signal) {
+function classifyResourceFailure(error) {
+  return {
+    error: error instanceof ResourceServiceError ? error.code : "network-error",
+    message: error instanceof Error ? error.message : String(error)
+  };
+}
+async function fetchResourceItem(options, identity, info, url, signal) {
   const parsedUrl = parseResourceUrl(url);
   if (!parsedUrl) return resourceInvalidRequest(url, `invalid URL: ${url}`);
+  const scheme = parsedUrl.protocol.slice(0, -1).toLowerCase();
+  if (!info.schemes.some((item) => item.enabled && item.scheme.toLowerCase() === scheme)) {
+    return { ok: false, url, error: "unsupported-scheme", message: `scheme ${scheme} is not enabled` };
+  }
   const origin = parsedUrl.origin;
   const grants = options.getConnectGrants(identity.dTag, identity.aggregateHash);
   if (!options.isOriginGranted(origin, grants)) {
@@ -1880,77 +2380,88 @@ async function fetchResourceItem(options, identity, url, init, signal) {
       ok: false,
       url,
       error: "blocked-by-policy",
-      code: "denied",
       message: `origin ${origin} not granted`
     };
   }
   try {
     const response = await options.fetch(url, {
-      method: init?.method,
-      headers: init?.headers ? { ...init.headers } : void 0,
+      method: "GET",
       signal
     });
     const buffer = await response.arrayBuffer();
-    const headers = collectResponseHeaders(response);
+    if (info.maxBytes !== void 0 && buffer.byteLength > info.maxBytes) {
+      return { ok: false, url, error: "too-large", message: `resource exceeds ${info.maxBytes} bytes` };
+    }
     const mime = responseMime(response);
     return {
       ok: true,
       url,
       blob: responseBlob(buffer, mime),
-      mime,
-      status: response.status,
-      headers,
-      bodyBase64: arrayBufferToBase64(buffer)
+      mime
     };
   } catch (err2) {
     const isAbort = signal.aborted || err2 instanceof Error && (err2.name === "AbortError" || err2.name === "DOMException");
     return {
       ok: false,
       url,
-      error: isAbort ? "timeout" : "network-error",
-      code: isAbort ? "canceled" : "network-error",
+      error: isAbort ? "timeout" : err2 instanceof ResourceServiceError ? err2.code : "network-error",
       message: err2 instanceof Error ? err2.message : String(err2)
     };
   }
 }
 async function handleBytes(options, state, windowId, msg, send) {
-  const { requestId, url, init } = msg;
+  const { requestId, url } = msg;
   const identity = options.resolveIdentity(windowId);
   if (!identity) {
-    sendResourceError(send, requestId, "denied", "napplet identity not resolvable", "blocked-by-policy");
+    sendResourceError(send, requestId, "napplet identity not resolvable", "blocked-by-policy");
     return;
   }
   const controller = new AbortController();
   trackRequest(state, requestId, windowId, controller);
   try {
-    const item = await fetchResourceItem(options, identity, url, init, controller.signal);
+    const info = await resolveResourceInfo(options, windowId);
+    const item = await fetchResourceItem(options, identity, info, url, controller.signal);
+    if (controller.signal.aborted) return;
     if (!item.ok) {
-      sendResourceError(send, requestId, item.code, item.message, item.error);
+      sendResourceError(send, requestId, item.message, item.error);
       return;
     }
     send({
       type: "resource.bytes.result",
       id: requestId,
-      requestId,
       blob: item.blob,
-      mime: item.mime,
-      status: item.status,
-      headers: item.headers,
-      bodyBase64: item.bodyBase64
+      mime: item.mime
     });
+  } catch (error) {
+    if (!controller.signal.aborted) {
+      const failure = classifyResourceFailure(error);
+      sendResourceError(send, requestId, failure.message, failure.error);
+    }
   } finally {
-    untrackRequest(state, requestId);
+    untrackRequest(state, windowId, requestId);
   }
 }
 async function handleBytesMany(options, state, windowId, msg, send) {
-  const { requestId, urls, init } = msg;
+  const { requestId, urls } = msg;
   if (!Array.isArray(urls) || urls.length === 0 || urls.some((url) => typeof url !== "string")) {
-    sendBytesManyError(send, requestId, "invalid-url", "resource.bytesMany requires a non-empty urls array", "invalid-request");
+    sendBytesManyError(send, requestId, "resource.bytesMany requires a non-empty urls array", "invalid-request");
     return;
   }
   const identity = options.resolveIdentity(windowId);
   if (!identity) {
-    sendBytesManyError(send, requestId, "denied", "napplet identity not resolvable", "blocked-by-policy");
+    sendBytesManyError(send, requestId, "napplet identity not resolvable", "blocked-by-policy");
+    return;
+  }
+  let info;
+  try {
+    info = await resolveResourceInfo(options, windowId);
+  } catch (error) {
+    const failure = classifyResourceFailure(error);
+    sendBytesManyError(send, requestId, failure.message, failure.error);
+    return;
+  }
+  if (info.maxUrls !== void 0 && urls.length > info.maxUrls) {
+    sendBytesManyError(send, requestId, `resource.bytesMany exceeds ${info.maxUrls} URLs`, "too-large");
     return;
   }
