fix: log unparseable relay frames at WARN, not ERROR

A frame the client can't decode (non-standard framing, unknown command,
malformed JSON) is a relay-side quirk, not an Amethyst error. For example,
multiplextr.coracle.social replies to a plain REQ with its own multiplexer
envelope `[{"relays":[]},["NOTICE","","Unable to handle message"]]`, whose
first element is an object rather than a command label, so the decoder
throws `Message null is not supported`.

BasicRelayClient already drops such frames and its comment states it
"doesn't expose parsing errors to lib users as errors", yet it logged at
ERROR. Downgrade to WARN so these relay-side quirks stop surfacing as app
errors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01THVD3sY6xrxGzBHhUnhJAY

.claude/CLAUDE.md

@@ -13,7 +13,10 @@ a non-interactive JVM command-line client that drives the same `quartz` + `commo
 humans, agents, and interop tests. `quic` is a from-scratch pure-Kotlin QUIC v1 + HTTP/3 +
 WebTransport client (no JNI, no BouncyCastle), built because no Android-compatible Java QUIC library
 exists. `geode` is a standalone JVM Nostr relay (Ktor) built on quartz's
-relay-server code; smaller modules are `benchmark` (Android macrobenchmarks) and
+relay-server code; smaller modules are `benchmark` (Android macrobenchmarks),
+`relayBench` (head-to-head relay benchmark — boots geode, strfry and other
+relay binaries, replays a shared deterministic corpus, measures ingest/query/
+NIP-77 sync; `./relayBench/run.sh`, see `relayBench/README.md`) and
 `quic-interop` (QUIC interop runner, lives at `quic/interop`). `nestsClient` runs
 the audio-room protocol on top of `:quic` for the NIP-53 audio-rooms feature. It implements both IETF `draft-ietf-moq-transport-17` (under
 `moq/`) and **moq-lite Lite-03** (kixelated's variant, under `moq/lite/`); the
@@ -76,12 +79,44 @@ amethyst/
 - `nestsClient/` = MoQ + audio-rooms client; takes `:quic` as transport,
   Quartz for crypto, `MediaCodec` / `AudioRecord` / `AudioTrack` for audio.
 - `amethyst/` & `desktopApp/` = Platform-native layouts and navigation
-- `cli/` = Thin assembly layer over `quartz/` + `commons/` (no new logic allowed)
+- `cli/` = Thin assembly layer over `quartz/` + `commons/` (no new logic
+  allowed). May also depend on `:geode` (for `amy serve`, which embeds the
+  standalone relay); never on `:amethyst` or `:desktopApp`.
 
 **Plans per module:** design docs for new subsystems live in the owning
 module's `plans/YYYY-MM-DD-<slug>.md` (e.g. `cli/plans/`, `commons/plans/`).
 The global `docs/plans/` folder is frozen — don't add new plans there.
 
+## Android Runtime Processes (IMPORTANT — the app runs in TWO processes)
+
+The Android app is **not single-process**. Android instantiates the one `Amethyst`
+Application class (there is no per-process Application in the manifest) in **both**:
+
+- **main** — the normal app: UI, account, signer, `LocalCache`, relay client.
+  `Amethyst.instance` (`AppModules`) is built here.
+- **`:napplet`** — the sandboxed WebView host for NIP-5D napplets / NIP-5A nSites
+  (`NappletHostActivity`, declared `android:process=":napplet"`). It holds **no**
+  account or keys; `Amethyst.onCreate()` early-returns here so `Amethyst.instance`
+  is **left unset** (touching it throws `UninitializedPropertyAccessException`).
+  The sandbox runtime lives in its own module **`:nappletHost`** (depends only on
+  `:commons` + `:quartz`, **never** `:amethyst`) so it *cannot* import
+  `Amethyst`/`LocalCache`/`Account` — the broker-side (signer, gateways, registry)
+  stays in `:amethyst` and the two halves talk over Messenger IPC.
+
+Consequences — don't get caught assuming one process:
+
+- **Processes don't share memory.** Every `object`/companion/`static` is a
+  *separate copy per process*: `LocalCache` (an `object`), `NappletLaunchRegistry`,
+  etc. The populated `LocalCache` lives only in **main**; the sandbox neither
+  builds nor should reference it (a stray reference would lazily create a second,
+  empty cache there).
+- **Don't assume `Amethyst.instance` exists.** Any code reachable from `:napplet`
+  (the host activity, content server, or an Application lifecycle callback like
+  `onTrimMemory`) must guard on the process and never reach for `instance`.
+- **Cross-process state goes over Messenger IPC**, never a shared singleton — this
+  is why the broker (main) owns `NappletLaunchRegistry` and the sandbox only relays
+  an opaque token. See `amethyst/plans/2026-06-22-napplet-nsite-security.md`.
+
 ## Tech Stack
 
 Exact versions live in `gradle/libs.versions.toml` (the source of truth — check
@@ -245,3 +280,12 @@ Do this before considering the task complete.
 
 - Commits: Conventional commits (`feat:`, `fix:`, etc.)
 - Never use `--no-verify`
+
+### Remotes & pull requests
+
+A PR can be published two ways, via two **kinds** of remote — identify them by **URL** (`git remote -v`), because the names vary per clone and **a collaborator may have only one**:
+
+- a **GitHub** remote (`github.com/vitorpamplona/amethyst`) — the **canonical** `main`; moves constantly. Standard `gh` PR flow.
+- a **git-over-nostr** remote (`nostr://…/relay.ngit.dev/amethyst`, via `ngit`) — pushing fans out to GitHub **and** the GRASP git servers; **PRs here are nostr proposals** (the `pr/feat/*` branches), reviewed on **gitworkshop.dev** — *not* GitHub PRs. (In the maintainer's checkout these happen to be named `upstream` and `origin` respectively, but don't rely on that.)
+
+Before opening, revising, or merging a PR by **either** path, use the **`ngit-pr`** skill. It covers when to use which, identifying your remotes by URL, the `gh` and `ngit` commands, and — critically for the nostr path — the three-mains alignment gate (GitHub main vs the lagging nostr `main` vs local `main`) that its create/revise/merge flows depend on. Skipping it leads to rejected pushes and PRs that don't show up as revisions.

.claude/hooks/pre-push-spotless.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+# PreToolUse gate: make sure Kotlin is spotless-clean BEFORE it leaves the box.
+#
+# Fires on `git push` (Bash tool) and on the create_pull_request MCP tool. Runs
+# `spotlessApply`; if that reformats any tracked .kt/.kts file, the push/PR is
+# blocked (exit 2) so the agent commits the formatting fix first. This turns
+# CI's `spotlessCheck` failure into an in-session block — no red PR, no round
+# trip. `spotlessApply` runs the same formatters CI's `spotlessCheck` verifies,
+# so a clean apply means a green check.
+set -uo pipefail
+
+cd "${CLAUDE_PROJECT_DIR:-.}" || exit 0
+
+# --- Parse the tool call off stdin; decide whether this call is a boundary. ---
+payload="$(cat)"
+should_gate="$(
+  printf '%s' "$payload" | python3 -c '
+import json, shlex, sys
+try:
+    data = json.load(sys.stdin)
+except Exception:
+    print("no"); sys.exit(0)
+tool = data.get("tool_name", "")
+if tool.endswith("create_pull_request"):
+    print("yes"); sys.exit(0)
+if tool != "Bash":
+    print("no"); sys.exit(0)
+cmd = (data.get("tool_input") or {}).get("command", "")
+# Tokenize like a shell so `push` inside a quoted commit message or heredoc
+# stays one token and is NOT mistaken for the push subcommand.
+try:
+    tokens = shlex.split(cmd, comments=True)
+except ValueError:
+    tokens = cmd.split()
+GLOBAL_WITH_ARG = {"-c", "-C", "--namespace", "--git-dir", "--work-tree", "--exec-path"}
+for i, t in enumerate(tokens):
+    if t != "git" and not t.endswith("/git"):
+        continue
+    j = i + 1
+    while j < len(tokens):  # skip git global options to reach the subcommand
+        tok = tokens[j]
+        if tok in GLOBAL_WITH_ARG:
+            j += 2; continue
+        if tok.startswith("-"):
+            j += 1; continue
+        break
+    if j < len(tokens) and tokens[j] == "push":
+        print("yes"); sys.exit(0)
+print("no")
+' 2>/dev/null
+)"
+
+[ "$should_gate" = "yes" ] || exit 0
+
+# Nothing to format if no Kotlin is tracked/changed at all — cheap early out.
+if ! git ls-files --error-unmatch '*.kt' '*.kts' >/dev/null 2>&1; then
+  exit 0
+fi
+
+# Snapshot Kotlin state (vs HEAD, so staged + unstaged both count) before/after
+# formatting; any delta means the committed tree wasn't spotless.
+before="$(git diff HEAD -- '*.kt' '*.kts' 2>/dev/null | sha1sum)"
+
+log="$(mktemp /tmp/spotless-gate.XXXXXX.log)"
+if ! ./gradlew spotlessApply >"$log" 2>&1; then
+  # Distinguish a formatting failure (block) from Gradle being unable to RUN —
+  # e.g. deps can't resolve in a restricted sandbox. An infra failure must not
+  # strand the agent; warn and let CI's spotlessCheck be the backstop.
+  if grep -qiE "could not resolve|could not (get|download)|handshake|connect timed out|no address|unable to (find|resolve) host|read timed out" "$log"; then
+    echo "WARN: could not run spotlessApply (Gradle infra/network failure), skipping the formatting gate." >&2
+    echo "      CI's spotlessCheck still enforces formatting on the PR." >&2
+    rm -f "$log"
+    exit 0
+  fi
+  echo "BLOCKED: spotlessApply failed — fix the build/formatting error before pushing." >&2
+  echo "----- gradle output (tail) -----" >&2
+  tail -n 40 "$log" >&2
+  rm -f "$log"
+  exit 2
+fi
+rm -f "$log"
+
+after="$(git diff HEAD -- '*.kt' '*.kts' 2>/dev/null | sha1sum)"
+
+if [ "$before" != "$after" ]; then
+  echo "BLOCKED: spotlessApply reformatted Kotlin files that were about to be pushed." >&2
+  echo "The changes below are now in your working tree. Commit them, then retry:" >&2
+  echo >&2
+  git diff --name-only HEAD -- '*.kt' '*.kts' >&2
+  echo >&2
+  echo "  git add -A && git commit -m 'style: apply spotless' && <retry the push>" >&2
+  echo "(CI runs 'spotlessCheck'; pushing now would fail the lint job.)" >&2
+  exit 2
+fi
+
+exit 0

.claude/settings.json

@@ -1,5 +1,17 @@
 {
   "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash|mcp__github__create_pull_request",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/pre-push-spotless.sh",
+            "timeout": 180
+          }
+        ]
+      }
+    ],
     "SessionStart": [
       {
         "hooks": [

.claude/skills/amy-expert/SKILL.md

@@ -129,10 +129,12 @@ via `Output.emit`. The template is in `references/command-template.md`;
 copy it rather than re-deriving it.
 
 Wire-up checklist:
-1. New file in `cli/commands/` with the `object` pattern.
-2. Add a branch in `Commands.kt`.
-3. Add a branch in `Main.kt`'s `dispatch` (or under `marmotDispatch`
-   / a new group dispatcher).
+1. New file in `cli/commands/` with the `object` pattern. Sub-verb
+   `dispatch` functions use the shared `route(...)` helper in
+   `Router.kt` rather than a hand-rolled `when (tail[0])`.
+2. Add a branch in `Main.kt`'s `dispatch` (top-level verbs call the
+   command object directly, e.g. `"relay" -> RelayCommands.dispatch(…)`;
+   `marmot` sub-verbs go through `marmotDispatch`'s `route` map).
 4. Extend `printUsage()` in `Main.kt`.
 5. Add the row to `cli/README.md`'s command table.
 6. Update `cli/ROADMAP.md` — move the row from 🆕 / 📦 to ✅.
@@ -173,6 +175,7 @@ cli/
     ├── secrets/           # SecretStore backends (keychain / ncryptsec / plaintext)
     └── commands/          # one file (or group) per top-level verb
         ├── UseCommand.kt          # `amy use NAME`
+        ├── Router.kt              # `route(...)` shared sub-verb dispatcher
         ├── InitCommands.kt        # init, whoami
         ├── CreateCommand.kt + LoginCommand.kt
         ├── RelayCommands.kt
@@ -186,15 +189,30 @@ cli/
         ├── MessageCommands.kt
         ├── MarmotResetCommand.kt
         ├── AwaitCommands.kt
-        └── StoreCommands.kt
+        ├── StoreCommands.kt
+        ├── AdminCommand.kt        # `amy admin RELAY METHOD` (NIP-86)
+        ├── ServeCommand.kt        # `amy serve` (embeds :geode)
+        └── cashu/                 # `amy cashu …` (NIP-60/61) — thin wrappers
+            ├── CashuCommands.kt   #   over commons CashuWalletOps / CashuWalletReader
+            ├── CashuWalletCommands.kt + CashuBalanceCommand.kt + CashuMintCommands.kt
+            └── CashuReceiveCommands.kt + CashuSendCommands.kt
+                + CashuMaintenanceCommands.kt + CashuMintRecCommands.kt
 ```
 
 Shared logic consumed by Amy lives in `commons/`:
 - `commons/account/` — account bootstrap
 - `commons/marmot/` — MLS / group state
+- `commons/cashu/` — `ops/CashuWalletOps` (jvmAndroid) + `CashuWalletReader`
+  + `CashuKeysetCounterStore`; the NIP-60/61 wallet, shared with Android.
+- `commons/relayManagement/Nip86Retriever` — NIP-86 HTTP client, shared with
+  the Android relay-management screen.
 - `commons/defaults/` — default relays, kinds
 - Consult `commons/plans/` for cross-cutting design work in flight.
 
+A few amy verbs lean on modules beyond `quartz`/`commons`: `amy serve`
+depends on `:geode` (the standalone relay) — the one allowed extra module
+dependency. `:amethyst` / `:desktopApp` remain forbidden (Rule 5).
+
 ## Common mistakes to refuse
 
 - **Adding protocol logic to `cli/`.** Push back, offer to extract.

.claude/skills/amy-expert/references/command-template.md

@@ -18,8 +18,7 @@ object NotePublishCommand {
         val args = Args(rest)
         val text = args.positional(0, "text")
 
-        val ctx = Context.open(dataDir)
-        try {
+        Context.open(dataDir).use { ctx ->
             ctx.prepare()
 
             val event = com.vitorpamplona.amethyst.commons.note
@@ -33,13 +32,15 @@ object NotePublishCommand {
                 "rejected_by"   to ack.filterValues { !it }.keys.map { it.url },
             ))
             return 0
-        } finally {
-            ctx.close()
         }
     }
 }
 ```
 
+`Context` is `AutoCloseable`; wrap it in `use { }` so it's closed
+(RunState flushed, relays disconnected) on every exit path — never a
+hand-rolled `try { } finally { ctx.close() }`.
+
 `Output.emit(...)` handles the text-vs-JSON mode automatically. The
 result map IS the `--json` shape; the human-readable text default is
 derived from the same map by `Output.kt`'s renderer.
@@ -51,39 +52,34 @@ When a feature has several verbs (`note publish`, `note show`,
 
 ```kotlin
 object NoteCommands {
-    suspend fun dispatch(dataDir: DataDir, tail: Array<String>): Int {
-        if (tail.isEmpty()) return Output.error("bad_args", "note <publish|show|react>")
-        val rest = tail.drop(1).toTypedArray()
-        return when (tail[0]) {
-            "publish" -> NotePublishCommand.run(dataDir, rest)
-            "show"    -> NoteShowCommand.run(dataDir, rest)
-            "react"   -> NoteReactCommand.run(dataDir, rest)
-            else      -> Output.error("bad_args", "note ${tail[0]}")
-        }
-    }
+    suspend fun dispatch(dataDir: DataDir, tail: Array<String>): Int =
+        route("note", tail, "note <publish|show|react>", mapOf(
+            "publish" to { rest -> NotePublishCommand.run(dataDir, rest) },
+            "show"    to { rest -> NoteShowCommand.run(dataDir, rest) },
+            "react"   to { rest -> NoteReactCommand.run(dataDir, rest) },
+        ))
 }
 ```
 
-Each verb gets its own file. Once a single file crosses ~200 lines,
-split it — see `GroupCommands.kt` and its siblings as the reference.
+The shared `route(name, tail, usage, routes)` helper (`Router.kt`)
+handles the empty-input and unknown-verb `bad_args` branches, so the
+`dispatch` body is just the verb→handler map. Each verb gets its own
+file. Once a single file crosses ~200 lines, split it — see
+`GroupCommands.kt` and its siblings as the reference.
 
 ## Wire-up checklist
 
 For every new command:
 
 1. File under `cli/commands/`.
-2. Branch in `Commands.kt`:
+2. Branch in `Main.kt`'s top-level `dispatch`, calling the command
+   object directly:
    ```kotlin
-   suspend fun note(dataDir: DataDir, tail: Array<String>): Int =
-       NoteCommands.dispatch(dataDir, tail)
+   "note" -> NoteCommands.dispatch(dataDir, tail)
    ```
-3. Branch in `Main.kt`'s top-level `dispatch`:
-   ```kotlin
-   "note" -> Commands.note(dataDir, tail)
-   ```
-4. Line in `printUsage()` explaining the verb.
-5. Row in `cli/README.md`'s command table.
-6. Status flip in `cli/ROADMAP.md` (🆕 / 📦 → ✅).
+3. Line in `printUsage()` explaining the verb.
+4. Row in `cli/README.md`'s command table.
+5. Status flip in `cli/ROADMAP.md` (🆕 / 📦 → ✅).
 
 ## What not to do
 
@@ -95,7 +91,7 @@ For every new command:
   them to `error: …` (text mode) / `{"error":…}` (JSON mode) plus the
   right exit code.
 - No holding a connection open across invocations — every run opens
-  a fresh `Context` and closes it in `finally`.
+  a fresh `Context` inside `use { }` so it closes on every exit path.
 - No blocking reads for user input — take a flag.
 - No global flags that collide with subcommand flags. `--name` is
   reserved for subcommand use (group/profile name); the global

.claude/skills/find-missing-translations/SKILL.md

@@ -38,11 +38,17 @@ The default set of locales (unless the user specifies otherwise):
 
 | Locale | Language | Directory |
 |--------|----------|-----------|
-| `cs-rCZ` | Czech | `values-cs-rCZ` |
+| `cs` | Czech | `values-cs` |
 | `pt-rBR` | Brazilian Portuguese | `values-pt-rBR` |
 | `sv-rSE` | Swedish | `values-sv-rSE` |
 | `de-rDE` | German | `values-de-rDE` |
 
+> Czech was consolidated onto the base qualifier (PR #3461, 2026-07-03): a
+> `cs: cs` `languages_mapping` entry in `crowdin.yml` makes Crowdin export to
+> `values-cs`, and `values-cs-rCZ` no longer exists. The other locales still
+> use Crowdin's default region-qualified `androidCode` until they are
+> consolidated the same way — update this table as each one moves.
+
 ## Technique
 
 ### 1. Identify files
@@ -52,9 +58,9 @@ Default:  amethyst/src/main/res/values/strings.xml
 Target:   amethyst/src/main/res/values-<locale>/strings.xml
 ```
 
-### 2. Find missing keys using cs-rCZ as reference
+### 2. Find missing keys using cs as reference
 
-Always diff against `cs-rCZ` first — it is the most complete locale and serves as the reference. Any keys missing in `cs-rCZ` will also be missing in the other target locales.
+Always diff against `cs` first — it is the most complete locale and serves as the reference. Any keys missing in `cs` will also be missing in the other target locales.
 
 You MUST diff **both** `<string name=` AND `<plurals name=` — these are independent resource types and a key that is a `<plurals>` in the source will never appear in a `<string>` diff. Forgetting `<plurals>` is the most common silent failure of this skill (it misses things like `music_playlist_track_count`, `notification_count_more`, etc.).
 
@@ -65,7 +71,7 @@ comm -23 \
   <(grep '<string name=' amethyst/src/main/res/values/strings.xml \
     | grep -v 'translatable="false"' \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort) \
-  <(grep '<string name=' amethyst/src/main/res/values-cs-rCZ/strings.xml \
+  <(grep '<string name=' amethyst/src/main/res/values-cs/strings.xml \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort)
 
 # Plurals: a separate resource type — MUST be diffed independently
@@ -73,16 +79,16 @@ echo "=== missing <plurals> ==="
 comm -23 \
   <(grep '<plurals name=' amethyst/src/main/res/values/strings.xml \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort) \
-  <(grep '<plurals name=' amethyst/src/main/res/values-cs-rCZ/strings.xml \
+  <(grep '<plurals name=' amethyst/src/main/res/values-cs/strings.xml \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort)
 ```
 
 This gives two lists of missing key names — keep them separate; `<plurals>` translations need the per-locale CLDR category set (see Step 5 → "Plurals: handle with care").
 
-Crowdin can asymmetrically strip keys across locales (each translator independently chose source-identical for different keys), so **cs-rCZ is not a reliable upper bound**. Diff **every** target locale and union the results — don't assume the cs-rCZ set covers the others. A quick per-locale count is a useful sanity check against the Crowdin UI's "N untranslated":
+Crowdin can asymmetrically strip keys across locales (each translator independently chose source-identical for different keys), so **cs is not a reliable upper bound**. Diff **every** target locale and union the results — don't assume the cs set covers the others. A quick per-locale count is a useful sanity check against the Crowdin UI's "N untranslated":
 
 ```bash
-for locale in cs-rCZ de-rDE sv-rSE pt-rBR; do
+for locale in cs de-rDE sv-rSE pt-rBR; do
   ns=$(comm -23 \
     <(grep '<string name=' amethyst/src/main/res/values/strings.xml \
       | grep -v 'translatable="false"' | sed 's/.*name="\([^"]*\)".*/\1/' | sort) \
@@ -111,7 +117,7 @@ done < <(comm -23 \
   <(grep '<string name=' amethyst/src/main/res/values/strings.xml \
     | grep -v 'translatable="false"' \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort) \
-  <(grep '<string name=' amethyst/src/main/res/values-cs-rCZ/strings.xml \
+  <(grep '<string name=' amethyst/src/main/res/values-cs/strings.xml \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort))
 
 # Missing <plurals>: extract the multi-line block (opening tag through </plurals>)
@@ -124,7 +130,7 @@ while IFS= read -r key; do
 done < <(comm -23 \
   <(grep '<plurals name=' amethyst/src/main/res/values/strings.xml \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort) \
-  <(grep '<plurals name=' amethyst/src/main/res/values-cs-rCZ/strings.xml \
+  <(grep '<plurals name=' amethyst/src/main/res/values-cs/strings.xml \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort))
 ```
 
@@ -199,7 +205,7 @@ done < <(comm -23 \
   <(grep '<string name=' amethyst/src/main/res/values/strings.xml \
     | grep -v 'translatable="false"' \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort) \
-  <(grep '<string name=' amethyst/src/main/res/values-cs-rCZ/strings.xml \
+  <(grep '<string name=' amethyst/src/main/res/values-cs/strings.xml \
     | sed 's/.*name="\([^"]*\)".*/\1/' | sort))
 ```
 
@@ -261,7 +267,7 @@ When adding translated strings to locale files:
 - **Diffing only `<string name=`** — `<plurals>` is a separate resource type; a source `<plurals>` missing from a locale will never show up in a `<string>` diff. Always run the diff twice (once per resource type) as shown in Step 2. The same goes for `<string-array>` if the project uses it.
 - **Trusting a git "sync-timestamp" heuristic to pre-filter the list** — this skill used to skip keys added before the last `New Crowdin translations` commit, on the theory that Crowdin had already "decided" them. It was dropped: a key added shortly before an export that translators hadn't reached yet is genuinely missing, so the heuristic silently dropped real work. Use the raw on-disk diff and reconcile against the Crowdin web UI's untranslated count instead.
 - **Adding source-identical fallbacks locally** — they get overwritten on the next Crowdin sync. Android falls back to `values/strings.xml` at runtime anyway, so a key intentionally kept as English already renders correctly. Skip these by inspection (brand terms, loanwords, `v%1$s`-style strings); don't translate them to an identical value.
-- **Skipping per-locale diffs when only diffing cs-rCZ** — Crowdin can strip different keys in different locales (each translator's choice), so cs-rCZ is not a reliable upper bound. Diff each target locale and union the results.
+- **Skipping per-locale diffs when only diffing cs** — Crowdin can strip different keys in different locales (each translator's choice), so cs is not a reliable upper bound. Diff each target locale and union the results.
 - **Inserting strings in a specific position** — always append at the bottom; ordering is handled separately
 - **Hardcoding `"1"` in a `<plurals>` `quantity="one"` item** — always use the count placeholder; otherwise non-English `one` categories produce wrong text
 - **Copying English's `one`/`other` set into every locale** — each language must include all CLDR plural categories it uses (e.g. Czech needs `one`, `few`, `many`, `other`)

.claude/skills/ngit-pr/SKILL.md

@@ -0,0 +1,183 @@
+---
+name: ngit-pr
+description: How to create, review, revise, and merge pull requests in this repo, which can be published TWO ways — GitHub (the `gh` CLI) and git-over-nostr (the `ngit` CLI, where PRs are nostr **proposals** reviewed on gitworkshop.dev). Use whenever a task involves opening/updating/merging a PR by either mechanism, the `pr/feat/*` branches, the `ngit` or `gh` CLIs, gitworkshop.dev, or a `nostr://` remote. Remote names vary per clone (and a collaborator may have only one) — this skill identifies remotes by URL, and covers the three-mains alignment gate the nostr flow depends on.
+---
+
+# Pull requests: GitHub **and** git-over-nostr
+
+This repo can be contributed to **two** ways, via **two kinds** of remote. Both end up in GitHub `main`.
+
+| Remote kind | URL pattern | Role |
+|--|--|--|
+| **GitHub** | `github.com/vitorpamplona/amethyst` | **Canonical** `main`. Moves constantly (bots merge often) — a moving target. |
+| **git-over-nostr** | `nostr://…/relay.ngit.dev/amethyst` | `ngit`. A push fans out to GitHub **and** the GRASP git servers and publishes nostr events. PRs are **proposals**, reviewed on **gitworkshop.dev**. |
+
+## Step 0 — identify YOUR remotes (names are not universal)
+
+Remote **names are per-clone**. In the maintainer's checkout the GitHub remote is `upstream` and the nostr remote is `origin`, but yours may differ, and **you may have only one of them** (e.g. cloned straight from `nostr://…`, so the nostr remote is your `origin` and there is no separate GitHub remote — pushing it still reaches GitHub via fan-out). Detect by **URL**, never assume a name:
+
+```bash
+git remote -v
+GH_REMOTE=$(git remote -v    | awk '/github\.com/   {print $1; exit}')   # GitHub remote (may be empty)
+NOSTR_REMOTE=$(git remote -v | awk '/nostr:\/\//     {print $1; exit}')  # git-over-nostr remote (may be empty)
+echo "github=$GH_REMOTE  nostr=$NOSTR_REMOTE"
+```
+
+The examples below use `$GH_REMOTE` / `$NOSTR_REMOTE` — substitute whichever you have.
+
+## Which path?
+
+| | **GitHub path** (`gh`) | **nostr path** (`ngit`) |
+|--|--|--|
+| Needs | a GitHub remote + `gh auth status` | a `nostr://` remote + `ngit` ≥ 2.5.0 |
+| PR lives on | GitHub only | nostr + GitHub + GRASP (fans out) |
+| Use when | Default; PR only needs to be on GitHub. Simplest, no alignment gate. | The PR must be visible/reviewable over nostr (gitworkshop), or you're revising/merging an existing **proposal** (a `pr/feat/*`). |
+
+**Default to GitHub** unless the task is specifically about a nostr proposal (e.g. "the PRs on origin", a gitworkshop link, a `pr/feat/*` branch). If you only have one remote, that decides the path for you. Revise/merge a PR on **the same path it was created** — don't revise a GitHub PR via ngit or vice-versa.
+
+---
+
+# GitHub path (`gh`)
+
+The normal flow most of this repo's history uses ("Merge pull request #NNNN …"). Requires a GitHub remote (`$GH_REMOTE`) and `gh auth status` OK.
+
+```bash
+# create — branch off main, push, open the PR
+git checkout -b feat/<slug> main
+git push -u "$GH_REMOTE" feat/<slug>
+gh pr create --repo vitorpamplona/amethyst --base main --head feat/<slug> \
+  --title "feat: …" --body "…"
+
+# review / list
+gh pr list --repo vitorpamplona/amethyst
+gh pr view <number> --repo vitorpamplona/amethyst   # --comments for the thread
+
+# revise — push more commits to the same branch
+git push "$GH_REMOTE" feat/<slug>
+
+# merge (maintainer)
+gh pr merge <number> --repo vitorpamplona/amethyst --merge   # or --squash
+```
+
+GitHub is the source of truth for this path — no three-mains gate. Standard Git Workflow rules from CLAUDE.md still apply (conventional commits, never `--no-verify`).
+
+---
+
+# nostr path (`ngit`)
+
+Requires a `nostr://` remote (`$NOSTR_REMOTE`) and `ngit` ≥ 2.5.0 (`ngit --version`).
+
+**Mental model:** an ngit PR ("proposal") is a *linear patch series off `main`*, published as nostr events. A "revision" is a new version of that proposal. Merging applies the series to `main` and publishes a merged-status event. There is **no** GitHub PR number; `ngit pr merge` makes a plain merge commit (amend it to a readable message).
+
+## ⚠ The three-mains alignment gate (the thing that breaks everything)
+
+Up to **three** `main` heads drift apart:
+
+- GitHub main (`$GH_REMOTE/main` if you have it) — newest, moves every few minutes
+- nostr main (`$NOSTR_REMOTE/main` tracking ref) — **lags**, often far behind
+- local `main`
+
+**Every create/revise/merge requires the proposal's base to equal the nostr `main`, and pushing `main` to the nostr remote requires GitHub's main to be an ancestor of what you push.** When misaligned, ngit **rejects pre-flight and publishes nothing** (safe — nothing half-breaks; realign and retry). Don't `--force` past it.
+
+```bash
+git fetch --all
+echo "github=$([ -n "$GH_REMOTE" ] && git rev-parse "$GH_REMOTE/main")  \
+nostr=$(git ls-remote "$NOSTR_REMOTE" -h refs/heads/main | awk '{print $1}')  \
+local=$(git rev-parse main)"
+# all present heads equal → proceed.
+# local behind GitHub?  git merge --ff-only "$GH_REMOTE/main"  (or "$NOSTR_REMOTE/main" if that's all you have)
+# nostr behind local?   git push "$NOSTR_REMOTE" main   (clean fast-forward only)
+```
+
+If you have **only** the nostr remote: align local `main` to `$NOSTR_REMOTE/main`; GitHub is handled by fan-out, and any GitHub/GRASP disagreement surfaces as an ngit rejection on push. If GitHub diverged from nostr (`out of sync with nostr` on push), that's a maintainer `ngit sync --ref-name refs/heads/main --force` situation — **stop and ask the human**, don't run a forced sync unprompted.
+
+## Pushes are slow — run them in the background
+
+`git push "$NOSTR_REMOTE" …`, `ngit send`, and `ngit pr merge` fan out to relays + GRASP servers and **routinely exceed 2 minutes**. Run with `run_in_background: true` and poll (e.g. `git ls-remote "$NOSTR_REMOTE"` for the expected ref). A foreground call hits the 2-minute tool timeout even while the push is actually succeeding.
+
+## Identity
+
+`ngit account whoami` shows the signing key; `ngit send`/`ngit pr merge` sign with **that** key regardless of original author. The maintainer (`VitorPamplona`, `_@vitorpamplona.com`) revising/merging a contributor's proposal with their own key is expected.
+
+## List / view
+
+```bash
+ngit pr list                                   # open + draft
+ngit pr list --status open,draft,closed,merged,applied
+ngit pr view <FULL-hex-event-id | nevent>      # FULL id, not the short prefix
+```
+
+In `git branch -r`, proposals show as `<nostr-remote>/pr/feat/<slug>(<short-id>)` — the `(...)` is an ngit annotation; the real ref is `pr/feat/<slug>`. Status `applied` == merged.
+
+## Create
+
+Push a `pr/`-prefixed branch (linear, off current `main`):
+
+```bash
+git push -o 'title=My title' -o 'description=line1\n\nline2' -u "$NOSTR_REMOTE" pr/feat/<slug>
+```
+
+Advanced (cover letter, labels): `ngit send` — see `ngit send --help`.
+
+## Revise (publish a new version)
+
+The revision must be a **linear series off the current `main`** (a merge commit is the wrong shape).
+
+```bash
+# 1. align (gate above), then build the linear series:
+git checkout -b <work> main
+git cherry-pick <original-pr-tip>      # existing PR commits
+git cherry-pick <your-new-commits…>    # yours on top   (or: git rebase main)
+
+# 2. verify it compiles + tests pass; tree == your intended change.
+
+# 3. publish as a new version, linked to the proposal:
+ngit send --in-reply-to <proposal-nevent> \
+  --subject "<keep or update title>" \
+  --description "<what changed>" \
+  -d main                              # SINCE_OR_RANGE "main" → commits in main..HEAD
+```
+
+`--in-reply-to` threads it under the same proposal on gitworkshop. **No `--force`** once the base equals the nostr `main`. `proposal builds on a commit N ahead of 'origin/main'` ⇒ gate unmet — realign and re-rebase, don't force. Verify: `git ls-remote "$NOSTR_REMOTE" | grep <short-id>` shows `refs/pr/<full-id>/head` at your new tip.
+
+## Merge into main
+
+The merge is **local**; the merged-status event publishes on the subsequent push.
+
+```bash
+# 1. ALIGN (mandatory) — all present mains equal.
+
+git checkout main
+ngit pr merge <FULL-hex-event-id> -d        # local merge commit; marks proposal "applied"
+                                            #   --squash for a squash merge
+
+# 2. amend the generic merge message to something readable:
+git commit --amend -F - <<'MSG'
+Merge PR: <title>
+
+Merges nostr proposal <short-id> into main:
+- <commit summaries>
+
+Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+MSG
+
+# 3. sanity-check, then publish (background — slow):
+[ -n "$GH_REMOTE" ] && { git merge-base --is-ancestor "$GH_REMOTE/main" HEAD && echo "clean FF push" || echo "github moved; realign"; }
+git push "$NOSTR_REMOTE" main
+```
+
+Confirm: `ngit pr list --status applied` shows it `applied`, and (if you have it) `git fetch "$GH_REMOTE"` fast-forwards GitHub's main to your merge.
+
+## Cleanup
+
+Delete throwaway branches pushed to the nostr remote (e.g. a `merge/*` used before switching to the proper flow): `git push "$NOSTR_REMOTE" --delete <branch>` (the per-GRASP "non-existent ref" warnings are idempotent fan-out). Delete the local merged branches ngit creates (`pr/feat/<slug>(...)`) and your work branch.
+
+## Failure modes — quick reference
+
+| Symptom | Cause | Fix |
+|---------|-------|-----|
+| `proposal builds on a commit N ahead of 'origin/main'` | base ≠ stale nostr `main` | realign `main`, rebase series, resend (no `--force`) |
+| `! [remote rejected] main … out of sync with nostr` | GitHub main diverged from nostr | maintainer `ngit sync … --force` — **ask the human** |
+| push "succeeds" but nothing on gitworkshop | pushed a plain branch, not a proposal | use `pr/`-prefix or `ngit send --in-reply-to` |
+| `ngit pr view`/`merge` "failed to parse event id" | used the short prefix | pass the **full** hex id or `nevent` |
+| push hangs / times out at 2 min | normal GRASP fan-out latency | run in background; verify via `git ls-remote` |

.claude/skills/nostr-expert/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: nostr-expert
-description: Nostr protocol implementation patterns in Quartz (AmethystMultiplatform's KMP Nostr library). Use when working with: (1) Nostr events (creating, parsing, signing), (2) Event kinds and tags, (3) NIP implementations (80+ NIP packages in quartz/), (4) Event builders and TagArrayBuilder DSL, (5) Nostr cryptography (secp256k1, NIP-44 encryption), (6) Relay communication patterns, (7) Bech32 encoding (npub, nsec, note, nevent). Complements nostr-protocol agent (NIP specs) - this skill provides Quartz codebase patterns and implementation details.
+description: Nostr protocol implementation patterns in Quartz (AmethystMultiplatform's KMP Nostr library). Use when working with: (1) Nostr events (creating, parsing, signing), (2) Event kinds and tags, (3) NIP implementations (80+ NIP packages in quartz/), (4) Event builders and TagArrayBuilder DSL, (5) Nostr cryptography (secp256k1, NIP-44 encryption), (6) Relay communication patterns, (7) Bech32 encoding (npub, nsec, note, nevent), (8) Resolving user input (hex, npub, nprofile, or NIP-05 `name@domain` internet identifiers) to a pubkey. Complements nostr-protocol agent (NIP specs) - this skill provides Quartz codebase patterns and implementation details.
 ---
 
 # Nostr Protocol Expert (Quartz Implementation)
@@ -15,6 +15,7 @@ Practical patterns for working with Nostr in Quartz, AmethystMultiplatform's KMP
 - Finding NIP implementations in quartz/ codebase
 - Nostr cryptography (secp256k1 signing, NIP-44 encryption)
 - Bech32 encoding/decoding (npub, nsec, note formats)
+- Resolving user input (hex / npub / nprofile / NIP-05 `name@domain`) to a pubkey
 - Event validation and verification
 
 **For NIP specifications** → Use `nostr-protocol` agent
@@ -345,6 +346,55 @@ object Nip04 {
 
 **Note**: Use NIP-44 (`Nip44`) for new implementations. NIP-04 has security issues.
 
+## Hex Encoding (HexKey ↔ ByteArray)
+
+Pubkeys, event ids and signatures are lower-case hex. Quartz uses the `HexKey`
+typealias (`= String`) plus extensions in `nip01Core/core/HexKey.kt`, backed by
+the `Hex` object in `utils/Hex.kt`. **Use these — never hand-roll a byte loop or
+import a third-party hex codec.**
+
+```kotlin
+import com.vitorpamplona.quartz.nip01Core.core.toHexKey
+import com.vitorpamplona.quartz.nip01Core.core.hexToByteArray
+import com.vitorpamplona.quartz.nip01Core.core.hexToByteArrayOrNull
+import com.vitorpamplona.quartz.nip01Core.core.isValid
+import com.vitorpamplona.quartz.utils.Hex
+
+val hex: HexKey = bytes.toHexKey()            // ByteArray -> lower-case hex
+val back: ByteArray = hex.hexToByteArray()    // hex -> ByteArray (throws on odd length)
+val safe: ByteArray? = input.hexToByteArrayOrNull()  // null on invalid hex
+
+Hex.isHex(input)     // valid hex, any length
+Hex.isHex64(input)   // ~30% faster fast-path for a 32-byte key/id
+hex.isValid()        // 64 chars + valid hex (pubkey / event-id shape)
+Hex.isEqual(hex, bytes)  // compare hex to bytes without decoding
+```
+
+Constants `PUBKEY_LENGTH` / `EVENT_ID_LENGTH` (both 64) live in `nip01Core.core`.
+
+## Core Utilities (time, random, event id)
+
+Reuse these instead of hand-rolling — each avoids a common mistake:
+
+```kotlin
+import com.vitorpamplona.quartz.utils.TimeUtils
+import com.vitorpamplona.quartz.utils.RandomInstance
+import com.vitorpamplona.quartz.utils.sha256.sha256
+import com.vitorpamplona.quartz.nip01Core.crypto.EventHasher
+
+TimeUtils.now()            // Unix SECONDS for created_at — not currentTimeMillis()/1000
+TimeUtils.oneHourAgo()     // relative filter bounds (…Ago / …FromNow); all in seconds
+RandomInstance.bytes(32)   // secure random (SecureRandom) — for nonces/keys, not kotlin.random.Random
+RandomInstance.randomChars()   // 16-char subscription id
+
+sha256(bytes)              // raw hash primitive
+EventHasher.hashId(pubKey, createdAt, kind, tags, content)   // canonical event id
+EventHasher.hashIdCheck(id, pubKey, createdAt, kind, tags, content)  // verify untrusted events
+```
+
+`EventHasher` serializes `[0, pubkey, created_at, kind, tags, content]` in the
+exact form NIP-01 requires — prefer it over calling `sha256` on your own JSON.
+
 ## Bech32 Encoding (NIP-19)
 
 Encoding uses extension functions on `ByteArray` (`nip19Bech32/ByteArrayExt.kt`);
@@ -375,6 +425,25 @@ when (val entity = Nip19Parser.uriToRoute(input)?.entity) {
 }
 ```
 
