@kehto/shell 0.11.1 → 0.13.0

package/README.md

@@ -53,6 +53,18 @@ bridge.runtime.registerService(
 ### Hooks adapter
 - `adaptHooks` — convert a `ShellAdapter` + `BrowserDeps` into the canonical `RuntimeAdapter` hook bag consumed by `@kehto/runtime`
 
+### Diagnostics
+- `ShellAdapter.onUnroutedMessage?(info)` — optional observe-only hook fired when `ShellBridge.handleMessage` drops an incoming postMessage it can't route to a registered napplet window. `info` is an `UnroutedMessageInfo` (`{ type?, origin, reason }`) where `reason` is `'no-source-window'` or `'unregistered-window'`. The message is still dropped — this exists so otherwise-silent drops (e.g. an intent/`srcdoc` iframe whose `contentWindow` was never registered in `originRegistry`, or was swapped by a reload) are diagnosable instead of vanishing. Host can `console.warn` inside its own hook; the bridge adds no console output and swallows hook errors so routing is never broken.
+
+```ts
+const bridge = createShellBridge({
+  ...myShellAdapter,
+  onUnroutedMessage: ({ type, origin, reason }) => {
+    console.warn(`[shell] dropped ${type ?? '<unknown>'} from ${origin}: ${reason}`);
+  },
+});
+```
+
 ### Shell init
 - `buildShellCapabilities` — construct the current draft `ShellCapabilities` payload emitted during the `shell.ready` / `shell.init` handshake
 
@@ -85,10 +97,10 @@ bridge.runtime.registerService(
 - `TopicKey`, `TopicValue` — typed topic lookup helpers
 
 ### Types
-Exported for host-app integration: `ShellAdapter`, `ShellCapabilities`, `RelayPoolHooks`, `RelayPoolLike`, `RelayConfigHooks`, `WindowManagerHooks`, `AuthHooks`, `ConfigHooks`, `HotkeyHooks`, `WorkerRelayHooks`, `WorkerRelayLike`, `CryptoHooks`, `DmHooks`, `SessionEntry`, `NappKeyEntry` (deprecated), `AclEntry`, `AclCheckEvent`, `ServiceDescriptor`, `ServiceHandler`, `ServiceRegistry`, `NostrEvent`, `NostrFilter`, `NappletMessage`, `ConsentRequest`, and per-proxy `*Deps`/`*Proxy` interfaces.
+Exported for host-app integration: `ShellAdapter`, `ShellCapabilities`, `RelayPoolHooks`, `RelayPoolLike`, `RelayConfigHooks`, `WindowManagerHooks`, `AuthHooks`, `ConfigHooks`, `HotkeyHooks`, `WorkerRelayHooks`, `WorkerRelayLike`, `CryptoHooks`, `DmHooks`, `SessionEntry`, `NappKeyEntry` (deprecated), `AclEntry`, `AclCheckEvent`, `UnroutedMessageInfo`, `ServiceDescriptor`, `ServiceHandler`, `ServiceRegistry`, `NostrEvent`, `NostrFilter`, `NappletMessage`, `ConsentRequest`, and per-proxy `*Deps`/`*Proxy` interfaces.
 
 ### Enforcement re-exports (from @kehto/runtime)
-`createEnforceGate`, `createNubEnforceGate`, `formatDenialReason`, plus `EnforceResult`, `EnforceConfig`, `NubEnforceConfig`, `IdentityResolver`, `AclChecker`, `NubMessage`.
+`createEnforceGate`, `createNapEnforceGate`, `formatDenialReason`, plus `EnforceResult`, `EnforceConfig`, `NapEnforceConfig`, `IdentityResolver`, `AclChecker`, `NapMessage`.
 
 ### Compat re-exports (DRIFT-CORE-06)
 

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { Capability, NappletClass, ServiceRegistry, RuntimeConfigOverrides, ConsentRequest, Runtime, SessionEntry, PendingUpdate, RuntimeAdapter } from '@kehto/runtime';
-export { ALL_CAPABILITIES, AclChecker, Capability, ConsentRequest, EnforceConfig, EnforceResult, IdentityResolver, NappKeyEntry, NappletClass, NubEnforceConfig, NubMessage, PendingUpdate, ServiceDescriptor, ServiceHandler, ServiceRegistry, SessionEntry, createEnforceGate, createNubEnforceGate, formatDenialReason } from '@kehto/runtime';
+import { Capability, ServiceRegistry, RuntimeConfigOverrides, ConsentRequest, Runtime, SessionEntry, PendingUpdate, RuntimeAdapter } from '@kehto/runtime';
+export { ALL_CAPABILITIES, AclChecker, Capability, ConsentRequest, EnforceConfig, EnforceResult, IdentityResolver, NapEnforceConfig, NapMessage, NappKeyEntry, PendingUpdate, ServiceDescriptor, ServiceHandler, ServiceRegistry, SessionEntry, createEnforceGate, createNapEnforceGate, formatDenialReason } from '@kehto/runtime';
 import { NappletMessage, NostrEvent, NostrFilter } from '@napplet/core';
 export { NappletMessage, NostrEvent, NostrFilter, TOPICS, TopicKey, TopicValue } from '@napplet/core';
 import { Theme } from '@napplet/nap/theme/types';
@@ -165,6 +165,17 @@ interface IntentHooks {
     /** True when the host has an intent resolver wired and ready to dispatch. */
     isAvailable(): boolean;
 }
+/**
+ * Optional host override for the static shell.init capability handshake.