   const controller = new AbortController();
@@ -1958,7 +2469,8 @@ async function handleBytesMany(options, state, windowId, msg, send) {
   try {
     const items = [];
     for (const url of urls) {
-      const item = await fetchResourceItem(options, identity, url, init, controller.signal);
+      const item = await fetchResourceItem(options, identity, info, url, controller.signal);
+      if (controller.signal.aborted) return;
       if (item.ok) {
         items.push({
           url: item.url,
@@ -1971,7 +2483,6 @@ async function handleBytesMany(options, state, windowId, msg, send) {
           url: item.url,
           ok: false,
           error: item.error,
-          code: item.code,
           message: item.message
         });
       }
@@ -1979,15 +2490,19 @@ async function handleBytesMany(options, state, windowId, msg, send) {
     send({
       type: "resource.bytesMany.result",
       id: requestId,
-      requestId,
       items
     });
+  } catch (error) {
+    if (!controller.signal.aborted) {
+      const failure = classifyResourceFailure(error);
+      sendBytesManyError(send, requestId, failure.message, failure.error);
+    }
   } finally {
-    untrackRequest(state, requestId);
+    untrackRequest(state, windowId, requestId);
   }
 }
-function handleCancel(state, requestId) {
-  const entry = state.inFlight.get(requestId);
+function handleCancel(state, windowId, requestId) {
+  const entry = state.inFlight.get(requestKey(windowId, requestId));
   if (entry) {
     entry.controller.abort();
   }
@@ -1995,11 +2510,11 @@ function handleCancel(state, requestId) {
 function destroyWindowRequests(state, windowId) {
   const requestIds = state.perWindow.get(windowId);
   if (!requestIds) return;
-  for (const requestId of requestIds) {
-    const entry = state.inFlight.get(requestId);
+  for (const key of requestIds) {
+    const entry = state.inFlight.get(key);
     if (entry) {
       entry.controller.abort();
-      state.inFlight.delete(requestId);
+      state.inFlight.delete(key);
     }
   }
   state.perWindow.delete(windowId);
@@ -2022,8 +2537,12 @@ function createResourceService(options) {
         case "resource.bytes": {
           const m = message;
           const requestId = requestIdFromMessage(m);
-          if (!requestId || typeof m.url !== "string") return;
-          handleBytes(options, state, windowId, { requestId, url: m.url, init: m.init }, send).catch(() => {
+          if (!requestId) return;
+          if (typeof m.url !== "string") {
+            sendResourceError(send, requestId, "resource.bytes requires a URL", "invalid-request");
+            return;
+          }
+          handleBytes(options, state, windowId, { requestId, url: m.url }, send).catch(() => {
           });
           return;
         }
@@ -2039,14 +2558,14 @@ function createResourceService(options) {
           const m = message;
           const requestId = requestIdFromMessage(m);
           if (!requestId) return;
-          handleBytesMany(options, state, windowId, { requestId, urls: m.urls ?? [], init: m.init }, send).catch(() => {
+          handleBytesMany(options, state, windowId, { requestId, urls: m.urls ?? [] }, send).catch(() => {
           });
           return;
         }
         case "resource.cancel": {
           const m = message;
           const requestId = requestIdFromMessage(m);
-          if (requestId) handleCancel(state, requestId);
+          if (requestId) handleCancel(state, windowId, requestId);
           return;
         }
         default:
@@ -2067,7 +2586,7 @@ var OUTBOX_DESCRIPTOR = {
   version: OUTBOX_SERVICE_VERSION,
   description: "NAP-OUTBOX outbox-aware relay routing \u2014 getEvent/query/subscribe/publish/resolveRelays"
 };
-function isRecord(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null;
 }
 function stringArray(value) {
@@ -2079,7 +2598,7 @@ function uint(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
 }
 function sanitizeEventOptions(raw) {
-  if (!isRecord(raw)) return void 0;
+  if (!isRecord3(raw)) return void 0;
   const out = {};
   if (typeof raw.author === "string") out.author = raw.author;
   const relays = stringArray(raw.relays);
@@ -2089,7 +2608,7 @@ function sanitizeEventOptions(raw) {
   return Object.keys(out).length > 0 ? out : void 0;
 }
 function sanitizeQueryOptions(raw) {
-  if (!isRecord(raw)) return void 0;
+  if (!isRecord3(raw)) return void 0;
   const out = {};
   const authors = stringArray(raw.authors);
   if (authors) out.authors = authors;
@@ -2103,7 +2622,7 @@ function sanitizeQueryOptions(raw) {
 }
 var sanitizeSubscribeOptions = sanitizeQueryOptions;
 function sanitizePublishOptions(raw) {
-  if (!isRecord(raw)) return void 0;
+  if (!isRecord3(raw)) return void 0;
   const out = {};
   const relays = stringArray(raw.relays);
   if (relays) out.relays = relays;
@@ -2113,7 +2632,7 @@ function sanitizePublishOptions(raw) {
   return Object.keys(out).length > 0 ? out : void 0;
 }
 function sanitizeTarget(raw) {
-  if (!isRecord(raw)) return void 0;
+  if (!isRecord3(raw)) return void 0;
   const out = {};
   const authors = stringArray(raw.authors);
   if (authors) out.authors = authors;