+## Resolving User Input to a Pubkey (NIP-05 + NIP-19)
+
+**Before writing any `if (isHex) … else if (npub) … else if ("@" in s) fetchWellKnown()` logic, stop — it already exists.** `resolveUserHexOrNull` in `quartz/nip05DnsIdentifiers/` accepts every identifier form a user might type and returns a 64-hex pubkey.
+
+```kotlin
+import com.vitorpamplona.quartz.nip05DnsIdentifiers.resolveUserHexOrNull
+
+// hex | npub1… | nprofile1… | nsec1… | name@domain.tld  →  HexKey? (null if unrecognized/lookup fails)
+val pubkey = resolveUserHexOrNull(userInput, nip05Client)
+```
+
+- Tries the **synchronous** hex/bech32 path first (`decodePublicKeyAsHexOrNull`) — only NIP-05-shaped input hits the network.
+- `suspend`; re-throws only `CancellationException`. Pass `nip05Client = null` for offline contexts.
+- Build the client with `Nip05Client(fetcher = OkHttpNip05Fetcher { _ -> okHttp })` (see `cli/Context.kt`). The OkHttp fetcher already runs on IO and disables redirects per the NIP-05 spec — don't re-implement the `.well-known/nostr.json` fetch or JSON parse.
+- Need only hex/bech32 (no network)? Use `decodePublicKeyAsHexOrNull(input)` directly.
+- Need to *verify* a claimed identifier maps back to a pubkey? `nip05Client.verify(Nip05Id.parse(id)!!, pubkey)`.
+
+See `references/nip05-identifiers.md` for the full API surface (`Nip05Id`, `Nip05Client`, `Nip05Parser`, `KeyInfoSet`, Namecoin `.bit`) and the hand-rolled anti-pattern to avoid.
+
 ## Event Validation
 
 ```kotlin
@@ -503,6 +572,7 @@ Or see `references/nip-catalog.md` for complete catalog.
 - **references/event-hierarchy.md** - Event class hierarchy, kind classifications, common types
 - **references/tag-patterns.md** - Tag structure, TagArrayBuilder DSL, common tag types, parsing patterns
 - **references/nip19-bech32.md** - `Nip19Parser`, `Bech32Util`, `TlvBuilder`, entity types (NPub, NSec, NEvent, NAddress, NProfile, NRelay, NEmbed)
+- **references/nip05-identifiers.md** - Resolving any identifier (hex/npub/nprofile/nsec/`name@domain`) to a pubkey via `resolveUserHexOrNull`; `Nip05Client`, `Nip05Id`, `Nip05Parser`, Namecoin `.bit` — and the hand-rolled anti-pattern to avoid
 - **references/event-factory.md** - `EventFactory` dispatch pattern and how to register a new kind
 - **references/crypto-and-encryption.md** - Event signing/verification, secp256k1 abstraction, NIP-44 encryption, `SharedKeyCache`
 - **references/large-cache.md** - `LargeCache<K,V>` expect/actual + `ICacheOperations` functional API
@@ -518,6 +588,9 @@ Or see `references/nip-catalog.md` for complete catalog.
 | Verify signature | `event.verify()` | nip01Core/core/ |
 | Encrypt (NIP-44) | `Nip44v2.encrypt(...)` | nip44Encryption/ |
 | Bech32 encode | `Nip19.npubEncode(...)` | nip19Bech32/ |
+| Resolve input → pubkey | `resolveUserHexOrNull(input, nip05Client)` | nip05DnsIdentifiers/ |
+| Decode bech32 → pubkey (no net) | `decodePublicKeyAsHexOrNull(input)` | nip19Bech32/ |
+| Verify NIP-05 identifier | `nip05Client.verify(Nip05Id.parse(id)!!, hex)` | nip05DnsIdentifiers/ |
 | Find NIP | `scripts/nip-lookup.sh <number>` | - |
 
 ## Common Event Kinds

.claude/skills/nostr-expert/references/nip-catalog.md

@@ -13,7 +13,7 @@ under `experimental/`**. The categorized list below may lag behind —
 | 02 | `nip02FollowList/` | ContactListEvent.kt | Follow/contact lists (kind 3) |
 | 03 | `nip03Timestamp/` | OpenTimestampsAttestation.kt | Timestamps |
 | 04 | `nip04Dm/` | EncryptedDmEvent.kt | Legacy encrypted DMs (deprecated for NIP-17) |
-| 05 | `nip05DnsIdentifiers/` | Nip05Verifier.kt | DNS-based verification |
+| 05 | `nip05DnsIdentifiers/` | UserHexResolver.kt, Nip05Client.kt | Internet identifiers; `resolveUserHexOrNull` resolves hex/npub/nprofile/`name@domain` → pubkey (see references/nip05-identifiers.md) |
 | 06 | `nip06KeyDerivation/` | Mnemonic-related | BIP-39 key derivation |
 | 09 | `nip09Deletions/` | DeletionEvent.kt | Event deletion requests (kind 5) |
 | 11 | `nip11RelayInfo/` | RelayInformation.kt | Relay metadata |

.claude/skills/nostr-expert/references/nip05-identifiers.md

@@ -0,0 +1,98 @@
+# NIP-05: Identifiers → Pubkey Resolution
+
+How Quartz turns anything a human might type — a raw hex pubkey, an `npub`/`nprofile`/`nsec`, or a NIP-05 internet identifier (`alice@domain.tld`) — into a 64-hex Nostr pubkey. **Everything below already exists in `quartz/nip05DnsIdentifiers/`. Do not hand-roll it.**
+
+## TL;DR — the one function you almost always want
+
+```kotlin
+import com.vitorpamplona.quartz.nip05DnsIdentifiers.resolveUserHexOrNull
+
+// hex | npub1… | nprofile1… | nsec1… | name@domain.tld  →  64-hex pubkey (or null)
+val pubkey: HexKey? = resolveUserHexOrNull(userInput, nip05Client)
+```
+
+`resolveUserHexOrNull(input, nip05Client)` (in `UserHexResolver.kt`) is the canonical "accept any identifier form" resolver. It:
+
+- trims input, tries the **synchronous** bech32/hex path first (`decodePublicKeyAsHexOrNull`), so hex/`npub`/`nprofile`/`nsec` never touch the network;
+- only issues an HTTPS fetch for genuinely NIP-05-shaped input (`name@domain.tld`), gated by a cheap `looksLikeNip05()` precheck;
+- returns `null` on anything unrecognizable or on a failed NIP-05 lookup (network error / no match);
+- re-throws **only** `CancellationException`, so it's safe inside structured concurrency.
+
+Pass `nip05Client = null` in pure-offline contexts — NIP-05-shaped inputs then fall through to `null` and no HTTP is attempted.
+
+## ❌ Do not write this (the hand-rolled anti-pattern)
+
+```kotlin
+// DON'T. This re-implements resolveUserHexOrNull badly:
+//  - no nsec support
+//  - no input validation (accepts IP-literal / malformed domains → spurious fetches)
+//  - hand-parses JSON instead of using Nip05Parser
+//  - bespoke httpGet ignores the "MUST NOT follow redirects" rule
+//  - swallows CancellationException, breaking structured concurrency
+fun resolveObserver(input: String): String? {
+    if (Hex.isHex64(input)) return input.lowercase()
+    if (input.startsWith("npub1") || input.startsWith("nprofile1")) { /* … */ }
+    if ("@" in input) return resolveNip05(input)  // bespoke well-known fetch
+    return null
+}
+```
+
+## ✅ Do this instead
+
+```kotlin
+// CLI already exposes it — commands call Context.requireUserHex(input):
+val pubHex = resolveUserHexOrNull(input, nip05Client)
+    ?: return Output.error("bad_args", "expected npub, nprofile, 64-hex, or name@domain.tld")
+```
+
+## Building an `Nip05Client`
+
+`resolveUserHexOrNull` takes an `INip05Client`. On JVM/Android, wire the OkHttp fetcher (mirror what `cli/Context.kt` does):
+
+```kotlin
+import com.vitorpamplona.quartz.nip05DnsIdentifiers.Nip05Client
+import com.vitorpamplona.quartz.nip05DnsIdentifiers.OkHttpNip05Fetcher
+
+val nip05Client = Nip05Client(fetcher = OkHttpNip05Fetcher { _ -> okHttpClient })
+```
+
+`OkHttpNip05Fetcher` already runs on `Dispatchers.IO` and disables redirects per the NIP-05 spec ("Fetchers MUST ignore any HTTP redirects"). Don't re-implement the fetch.
+
+For tests / offline code, `EmptyNip05Client` is a no-op stub.
+
+## The pieces (all in `quartz/…/nip05DnsIdentifiers/`)
+
+| Type | File | Purpose |
+|------|------|---------|
+| `resolveUserHexOrNull(input, client?)` | `UserHexResolver.kt` | **Start here.** Any identifier form → 64-hex pubkey, or null. `suspend`. |
+| `Nip05Id` | `Nip05Id.kt` | Parsed `name@domain`. `Nip05Id.parse(str)` validates (RFC 5321 local-part + hostname rules, rejects IP literals) and lowercases. `toUserUrl()` / `toDomainUrl()` build the `.well-known/nostr.json` URLs. `toDisplayValue()` collapses the `_` wildcard to just the domain. |
+| `INip05Client` / `Nip05Client` | `INip05Client.kt`, `Nip05Client.kt` | Async resolver. `get(id): Nip05KeyInfo?` (pubkey + relays), `verify(id, hex): Boolean`, `load(id): KeyInfoSet?`, `list(domain): KeyInfoSet`, `loadClinkOffer(id): String?`. Auto-routes `.bit` domains to Namecoin. `EmptyNip05Client` = offline no-op. |
+| `Nip05Fetcher` / `OkHttpNip05Fetcher` | `Nip05Fetcher.kt`, `OkHttpNip05Fetcher.kt` (jvmAndroid) | Transport SAM. OkHttp actual disables redirects + runs on IO. |
+| `Nip05Parser` | `Nip05Parser.kt` | JSON `.well-known/nostr.json` codec: `parseHexKey`, `parseHexKeyAndRelays`, `parse` → `KeyInfoSet`, `parseClinkOffer`. |
+| `Nip05KeyInfo` / `KeyInfoSet` | `Nip05KeyInfo.kt`, `KeyInfoSet.kt` | `Nip05KeyInfo(pubkey, relays)`; `KeyInfoSet(names: Map, relays: Map)` = the full domain listing. |
+| `NamecoinNameResolver` | `namecoin/NamecoinNameResolver.kt` | `.bit` / `d/…` / `id/…` blockchain identifiers. `isNamecoinIdentifier(str)`, `resolve(str)`. Invoked automatically by `Nip05Client` — you rarely call it directly. |
+
+## When you only need the pure (synchronous, no-network) part
+
+If the input can only be hex/bech32 (no NIP-05), skip the client entirely:
+
+```kotlin
+import com.vitorpamplona.quartz.nip19Bech32.decodePublicKeyAsHexOrNull
+
+// hex | npub1… | nprofile1… | nsec1…  →  64-hex pubkey (or null). No suspend, no network.
+val pubkey: HexKey? = decodePublicKeyAsHexOrNull(input)
+```
+
+See `references/nip19-bech32.md` for the full bech32 entity story. `resolveUserHexOrNull` is just this function plus the NIP-05 HTTP fallback.
+
+## Verifying a claimed identifier
+
+To confirm a profile's advertised `nip05` actually points back to its pubkey (NIP-05 verification), use `verify`, not `get`:
+
+```kotlin
+val ok: Boolean = nip05Client.verify(Nip05Id.parse("alice@domain.tld")!!, profilePubkeyHex)
+```
+
+## Tests
+
+`quartz/src/commonTest/…/nip05DnsIdentifiers/Nip05Test.kt` covers parsing, URL construction, case-normalization, CLINK offers, and the validation rejects (IP literals, malformed domains).

.claude/skills/quartz-integration/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: quartz-integration
-description: Integration guide for using the Quartz Nostr KMP library in external projects. Use when: (1) adding Quartz as a Gradle dependency, (2) setting up NostrClient with WebSocket, (3) creating/signing/sending events, (4) building relay subscriptions with Filter, (5) handling keys with KeyPair/NostrSignerInternal, (6) using Bech32 encoding/decoding (NIP-19), (7) platform-specific setup (Android vs JVM/Desktop), (8) NIP-57 zaps, NIP-17 DMs, NIP-44 encryption in external projects.
+description: Integration guide for using the Quartz Nostr KMP library in external projects. Use when: (1) adding Quartz as a Gradle dependency, (2) setting up NostrClient with WebSocket, (3) creating/signing/sending events, (4) building relay subscriptions with Filter, (5) handling keys with KeyPair/NostrSignerInternal, (6) using Bech32 encoding/decoding (NIP-19), (7) platform-specific setup (Android vs JVM/Desktop), (8) NIP-57 zaps, NIP-17 DMs, NIP-44 encryption in external projects, (9) running a relay on Quartz and serving/building its NIP-11 relay information document (application/nostr+json).
 ---
 
 # Quartz Integration Guide
 
 Reference for integrating `com.vitorpamplona.quartz:quartz` into external Nostr KMP projects.
 
-**Published artifact**: `com.vitorpamplona.quartz:quartz:1.12.4` (Maven Central)
+**Published artifact**: `com.vitorpamplona.quartz:quartz:1.12.6` (Maven Central)
 **Targets**: JVM 21+, Android (minSdk 21+), iOS (XCFramework `quartz-kmpKit`)
 **License**: MIT
 
@@ -19,7 +19,7 @@ Reference for integrating `com.vitorpamplona.quartz:quartz` into external Nostr
 
 ```toml
 [versions]
-quartz = "1.12.4"
+quartz = "1.12.6"
 
 [libraries]
 quartz = { module = "com.vitorpamplona.quartz:quartz", version.ref = "quartz" }
@@ -41,7 +41,7 @@ kotlin {
 
 ```kotlin
 dependencies {
-    implementation("com.vitorpamplona.quartz:quartz:1.12.4")
+    implementation("com.vitorpamplona.quartz:quartz:1.12.6")
 }
 ```
 
@@ -134,13 +134,14 @@ val privKeyHex: String? = keyPair.privKey?.toHexKey()
 
 ```kotlin
 import com.vitorpamplona.quartz.nip01Core.core.toHexKey
+import com.vitorpamplona.quartz.nip01Core.core.hexToByteArray
 import com.vitorpamplona.quartz.nip19Bech32.Nip19Parser
 
 // ByteArray → hex
 val hex = byteArray.toHexKey()
 
 // hex → ByteArray
-val bytes = HexKey.decodeHex(hex)
+val bytes = hex.hexToByteArray()
 
 // Bech32 import (npub, nsec)
 val parsed = Nip19Parser.uriToRoute("npub1abc...")
@@ -148,6 +149,126 @@ val parsed = Nip19Parser.uriToRoute("npub1abc...")
 val parsed = Nip19Parser.uriToRoute("nsec1abc...")
 ```
 
+> Hex ↔ ByteArray is a first-class utility in Quartz — see **§3.1 Hex utilities** below.
+
+---
+
+### 3.1 Hex utilities (HexKey ↔ ByteArray)
+
+Nostr keys, event ids and signatures travel as lower-case hex strings. Quartz
+models this with the `HexKey` typealias (just a `String`) plus extension
+functions — **do not** write your own byte loop or pull in a third-party codec.
+
+**Packages:** `com.vitorpamplona.quartz.nip01Core.core` (the extensions) and
+`com.vitorpamplona.quartz.utils` (the underlying `Hex` object).
+
+```kotlin
+import com.vitorpamplona.quartz.nip01Core.core.HexKey            // typealias = String
+import com.vitorpamplona.quartz.nip01Core.core.toHexKey          // ByteArray → hex
+import com.vitorpamplona.quartz.nip01Core.core.hexToByteArray    // hex → ByteArray
+import com.vitorpamplona.quartz.nip01Core.core.hexToByteArrayOrNull
+import com.vitorpamplona.quartz.nip01Core.core.isValid
+import com.vitorpamplona.quartz.utils.Hex
+
+// Encode / decode
+val hex: HexKey = pubKeyBytes.toHexKey()      // lower-case, 2 chars per byte
+val bytes: ByteArray = hex.hexToByteArray()   // throws on odd length
+
+// Untrusted input → decode safely
+val maybe: ByteArray? = userInput.hexToByteArrayOrNull()  // null if not valid hex
+
+// Validate without decoding (no allocation)
+Hex.isHex(userInput)        // even-length, all hex digits (any length)
+Hex.isHex64(userInput)      // fast path for a 32-byte key/id (checks first 64 chars)
+hex.isValid()               // 64 chars AND valid hex (pubkey / event-id shape)
+
+// Compare a hex string to raw bytes without decoding
+Hex.isEqual(incomingHexId, myIdBytes)
+```
+
+| Need | Call | Notes |
+|------|------|-------|
+| ByteArray → hex | `bytes.toHexKey()` | lower-case output |
+| hex → ByteArray (strict) | `hex.hexToByteArray()` | throws on odd length |
+| hex → ByteArray (safe) | `hex.hexToByteArrayOrNull()` | `null` on invalid hex |
+| is this valid hex? | `Hex.isHex(s)` / `Hex.isHex64(s)` | `isHex64` ~30% faster for keys/ids |
+| is this a pubkey/id shape? | `hex.isValid()` | 64 chars + valid hex |
+| hex == bytes? | `Hex.isEqual(hex, bytes)` | no decode allocation |
+
+Constants `PUBKEY_LENGTH` and `EVENT_ID_LENGTH` (both `64`) live in the same
+`nip01Core.core` package.
+
+---
+
+### 3.2 Everyday utilities (time, random, hashing, bech32, base64)
+
+These small helpers exist so you don't reinvent them — and several have a
+footgun the built-in avoids. **Prefer them over stdlib/hand-rolled equivalents.**
+
+**Time — `TimeUtils` (`com.vitorpamplona.quartz.utils`).** Everything is in Unix
+**seconds** (what `created_at` and filter `since`/`until` use), *not* millis.
+
+```kotlin
+import com.vitorpamplona.quartz.utils.TimeUtils
+
+val createdAt = TimeUtils.now()          // seconds — for created_at. NOT currentTimeMillis()/1000
+val since = TimeUtils.oneDayAgo()        // relative filter bounds: oneHourAgo(), fiveMinutesAgo()…
+val fresh = TimeUtils.withinTenMinutes(event.createdAt)  // NIP-42/NIP-98 freshness
+// TimeUtils.nowMillis() is the only millisecond helper — non-protocol use only.
+```
+
+**Secure random — `RandomInstance` (`utils`).** Backed by `SecureRandom`; use it
+for anything security-sensitive instead of `kotlin.random.Random`.
+
+```kotlin
+import com.vitorpamplona.quartz.utils.RandomInstance
+
+val nonce = RandomInstance.bytes(32)     // nonces, salts, keys
+val subId = RandomInstance.randomChars() // 16-char [a-zA-Z0-9] subscription id
+```
+
+**Hashing — `sha256(...)` + `EventHasher`.** `sha256` is the raw primitive; to
+compute/verify an **event id** use `EventHasher`, which canonically serializes
+`[0, pubkey, created_at, kind, tags, content]` before hashing (getting this wrong
+is what makes relays reject an event). Typed builders already do this for you.
+
+```kotlin
+import com.vitorpamplona.quartz.utils.sha256.sha256
+import com.vitorpamplona.quartz.nip01Core.crypto.EventHasher
+
+val digest = sha256(bytes)               // raw 32-byte hash
+val id = EventHasher.hashId(pubKey, createdAt, kind, tags, content)
+val valid = EventHasher.hashIdCheck(event.id, event.pubKey, event.createdAt, event.kind, event.tags, event.content)
+```
+
+**Bech32.** For `npub`/`nsec`/`note`/… prefer the NIP-19 layer (`ByteArray.toNpub()`,
+`Nip19Parser.uriToRoute(...)` — see §10). Drop to the low-level
+`Bech32` object (`nip19Bech32.bech32`) only for a custom prefix:
+
+```kotlin
+import com.vitorpamplona.quartz.nip19Bech32.bech32.Bech32
+import com.vitorpamplona.quartz.nip19Bech32.bech32.bechToBytes
+
+val addr = Bech32.encodeBytes("npub", pubKeyBytes, Bech32.Encoding.Bech32)
+val bytes = "npub1...".bechToBytes("npub")   // decode + assert the prefix
+```
+
+**Base64.** Quartz has no wrapper — use the Kotlin stdlib `kotlin.io.encoding.Base64`
+directly, and match the variant the spec wants: NIP-44/NIP-04 payloads use
+`Base64.Default` (standard, padded); url-safe contexts use `Base64.UrlSafe`
+(configure padding via `.withPadding(...)`).
+
+| Need | Call |
+|------|------|
+| Now (event `created_at`) | `TimeUtils.now()` (seconds) |
+| Relative filter bound | `TimeUtils.oneDayAgo()` / `oneHourAgo()` / … |
+| Secure random bytes | `RandomInstance.bytes(n)` |
+| Subscription id | `RandomInstance.randomChars()` |
+| Raw hash | `sha256(bytes)` |
+| Event id / verify | `EventHasher.hashId(...)` / `hashIdCheck(...)` |
+| Bech32 custom prefix | `Bech32.encodeBytes(hrp, bytes, enc)` / `s.bechToBytes(hrp)` |
+| Base64 | `kotlin.io.encoding.Base64` (`.Default` / `.UrlSafe`) |
+
 ---
 
 ## 4. Signing Events
@@ -634,7 +755,100 @@ val results = store.query<Event>(Filter(search = "bitcoin"))
 
 ---
 
-## 15. Quick Reference
+## 15. NIP-11 Relay Information Document
+
+If you're standing up a relay on Quartz's relay-server code, serve your NIP-11
+document with the **type-safe builder** — don't hand-write the JSON string.
+
+**Package:** `com.vitorpamplona.quartz.nip11RelayInfo`
+
+```kotlin
+import com.vitorpamplona.quartz.nip11RelayInfo.Nip11RelayInformation
+import com.vitorpamplona.quartz.nip11RelayInfo.relayInformation
+
+val info =
+    relayInformation {
+        name = "sot"
+        description = "NIP-50 profile search ranked by Nostr web-of-trust"
+        software = "https://github.com/vitorpamplona/sot"
+        version = "0.1"
+        supports(1, 11, 42, 50)   // ints → spec-compliant [1,11,42,50] in the JSON
+    }
+
+val json = info.toJson()          // null/empty fields are omitted
+```
+
+Serve it at the relay root, branching on the `Accept` header (Ktor example):
+
+```kotlin
+import com.vitorpamplona.quartz.nip11RelayInfo.Nip11RelayInformation
+import io.ktor.http.ContentType
+
+get("/") {
+    val accept = call.request.headers[HttpHeaders.Accept].orEmpty()
+    if (accept.contains(Nip11RelayInformation.CONTENT_TYPE)) {      // "application/nostr+json"
+        call.respondText(json, ContentType.parse(Nip11RelayInformation.CONTENT_TYPE))
+    } else {
+        call.respondText("Open a WebSocket (NIP-01) or send Accept: ${Nip11RelayInformation.CONTENT_TYPE}")
+    }
+}
+```
+
+### Nested objects, lists, and enforced limits
+
+```kotlin
+val info =
+    relayInformation {
+        name = "Paid Relay"
+        supports(1, 11, 42)
+        supportsExtensions("nip50-search")   // supported_nip_extensions
+        countries("US", "CA")                // relay_countries; also languages(...), tags(...)
+        nip50Features("profile_search")      // the `nip50` field
+
+        // limitation { } — camelCase maps to NIP-11 snake_case fields
+        limitation {
+            maxSubscriptions = 20
+            maxFilters = 10
+            authRequired = true
+        }
+
+        // fees { } — each helper is repeatable
+        fees {
+            admission(amount = 1000, unit = "msats")
+            publication(amount = 100, unit = "msats", kinds = listOf(1, 30023))
+        }
+
+        // retention(...) — call once per policy entry
+        retention(kinds = listOf(0, 3), count = 1)
+    }
+```
+
+**Keep advertised limits in sync with enforced ones.** If you build a
+`RelayLimits` for the server's policy chain, hand the *same* object to the
+builder so what you publish can never drift from what you enforce:
+
+```kotlin
+import com.vitorpamplona.quartz.nip01Core.relay.server.policies.RelayLimits
+
+val limits = RelayLimits(maxSubscriptions = 20, maxFilters = 10, maxLimit = 500, authRequired = true)
+
+val info =
+    relayInformation {
+        name = "My Relay"
+        supports(1, 11, 42, 45)
+        limitation(limits)        // == limits.toNip11Limitation()
+    }
+```
+
+To load an operator-supplied doc from disk or a string instead of building it,
+use `Nip11RelayInformation.fromJson(json)`.
+
+> `geode` (Quartz's standalone relay) builds its default document exactly this
+> way — see `geode/.../RelayInfo.kt`.
+
+---
+
+## 16. Quick Reference
 
 | Task | API | Package |
 |------|-----|---------|
@@ -644,6 +858,13 @@ val results = store.query<Event>(Filter(search = "bitcoin"))
 | Sign event | `signer.sign(template)` | `nip01Core.signers` |
 | Serialize | `event.toJson()` | `nip01Core.core` |
 | Parse | `Event.fromJson(json)` | `nip01Core.core` |
+| ByteArray → hex | `bytes.toHexKey()` | `nip01Core.core` |
+| hex → ByteArray | `hex.hexToByteArray()` / `hex.hexToByteArrayOrNull()` | `nip01Core.core` |
+| Validate hex | `Hex.isHex(s)` / `Hex.isHex64(s)` / `hex.isValid()` | `utils`, `nip01Core.core` |
+| Now (seconds) | `TimeUtils.now()` | `utils` |
+| Relative time | `TimeUtils.oneDayAgo()` / `oneHourAgo()` | `utils` |
+| Secure random | `RandomInstance.bytes(n)` / `randomChars()` | `utils` |
+| Hash / event id | `sha256(bytes)` / `EventHasher.hashId(...)` | `utils.sha256`, `nip01Core.crypto` |
 | Normalize relay URL | `RelayUrlNormalizer.normalize("wss://...")` | `nip01Core.relay.normalizer` |
 | Setup relay client | `NostrClient(BasicOkHttpWebSocket.Builder { okhttp })` | `nip01Core.relay.client` |
 | Subscribe | `client.openReqSubscription(subId, mapOf(relay to filters), listener)` | `nip01Core.relay.client` |
@@ -651,6 +872,8 @@ val results = store.query<Event>(Filter(search = "bitcoin"))
 | NIP-44 encrypt | `signer.nip44Encrypt(text, recipientPubKey)` | `nip01Core.signers` |
 | Bech32 decode | `Nip19Parser.uriToRoute("npub1...")` | `nip19Bech32` |
 | Bech32 encode | `Nip19Bech32.createNPub(pubKeyHex)` | `nip19Bech32` |
+| Build NIP-11 doc | `relayInformation { name = ...; supports(1, 11) }` | `nip11RelayInfo` |
+| Serialize NIP-11 doc | `info.toJson()` (media type `Nip11RelayInformation.CONTENT_TYPE`) | `nip11RelayInfo` |
 
 ## Common Event Kinds
 

.claude/skills/quartz-integration/references/gradle-setup.md

@@ -3,7 +3,7 @@
 ## Current version
 
 ```
-com.vitorpamplona.quartz:quartz:1.12.4
+com.vitorpamplona.quartz:quartz:1.12.6
 ```
 