+ *
+ * Hosts normally advertise the default Kehto NAP surface. Development hosts may
+ * temporarily suppress domains to simulate smaller or policy-constrained shell
+ * environments while still using the production shell-ready path.
+ */
+interface CapabilityHooks {
+    /** Bare capability domains to remove from domains, naps, and protocols. */
+    readonly disabledDomains?: readonly string[];
+}
 /**
  * Event emitted on every ACL enforcement check.
  * @example
@@ -188,36 +199,51 @@ interface AclCheckEvent {
     /** The triggering message, if available. Accepts NIP-01 arrays or NIP-5D NappletMessage envelopes. */
     message?: NappletMessage | unknown[];
 }
+/**
+ * Diagnostic payload reported when {@link ShellAdapter.onUnroutedMessage} fires —
+ * i.e. when `ShellBridge.handleMessage` drops an incoming postMessage because it
+ * cannot be routed to a registered napplet window.
+ *
+ * @example
+ * ```ts
+ * hooks.onUnroutedMessage = (info: UnroutedMessageInfo) => {
+ *   console.warn(`[shell] dropped ${info.type ?? '<unknown>'} from ${info.origin}: ${info.reason}`);
+ * };
+ * ```
+ */
+interface UnroutedMessageInfo {
+    /**
+     * The dropped message's `type` field when `event.data` is an object with a
+     * string `type`; `undefined` for malformed/non-envelope payloads.
+     */
+    type?: string;
+    /** The `MessageEvent.origin` of the dropped message. */
+    origin: string;
+    /**
+     * Why the message was dropped:
+     * - `no-source-window` — the `MessageEvent` had no `source` window to identify the sender.
+     * - `unregistered-window` — the source `Window` is not in `originRegistry` (the
+     *   sending iframe was never registered, or a `srcdoc` reload swapped its
+     *   `contentWindow` to a new object that no longer matches the registry key).
+     */
+    reason: 'no-source-window' | 'unregistered-window';
+}
 /**
  * Static capability set sent to napplet iframes through the shell.ready /
  * shell.init handshake. Used by hosted `window.napplet.shell.supports()` for
  * synchronous capability queries after the shim consumes shell.init.
  *
- * Per canonical NIP-5D (specs/NIP-5D.md lines 81-94), supports() distinguishes
- * two namespaces:
+ * Per canonical NIP-5D (https://github.com/nostr-protocol/nips/pull/2303/),
+ * supports() distinguishes two namespaces:
  *
- *   - Bare names (or optional `nub:` prefix) for NUB-capability lookups,
- *     resolved against the `nubs` array — e.g. `supports('relay')`,
- *     `supports('identity')`.
+ *   - Bare names for NAP-capability lookups, resolved against the `naps`
+ *     array — e.g. `supports('relay')`, `supports('identity')`.
  *   - The `perm:<permission>` prefix for sandbox-permission lookups, resolved
  *     against the `sandbox` array — e.g. `supports('perm:popups')`,
  *     `supports('perm:modals')`.
  *
  * The two namespaces do not cross: a bare-name lookup never matches a sandbox
- * entry and a `perm:`-prefixed lookup never matches a NUB entry.
- *
- * ## Dual-emit (back-compat window — D2/D3, ALIGN-01..04)
- *
- * Both `naps` and `nubs` are emitted in the shell.init payload for one
- * back-compat release:
- *
- *   - `naps` (PRIMARY) — NAP vocabulary: bare domain `inc`, protocol IDs
- *     `inc:NAP-01..inc:NAP-06`. Consumed by `@napplet/shim >=0.9.0`.
- *     Contains NO unaliased `ifc` or `NUB-NN` identifiers.
- *   - `nubs` (LEGACY) — retains the original `ifc` / `ifc:NUB-01..06` /
- *     `ifc:NAP-01` vocabulary for `@napplet/nub` and `<=0.8.x` shims.