@@ -2775,7 +3294,7 @@ function createRelayPoolOutboxRouter(options) {
   if (!Array.isArray(options.fallbackRelays)) {
     throw new Error("createRelayPoolOutboxRouter: options.fallbackRelays is required");
   }
-  const verifyEvent = options.verifyEvent;
+  const verifyEvent2 = options.verifyEvent;
   const ctx = {
     relayPool: options.relayPool,
     loadRelayLists: options.loadRelayLists,
@@ -2784,9 +3303,9 @@ function createRelayPoolOutboxRouter(options) {
     isRelayAllowed: options.isRelayAllowed ?? defaultRelayAllowed,
     defaultTimeoutMs: options.defaultTimeoutMs ?? DEFAULT_QUERY_TIMEOUT_MS,
     async verify(event) {
-      if (!verifyEvent) return true;
+      if (!verifyEvent2) return true;
       try {
-        return await verifyEvent(event);
+        return await verifyEvent2(event);
       } catch {
         return false;
       }
@@ -3655,11 +4174,18 @@ function createCvmService(options) {
       sendByWindow.delete(windowId);
       for (const [pubkey, windows] of windowsByServer) {
         windows.delete(windowId);
-        if (windows.size === 0) windowsByServer.delete(pubkey);
+        if (windows.size === 0) {
+          windowsByServer.delete(pubkey);
+          void transport.close({ pubkey }).catch(() => {
+          });
+        }
       }
     },
     dispose() {
       eventSub.close();
+      transport.dispose?.();
+      sendByWindow.clear();
+      windowsByServer.clear();
     }
   };
 }
@@ -3848,35 +4374,102 @@ function unsupported(resultType, id) {
     error: `${resultType.replace(".result", "")} unavailable`
   };
 }
+function createContext(windowId, emit) {
+  return {
+    windowId,
+    emit
+  };
+}
 function createSerialService(options = {}) {
+  const windows = /* @__PURE__ */ new Map();
+  const currentWindow = (windowId) => {
+    const existing = windows.get(windowId);
+    if (existing) return existing;
+    const record = {
+      connections: /* @__PURE__ */ new Map(),
+      pendingConnections: /* @__PURE__ */ new Set()
+    };
+    windows.set(windowId, record);
+    return record;
+  };
+  const emit = (windowId, record, connection, send, event) => {
+    if (!connection || windows.get(windowId) !== record || connection.state === "closed") return;
+    if (connection.state === "opening") {
+      connection.bufferedEvents.push(event);
+      return;
+    }
+    send({ type: "serial.event", event });
+  };
   return {
     descriptor: SERIAL_DESCRIPTOR,
     handleMessage(windowId, message, send) {
       const id = message.id ?? "";
-      const context = { windowId };
+      const record = currentWindow(windowId);
+      const isCurrent = () => windows.get(windowId) === record;
+      const currentSend = (outbound) => {
+        if (isCurrent()) send(outbound);
+      };
       if (message.type === "serial.open") {
         if (!options.open) {
-          send(unsupported("serial.open.result", id));
+          currentSend(unsupported("serial.open.result", id));
           return;
         }
         const serialMessage = message;
-        settle2(
-          () => options.open(serialMessage.request, context),
-          send,
-          (error) => ({ type: "serial.open.result", id, error }),
-          (result2) => ({ type: "serial.open.result", id, session: result2.session })
-        );
+        const connection = { state: "opening", bufferedEvents: [] };
+        record.pendingConnections.add(connection);
+        const context = createContext(windowId, (event) => emit(windowId, record, connection, currentSend, event));
+        let pending;
+        try {
+          pending = Promise.resolve(options.open(serialMessage.request, context));
+        } catch (error) {
+          record.pendingConnections.delete(connection);
+          connection.state = "closed";
+          currentSend({
+            type: "serial.open.result",
+            id,
+            error: errorMessage2(error, "serial request failed")
+          });
+          return;
+        }
+        void pending.then((result2) => {
+          record.pendingConnections.delete(connection);
+          if (!isCurrent() || connection.state === "closed") return;
+          connection.state = "open";
+          record.connections.set(result2.session.id, connection);
+          currentSend({ type: "serial.open.result", id, session: result2.session });
+          if (!isCurrent() || connection.state !== "open") return;
+          for (const event of connection.bufferedEvents) {
+            if (!isCurrent() || connection.state !== "open") break;
+            currentSend({ type: "serial.event", event });
+          }
+          connection.bufferedEvents.length = 0;
+        }).catch((error) => {
+          record.pendingConnections.delete(connection);
+          connection.state = "closed";
+          currentSend({
+            type: "serial.open.result",
+            id,
+            error: errorMessage2(error, "serial request failed")
+          });
+        });
         return;
       }
       if (message.type === "serial.write") {
         if (!options.write) {
-          send(unsupported("serial.write.result", id));
+          currentSend(unsupported("serial.write.result", id));
           return;