 Check latest: https://central.sonatype.com/artifact/com.vitorpamplona.quartz/quartz
@@ -16,7 +16,7 @@ Check latest: https://central.sonatype.com/artifact/com.vitorpamplona.quartz/qua
 
 ```toml
 [versions]
-quartz = "1.12.4"
+quartz = "1.12.6"
 
 [libraries]
 quartz = { module = "com.vitorpamplona.quartz:quartz", version.ref = "quartz" }
@@ -55,7 +55,7 @@ kotlin {
 ```kotlin
 // build.gradle.kts (app module)
 dependencies {
-    implementation("com.vitorpamplona.quartz:quartz:1.12.4")
+    implementation("com.vitorpamplona.quartz:quartz:1.12.6")
 }
 ```
 
@@ -70,7 +70,7 @@ plugins {
 }
 
 dependencies {
-    implementation("com.vitorpamplona.quartz:quartz:1.12.4")
+    implementation("com.vitorpamplona.quartz:quartz:1.12.6")
     // JNA needed for libsodium (NIP-44) on JVM
     implementation("net.java.dev.jna:jna:5.18.1")
 }

.gitattributes

@@ -0,0 +1,4 @@
+# Gzip-compressed test corpora (e.g. nostr_vitor_startup_data.json.gz): treat as
+# binary so git never applies CRLF/text normalization or textual diff/merge, which
+# would corrupt the compressed stream (important on Windows checkouts).
+*.gz binary

.github/actions/import-macos-cert/action.yml

@@ -24,6 +24,15 @@ outputs:
       Compose's macOS signing, whose certificate lookup doesn't resolve the
       search list reliably on CI runners the way bare `codesign` does.
     value: ${{ steps.import.outputs.keychain }}
+  identity:
+    description: >
+      The imported certificate's full "Developer ID Application: NAME (TEAMID)"
+      common name, resolved from the keychain (empty when signing=false or if it
+      could not be parsed). `codesign` accepts a SHA-1 hash or a CN substring,
+      but Compose's MacSigner runs `security find-certificate -c <identity>`
+      after prepending "Developer ID Application: " — so it only works with the
+      exact common name. Feed this to Compose's `signing.identity`.
+    value: ${{ steps.import.outputs.identity }}
 
 runs:
   using: composite
@@ -62,5 +71,20 @@ runs:
         # explicit keychain can read the `keychain` output below.
         security default-keychain -d user -s "$KEYCHAIN"
         rm -f "$CERT_PATH"
+        # Resolve the certificate's exact common name. Compose's MacSigner maps
+        # its identity to a cert via `security find-certificate -c <name>` (after
+        # prepending "Developer ID Application: " when absent), so it needs the
+        # full CN — a SHA-1 hash or partial name in the secret signs fine with
+        # bare `codesign` but yields "Could not find certificate ...". Pull the
+        # canonical name straight from the keychain so the caller is independent
+        # of whatever form the MAC_SIGN_IDENTITY secret takes.
+        IDENTITY_NAME="$(security find-identity -v -p codesigning "$KEYCHAIN" \
+          | grep -o '"Developer ID Application:[^"]*"' | head -1 | tr -d '"' || true)"
         echo "signing=true" >> "$GITHUB_OUTPUT"
         echo "keychain=$KEYCHAIN" >> "$GITHUB_OUTPUT"
+        echo "identity=$IDENTITY_NAME" >> "$GITHUB_OUTPUT"
+        if [[ -n "$IDENTITY_NAME" ]]; then
+          echo "::notice::Resolved signing identity: $IDENTITY_NAME"
+        else
+          echo "::warning::Could not resolve a 'Developer ID Application' identity from the keychain; callers will fall back to the MAC_SIGN_IDENTITY secret."
+        fi

.github/workflows/build.yml

@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5
@@ -66,7 +66,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5
@@ -122,7 +122,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5
@@ -181,7 +181,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5

.github/workflows/bump-homebrew.yml

@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Re-assert stable release
         uses: ./.github/actions/assert-stable-release

.github/workflows/bump-winget.yml

@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Re-assert stable release
         uses: ./.github/actions/assert-stable-release

.github/workflows/create-release.yml

@@ -50,7 +50,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5
@@ -119,8 +119,13 @@ jobs:
         env:
           # Empty on non-macOS legs and on the macOS leg when no cert is
           # configured — the gradle macOS{} block skips signing when the
-          # identity is blank.
-          AMETHYST_MAC_SIGN_IDENTITY: ${{ steps.mac_keychain.outputs.signing == 'true' && secrets.MAC_SIGN_IDENTITY || '' }}
+          # identity is blank. Prefer the full common name resolved from the
+          # keychain over the raw secret: Compose's signer maps the identity via
+          # `security find-certificate` and only matches the exact "Developer ID
+          # Application: …" CN, whereas the secret may be a hash or partial name
+          # (which bare codesign accepts but Compose does not). Fall back to the
+          # secret if resolution failed.
+          AMETHYST_MAC_SIGN_IDENTITY: ${{ steps.mac_keychain.outputs.signing == 'true' && (steps.mac_keychain.outputs.identity || secrets.MAC_SIGN_IDENTITY) || '' }}
           # Explicit keychain for Compose's MacSigner. Its `security
           # find-certificate` lookup doesn't resolve the imported cert via the
           # search list on these runners ("Could not find certificate ... in
@@ -195,7 +200,7 @@ jobs:
 
       - name: Upload to GH Release (skip on dry-run)
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true'
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
         with:
           files: dist/*
           tag_name: ${{ steps.ver.outputs.tag }}
@@ -244,7 +249,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5
@@ -446,7 +451,7 @@ jobs:
 
       - name: Upload to GH Release (skip on dry-run)
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true'
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
         with:
           files: dist/*
           tag_name: ${{ steps.ver.outputs.tag }}
@@ -474,7 +479,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5
@@ -483,7 +488,7 @@ jobs:
           java-version: 21
 
       - name: Cache gradle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/.gradle/caches
@@ -567,6 +572,48 @@ jobs:
              "dist/amethyst-fdroid-${TAG}.aab"
           ls -la dist
 
+      # Accrescent does not accept AABs or monolithic APKs — it requires a signed
+      # APK set (.apks) of split APKs generated by bundletool from the AAB. We build
+      # it from the F-Droid flavor (no proprietary Google deps) and sign the splits
+      # with the same release keystore used above. Upload is still manual: drop this
+      # .apks into https://console.accrescent.app (no publish API/CLI exists yet).
+      - name: Build Accrescent APK set (F-Droid)
+        env:
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_STORE_PASSWORD: ${{ secrets.KEY_STORE_PASSWORD }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME}"
+          BUNDLETOOL_VERSION="1.18.3"  # must be >= 1.11.4 per Accrescent requirements
+          curl -fsSL -o bundletool.jar \
+            "https://github.com/google/bundletool/releases/download/${BUNDLETOOL_VERSION}/bundletool-all-${BUNDLETOOL_VERSION}.jar"
+
+          # Same base64 keystore secret consumed by the r0adkll signing steps above.
+          echo "$SIGNING_KEY" | base64 -d > release.keystore
+
+          # --mode=default emits the split-APK set Accrescent wants (NOT --mode=universal,
+          # which produces a monolithic APK that Accrescent rejects).
+          java -jar bundletool.jar build-apks \
+            --bundle="dist/amethyst-fdroid-${TAG}.aab" \
+            --output="dist/amethyst-fdroid-${TAG}.apks" \
+            --ks=release.keystore \
+            --ks-key-alias="$KEY_ALIAS" \
+            --ks-pass="pass:$KEY_STORE_PASSWORD" \
+            --key-pass="pass:$KEY_PASSWORD" \
+            --mode=default
+
+          rm -f release.keystore bundletool.jar
+
+          # Accrescent's automated check rejects an APK set larger than 128 MiB.
+          SIZE_BYTES=$(stat -c%s "dist/amethyst-fdroid-${TAG}.apks")
+          echo "Accrescent APK set size: $((SIZE_BYTES / 1024 / 1024)) MiB"
+          if [ "$SIZE_BYTES" -gt $((128 * 1024 * 1024)) ]; then
+            echo "::warning::amethyst-fdroid-${TAG}.apks exceeds Accrescent's 128 MiB limit; the console will reject this upload."
+          fi
+          ls -la dist
+
       - name: Classify release
         id: classify
         run: |
@@ -579,7 +626,7 @@ jobs:
           fi
 
       - name: Upload Android assets to GH Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
         with:
           files: dist/*
           tag_name: ${{ github.ref_name }}

.github/workflows/crowdin.yml

@@ -10,12 +10,21 @@ permissions:
   pull-requests: write
 
 jobs:
+  # Single job so the Crowdin translation sync and the translator-placeholder seed
+  # land in ONE pull request instead of two. The Crowdin action only downloads into
+  # the working tree (push_translations/create_pull_request disabled); the seed
+  # script then edits translators.json; finally one create-pull-request step opens a
+  # single PR with both sets of changes (and no-ops when there is no diff).
   synchronize-with-crowdin:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+        with:
+          # Need tags so scripts/translators.sh can resolve the last v* release tag
+          # for the "since last tag" window.
+          fetch-depth: 0
 
       - name: crowdin action
         uses: crowdin/github-action@v2
@@ -23,12 +32,42 @@ jobs:
           upload_sources: true
           upload_translations: true
           download_translations: true
-          localization_branch_name: l10n_crowdin_translations
-          create_pull_request: true
-          pull_request_title: 'New Crowdin Translations'
-          pull_request_body: 'New Crowdin translations by [Crowdin GH Action](https://github.com/crowdin/github-action)'
-          pull_request_base_branch_name: 'main'
+          # Let the downloaded translations stay in the working tree; the single
+          # create-pull-request step below opens the combined PR.
+          push_translations: false
+          create_pull_request: false
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      # Keep docs/changelog/translators.json seeded with everyone who has translated
+      # recently, so the per-release `## Translations` credits (scripts/translators.sh)
+      # can resolve them to npubs. Only adds rows when a genuinely new contributor
+      # appears.
+      - name: Seed translator placeholders from Crowdin
+        run: bash scripts/translators.sh --seed
+        env:
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      - name: Open or update the combined Crowdin PR
+        # peter-evans/create-pull-request is MIT-licensed CI-only tooling (not
+        # linked into any shipped artifact). It no-ops when there is no diff.
+        uses: peter-evans/create-pull-request@v8
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          base: main
+          branch: l10n_crowdin_translations
+          add-paths: |
+            amethyst/src/main/res/**/strings.xml
+            docs/changelog/translators.json
+          commit-message: 'chore: sync Crowdin translations and seed translator npub placeholders'
+          title: 'New Crowdin Translations'
+          body: |
+            New Crowdin translations by [Crowdin GH Action](https://github.com/crowdin/github-action).
+
+            Any new Crowdin contributors were added to `docs/changelog/translators.json`
+            with blank npubs. Fill in the npubs you have so the next release's
+            `## Translations` credits generate automatically via
+            `scripts/translators.sh --from <prev-tag> --to <this-tag>`.

.github/workflows/smoke-test-desktop.yml

@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5
@@ -55,7 +55,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5

BUILDING.md

@@ -163,6 +163,56 @@ Examples:
 
 ---
 
+## Reproducible Android builds
+
+The release APKs are **bit-for-bit reproducible**: anyone can rebuild the exact
+bytes we ship (minus the signature) from the tagged source and confirm the
+artifact on F-Droid / Zapstore / GitHub was built from this code and nothing
+else. What makes that hold:
+
+- **Pinned toolchain.** AGP, Kotlin, R8, and the Compose compiler are pinned in
+  `gradle/libs.versions.toml`; the build targets **JDK 21**. R8 is deterministic
+  for a fixed version + inputs, so the minified output is stable. Build with the
+  same JDK 21 you see in `BUILDING.md` / CI.
+- **No build-time clock.** Nothing injects `System.currentTimeMillis()` /
+  build dates into `BuildConfig` (a Spotless rule bans the call in `quartz` and
+  `commons`), and AGP normalizes ZIP entry timestamps, so two builds an hour
+  apart are identical.
+- **Deterministic version name.** `generateVersionName` only appends a branch
+  suffix off feature branches; a release tag builds in detached-`HEAD` (or from a
+  source tarball with no `.git`) resolve to the bare `app` version.
+- **No dependency-metadata blob.** `dependenciesInfo { includeInApk = false;
+  includeInBundle = false }` in `amethyst/build.gradle.kts` stops AGP from
+  embedding the Google-encrypted dependency protobuf in the signing block — that
+  ciphertext is non-deterministic.
+- **Reproducible native library.** The bundled Tor (Arti) `.so` is the one
+  binary we compile ourselves; it is built reproducibly from source (pinned Rust
+  toolchain, locked deps, canonical build path). See
+  [`tools/arti-build/README.md`](tools/arti-build/README.md) → "Reproducible
+  builds". All other native libs (`secp256k1`, `webrtc`) are version-pinned Maven
+  prebuilts and so are byte-identical by download.
+
+### Verify a release APK reproduces
+
+```bash
+# 1. Check out the exact released tag and build the same variant unsigned.
+git checkout v1.12.1
+./gradlew clean :amethyst:assembleFdroidRelease
+
+# 2. Diff your unsigned build against the published APK, ignoring only the
+#    signature (META-INF/*). apksigner + a zip-aware diff is the simplest check;
+#    diffoscope gives a human-readable breakdown of any remaining delta.
+diffoscope \
+  amethyst/build/outputs/apk/fdroid/release/amethyst-fdroid-arm64-v8a-release-unsigned.apk \
+  amethyst-fdroid-arm64-v8a-1.12.1.apk
+```
+
+A clean run shows differences confined to `META-INF/` (the signing files). Any
+diff in `classes*.dex`, `resources.arsc`, or native libs means something in the
+toolchain drifted — file it before publishing.
+
+---
+
 ## Release runbook
 
 The release flow is driven by a tag push. Every cut ships Android + Desktop +

PLANS.md

@@ -0,0 +1,83 @@
+# Amethyst plans index
+
+_Cross-module roll-up of every `plans/` folder. Surveyed 2026-06-30._
+
+Plans in this repo are **decentralized**: each module keeps its own design docs
+in `<module>/plans/YYYY-MM-DD-<slug>.md` (see `.claude/CLAUDE.md` →
+"Plans per module"). There is no single plans directory — **this file is the
+master index** that stitches the per-folder indexes together.
+
+Each plan carries a `Status:` header (shipped | in-progress | queued |
+abandoned) backed by codebase evidence. **Shipped** plans are moved into each
+folder's `archive/`; live work stays at the top level. For the full per-folder
+listing (including archived plans), open that folder's `README.md`.
+
+> `docs/plans/` is the **frozen** legacy global folder — it is indexed here for
+> completeness, but new plans must go in the owning module's `plans/` folder.
+
+## Totals
+
+**142 plans** across 10 folders:
+
+| Status | Count |
+| ------ | ----: |
+| shipped (archived) | 122 |
+| in-progress | 9 |
+| queued | 8 |
+| abandoned | 3 |
+
+## By module
+
+| Module | Plans | Shipped | In-prog | Queued | Aband. | Index |
+| ------ | ----: | ------: | ------: | -----: | -----: | ----- |
+| amethyst | 21 | 19 | 1 | 1 | 0 | [amethyst/plans](amethyst/plans/README.md) |
+| nestsClient | 26 | 23 | 1 | 2 | 0 | [nestsClient/plans](nestsClient/plans/README.md) |
+| desktopApp | 13 | 10 | 2 | 1 | 0 | [desktopApp/plans](desktopApp/plans/README.md) |
+| quartz | 10 | 7 | 0 | 3 | 0 | [quartz/plans](quartz/plans/README.md) |
+| commons | 6 | 2 | 2 | 2 | 0 | [commons/plans](commons/plans/README.md) |
+| cli | 6 | 5 | 1 | 0 | 0 | [cli/plans](cli/plans/README.md) |
+| quic | 4 | 3 | 0 | 0 | 1 | [quic/plans](quic/plans/README.md) |
+| quic/interop | 1 | 1 | 0 | 0 | 0 | [quic/interop/plans](quic/interop/plans/README.md) |
+| geode | 5 | 4 | 0 | 0 | 0 | [geode/plans](geode/plans/README.md) |
+| docs (frozen) | 52 | 48 | 2 | 0 | 2 | [docs/plans](docs/plans/README.md) |
+
+## Live work (not shipped)
+
+Everything still open, across all modules. Shipped plans are omitted here — find
+them under each folder's `archive/` via the per-module index above.
+
+### In progress (9)
+
+| Module | Plan | Summary |
+| ------ | ---- | ------- |
+| amethyst | [ios-support](amethyst/plans/2026-05-24-ios-support.md) | KMP-to-iOS port; quartz/commons iOS targets configured (Phase 1) but no `iosApp` module yet. |
+| commons | [custom-feeds-plan](commons/plans/2026-05-04-custom-feeds-plan.md) | Custom feeds; model + builder + kind 31890 + desktop UI shipped, but relay-filter layer, DVM marketplace, kind 10090 sync, list resolution pending. |
+| commons | [nest-subscription-manager-extraction](commons/plans/2026-05-06-nest-subscription-manager-extraction.md) | Split per-speaker subscription state machine out of `NestViewModel`; only the `ActiveSubscription` stepping-stone extracted. |
+| desktopApp | [wallet-zapping-test-coverage](desktopApp/plans/2026-05-12-feat-desktop-wallet-zapping-test-coverage-plan.md) | NWC handler + RPC round-trip tests shipped; wallet-column-state and zap-dialog-logic tests still missing. |
+| desktopApp | [napplet-desktop-host](desktopApp/plans/2026-06-21-napplet-desktop-host.md) | Desktop NIP-5A/5D host; shared core extractions done, desktop engine/scheme-handler/transport/UI edge not built. |
+| cli | [cashu-cli](cli/plans/2026-05-28-cashu-cli.md) | NIP-60/61/87 Cashu wallet verbs in amy; full command surface ships, production-mint interop harness pending. |
+| nestsClient | [t16-closure-roadmap](nestsClient/plans/2026-05-07-t16-closure-roadmap.md) | Priorities 1 & 2 closed and suite passes, but CI gating deferred and framesPerGroup rerun + two upstream items open. |
+| docs | [viewport-aware-metadata-loading](docs/plans/2026-04-29-perf-viewport-aware-metadata-loading-plan.md) | Base preloader/rate-limiter infra exists but the LazyListState/snapshotFlow viewport selection isn't clearly wired. |
+| docs | [macos-bunker-relogin](docs/plans/2026-06-18-fix-desktop-macos-bunker-relogin-plan.md) | PR 1 defense-in-depth shipped, but the cold-boot root cause is still open/unidentified. |
+
+### Queued (8)
+
+| Module | Plan | Summary |
+| ------ | ---- | ------- |
+| amethyst | [napplet-inter-applet](amethyst/plans/2026-06-20-napplet-inter-applet.md) | NAP-INC / NAP-INTENT inter-applet messaging; prerequisites (multi-applet hosting, archetype registry, `MESSAGING` capability) not built. |
+| quartz | [local-headers-explorer](quartz/plans/2026-05-08-local-headers-explorer.md) | Headers-only Bitcoin P2P client to verify NIP-03 OTS attestations without a trusted block explorer. |
+| quartz | [giftwrap-deletion-requests](quartz/plans/2026-06-12-giftwrap-deletion-requests.md) | Let a recipient-authored kind-5 delete/block a gift wrap (kind 1059) addressed to them. |
+| quartz | [incremental-negentropy-storage](quartz/plans/2026-07-03-incremental-negentropy-storage.md) | Always-current (created_at, id) index so cold NEG-OPENs stop paying a full scan + seal. |
+| commons | [event-renderer](commons/plans/2026-04-21-event-renderer.md) | Cross-platform UI-agnostic `RenderedEvent` subsystem shared by Amy, Desktop, Android; not started. |
+| commons | [amethyst-to-commons-migration](commons/plans/2026-05-30-amethyst-to-commons-migration.md) | Roadmap to move shared `amethyst` Android code into `commons`; keystone `Account`/`LocalCache` extraction not begun. |
+| desktopApp | [embedded-wallet-phase2-research](desktopApp/plans/2026-05-21-embedded-wallet-phase2-research.md) | Research for an embedded self-custodial Lightning wallet (Breez/ldk-node/lightning-kmp); parked, no code. |
+| nestsClient | [cross-stack-interop-ci-gating](nestsClient/plans/2026-05-07-cross-stack-interop-ci-gating.md) | CI gating for the cross-stack interop suite; infra built then removed over wallclock cost, kept as a ready revisit target. |
+| nestsClient | [framespergroup-production-rerun](nestsClient/plans/2026-05-07-framespergroup-production-rerun.md) | Re-run the two-phone field tests to settle the framesPerGroup test-pin (5) vs default (50); needs prod-rig access. |
+
+### Abandoned (3)
+
+| Module | Plan | Summary |
+| ------ | ---- | ------- |
+| quic | [congestion-control](quic/plans/2026-05-05-congestion-control.md) | NewReno congestion control parked indefinitely; the real concern was solved by the smaller `SendBuffer.bestEffort` fix instead. |
+| docs | [desktop-relay-config-single-source](docs/plans/2026-04-23-feat-desktop-relay-config-single-source-plan.md) | Single `DesktopRelayConfig` class never built; relay state landed as `DesktopRelayCategories`/`LocalRelayCategories` instead. |
+| docs | [macos-vlc-bundled-discovery](docs/plans/2026-05-18-fix-macos-vlc-bundled-discovery-plan.md) | macOS bundled-VLC `setenv` discovery fix; moot after VLC/VLCJ was removed entirely in the kdroidFilter migration. |

README.md

@@ -297,16 +297,16 @@ repositories {
 Add the following line to your `commonMain` dependencies:
 
 ```gradle
-implementation('com.vitorpamplona.quartz:quartz:1.12.4')
+implementation('com.vitorpamplona.quartz:quartz:1.12.6')
 ```
 
 Variations to each platform are also available:
 