- *
- * The dual-emit is intentional; removal is tracked as CLEANUP-01.
+ * entry and a `perm:`-prefixed lookup never matches a NAP entry.
  *
  * ## Conformant NAP-SHELL shape (TERM-03 — @napplet/core@0.12 / @napplet/shim@0.13)
  *
@@ -230,8 +256,8 @@ interface AclCheckEvent {
  *   - `supports('inc','NAP-01')`→ true iff `capabilities.protocols['inc']`
  *                                  includes `'NAP-01'`
  *
- * `domains` and `protocols` are emitted as a SUPERSET ALONGSIDE the legacy
- * `naps`/`nubs`/`sandbox` fields (TERM-05 back-compat). The 0.13 shim has NO
+ * `domains` and `protocols` are emitted as a SUPERSET ALONGSIDE the
+ * `naps`/`sandbox` fields (TERM-05 back-compat). The 0.13 shim has NO
  * special `perm:` logic — `supports('perm:popups')` is an ordinary bare-domain
  * membership check, so kehto's `perm:`-prefixed sandbox entries are folded into
  * `domains` (empty by default, preserving the default-empty sandbox behavior).
@@ -262,38 +288,25 @@ interface ShellCapabilities {
     protocols: Record<string, string[]>;
     /**
      * NAP-vocabulary domain entries the shell handles (PRIMARY — consumed by
-     * `@napplet/shim >=0.9.0`). Bare domain `inc` (the NAP rename of `ifc`)
+     * `@napplet/shim >=0.9.0`). Bare domain `inc` (the NAP rename of `inc`)
      * plus protocol IDs `inc:NAP-01..inc:NAP-06`. Conditional entries:
      * `relay`, `outbox` prepended when a relay pool is wired; `upload` appended
      * when an upload backend is wired; `intent` appended when an intent
      * dispatcher is available.
      *
-     * Contains NO `ifc`, `NUB-NN`, or unaliased legacy identifiers.
+     * Contains NO `NAP-NN` protocol strings (those live in `protocols`).
      */
     naps: string[];
-    /**
-     * Legacy NUB domain entries the shell handles (retained for one back-compat
-     * release — consumed by `@napplet/nub` and `@napplet/shim <=0.8.x`).
-     * Vocabulary: `ifc`, `ifc:NUB-01..06`, `ifc:NAP-01`, bare domain names.
-     * Contents are unchanged from the pre-0.9.0 release; `naps` is the primary
-     * field for new shims. Removal tracked as CLEANUP-01.
-     *
-     * Entries are bare domain names — `'relay'`, `'identity'`, etc. They MUST NOT
-     * carry the `perm:` prefix; that prefix is reserved for the `sandbox` array.
-     * Napplets query NUB support via `supports('<domain>')` (or, equivalently,
-     * `supports('nub:<domain>')`).
-     */
-    nubs: string[];
     /**
      * Sandbox permissions under the `perm:<permission>` namespace. Each entry
      * MUST begin with the literal prefix `'perm:'` — e.g. `'perm:popups'`,
      * `'perm:modals'`, `'perm:downloads'`. Napplets call
      * `shell.supports('perm:<permission>')` to check sandbox entitlements.
      *
-     * The `perm:` prefix is what separates sandbox permissions from NUB
+     * The `perm:` prefix is what separates sandbox permissions from NAP
      * capabilities; bare-name entries here violate the NIP-5D contract and will
-     * be unreachable through `supports()` (see specs/NIP-5D.md §6 and lines
-     * 81-94). NUB-capability lookups (on `nubs`) retain the bare-name
+     * be unreachable through `supports()` (see the living NIP-5D at
+     * https://github.com/nostr-protocol/nips/pull/2303/). NAP-capability lookups (on `naps`) retain the bare-name
      * convention and do NOT use the `perm:` prefix.
      */
     sandbox: string[];
@@ -337,24 +350,30 @@ interface ShellAdapter {
      * concrete service via `registerService('intent')`.
      */
     intent?: IntentHooks;
+    /**
+     * Optional capability advertisement override. Omitted by production hosts.
+     */
+    capabilities?: CapabilityHooks;
     /** Called on every ACL enforcement check. Both allows and denials are reported. */
     onAclCheck?: (event: AclCheckEvent) => void;
+    /**
+     * Called when `ShellBridge.handleMessage` drops an incoming postMessage because
+     * it cannot be routed to a registered napplet window (no source window, or the
+     * source `Window` is not in `originRegistry`). Observe-only — the message is
+     * still dropped; this hook exists so otherwise-silent drops are diagnosable
+     * (the FEED-02 / hyprgate#21 class of "a napplet's messages vanish" bug).