         }
         const serialMessage = message;
+        const context = createContext(windowId, (event) => emit(
+          windowId,
+          record,
+          record.connections.get(serialMessage.sessionId),
+          currentSend,
+          event
+        ));
         settle2(
           () => options.write(serialMessage.sessionId, serialMessage.data, context),
-          send,
+          currentSend,
           (error) => ({ type: "serial.write.result", id, error }),
           () => ({ type: "serial.write.result", id })
         );
@@ -3884,25 +4477,45 @@ function createSerialService(options = {}) {
       }
       if (message.type === "serial.close") {
         if (!options.close) {
-          send(unsupported("serial.close.result", id));
+          currentSend(unsupported("serial.close.result", id));
           return;
         }
         const serialMessage = message;
+        const connection = record.connections.get(serialMessage.sessionId);
+        if (connection) {
+          connection.state = "closed";
+          record.connections.delete(serialMessage.sessionId);
+        }
+        const context = createContext(windowId, (event) => emit(
+          windowId,
+          record,
+          connection,
+          currentSend,
+          event
+        ));
         settle2(
           () => options.close(serialMessage.sessionId, serialMessage.reason, context),
-          send,
+          currentSend,
           (error) => ({ type: "serial.close.result", id, error }),
           () => ({ type: "serial.close.result", id })
         );
         return;
       }
-      send({
+      currentSend({
         type: `${message.type}.error`,
         id,
         error: `Unknown serial method: ${message.type}`
       });
     },
     onWindowDestroyed(windowId) {
+      const record = windows.get(windowId);
+      if (record) {
+        for (const connection of record.connections.values()) connection.state = "closed";
+        for (const connection of record.pendingConnections) connection.state = "closed";
+        record.connections.clear();
+        record.pendingConnections.clear();
+        windows.delete(windowId);
+      }
       options.destroyWindow?.(windowId);
     }
   };
@@ -3937,7 +4550,7 @@ function unsupported2(resultType, id) {
     error: `${resultType.replace(".result", "")} unavailable`
   };
 }
-function createContext(windowId, send) {
+function createContext2(windowId, send) {
   return {
     windowId,
     emit(event) {
@@ -3950,7 +4563,7 @@ function createBleService(options = {}) {
     descriptor: BLE_DESCRIPTOR,
     handleMessage(windowId, message, send) {
       const id = message.id ?? "";
-      const context = createContext(windowId, send);
+      const context = createContext2(windowId, send);
       if (message.type === "ble.open") {
         if (!options.open) {
           send(unsupported2("ble.open.result", id));
@@ -4090,7 +4703,7 @@ function unsupported3(resultType, id) {
     error: `${resultType.replace(".result", "")} unavailable`
   };
 }
-function createContext2(windowId, send) {
+function createContext3(windowId, send) {
   return {
     windowId,
     emit(event) {
@@ -4103,7 +4716,7 @@ function createWebrtcService(options = {}) {
     descriptor: WEBRTC_DESCRIPTOR,
     handleMessage(windowId, message, send) {
       const id = message.id ?? "";
-      const context = createContext2(windowId, send);
+      const context = createContext3(windowId, send);
       if (message.type === "webrtc.open") {
         if (!options.open) {
           send(unsupported3("webrtc.open.result", id));
@@ -4425,7 +5038,7 @@ function createDmService(options) {
     }
     subs.add(subscriptionId);
   }
-  function forget(windowId, subscriptionId) {
+  function forget2(windowId, subscriptionId) {
     const subs = ownedSubscriptions.get(windowId);
     if (!subs) return;
     subs.delete(subscriptionId);
@@ -4438,33 +5051,40 @@ function createDmService(options) {
       const requestId = typeof id === "string" ? id : "";
       switch (message.type) {
         case "dm.status":
-          void Promise.resolve(adapter.status()).then((status) => send({ type: "dm.status.result", id: requestId, ...status })).catch((error) => send({ type: "dm.status.result", id: requestId, error: err(error) }));
+          void Promise.resolve().then(() => adapter.status()).then((status) => send({ type: "dm.status.result", id: requestId, ...status })).catch((error) => send({ type: "dm.status.result", id: requestId, error: err(error) }));
           return;
         case "dm.conversations":
-          void Promise.resolve(adapter.conversations(message)).then((page) => send({ type: "dm.conversations.result", id: requestId, ...page })).catch(
-            (error) => send({ type: "dm.conversations.result", id: requestId, conversations: [], error: err(error) })
+          void Promise.resolve().then(() => adapter.conversations(message)).then((page) => send({ type: "dm.conversations.result", id: requestId, ...page })).catch(
+            (error) => send({ type: "dm.conversations.result", id: requestId, error: err(error) })
           );
           return;
         case "dm.messages":