 ```gradle
-implementation('com.vitorpamplona.quartz:quartz-android:1.12.4')
-implementation('com.vitorpamplona.quartz:quartz-jvm:1.12.4')
-implementation('com.vitorpamplona.quartz:quartz-iosarm64:1.12.4')
-implementation('com.vitorpamplona.quartz:quartz-iossimulatorarm64:1.12.4')
+implementation('com.vitorpamplona.quartz:quartz-android:1.12.6')
+implementation('com.vitorpamplona.quartz:quartz-jvm:1.12.6')
+implementation('com.vitorpamplona.quartz:quartz-iosarm64:1.12.6')
+implementation('com.vitorpamplona.quartz:quartz-iossimulatorarm64:1.12.6')
 ```
 
 Check versions on [MavenCentral](https://central.sonatype.com/search?q=com.vitorpamplona.quartz)

RELEASE_OPS.md

@@ -44,6 +44,23 @@ workflow.
    e.g. `v1.12.01.md`) and add it to `docs/changelog/README.md`. Follow the
    house style: plain text, short verb-first sentences.
 
+   For the `## Translations` section, generate the credits instead of writing
+   them by hand — no token needed:
+   ```bash
+   scripts/translators.sh
+   ```
+   This runs offline. It reads `docs/changelog/translators.json` (kept next to
+   the changelogs), which CI keeps fresh: the Crowdin sync workflow's
+   `seed-translators` job records everyone who has translated since the last `v*`
+   tag, with their languages, in the file's `sinceLastTag` list, and accumulates
+   their npubs in the forever-growing `mappings` registry. The script resolves
+   that list to npubs and prints the `## Translations` block grouped by language.
+   Contributors with no npub yet are listed under `UNMAPPED` — credit them by
+   hand, then add their npub under `mappings` so future releases pick them up
+   automatically. (To re-query Crowdin live as a sanity check, run
+   `scripts/translators.sh --seed` with `CROWDIN_PROJECT_ID` /
+   `CROWDIN_PERSONAL_TOKEN` set, which refreshes the file.)
+
 3. **Publish the release-notes note on Nostr** with Amethyst's account and paste
    its event id into `amethyst/build.gradle.kts`:
    ```kotlin

amethyst/build.gradle.kts

@@ -264,6 +264,23 @@ android {
         resValues = true
     }
 
+    // Reproducible builds: keep AGP from embedding the dependency-metadata blob
+    // in the APK/AAB. That blob is a protobuf of the resolved dependency tree
+    // encrypted with a Google public key; the ciphertext is non-deterministic,
+    // so its presence makes every release artifact impossible to reproduce
+    // bit-for-bit. Dropping it (F-Droid's documented recommendation) lets
+    // F-Droid / Zapstore independently rebuild and verify our developer-signed
+    // APKs.
+    //
+    // Play-channel trade-off: with includeInBundle = false the uploaded .aab no
+    // longer carries this metadata, so Play Console's app-dependency insights /
+    // known-vulnerability SDK alerts go unpopulated. Uploads still succeed; only
+    // that advisory feature is lost.
+    dependenciesInfo {
+        includeInApk = false
+        includeInBundle = false
+    }
+
     packaging {
         resources {
             excludes += listOf("/META-INF/{AL2.0,LGPL2.1}", "**/libscrypt.dylib")
@@ -331,12 +348,31 @@ composeCompiler {
 dependencies {
     implementation(platform(libs.androidx.compose.bom))
 
+    // Compose composition tracing — DEBUG ONLY, profiling aid (not shipped). Makes each
+    // recomposition show up as a NAMED slice in Perfetto system traces so we can see which
+    // composable recomposes (e.g. during the cold-start feed first-paint). All Apache-2.0.
+    // Usage: runtime-enable, then capture a Perfetto trace with the `track_event` data source:
+    //   adb shell am broadcast -a androidx.tracing.perfetto.action.ENABLE_TRACING \
+    //     -n com.vitorpamplona.amethyst.debug/androidx.tracing.perfetto.TracingReceiver
+    debugImplementation("androidx.compose.runtime:runtime-tracing")
+    debugImplementation("androidx.tracing:tracing-perfetto:1.0.0")
+    debugImplementation("androidx.tracing:tracing-perfetto-binary:1.0.0")
+
     implementation(project(":quartz"))
     implementation(project(":commons"))
     implementation(project(":nestsClient"))
+    implementation(project(":nappletHost"))
     implementation(libs.androidx.core.ktx)
     implementation(libs.androidx.activity.compose)
 
+    // Hardened WebView host for sandboxed napplet/nsite rendering (origin-restricted message bridge).
+    implementation(libs.androidx.webkit)
+
+    // Client side of the cross-process UI embedding: renders the sandboxed browser surface (hosted in
+    // the keyless `:napplet` process) inside a Compose component in the main app.
+    implementation(libs.androidx.privacysandbox.ui.core)
+    implementation(libs.androidx.privacysandbox.ui.client)
+
     implementation(libs.androidx.ui)
     implementation(libs.androidx.ui.graphics)
     implementation(libs.androidx.ui.tooling.preview)
@@ -421,6 +457,9 @@ dependencies {
     implementation(libs.markdown.ui.material3)
     implementation(libs.markdown.commonmark)
 
+    // Syntax highlighting for the git repository code browser (Apache-2.0)
+    implementation(libs.highlights)
+
     // LaTeX math rendering ($...$ and $$...$$ inline equations)
     implementation(libs.jlatexmath.android)
     implementation(libs.jlatexmath.font.greek)

amethyst/plans/2026-05-24-ios-support.md

@@ -1,5 +1,8 @@
 # iOS Support for Amethyst
 
+> **Status:** in-progress — `iosArm64`/`iosSimulatorArm64` targets are configured in `quartz` and `commons` (Phase 1), but no `iosApp` module exists yet — later phases not built.
+> _Audited 2026-06-30._
+
 **Date:** 2026-05-24
 **Status:** Phase 1 complete; Phase 2 in flight
 **Owner:** TBD

amethyst/plans/2026-06-20-napplet-inter-applet.md

@@ -0,0 +1,97 @@
+# Napplet inter-applet communication (NAP-INC / NAP-INTENT) — design notes
+
+> **Status:** queued — Explicitly deferred; no `MESSAGING` capability exists in `NappletCapability` and the prerequisites (multi-applet hosting, archetype registry) are unbuilt.
+> _Audited 2026-06-30._
+
+**Date:** 2026-06-20
+**Status:** Deferred — design only. Prereqs not yet built (see below).
+**Parent:** `amethyst/plans/2026-06-19-napplet-sandbox-host.md`
+
+## Why this is deferred (not just "next")
+
+Inter-applet messaging is the one napplet capability that needs **new
+architecture**, not just a new broker op + gateway. Two hard prerequisites are
+missing today:
+
+1. **Multiple applets running at once.** `NappletHostActivity` is declared
+   `launchMode="singleTask"` and hosts exactly one applet. True live A↔B
+   messaging (the full NAP-INC request/result transport) requires either
+   multi-applet hosting (several iframes in one host, or several host processes)
+   plus a routing layer — none of which exists.
+2. **An archetype / handler registry.** NAP-INTENT dispatches by *archetype*
+   (`note`, `feed`, `profile`, …) to a default-handler napplet. Our
+   `NappletManifest` has no `handles`/archetype declaration and there is no
+   "which napplet is the default handler for X" registry.
+
+Both are sizeable subsystems. Shipping a half-version would also risk **forking
+the wire format** from upstream while it is still being defined.
+
+## Upstream model (napplet/naps survey, 2026-06-20)
+
+Inter-applet is split into two shell-mediated specs (applets never reach each
+other directly — every message crosses the shell/broker):
+
+- **NAP-INC** (`inc`) — the transport. Messages are `{ type: "domain.action",
+  id, … }`, request/result correlated by `id`. Addressing is direct
+  (napplet→napplet) *or* archetype-mediated by the runtime.
+- **NAP-INTENT** (`intent`) — invoke a napplet by **archetype** via
+  default-handler dispatch (`shell.supports("intent")`). The shell launches the
+  handler; napplets cannot invoke directly.
+- **NAP-1…5** — concrete protocols on top of NAP-INC: `profile:*` (NAP-1),
+  `stream:*` (NAP-2), `chat:*` (NAP-3), `note:open` (NAP-4), `feed:*` (NAP-5).
+  Producer/consumer model.
+
+Discovery is capability-probe based: `shell.supports("inc")`,
+`shell.supports("inc", "NAP-N")`.
+
+## How it would map onto our boundary
+
+The broker model fits "shell-mediated" naturally — every message would cross
+`NappletBrokerService` exactly like every other capability, gated by the ledger.
+The pieces:
+
+1. **Capability.** Add `NappletCapability.MESSAGING` mapped from NAP domains
+   `inc` / `intent` (default-deny like every other domain). Consent is a *link*
+   grant ("Applet A may message / open Applet B"), distinct from per-op consent.
+2. **Protocol.** New `NappletRequest`/`NappletResponse` variants under
+   `MESSAGING`, shaped to mirror NAP-INC (`type = "domain.action"`, `id`
+   correlation) so we don't fork the wire format.
+3. **Addressing.** Direct by napplet coordinate first; archetype dispatch only
+   after the registry (below) exists.
+
+### Two viable implementation shapes (pick at build time)
+
+- **NAP-INTENT, direct coordinate** — `napplet.intent({ target, payload })` →
+  consent → broker resolves `target` to a manifest in `LocalCache` → launches it
+  via a `NappletIntentLauncher` gateway, passing an initial payload the target
+  reads on startup (`napplet.intent` / `onIntent`). Fits the single-applet model
+  (you switch to the target). No simultaneous hosting needed. **Lowest lift; most
+  aligned with NAP-INTENT.** Result-return across the switch is awkward (fire-and-
+  forget, or a callback event).
+- **NAP-INC brokered mailbox** — `napplet.sendTo(coordinate, msg)` /
+  `pollMessages()` with broker-persisted per-napplet inboxes, consent per link.
+  Works with no simultaneous hosting and is fully unit-testable, but it is async
+  fire-and-collect, not the request/result transport upstream describes.
+
+Full live NAP-INC (simultaneous A↔B, request/result) needs the multi-applet
+hosting prereq regardless.
+
+## Prerequisites to build first
+
+1. **Multi-applet hosting** — either N iframes in one `NappletHostActivity` with
+   per-iframe origin isolation + routing, or a host-per-applet process model and
+   a cross-process router in the broker. Decide the model before coding NAP-INC.
+2. **Archetype registry** — a manifest `handles`/archetype tag (align with
+   upstream naps), an index over installed napplets, and a user-set default
+   handler per archetype (mirror NIP-89 handler selection, which Amethyst already
+   models for app recommendations).
+3. **Link-consent UX** — distinct from capability consent: "Allow *Chess* to open
+   *Wallet*?", revocable per pair in a permissions screen.
+
+## Recommendation
+
+When picked up: start with **NAP-INTENT direct-coordinate** (smallest, aligned,
+no new hosting), build the archetype registry next (unlocks default-handler
+dispatch + reuses NIP-89 patterns), and only then tackle live NAP-INC once
+multi-applet hosting lands. Keep the wire `type`/`id` shape identical to upstream
+NAP-INC throughout to avoid a fork.

amethyst/plans/README.md

@@ -0,0 +1,36 @@
+# amethyst plans
+
+_Audited 2026-06-30. 21 plans: 19 shipped (archived), 1 in-progress, 1 queued, 0 abandoned._
+
+## In progress
+| Plan | Summary |
+| ---- | ------- |
+| [2026-05-24-ios-support.md](2026-05-24-ios-support.md) | Incremental KMP-to-iOS port; quartz/commons iOS targets are configured (Phase 1) but no `iosApp` module exists yet. |
+
+## Queued
+| Plan | Summary |
+| ---- | ------- |
+| [2026-06-20-napplet-inter-applet.md](2026-06-20-napplet-inter-applet.md) | NAP-INC / NAP-INTENT inter-applet messaging — deferred; prerequisites (multi-applet hosting, archetype registry, `MESSAGING` capability) not yet built. |
+
+## Archived (shipped)
+| Plan | Summary |
+| ---- | ------- |
+| [archive/2026-05-14-onchain-zaps.md](archive/2026-05-14-onchain-zaps.md) | NIP-BC (kind 8333) onchain Bitcoin zaps — hand-rolled `quartz/nipBCOnchainZaps/` consensus layer plus Android send/receive/display. |
+| [archive/2026-05-25-appfunctions-signer-prompts.md](archive/2026-05-25-appfunctions-signer-prompts.md) | How AppFunctions write verbs acquire signatures across the three signer types; write verbs now ship. |
+| [archive/2026-05-26-appfunctions-gemini-discovery.md](archive/2026-05-26-appfunctions-gemini-discovery.md) | Verifying Gemini-side discovery of Amethyst's AppFunctions; description-based (`isDescribedByKDoc`) discovery shipped. |
+| [archive/2026-05-26-appfunctions-screens-as-verbs.md](archive/2026-05-26-appfunctions-screens-as-verbs.md) | Map every Amethyst screen's feed filter to an AppFunction/MCP verb; 46 verbs now ship. |
+| [archive/2026-05-26-avif-implementation-plan.md](archive/2026-05-26-avif-implementation-plan.md) | Task-by-task plan for AVIF support via a `MediaMimeTypes` helper across the upload pipeline. |
+| [archive/2026-05-26-avif-support.md](archive/2026-05-26-avif-support.md) | Comprehensive design making AVIF a first-class image format on every Amethyst surface. |
+| [archive/2026-05-27-avif-instrumented-tests-design.md](archive/2026-05-27-avif-instrumented-tests-design.md) | Design for on-device AVIF upload-pipeline regression tests with committed fixtures. |
+| [archive/2026-05-27-avif-instrumented-tests-plan.md](archive/2026-05-27-avif-instrumented-tests-plan.md) | Implementation plan for the AVIF instrumented + JVM unit tests and their fixtures. |
+| [archive/2026-06-01-dm-live-tail-and-history-slices.md](archive/2026-06-01-dm-live-tail-and-history-slices.md) | DM loading split into a fixed live tail plus per-relay backward history paging (`WindowLoadTracker` / `RelayLoadingCursors`). |
+| [archive/2026-06-19-napplet-sandbox-host.md](archive/2026-06-19-napplet-sandbox-host.md) | Keyless `:napplet`-process WebView host with brokered, consent-gated capabilities for NIP-5A/5D content. |
+| [archive/2026-06-20-napplet-ecosystem-audit.md](archive/2026-06-20-napplet-ecosystem-audit.md) | Audit of our napplet shell against the upstream `@napplet` SDK; wire-compat gaps subsequently closed. |
+| [archive/2026-06-21-napplet-code-audit.md](archive/2026-06-21-napplet-code-audit.md) | Code audit of the napplet subsystem recording correctness/perf/refactor fixes and deferred items. |
+| [archive/2026-06-21-napplet-sdk-conformance-audit.md](archive/2026-06-21-napplet-sdk-conformance-audit.md) | Feature-by-feature SDK conformance audit; the four conformance breakers were fixed and pinned by tests. |
+| [archive/2026-06-22-napplet-nsite-security.md](archive/2026-06-22-napplet-nsite-security.md) | Security review of the nsite/napplet attack surface; launch-token identity and per-applet origins landed. |
+| [archive/2026-06-23-napplet-nap-theme-notify-inc.md](archive/2026-06-23-napplet-nap-theme-notify-inc.md) | Add the `theme`, `notify`, and `inc` NAP domains so demo napplets boot; capabilities + `NappletIncBus` shipped. |
+| [archive/2026-06-24-napplet-embedded-tabs.md](archive/2026-06-24-napplet-embedded-tabs.md) | Embedded warm bottom-bar napplet/nsite/browser tabs via `SurfaceControlViewHost`, in the new `:nappletHost` module. |
+| [archive/2026-06-25-embed-text-selection-native-parity.md](archive/2026-06-25-embed-text-selection-native-parity.md) | Host-drawn text selection (handles, magnifier, toolbar, IME proxy) for embedded sandboxed surfaces. |
+| [archive/2026-06-25-web-app-naming.md](archive/2026-06-25-web-app-naming.md) | Naming overhaul for web-app / nApplet / nSite / favorite surfaces (route, screen, controller renames). |
+| [archive/2026-06-26-nsite-napplet-favorite-icons.md](archive/2026-06-26-nsite-napplet-favorite-icons.md) | Derive favorited nSite/nApplet bottom-nav icons from verified manifest blobs (`NappletIconPath`). |

amethyst/plans/archive/2026-05-14-onchain-zaps.md

@@ -1,5 +1,8 @@
 # Onchain Zaps in Amethyst
 
+> **Status:** shipped — Full `quartz/nipBCOnchainZaps/` consensus + builder + verify layer ships with Android model/UI wiring (`OnchainZapResolver`, `OnchainZapEvent` view, `ReusableZapButton`).
+> _Audited 2026-06-30._
+
 **Date:** 2026-05-14
 **Status:** Active
 

amethyst/plans/archive/2026-05-25-appfunctions-signer-prompts.md

@@ -1,5 +1,8 @@
 # AppFunctions signer prompts — design
 
+> **Status:** shipped — `AmethystAppFunctions.kt` ships 46 `@AppFunction` verbs including write verbs that acquire signatures across signer types.
+> _Audited 2026-06-30._
+
 **Date:** 2026-05-25
 **Status:** Draft — no code yet
 

amethyst/plans/archive/2026-05-26-appfunctions-gemini-discovery.md

@@ -1,5 +1,8 @@
 # Verifying Gemini-side AppFunctions discovery
 
+> **Status:** shipped — Verification doc; verbs ship with `@AppFunction(isDescribedByKDoc = true)` description-based discovery as the doc concludes.
+> _Audited 2026-06-30._
+
 **Date:** 2026-05-26
 **Status:** Active — answers the open question from
 `2026-05-25-appfunctions-signer-prompts.md`

amethyst/plans/archive/2026-05-26-appfunctions-screens-as-verbs.md

@@ -1,5 +1,8 @@
 # All Amethyst screens as AppFunctions / MCP endpoints
 
+> **Status:** shipped — 46 `@AppFunction` verbs ship in `AmethystAppFunctions.kt`, exceeding the screen-to-verb surface this plan proposed.
+> _Audited 2026-06-30._
+
 **Date:** 2026-05-26
 **Status:** Active — informs the v1 read-verb surface and guides
 future MCP work

amethyst/plans/archive/2026-05-26-avif-implementation-plan.md

@@ -1,5 +1,8 @@
 # AVIF Support Implementation Plan
 
+> **Status:** shipped — `service/uploads/MediaMimeTypes.kt` and the rest of the AVIF upload pipeline are present in `amethyst/`.
+> _Audited 2026-06-30._
+
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
 
 **Goal:** Make AVIF (still and animated) work as a first-class image format in Amethyst across every user-visible surface — uploads (Blossom + NIP-96), feeds, profiles, DMs, emoji packs, reactions, gallery, and caching — with graceful no-crash fallback on Android API < 31.

amethyst/plans/archive/2026-05-26-avif-support.md

@@ -1,5 +1,8 @@
 # AVIF support — comprehensive design
 
+> **Status:** shipped — AVIF upload/display support landed — `MediaMimeTypes.kt` plus the compressor/stripper/preview changes are in tree.
+> _Audited 2026-06-30._
+
 **Issue:** [vitorpamplona/amethyst#837](https://github.com/vitorpamplona/amethyst/issues/837)
 **Date:** 2026-05-26
 **Branch:** `feat/avif-support` (based on `d1610bf97`, origin/main = upstream/main)

amethyst/plans/archive/2026-05-27-avif-instrumented-tests-design.md

@@ -1,5 +1,8 @@
 # Design — AVIF instrumented tests
 
+> **Status:** shipped — The designed test files and AVIF fixtures exist under `amethyst/src/androidTest/` and `src/test/`.
+> _Audited 2026-06-30._
+
 **Date:** 2026-05-27
 **Status:** Design (pre-implementation)
 **Owning module:** `amethyst/`

amethyst/plans/archive/2026-05-27-avif-instrumented-tests-plan.md

@@ -1,5 +1,8 @@
 # AVIF Instrumented Tests — Implementation Plan
 
+> **Status:** shipped — `AvifUploadPipelineInstrumentedTest.kt`, `MediaMimeTypesTest.kt`, and the three `.avif` fixtures are committed.
+> _Audited 2026-06-30._
+
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
 
 **Goal:** Add an Android on-device test layer that catches regressions in the AVIF upload pipeline and the Phase E bugs fixed manually (`C2`–`C8` plus follow-ups in commits `df84475d4`, `5a760c046`, `b9112550b`, `1db110cdf`).

amethyst/plans/archive/2026-06-01-dm-live-tail-and-history-slices.md

@@ -1,5 +1,8 @@
 # DM loading: live tail + per-relay history paging
 
+> **Status:** shipped — Live-tail + per-relay history layers exist (`WindowLoadTracker`, `RelayLoadingCursors`, `AccountGiftWrapsHistoryEoseManager`); doc marks itself authoritative-as-of-code.
+> _Audited 2026-06-30._
+
 > **Status:** authoritative as of 2026-06-05. The "Current architecture"
 > section below describes the code as it actually stands. The original
 > time-slice design and the round-model history are kept at the bottom under

amethyst/plans/archive/2026-06-19-napplet-sandbox-host.md

@@ -0,0 +1,274 @@
+# Napplet / nsite sandbox host — design
+
+> **Status:** shipped — Keyless sandbox host shipped: `:nappletHost` module, `NappletBrokerService`, `NappletLaunchRegistry` all present (rendering half superseded by embedded-tabs).
+> _Audited 2026-06-30._
+
+**Date:** 2026-06-19
+**Status:** Core (commons) implemented + tested; Android host (`:napplet` process, WebView, broker IPC, consent, DataStore) implemented and compiling — needs on-device verification
+**Companion:** `quartz/plans/2026-06-19-napplet-nip5a-resolver.md` (the bottom half — manifest parsing + verified Blossom resolution — already landed in `quartz`).
+
+> **Update (2026-06-24):** the *rendering* model below (full-screen-only
+> `NappletHostActivity`, host living in `amethyst/androidMain/.../napplet/`) has
+> moved on. The sandbox runtime now lives in its own **`:nappletHost`** module and
+> renders three ways — full-screen, embedded warm bottom-bar tabs, and an arbitrary-URL
+> browser — with a cross-process `SurfaceControlViewHost`, a soft-keyboard IME proxy,
+> and per-site Tor routing. See **`amethyst/plans/2026-06-24-napplet-embedded-tabs.md`**
+> for the current architecture. The **trust model** in this doc (keyless `:napplet`
+> process, brokered consent-gated capabilities, verified-blob serving) is unchanged.
+
+## Goal
+
+Render NIP-5A static sites (nsites) and NIP-5D napplets *inside* Amethyst, with
+the applet's HTML/CSS/JS running behind a **hard trust boundary**: it must never
+be able to read the user's `nsec` or any other secret, read app storage,
+`LocalCache`, or other accounts' data, or sign / encrypt / publish / zap without
+explicit per-applet user consent. A napplet is untrusted third-party code served
+from an untrusted Blossom CDN; we treat it accordingly.
+
+## Threat model
+
+**Adversary:** the applet bundle (HTML/CSS/JS), authored by an untrusted party,
+delivered from an untrusted CDN.
+
+It must NOT be able to:
+
+1. Read the `nsec` / any `NostrSigner`-held secret, or decrypted key material.
+2. Read app private storage, `LocalCache`, DataStore, other accounts, or another
+   applet's sandboxed storage.
+3. Sign, encrypt/decrypt, publish, subscribe, or zap without explicit consent.
+4. Escalate to native code, other installed apps, or the file system.
+5. Reach the network directly to exfiltrate or fingerprint (network is a *brokered
+   capability*, default-deny).
+6. Forge content past the signed manifest (already handled by `StaticSiteResolver`:
+   manifest is authority, CDN is untrusted, every blob is sha256-verified).
+
+**Trusted:** the main Amethyst process, the broker, the consent UI, quartz
+verification. **Assumption:** the Android System WebView (Chromium) renderer
+sandbox is sound — and we add an OS-process boundary on top so that even a full
+WebView/renderer escape lands in a process that holds no secrets.
+
+## Why a separate OS process is the load-bearing decision
+
+Android processes have isolated address spaces. The decrypted `privKey`, the
+`KeyPair`, and the `NostrSigner` instance live **only in the main process heap**.
+The applet host runs in a separate process (`android:process=":napplet"`) that:
+
+- never constructs a `NostrSigner`, never touches `SecureKeyStorage`/Keystore,
+  never holds an `Account` or `LocalCache`;
+- only holds an IPC handle to *request operations*, whose **results carry no key
+  material** (a signed event, a ciphertext, a pubkey — never the private key).
+
+So even arbitrary code execution inside the WebView renderer (already its own
+sandboxed process) or inside the `:napplet` app process cannot read the main
+process's memory where the secret lives. This is the guarantee the same-process
+approach cannot make.
+
+## Process & component model
+
+```
+┌─────────────────────────────────────────┐        ┌───────────────────────────────────┐
+│  Main process  (com.vitorpamplona.amethyst)│        │  Applet process  (…:napplet)       │
+│                                            │        │                                    │
+│  Account · NostrSigner · SecureKeyStorage  │        │  NappletHostActivity               │
+│  LocalCache · NostrClient · Blossom · NWC  │        │   └─ WebView                       │
+│                                            │        │       ├─ shell page (trusted,      │
+│  NappletBrokerService (bound, not exported)│◀──AIDL─▶│       │   app-asset origin)        │
+│   └─ commons NappletBroker                 │ Binder │       │   exposes bridge → broker  │
+│       └─ NappletPermissionLedger           │  (UID  │       └─ <iframe sandbox=          │
+│                                            │ checked)│           "allow-scripts">        │
+│  NappletConsentActivity (consent UI)       │        │             = applet, opaque origin│
+└─────────────────────────────────────────┘        └───────────────────────────────────┘
+         holds secrets                                       holds NO secrets
+```
+
+### Three transport hops (each a trust step-down)
+
+1. **applet iframe ↔ shell page** — `postMessage` with strict origin checks. The
+   shell injects a tiny `window.napplet.*` client shim into the applet that wraps
+   postMessage calls into promises (request-id correlation). This is the NIP-5D
+   capability surface the applet codes against.
+2. **shell page ↔ `:napplet` native** — exactly one audited bridge,
+   `WebView.addWebMessageListener` restricted to the **shell origin only** (the
+   applet's opaque-origin iframe cannot reach it). The shell forwards validated
+   requests.
+3. **`:napplet` process ↔ main-process broker** — AIDL/`Messenger`. The broker
+   checks `Binder.getCallingUid() == Process.myUid()` (reject anything not from
+   our own app), consults the permission ledger, runs the operation with the real
+   signer/client, returns only the result.
+
+### WebView hardening (`:napplet`)
+
+- Shell document served from app assets via `WebViewAssetLoader` at a fixed
+  internal origin (`https://napplet.localhost/`). The applet lives in a child
+  `<iframe sandbox="allow-scripts">` **without `allow-same-origin`** → unique
+  opaque origin: no access to the shell DOM, cookies, `localStorage`,
+  `IndexedDB`, or the bridge.
+- Applet resources are served by `shouldInterceptRequest` from an **in-memory map
+  of already-verified blob bytes** (resolved + sha256-checked by
+  `StaticSiteResolver` *before* the WebView loads). Only manifest-declared paths
+  resolve; everything else → 404. No `file://`, no `content://`.
+- `WebSettings`: `allowFileAccess=false`, `allowContentAccess=false`,
+  `allowFileAccessFromFileURLs=false`, `allowUniversalAccessFromFileURLs=false`,
+  `setGeolocationEnabled(false)`, `mediaPlaybackRequiresUserGesture=true`,
+  `safeBrowsingEnabled=true`, no insecure mixed content. `domStorageEnabled`
+  only for a partitioned per-applet store (or off in v1).
+- **CSP**: the shell injects `connect-src 'none'` for the applet by default — the
+  applet has *no direct network*. Relay/Blossom/identity all go through the
+  broker. Direct network is itself a capability (`net`) that widens `connect-src`
+  to user-approved origins only.
+- External navigation blocked in `shouldOverrideUrlLoading`; links open in the
+  system browser only after consent.
+
+## Capability / NAP-domain model
+
+`NappletManifest.requires()` already yields the bare NAP domains
+(`identity`, `relay`, `storage`, …; see `quartz/.../tags/RequiresTag.kt`). Map
+each to a `NappletCapability` with the concrete broker operations it unlocks:
+
+| NAP domain | Capability | Broker operations |
+|---|---|---|
+| `identity` | `IDENTITY` | `getPublicKey`, `signEvent`, `nip04/44 encrypt/decrypt` |
+| `relay`    | `RELAY`    | `publish`, scoped `subscribe` (read) |
+| `value` / `wallet` | `WALLET` | NIP-57 zap request / invoice; NWC pay (stricter, separate grant) |
+| `storage`  | `STORAGE`  | per-applet sandboxed KV store, namespaced by applet identity — **never** app storage |
+| `net`      | `NET`      | widen CSP `connect-src` to approved origins |
+| *(unknown)* | — | **denied by default**, surfaced to the user |
+
+**Applet identity for the ledger** = author pubkey + `d` identifier (the
+addressable coordinate), *not* the blob hash, so grants survive updates. We still
+record the manifest aggregate hash (`computeAggregateHash()`) so a user who picks
+"ask again on code change" is re-prompted when the bundle changes.
+
+## Permission ledger
+
+`NappletPermissionLedger` — per-applet-identity grants, each
+`NappletCapability → GrantState` (`ASK` / `ALLOW_ONCE` / `ALLOW_SESSION` /
+`ALLOW_ALWAYS` / `DENY`), persisted via a `NappletPermissionStore` interface
+(DataStore actual on Android). The broker consults it on every request:
+
+- `DENY` → immediate `Denied` response.
+- `ALLOW_*` → execute.
+- `ASK` → suspend, launch `NappletConsentActivity` (main process), await the
+  user's decision, optionally persist, then execute or deny.
+
+Consent UI reuses the signer-prompt design
+(`amethyst/plans/2026-05-25-appfunctions-signer-prompts.md`) and
+`commons/.../ui/signing`.
+
+### Capability-aware consent policy
+
+The uniform "once / session / always / deny" is refined per capability:
+
+- **Payments (`WALLET`)** — `requiresPerUseConsent = true`: every `payInvoice`
+  re-prompts with the decoded sats amount; the dialog never offers "Always allow"
+  and a stray always/session grant is downgraded to one-shot so nothing persists.
+- **Identity (`IDENTITY`)** — gated by us **only when Amethyst holds the key**
+  (`NostrSignerInternal`). For remote (NIP-46) / external (NIP-55) signers the
+  broker defers to the signer's own per-request consent (no double-prompt), while
+  still honoring a standing per-napplet `DENY` and the `requires` declaration. The
+  sign prompt shows a kind + content preview.
+- **Foreground-only execution** — the napplet WebView's JS/timers are paused when
+  the host isn't resumed (`onPause`/`onResume`), so a backgrounded applet cannot
+  fire a sign/decrypt/pay request whose prompt would surface over — and be
+  confused with — Amethyst's own UI. This is the precondition that makes deferring
+  identity to an external signer safe.
+
+## Module placement
+
+- **`quartz`** — protocol done. (Optional later: a canonical `NapDomain` constant
+  set once the upstream NAP list stabilizes — an open question in the resolver
+  plan.)
+- **`commons/commonMain`** — new CLI-safe `napplet/` feature package:
+  - `napplet/NappletCapability.kt` — NAP-domain ↔ capability mapping.
+  - `napplet/protocol/` — `NappletRequest` / `NappletResponse` sealed families + JSON codec.
+  - `napplet/permissions/` — `NappletPermissionLedger`, `GrantState`, `NappletPermissionStore`.
+  - `napplet/NappletBroker.kt` — platform-agnostic broker: `(NostrSigner +
+    relay/blossom/zap handles + ledger) → (NappletRequest → NappletResponse)`.
+    The heart of the boundary; **fully unit-testable on the JVM**.
+  - `napplet/ui/` — shared consent composables.
+- **`amethyst/androidMain`** —
+  - `NappletHostActivity` (`:napplet`) + WebView + `WebViewAssetLoader` + the
+    shell HTML/JS shim asset.
+  - `NappletBrokerService` (main process, bound, `exported=false`) wrapping the
+    commons broker; `Binder` UID check.
+  - `NappletConsentActivity` (main process) using the commons consent UI.
+  - AIDL/`Messenger` plumbing; OkHttp `BlobFetcher` wiring (the resolver plan's
+    named follow-up).
+  - AndroidManifest: `:napplet` process declaration, the bound service, the
+    consent activity.
+- **`desktopApp`** — out of scope for v1 (the `:napplet` process model is
+  Android-specific; desktop needs a separate child-process/WebView strategy).
+
+## Inter-applet communication (v2)
+
+Napplets' differentiator is talking to each other. Model: applets address each
+other by napplet coordinate; `napplet.send(target, msg)` is **routed through the
+broker** (shell→broker→shell) so two opaque-origin iframes never share an origin
+or memory, and the user (or a manifest-declared allowlist) consents to the link.
+Deferred to v2; v1 nails the single-applet boundary first.
+
+## Testing & verification
+
+- **commons (now, JVM):** broker decision logic per capability
+  (granted/denied/ask), ledger state transitions + persistence semantics,
+  protocol JSON round-trips, and security cases — unknown NAP domain denied,
+  request for an undeclared path 404s without fetching, signer responses never
+  contain key bytes.
+- **Android (needs emulator):** instrumented tests for the WebView host, the
+  opaque-origin iframe isolation, and the process boundary — flagged as on-device
+  verification.
+
+## Phasing (within the "full napplet" milestone)
+
+1. **Core (commons, tested)** — protocol + capability model + ledger + broker. ✅ done.
+2. **Android host** — `:napplet` process + WebView + verified-blob serving via
+   `shouldInterceptRequest` + CSP. ✅ implemented (`NappletHostActivity`).
+3. **Broker IPC + `identity` + `relay`** — Messenger broker
+   (`NappletBrokerService`), `window.napplet.*` shim, consent UI
+   (`NappletConsentActivity`), DataStore ledger. ✅ implemented.
+4. **Capabilities beyond identity/publish:**
+   - **`relay` read** — `QueryEvents`: bounded live relay fetch (`fetchAll`,
+     EOSE/timeout) merged with `LocalCache`, newest-first. ✅
+   - **`storage`** — per-applet sandboxed KV store (`DataStoreNappletStorage`). ✅
+   - **`value`/`wallet`** — `PayInvoice` wired to the user's NWC wallet
+     (`sendZapPaymentRequestFor`); consent shows the decoded sats amount; throws
+     (→ `Failed`) on no-wallet/error/timeout. ✅ (needs on-device verification)
+   - **`net`** — CSP widening to approved origins. ⏳
+5. **Capability enforcement** — the broker refuses any request whose capability is
+   not in the manifest's `requires` (passed host→broker as `declared`), before any
+   consent prompt. ✅
+6. **Inter-applet (NAP-INC / NAP-INTENT)** — deferred; design + prerequisites in
+   `2026-06-20-napplet-inter-applet.md`. **`net`** capability and an install-style
+   up-front capability grant UI also remain. ⏳
+
+### Implemented Android components (amethyst `…/napplet/`)
+
+| File | Process | Role |
+|---|---|---|
+| `NappletHostActivity` | `:napplet` | WebView host: hardened settings, opaque-origin iframe, verified-blob `shouldInterceptRequest`, CSP, `window.napplet` shim, Messenger client |
+| `NappletBrokerService` | main | Bound Messenger service; runs the commons `NappletBroker` against the live account; `exported=false` + UID check |
+| `NappletConsentActivity` / `NappletConsentCoordinator` | main | Capability-consent dialog + suspend bridge to the broker |
+| `DataStoreNappletPermissionStore` | main | Persistent grant store (`NappletPermissionStore` actual) |
+| `NappletProtocolJson` / `NappletIpc` | both | JSON codec + Messenger wire contract |
+| `NappletLauncher` | caller | Packs a verified manifest into the host Intent |
+| `assets/napplet/shell.html` | `:napplet` | Trusted shell page that sandboxes the applet iframe and relays messages |
+
+### Remaining before user-facing ship
+
+- **On-device verification (needs emulator/device):** opaque-origin iframe really
+  excludes the bridge; CSP `connect-src 'none'` blocks fetch/XHR/WebSocket; a real
+  napplet renders and round-trips a `getPublicKey` / `signEvent` through consent.
+- ✅ **UI entry point:** a "Napplets" drawer item → `NappletsScreen` that lists
+  cached napplet manifests (kinds 15129/35129) and launches the host.
+- ✅ **Process isolation:** `Amethyst.onCreate` now skips `AppModules` entirely in
+  the `:napplet` process, so the account/signer are never loaded there. (Previously
+  `initiate()` loaded the account in every process — a real hole, now closed.)
+- ✅ **Privacy:** the host routes blob fetches through the user's Tor SOCKS proxy
+  when active; the port is passed in by the launcher (main process) so the sandbox
+  process never touches the account-bound HTTP stack.
+- ✅ **Relay discovery:** `NappletsFilterAssembler` (registered in
+  `RelaySubscriptionsCoordinator`, invoked by `NappletsScreen`) REQs kinds
+  15129/35129 from the user's read relays while the screen is open, so manifests
+  flow into `LocalCache` for the list to render.
+- **Consent UX:** reuse `commons/.../ui/signing` styling; show the manifest title
+  and a per-capability rationale; batch-grant on first run.

amethyst/plans/archive/2026-06-20-napplet-ecosystem-audit.md

@@ -0,0 +1,277 @@
+# Napplet implementation audit vs the upstream SDK / demo runtimes
+
+> **Status:** shipped — Audit doc; the wire-compatibility gaps it identified were subsequently closed (shell handshake, keys, upload now in the broker/codec).
+> _Audited 2026-06-30._
+
+**Date:** 2026-06-20
+**Sources:** `github.com/napplet/naps` (NAP specs), `github.com/napplet/web`
+(`@napplet/shim` SDK), `github.com/kehto/web` + `kehto.github.io/web/playground`
+(reference runtime). Audited against our branch `claude/awesome-pasteur-xwiwad`.
+
+## TL;DR
+
+Our shell is a **correct and security-hardened NIP-5A/5D renderer + capability
+broker** — process isolation, verified-blob serving, default-deny CSP,
+capability-aware + signer-aware consent, foreground-only, permissions UI. Those
+are *shell-quality* properties the demo runtimes don't even specify, and we're
+ahead there.
+
+**But it is not wire-compatible with the napplet ecosystem.** Real napplets are
+built against `@napplet/shim`, which exposes a **namespaced** `window.napplet.*`
+and a **`{type:"domain.action", id}`** postMessage envelope. We inject a **flat**
+`window.napplet.*` and use a **`{id, payload:{op}}`** envelope. A napplet from the
+kehto playground calling `window.napplet.relay.publish(...)` or
+`window.napplet.shell.supports("relay")` hits `undefined` on our shell. So today:
+**0 real ecosystem napplets run as-is.**
+
+## Reference: the upstream surface
+
+`window.napplet` namespaces (from `@napplet/web`):
+
+| Namespace | Methods (upstream) |
+|---|---|
+| `shell` | `supports(domain)` — **required of every runtime** |
+| `identity` | `getPublicKey()`, `onChanged(handler)` |
+| `keys` | signing / NIP-04 / NIP-44 (separate domain from `identity`) |
+| `relay` | `subscribe(filters)` (live), `publish(event)`, `query(filters)`, `publishEncrypted` |
+| `storage` | `get(key)`, `set(key, value)`, `remove(key)` |
+| `inc` | `emit(type, payload)`, `on(type, handler)` (inter-napplet) |
+| `resource` | `bytes(url)`, `bytesAsObjectURL(url)` — fetch https/blossom/nostr/data |
+| `value` | shell-mediated value transfer + zaps (depends on `relay`) |
+| `upload` | shell-mediated file/blob upload (Blossom; depends on `relay`) |
+| `intent` | invoke a napplet by archetype |
+| `theme`, `notify`, `media`, `config`, `outbox`, `ifc`, `cvm` | further domains |
+
+**Envelope:** `{ type: "<domain>.<action>", id, ...payload }` →
+result `{ type: "<domain>.<action>.result", id, ok, ... }`.
+**Sandbox:** `iframe sandbox="allow-scripts"` only (no `allow-same-origin`) — **we
+match this exactly.**
+
+## Coverage scorecard (our broker vs upstream domains)
+
+| Domain | Status | Notes |
+|---|---|---|
+| `shell` | ✗ **missing** | `supports()` is foundational; without it well-behaved napplets bail early |
+| `identity` | ◐ | `getPublicKey` ✓; `onChanged` ✗ (no push) |
+| `keys` (sign/nip04/nip44) | ◐ | implemented, but lumped under our `IDENTITY` capability, not a `keys` domain |
+| `relay` | ◐ | `publish` ✓, `query` ✓ (now live); `subscribe` (live) ✗, `publishEncrypted` ✗ |
+| `storage` | ✓ | get/set/remove — shape matches (wire differs) |
+| `value` | ◐ | we do `payInvoice` via NWC; upstream `value` is zaps/value-transfer (depends on relay) — different method shape |