+     */
+    onUnroutedMessage?: (info: UnroutedMessageInfo) => void;
     /** Called when aggregate hash verification fails (computed != declared). */
     onHashMismatch?: (dTag: string, claimed: string, computed: string) => void;
     /**
      * Called at iframe creation for NIP-5D napplets.
-     * Returns identity metadata for originRegistry.register(), INCLUDING the
-     * class posture (CLASS-01, breaking v1.7). Returning `class: null` selects
-     * the permissive default (D2). Returning null overall means "not NIP-5D /
-     * skip registration" (unchanged semantics from v1.6).
-     *
-     * BREAKING v1.7: previously `{ dTag, aggregateHash } | null`; now requires
-     * `class` in the non-null branch. See .changeset/class-01-breaking-hook.md.
+     * Returns identity metadata for originRegistry.register(). Returning null
+     * means "not NIP-5D / skip registration".
      */
     onNip5dIframeCreate?: (windowId: string) => {
         dTag: string;
         aggregateHash: string;
-        class: NappletClass;
     } | null;
     /**
      * Optional service extensions. Each key is a service name (e.g., 'audio',
@@ -381,146 +400,6 @@ interface ShellAdapter {
     getConfigOverrides?(): RuntimeConfigOverrides;
 }
 
-/**
- * connect-store.ts — NUB-CONNECT grant registry keyed on (dTag, aggregateHash).
- *
- * Mirrors acl-store.ts pattern: module-level singleton, localStorage persistence,
- * composite-key Map. Grants are per-napplet-build: changing the aggregateHash
- * (a rebuild) invalidates prior grants (CONNECT-06) — the composite key makes
- * this structural, not policy-driven.
- *
- * Default policy is RESTRICTIVE (opposite of aclStore): unknown (dTag, hash, origin)
- * combinations return `false` from check() — napplets must be explicitly granted
- * origins via grant(). This is the NUB-CONNECT security invariant.
- *
- * @see packages/shell/src/types/internal-connect.ts for the wire types.
- * @see docs/policies/SHELL-CONNECT-POLICY.md (Plan 39-05) for the full policy.
- */
-/**
- * Public interface for the NUB-CONNECT grant store singleton.
- *
- * All methods are keyed on (dTag, aggregateHash). A rebuild with a new
- * aggregateHash is a distinct identity — CONNECT-06 hash-upgrade semantics
- * are structurally guaranteed: check(dTag, newHash, origin) returns false
- * because newHash has no entry in the store.
- */
-interface ConnectStore {
-    /**
-     * Check whether an origin has been granted for a specific (dTag, aggregateHash).
-     *
-     * Returns false for unknown (dTag, aggregateHash) pairs — RESTRICTIVE default.
-     * Returns false for unknown origins even if the (dTag, hash) pair exists.
-     *
-     * @param dTag - The napplet's dTag identifier
-     * @param aggregateHash - The napplet's build aggregate hash
-     * @param origin - The origin to check (e.g., 'https://relay.example.com')
-     * @returns true if origin is in the grant set; false otherwise
-     */
-    check(dTag: string, aggregateHash: string, origin: string): boolean;
-    /**
-     * Get all granted origins for a (dTag, aggregateHash) pair.
-     *
-     * Returns an empty array for unknown (dTag, aggregateHash) pairs.
-     *
-     * @param dTag - The napplet's dTag identifier
-     * @param aggregateHash - The napplet's build aggregate hash
-     * @returns Readonly array of granted origin strings; empty if not granted
-     */
-    getOrigins(dTag: string, aggregateHash: string): readonly string[];
-    /**
-     * Grant a set of origins to a (dTag, aggregateHash) pair.
-     *
-     * Deduplicates and sorts origins for idempotent CSP header output (Plan 39-03).
-     * Replaces any existing grant for the same (dTag, aggregateHash) pair.
-     * Persists to localStorage automatically.
-     *
-     * @param dTag - The napplet's dTag identifier
-     * @param aggregateHash - The napplet's build aggregate hash
-     * @param origins - Origins to grant (e.g., ['https://relay.example.com', 'wss://relay2.example.com'])
-     */
-    grant(dTag: string, aggregateHash: string, origins: readonly string[]): void;
-    /**
-     * Revoke all granted origins for a (dTag, aggregateHash) pair.
-     *
-     * After revocation, check() returns false and getOrigins() returns [].
-     * Persists to localStorage automatically.
-     *
-     * @param dTag - The napplet's dTag identifier
-     * @param aggregateHash - The napplet's build aggregate hash
-     */
-    revoke(dTag: string, aggregateHash: string): void;
-    /**
-     * Get all current grants across all (dTag, aggregateHash) pairs.