-          void Promise.resolve(adapter.messages(message)).then((page) => send({ type: "dm.messages.result", id: requestId, ...page })).catch(
-            (error) => send({ type: "dm.messages.result", id: requestId, messages: [], error: err(error) })
+          void Promise.resolve().then(() => adapter.messages(message)).then((page) => send({ type: "dm.messages.result", id: requestId, ...page })).catch(
+            (error) => send({ type: "dm.messages.result", id: requestId, error: err(error) })
           );
           return;
         case "dm.send":
-          void adapter.send(message).then((result2) => send({ type: "dm.send.result", id: requestId, ...result2 })).catch((error) => send({ type: "dm.send.result", id: requestId, error: err(error) }));
+          void Promise.resolve().then(() => adapter.send(message)).then((result2) => send({ type: "dm.send.result", id: requestId, ...result2 })).catch((error) => send({ type: "dm.send.result", id: requestId, error: err(error) }));
           return;
         case "dm.subscribe": {
           let activeSubscriptionId = "";
-          void Promise.resolve(
-            adapter.subscribe(message, (dmMessage) => {
+          const pending = [];
+          void Promise.resolve().then(
+            () => adapter.subscribe(message, (dmMessage) => {
               if (activeSubscriptionId.length > 0) {
                 send({ type: "dm.message", subscriptionId: activeSubscriptionId, message: dmMessage });
+              } else {
+                pending.push(dmMessage);
               }
             })
           ).then((subscription) => {
             remember(windowId, subscription.subscriptionId);
             activeSubscriptionId = subscription.subscriptionId;
             send({ type: "dm.subscribe.result", id: requestId, ...subscription });
+            for (const dmMessage of pending) {
+              send({ type: "dm.message", subscriptionId: activeSubscriptionId, message: dmMessage });
+            }
+            pending.length = 0;
           }).catch((error) => {
             send({ type: "dm.subscribe.result", id: requestId, error: err(error) });
           });
@@ -4472,14 +5092,14 @@ function createDmService(options) {
         }
         case "dm.unsubscribe": {
           const subId = message.subscriptionId;
-          if (typeof subId !== "string" || subId.length === 0) {
-            send({ type: "dm.unsubscribe.result", id: requestId, ok: false, error: "subscription not found" });
+          if (typeof subId !== "string" || subId.length === 0 || ownedSubscriptions.get(windowId)?.has(subId) !== true) {
+            send({ type: "dm.unsubscribe.result", id: requestId, error: "subscription not found" });
             return;
           }
-          void Promise.resolve(adapter.unsubscribe(subId)).then((ok) => {
-            forget(windowId, subId);
+          void Promise.resolve().then(() => adapter.unsubscribe(subId)).then((ok) => {
+            forget2(windowId, subId);
             send({ type: "dm.unsubscribe.result", id: requestId, ...ok });
-          }).catch((error) => send({ type: "dm.unsubscribe.result", id: requestId, ok: false, error: err(error) }));
+          }).catch((error) => send({ type: "dm.unsubscribe.result", id: requestId, error: err(error) }));
           return;
         }
         default:
@@ -4500,7 +5120,13 @@ function createDmService(options) {
 }
 
 // src/dm-nip17-adapter.ts
-import { getPublicKey } from "nostr-tools/pure";
+import * as nip44 from "nostr-tools/nip44";
+import {
+  getEventHash,
+  getPublicKey,
+  validateEvent,
+  verifyEvent
+} from "nostr-tools/pure";
 import * as nip17 from "nostr-tools/nip17";
 
 // src/dm-memory-store.ts
@@ -4550,6 +5176,7 @@ var DmMemoryStore = class {
 
 // src/dm-nip17-adapter.ts
 var NIP17_GIFT_WRAP_KIND = 1059;
+var NIP59_SEAL_KIND = 13;
 var subscriptionCounter = 0;
 function tagsFor(tags, name) {
   return tags.filter((tag) => tag[0] === name && typeof tag[1] === "string").map((tag) => tag[1]);
@@ -4557,110 +5184,163 @@ function tagsFor(tags, name) {
 function nowSeconds() {
   return Math.floor(Date.now() / 1e3);
 }
-function createNip17DmAdapter(options) {
-  const ownerPubkey = getPublicKey(options.ownerSecretKey);
-  const store = options.store ?? new DmMemoryStore();
-  const live = /* @__PURE__ */ new Map();
-  function relaysFor2(filters) {
-    return options.relays && options.relays.length > 0 ? options.relays : options.relayPool.selectRelayTier(filters);
+var Nip17DmRuntime = class {
+  constructor(options) {
+    this.options = options;
+    this.ownerPubkey = getPublicKey(options.ownerSecretKey);
+    this.store = options.store ?? new DmMemoryStore();
+  }
+  options;
+  ownerPubkey;
+  store;
+  live = /* @__PURE__ */ new Map();
+  historyLoaded = false;
+  historyLoading = null;
+  adapter() {
+    return {
+      status: () => this.status(),
+      conversations: (query) => this.conversations(query),
+      messages: (query) => this.messages(query),
+      send: (request) => this.send(request),
+      subscribe: (request, onMessage) => this.subscribe(request, onMessage),
+      unsubscribe: (subscriptionId) => this.unsubscribe(subscriptionId),