+| `resource` | ✗ | no `bytes(url)`; we only serve manifest subresources |
+| `upload` | ✗ | no Blossom upload |
+| `inc` | ✗ | deferred (see inter-applet plan) |
+| `intent` | ✗ | deferred |
+| `theme` `notify` `media` `config` `outbox` `ifc` `cvm` | ✗ | not modeled |
+
+Our extra `NET` domain has **no upstream equivalent** — upstream fetching is
+`resource`. Our `fromNapDomain` recognizes `identity/relay/value/storage/net`;
+everything else (`shell`, `resource`, `upload`, `inc`, `intent`, `keys`, …) maps
+to *unknown → denied*. So a manifest `requires: ["relay","shell","resource"]`
+would have two of three flagged unknown — and `shell` is mandatory.
+
+## The two interop blockers
+
+1. **Envelope.** Real napplets send `{type:"relay.publish", id, event}` and await
+   `{type:"relay.publish.result", id, ok}`. We expect `{id, payload:{op:"publish"}}`
+   and reply `{id, response:{type:"published"}}`. Incompatible.
+2. **API surface.** Upstream is namespaced (`relay.publish`, `identity.getPublicKey`,
+   `keys.signEvent`, `shell.supports`, `resource.bytes`). Ours is flat
+   (`getPublicKey`, `signEvent`, `publish`, `queryEvents`, `payInvoice`) + a
+   namespaced `storage`. Only `storage` lines up.
+
+Both live in our **edge layer** (the injected JS shim + `NappletProtocolJson` +
+`NappletIpc`) and the capability enum — *not* in the security core (broker,
+ledger, process model), which is dialect-agnostic. So aligning is an edge rewrite,
+not an architecture change.
+
+## What we have that the demos don't
+
+- Separate-OS-process sandbox (`:napplet`), not just an iframe.
+- Verified-blob serving (manifest-authoritative, per-blob sha256) with default-deny
+  CSP (`connect-src 'none'`) and Tor-routed fetch.
+- Capability **declaration enforcement** (manifest `requires` gate), **per-use**
+  payment consent, **signer-aware** identity deferral, **foreground-only** execution.
+- A persisted permission ledger + a permissions-management UI.
+
+These are real-shell concerns the reference runtimes leave to the implementer; we
+should keep them.
+
+## Recommended path to ecosystem compatibility (priority order)
+
+1. **Adopt the upstream envelope** `{type:"domain.action", id}` / `…​.result` in the
+   shim + `NappletProtocolJson` + `NappletIpc`. (Unblocks everything.)
+2. **Re-shape the injected shim** to the namespaced `window.napplet.*` and add
+   **`shell.supports(domain)`** (cheap; derive from the granted capability set).
+3. **Split capabilities** to match domains: `keys` (sign/nip04/nip44) distinct from
+   `identity` (getPublicKey/onChanged); rename `NET`→`resource`; add `SHELL`,
+   `UPLOAD`, `VALUE` semantics (zap-by-target, not raw invoice).
+4. **Add the push channel**: `relay.subscribe` (live events), `identity.onChanged`,
+   later `inc.on` — the host already holds a `JavaScriptReplyProxy` we can push
+   unsolicited `…event` messages through.
+5. **`resource.bytes`** (consented fetch of https/blossom/nostr/data) and
+   **`upload`** (Blossom), both brokered + consent-gated.
+6. Lower priority / app-specific: `theme`, `notify`, `media`, `config`, `outbox`,
+   `intent`, `inc`, `ifc`, `cvm`.
+
+## Update (2026-06-20): ecosystem alignment landed
+
+Acted on #1–#5. The dialect mismatch is resolved:
+
+- **Envelope** is now `{type:"<domain>.<action>", id}` → `{type:"…​.result", id, ok, …}`,
+  matching upstream (codec + host shuttle + shim rewritten; round-trip unit-tested).
+- **Namespaced `window.napplet.*`** shim: `shell.supports`, `identity.getPublicKey`
+  (+`onChanged` stub), `keys.{signEvent,nip04*,nip44*}`, `relay.{publish,query,subscribe}`,
+  `storage.{get,set,remove}`, `value.payInvoice`, `resource.{bytes,bytesAsObjectURL}`,
+  `upload.blob`. The applet's own SDK-targeted code now runs unchanged.
+- **`shell.supports(domain)`** implemented (no consent; reflects declared+brokered domains).
+- **Capabilities split** to the domain model: `SHELL`, `IDENTITY`, `KEYS`, `RELAY`,
+  `STORAGE`, `VALUE`, `RESOURCE`, `UPLOAD` (was `IDENTITY/RELAY/WALLET/STORAGE/NET`).
+- **`resource.bytes`** implemented for `https`/`data` (broker-fetched, Tor-routed,
+  consent-gated); `blossom:`/`nostr:` are a follow-up.
+
+## Update (2026-06-21): return shapes verified against `@napplet/nap@0.15.0`
+
+Pulled the canonical message types (`@napplet/nap` `*/types.d.ts` + `value-types`) and corrected
+the result field names — several were wrong guesses. The authoritative wire:
+
+| Method | Request `type` | Result field(s) |
+|---|---|---|
+| `identity.getPublicKey` | `identity.getPublicKey` | `pubkey: string` |
+| `identity.getProfile` | `identity.getProfile` | `profile: ProfileData \| null` |
+| `identity.getRelays` | `identity.getRelays` | `relays: Record<url, {read,write}>` |
+| `identity.getFollows`/`getMutes`/`getBlocked` | same | `pubkeys: string[]` |
+| `identity.getList` | `identity.getList` | `entries: string[]` |
+| `identity.getZaps` / `getBadges` | same | `zaps[]` / `badges[]` |
+| `storage.getItem/setItem/removeItem/keys` | **`storage.get`/`set`/`remove`/`keys`** | `value` / — / — / `keys: string[]` |
+| `relay.publish` / `publishEncrypted` | same | template in the **`event`** field; result `{ok, event, eventId}` |
+| `relay.query` | `relay.query` | `events: NostrEvent[]` |
+| `resource.bytes` | `resource.bytes` | `blob: Blob`, `mime: string` |
+
+`ProfileData` is `{ name?, displayName?, about?, picture?, banner?, nip05?, lud16?, website? }` —
+note **`displayName`** (camelCase), so the shell maps kind-0 `display_name` → `displayName` rather
+than dumping raw content. Corrected in code: identity reads now emit method-specific fields;
+`storage.*` wire types fixed (the *function* is `getItem`, the *envelope* is `storage.get`);
+`storage.keys` returns `keys`; `relay.publish`/`publishEncrypted` read the template from `event`;
+`getProfile` builds a `ProfileData` object. Locked by `NappletProtocolJsonTest`.
+
+**Transport: structured-clone objects + subscription push — landed.** `@napplet/core` posts
+**structured-clone objects** (not JSON strings) via `target.postMessage(obj)` and validates
+cloneability — that is how `resource.bytes` returns a real `Blob`, and why a stock napplet's
+object messages were dropped before (our shell only forwarded strings). Fixed:
+
+- **`shell.html` bridges object↔string both ways.** applet→native serializes object envelopes to
+  the string the native bridge carries (requests carry no Blobs); native→applet parses the reply
+  to an object and posts a **structured-clone object** (what the SDK reads via `e.data.type`), not
+  a string. The injected shim accepts either form.
+- **`resource.bytes` Blob.** The shell rebuilds a real `Blob` from the host's base64 `bytes`+`mime`
+  before delivering, so both the SDK and our shim resolve to a `Blob`.
+- **`relay.subscribe` push channel.** Subscriptions are answered with `relay.event` (one per match)
+  then `relay.eose`, keyed by `subId` — no `.result`, matching the SDK. A new `MSG_PUSH` IPC frame
+  lets the broker push unsolicited envelopes the host forwards verbatim; `relay.close` is a
+  fire-and-forget no-op. Today this delivers the **initial snapshot then EOSE**.
+
+Still open: a **live subscription tail** (push as events arrive, not just the snapshot) plus
+`identity.onChanged`/`inc.on`; multi-`filters` queries (we use the first filter); the Blossom
+`upload` gateway; and **on-device verification** — the shell/shim changes are JS and not exercised
+by the JVM unit tests.
+
+## Update (2026-06-21, even later): feed surfacing + nsite runtime hardening
+
+- **Feed surfacing (sandbox-preserving).** Napplets gained an inline feed card (nsites already had
+  one), both render via `NoteCompose`, are indexed in `LocalCache`, and a profile **"Apps & Sites"**
+  tab lists a user's manifests. The cards are inert (`Text`+`Button`, no WebView); execution begins
+  only on explicit tap, in the `:napplet` process.
+- **SPA route fallback** — a document navigation (Accept: text/html) to a route not in the manifest
+  serves the verified `index.html`; missing sub-resources still 404.
+- **External-link handoff** — a user-tapped off-origin http(s) link opens in the system browser
+  (gesture-gated so a hostile site can't auto-redirect); the sandbox WebView never navigates away.
+- **`resource.bytes` `blossom:` scheme** — `blossom:<sha256>` fetches from the user's kind:10063
+  Blossom servers and verifies the hash before returning. `nostr:` stays deferred (unspecified).
+- **Content-type byte-sniffing** — when a manifest path has no/unknown extension, the resolver
+  sniffs magic bytes; text/markup is never sniffed, so HTML detection stays extension-driven.
+  Unit-tested in quartz.
+- **kind:10063 fallback** — the launcher augments the manifest's `servers` with the author's
+  published Blossom list (best-effort); every blob is still sha256-verified.
+- **Blob caching** — the host OkHttp client caches blobs on disk (forced-immutable, since they're
+  content-addressed); the resolver re-verifies every served blob, so a stale entry can't be served.
+
+Remaining: live subscription tail + `identity.onChanged`/`inc.on`, the Blossom `upload` gateway,
+`getList`/`getZaps`/`getBadges`, the `nostr:` resource scheme, multi-`filters` queries — and
+**on-device verification** of all the WebView-host behavior.
+
+## Update (2026-06-20, later): verified against `@napplet/shim@0.16.0` and corrected
+
+Pulled the authoritative SDK (`@napplet/shim` v0.16.0, npm/unpkg) and corrected the
+implementation to its real contract. Commit `5ca44e27` had carried several wrong guesses; the
+verified surface is:
+
+| Namespace | Verified methods (v0.16.0) |
+|---|---|
+| `shell` | `supports(domain, protocol?)` (sync), `ready()`, `onReady(cb)`, `services` |
+| `identity` | `getPublicKey()`, `onChanged(h)`, + read API (`getRelays/getProfile/getFollows/getList/getZaps/getMutes/getBlocked/getBadges`) |
+| `keys` | **keyboard/command actions** — `registerAction/unregisterAction/onAction` (NOT signing) |
+| `relay` | `publish(template, options?)` → signed `NostrEvent`, `publishEncrypted(template, recipient, encryption?)`, `query(filters)`, `subscribe(filters, onEvent, onEose, options?)` |
+| `storage` | `getItem/setItem/removeItem/keys` (512 KB quota; `instance.*` variant) |
+| `resource` | `bytes(url)` → `Blob`, `bytesAsObjectURL(url)` |
+| `inc` | `emit(topic, extraTags?, content?)`, `on(topic, cb)` |
+
+Crucial design fact, quoted: **"signing and encryption are mediated by the shell via
+`relay.publish()` and `relay.publishEncrypted()`"** and *"no cryptographic dependencies — the
+shim sends JSON envelope messages and the shell handles identity"*. **There is no `sign()` and no
+raw nip04/44 in the napplet surface.** There is **no `value` or `upload` domain** in v0.16.0.
+
+Corrections landed (this commit):
+
+- **Signing model fixed (the big one).** Dropped the bogus `keys.signEvent` / `keys.nip04*` /
+  `keys.nip44*` napplet ops. `relay.publish` now takes an **unsigned template** (`kind/tags/content`)
+  and the broker signs it as the user and returns the signed event — exactly the upstream contract.
+  Added `relay.publishEncrypted` (broker encrypts to recipient with nip44/nip04, then signs +
+  publishes). The broker still defers the per-signature prompt to remote/external signers
+  (`signsAsUser` + non-internal signer) and honors standing DENY.
+- **`keys` re-pointed to keyboard actions** (`registerAction/unregisterAction/onAction`),
+  implemented as client-side no-op stubs (not yet wired to the host keyboard) so action-using
+  napplets don't crash. They never cross the broker boundary.
+- **`storage` renamed** to `getItem/setItem/removeItem` and **`storage.keys`** added end-to-end
+  (protocol + broker + DataStore + shim), matching upstream.
+- **`resource.bytes` now returns a `Blob`** (shim builds it from `{bytes, mime}`); wire field
+  renamed `contentType`→`mime`.
+- **`shell.supports(domain, protocol?)`** gained the optional protocol arg; added `shell.ready()`,
+  `onReady`, `services` stubs.
+- **`relay.subscribe`** wired (initial matches; live tail still a follow-up).
+- `value.payInvoice` and `upload.blob` are **kept as clearly-marked Amethyst-specific extensions**
+  (no upstream equivalent in v0.16.0) — a real `@napplet/shim` napplet never calls them, so they
+  can't conflict.
+
+Verified off-device: `commons:jvmTest` (broker + capability + ledger) and the amethyst codec
+round-trip test (`NappletProtocolJsonTest`) both green.
+
+Still open (documented, not blocking basic napplets):
+- **`upload`** — wired end-to-end (protocol/shim/capability) but the Android Blossom
+  gateway is unprovided (`Unsupported`): a correct upload needs a content Uri + signed
+  auth event + server selection, which needs on-device verification.
+- **Live push** — `relay.subscribe` returns initial matches via `query`; a live tail and
+  `identity.onChanged`/`inc.on` need a push channel over the existing reply proxy.
+- **Underspecified domains** — `inc`, `intent`, `theme`, `notify`, `media`, `config`,
+  `outbox`, `ifc`, `cvm` remain unknown→denied (no method spec available to build to).
+- **Method-name fidelity** — ✅ resolved. All standard method names/shapes are now confirmed
+  against `@napplet/shim@0.16.0` (see the later update above), not guessed.
+- **Identity read API** — ✅ partly landed. `identity.getProfile` (kind-0 content), `getRelays`
+  (NIP-65 read/write map), `getFollows` (kind-3 authors), `getMutes` and `getBlocked` (NIP-51
+  decrypted user tags) now read from the active `Account` and return JSON, gated by the IDENTITY
+  consent (and deferred to remote/external signers). `getList`/`getZaps`/`getBadges` route through
+  but degrade to `Unsupported` for now; `identity.onChanged` is still a client-side no-op (needs
+  the live push channel). Return shapes still want on-device verification against a real napplet.
+- **On-device verification** of the whole round-trip with a real playground napplet.
+
+Revised ecosystem-compatibility estimate: **~80%** — real request/response napplets using
+identity(getPublicKey)/relay(publish/publishEncrypted/query/subscribe)/storage/resource +
+`shell.supports` now run against the *verified* contract; remaining gaps are the identity read
+API, keyboard-action wiring, live subscription tails, the niche domains, and device verification.
+
+## Verdict (original assessment, pre-update)
+
+- **As a secure NIP-5A/5D renderer + broker:** ~85% — the hard, security-critical
+  parts are done and tested; gaps are on-device verification and breadth of ops.
+- **As an ecosystem-compatible napplet host (runs real napplets):** ~25% — blocked
+  by the envelope + namespaced-API mismatch and missing `shell`/`resource`. Until
+  #1–#2 land, existing napplets won't run regardless of how solid the core is.

amethyst/plans/archive/2026-06-21-napplet-code-audit.md

@@ -0,0 +1,65 @@
+# Napplet subsystem code audit — bugs, performance, refactor, placement
+
+> **Status:** shipped — Audit recording completed fixes (LiveSub teardown, broker caching, shim extraction); referenced files exist.
+> _Audited 2026-06-30._
+
+**Date:** 2026-06-21. Scope: the napplet/nsite subsystem (`amethyst/.../napplet/`,
+`commons/.../napplet/`, `quartz/.../nip5aStaticWebsites` + `nip5dNapplets`).
+
+## Fixed in this pass
+
+| # | Category | Issue | Fix |
+|---|---|---|---|
+| 1 | 🐛 correctness | **Live subscription unsubscribed from the wrong client after an account switch** — `closeLiveSubscription`/`onDestroy` used the *current* account's client, leaking the sub on the original. | `LiveSub` holder stores the exact `INostrClient` that opened the sub; teardown uses it. |
+| 2 | 🐛 correctness | **Multi-relay subscriptions emitted N `relay.eose`** (one per relay) — the SDK expects one. | An `eoseSent` latch (`compareAndSet`) emits a single `relay.eose`. |
+| 3 | ⚡ perf | **Broker rebuilt on every request** (new gateways/prompt each call). | `broker()` caches per account (reference identity), rebuilt only on switch. |
+| 4 | ⚡ perf | **A fresh `OkHttpClient` per blob fetch** (no connection pooling). | `blobHttpClient()` caches the client keyed by Tor port (`@Synchronized`). |
+| 5 | ♻️ refactor | **105-line `SHIM_JS` string constant** in `NappletHostActivity.kt` (no highlighting, hard to edit). | Moved to `assets/napplet/shim.js`, loaded once like `shell.html`. |
+| 6 | 📝 docs | Stale shim comments (`onChanged` "follow-up", `subscribe` "snapshot…follow-up"). | Rewritten to match reality (no-op onChanged; live tail). |
+
+All compile; `commons:jvmTest` + the amethyst napplet suite stay green.
+
+## Deferred — with rationale (not silently dropped)
+
+- **Duplicate events across relays** — the same event id can arrive from multiple relays, so
+  `relay.event` is pushed more than once. Deduping needs a per-subscription seen-id set (unbounded
+  memory for long subs); napplets already dedupe by id. Left as-is; documented.
+- **Background teardown of live subscriptions** — a backgrounded-but-alive napplet keeps its relay
+  subscription open (the WebView is paused, but the service keeps streaming). It is *not* a
+  permanent leak: the service is bind-only, so closing the napplet → `unbindService` → service
+  `onDestroy` → all subs torn down. A proper pause/resume (unsubscribe on background, re-`REQ` on
+  foreground) is a real optimization but needs an IPC pause/resume signal + device verification.
+- **Request ordering** — requests are handled concurrently (`scope.launch` per message), so
+  `storage.set` then `storage.get` aren't guaranteed in-order. Matches the SDK's async model;
+  serializing would hurt throughput. Documented, not changed.
+- **`runBlocking` in `shouldInterceptRequest`** — this runs on a WebView *background* worker thread
+  (not the UI thread), so blocking there during a blob fetch is acceptable; WebView fans out
+  resource loads across workers. Left as-is.
+- **Over-flags from the sweep that aren't real:** `pendingRequests` / `bridgeReplyProxy` "races" —
+  both the `WebMessageListener` callback and the reply `Handler` run on the **main looper**, so
+  there is no cross-thread access. A null `bridgeReplyProxy` only drops a reply to an
+  already-gone WebView (the applet is gone too) — harmless.
+
+## Recommended moves to commons / quartz
+
+- **quartz (protocol-only): correct as-is.** NIP-5A/5D events, `NappletManifest`,
+  `StaticSiteResolver` + `StaticSitePathLookup` (`sniffContentType`), `SiteAggregateHash` are all in
+  `commonMain`. No app policy leaked in.
+- **commons (shared logic): mostly correct.** Broker, capability, identity, request/response,
+  permissions ledger/store, and gateway interfaces are in `commonMain` — right home.
+- **DONE: `NappletProtocolJson` → `commons/jvmAndroid`.** Moved to
+  `commons/.../napplet/protocol/` (next to the types it marshals) so the future **desktop** host
+  reuses the exact wire codec. Its tests stay in `amethyst` (JUnit4) for now and still exercise it
+  via the commons dependency; converting them to `kotlin.test` and moving to commons `jvmTest` is a
+  small follow-up. See `desktopApp/plans/2026-06-21-napplet-desktop-host.md`.
+- **amethyst (Android-only): correctly platform-bound.** `NappletHostActivity` (WebView/process),
+  `NappletBrokerService` (Service/Messenger/account), the gateway *implementations* (account,
+  `BlossomUploader`, DataStore, NWC), `NappletLauncher`, consent UI, `NappletIpc`, and the screens
+  all belong here.
+
+## Lower-priority refactors (not done)
+
+- Extract a shared Tor-aware OkHttp builder (host `buildHttpClient` vs service `blobHttpClient`
+  duplicate the proxy logic) into a small util.
+- `summaryFor`'s long `when` could become a per-request-type method, and `encodeResponse`'s big
+  `when` is repetitive — both are readability, not correctness.

amethyst/plans/archive/2026-06-21-napplet-sdk-conformance-audit.md

@@ -0,0 +1,131 @@
+# Napplet SDK conformance audit — feature by feature
+
+> **Status:** shipped — Conformance audit; the four breakers are marked fixed and pinned by `NappletSdkConformanceTest`.
+> _Audited 2026-06-30._
+
+**Date:** 2026-06-21
+**Authoritative sources (verified, not from memory):**
+`@napplet/nap@0.15.0` (`dist/<domain>/types.d.ts` — the canonical wire message types),
+`@napplet/shim@0.16.0` (the SDK napplets bundle), `@napplet/core@0.15.0` (base envelope +
+shell handshake). Audited against branch `claude/awesome-pasteur-xwiwad`.
+
+Our edge layer: `NappletProtocolJson` (codec), `NappletRequest`/`NappletResponse` (commons),
+`NappletHostActivity` (`SHIM_JS` + `shell.html` relay), `NappletBroker`, `NappletBrokerService`.
+
+## Update — the four 🔴 breakers are now implemented
+
+All four conformance breakers below are fixed (codec pinned by `NappletSdkConformanceTest`):
+
+1. **Shell handshake** — the host answers `shell.ready` with `shell.init { capabilities:{domains,
+   protocols}, services }` built from the declared domains (`NappletProtocolJson.encodeShellInit`),
+   so a stock napplet's cached environment is populated and `supports()` works.
+2. **Id-less messages** — `onShellMessage` no longer drops messages without an `id`: `shell.ready`
+   is answered locally, and other fire-and-forget messages get a synthetic id so they reach the broker.
+3. **keys** — `keys.registerAction`/`keys.unregisterAction` decode and the broker acknowledges them
+   (declared-gated, no consent) so `registerAction()` resolves; the shim dispatches the `keys.action`
+   push. (The actual global-key binding is still a follow-up — `keys.action` isn't emitted yet.)
+4. **upload** — realigned to `upload.upload { request:{ data, mimeType, filename } }` → rich
+   `UploadResult { ok, uploadId, status, url, sha256, size, mimeType }`; `shell.html` inlines the
+   request `Blob` as base64 so it survives the bridge; the gateway uploads via the app's
+   `BlossomUploader` to the user's kind:10063 server with a signed auth event.
+
+Also now implemented (the ◐ follow-ups):
+- **Live subscription tail** — `relay.subscribe` opens a real `client.subscribe` whose listener
+  streams `relay.event` (stored + live), `relay.eose`, and `relay.closed` pushes by `subId`;
+  `relay.close` unsubscribes (tracked in `liveSubs`, torn down in `onDestroy`).
+- **Multi-`filters`** — `relay.query`/`subscribe` honor every filter in the `filters[]` array,
+  not just the first (`decodeFilterList`, gateway `query(List<Filter>)`).
+- **`resource.cancel`** — accepted at the host edge as a no-op `Done`.
+
+Still open: identity `getList`/`getZaps`/`getBadges` + `onChanged` (object shapes / list-type
+semantics underspecified), the `keys.action` push (needs a host command-palette UI to *trigger*
+actions — registration already conforms), the `resource` `nostr:` scheme (unspecified bytes),
+`inc`/`intent`/the niche domains, and **on-device verification** of the host/shell behavior.
+
+## Base envelope & error convention (verified)
+
+- `NappletMessage` carries only **`type`** (`"domain.action"`). **There is no universal `id`** —
+  request/response pairs add `id`; fire-and-forget and handshake/push messages have **no `id`**.
+- **No universal `ok`.** Each domain picks its own: `relay.publish`/`publishEncrypted`,
+  `outbox.publish`, `upload`, `intent` use `ok: boolean`; identity/storage/query results omit `ok`
+  and signal success by the data field's presence + an optional `error?: string`. The SDK shim
+  rejects when `error` is present and otherwise reads the domain's data field.
+  - **Ours:** we set `ok` on *every* result. Harmless (the SDK reads the data field and ignores the
+    extra `ok`), and our own injected shim relies on `ok`. ✅ compatible, ⚠️ non-canonical.
+
+## Transport (verified) — two architectural gaps
+
+1. **Structured-clone objects, not strings.** `@napplet/core` posts cloneable **objects**. Our
+   `shell.html` now bridges object↔string both ways (done earlier). ✅
+2. **🔴 The host drops id-less messages.** `NappletHostActivity.onShellMessage` does
+   `id = optString("id").ifEmpty { return }` — so every message **without an `id`** is dropped:
+   `shell.ready`, `inc.emit`, `keys.unregisterAction`. This silently breaks the shell handshake and
+   all fire-and-forget messages. **Must fix** to forward/handle id-less messages.
+3. **🔴 Blob-carrying requests can't cross.** `upload.upload`'s request payload contains a `Blob`
+   (`data: Blob | ArrayBuffer`). Our applet→native bridge does `JSON.stringify`, which turns a Blob
+   into `{}`. Real-napplet uploads lose their bytes. Needs a Blob-aware request path.
+
+## Shell handshake (verified) — 🔴 not implemented
+
+The SDK does **not** send a `shell.supports` message. Instead:
+- napplet posts **`shell.ready`** (no payload), and
+- the shell replies **once** with **`shell.init`** = `{ capabilities: { domains: string[],
+  protocols: Record<string,string[]> }, services: string[] }`.
+- `shell.supports(capability, protocol?)` is then answered **synchronously and locally** from that
+  cached environment.
+
+**Ours:** we implement a `shell.supports` *request* (`ShellSupports` → `Supported`) and our injected
+shim calls it async. A real napplet never sends `shell.supports`; it sends `shell.ready` — which our
+host **drops** (no id) — so its cached environment stays empty and `supports()` returns `false` for
+everything, likely making well-behaved napplets bail early. **Highest-impact gap.**
+Fix: host answers `shell.ready` with a `shell.init` carrying the declared domains.
+
+## Per-domain conformance matrix
+
+Legend: ✅ conformant · ◐ partial · 🔴 mismatch/missing · ➖ not modeled.
+
+| Domain | SDK surface (wire) | Ours | Verdict |
+|---|---|---|---|
+| **shell** | `shell.ready`→`shell.init{capabilities,services}`; `supports()` local | `shell.supports` request→`{supported}` | 🔴 wrong model (no handshake) |
+| **identity** | `getPublicKey`→`{pubkey}`; `getProfile`→`{profile}`; `getRelays`→`{relays}`; `getFollows`/`getMutes`/`getBlocked`→`{pubkeys}`; `getList`→`{entries}`; `getZaps`→`{zaps}`; `getBadges`→`{badges}`; `onChanged` push | getPublicKey ✅; profile/relays/follows/mutes/blocked ✅ (exact fields); getList/getZaps/getBadges → Unsupported; onChanged no-op | ◐ reads ✅, push/3 methods missing |
+| **relay** | `publish{event}`→`{ok,event,eventId}`; `publishEncrypted{event,recipient,encryption}`; `query{filters[]}`→`{events}`; `subscribe{subId,filters,relay?}`; `close{subId}`; pushes `relay.event{subId,event,resources?}`, `relay.eose{subId}`, `relay.closed{subId,reason?}` | publish/publishEncrypted ✅ (read `event`); query ◐ (first filter only); subscribe ✅ + event/eose push ✅ (snapshot); close ✅ (no-op); `relay.closed` not emitted | ◐ strong; multi-filter + live tail + `relay.closed` open |
+| **storage** | `get`→`{value}`; `set`; `remove`; `keys`→`{keys}` (512 KB quota) | ✅ exact (`get/set/remove/keys`, `value`/`keys` fields) | ✅ (quota not enforced) |
+| **resource** | `bytes{url}`→`{blob,mime}`; `cancel`; https/blossom/nostr/data | bytes ✅ (shell builds Blob); https/data/blossom ✅; nostr ➖; cancel ➖ | ◐ nostr + cancel missing |
+| **keys** | `registerAction{action}`→`{actionId,binding?}`; `unregisterAction{actionId}`; pushes `keys.action{actionId}`, `keys.bindings{bindings[]}` | client-side no-op stubs only; **host rejects** `keys.*` (decodes to null) | 🔴 real napplets' `registerAction` rejects |
+| **upload** | `upload.upload{request:{data:Blob,mimeType?,...}}`→`{ok,uploadId,status,url?,sha256?,...}`; `upload.status` | type `upload` + `{bytes(base64),contentType}`→`{url}`; gateway null→Unsupported | 🔴 wrong type + shape + Blob transport |
+| **inc** | `inc.emit`; `inc.subscribe`/`.result`; `inc.unsubscribe`; `inc.event` push; channel mode (`inc.channel.*`) | ➖ (deferred; maps to null→denied) | ➖ not modeled |
+| **intent** | invoke a napplet by archetype | ➖ | ➖ |
+| **theme/notify/media/config/outbox/ifc/cvm** | further domains | ➖ | ➖ |
+
+## Inconsistencies, ranked
+
+1. **🔴 Shell handshake missing** (`shell.ready`→`shell.init`). Real napplets get an empty
+   capability environment → `supports()` false → likely bail. *Fix: host emits `shell.init`.*
+2. **🔴 Id-less messages dropped** by the host. Breaks the handshake + every fire-and-forget
+   (`inc.emit`, `keys.unregisterAction`). *Fix: forward/handle id-less messages.*
+3. **🔴 `keys.*` rejects** for real napplets (we only stub client-side). *Fix: decode
+   `keys.registerAction`/`unregisterAction`, answer a stub `{actionId}`; later wire `keys.action`.*
+4. **🔴 `upload` non-conformant** (`upload` vs `upload.upload`, flat base64 vs `request:{data:Blob}}`,
+   `{url}` vs rich `UploadResult`) AND the Blob can't cross our string bridge. *Fix: realign the
+   wire + a Blob-aware request path when the gateway lands.*
+5. **◐ `relay.query`/`subscribe` use only the first of `filters[]`.** Multi-filter napplets get
+   partial results. *Fix: honor all filters.*
+6. **◐ Identity `getList`/`getZaps`/`getBadges` + `onChanged`** unimplemented.
+7. **◐ `resource` `nostr:` scheme + `resource.cancel`** unimplemented.
+8. **◐ `relay.closed` push** not emitted; **live subscription tail** absent (snapshot only).
+9. **⚠️ Non-canonical `ok` on every result** (harmless, but not how the SDK signals success for
+   identity/storage/query).
+
+## What the conformance tests assert
+
+`NappletSdkConformanceTest` (amethyst, JVM) pins the codec to the **exact SDK wire** for the
+methods we support, so a regression that drifts from `@napplet/nap` fails CI:
+
+- **Requests:** the SDK's exact envelope (`relay.publish{event}`, `storage.get`, `identity.*`,
+  `resource.bytes`, multi-`filters`) decodes to the right `NappletRequest`.
+- **Results:** `encodeResponse` emits the SDK's exact field names (`pubkey`, `profile`, `relays`,
+  `pubkeys`, `entries`, `value`, `keys`, `events`, `event`/`eventId`, `bytes`/`mime`).
+- **Pushes:** `relay.event{subId,event}` / `relay.eose{subId}` match the SDK push shapes.
+- **Gap guards:** tests that *document current behavior* for the known gaps (`shell.ready`,
+  `keys.registerAction`, `upload.upload`, `inc.emit` currently decode to `null`), each annotated
+  with the audit item so the day we fix them the guard flips intentionally.

amethyst/plans/archive/2026-06-22-napplet-nsite-security.md

@@ -0,0 +1,114 @@
+# Napplet / nsite security review (2026-06-22)
+
+> **Status:** shipped — Security review recording completed hardening; `NappletLaunchRegistry` token model and per-applet origins are in tree.
+> _Audited 2026-06-30._
+
+A review of the attack surface for NIP-5A static sites (nsites) and NIP-5D napplets,
+the protections in place, and the residual risks — with what was fixed in this pass
+and what remains as future work.
+
+## Trust model (what holds)
+
+- **Keys never enter the sandbox.** The `:napplet` process holds no account/signer.
+  Signing happens only in the main process (`signer` fixes `pubkey`, host clock
+  prevents backdating). *"Even a full WebView/renderer escape into this process yields
+  no secret."*
+- **Content integrity.** Every blob is sha256-verified against the **signed** manifest
+  before serving (`StaticSiteResolver`); cache is content-addressed + re-verified, so a
+  poisoned/stale cache can't be served. nsites launch with **zero** capabilities.
+- **Network containment.** App CSP `connect-src 'none'`; egress only via the brokered,
+  consent-gated `resource.bytes`, Tor-routed. Bridge is origin-restricted + main-frame.
+- **IPC binding** is `exported=false` + same-UID (`onBind` UID check). Payments always
+  prompt per-use with the amount.
+
+## Fixed in this pass
+
+1. **Cross-napplet identity/storage spoofing (was: per-message identity).** The broker
+   used to trust `author`/`identifier`/`declared` sent on **every** IPC message from the
+   `:napplet` process. A WebView→native escape could forge another napplet's coordinate
+   and read/act as it. Now the **main process** mints a random launch token
+   (`NappletLaunchRegistry`), hands only that token to the sandbox, and the broker
+   resolves it back to the trusted identity + declared set. A compromised sandbox can act
+   as nothing but the napplet it was launched as (it holds only its own token).
+
+2. **Private mute/block leak via `identity.getMutes`/`getBlocked`.** These read
+   `muteList.flow` / `blockPeopleList.flow`, which contain **decrypted private** entries.
+   Now they read the events' **public** tags only (`MuteListEvent.publicMutes()`,
+   `PeopleListEvent.publicUsersIdSet()`).
+
+3. **Silent "allow-always" actions + UI-redress.** Added persistent **trusted chrome**
+   (a sandbox bar the applet can't draw over: shield + name + tap-to-see "what it can
+   access") and a **live toast** when a granted RELAY/UPLOAD/VALUE op runs — so an
+   allow-always grant can't act completely silently. Also fixes the host drawing under
+   the status/navigation bars (edge-to-edge insets).
+
+4. **Real per-applet storage origin (was: opaque sandbox → broken apps).** The applet
+   ran in an `allow-scripts`-only iframe served under `napplet.local/app/`, i.e. an
+   **opaque ("null") origin**. That has no `localStorage`/`IndexedDB`/service worker
+   (reads throw `SecurityError`), and module scripts / asset fetches are CORS-blocked, so
+   essentially every bundled SPA rendered **blank** or **crash-looped** ("cache version
+   0 → reset → reload" forever, because IndexedDB never persisted the version). Each
+   applet now loads on its **own** internal origin `https://<id>.napplet.local` —
+   `id = sha256(author + ":" + identifier)`, truncated + letter-prefixed to a DNS label —
+   with `allow-scripts allow-same-origin`, served at the **origin root** (bundlers emit
+   absolute `/assets/...` URLs). A real origin restores DOM storage / IndexedDB / SW and
+   makes the applet's own assets same-origin (no CORS shim needed). **Isolation is
+   preserved precisely because the applet origin is distinct from the shell's:** the
+   bridge stays origin-restricted to the shell (`napplet.local`), so the cross-origin
+   applet still cannot reach it or read the shell DOM — it talks only via `postMessage`,
+   which the shell relays. Per-applet subdomains keep applets' storage isolated from one
+   another; CSP `connect-src 'none'` is unchanged; the app CSP was **tightened** to
+   `'self'` (it no longer grants the shell origin).
+
+## Residual risks / future work
+
+- **`allow-same-origin` is safe only while the applet origin ≠ the shell/bridge origin.**
+  A frame carrying *both* `allow-scripts` and `allow-same-origin` can strip its own
+  sandbox **iff it is same-origin with its embedder**; here it never is (applet on a
+  per-applet subdomain, shell on `napplet.local`), so it cannot. **Load-bearing
+  invariant — do not break:** never serve the applet on the shell origin, and never add
+  an applet origin (`*.napplet.local`) to the bridge's `addWebMessageListener` allowlist
+  (kept to `setOf(ORIGIN)`). Collapsing the two origins would hand the applet the bridge.
+- **Persistent client storage is now a persistence/exfil surface.** The applet keeps
+  `localStorage`/`IndexedDB` across launches (origin-scoped, per applet, key-free and
+  isolated from other applets). A consented applet can build durable local state and,
+  combined with allow-always RESOURCE, a durable profile. Tie to the session-scoped-grant
+  proposal above; consider a "clear this applet's data" affordance.
+- **Per-applet origin id.** `sha256(author:identifier)` is stable per applet and
+  collision-resistant; root/replaceable applets (kinds 15128/15129, no `d` tag) collapse
+  to one origin per author — fine, since there's one root per author. Changing the id
+  scheme later resets an applet's storage (new origin); acceptable.
+- **Service workers are reachable but unwired.** With a real origin the applet *can* now
+  register a service worker; the host does not yet route SW fetches
+  (`ServiceWorkerControllerCompat`), so registration currently fails gracefully (a
+  warning, not a crash). If SW support is wired later, SW-originated fetches MUST go
+  through the same verified content server, never the network.
+
+- **Coarse, persistent grants.** Non-payment capabilities persist as ALLOW_ALWAYS. A
+  consented napplet can still, thereafter, publish as you (RELAY), read your social graph
+  (IDENTITY), and make arbitrary network calls (RESOURCE) without re-prompting. The new
+  chrome + toasts make this *visible*, but the model is still allow-forever. **Proposed:**
+  a session-scoped grant ("Allow while open", cleared on close) in `GrantState` +
+  consent dialog, defaulted for RESOURCE/RELAY; and per-origin consent for cross-origin
+  `resource.bytes` https fetches.
+- **`resource.bytes` as exfil channel.** Once RESOURCE is allow-always, the applet can
+  encode data into arbitrary https URLs through the Tor proxy. Tor hides the IP, not the
+  payload. Tie to the per-origin/session proposal above.
+- **`'unsafe-inline'` in app `script-src`.** Required to inject the shim; the applet is
+  the author's own (content sha256-pinned), so it's not an escalation. `connect-src
+  'none'` remains the real boundary. Residual, accepted.
+- **Trust pivots on the author key.** A compromised author key lets an attacker push a
+  new *signed* manifest and own the app — expected Nostr trust model. Aggregate `x` hash
+  is enforced when present (only *recommended* by the spec); per-path hashes always
+  protect.
+- **Sandbox isolation is now structural.** The `:napplet` runtime
+  (`NappletHostActivity`, content server, IPC, key actions) lives in its own
+  `:nappletHost` module that depends only on `:commons` + `:quartz` — so it is
+  *compile-time incapable* of importing `Amethyst`/`LocalCache`/`Account`. The
+  broker-side (signer, gateways, `NappletLaunchRegistry`) stays in `:amethyst`;
+  the activity binds the broker service by class-name string and the two halves
+  communicate only over Messenger IPC.
+- **Launch-token lifecycle.** Tokens are capped (LRU, 128) rather than explicitly
+  unregistered on sandbox close (the sandbox is a separate process and can't reach the
+  main-process registry). A long-backgrounded napplet whose token was evicted would need
+  relaunch. Acceptable; revisit if it bites.

amethyst/plans/archive/2026-06-23-napplet-nap-theme-notify-inc.md

@@ -0,0 +1,55 @@
+# Napplet NAP domains: theme, notify, inc
+
+> **Status:** shipped — `NappletCapability` has `THEME`/`NOTIFY`/`INC` and `NappletIncBus` is wired into `NappletBrokerService`.
+> _Audited 2026-06-30._
+
+Date: 2026-06-23
+Status: in progress
+
+## Problem
+
+Real-world demo napplets (e.g. kehto/web's `apps/playground/napplets/*`) hard-gate
+their own boot: each reads `window.napplet.shell.supports(<domain>)` for every
+domain in its manifest `requires` and aborts ("unavailable") if any is missing.
+**Every** kehto demo `requires: theme`; most also need `inc`; toaster needs
+`notify`. Amethyst's `fromNapDomain` returns `null` for `theme/notify/inc/cvm`,
+so `shell.supports()` is false for them and all demos fail at boot.
+
+These are real NAP service domains (kehto ships reference handlers). We add the
+three the demos need (theme, notify, inc); `cvm` is deferred (its own design).
+
+## Wire contracts (verified against kehto reference services + demos)
+
+- **theme** — `theme.get` → `theme.get.result { theme: { colors: { background, text, primary } } }`.
+  Optional host push `theme.changed { theme }` (we skip the push for v1; the