-     *
-     * Used by the Vite CSP plugin (Plan 39-03) to build the connect-src
-     * header for each napplet on dev-server startup.
-     *
-     * @returns Readonly array of all grants
-     */
-    getAllGrants(): ReadonlyArray<{
-        dTag: string;
-        aggregateHash: string;
-        origins: readonly string[];
-    }>;
-    /**
-     * Persist the current store state to localStorage under 'napplet:connect'.
-     *
-     * Tolerates unavailable localStorage (e.g., SSR, private browsing with
-     * storage disabled). Called automatically by grant() and revoke().
-     */
-    persist(): void;
-    /**
-     * Load the store state from localStorage.
-     *
-     * Validates shape before populating; clears store on corrupt data.
-     * Should be called once on shell startup before handling any napplet messages.
-     */
-    load(): void;
-    /**
-     * Clear all grants and remove the localStorage entry.
-     *
-     * Best-effort localStorage removal (tolerates unavailability).
-     */
-    clear(): void;
-}
-/**
- * NUB-CONNECT grant store singleton.
- *
- * Module-level instance — import and use directly. Persists under localStorage
- * key 'napplet:connect'. Call `connectStore.load()` on shell startup to restore
- * persisted grants from a previous session.
- *
- * @example
- * ```ts
- * import { connectStore } from '@kehto/shell';
- *
- * // On shell startup:
- * connectStore.load();
- *
- * // On consent approval:
- * connectStore.grant(dTag, aggregateHash, ['https://relay.example.com']);
- *
- * // In Vite CSP plugin (Plan 39-03):
- * const origins = connectStore.getOrigins(dTag, aggregateHash);
- * ```
- */
-declare const connectStore: ConnectStore;
-/**
- * Compose the canonical `<dTag>:<aggregateHash>` composite key used by the
- * connect-store. Exported for consumers that need to key their own maps by
- * the same identity (e.g., Vite CSP plugin — Plan 39-03).
- *
- * @param dTag - The napplet's dTag identifier
- * @param aggregateHash - The napplet's build aggregate hash
- * @returns Composite key string in `<dTag>:<aggregateHash>` format
- *
- * @example
- * ```ts
- * const key = connectGrantKey('chat', 'abc123'); // 'chat:abc123'
- * ```
- */
-declare function connectGrantKey(dTag: string, aggregateHash: string): string;
-
 /**
  * Shell-side message bridge that handles NIP-5D communication with napplet iframes.
  *
@@ -548,7 +427,7 @@ interface ShellBridge {
      *
      * shell.ready messages are handled locally: the bridge responds with shell.init
      * containing the capability set and registered service list. All other envelopes
-     * are delegated to the runtime's NUB domain dispatch.
+     * are delegated to the runtime's NAP domain dispatch.
      *
      * @param event - The raw MessageEvent from window.addEventListener('message', ...)
      * @example
@@ -559,7 +438,7 @@ interface ShellBridge {
     handleMessage(event: MessageEvent): void;
     /**
      * Inject a shell-originated event into subscription delivery. Under NIP-5D,
-     * shell-originated events are forwarded to napplets as ifc.event envelope
+     * shell-originated events are forwarded to napplets as inc.event envelope
      * messages. The runtime's injectEvent() handles the per-session routing.
      *
      * v1.10 hard-removed the v1.8 soft-rename compatibility branch for the
@@ -640,45 +519,7 @@ interface ShellBridge {
      * and manifestCache.
      */
     readonly runtime: Runtime;
-    /**
-     * Access the NUB-CONNECT grant store. Per-napplet connect grants are
-     * keyed on (dTag, aggregateHash) and persisted under localStorage key
-     * 'napplet:connect'. Public API surface for the Vite CSP middleware
-     * (Plan 39-03) and the consent flow (Plan 39-04).
-     *
-     * Default policy is RESTRICTIVE: check() returns false for any origin
-     * not explicitly granted. Call load() on shell startup to restore
-     * persisted grants from a previous session.
-     *
-     * @see SHELL-CONNECT-POLICY.md for the full policy.
-     */
-    readonly connectStore: ConnectStore;
 }
-/**
- * Create a ShellBridge instance with dependency injection via hooks.
- *
- * Internally creates a Runtime from @kehto/runtime and adapts the
- * browser-oriented ShellAdapter into environment-agnostic RuntimeAdapter.
- *
- * @param hooks - Host application provides relay pool, auth, config, etc.