+      close: () => this.close()
+    };
+  }
+  relaysFor(filters) {
+    return this.options.relays && this.options.relays.length > 0 ? this.options.relays : this.options.relayPool.selectRelayTier(filters);
   }
-  function normalizeRumor(rumor, status) {
+  normalizeRumor(rumor, status) {
     if (rumor.kind !== 14) return null;
-    const participants = [.../* @__PURE__ */ new Set([ownerPubkey, rumor.pubkey, ...tagsFor(rumor.tags, "p")])];
-    const conversationId = store.conversationIdFor(participants);
-    return store.upsertMessage(
-      {
-        id: rumor.id,
-        conversationId,
-        senderPubkey: rumor.pubkey,
-        createdAt: rumor.created_at,
-        content: rumor.content,
-        status
-      },
-      participants
-    );
+    const participants = [.../* @__PURE__ */ new Set([this.ownerPubkey, rumor.pubkey, ...tagsFor(rumor.tags, "p")])];
+    const conversationId = this.store.conversationIdFor(participants);
+    return this.store.upsertMessage({
+      id: rumor.id,
+      conversationId,
+      senderPubkey: rumor.pubkey,
+      createdAt: rumor.created_at,
+      content: rumor.content,
+      status
+    }, participants);
+  }
+  decryptEvent(event) {
+    return JSON.parse(nip44.decrypt(
+      event.content,
+      nip44.getConversationKey(this.options.ownerSecretKey, event.pubkey)
+    ));
+  }
+  unwrapVerified(wrap) {
+    if (wrap.kind !== NIP17_GIFT_WRAP_KIND || !verifyEvent(wrap) || !wrap.tags.some((tag) => tag[0] === "p" && tag[1] === this.ownerPubkey)) return null;
+    try {
+      const seal = this.decryptEvent(wrap);
+      if (!validateEvent(seal) || typeof seal.id !== "string" || typeof seal.sig !== "string" || seal.kind !== NIP59_SEAL_KIND) return null;
+      const signedSeal = seal;
+      if (!verifyEvent(signedSeal)) return null;
+      const rumor = this.decryptEvent(signedSeal);
+      if (!validateEvent(rumor)) return null;
+      const candidate = rumor;
+      if (candidate.kind !== 14 || candidate.pubkey !== signedSeal.pubkey || typeof candidate.id !== "string" || candidate.id !== getEventHash(candidate)) return null;
+      return candidate;
+    } catch {
+      return null;
+    }
   }
-  return {
-    status() {
-      return {
-        available: options.relayPool.isAvailable(),
-        ownerPubkey,
-        implementations: ["nip17"],
-        capabilities: ["send", "receive", "subscribe", "history"]
-      };
-    },
-    conversations(query) {
-      return store.conversations(query);
-    },
-    messages(query) {
-      return store.messages(query);
-    },
-    async send(request) {
-      if (!options.relayPool.isAvailable()) throw new Error("relay unavailable");
-      if (!Array.isArray(request.recipients) || request.recipients.length === 0) {
-        throw new Error("recipient required");
-      }
-      if (typeof request.content !== "string" || request.content.length === 0) {
-        throw new Error("content required");
+  ingestWrap(wrap, status) {
+    const rumor = this.unwrapVerified(wrap);
+    return rumor ? this.normalizeRumor(rumor, status) : null;
+  }
+  async loadHistory() {
+    if (this.historyLoaded || !this.options.relayPool.query) return;
+    this.historyLoading ??= (async () => {
+      const filters = [{ kinds: [NIP17_GIFT_WRAP_KIND], "#p": [this.ownerPubkey], limit: 1e3 }];
+      const wraps = await this.options.relayPool.query(filters, this.relaysFor(filters));
+      for (const wrap of wraps) this.ingestWrap(wrap, "received");
+      this.historyLoaded = true;
+    })().finally(() => {
+      this.historyLoading = null;
+    });
+    await this.historyLoading;
+  }
+  status() {
+    return {
+      available: this.options.relayPool.isAvailable(),
+      ownerPubkey: this.ownerPubkey,
+      implementations: ["nip17"],
+      capabilities: ["send", "receive", "subscribe", "history"]
+    };
+  }
+  async conversations(query) {
+    await this.loadHistory();
+    return this.store.conversations(query);
+  }
+  async messages(query) {
+    await this.loadHistory();
+    return this.store.messages(query);
+  }
+  async send(request) {
+    if (!this.options.relayPool.isAvailable()) throw new Error("relay unavailable");
+    if (!Array.isArray(request.recipients) || request.recipients.length === 0) throw new Error("invalid recipient");
+    if (request.recipients.some((recipient) => !/^[0-9a-f]{64}$/.test(recipient))) throw new Error("invalid recipient");
+    if (typeof request.content !== "string" || request.content.length === 0) throw new Error("content required");
+    if (this.options.authorizeSend && !await this.options.authorizeSend(request)) throw new Error("forbidden");
+    const recipients = [...new Set(request.recipients)];
+    const wraps = nip17.wrapManyEvents(
+      this.options.ownerSecretKey,
+      recipients.map((publicKey) => ({ publicKey })),
+      request.content
+    );
+    for (const wrap of wraps) await Promise.resolve(this.options.relayPool.publish(wrap));
+    const conversationId = request.conversationId ?? this.store.conversationIdFor([this.ownerPubkey, ...recipients]);
+    const message = this.store.upsertMessage({