+  app theme rarely changes while a napplet is foreground). Read-only, **no consent**.
+- **notify** — `notify.create { title, body }` → `notify.created { id }` (past-tense,
+  **not** the generic `.result`), `notify.list` → `notify.listed { notifications }`,
+  `notify.dismiss { notificationId }` fire-and-forget. Consent-gated (ask once).
+  Host shows a system notification + tracks a per-coordinate store for list/dismiss.
+- **inc** — a topic pub/sub bus. `inc.emit { topic, args, payload }` (fire-and-forget)
+  delivers `inc.event { topic, payload }` to **other** subscribed napplet sessions
+  (no echo to the sender). `inc.subscribe`/`inc.unsubscribe` register interest.
+  Gated on the INC declaration at the router edge (like `identity.watch`), no
+  per-call consent. NOTE: Amethyst runs napplets **foreground-only, one at a time**,
+  so cross-napplet delivery is usually a no-op in practice — but the bus is correct
+  if/when multiple sessions overlap, and it lets the demos boot + emit without error.
+
+## Capability mapping & consent
+
+`NappletCapability` gains `THEME`, `NOTIFY`, `INC`; `fromNapDomain` maps the bare
+domains. `requiresConsent` is false for `SHELL` and `THEME` (negotiation/cosmetic),
+true otherwise. INC is authorized at the router (declared-only) and never reaches
+the broker consent path.
+
+## Touch points
+
+- commons: `NappletCapability`, `NappletRequest`, `NappletResponse`,
+  `NappletBrokerCollaborators` (new gateways), `NappletBroker`,
+  `protocol/NappletProtocolJson` (decode + custom reply types + inc/theme pushes),
+  `NappletRequestRouter` (inc edge ops).
+- amethyst: `gateways/AccountNappletGateways` (+ theme/notify gateways), an
+  app-wide `NappletIncBus`, and `NappletBrokerService` wiring (notify store + inc
+  push transport, like `NappletLiveSubscriptions`/`NappletIdentityWatch`).
+
+Staged commits: (1) theme, (2) notify, (3) inc.

amethyst/plans/archive/2026-06-24-napplet-embedded-tabs.md

@@ -0,0 +1,183 @@
+# Embedded napplet / nsite / browser tabs — final architecture
+
+> **Status:** shipped — `EmbeddedTabLayer` and the `:nappletHost` module exist; embedded warm-tab + browser render paths are implemented (PR #3348).
+> _Audited 2026-06-30._
+
+**Date:** 2026-06-24
+**Status:** Implemented on `claude/webview-menu-custom-url-ikrgbz` (PR #3348); needs on-device verification.
+**Supersedes the rendering half of** `amethyst/plans/2026-06-19-napplet-sandbox-host.md`
+(full-screen-only `NappletHostActivity` in `amethyst/androidMain`). The trust
+model is unchanged and still governed by
+`amethyst/plans/2026-06-22-napplet-nsite-security.md`.
+
+## What changed since the sandbox-host plan
+
+The 2026-06-19 design rendered a napplet/nsite **only** full-screen, in its own
+`:napplet` Activity/task. This branch adds:
+
+1. A second, **embedded** render path: warm bottom-bar "favorite" tabs that live
+   inside the main Amethyst window, swapped in place with no relaunch — built on
+   a cross-process `SurfaceControlViewHost` surface.
+2. A **browser** host: the same keyless `:napplet` sandbox now also renders an
+   arbitrary user-typed URL (not just a verified-blob nsite/napplet), as both a
+   full-screen activity and an embedded tab.
+3. A working **soft keyboard** inside the embedded surface (the cross-process
+   surface window cannot itself be an IME target).
+4. The sandbox runtime extracted into its **own `:nappletHost` module** (depends
+   only on `:commons` + `:quartz`; cannot import `Amethyst`/`LocalCache`/`Account`).
+5. **Per-site Tor / open-web** routing memory, and a startup **preloader** that
+   warms every bottom-bar favorite so the first tap is instant.
+
+The keyless-sandbox guarantee is preserved throughout: keys live only in the main
+process, every NIP-07 / `window.napplet` call is brokered + consent-gated, and the
+embedded surface is z-ordered **below** the client window.
+
+## Two render paths, one sandbox
+
+| | Full-screen | Embedded tab |
+|---|---|---|
+| Container | `NappletHostActivity` / `NappletBrowserActivity` (`:napplet` task) | `SandboxedSdkView` in `EmbeddedTabLayer` (main window) |
+| Surface | the Activity's own window | `SurfaceControlViewHost` shipped to the host `SandboxedSdkView` |
+| Chrome (pull-down) | `NappletControlSheet` (native Android `View`s) | `TopControlSheet` (Compose) |
+| Soft keyboard | the Activity's own window (native) | `RemoteImeView` proxy in the **main** window |
+| Lifecycle | one session per task | many warm sessions, parked off-screen |
+
+Both paths run the **same** `NappletHostService` / `NappletBrowserService` and the
+same `shell.html` + `shim.js`; only the host/embedding differs.
+
+## Persistent warm-surface layer (embedded)
+
+`EmbeddedTabLayer` is mounted once in the app shell, below the drawer/dialogs. It
+renders **every** warm session's `SandboxedSdkView` and keeps it attached:
+
+- `EmbeddedTabHost` (object) owns the set of warm `sessions`, the active id, and
+  the reserved `contentBounds`. `setActive(id)` returns a token; `clearActiveIfOwner(token)`
+  only clears if the caller still owns it (so a fast tab A→B→A swap can't have B's
+  teardown clear A's just-set active id). `retainOnly(ids)` warm-keeps the
+  bottom-bar favorites (+ the momentarily-active tab) and evicts the rest.
+- The active session is offset over the current tab's bounds; **inactive warm tabs
+  keep the same size and are merely shifted ~10 000 dp off-screen** (never resized
+  to 1 dp). Parking by translation rather than resize is what avoids the ~1 s black
+  flash on every tab switch (a resize forces a surface re-render).
+- The surface is z-below, so Compose draws over it — that's how `TopControlSheet`
+  sits on top. Each surface is wrapped in `EmbeddedSurfaceTouchHolder` so a scroll
+  gesture isn't stolen by a host-side ancestor (the cross-process WebView can't
+  `requestDisallowInterceptTouchEvent` for itself).
+
+`EmbeddedTabFactory` builds/acquires the per-app controller (`EmbeddedBrowserController`
+/ `EmbeddedNappletController`, both `EmbeddedSurfaceController` + `EmbeddedImeBridge`)
+and gates preloading on Tor (won't warm a Tor-routed site over clearnet while Tor is
+still connecting).
+
+## Per-session services (the multi-tab refactor)
+
+`NappletHostService` / `NappletBrowserService` are **single shared instances** (same
+bind `Intent`); per-tab state lives in a `NappletTab` / `BrowserTab` map keyed by the
+client-stamped `KEY_SESSION_ID` (`NappletEmbedContract` / `NappletBrowserContract`).
+Each tab carries its **own** reply `Messenger`, so broker responses + pushes route to
+the right tab (the broker echoes `replyTo`). Critical correctness rules baked in:
+
+- `contentServer` is `@Volatile` (read on the WebView worker thread in
+  `shouldInterceptRequest`, written on main).
+- broker-reply delivery drops a reply whose tab was replaced (`tabs[id] !== tab`)
+  and wraps `postMessage` in `runCatching` (a torn-down WebView can't crash the relay).
+- session close / `onDestroy` tears down **that tab's** content server + WebView only
+  (an earlier bug destroyed sibling tabs' WebViews → "open A, switch to B, back to A =
+  black").
+
+## Embedded soft keyboard (IME proxy)
+
+The embedded surface is a `SurfaceControlViewHost` window: in z-below mode it forwards
+touch but **cannot be an IME target**, so a focused field would get no keyboard. The fix
+mirrors Flutter's `TextInputPlugin`:
+
+- `RemoteImeView` — an invisible, focusable `EditText` in the **main** app window takes
+  the keyboard. A real local `Editable` is the source of truth (the platform handles
+  composing regions, suggestions, autofill); edits are **coalesced across batch edits**
+  and the whole **editing state** (text + selection + composing) is shipped — not
+  individual ops. It flushes **synchronously** at the outermost `endBatchEdit` so a
+  compose-then-commit in one frame preserves the composing region.
+- `shim.js` IME agent (gated on `window.__nappletImeProxy`) applies that state to the
+  focused field and synthesizes the matching DOM `input`/composition events so web
+  frameworks react as if typed natively. It is surrogate-pair-safe (emoji / CJK-supplement
+  never split into a lone surrogate) and supports `contenteditable` via Range-mapped char
+  offsets (in-place replacement, not a `textContent` overwrite), with selection-echo dedup.
+- `EmbeddedTabLayer` shrinks the active surface to clear the keyboard using the **snapped**
+  `WindowInsets.imeAnimationTarget` (not the per-frame animated `ime`), so the expensive
+  cross-process surface resize happens once, not every animation frame.
+
+State + ops cross over `MSG_IME_EVENT` / `MSG_IME_OP` (`EmbeddedImeBridge`). Full-screen
+hosts set neither IME flag (they have a native keyboard).
+
+## Per-site network routing
+
+`WebUrlNetworkRegistry` (keyed by site host) and `NappletNetworkRegistry` (keyed by
+`author:identifier`) remember whether a site routes through **Tor** (default) or the
+**open web** — some servers reject Tor exits, so a user can opt one out and it must
+survive relaunch. Both hydrate from DataStore asynchronously and now expose
+`awaitReady()`; the preloader awaits hydration **before** its first routing decision so a
+cold start can't route an open-web-pinned site through Tor. Live in the **main** process
+only; the keyless sandbox never reads them (the launcher stamps the choice into the
+launch intent).
+
+## The two control-sheet twins
+
+`TopControlSheet` (Compose, `:amethyst`, drawn in the main process over the z-below
+surface) and `NappletControlSheet` (hand-built Android `View`s, `:nappletHost`, in the
+keyless sandbox process) are deliberate twins: the sandbox module is Compose-free and
+can't depend on `:amethyst`, so the composable can't be shared. They are kept visually
+identical by hand — same 10 dp row rhythm, same muted-icon + framework `Switch` Tor row.
+Both are a top-center pull-down (collapsed = a small grabber out of the corner where a
+site puts its own avatar/menu): route over Tor, reload, "what it can access" (sandboxed
+apps), open full screen.
+
+## Bottom bar
+
+Built-ins and favorites are one ordered list (`BottomBarEntry`, polymorphic with
+`@SerialName("builtIn")` / `@SerialName("favorite")`). `UISharedPreferences.decodeBottomBarItems`
+migrates the old persisted discriminator (the kotlinx default fully-qualified class name)
+to the short names, falling back to `DefaultBottomBarEntries` — fixing the one-time bottom
+bar reset the `@SerialName` change would otherwise have caused.
+
+The **Browser** launcher (`BrowserScreen`) is an omnibox + the shared `FavoriteAppsGrid`;
+each opened URL lands in its own full-screen `NappletBrowserActivity`. When the Browser is
+reached from the drawer (pushed) rather than as a bottom-bar tab, its omnibox shows a back
+arrow — the standard `nav.canPop()` rule (mirrors `NappletsTopBar`).
+
+## File map (final)
+
+**`:nappletHost`** (`com.vitorpamplona.amethyst.napplethost`, `:napplet` process):
+`NappletHostService` / `NappletBrowserService` (per-session WebView hosts),
+`NappletHostActivity` / `NappletBrowserActivity` (full-screen),
+`NappletHostUiAdapter` / `NappletBrowserUiAdapter` (`SandboxedUiAdapter` for the embedded
+surface), `NappletControlSheet` (native pull-down), `NappletContentServer` +
+`NappletBlobHttp` + `NappletBlobCache` + `NappletBlobPrefetcher` (verified-blob serving,
+Tor-routed, content-addressed), `NappletEmbedContract` / `NappletBrowserContract` /
+`NappletHostContract` (Messenger wire keys), `NappletIpc`, `NappletKeyActions`,
+`NappletWebViewInsets`.
+
+**`:amethyst` embed** (`ui/screen/loggedIn/embed`): `EmbeddedTabLayer`, `EmbeddedTabHost`,
+`EmbeddedTabFactory`, `EmbeddedTabChrome`, `EmbeddedSurfaceController`,
+`EmbeddedSurfaceTouchHolder`, `EmbeddedImeBridge`, `RemoteImeView`, `TopControlSheet`,
+`EmbeddedTabPreloader`, `TorToggleButton`.
+
+**`:amethyst` main-process napplet** (`napplet/`): `NappletBrokerService`,
+`NappletLauncher`, `NappletLaunchRegistry`, `WebUrlNetworkRegistry`,
+`NappletNetworkRegistry`, `SandboxForegroundHold`, consent (`NappletConsent*`), gateways,
+DataStore stores.
+
+**`:amethyst` launchers/screens**: `BrowserScreen`, `FavoriteWebAppScreen`,
+`FavoriteNappletScreen`, `FavoriteAppsScreen` + `FavoriteAppsGrid`.
+
+**`:commons`**: `shell.html`, `shim.js` (`composeResources/files/napplet/`),
+`FavoriteApp`/`FavoriteAppIcon`, `BottomBarEntry`.
+
+## Residual / on-device verification
+
+- All embedded-surface behavior (IME, scroll-gesture claiming, warm-keep across swaps, the
+  Tor shrink) needs emulator/device verification — `SurfaceControlViewHost` + the IME proxy
+  can't be unit-tested.
+- The IME proxy runs a host-window `EditText`; it ships only editing **state** to the page,
+  never to any key material — the keyless-sandbox boundary is unaffected.
+- Launch-token lifecycle, coarse persistent grants, and the `resource.bytes` exfil channel
+  remain as tracked in the 2026-06-22 security review.

amethyst/plans/archive/2026-06-25-embed-text-selection-native-parity.md

@@ -0,0 +1,259 @@
+# Embedded text selection — native-Android parity
+
+> **Status:** shipped — Doc states core feature-complete; host-drawn selection (handles, magnifier, IME proxy) landed in `EmbeddedTabLayer`/`RemoteImeView`.
+> _Audited 2026-06-30._
+
+**Status:** core feature-complete. The working set landed in `fix(embed): IME typing +
+host-drawn text selection for embedded surfaces` (commit `e0a2a9ab81`); subsequent
+sessions added the magnifier, the `SelectionUiState` refactor, hybrid word+char
+handle-extend, and a run of polish/bug fixes (below). **The one open platform bug —
+full-screen round-trip kills selection paint — is now FIXED** (root cause was
+process-global `pauseTimers()` + an attached `WebView.destroy()`; see that section).
+
+**2026-06-26 fixes (branch `fix/embed-ime-selection`):**
+- **No-blink word-select** — the overlay handles + toolbar blinked 2–3× on long-press
+  word-select; cause was the shim's selection-*reveal* scrolls (a `<textarea>` auto-
+  scrolling to show a forming/re-asserted range) tripping the hide-on-scroll path. The
+  shim now timestamps selection activity (`lastSelActivityAt`) and treats a scroll within
+  350 ms as a reveal-scroll (reposition, don't hide, don't re-arm the timer). Plus a
+  `RemoteImeView` range-lost debounce as a safety net. (#2, #3)
+- **Page selection clears on field focus** — focusing a field left the page-text handles
+  + Copy bar up (the shim's page `selectionchange` is muted once a field is focused), and
+  being z-above they STOLE the field handle's drag. Fixed: `focusin` emits `pagesel:false`
+  (+ resets the scroll state); host `ImeEvent.Focus` also drops the page overlay. (#2)
+- **Caret handle drag** moved the loupe but not the caret — the unified `awaitEachGesture`
+  did `change.consume()` BEFORE `change.positionChange()`, and `positionChange()` returns
+  `Offset.Zero` once consumed, so `fp` never accumulated. Fixed with
+  `positionChangeIgnoreConsumed()` (also immune to the sandbox surface consuming the move). (#10)
+- **Hybrid word+char handle-extend** completed (#5, below).
+- **Full-screen round-trip corruption FIXED** (was the open bug; see section).
+- **Embed WebViews follow the APP theme** — separate from selection, but same surfaces:
+  see `embed-webview-prefers-color-scheme-limitation` memo / `EmbedWebViewTheme.kt`.
+
+## Why we draw selection ourselves
+
+Editable fields inside an embedded napplet/nsite/browser tab live in the keyless
+`:napplet` process and render through `SurfaceControlViewHost` /
+`SandboxedSdkView` (privacy-sandbox UI). A WebView rendered into an off-window
+surface like this **cannot host the soft keyboard and cannot present Chrome's
+own text-selection UI** (handles, the floating action-mode toolbar, the
+magnifier). Chrome detects it has nowhere to put that UI and collapses the
+selection to the focus endpoint.
+
+So, exactly like Flutter's `TextInputPlugin` did for its virtual-display era, we
+relay editing to the main process: an invisible `EditText` (`RemoteImeView`)
+hosts the keyboard, `shim.js` mirrors DOM selection/caret geometry out over the
+Messenger channel, and `EmbeddedTabLayer` draws the selection UI in Compose on
+top of the surface. Everything we want for parity, we draw — the platform gives
+us nothing here.
+
+## What native Android gives a text field (the parity target)
+
+This is the full feature inventory we are cloning, with activation/deactivation
+rules, so we can check off coverage. Native impl lives in `android.widget.Editor`
+(+ `SelectionActionModeHelper`, `android.widget.Magnifier`,
+`PopupTouchHandleDrawable` on the Chrome side).
+
+| # | Native feature | Activates | Deactivates | Our status |
+|---|----------------|-----------|-------------|------------|
+| 1 | **Insertion handle** (the teardrop "blob" under the caret) | tap in editable text; tap again to re-show | typing, scroll start, focus loss, ~4s inactivity timeout | ✅ `InsertionHandle`. **Native availability rule now matched (2026-06-25):** only shown when the field is NON-EMPTY (`Editor` gates the handle behind `text.length() > 0`, via `SelectionUiState.fieldHasText`) — fixes it popping up on focus of an empty box; hides on typing (`onEdited`), scroll (`scrolling`), focus loss, and ~4s inactivity (`hideCaret` timeout), re-showing on the next tap — via an explicit `ime.carettap` shim signal (DOM `click`), so a tap that doesn't move the caret still re-shows it. Device-verified. |
+| 2 | **Selection handles** (asymmetric left/right teardrops) | long-press word, double-tap word, drag-extend | tap-collapse, typing, new selection | ✅ `SelectionHandle(isStart)` + drag-to-extend, for BOTH plain page text (`pageExtend`) AND in-field `<input>`/`<textarea>` selections (`fieldExtend`, 2026-06-25). The shim reports the selection's caret feet (`sx/sb`,`ex/eb`, flagged `rng`) via the same mirror-div as the caret; the host holds the range geometry separately so Chrome's transient collapse-to-caret (the re-assert fight) doesn't yank the handles to the field edges. **Tap-to-collapse (2026-06-25):** a single tap inside a selection dismisses it to a caret at the tapped offset + insertion handle — the shim's `click` handler collapses explicitly via `offsetFromPoint` (off-window Chrome doesn't do it itself). Device-verified. |
+| 3 | **Floating toolbar** (Cut/Copy/Paste/Select-All/Share/…) | selection made, or tap insertion handle (Paste/Select-All) | scroll/fling (hides, returns on settle), handle drag (hides), tap-collapse | ⚠️ `EmbeddedSelectionToolbar` (Cut/Copy/Paste/Select-All). **Hide-during-handle-drag ✅ device-verified.** Hide-during-scroll via `SelectionUiState.scrolling` (shim `ime.scroll` + re-report on settle). **2026-06-26: the scroll path was hardened** — selection-*reveal* scrolls (forming/re-asserting a range auto-scrolls a `<textarea>`) are no longer treated as user scrolls (they blinked the overlays); the shim guards them via `lastSelActivityAt` and the hide self-heals instead of re-arming. (User content-scroll-hide still wants a clean on-device pass.) Still missing: overflow, Share/Web-Search/process-text. |
+| 4 | **Magnifier / loupe** (the zoom bubble above the finger while dragging a handle or the caret) | finger down + moving on a handle or the caret | finger up | ✅ **Built (2026-06-25).** `Magnifier` bubble in [EmbeddedMagnifier.kt] follows the dragged caret/selection handle, showing live magnified page pixels captured in the `:napplet` provider and shipped over IPC ([EmbeddedMagnifierProbe], option B). Both embed paths wired (browser + napplet); verified on device for the browser path. Capture Y is locked to the caret/selection line (X follows the finger). Possible further polish: RGB_565 to cut encode, themed crosshair, clamp capture X to the line so a fast drag past EOL doesn't show blank. |
+| 5 | **Word-granularity long-press** then char-extend | long-press | — | ✅ HYBRID word+char in-field handle-extend (2026-06-25, completed): `fieldExtend` keeps per-drag state (`fieldDragWordEnd`/`fieldDragWordStart`, reset on a >250ms gap or edge switch). The drag baselines at the current selection edge; sweeping PAST that word's far boundary snaps to the next whole word (`wordEndAt`/`wordStartAt`), while moving within/back from the furthest-reached word gives CHARACTER precision — so you can fine-tune to a single character (the previously-missing "then char" mode). Page-text extend stays char (no offset model). |
+| 6 | **Double-tap = word, long-press = word, (triple-tap/drag = paragraph)** | tap count | — | ✅ double-tap + long-press both select a word (2026-06-25). Chrome word-selects on the 2nd tap, then abandons it by collapsing to the end (off-window quirk); the host re-assert restores it. The shim `click` handler DEFERS its tap-to-collapse ~300ms and the real `dblclick` cancels that timer, so the word selection survives (a timing-only guard was flaky ~40%). Triple-tap/paragraph not done. |
+| 7 | **Smart selection / entity expansion** (`TextClassifier`: phone, URL, address, date → entity actions in toolbar) | selection lands on an entity | — | ❌ not built (low priority) |
+| 8 | **Drag selected text** (long-press a selection → drag-and-drop to move) | long-press on existing selection | drop | ❌ not built (low priority) |
+| 9 | **Auto-scroll while dragging to a viewport edge** | handle dragged near top/bottom edge | finger leaves edge / up | ✅ works (2026-06-25, user-confirmed). The drag driver (`onMagnify`) detects the finger in the surface's top/bottom edge zone and sends `ime.autoscroll`; the shim scrolls the textarea (else the window) and re-reports geometry, flagged so the hide-on-scroll path doesn't fire. Scrolls per drag-move in the edge zone (not on a perfectly-held finger). **Fixed alongside:** the nav drawer's left-edge swipe was hijacking the edge drag — `EmbeddedSelectionDrag.dragging` (set by `onMagnify`) now suspends the drawer's `gesturesEnabled` while a handle is dragged. |
+| 10 | **Caret snapping to character boundaries** | always during caret/handle drag | — | ✅ via `offsetFromPoint` binary search + Y-clamp. **2026-06-26 fix:** the insertion-handle drag stopped moving the caret (loupe showed, caret frozen) — the unified `awaitEachGesture` consumed the pointer change BEFORE reading `positionChange()`, which returns `Offset.Zero` once consumed, so the accumulated finger position never advanced. Now reads `positionChangeIgnoreConsumed()` first. |
+| 11 | **Themed handle/caret drawables + blink** | always | — | ✅/⚠️ The host-drawn handles use `colorScheme.primary` — which IS the native `textSelectHandle`/accent color — so the handle drawables are themed (the actionable part). The caret bar + selection-highlight are drawn by Chrome inside the off-window surface: the caret already blinks natively, and theming its color/the highlight would mean injecting CSS into arbitrary third-party pages (intrusive; `::selection` was already ruled out as non-painting), so those are intentionally left to Chrome. |
+| 12 | **Insertion-handle Paste/Select-All mini-popup** | tap the insertion handle | tap elsewhere | ✅ built (2026-06-25). Tapping the bare insertion handle toggles a Paste/Select-All bar above the caret (`SelectionUiState.insertionPopup`, toggled from the handle's unified tap/drag gesture); tap-elsewhere/typing/blur/selection/scroll dismiss it. Fixed a latent bug: toolbar items now consume the *down* (not just the up) so the tap doesn't bleed through to the surface and blur the field. Device-verified (Select-all selects all text, field stays focused). |
+
+Legend: ✅ done · ⚠️ partial · ❌ missing.
+
+### Activation/deactivation is the hard part
+
+Most of the bugs we already fixed were activation-timing bugs (cursor-jumps-to-end,
+collapse-on-tap, focus-transfer races). The remaining features each carry their
+own state machine.
+
+**Done (2026-06-25): `SelectionUiState`** (`SelectionUiState.kt`) now centralizes
+what used to be scattered flags in `EmbeddedTabLayer` (`showInsertionHandle`,
+`showSelectionToolbar`, `fieldGeometry`, `rangeFieldGeometry`, `pageSelection`).
+It holds the three mutually-exclusive contexts (insertion caret / in-field range /
+page-text range) plus the transient modifiers `dragging` and `scrolling`, and
+exposes derived visibility (`insertionHandle`, `fieldHandles`, `fieldToolbar`,
+`pageHandles`, `pageToolbar`) so the rules are expressed once:
+- **toolbar hides while a handle is dragged** (`dragging`, set from the same
+  `OnMagnify` lifecycle that drives the loupe) — the dragged handle also hides its
+  own teardrop (the loupe stands in), like Android; the other handle stays.
+- **all overlays hide while scrolling** (`scrolling`, from the shim's `ime.scroll`);
+  the shim re-reports geometry just before `active=false` so they reappear
+  repositioned.
+Still emergent / TODO: insertion-handle auto-timeout, tap-to-re-show.
+
+**Selection-blink fix (2026-06-25).** A field selection — especially in a `<textarea>` —
+flickered: off-window Chrome abandons the selection by collapsing the caret to an
+endpoint every ~25 ms, and the FIELD re-assert round-tripped through the host EditText
+(`RemoteImeView.onPageState` → `ime.set` → page), leaving a visible collapsed frame each
+cycle. Fix: re-assert field selections **synchronously in the shim's `selectionchange`
+handler** (mirror of the page-text path that never blinked) — `lastFieldRange`/`lastFieldAt`
+tracked via `noteSel()`, and a collapse-to-endpoint within 1500 ms is reverted with `setSel`
+(guarded, not re-reported) so it reverts before paint. The host re-assert stays as a
+fallback. Device-verified: textarea selection is stable; input select still works.
+
+## Priority order for parity work
+
+1. **Magnifier (#4).** Biggest perceived gap. We already report caret/handle
+   geometry; the magnifier needs a *magnified pixel view of the surface* at the
+   drag point. Options:
+   - **A. Compose-side zoom of a surface snapshot. ❌ RULED OUT (spiked 2026-06-25).**
+     The surface is a `SurfaceControlViewHost` — we can't trivially `Bitmap`-grab a
+     remote surface from the main process. We spiked `PixelCopy.request(SurfaceView, …)`
+     against the live embedded surface (`SurfaceMagnifierProbe`, wired into
+     `EmbeddedTabLayer` behind `BuildConfig.DEBUG`, fired on field focus). The capture
+     target is the privacysandbox `ContentView extends SurfaceView` — the only real
+     child of `SandboxedSdkView` once the session opens. **Result on a clearly-painted
+     surface (1080×2088): every capture returns `ERROR_SOURCE_NO_DATA`** (center
+     region, repeated 3×). Cause: the WebView pixels live in a *child* `SurfaceControl`
+     reparented under the SurfaceView via `ContentView.setChildSurfacePackage(...)`; the
+     host SurfaceView's *own* buffer is never drawn into, so `PixelCopy` on the parent
+     reads an empty buffer. Host-side pixel capture of the sandboxed content is not
+     available. (A `PixelCopy.request(Window, …)` against the host window would also
+     miss it — the sandbox layer is a *separate* SurfaceControl z-ordered below the
+     window.)
+   - **B. Capture in `:napplet` and ship the loupe content. ✅ SPIKED & VIABLE
+     (2026-06-25).** Inside the keyless provider the WebView IS a real in-window view, so
+     `WebView.draw(Canvas)` into a software bitmap renders real DOM pixels. Spike added
+     `MSG_MAGNIFIER_REQUEST`/`MSG_MAGNIFIER_FRAME` to `NappletBrowserContract`:
+     `NappletBrowserService.onMagnifierRequest` draws a zoomed slice
+     (`canvas.scale(zoom); translate(-(cx-box/2), -(cy-box/2)); webView.draw(canvas)`),
+     PNG-encodes it, and ships the bytes back; `EmbeddedBrowserController` (now also an
+     `EmbeddedMagnifierProbe`) requests on focus and `EmbeddedTabLayer` logs the result.
+     **10-frame burst, 160px source × 1.5× zoom → 240×240 PNG, center `#FF111111`
+     (real opaque content):** provider draw 0.7–1.2 ms steady (≈5 ms cold), provider
+     total draw+PNG 3–4 ms steady (≈12 ms cold), client round-trip 4–8 ms steady
+     (occasional ~18 ms), payload 8–15 KB (far under the 1 MB Binder limit). Comfortably
+     within a frame budget if throttled to ~30 fps.
+
+     **✅ Real loupe shipped (2026-06-25).** `MagnifierUiState` + `Magnifier`
+     (`EmbeddedMagnifier.kt`); the caret/selection handles call an `OnMagnify` callback
+     on drag start/move/end; `EmbeddedTabLayer` tracks the drag point, throttles capture
+     requests to one in flight (100 ms timeout), decodes each `MagnifierFrame` to an
+     `ImageBitmap`, and floats the bubble above the finger (clamped, flips below near the
+     top). Capture mirrored onto BOTH embed paths (browser:
+     `NappletBrowserContract`/`NappletBrowserService`/`EmbeddedBrowserController`;
+     napplet: `NappletEmbedContract`/`NappletHostService`/`EmbeddedNappletController`).
+     Verified on device (browser): drag → bubble shows live magnified "ello world" with
+     the caret, centered on the line → follows finger → hides on release. The dead
+     Option-A probe (`SurfaceMagnifierProbe`) was removed. **Polish done (2026-06-25):**
+     capture Y is locked to the authoritative caret/selection line (the handles pass a
+     `lineHalfPx` so the box centers on the line, not the finger or the caret foot); X
+     still follows the finger. Remaining nice-to-haves: RGB_565/raw to cut PNG encode,
+     themed crosshair, clamp capture X to the line so a fast drag past EOL isn't blank,
+     reuse one off-screen bitmap.
+   - **Gesture-routing caveat (found during the spike).** The host-drawn handles'
+     drag is fragile: the sandbox `ContentView.onTouchEvent` always returns `true`, so
+     via Compose's `AndroidView` interop it consumes the drag-move pointer and cancels
+     the overlay handle's `detectDragGestures` (synthetic `adb` drags on the handle
+     never produced an `onDrag`). The magnifier trigger should ride the existing
+     caret/selection-move path (which already round-trips through the shim), not a fresh
+     Compose drag layered over the surface.
+2. **Toolbar state rules (#3 hide-during-drag/scroll) + insertion-handle popup
+   (#12).** Pure Compose/state work, no platform unknowns. Do alongside the
+   `SelectionUiState` refactor.
+3. **Handle inactivity timeout + tap-to-re-show (#1).** Small.
+4. **Double-tap-to-select (#6)** and **word-granularity drag (#5).**
+5. **Auto-scroll (#9), themed drawables/blink (#11).**
+6. Defer: smart selection (#7), drag-to-move (#8).
+
+## ✅ FIXED — full-screen round-trip corrupted the embedded WebViews (2026-06-26)
+
+**Symptom (was).** Open an embedded field's page in its own full-screen activity,
+then `back` to the embedded version. From then on **every** embedded surface in the
+`:napplet` process was broken — and it was far more than the selection highlight: DOM
+reads returned empty (a field that visibly showed text reported `value == ""`, so typing
+prepended at offset 0 and backspace did nothing), DNS died (`ERR_NAME_NOT_RESOLVED`), the
+selection highlight stopped painting, and IME broke. The page showed a stale last frame
+over a functionally-dead renderer.
+
+**Root cause — two process-global defects in the full-screen hosts** corrupting the
+shared multiprocess WebView state the embedded surfaces rely on. (Diagnosed with temporary
+logging: page console → logcat, all `onReceivedError`/`onReceivedHttpError`, and the shim's
+focused-field type/caret. The user's own insight — "the activity is gone but the service
+doesn't come back; am I using something from the activity?" — pointed straight at it.)
+
+1. **`pauseTimers()`/`resumeTimers()` are PROCESS-GLOBAL** (they pause JS, layout and
+   parsing timers for *every* WebView in the process). `NappletBrowserActivity` /
+   `NappletHostActivity` `onPause`/`onResume` and `NappletHostService`'s embed
+   pause/resume all called them on their own lifecycle — so returning from full-screen
+   *froze* the embedded surfaces, which had no resume of their own. **Fix:** removed ALL
+   process-global timer calls; rely only on per-WebView `onPause()`/`onResume()` (which
+   pause just that surface's JS/DOM — still meets the napplet background-security goal).
+2. **`WebView.destroy()` while still attached to the window** corrupts the shared
+   multiprocess renderer (`cr_AwContents: "WebView.destroy() called while WebView is still
+   attached to window"`). **Fix:** `stopLoading()` + `(parent as ViewGroup).removeView(...)`
+   before `destroy()` in both full-screen activities' `onDestroy`.
+
+Device-verified: the round-trip no longer corrupts the embeds. This supersedes the old
+"recreate the session on return" hypothesis and the ruled-out attempts (`::selection` CSS,
+surface resize, focus-cycle, `MSG_WAKE`) — none were the real cause.
+
+## ✅ Embed WebViews follow the app theme (2026-06-26, separate concern)
+
+Not text-selection, but the same off-window surfaces: embedded (and full-screen) WebViews
+rendered web content in the *device* theme, ignoring the app's DARK/LIGHT preference.
+**Root cause:** WebView's dark decision (`prefers-color-scheme` via algorithmic darkening)
+reads the context's **theme** (`?android:attr/isLightTheme`), NOT just `Configuration.uiMode`
+— and the off-window `SurfaceControlViewHost` surface context carries neither. The old
+`applyNightMode` used `UiModeManager.setNightMode` (permission-gated no-op). **Fix:** build
+every WebView from `nightThemedContext()` — `ContextThemeWrapper(createConfigurationContext(
+<night|day>), Theme.DeviceDefault.DayNight)` for the resolved theme — shared in
+`nappletHost/.../EmbedWebViewTheme.kt`, used by both embed services + both full-screen
+activities. The full debugging arc (config-only context fails; `setForceDark` gone at
+targetSdk 37; `setApplicationNightMode` does nothing; it's the unthemed context, not the
+process boundary) is in the `embed-webview-prefers-color-scheme-limitation` memo. Upstream
+WebView is still buggy here (a cross-process SCVH WebView ignores `uiMode`); the
+theme-wrapper is the app-side workaround.
+
+## How to test
+
+The on-device harness lives at **`tools/ime-test/`** (`index.html` + `README.md`).
+It's a single page with an `<input>`, a `<textarea>`, and an on-page log that
+timestamps focus/selection/input/composition events, **paint latency**,
+long-tasks, and main-thread blocks — the instrumentation that pinned the erase,
+caret-jump, and first-letter-freeze bugs, and exactly what we'll want when
+profiling the magnifier.
+
+Run it (full details in `tools/ime-test/README.md`):
+
+1. `cd tools/ime-test && python3 -m http.server 8765`
+2. Reach it: emulator → `http://10.0.2.2:8765`; USB device →
+   `adb reverse tcp:8765 tcp:8765` then `http://localhost:8765`.
+3. Open that URL in the **in-app browser** to load it as an *embedded* tab. (Opening
+   the same URL full-screen and pressing `back` used to reproduce the
+   highlight/corruption bug — now fixed; it's still the regression test for it.)
+
+Console log lines are tagged `[ImeDiag]` and surface in `adb logcat` (the
+`:napplet` process owns the WebView console). This is a dev tool — nothing under
+`tools/` ships, which is why those diagnostic strings are kept out of `src/`.
+
+## Key files
+
+- `commons/src/commonMain/composeResources/files/napplet/shim.js` — DOM bridge.
+  Geometry sources: `caretCoords` (287), `offsetFromPoint` (318), `fieldGeom`
+  (336), `reportState` (360), `pageGeom` (462), `sendPageSel` (470), `pageExtend`
+  (494). A magnifier built via option B would add a loupe-render here.
+- `amethyst/.../embed/EmbeddedTabLayer.kt` — the Compose overlay. `InsertionHandle`
+  (557), `SelectionHandle` (496), `EmbeddedSelectionToolbar` (616),
+  `PageSelectionOverlay` (460), the `showInsertionHandle`/`showSelectionToolbar`
+  state to be folded into a `SelectionUiState`. Magnifier popup (option A) lands
+  here.
+- `amethyst/.../embed/RemoteImeView.kt` — invisible host `EditText`; selection
+  re-assert + copy/cut/paste/select-all + edit callbacks.
+- `amethyst/.../embed/EmbeddedImeBridge.kt` — `SelectionGeometry` (caret + handle
+  feet + viewport), `ImeEvent.{Focus,State,PageSelection}`, `parseSelectionGeometry`.
+- `amethyst/.../{browser/EmbeddedBrowserController,favorites/EmbeddedNappletController}.kt`
+  — parse `ime.pagesel` + geometry off the Messenger channel.
+- Context: `amethyst/plans/2026-06-19-napplet-sandbox-host.md`,
+  `2026-06-24-napplet-embedded-tabs.md`.

amethyst/plans/archive/2026-06-25-web-app-naming.md

@@ -0,0 +1,66 @@
+# Web-app naming overhaul (favorites / browser / app surfaces)
+
+> **Status:** shipped — Renames applied — `WebAppScreen`, `NostrAppScreen`, `EmbeddedWebAppController`, `FavoriteAppsScreen` all present.
+> _Audited 2026-06-30._
+
+## Problem
+
+The in-app "app" surfaces had colliding, sometimes inaccurate names:
+
+- `software_apps` (NIP-89 native Android apps, an install-from-a-store flow) showed as
+  **"Apps"** — colliding with the in-app favorites, which showed as **"Favorite apps"**.
+- The **host screens** that render a single web client / nSite / nApplet were named
+  `FavoriteWebAppScreen` / `FavoriteNappletScreen`. But they open *any* url/coordinate,
+  favorited or not — "Favorite" described how they happened to be reached (a pinned
+  bottom-bar tab), not what they are. And `FavoriteNappletScreen` also renders **nSites**
+  (website-mode), so "Napplet" was narrower than reality.
+- Three vocabularies for two model cases: model `WebUrl`/`NostrApp`, route
+  `FavoriteWebApp`/`FavoriteNostrApp`, screen `FavoriteWebApp`/`FavoriteNapplet`.
+
+## Taxonomy (decided with maintainer)
+
+User-facing terms, now distinct:
+
+| Concept | User-facing | What it is |
+|---|---|---|
+| Native app store | **App Store** | NIP-89 native Android apps you install off-device |
+| Nostr web client | **Web app** | an `https://` client that runs in-app (WebView) |
+| nApplet | **nApplet** | NIP-5D sandboxed JS app |
+| nSite | **nSite** | NIP-5A static website |
+| Pinned set | **Favorite** | a cross-cutting attribute (the star), *not* a screen |
+
+Code axis (favorites / route / screen / embedded-controller layer): **`WebApp`** (url-based,
+no nostr identity) and **`NostrApp`** (coordinate-based nSite *or* nApplet). The cross-process
+sandbox infra (`napplet/`, `nappletHost/`, `NappletHostService`, `NappletEmbedContract`)
+keeps **"Napplet"** — that process genuinely is the napplet host (it serves nSites in
+website-mode too, but the host *is* the napplet runtime).
+
+"Favorite" is reserved for the **grid of pinned apps** (`FavoriteAppsScreen` /
+`Route.FavoriteApps`) and the star toggle — the only things that are actually about favorites.
+
+## Renames
+
+Routes: `FavoriteWebApp(url)` → `WebApp(url)`; `FavoriteNostrApp(coordinate)` → `NostrApp(coordinate)`.
+Screens: `FavoriteWebAppScreen` → `WebAppScreen`; `FavoriteNappletScreen` → `NostrAppScreen`.
+Controllers: `EmbeddedBrowserController` → `EmbeddedWebAppController`;
+`EmbeddedNappletController` → `EmbeddedNostrAppController`.
+Factory: `acquireBrowser`/`browserId` → `acquireWebApp`/`webAppId`;
+`acquireNapplet`/`nappletId` → `acquireNostrApp`/`nostrAppId`.
+Model: `FavoriteApp.WebUrl` → `FavoriteApp.WebApp`. Registry: `WebUrlNetworkRegistry` →
+`WebAppNetworkRegistry`.
+
+Strings: `software_apps` "Apps" → "App Store"; `favorite_apps_empty` reworded to name
+nApplet/nSite.
+
+## Stable (do NOT change — persistence / wire compat)
+