- * @returns A ShellBridge instance ready to handle napplet messages
- * @example
- * ```ts
- * import { createShellBridge, type ShellAdapter } from '@kehto/shell';
- *
- * const hooks: ShellAdapter = {
- *   relayPool: myRelayPoolHooks,
- *   relayConfig: myRelayConfigHooks,
- *   windowManager: myWindowManagerHooks,
- *   auth: myAuthHooks,
- *   config: myConfigHooks,
- *   hotkeys: myHotkeyHooks,
- *   workerRelay: myWorkerRelayHooks,
- *   crypto: myCryptoHooks,
- * };
- * const bridge = createShellBridge(hooks);
- * ```
- */
 declare function createShellBridge(hooks: ShellAdapter): ShellBridge;
 
 /**
@@ -1221,27 +1062,23 @@ declare function adaptHooks(shellHooks: ShellAdapter, deps: BrowserDeps): Runtim
 /**
  * Build the shell's static capability set from adapter configuration.
  *
- * Returns BOTH `naps` (NAP vocabulary, primary — consumed by @napplet/shim >=0.9.0)
- * and `nubs` (legacy vocabulary — consumed by @napplet/nub and <=0.8.x shims)
- * for one back-compat release (D2/D3, ALIGN-01..04). Dual-emit is intentional;
- * removal is tracked as CLEANUP-01.
+ * Returns the conformant NAP-SHELL `domains`/`protocols` shape (consumed by
+ * `@napplet/shim >=0.13` via `@napplet/nap@0.12`'s `createShellEnvironment` +
+ * `makeSupports`) alongside the flat `naps` array (consumed by
+ * `@napplet/shim >=0.9.0`) and the `sandbox` array.
  *
  * ### naps array (NAP vocabulary)
- * Bare domain `inc` (rename of `ifc`) + `inc:NAP-01..inc:NAP-06`.
+ * Bare domain `inc` + `inc:NAP-01..inc:NAP-06`.
  * Conditional: `relay`+`outbox` prepended when hooks.relayPool;
  * `upload` appended when hooks.upload;
  * `intent` appended when hooks.intent.isAvailable().
- * Contains NO `ifc` or `NUB-NN` identifiers.
- *
- * ### nubs array (legacy vocabulary)
- * Bare domain `ifc`, `ifc:NUB-01..06`, `ifc:NAP-01`.
- * Same conditional appends as naps, using legacy vocabulary.
  *
  * Sandbox permissions are left empty by default — host apps may extend after
  * construction. Sandbox entries (and any host-app extensions) MUST use the
  * canonical `perm:<permission>` form — e.g. `'perm:popups'`, `'perm:modals'`,
  * `'perm:downloads'`. Napplets rely on the `perm:` prefix to distinguish
- * sandbox permissions from NUB-capability lookups; see specs/NIP-5D.md lines 81-94.
+ * sandbox permissions from NAP-capability lookups; see the living NIP-5D at
+ * https://github.com/nostr-protocol/nips/pull/2303/
  *
  * ### domains array + protocols map (conformant NAP-SHELL — @napplet/core@0.12)
  * The structured shape the released `@napplet/shim@0.13` actually reads via
@@ -1255,26 +1092,23 @@ declare function adaptHooks(shellHooks: ShellAdapter, deps: BrowserDeps): Runtim
  *   - `protocols` — `{ inc: ['NAP-01'..'NAP-06'] }`, derived from
  *     `NAP_INC_PROTOCOLS` by stripping the `inc:` prefix.
  *
- * Emitted as a SUPERSET alongside `naps`/`nubs`/`sandbox` (TERM-05 back-compat).
+ * Emitted as a SUPERSET alongside `naps`/`sandbox` (TERM-05 back-compat).
  *
  * @param hooks - The ShellAdapter provided by the host app
  * @returns ShellCapabilities with domains/protocols (conformant 0.13 shape) plus
- *          naps (NAP vocab), nubs (legacy vocab), and sandbox (perm:-prefixed) arrays
+ *          naps (NAP vocab) and sandbox (perm:-prefixed) arrays
  * @example
  * ```ts
  * const caps = buildShellCapabilities(hooks);
- * // caps.domains => ['relay','outbox','identity','storage','inc','theme','keys','media','notify','config','resource','connect','class','cvm']
+ * // caps.domains => ['relay','outbox','identity','storage','inc','theme','keys','media','notify','config','resource','cvm']
  * //               (relay + outbox present when hooks.relayPool is provided; 'upload'/'intent'
  * //                appended under their hooks; perm:<x> sandbox entries appended when extended)
  * // caps.protocols => { inc: ['NAP-01','NAP-02','NAP-03','NAP-04','NAP-05','NAP-06'] }
- * // caps.naps => ['relay','outbox','identity','storage','inc','theme','keys','media','notify','config','resource','connect','class','cvm',
+ * // caps.naps => ['relay','outbox','identity','storage','inc','theme','keys','media','notify','config','resource','cvm',
  * //               'inc:NAP-01','inc:NAP-02','inc:NAP-03','inc:NAP-04','inc:NAP-05','inc:NAP-06']
  * //              (relay + outbox present when hooks.relayPool is provided; 'upload'
  * //               appended when hooks.upload is provided; 'intent' appended when
- * //               hooks.intent.isAvailable() is true; no ifc or NUB-NN identifiers)
- * // caps.nubs => ['relay','outbox','identity','storage','ifc','theme','keys','media','notify','config','resource','connect','class','cvm',
- * //               'ifc:NAP-01','ifc:NUB-01','ifc:NUB-02','ifc:NUB-03','ifc:NUB-04','ifc:NUB-05','ifc:NUB-06']
- * //              (legacy vocabulary, unchanged for back-compat)
+ * //               hooks.intent.isAvailable() is true)
  * // caps.sandbox => []   // host app may extend with 'perm:popups', etc.