+      id: request.clientMessageId ?? wraps[0]?.id ?? `dm-${nowSeconds()}`,
+      conversationId,
+      senderPubkey: this.ownerPubkey,
+      createdAt: nowSeconds(),
+      content: request.content,
+      status: "sent"
+    }, [this.ownerPubkey, ...recipients]);
+    return { ok: true, message };
+  }
+  async subscribe(request, onMessage) {
+    if (!this.options.relayPool.isAvailable()) throw new Error("relay unavailable");
+    await this.loadHistory();
+    const subscriptionId = `dm-nip17-${++subscriptionCounter}`;
+    const filters = [{ kinds: [NIP17_GIFT_WRAP_KIND], "#p": [this.ownerPubkey] }];
+    const sub = { conversationId: request.conversationId, onMessage };
+    this.live.set(subscriptionId, sub);
+    try {
+      const handle = this.options.relayPool.subscribe(filters, (item) => {
+        if (item === "EOSE") return;
+        const message = this.ingestWrap(item, "received");
+        if (!message) return;
+        const active = this.live.get(subscriptionId);
+        if (active && (!active.conversationId || active.conversationId === message.conversationId)) active.onMessage(message);
+      }, this.relaysFor(filters));
+      if (this.live.get(subscriptionId) !== sub) {
+        handle.unsubscribe();
+        throw new Error("subscription cancelled");
       }
-      const recipients = [...new Set(request.recipients)];
-      const wraps = nip17.wrapManyEvents(
-        options.ownerSecretKey,
-        recipients.map((publicKey) => ({ publicKey })),
-        request.content
-      );
-      for (const wrap of wraps) await Promise.resolve(options.relayPool.publish(wrap));
-      const conversationId = request.conversationId ?? store.conversationIdFor([ownerPubkey, ...recipients]);
-      const message = store.upsertMessage(
-        {
-          id: request.clientMessageId ?? wraps[0]?.id ?? `dm-${nowSeconds()}`,
-          conversationId,
-          senderPubkey: ownerPubkey,
-          createdAt: nowSeconds(),
-          content: request.content,
-          status: "sent"
-        },
-        [ownerPubkey, ...recipients]
-      );
-      return { ok: true, message };
-    },
-    subscribe(request, onMessage) {
-      if (!options.relayPool.isAvailable()) throw new Error("relay unavailable");
-      const subscriptionId = `dm-nip17-${++subscriptionCounter}`;
-      const filters = [{ kinds: [NIP17_GIFT_WRAP_KIND], "#p": [ownerPubkey] }];
-      const handle = options.relayPool.subscribe(
-        filters,
-        (item) => {
-          if (item === "EOSE") return;
-          let rumor;
-          try {
-            rumor = nip17.unwrapEvent(item, options.ownerSecretKey);
-          } catch {
-            return;
-          }
-          const message = normalizeRumor(rumor, "received");
-          if (!message) return;
-          for (const sub of live.values()) {
-            if (!sub.conversationId || sub.conversationId === message.conversationId) sub.onMessage(message);
-          }
-        },
-        relaysFor2(filters)
-      );
-      live.set(subscriptionId, { handle, conversationId: request.conversationId, onMessage });
+      sub.handle = handle;
       return { subscriptionId };
-    },
-    unsubscribe(subscriptionId) {
-      const sub = live.get(subscriptionId);
-      if (!sub) return { ok: false };
-      sub.handle.unsubscribe();
-      live.delete(subscriptionId);
-      return { ok: true };
-    },
-    close() {
-      for (const sub of live.values()) sub.handle.unsubscribe();
-      live.clear();
+    } catch (error) {
+      this.live.delete(subscriptionId);
+      throw error;
     }
-  };
+  }
+  unsubscribe(subscriptionId) {
+    const sub = this.live.get(subscriptionId);
+    if (!sub) return { ok: false };
+    sub.handle?.unsubscribe();
+    this.live.delete(subscriptionId);
+    return { ok: true };
+  }
+  close() {
+    for (const sub of this.live.values()) sub.handle?.unsubscribe();
+    this.live.clear();
+  }
+};
+function createNip17DmAdapter(options) {
+  return new Nip17DmRuntime(options).adapter();
 }
 
 // src/dm-ndr-adapter.ts
@@ -5041,8 +5721,154 @@ function createCordnDmAdapter(options) {
     }
   };
 }
+
+// src/fs-service.ts
+var FsServiceError = class extends Error {
+  constructor(code, message = code) {
+    super(message);
+    this.code = code;
+    this.name = "FsServiceError";
+  }
+  code;
+};
+var FS_DESCRIPTOR = {
+  name: "fs",
+  version: "1.0.0",
+  description: "NAP-FS runtime-owned virtual filesystem"
+};
+var watchCounter = 0;
+function fsError(error) {
+  return error instanceof FsServiceError ? error.code : "io-error";
+}
+function createFsService(options) {
+  if (!options?.backend) throw new Error("createFsService: options.backend is required");
+  const watches = /* @__PURE__ */ new Map();
+  const watchesByWindow = /* @__PURE__ */ new Map();
+  function ownWatch(watchId, owned) {
+    watches.set(watchId, owned);
+    let ids = watchesByWindow.get(owned.windowId);
+    if (!ids) {
+      ids = /* @__PURE__ */ new Set();
+      watchesByWindow.set(owned.windowId, ids);
+    }
+    ids.add(watchId);
+  }
+  function forgetWatch(watchId) {
+    const owned = watches.get(watchId);
+    if (!owned) return void 0;
+    watches.delete(watchId);