+- Favorite `id` prefixes `"url:"` / `"nostr:"` (persisted dedup + bottom-bar keys).
+- DataStore names `"favorite_apps"`, `"weburl_network"`; serialized type tags `"url"` / `"nostr"`.
+- `napplet/` + `nappletHost/` sandbox infra names and IPC contracts.
+
+## Follow-ups (not in this pass)
+
+- Move `NostrAppScreen` + `EmbeddedNostrAppController` out of the `ui/...favorites/`
+  package (they are no longer favorites-specific) into a host package alongside the web side.
+- Recent nApplets / nSites (parallel to the browser's recent web apps), surfaced on the
+  discovery screens.

amethyst/plans/archive/2026-06-26-nsite-napplet-favorite-icons.md

@@ -0,0 +1,80 @@
+# nSite / nApplet favorite icons
+
+> **Status:** shipped — `quartz/.../NappletIconPath.kt` and `amethyst/.../favorites/NappletFavoriteIcon.kt` are in tree.
+> _Audited 2026-06-30._
+
+**Date:** 2026-06-26
+**Status:** implemented (pending on-device verification of the blob image-load path)
+
+## Problem
+
+When a user favorites a plain web app and pins it to the bottom nav, the generic globe
+icon is replaced by the **site's favicon**. Favorited nSites (NIP-5A) and nApplets
+(NIP-5D) did not get the same treatment — they fell back to the generic grid glyph.
+
+## Why the webapp trick doesn't carry over
+
+The webapp favicon is **captured live** from the WebView that loads the page
+(`NappletBrowserActivity.onReceivedIcon` → IPC `MSG_RECORD_ICON` →
+`BrowserIconRegistry`, keyed by host). That works because, for a plain webapp, the site
+**is** the WebView's main frame.
+
+nSites/nApplets render differently: they always load inside a **cross-origin sandboxed
+iframe** under a trusted shell document (`commons/.../composeResources/files/napplet/shell.html`,
+`iframe.src = '__APP_ORIGIN__/'`). `WebChromeClient.onReceivedIcon` only reports the
+**main frame's** favicon — i.e. the shell (`<title>Napplet</title>`, no icon), never the
+applet's iframe. So the live-capture approach is structurally blind to the app's own
+favicon here, and mirroring it would silently show nothing.
+
+## Approach: derive the icon from the manifest's own bundled blobs
+
+An nSite/nApplet ships its files as `path → sha256` (`path` tags). Its icon is almost
+always one of those blobs (a conventional `/favicon.png`, `/icon.png`,
+`/apple-touch-icon.png`, …). We already download + sha256-verify every manifest blob into
+a shared, content-addressed cache (`NappletBlobCache` / `NappletBlobPrefetcher`,
+Tor-routed). So the icon can be resolved from the manifest itself — no WebView, no iframe
+problem, content-addressed and verifiable, on the same private network path as everything
+else.
+
+### Resolution priority (per favorite)
+
+1. **Captured/bundled blob** (`iconModel`) — the conventional icon path picked from the
+   manifest's blobs, loaded from the verified cache as a `file://` model.
+2. **Manifest `icon` tag** (`FavoriteApp.iconUrl`) — the publisher-declared icon URL
+   (already wired before this change).
+3. **Type glyph** — grid (nostr app) / globe (web), already the fallback in
+   `FavoriteAppIcon`.
+
+Blob beats the `icon` URL deliberately: the blob is verified and rides the site's
+Tor-routed path, whereas a remote `icon` URL would be a clearnet fetch by Coil. Both still
+beat the glyph.
+
+## Changes
+
+- **quartz** `nip5aStaticWebsites/NappletIconPath.kt` (new) — pure, unit-tested heuristic
+  that picks the best icon `PathTag` from a manifest's `path` tags (priority list of
+  conventional names + a loose raster fallback; prefers shallower paths; raster formats
+  over `.ico`/`.svg`). Tests in `NappletIconPathTest.kt`.
+- **quartz** — `NappletManifest.iconBlob()` (covers nApplet kinds) and
+  `RootSiteEvent.iconBlob()` / `NamedSiteEvent.iconBlob()` (nSite kinds) delegate to it.
+- **amethyst** `favorites/NappletFavoriteIcon.kt` (new) — `rememberNappletIconModel(coordinate)`:
+  re-resolves the live event from `LocalCache`, picks its icon blob, ensures it's in the
+  shared cache (prefetching on demand, off the composition thread), and returns a `file://`
+  Coil model. Returns null until the blob is on disk (icon appears on next recomposition).
+- **amethyst** — `AppBottomBar` and `FavoriteAppsScreen` now resolve that model for
+  `FavoriteApp.NostrApp` and pass it as `iconModel`, exactly as they already did with the
+  captured favicon for `FavoriteApp.WebApp`.
+
+`FavoriteApp` is unchanged (no persistence migration): the icon is resolved from the live
+manifest at render time, consistent with the existing rule that a `NostrApp` favorite is
+only usable while its event is resolvable in `LocalCache`.
+
+## Follow-ups / not done
+
+- **On-device verification** of the blob → Coil image load (the heuristic + wiring are
+  verified by unit tests + compilation; the actual image render needs a device).
+- **HTML `<link rel="icon">` parsing.** The heuristic matches by conventional file name.
+  A future pass could fetch + parse the index blob to honor a non-conventional icon path.
+- **`.svg` / `.ico` decoding.** Listed as low-priority candidates; if Coil can't decode
+  them the `FavoriteAppIcon` error fallback shows the glyph, so it's harmless but not
+  guaranteed to render.

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/CashuBTest.kt

@@ -21,9 +21,9 @@
 package com.vitorpamplona.amethyst
 
 import androidx.test.ext.junit.runners.AndroidJUnit4
-import com.vitorpamplona.amethyst.commons.model.nip60Cashu.CashuToken
+import com.vitorpamplona.amethyst.commons.ui.components.GenericLoadable
 import com.vitorpamplona.amethyst.service.cashu.CashuParser
-import com.vitorpamplona.amethyst.ui.components.GenericLoadable
+import com.vitorpamplona.quartz.nip60Cashu.token.CashuToken
 import kotlinx.collections.immutable.ImmutableList
 import kotlinx.coroutines.runBlocking
 import org.junit.Assert.assertEquals
@@ -48,12 +48,12 @@ class CashuBTest {
             assertEquals(2, parsed.proofs[0].amount)
             assertEquals("407915bc212be61a77e3e6d2aeb4c727980bda51cd06a6afc29e2861768a7837", parsed.proofs[0].secret)
             assertEquals("009a1f293253e41e", parsed.proofs[0].id)
-            assertEquals("02bc9097997d81afb2cc7346b5e4345a9346bd2a506eb7958598a72f0cf85163ea", parsed.proofs[0].C)
+            assertEquals("02bc9097997d81afb2cc7346b5e4345a9346bd2a506eb7958598a72f0cf85163ea", parsed.proofs[0].c)
 
             assertEquals(8, parsed.proofs[1].amount)
             assertEquals("fe15109314e61d7756b0f8ee0f23a624acaa3f4e042f61433c728c7057b931be", parsed.proofs[1].secret)
             assertEquals("009a1f293253e41e", parsed.proofs[1].id)
-            assertEquals("029e8e5050b890a7d6c0968db16bc1d5d5fa040ea1de284f6ec69d61299f671059", parsed.proofs[1].C)
+            assertEquals("029e8e5050b890a7d6c0968db16bc1d5d5fa040ea1de284f6ec69d61299f671059", parsed.proofs[1].c)
         }
     }
 
@@ -68,18 +68,18 @@ class CashuBTest {
             assertEquals(1, parsed[0].proofs[0].amount)
             assertEquals("acc12435e7b8484c3cf1850149218af90f716a52bf4a5ed347e48ecc13f77388", parsed[0].proofs[0].secret)
             assertEquals("00ffd48b8f5ecf80", parsed[0].proofs[0].id)
-            assertEquals("0244538319de485d55bed3b29a642bee5879375ab9e7a620e11e48ba482421f3cf", parsed[0].proofs[0].C)
+            assertEquals("0244538319de485d55bed3b29a642bee5879375ab9e7a620e11e48ba482421f3cf", parsed[0].proofs[0].c)
 
             assertEquals(3, parsed[1].totalAmount)
             assertEquals(2, parsed[1].proofs[0].amount)
             assertEquals("1323d3d4707a58ad2e23ada4e9f1f49f5a5b4ac7b708eb0d61f738f48307e8ee", parsed[1].proofs[0].secret)
             assertEquals("00ad268c4d1f5826", parsed[1].proofs[0].id)
-            assertEquals("023456aa110d84b4ac747aebd82c3b005aca50bf457ebd5737a4414fac3ae7d94d", parsed[1].proofs[0].C)
+            assertEquals("023456aa110d84b4ac747aebd82c3b005aca50bf457ebd5737a4414fac3ae7d94d", parsed[1].proofs[0].c)
 
             assertEquals(1, parsed[1].proofs[1].amount)
             assertEquals("56bcbcbb7cc6406b3fa5d57d2174f4eff8b4402b176926d3a57d3c3dcbb59d57", parsed[1].proofs[1].secret)
             assertEquals("00ad268c4d1f5826", parsed[1].proofs[1].id)
-            assertEquals("0273129c5719e599379a974a626363c333c56cafc0e6d01abe46d5808280789c63", parsed[1].proofs[1].C)
+            assertEquals("0273129c5719e599379a974a626363c333c56cafc0e6d01abe46d5808280789c63", parsed[1].proofs[1].c)
         }
 
     @Test()
@@ -93,11 +93,11 @@ class CashuBTest {
             assertEquals(64, parsed[0].proofs[0].amount)
             assertEquals("7a8dcf9b3e8a247ce339e7369e9b4a19f31eacb69d8b0c65daaeb72d1acb9ad3", parsed[0].proofs[0].secret)
             assertEquals("009bb23d3a912e4e", parsed[0].proofs[0].id)
-            assertEquals("03df591d261bcd176c69e3e833bcab5348ca31d218620492859303a1f5e874e9c7", parsed[0].proofs[0].C)
+            assertEquals("03df591d261bcd176c69e3e833bcab5348ca31d218620492859303a1f5e874e9c7", parsed[0].proofs[0].c)
 
             assertEquals(32, parsed[0].proofs[1].amount)
             assertEquals("9d81c1a2616853ad8049cbcd1c7c247add83b373828620bac2fd7f3e5a58aceb", parsed[0].proofs[1].secret)
             assertEquals("009bb23d3a912e4e", parsed[0].proofs[1].id)
-            assertEquals("039e52c02141738e9dc278db91bf3b333a37d13d8413d5acfe77a6b859de0de806", parsed[0].proofs[1].C)
+            assertEquals("039e52c02141738e9dc278db91bf3b333a37d13d8413d5acfe77a6b859de0de806", parsed[0].proofs[1].c)
         }
 }

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/NotificationFeedFilterModeOverrideTest.kt

@@ -67,13 +67,16 @@ class NotificationFeedFilterModeOverrideTest {
 
         private val client =
             NostrClient(
-                OkHttpWebSocket.Builder {
-                    OkHttpClient
-                        .Builder()
-                        .followRedirects(true)
-                        .followSslRedirects(true)
-                        .build()
-                },
+                OkHttpWebSocket.Builder(
+                    httpClient = {
+                        OkHttpClient
+                            .Builder()
+                            .followRedirects(true)
+                            .followSslRedirects(true)
+                            .build()
+                    },
+                    canDial = { true },
+                ),
                 scope,
             )
 

amethyst/src/androidTest/java/com/vitorpamplona/amethyst/ThreadDualAxisChartAssemblerTest.kt

@@ -58,13 +58,16 @@ class ThreadDualAxisChartAssemblerTest {
 
         val client =
             NostrClient(
-                OkHttpWebSocket.Builder {
-                    OkHttpClient
-                        .Builder()
-                        .followRedirects(true)
-                        .followSslRedirects(true)
-                        .build()
-                },
+                OkHttpWebSocket.Builder(
+                    httpClient = {
+                        OkHttpClient
+                            .Builder()
+                            .followRedirects(true)
+                            .followSslRedirects(true)
+                            .build()
+                    },
+                    canDial = { true },
+                ),
                 scope,
             )
 

amethyst/src/main/AndroidManifest.xml

@@ -105,7 +105,6 @@
         android:supportsRtl="true"
         android:theme="@style/Theme.Amethyst"
         android:largeHeap="true"
-        android:usesCleartextTraffic="true"
         android:networkSecurityConfig="@xml/network_security_config"
         android:hardwareAccelerated="true"
         android:localeConfig="@xml/locales_config"
@@ -402,6 +401,71 @@
             android:name=".service.call.CallNotificationReceiver"
             android:exported="false" />
 
+        <!-- Sandboxed napplet/nsite host. Runs in an isolated process that holds no keys. -->
+        <activity
+            android:name="com.vitorpamplona.amethyst.napplethost.NappletHostActivity"
+            android:process=":napplet"
+            android:exported="false"
+            android:autoRemoveFromRecents="true"
+            android:configChanges="orientation|screenSize|screenLayout|smallestScreenSize|keyboardHidden|keyboard|uiMode|navigation|fontScale|density"
+            android:launchMode="singleTask"
+            android:theme="@style/Theme.Amethyst" />
+
+        <!-- Direct-WebView browser for a single web client. Runs in the isolated, keyless `:napplet`
+             process and hosts the WebView directly (not a streamed surface), so scroll/zoom/keyboard work
+             natively. adjustResize shrinks the window for the soft keyboard. Its own task/recents entry. -->
+        <activity
+            android:name="com.vitorpamplona.amethyst.napplethost.NappletBrowserActivity"
+            android:process=":napplet"
+            android:exported="false"
+            android:autoRemoveFromRecents="true"
+            android:documentLaunchMode="intoExisting"
+            android:configChanges="orientation|screenSize|screenLayout|smallestScreenSize|keyboardHidden|keyboard|uiMode|navigation|fontScale|density"
+            android:windowSoftInputMode="adjustResize"
+            android:theme="@style/Theme.Amethyst" />
+
+        <!-- Capability-consent dialog. Runs in the main process (the only side trusted to grant). -->
+        <activity
+            android:name=".napplet.NappletConsentActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:launchMode="singleTop"
+            android:theme="@android:style/Theme.Translucent.NoTitleBar" />
+        <!-- First-connect "Connect to Nostr" dialog. -->
+        <activity
+            android:name=".napplet.NappletConnectActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:launchMode="singleTop"
+            android:theme="@android:style/Theme.Translucent.NoTitleBar" />
+        <!-- Per-operation signer consent dialog. -->
+        <activity
+            android:name=".napplet.NappletSignerConsentActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:launchMode="singleTop"
+            android:theme="@android:style/Theme.Translucent.NoTitleBar" />
+
+        <!-- Main-process broker: holds the signer and brokers capabilities for the sandbox. -->
+        <service
+            android:name=".napplet.NappletBrokerService"
+            android:exported="false" />
+
+        <!-- Embedded-browser provider: hosts the in-app browser WebView in the isolated, keyless
+             process and ships its rendered surface to the main app (SurfaceControlViewHost). -->
+        <service
+            android:name="com.vitorpamplona.amethyst.napplethost.NappletBrowserService"
+            android:process=":napplet"
+            android:exported="false" />
+
+        <!-- Embedded nsite/napplet provider: hosts the verified-blob WebView in the isolated, keyless
+             process and ships its surface to the main app, so a favorited nsite/napplet can render as
+             an in-app tab instead of taking over the screen. Same trust model as NappletHostActivity. -->
+        <service
+            android:name="com.vitorpamplona.amethyst.napplethost.NappletHostService"
+            android:process=":napplet"
+            android:exported="false" />
+
     </application>
 
 

amethyst/src/main/java/com/vitorpamplona/amethyst/Amethyst.kt

@@ -21,11 +21,36 @@
 package com.vitorpamplona.amethyst
 
 import android.app.Application
+import android.content.ComponentCallbacks2
+import android.os.Build
+import com.vitorpamplona.amethyst.favorites.BrowserHistoryRegistry
+import com.vitorpamplona.amethyst.favorites.BrowserIconRegistry
+import com.vitorpamplona.amethyst.favorites.FavoriteAppsRegistry
+import com.vitorpamplona.amethyst.napplet.WebAppNetworkRegistry
 import com.vitorpamplona.amethyst.service.logging.Logging
 import com.vitorpamplona.amethyst.service.nests.AppForegroundRecycleHook
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.embed.EmbeddedTabHost
 import com.vitorpamplona.quartz.utils.Log
 import com.vitorpamplona.quartz.utils.LogLevel
+import java.io.File
 
+/**
+ * The Android [Application]. **Heads-up: this app runs in TWO OS processes**, and Android
+ * instantiates this same class in each of them:
+ *
+ * - **main** — the normal app (UI, account, signer, `LocalCache`, relay client). [instance]
+ *   ([AppModules]) is built here in [onCreate].
+ * - **`:napplet`** — the sandboxed WebView host for NIP-5D napplets / NIP-5A nSites
+ *   (`NappletHostActivity`, declared `android:process=":napplet"`). It holds **no** account or keys.
+ *   [onCreate] early-returns here, so [instance] is **left unset** and any access throws.
+ *
+ * There is no per-process Application in Android — `android:name` is one class for the whole package —
+ * so the process-name guard ([isNappletSandbox]) is how the two are kept apart.
+ *
+ * **Processes don't share memory:** every `object`/companion/`static` (e.g. `LocalCache`,
+ * `NappletLaunchRegistry`) is a *separate copy per process*. Don't assume [instance] exists off the
+ * main process, and don't try to share state via a singleton across the boundary — use Messenger IPC.
+ */
 class Amethyst : Application() {
     init {
         Log.minLevel = if (BuildConfig.DEBUG) LogLevel.DEBUG else LogLevel.ERROR
@@ -37,11 +62,43 @@ class Amethyst : Application() {
             private set
     }
 
+    /**
+     * Android instantiates this single Application class in EVERY process (there's no per-process
+     * Application in the manifest). The sandboxed napplet host runs in `:napplet`, where we must not
+     * build [AppModules] — so this is computed once and gates every lifecycle callback that would
+     * otherwise touch the unset [instance].
+     */
+    private val isNappletSandbox by lazy { isNappletSandboxProcess() }
+
     override fun onCreate() {
         super.onCreate()
         Log.d("AmethystApp") { "onCreate $this" }
+
+        // Application.onCreate runs in every process. The sandboxed napplet host
+        // (`:napplet`) must NOT build AppModules — that would load the account and
+        // construct the signer in the very process we keep secret-free. The host
+        // is self-contained (WebView + IPC), so we skip all app init there and
+        // leave `instance` unset; any accidental use fails fast.
+        if (isNappletSandbox) {
+            Log.d("AmethystApp") { "Skipping AppModules init in sandbox process" }
+            return
+        }
+
         instance = AppModules(this)
 
+        // Hydrate the device-local favorite-apps list (main process only; the sandbox never reads it).
+        FavoriteAppsRegistry.init(this)
+
+        // Hydrate the device-local browser visit history (main process only; feeds the omnibox suggestions).
+        BrowserHistoryRegistry.init(this)
+
+        // Index device-local captured favicons (main process only; decorates favorites + suggestions).
+        BrowserIconRegistry.init(this)
+
+        // Hydrate the per-web-client Tor routing preferences so a site opted out of Tor (some reject Tor
+        // exits) starts on the open web without first flashing a failed Tor load.
+        WebAppNetworkRegistry.init(this)
+
         // After-background foreground recycle: when the app returns to
         // the foreground after spending more than ~5 s in the
         // background, publish a network-change event so every active
@@ -66,9 +123,22 @@ class Amethyst : Application() {
         instance.initiate(this)
     }
 
+    /** True when this process is the isolated `:napplet` WebView host (see AndroidManifest). */
+    private fun isNappletSandboxProcess(): Boolean {
+        val name =
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+                getProcessName()
+            } else {
+                runCatching { File("/proc/self/cmdline").readText().substringBefore('\u0000').trim() }.getOrNull()
+            }
+        return name?.endsWith(":napplet") == true
+    }
+
     override fun onTerminate() {
         super.onTerminate()
         Log.d("AmethystApp") { "onTerminate $this" }
+        // The sandbox process never built AppModules; `instance` is unset there.
+        if (isNappletSandbox) return
         instance.terminate(this)
     }
 
@@ -80,6 +150,20 @@ class Amethyst : Application() {
     override fun onTrimMemory(level: Int) {
         super.onTrimMemory(level)
         Log.d("AmethystApp") { "onTrimMemory $level" }
-        instance.trim()
+        // onTrimMemory IS delivered to the `:napplet` process on real devices, where `instance`
+        // was never initialized — guard so a trim callback can't crash the sandbox.
+        if (isNappletSandbox) return
+        instance.trim(level)
+        // Drop warm embedded tab sessions under genuine memory pressure (decision: keep warm until the
+        // user or Android reclaims them). Deliberately NOT on UI_HIDDEN/BACKGROUND — those fire on every
+        // backgrounding, and a pinned tab should survive that. Only on real pressure levels, R+ only.
+        val pressure =
+            level == ComponentCallbacks2.TRIM_MEMORY_RUNNING_LOW ||
+                level == ComponentCallbacks2.TRIM_MEMORY_RUNNING_CRITICAL ||
+                level == ComponentCallbacks2.TRIM_MEMORY_MODERATE ||
+                level == ComponentCallbacks2.TRIM_MEMORY_COMPLETE
+        if (pressure && Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            EmbeddedTabHost.evictAll()
+        }
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/AppModules.kt

@@ -20,6 +20,7 @@
  */
 package com.vitorpamplona.amethyst
 
+import android.content.ComponentCallbacks2
 import android.content.Context
 import androidx.security.crypto.EncryptedSharedPreferences
 import coil3.disk.DiskCache
@@ -43,6 +44,9 @@ import com.vitorpamplona.amethyst.model.preferences.UiSharedPreferences
 import com.vitorpamplona.amethyst.model.privacyOptions.RoleBasedHttpClientBuilder
 import com.vitorpamplona.amethyst.model.torState.AccountsTorStateConnector
 import com.vitorpamplona.amethyst.model.torState.TorRelayState
+import com.vitorpamplona.amethyst.napplet.DataStoreNappletPermissionStore
+import com.vitorpamplona.amethyst.napplet.DataStoreNostrSignerPermissionStore
+import com.vitorpamplona.amethyst.service.CachedRichTextParser
 import com.vitorpamplona.amethyst.service.cast.CastRegistry
 import com.vitorpamplona.amethyst.service.connectivity.ConnectivityManager
 import com.vitorpamplona.amethyst.service.connectivity.ConnectivityStatus
@@ -60,6 +64,7 @@ import com.vitorpamplona.amethyst.service.okhttp.DualHttpClientManager
 import com.vitorpamplona.amethyst.service.okhttp.DualHttpClientManagerForRelays
 import com.vitorpamplona.amethyst.service.okhttp.EncryptionKeyCache
 import com.vitorpamplona.amethyst.service.okhttp.OkHttpWebSocket
+import com.vitorpamplona.amethyst.service.okhttp.OnionLocationCache
 import com.vitorpamplona.amethyst.service.okhttp.SurgeDns
 import com.vitorpamplona.amethyst.service.okhttp.SurgeDnsStore
 import com.vitorpamplona.amethyst.service.playback.diskCache.VideoCache
@@ -70,6 +75,7 @@ import com.vitorpamplona.amethyst.service.relayClient.CacheClientConnector
 import com.vitorpamplona.amethyst.service.relayClient.RelayProxyClientConnector
 import com.vitorpamplona.amethyst.service.relayClient.TorCircuitHealthTracker
 import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.AuthCoordinator
+import com.vitorpamplona.amethyst.service.relayClient.authCommand.model.DataStoreRelayAuthPermissionStore
 import com.vitorpamplona.amethyst.service.relayClient.notifyCommand.model.NotifyCoordinator
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.RelaySubscriptionsCoordinator
 import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderQueryState
@@ -94,6 +100,7 @@ import com.vitorpamplona.quartz.nip01Core.relay.client.accessories.RelayLogger
 import com.vitorpamplona.quartz.nip01Core.relay.client.accessories.RelayOfflineTracker
 import com.vitorpamplona.quartz.nip01Core.relay.client.reqs.stats.RelayReqStats
 import com.vitorpamplona.quartz.nip01Core.relay.client.stats.RelayStats
+import com.vitorpamplona.quartz.nip01Core.relay.commands.toClient.CachingEventDecoder
 import com.vitorpamplona.quartz.nip03Timestamp.VerificationStateCache
 import com.vitorpamplona.quartz.nip03Timestamp.okhttp.OkHttpBitcoinExplorer
 import com.vitorpamplona.quartz.nip03Timestamp.ots.OtsBlockHeightCache
@@ -110,6 +117,7 @@ import com.vitorpamplona.quartz.nip05DnsIdentifiers.namecoin.NamecoinBackend
 import com.vitorpamplona.quartz.nip05DnsIdentifiers.namecoin.NamecoinCoreRpcClient
 import com.vitorpamplona.quartz.nip05DnsIdentifiers.namecoin.NamecoinNameResolver
 import com.vitorpamplona.quartz.nip05DnsIdentifiers.namecoin.TOR_ELECTRUMX_SERVERS
+import com.vitorpamplona.quartz.nip19Bech32.decodePublicKeyAsHexOrNull
 import com.vitorpamplona.quartz.nipB7Blossom.BlossomServersEvent
 import com.vitorpamplona.quartz.nipBCOnchainZaps.chain.CachingOnchainBackend
 import com.vitorpamplona.quartz.nipBCOnchainZaps.chain.EsploraBackend
@@ -120,8 +128,11 @@ import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.async
 import kotlinx.coroutines.cancel
+import kotlinx.coroutines.channels.BufferOverflow
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.MutableSharedFlow
+import kotlinx.coroutines.flow.asSharedFlow
 import kotlinx.coroutines.flow.collectLatest
 import kotlinx.coroutines.flow.distinctUntilChanged
 import kotlinx.coroutines.flow.drop
@@ -148,6 +159,9 @@ class AppModules(
 
     val applicationIOScope = CoroutineScope(Dispatchers.IO + SupervisorJob() + exceptionHandler)
 
+    private val _trimLevelEvents = MutableSharedFlow<Int>(extraBufferCapacity = 1, onBufferOverflow = BufferOverflow.DROP_OLDEST)
+    val trimLevelEvents = _trimLevelEvents.asSharedFlow()
+
     // Pre-load both preference DataStores in parallel on IO threads.
     // Both constructors use runBlocking internally, so starting them concurrently
     // reduces total blocking time from (torPrefs + uiPrefs) to ~max(torPrefs, uiPrefs).
@@ -232,6 +246,11 @@ class AppModules(
     // path on first lookup. Stored in cacheDir — pure perf data, OK if the OS evicts it.
     val dnsStore = SurgeDnsStore(File(appContext.safeCacheDir(), SurgeDnsStore.FILE_NAME), surgeDns)
 
+    // Shared cache populated by OnionLocationInterceptor from any HTTP/WebSocket
+    // response carrying an Onion-Location header. Consulted by OnionUrlRewriteInterceptor
+    // on Tor-enabled clients to transparently redirect to .onion addresses.
+    val onionLocationCache = OnionLocationCache()
+
     // manages all the other connections separately from relays.
     val okHttpClients: DualHttpClientManager =
         DualHttpClientManager(
@@ -250,6 +269,7 @@ class AppModules(
                 val profileOnly = settings?.localBlossomCacheProfilePicturesOnly?.value ?: false
                 master && !profileOnly && localBlossomCacheProbe.available.value
             },
+            onionCache = onionLocationCache,
         )
 
     // Offers easy methods to know when connections are happening through Tor or not
@@ -424,6 +444,7 @@ class AppModules(
             isMobileDataProvider = connManager.isMobileOrNull,
             scope = applicationIOScope,
             dns = surgeDns,
+            onionCache = onionLocationCache,
         )
 
     // Connects the INostrClient class with okHttp
@@ -479,8 +500,10 @@ class AppModules(
             OkHttpLnurlEndpointResolver(roleBasedHttpClientBuilder::okHttpClientForMoney)
     }
 
-    // Provides a relay pool
-    val client: INostrClient = NostrClient(websocketBuilder, applicationIOScope)
+    // Provides a relay pool. The caching decoder skips re-parsing EVENT frames
+    // that arrive again via another subscription or relay (14-57% of frames in
+    // production measurements).
+    val client: INostrClient = NostrClient(websocketBuilder, applicationIOScope, CachingEventDecoder())
 
     // Self-heals the "Tor Active but every circuit dead" state the lifecycle watchdogs can't
     // see (they only arm while Connecting). Watches Tor-routed relay outcomes and, when enough
@@ -512,6 +535,15 @@ class AppModules(
     // Show messages from the Relay and controls their dismissal
     val notifyCoordinator = NotifyCoordinator(client)
 
+    // Persists per-relay NIP-42 ALLOW/DENY overrides across app restarts.
+    val relayAuthPermissionStore by lazy {
+        DataStoreRelayAuthPermissionStore(appContext)
+    }
+
+    // Singleton stores for napplet permissions — DataStore v1 enforces one instance per file.
+    val nappletPermissionStore by lazy { DataStoreNappletPermissionStore(appContext) }
+    val signerPermissionStore by lazy { DataStoreNostrSignerPermissionStore(appContext) }
+
     // Authenticates with relays.
     val authCoordinator = AuthCoordinator(client, applicationIOScope)
 
@@ -744,6 +776,18 @@ class AppModules(
             sessionManager.loginWithDefaultAccountIfLoggedOff()
         }
 
+        // One-time hygiene: remove per-account directories (MLS/Marmot stores) left behind
+        // by accounts that are no longer saved — account deletion historically didn't clean
+        // them up, so they leaked disk across every add/remove.
+        applicationIOScope.launch {
+            val keep =
+                LocalPreferences
+                    .allSavedAccounts()
+                    .mapNotNull { decodePublicKeyAsHexOrNull(it.npub) }
+                    .toSet()
+            accountsCache.pruneOrphanAccountDirs(keep)
+        }
+
         // forces initialization of uiPrefs in the main thread to avoid blinking themes
         uiPrefs
 
@@ -765,6 +809,13 @@ class AppModules(
             resourceCacheInit()
         }
 
+        // Initialize napplet permission stores on an IO thread to avoid StrictMode violations
+        // when ConnectedAppsScreen first accesses them on the main thread.
+        applicationIOScope.launch {
+            nappletPermissionStore
+            signerPermissionStore
+        }
+
         // registers to receive events
         pokeyReceiver.register(appContext)
 
@@ -852,12 +903,71 @@ class AppModules(
         accountsCache.clear()
     }
 
-    fun trim() {
+    fun trim(level: Int) {
+        _trimLevelEvents.tryEmit(level)
         applicationIOScope.launch {
             // Backgrounding is a natural moment to flush the DNS cache.
             dnsStore.save()
             val loggedIn = accountsCache.accounts.value.values
-            trimmingService.run(loggedIn, LocalPreferences.allSavedAccounts())
+            trimmingService.run(loggedIn, LocalPreferences.allSavedAccounts(), level)
+            // Trim in-process caches proportional to OS memory pressure.
+            //
+            // Background levels (app not visible, ordered highest-first so the when
+            // chain short-circuits at the right tier):
+            //   COMPLETE  (80) — at the bottom of the LRU list, kill imminent
+            //   MODERATE  (60) — system is hurting, neighbouring apps being killed
+            //   BACKGROUND(40) — backgrounded, mild system pressure
+            //   UI_HIDDEN (20) — just backgrounded, no pressure yet
+            //
+            // Foreground levels (app is active but system is low):
+            //   RUNNING_CRITICAL (15), RUNNING_LOW (10)
+            //
+            // UI_HIDDEN fires on EVERY app switch. Don't clear CPU-heavy caches
+            // (Robohash SVG assembly, rich-text parsing) there — clearing them
+            // forces a full rebuild on every resume and causes visible jank.
+            when {
+                level >= ComponentCallbacks2.TRIM_MEMORY_COMPLETE -> {
+                    // Kill imminent: free everything.
+                    memoryCache.trimToSize(0)
+                    CachedRichTextParser.trimToSize(0)
+                    CachedRobohash.trimToSize(0)
+                    nip11Cache.trimToSize(0)
+                }
+                level >= ComponentCallbacks2.TRIM_MEMORY_MODERATE -> {
+                    // System under real pressure: clear images and most parsed state.
+                    memoryCache.trimToSize(0)
+                    CachedRichTextParser.trimToSize(50)
+                    CachedRobohash.trimToSize(10)
+                    nip11Cache.trimToSize(100)
+                }
+                level >= ComponentCallbacks2.TRIM_MEMORY_BACKGROUND -> {
+                    // Backgrounded with mild pressure: trim significantly.
+                    memoryCache.trimToSize(memoryCache.maxSize / 4)
+                    CachedRichTextParser.trimToSize(100)
+                    CachedRobohash.trimToSize(20)
+                    nip11Cache.trimToSize(200)
+                }
+                level >= ComponentCallbacks2.TRIM_MEMORY_UI_HIDDEN -> {
+                    // Just backgrounded, no pressure yet: trim images (bitmaps are the
+                    // largest allocations) but keep parsed-text and avatar caches warm
+                    // so resuming is instant.
+                    memoryCache.trimToSize(memoryCache.maxSize / 2)
+                }
+                level >= ComponentCallbacks2.TRIM_MEMORY_RUNNING_CRITICAL -> {
+                    // Foreground, critically low memory.
+                    memoryCache.trimToSize(memoryCache.maxSize / 4)
+                    CachedRichTextParser.trimToSize(100)
+                    CachedRobohash.trimToSize(20)
+                    nip11Cache.trimToSize(200)
+                }
+                level >= ComponentCallbacks2.TRIM_MEMORY_RUNNING_LOW -> {
+                    // Foreground, low memory.
+                    memoryCache.trimToSize(memoryCache.maxSize / 2)
+                    CachedRichTextParser.trimToSize(250)
+                    CachedRobohash.trimToSize(50)
+                    nip11Cache.trimToSize(500)
+                }
+            }
         }
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/DebugUtils.kt

@@ -37,6 +37,58 @@ import kotlin.time.measureTimedValue
 @Suppress("SENSELESS_COMPARISON")
 val isDebug = BuildConfig.DEBUG || BuildConfig.BUILD_TYPE == "benchmark"
 
+data class MemorySnapshot(
+    val heapUsedMb: Long,
+    val heapMaxMb: Long,
+    val nativeHeapUsedMb: Long,
+    val imageCacheUsedMb: Long,
+    val imageCacheMaxMb: Long,
+    val imageDiskUsedMb: Long,
+    val imageDiskMaxMb: Long,
+    val noteCount: Int,
+    val userCount: Int,
+    val addressableCount: Int,
+    val chatroomCount: Int,
+    val memoryClassMb: Int,
+) {
+    val heapFraction: Float get() = heapUsedMb.toFloat() / heapMaxMb.coerceAtLeast(1L).toFloat()
+}
+
+fun collectMemorySnapshot(context: Context): MemorySnapshot {
+    val rt = Runtime.getRuntime()
+    val heapUsedMb = (rt.totalMemory() - rt.freeMemory()) / 1_048_576L
+    val heapMaxMb = rt.maxMemory() / 1_048_576L
+    val nativeHeapUsedMb = Debug.getNativeHeapAllocatedSize() / 1_048_576L
+
+    val app = Amethyst.instance
+    val imageCacheUsedMb = app.memoryCache.size / 1_048_576L
+    val imageCacheMaxMb = app.memoryCache.maxSize / 1_048_576L
+    val imageDiskUsedMb = app.diskCache.size / 1_048_576L
+    val imageDiskMaxMb = app.diskCache.maxSize / 1_048_576L
+
+    val activityManager: ActivityManager? = context.getSystemService()
+    val isLargeHeap = (context.applicationInfo.flags and ApplicationInfo.FLAG_LARGE_HEAP) != 0
+    val memoryClassMb =
+        activityManager?.let {
+            if (isLargeHeap) it.largeMemoryClass else it.memoryClass
+        } ?: 0
+
+    return MemorySnapshot(
+        heapUsedMb = heapUsedMb,
+        heapMaxMb = heapMaxMb,
+        nativeHeapUsedMb = nativeHeapUsedMb,
+        imageCacheUsedMb = imageCacheUsedMb,
+        imageCacheMaxMb = imageCacheMaxMb,
+        imageDiskUsedMb = imageDiskUsedMb,
+        imageDiskMaxMb = imageDiskMaxMb,
+        noteCount = LocalCache.notes.size(),
+        userCount = LocalCache.users.size(),
+        addressableCount = LocalCache.addressables.size(),
+        chatroomCount = LocalCache.chatroomList.size(),
+        memoryClassMb = memoryClassMb,
+    )
+}
+
 private const val STATE_DUMP_TAG = "STATE DUMP"
 
 fun debugState(context: Context) {

amethyst/src/main/java/com/vitorpamplona/amethyst/LocalPreferences.kt

@@ -28,6 +28,7 @@ import androidx.core.content.edit
 import com.vitorpamplona.amethyst.commons.model.clink.ClinkDebitWalletEntry
 import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntry
 import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntryNorm
+import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthPolicy
 import com.vitorpamplona.amethyst.model.AccountSettings
 import com.vitorpamplona.amethyst.model.TopFilter
 import com.vitorpamplona.amethyst.model.UiSettings
@@ -105,7 +106,10 @@ private object PrefKeys {
     const val DEFAULT_DISCOVERY_FOLLOW_LIST = "defaultDiscoveryFollowList"
     const val DEFAULT_POLLS_FOLLOW_LIST = "defaultPollsFollowList"
     const val DEFAULT_PICTURES_FOLLOW_LIST = "defaultPicturesFollowList"
+    const val DEFAULT_NAPPLETS_FOLLOW_LIST = "defaultNappletsFollowList"
+    const val DEFAULT_NSITES_FOLLOW_LIST = "defaultNsitesFollowList"
     const val DEFAULT_WORKOUTS_FOLLOW_LIST = "defaultWorkoutsFollowList"
+    const val DEFAULT_GIT_REPOSITORIES_FOLLOW_LIST = "defaultGitRepositoriesFollowList"
     const val DEFAULT_CALENDARS_FOLLOW_LIST = "defaultCalendarsFollowList"
     const val DEFAULT_PRODUCTS_FOLLOW_LIST = "defaultProductsFollowList"
     const val DEFAULT_SHORTS_FOLLOW_LIST = "defaultShortsFollowList"
@@ -123,6 +127,7 @@ private object PrefKeys {
     const val DEFAULT_BROWSE_EMOJI_SETS_FOLLOW_LIST = "defaultBrowseEmojiSetsFollowList"
     const val DEFAULT_COMMUNITIES_FOLLOW_LIST = "defaultCommunitiesFollowList"
     const val DEFAULT_FOLLOW_PACKS_FOLLOW_LIST = "defaultFollowPacksFollowList"
+    const val DEFAULT_APP_RECOMMENDATIONS_FOLLOW_LIST = "defaultAppRecommendationsFollowList"
     const val ZAP_PAYMENT_REQUEST_SERVER = "zapPaymentServer" // legacy, kept for migration
     const val NWC_WALLETS = "nwcWallets"
     const val DEFAULT_NWC_WALLET_ID = "defaultNwcWalletId" // legacy, migrated into DEFAULT_PAYMENT_SOURCE_ID
@@ -151,7 +156,9 @@ private object PrefKeys {
     const val HIDE_BLOCK_ALERT_DIALOG = "hide_block_alert_dialog"
     const val HIDE_NIP_17_WARNING_DIALOG = "hide_nip24_warning_dialog" // delete later
     const val ALWAYS_ON_NOTIFICATION_SERVICE = "always_on_notification_service"
+    const val DEFAULT_RELAY_AUTH_POLICY = "default_relay_auth_policy"
     const val SPLIT_NOTIFICATIONS_ENABLED = "split_notifications_enabled"
+    const val SHOW_MESSAGES_IN_NOTIFICATIONS = "show_messages_in_notifications"
 
     // One-shot stamp: set once an account has gone through the notifications
     // Global -> Selected (Curated) migration (or was created after it shipped).
@@ -179,6 +186,12 @@ object LocalPreferences {
 
     private var currentAccount: String? = null
     private val savedAccounts: MutableStateFlow<List<AccountInfo>?> = MutableStateFlow(null)
+
+    // Guards the one-time lazy population of [savedAccounts]. Without it, concurrent callers
+    // of savedAccounts() (e.g. the account-load path, the always-on notification service, and
+    // the orphan-dir sweep, all launched at startup) would each see a null value, run the IO
+    // read in parallel, and the migration branch could double-write ALL_ACCOUNT_INFO.
+    private val savedAccountsMutex = Mutex()
     private val cachedAccounts: MutableMap<String, AccountSettings?> = mutableMapOf()
 