  * ```
  */
@@ -1738,15 +1572,15 @@ declare function createNotifyProxy(deps: NotifyProxyDeps): NotifyProxy;
 
 /**
  * keys-forwarder.ts — Shell-side host keydown listener that forwards events
- * to registered napplets as `keys.forward` envelopes (Plan 12-11, NUB-05
+ * to registered napplets as `keys.forward` envelopes (Plan 12-11, NAP-05
  * shell-side half).
  *
  * Per `@napplet/nap/keys`, `keys.forward` is fire-and-forget (no result
- * envelope, no correlation id). Field names follow the nub convention:
+ * envelope, no correlation id). Field names follow the nap convention:
  * `{ ctrl, alt, shift, meta }` — NOT the DOM-style `ctrlKey`/etc.
  *
  * Capability gate: only forwards to napplets whose ACL grants the
- * `keys:forward` capability (per Plan 12-10 `resolveCapabilitiesNub` 'keys'
+ * `keys:forward` capability (per Plan 12-10 `resolveCapabilitiesNap` 'keys'
  * case). The caller wires the cap-lookup via the `hasKeysForwardCap` dep so
  * this module stays free of any direct ACL-store dependency.
  *
@@ -1831,63 +1665,6 @@ interface KeysForwarder {
  */
 declare function createKeysForwarder(deps: KeysForwarderDeps): KeysForwarder;
 
-/**
- * @file internal-connect.ts
- *
- * Kehto-internal shell-side connect-store + consent-flow types. Per
- * PROJECT.md Decision #31, this is NOT a staging-ground duplicate of upstream
- * `@napplet/nap/connect`: upstream exports a napplet-side accessor interface
- * (`NappletConnect = { granted, origins }`) plus the shared
- * `normalizeConnectOrigin` pure validator. Kehto's types here describe the
- * shell's grant-store records (`ConnectGrant`, `ConnectGrantKey`,
- * `ConsentResult`), used by the connect-store singleton and the Vite CSP
- * plugin's consent flow.
- *
- * The two surfaces are complementary: upstream's accessor type ships at the
- * napplet boundary; kehto's grant-store types live shell-side. No retirement
- * planned. For canonical origin validation (kehto has no local impl;
- * Decision #32), consume `@napplet/nap/connect`'s `normalizeConnectOrigin`
- * directly.
- *
- * Downstream consumers (Phase 39 `connect-store.ts`, Vite CSP middleware,
- * consent flow UI) import from this module.
- */
-/**
- * Grant key composed from the napplet's dTag and build aggregateHash. A hash
- * upgrade invalidates prior grants (CONNECT-06).
- */
-interface ConnectGrantKey {
-    dTag: string;
-    aggregateHash: string;
-}
-/**
- * A persisted connect grant. Stored in the shell connect-store singleton,
- * surfaced as the CSP `connect-src` origin list for the corresponding napplet.
- */
-interface ConnectGrant {
-    /** Composite key `"<dTag>:<aggregateHash>"` under which this grant is stored. */
-    key: string;
-    /** The set of origins (WebSocket and HTTPS) the napplet is granted to connect to. */
-    origins: readonly string[];
-    /** Epoch millis when the grant was approved by the user. */
-    grantedAt: number;
-}
-/**
- * Consent flow outcome. `'dismiss'` resolves to deny (MUST NOT default to allow).
- * `'timeout'` also resolves to deny.
- */
-type ConsentResult = 'approve' | 'deny' | 'dismiss' | 'timeout';
-/**
- * Inbound consent request from a napplet requesting connect access to one or
- * more origins.