+    const ids = watchesByWindow.get(owned.windowId);
+    ids?.delete(watchId);
+    if (ids?.size === 0) watchesByWindow.delete(owned.windowId);
+    return owned;
+  }
+  function result2(send, type, id, operation, field) {
+    void Promise.resolve().then(operation).then((value) => send({
+      type,
+      id,
+      ...field ? { [field]: value } : {}
+    })).catch((error) => send({ type, id, error: fsError(error) }));
+  }
+  function closeWindowWatches(windowId) {
+    for (const watchId of watchesByWindow.get(windowId) ?? []) {
+      const owned = forgetWatch(watchId);
+      if (owned?.handle) void Promise.resolve(owned.handle.close()).catch(() => void 0);
+    }
+  }
+  return {
+    descriptor: FS_DESCRIPTOR,
+    handleMessage(windowId, message, send) {
+      const input = message;
+      const id = typeof input.id === "string" ? input.id : "";
+      switch (input.type) {
+        case "fs.info":
+          result2(send, "fs.info.result", id, () => options.backend.info(windowId), "info");
+          return;
+        case "fs.pickFile":
+          result2(send, "fs.pickFile.result", id, () => options.backend.pickFile(windowId, input.options), "result");
+          return;
+        case "fs.pickFiles":
+          result2(send, "fs.pickFiles.result", id, () => options.backend.pickFiles(windowId, input.options), "result");
+          return;
+        case "fs.pickDirectory":
+          result2(send, "fs.pickDirectory.result", id, () => options.backend.pickDirectory(windowId, input.options), "result");
+          return;
+        case "fs.pickSaveFile":
+          result2(send, "fs.pickSaveFile.result", id, () => options.backend.pickSaveFile(windowId, input.options), "result");
+          return;
+        case "fs.stat":
+          result2(send, "fs.stat.result", id, () => options.backend.stat(windowId, input.path), "metadata");
+          return;
+        case "fs.list":
+          result2(send, "fs.list.result", id, () => options.backend.list(windowId, input.path), "entries");
+          return;
+        case "fs.read":
+          result2(send, "fs.read.result", id, () => options.backend.read(windowId, input.path, input.options), "result");
+          return;
+        case "fs.write":
+          result2(send, "fs.write.result", id, () => options.backend.write(windowId, input.path, input.data, input.options), "result");
+          return;
+        case "fs.mkdir":
+          result2(send, "fs.mkdir.result", id, () => options.backend.mkdir(windowId, input.path, input.options));
+          return;
+        case "fs.remove":
+          result2(send, "fs.remove.result", id, () => options.backend.remove(windowId, input.path, input.recursive));
+          return;
+        case "fs.move":
+          result2(send, "fs.move.result", id, () => options.backend.move(windowId, input.fromPath, input.toPath));
+          return;
+        case "fs.watch": {
+          const watchId = `fs-watch-${++watchCounter}`;
+          result2(send, "fs.watch.result", id, async () => {
+            const owned = { windowId };
+            ownWatch(watchId, owned);
+            const handle = await options.backend.watch(
+              windowId,
+              input.path,
+              input.options,
+              (change) => {
+                if (watches.get(watchId) !== owned || owned.handle === void 0) return;
+                send({ type: "fs.changed", change: { ...change, watchId } });
+              }
+            );
+            if (watches.get(watchId) !== owned) {
+              await Promise.resolve(handle.close()).catch(() => void 0);
+              throw new FsServiceError("cancelled");
+            }
+            owned.handle = handle;
+            return watchId;
+          }, "watchId");
+          return;
+        }
+        case "fs.unwatch": {
+          const watchId = typeof input.watchId === "string" ? input.watchId : "";
+          const owned = watches.get(watchId);
+          if (!owned || owned.windowId !== windowId) {
+            send({ type: "fs.unwatch.result", id });
+            return;
+          }
+          const forgotten = forgetWatch(watchId);
+          result2(send, "fs.unwatch.result", id, () => forgotten?.handle?.close());
+          return;
+        }
+        default:
+          return;
+      }
+    },
+    onWindowDestroyed(windowId) {
+      closeWindowWatches(windowId);
+      options.backend.onWindowDestroyed?.(windowId);
+    },
+    dispose() {
+      for (const windowId of watchesByWindow.keys()) closeWindowWatches(windowId);
+      options.backend.close?.();
+    }
+  };
+}
 export {
   DmMemoryStore,
+  FsServiceError,
+  ResourceServiceError,
   createBleService,
   createBrowserMediaBridge,
   createCacheService,
@@ -5055,6 +5881,7 @@ export {
   createCountService,
   createCvmService,
   createDmService,
+  createFsService,
   createHttpUploader,
   createIdentityService,
   createIntentService,
@@ -5075,6 +5902,8 @@ export {
   createThemeService,
   createUploadService,
   createWebrtcService,
-  manifestToIntentCatalogEntry
+  manifestToIntentCatalogEntry,
+  resolveConfigValues,
+  validateConfigSchema
 };
 //# sourceMappingURL=index.js.map