- */
-interface ConnectConsentRequest {
-    dTag: string;
-    aggregateHash: string;
-    /** Origins the napplet is asking to be granted access to. */
-    requestedOrigins: readonly string[];
-}
-
 /**
  * @file internal-resource.ts
  *
@@ -1897,8 +1674,8 @@ interface ConnectConsentRequest {
  * field names (kehto's `requestId` vs upstream `id`; kehto's `bodyBase64` vs
  * upstream `blob` + `mime`), different message-type names
  * (`ResourceBytesRequest` vs `ResourceBytesMessage`), and disjoint error
- * vocabularies (kehto: 5 codes `{denied, canceled, network-error, invalid-url,
- * class-forbidden}`; upstream: 8 codes `{not-found, blocked-by-policy,
+ * vocabularies (kehto: 4 codes `{denied, canceled, network-error, invalid-url}`;
+ * upstream: 8 codes `{not-found, blocked-by-policy,
  * timeout, too-large, unsupported-scheme, decode-failed, network-error,
  * quota-exceeded}`).
  *
@@ -1954,7 +1731,7 @@ interface ResourceBytesResult {
  * Canonical typed-error codes for RESOURCE-03 cancel correlation + H-03
  * ungranted-origin refusal.
  */
-type ResourceErrorCode = 'denied' | 'canceled' | 'network-error' | 'invalid-url' | 'class-forbidden';
+type ResourceErrorCode = 'denied' | 'canceled' | 'network-error' | 'invalid-url';
 /**
  * Outbound: error result — used for both grant-refusal (RESOURCE-01) and
  * cancel-correlation (RESOURCE-03) cases.
@@ -1974,4 +1751,4 @@ type ResourceInbound = ResourceBytesRequest | ResourceCancelRequest;
  */
 type ResourceOutbound = ResourceBytesResult | ResourceBytesError;
 
-export { type AclCheckEvent, type AclEntry, type AudioSource, type AuthHooks, type BrowserDeps, type ConfigHooks, type ConnectConsentRequest, type ConnectGrant, type ConnectGrantKey, type ConnectStore, type ConsentResult, type CryptoHooks, type DmHooks, type HotkeyHooks, type IdentityProxy, type IdentityProxyDeps, type IntentHooks, type KeysForwarder, type KeysForwarderDeps, type KeysForwarderOriginRegistry, type KeysForwarderSessionRegistry, type KeysProxy, type KeysProxyDeps, type ManifestCacheEntry, type MediaProxy, type MediaProxyDeps, type NotifyProxy, type NotifyProxyDeps, type ProxyOriginRegistry, type RelayConfigHooks, type RelayPoolHooks, type RelayPoolLike, type ResourceBytesError, type ResourceBytesRequest, type ResourceBytesResult, type ResourceCancelRequest, type ResourceErrorCode, type ResourceInbound, type ResourceOutbound, type ResourceRequestId, type ShellAdapter, type ShellBridge, type ShellCapabilities, type ThemeProxy, type ThemeProxyDeps, type UploadBackendLike, type UploadHooks, type WindowManagerHooks, type WorkerRelayHooks, type WorkerRelayLike, adaptHooks, audioManager, buildShellCapabilities, connectGrantKey, connectStore, createIdentityProxy, createKeysForwarder, createKeysProxy, createMediaProxy, createNotifyProxy, createShellBridge, createThemeProxy, manifestCache, nappKeyRegistry, originRegistry, sessionRegistry };
+export { type AclCheckEvent, type AclEntry, type AudioSource, type AuthHooks, type BrowserDeps, type CapabilityHooks, type ConfigHooks, type CryptoHooks, type DmHooks, type HotkeyHooks, type IdentityProxy, type IdentityProxyDeps, type IntentHooks, type KeysForwarder, type KeysForwarderDeps, type KeysForwarderOriginRegistry, type KeysForwarderSessionRegistry, type KeysProxy, type KeysProxyDeps, type ManifestCacheEntry, type MediaProxy, type MediaProxyDeps, type NotifyProxy, type NotifyProxyDeps, type ProxyOriginRegistry, type RelayConfigHooks, type RelayPoolHooks, type RelayPoolLike, type ResourceBytesError, type ResourceBytesRequest, type ResourceBytesResult, type ResourceCancelRequest, type ResourceErrorCode, type ResourceInbound, type ResourceOutbound, type ResourceRequestId, type ShellAdapter, type ShellBridge, type ShellCapabilities, type ThemeProxy, type ThemeProxyDeps, type UnroutedMessageInfo, type UploadBackendLike, type UploadHooks, type WindowManagerHooks, type WorkerRelayHooks, type WorkerRelayLike, adaptHooks, audioManager, buildShellCapabilities, createIdentityProxy, createKeysForwarder, createKeysProxy, createMediaProxy, createNotifyProxy, createShellBridge, createThemeProxy, manifestCache, nappKeyRegistry, originRegistry, sessionRegistry };