     suspend fun currentAccount(): String? {
@@ -208,41 +221,46 @@ object LocalPreferences {
     }
 
     private suspend fun savedAccounts(): List<AccountInfo> {
-        if (savedAccounts.value == null) {
-            withContext(Dispatchers.IO) {
-                with(encryptedPreferences()) {
-                    val newSystemOfAccounts =
-                        getString(PrefKeys.ALL_ACCOUNT_INFO, "[]")?.let {
-                            JsonMapper.fromJson<List<AccountInfo>>(it)
-                        }
+        // Fast path: already populated, no lock needed.
+        savedAccounts.value?.let { return it }
 
-                    if (!newSystemOfAccounts.isNullOrEmpty()) {
-                        savedAccounts.emit(newSystemOfAccounts)
-                    } else {
-                        val oldAccounts = getString(PrefKeys.SAVED_ACCOUNTS, null)?.split(COMMA) ?: listOf()
+        return savedAccountsMutex.withLock {
+            // Re-check under the lock: another coroutine may have populated it while we waited.
+            savedAccounts.value ?: loadSavedAccountsFromStorage().also { savedAccounts.emit(it) }
+        }
+    }
 
-                        val migrated =
-                            oldAccounts.map { npub ->
-                                AccountInfo(
-                                    npub,
-                                    encryptedPreferences(npub).getBoolean(PrefKeys.LOGIN_WITH_EXTERNAL_SIGNER, false),
-                                    (encryptedPreferences(npub).getString(PrefKeys.NOSTR_PRIVKEY, "") ?: "").isNotBlank(),
-                                    false,
-                                )
-                            }
-
-                        savedAccounts.emit(migrated)
-
-                        edit {
-                            putString(PrefKeys.ALL_ACCOUNT_INFO, JsonMapper.toJson(migrated))
-                        }
+    private suspend fun loadSavedAccountsFromStorage(): List<AccountInfo> =
+        withContext(Dispatchers.IO) {
+            with(encryptedPreferences()) {
+                val newSystemOfAccounts =
+                    getString(PrefKeys.ALL_ACCOUNT_INFO, "[]")?.let {
+                        JsonMapper.fromJson<List<AccountInfo>>(it)
                     }
+
+                if (!newSystemOfAccounts.isNullOrEmpty()) {
+                    newSystemOfAccounts
+                } else {
+                    val oldAccounts = getString(PrefKeys.SAVED_ACCOUNTS, null)?.split(COMMA) ?: listOf()
+
+                    val migrated =
+                        oldAccounts.map { npub ->
+                            AccountInfo(
+                                npub,
+                                encryptedPreferences(npub).getBoolean(PrefKeys.LOGIN_WITH_EXTERNAL_SIGNER, false),
+                                (encryptedPreferences(npub).getString(PrefKeys.NOSTR_PRIVKEY, "") ?: "").isNotBlank(),
+                                false,
+                            )
+                        }
+
+                    edit {
+                        putString(PrefKeys.ALL_ACCOUNT_INFO, JsonMapper.toJson(migrated))
+                    }
+
+                    migrated
                 }
             }
         }
-        // it's always not null when it gets here.
-        return savedAccounts.value!!
-    }
 
     fun accountsFlow() = savedAccounts
 
@@ -340,7 +358,27 @@ object LocalPreferences {
         }
     }
 
-    suspend fun setDefaultAccount(accountSettings: AccountSettings) {
+    /**
+     * Make [accountSettings] the current account, persisting + caching it. Returns the settings that
+     * actually became current — normally [accountSettings] itself, but see the downgrade guard below.
+     */
+    suspend fun setDefaultAccount(accountSettings: AccountSettings): AccountSettings {
+        val npub = accountSettings.keyPair.pubKey.toNpub()
+
+        // Downgrade guard: adding a read-only npub for a pubkey we already hold a SIGNING account for
+        // must not clobber that account. Accounts dedup by npub, so saving fresh read-only settings
+        // here would overwrite the signing account's per-npub file — wiping its cached follow/relay/
+        // mute lists and flipping hasPrivKey off, which silently disables its push notifications. A
+        // signing account already does everything the read-only one would, so keep it and just make
+        // it current instead of degrading it.
+        if (!accountSettings.isWriteable()) {
+            val existing = loadAccountConfigFromEncryptedStorage(npub)
+            if (existing != null && existing.isWriteable()) {
+                setCurrentAccount(existing)
+                return existing
+            }
+        }
+
         // Save the per-npub file before emitting onto the savedAccounts flow.
         // Otherwise a collector (e.g. AlwaysOnNotificationServiceManager) can race in
         // and call loadAccountConfigFromEncryptedStorage(npub) before NOSTR_PUBKEY is
@@ -348,9 +386,9 @@ object LocalPreferences {
         // rest of the session — making every later switch to this account land on
         // LoggedOff instead of LoggedIn.
         saveToEncryptedStorage(accountSettings)
-        val npub = accountSettings.keyPair.pubKey.toNpub()
         mutex.withLock { cachedAccounts.put(npub, accountSettings) }
         setCurrentAccount(accountSettings)
+        return accountSettings
     }
 
     suspend fun allSavedAccounts(): List<AccountInfo> = savedAccounts()
@@ -388,7 +426,10 @@ object LocalPreferences {
 
                     putString(PrefKeys.DEFAULT_POLLS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultPollsFollowList.value))
                     putString(PrefKeys.DEFAULT_PICTURES_FOLLOW_LIST, JsonMapper.toJson(settings.defaultPicturesFollowList.value))
+                    putString(PrefKeys.DEFAULT_NAPPLETS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultNappletsFollowList.value))
+                    putString(PrefKeys.DEFAULT_NSITES_FOLLOW_LIST, JsonMapper.toJson(settings.defaultNsitesFollowList.value))
                     putString(PrefKeys.DEFAULT_WORKOUTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultWorkoutsFollowList.value))
+                    putString(PrefKeys.DEFAULT_GIT_REPOSITORIES_FOLLOW_LIST, JsonMapper.toJson(settings.defaultGitRepositoriesFollowList.value))
                     putString(PrefKeys.DEFAULT_CALENDARS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultCalendarsFollowList.value))
                     putString(PrefKeys.DEFAULT_PRODUCTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultProductsFollowList.value))
                     putString(PrefKeys.DEFAULT_SHORTS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultShortsFollowList.value))
@@ -406,6 +447,7 @@ object LocalPreferences {
                     putString(PrefKeys.DEFAULT_BROWSE_EMOJI_SETS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultBrowseEmojiSetsFollowList.value))
                     putString(PrefKeys.DEFAULT_COMMUNITIES_FOLLOW_LIST, JsonMapper.toJson(settings.defaultCommunitiesFollowList.value))
                     putString(PrefKeys.DEFAULT_FOLLOW_PACKS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultFollowPacksFollowList.value))
+                    putString(PrefKeys.DEFAULT_APP_RECOMMENDATIONS_FOLLOW_LIST, JsonMapper.toJson(settings.defaultAppRecommendationsFollowList.value))
 
                     val walletEntries = settings.nwcWallets.value.mapNotNull { it.denormalize() }
                     if (walletEntries.isNotEmpty()) {
@@ -466,7 +508,9 @@ object LocalPreferences {
                     putBoolean(PrefKeys.HIDE_BLOCK_ALERT_DIALOG, settings.hideBlockAlertDialog)
                     putBoolean(PrefKeys.CALLS_ENABLED, settings.callsEnabled.value)
                     putBoolean(PrefKeys.ALWAYS_ON_NOTIFICATION_SERVICE, settings.alwaysOnNotificationService.value)
+                    putString(PrefKeys.DEFAULT_RELAY_AUTH_POLICY, settings.defaultRelayAuthPolicy.value.name)
                     putBoolean(PrefKeys.SPLIT_NOTIFICATIONS_ENABLED, settings.splitNotificationsEnabled.value)
+                    putBoolean(PrefKeys.SHOW_MESSAGES_IN_NOTIFICATIONS, settings.showMessagesInNotifications.value)
                     // Any account that reaches a save has its notification filter in its
                     // post-split meaning, so stamp it as migrated. This keeps the one-shot
                     // Global -> Selected rewrite from ever touching it again and preserves a
@@ -581,7 +625,12 @@ object LocalPreferences {
                     val hideNIP17WarningDialog = getBoolean(PrefKeys.HIDE_NIP_17_WARNING_DIALOG, false)
                     val callsEnabled = getBoolean(PrefKeys.CALLS_ENABLED, true)
                     val alwaysOnNotificationService = getBoolean(PrefKeys.ALWAYS_ON_NOTIFICATION_SERVICE, false)
+                    val defaultRelayAuthPolicy =
+                        getString(PrefKeys.DEFAULT_RELAY_AUTH_POLICY, null)
+                            ?.let { runCatching { RelayAuthPolicy.valueOf(it) }.getOrNull() }
+                            ?: RelayAuthPolicy.IF_IN_MY_LIST
                     val splitNotificationsEnabled = getBoolean(PrefKeys.SPLIT_NOTIFICATIONS_ENABLED, false)
+                    val showMessagesInNotifications = getBoolean(PrefKeys.SHOW_MESSAGES_IN_NOTIFICATIONS, true)
                     val hasDonatedInVersion = getStringSet(PrefKeys.HAS_DONATED_IN_VERSION, null) ?: setOf()
                     val dismissedPollNoteIds = getStringSet(PrefKeys.DISMISSED_POLL_NOTE_IDS, null) ?: setOf()
                     val viewedPollResultNoteIdsStr = getString(PrefKeys.VIEWED_POLL_RESULT_NOTE_IDS, null)
@@ -693,12 +742,50 @@ object LocalPreferences {
 
                     Log.d("LocalPreferences") { "Load account from file $npub - asyncs created" }
 
+                    // Resolve every parallel parse into a local before constructing AccountSettings.
+                    // Awaiting inside the 70-argument constructor expression below would place ~27
+                    // suspension points in the middle of a single huge operand stack, forcing the
+                    // coroutine state machine to spill/restore every partially-evaluated argument at
+                    // each point. That bloats the generated method past the compiler's per-method
+                    // instruction limit ("Method exceeds compiler instruction limit"). Awaiting into
+                    // vals first keeps each suspension point at a statement boundary (near-empty
+                    // operand stack) and leaves the constructor as straight-line, suspension-free code.
+                    val nwcWalletsResolved = nwcWalletsLoaded.await()
+                    val clinkDebitsResolved = clinkDebitsLoaded.await()
+                    val defaultFileServerResolved = defaultFileServer.await()
+                    val viewedPollResultNoteIdsResolved = viewedPollResultNoteIds.await()
+                    val pendingAttestationsResolved = pendingAttestations.await()
+                    val lastReadPerRouteResolved = lastReadPerRoute.await()
+                    val latestUserMetadataResolved = latestUserMetadata.await()
+                    val latestContactListResolved = latestContactList.await()
+                    val latestDmRelayListResolved = latestDmRelayList.await()
+                    val latestNip65RelayListResolved = latestNip65RelayList.await()
+                    val latestSearchRelayListResolved = latestSearchRelayList.await()
+                    val latestIndexRelayListResolved = latestIndexRelayList.await()
+                    val latestRelayFeedsListResolved = latestRelayFeedsList.await()
+                    val latestBlockedRelayListResolved = latestBlockedRelayList.await()
+                    val latestTrustedRelayListResolved = latestTrustedRelayList.await()
+                    val latestMuteListResolved = latestMuteList.await()
+                    val latestPrivateHomeRelayListResolved = latestPrivateHomeRelayList.await()
+                    val latestAppSpecificDataResolved = latestAppSpecificData.await()
+                    val latestChannelListResolved = latestChannelList.await()
+                    val latestCommunityListResolved = latestCommunityList.await()
+                    val latestHashtagListResolved = latestHashtagList.await()
+                    val latestGeohashListResolved = latestGeohashList.await()
+                    val latestEphemeralListResolved = latestEphemeralList.await()
+                    val latestTrustProviderListResolved = latestTrustProviderList.await()
+                    val latestPaymentTargetsResolved = latestPaymentTargets.await()
+                    val latestCashuWalletResolved = latestCashuWallet.await()
+                    val latestNutzapInfoResolved = latestNutzapInfo.await()
+
+                    Log.d("LocalPreferences") { "Load account from file $npub - asyncs resolved" }
+
                     return@with AccountSettings(
                         keyPair = keyPair,
                         transientAccount = false,
                         externalSignerPackageName = externalSignerPackageName,
                         localRelayServers = MutableStateFlow(localRelayServers),
-                        defaultFileServer = defaultFileServer.await(),
+                        defaultFileServer = defaultFileServerResolved,
                         stripLocationOnUpload = stripLocationOnUpload,
                         useLocalBlossomCache = MutableStateFlow(useLocalBlossomCache),
                         localBlossomCacheProfilePicturesOnly = MutableStateFlow(localBlossomCacheProfilePicturesOnly),
@@ -709,7 +796,10 @@ object LocalPreferences {
                         defaultDiscoveryFollowList = MutableStateFlow(followListPrefs.discovery),
                         defaultPollsFollowList = MutableStateFlow(followListPrefs.polls),
                         defaultPicturesFollowList = MutableStateFlow(followListPrefs.pictures),
+                        defaultNappletsFollowList = MutableStateFlow(followListPrefs.napplets),
+                        defaultNsitesFollowList = MutableStateFlow(followListPrefs.nsites),
                         defaultWorkoutsFollowList = MutableStateFlow(followListPrefs.workouts),
+                        defaultGitRepositoriesFollowList = MutableStateFlow(followListPrefs.gitRepositories),
                         defaultCalendarsFollowList = MutableStateFlow(followListPrefs.calendars),
                         defaultProductsFollowList = MutableStateFlow(followListPrefs.products),
                         defaultShortsFollowList = MutableStateFlow(followListPrefs.shorts),
@@ -727,47 +817,50 @@ object LocalPreferences {
                         defaultBrowseEmojiSetsFollowList = MutableStateFlow(followListPrefs.browseEmojiSets),
                         defaultCommunitiesFollowList = MutableStateFlow(followListPrefs.communities),
                         defaultFollowPacksFollowList = MutableStateFlow(followListPrefs.followPacks),
-                        nwcWallets = MutableStateFlow(nwcWalletsLoaded.await().first),
-                        clinkDebitWallets = MutableStateFlow(clinkDebitsLoaded.await()),
+                        defaultAppRecommendationsFollowList = MutableStateFlow(followListPrefs.appRecommendations),
+                        nwcWallets = MutableStateFlow(nwcWalletsResolved.first),
+                        clinkDebitWallets = MutableStateFlow(clinkDebitsResolved),
                         // Prefer the new unified default; migrate from the legacy NWC default;
                         // else fall back to the first configured source (NWC before debits).
                         defaultPaymentSourceId =
                             MutableStateFlow(
                                 defaultPaymentSourceIdStr
-                                    ?: nwcWalletsLoaded.await().second
-                                    ?: clinkDebitsLoaded.await().firstOrNull()?.id,
+                                    ?: nwcWalletsResolved.second
+                                    ?: clinkDebitsResolved.firstOrNull()?.id,
                             ),
                         hideDeleteRequestDialog = hideDeleteRequestDialog,
                         hideBlockAlertDialog = hideBlockAlertDialog,
                         hideNIP17WarningDialog = hideNIP17WarningDialog,
                         alwaysOnNotificationService = MutableStateFlow(alwaysOnNotificationService),
+                        defaultRelayAuthPolicy = MutableStateFlow(defaultRelayAuthPolicy),
                         splitNotificationsEnabled = MutableStateFlow(splitNotificationsEnabled),
-                        backupUserMetadata = latestUserMetadata.await(),
-                        backupContactList = latestContactList.await(),
-                        backupNIP65RelayList = latestNip65RelayList.await(),
-                        backupDMRelayList = latestDmRelayList.await(),
-                        backupSearchRelayList = latestSearchRelayList.await(),
-                        backupIndexRelayList = latestIndexRelayList.await(),
-                        backupRelayFeedsList = latestRelayFeedsList.await(),
-                        backupBlockedRelayList = latestBlockedRelayList.await(),
-                        backupTrustedRelayList = latestTrustedRelayList.await(),
-                        backupPrivateHomeRelayList = latestPrivateHomeRelayList.await(),
-                        backupMuteList = latestMuteList.await(),
-                        backupAppSpecificData = latestAppSpecificData.await(),
-                        backupChannelList = latestChannelList.await(),
-                        backupCommunityList = latestCommunityList.await(),
-                        backupHashtagList = latestHashtagList.await(),
-                        backupGeohashList = latestGeohashList.await(),
-                        backupEphemeralChatList = latestEphemeralList.await(),
-                        backupTrustProviderList = latestTrustProviderList.await(),
-                        lastReadPerRoute = MutableStateFlow(lastReadPerRoute.await()),
+                        showMessagesInNotifications = MutableStateFlow(showMessagesInNotifications),
+                        backupUserMetadata = latestUserMetadataResolved,
+                        backupContactList = latestContactListResolved,
+                        backupNIP65RelayList = latestNip65RelayListResolved,
+                        backupDMRelayList = latestDmRelayListResolved,
+                        backupSearchRelayList = latestSearchRelayListResolved,
+                        backupIndexRelayList = latestIndexRelayListResolved,
+                        backupRelayFeedsList = latestRelayFeedsListResolved,
+                        backupBlockedRelayList = latestBlockedRelayListResolved,
+                        backupTrustedRelayList = latestTrustedRelayListResolved,
+                        backupPrivateHomeRelayList = latestPrivateHomeRelayListResolved,
+                        backupMuteList = latestMuteListResolved,
+                        backupAppSpecificData = latestAppSpecificDataResolved,
+                        backupChannelList = latestChannelListResolved,
+                        backupCommunityList = latestCommunityListResolved,
+                        backupHashtagList = latestHashtagListResolved,
+                        backupGeohashList = latestGeohashListResolved,
+                        backupEphemeralChatList = latestEphemeralListResolved,
+                        backupTrustProviderList = latestTrustProviderListResolved,
+                        lastReadPerRoute = MutableStateFlow(lastReadPerRouteResolved),
                         hasDonatedInVersion = MutableStateFlow(hasDonatedInVersion),
                         dismissedPollNoteIds = MutableStateFlow(dismissedPollNoteIds),
-                        viewedPollResultNoteIds = MutableStateFlow(viewedPollResultNoteIds.await()),
-                        pendingAttestations = MutableStateFlow(pendingAttestations.await()),
-                        backupNipA3PaymentTargets = latestPaymentTargets.await(),
-                        backupCashuWallet = latestCashuWallet.await(),
-                        backupNutzapInfo = latestNutzapInfo.await(),
+                        viewedPollResultNoteIds = MutableStateFlow(viewedPollResultNoteIdsResolved),
+                        pendingAttestations = MutableStateFlow(pendingAttestationsResolved),
+                        backupNipA3PaymentTargets = latestPaymentTargetsResolved,
+                        backupCashuWallet = latestCashuWalletResolved,
+                        backupNutzapInfo = latestNutzapInfoResolved,
                         callsEnabled = MutableStateFlow(callsEnabled),
                     )
                 }
@@ -797,7 +890,10 @@ object LocalPreferences {
         val discovery: TopFilter,
         val polls: TopFilter,
         val pictures: TopFilter,
+        val napplets: TopFilter,
+        val nsites: TopFilter,
         val workouts: TopFilter,
+        val gitRepositories: TopFilter,
         val calendars: TopFilter,
         val products: TopFilter,
         val shorts: TopFilter,
@@ -815,6 +911,7 @@ object LocalPreferences {
         val browseEmojiSets: TopFilter,
         val communities: TopFilter,
         val followPacks: TopFilter,
+        val appRecommendations: TopFilter,
     )
 
     /**
@@ -849,7 +946,10 @@ object LocalPreferences {
             discovery = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_DISCOVERY_FOLLOW_LIST, null), TopFilter.Global),
             polls = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_POLLS_FOLLOW_LIST, null), TopFilter.Global),
             pictures = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_PICTURES_FOLLOW_LIST, null), TopFilter.Global),
+            napplets = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_NAPPLETS_FOLLOW_LIST, null), TopFilter.Global),
+            nsites = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_NSITES_FOLLOW_LIST, null), TopFilter.Global),
             workouts = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_WORKOUTS_FOLLOW_LIST, null), TopFilter.Global),
+            gitRepositories = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_GIT_REPOSITORIES_FOLLOW_LIST, null), TopFilter.Global),
             calendars = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_CALENDARS_FOLLOW_LIST, null), TopFilter.Global),
             products = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_PRODUCTS_FOLLOW_LIST, null), TopFilter.AroundMe),
             shorts = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_SHORTS_FOLLOW_LIST, null), TopFilter.Global),
@@ -867,6 +967,7 @@ object LocalPreferences {
             browseEmojiSets = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_BROWSE_EMOJI_SETS_FOLLOW_LIST, null), TopFilter.Global),
             communities = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_COMMUNITIES_FOLLOW_LIST, null), TopFilter.AllFollows),
             followPacks = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_FOLLOW_PACKS_FOLLOW_LIST, null), TopFilter.Global),
+            appRecommendations = parseTopFilterOrDefault(getString(PrefKeys.DEFAULT_APP_RECOMMENDATIONS_FOLLOW_LIST, null), TopFilter.Global),
         )
 
     private inline fun <reified T : Any> parseOrNull(value: String?): T? {

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/BrowserHistoryRegistry.kt

@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.favorites
+
+import android.content.Context
+import android.util.Log
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import com.vitorpamplona.amethyst.commons.browser.OmniboxInput
+import com.vitorpamplona.quartz.nip01Core.core.JsonMapper
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.launch
+import kotlinx.serialization.Serializable
+
+private val Context.browserHistoryDataStore by preferencesDataStore(name = "browser_history")
+
+/**
+ * One device-local visited site, keyed by full [url]. [visitCount]/[lastVisitedAt] drive frecency ranking
+ * in the omnibox suggestions.
+ */
+@Serializable
+data class BrowserHistoryEntry(
+    val url: String,
+    val title: String,
+    val host: String,
+    val lastVisitedAt: Long,
+    val visitCount: Int,
+)
+
+/**
+ * The browser's visit history — the data behind the omnibox suggestions, alongside the user's favorites.
+ *
+ * **Only pages that actually loaded land here.** [record] is called from the `:napplet` browser host
+ * (relayed over IPC through `NappletBrokerService`) on a *successful* main-frame page-finish — never from
+ * the address bar as the user types — so misspelled/never-resolved hosts never pollute the list. Bounded
+ * to [MAX_ENTRIES] most-recent entries.
+ *
+ * Lives only in the **main process** (the launcher/omnibox consume it; the keyless `:napplet` sandbox
+ * never reads it). Same shape as [FavoriteAppsRegistry]: an authoritative in-memory [StateFlow] for
+ * synchronous Compose reads, with write-through persistence to a DataStore on a background scope.
+ */
+object BrowserHistoryRegistry {
+    private val KEY = stringPreferencesKey("history")
+    private const val MAX_ENTRIES = 500
+
+    private val _history = MutableStateFlow<List<BrowserHistoryEntry>>(emptyList())
+    val history: StateFlow<List<BrowserHistoryEntry>> = _history.asStateFlow()
+
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+
+    @Volatile private var appContext: Context? = null
+
+    @Volatile private var hydrated = false
+
+    /** Binds the app context and hydrates the on-disk list into [history]. Idempotent. */
+    fun init(context: Context) {
+        if (appContext != null) return
+        val ctx = context.applicationContext
+        appContext = ctx
+        scope.launch {
+            val json = ctx.browserHistoryDataStore.data.first()[KEY]
+            val loaded = if (json != null) decode(json) else emptyList()
+            // Merge disk under anything already recorded this session (session wins, newest-first).
+            update { current -> dedupeNewestFirst(current + loaded) }
+            hydrated = true
+        }
+    }
+
+    /**
+     * Records a successful visit to [url], moving it to the front. An existing entry for the same URL is
+     * bumped (visit count +1, title refreshed if non-blank); otherwise a new entry is prepended.
+     */
+    fun record(
+        url: String,
+        title: String,
+    ) {
+        val host = OmniboxInput.hostOf(url) ?: url
+        val now = System.currentTimeMillis()
+        update { current ->
+            val existing = current.firstOrNull { it.url == url }
+            val entry =
+                if (existing != null) {
+                    existing.copy(
+                        title = title.ifBlank { existing.title },
+                        host = host,
+                        lastVisitedAt = now,
+                        visitCount = existing.visitCount + 1,
+                    )
+                } else {
+                    BrowserHistoryEntry(url = url, title = title, host = host, lastVisitedAt = now, visitCount = 1)
+                }
+            (listOf(entry) + current.filterNot { it.url == url }).take(MAX_ENTRIES)
+        }
+    }
+
+    fun remove(url: String) = update { current -> current.filterNot { it.url == url } }
+
+    fun clear() = update { emptyList() }
+
+    private fun dedupeNewestFirst(list: List<BrowserHistoryEntry>): List<BrowserHistoryEntry> =
+        list
+            .sortedByDescending { it.lastVisitedAt }
+            .distinctBy { it.url }
+            .take(MAX_ENTRIES)
+
+    private inline fun update(transform: (List<BrowserHistoryEntry>) -> List<BrowserHistoryEntry>) {
+        val next = transform(_history.value)
+        if (next == _history.value) return
+        _history.value = next
+        persist(encode(next))
+    }
+
+    private fun persist(json: String) {
+        val ctx = appContext ?: return
+        scope.launch {
+            ctx.browserHistoryDataStore.edit { it[KEY] = json }
+        }
+    }
+
+    private fun encode(list: List<BrowserHistoryEntry>): String = JsonMapper.toJson(list)
+
+    private fun decode(json: String): List<BrowserHistoryEntry> =
+        try {
+            JsonMapper.fromJson<List<BrowserHistoryEntry>>(json)
+        } catch (e: Exception) {
+            Log.w("BrowserHistoryRegistry", "Failed to decode history", e)
+            emptyList()
+        }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/BrowserIconRegistry.kt

@@ -0,0 +1,98 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.favorites
+
+import android.content.Context
+import android.util.Log
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.flow.update
+import java.io.File
+
+/**
+ * Device-local favicon store for browsed sites, keyed by host. Favicons are **captured from the WebView
+ * that already loaded the page** in the keyless `:napplet` browser host (where they ride the page's own —
+ * Tor-routed — network path) and relayed here as PNG bytes over IPC; this is the privacy-preserving
+ * alternative to the main app fetching `host/favicon.ico` itself, which would bypass Tor and leak the
+ * visit. Used to decorate favorite cards and omnibox suggestion rows.
+ *
+ * Lives only in the **main process**. Bytes are persisted as one small PNG per host under
+ * `filesDir/browser_icons`; the deterministic path means the only in-memory state is [keys] — the set of
+ * hosts that currently have an icon — which exists purely to drive Compose recomposition (and to keep
+ * `File.exists()` disk checks out of composition).
+ */
+object BrowserIconRegistry {
+    private const val DIR = "browser_icons"
+
+    private val _keys = MutableStateFlow<Set<String>>(emptySet())
+
+    /** Sanitized host keys that currently have a stored icon. Observe to recompose when an icon arrives. */
+    val keys: StateFlow<Set<String>> = _keys.asStateFlow()
+
+    @Volatile private var iconDir: File? = null
+
+    /** Binds the app context and indexes already-stored icons. Idempotent. */
+    fun init(context: Context) {
+        if (iconDir != null) return
+        val dir = File(context.applicationContext.filesDir, DIR).apply { mkdirs() }
+        iconDir = dir
+        _keys.value = dir.listFiles()?.mapNotNull { it.name.removeSuffix(PNG).takeIf { n -> n.isNotBlank() } }?.toSet() ?: emptySet()
+    }
+
+    /** Persists [bytes] as the favicon for [host] and marks it available. Called from the broker on IPC. */
+    fun record(
+        host: String,
+        bytes: ByteArray,
+    ) {
+        val dir = iconDir ?: return
+        if (host.isBlank() || bytes.isEmpty()) return
+        val key = sanitize(host)
+        try {
+            File(dir, key + PNG).writeBytes(bytes)
+            _keys.update { it + key }
+        } catch (e: Exception) {
+            Log.w("BrowserIconRegistry", "Failed to store favicon for $host", e)
+        }
+    }
+
+    /**
+     * A Coil model (`file://…`) for [host]'s favicon, or null when none is stored. Reads [keys] so callers
+     * that observe the flow recompose as icons arrive — pass [keys]'s value as a `remember` key.
+     */
+    fun iconModelFor(host: String): String? {
+        val dir = iconDir ?: return null
+        val key = sanitize(host)
+        if (key !in _keys.value) return null
+        return "file://" + File(dir, key + PNG).absolutePath
+    }
+
+    // Hosts map to a flat, filesystem-safe filename. Collisions (two hosts → one key) only mean a shared
+    // icon file, which is harmless for a decoration.
+    private fun sanitize(host: String): String =
+        host
+            .lowercase()
+            .map { if (it.isLetterOrDigit() || it == '.' || it == '-') it else '_' }
+            .joinToString("")
+            .take(120)
+
+    private const val PNG = ".png"
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/FavoriteAppLauncher.kt

@@ -0,0 +1,219 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.favorites
+
+import android.app.Activity
+import android.content.Context
+import android.content.res.Configuration
+import android.os.Bundle
+import android.util.Log
+import android.widget.Toast
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
+import com.vitorpamplona.amethyst.model.LocalCache
+import com.vitorpamplona.amethyst.model.ThemeType
+import com.vitorpamplona.amethyst.napplet.NappletLauncher
+import com.vitorpamplona.amethyst.napplet.WebAppNetworkRegistry
+import com.vitorpamplona.amethyst.napplethost.HostProfile
+import com.vitorpamplona.amethyst.napplethost.NappletBrowserActivity
+import com.vitorpamplona.quartz.nip01Core.core.Event
+import com.vitorpamplona.quartz.nip5aStaticWebsites.NamedSiteEvent
+import com.vitorpamplona.quartz.nip5aStaticWebsites.RootSiteEvent
+import com.vitorpamplona.quartz.nip5dNapplets.NamedNappletEvent
+import com.vitorpamplona.quartz.nip5dNapplets.RootNappletEvent
+
+/**
+ * Turns a [FavoriteApp] back into a running app. The two cases map to the two launch paths in the
+ * codebase, nothing more:
+ *
+ * - [FavoriteApp.WebApp] → a full-screen direct-WebView
+ *   [NappletBrowserActivity][com.vitorpamplona.amethyst.napplethost.NappletBrowserActivity] (its own
+ *   task/recents entry), so the web client owns the whole screen and scrolls/zooms natively.
+ * - [FavoriteApp.NostrApp] → re-resolve the live event from [LocalCache] by coordinate, read its
+ *   `requires`/website-mode off the event, then hand to [NappletLauncher] (the sandboxed `:napplet`
+ *   host). nsite vs napplet is decided *here*, from the event, never from stored state.
+ *
+ * A [FavoriteApp.NostrApp] whose event hasn't loaded yet can't launch; we surface that instead of
+ * failing silently.
+ */
+object FavoriteAppLauncher {
+    fun launch(
+        context: Context,
+        app: FavoriteApp,
+    ) {
+        when (app) {
+            is FavoriteApp.WebApp -> launchUrl(context, app.url)
+            is FavoriteApp.NostrApp -> launchNostrApp(context, app.coordinate)
+        }
+    }
+
+    /**
+     * Opens [url] full-screen in its own task, so back/recents treat it like a separate app. Uses the
+     * direct-WebView [NappletBrowserActivity] (page scrolls/zooms and the keyboard resizes natively),
+     * resolving the proxy port + this site's remembered Tor choice here in the main process. [preferTor]
+     * forces Tor (when available) regardless of the remembered choice — used for `.onion`, which only
+     * resolves over Tor.
+     */
+    fun launchUrl(
+        context: Context,
+        url: String,
+        preferTor: Boolean = false,
+    ) {
+        val proxyPort = Amethyst.instance.torManager.activePortOrNull.value ?: -1
+        val useTor = proxyPort > 0 && (preferTor || WebAppNetworkRegistry.useTor(url))
+        val themeType = Amethyst.instance.uiPrefs.value.theme.value
+        val theme =
+            when (themeType) {
+                ThemeType.DARK -> "DARK"
+                ThemeType.LIGHT -> "LIGHT"
+                ThemeType.SYSTEM -> {
+                    val nightMask = context.resources.configuration.uiMode and Configuration.UI_MODE_NIGHT_MASK
+                    if (nightMask == Configuration.UI_MODE_NIGHT_YES) "DARK" else "LIGHT"
+                }
+            }
+        val isFavorite = FavoriteAppsRegistry.isFavorite("url:$url")
+        val intent =
+            NappletBrowserActivity.intent(context, url, proxyPort, useTor, theme = theme, isFavorite = isFavorite).apply {
+                if (context !is Activity) addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK)
+            }
+        context.startActivity(intent)
+    }
+
+    private fun launchNostrApp(
+        context: Context,
+        coordinate: String,
+    ) {
+        val event = LocalCache.getAddressableNoteIfExists(coordinate)?.event
+        when (event) {
+            is RootNappletEvent ->
+                NappletLauncher.launch(context, event, event.pubKey, "")
+            is NamedNappletEvent ->
+                NappletLauncher.launch(context, event, event.pubKey, event.identifier())
+            is RootSiteEvent ->
+                NappletLauncher.launch(
+                    context = context,
+                    paths = event.paths(),
+                    servers = event.servers(),
+                    authorPubKey = event.pubKey,
+                    identifier = "",
+                    aggregateHash = null,
+                    title = event.title() ?: "nsite",
+                    requires = emptyList(),
+                    profile = HostProfile.WEBSITE,
+                )
+            is NamedSiteEvent ->
+                NappletLauncher.launch(
+                    context = context,
+                    paths = event.paths(),
+                    servers = event.servers(),
+                    authorPubKey = event.pubKey,
+                    identifier = event.identifier(),
+                    aggregateHash = null,
+                    title = event.title() ?: event.identifier(),
+                    requires = emptyList(),
+                    profile = HostProfile.WEBSITE,
+                )
+            else -> {
+                Log.w("FavoriteAppLauncher", "Favorited app not resolvable yet: $coordinate")
+                Toast.makeText(context, R.string.favorite_app_still_loading, Toast.LENGTH_SHORT).show()
+            }
+        }
+    }
+
+    /**
+     * Builds the main-process-minted launch parameters for embedding the nsite/napplet at [coordinate]
+     * as an in-app tab (see `NappletHostService`). Returns null when the event isn't resolvable in
+     * [LocalCache] yet — the caller shows a loading state. nsite vs napplet (and website mode) is decided
+     * here from the live event, exactly as in [launchNostrApp].
+     */
+    fun embedParams(
+        context: Context,
+        coordinate: String,
+    ): Bundle? {
+        val event = LocalCache.getAddressableNoteIfExists(coordinate)?.event
+        return when (event) {
+            is RootNappletEvent ->
+                NappletLauncher.buildLaunchParams(
+                    context,
+                    event.paths(),
+                    event.servers(),
+                    event.pubKey,
+                    "",
+                    event.declaredAggregateHash() ?: event.computeAggregateHash(),
+                    event.title() ?: "Napplet",
+                    event.requires(),
+                    HostProfile.NAPPLET,
+                )
+            is NamedNappletEvent ->
+                NappletLauncher.buildLaunchParams(
+                    context,
+                    event.paths(),
+                    event.servers(),
+                    event.pubKey,
+                    event.identifier(),
+                    event.declaredAggregateHash() ?: event.computeAggregateHash(),
+                    event.title() ?: event.identifier(),
+                    event.requires(),
+                    HostProfile.NAPPLET,
+                )
+            is RootSiteEvent ->
+                NappletLauncher.buildLaunchParams(
+                    context,
+                    event.paths(),
+                    event.servers(),
+                    event.pubKey,
+                    "",
+                    null,
+                    event.title() ?: "nsite",
+                    emptyList(),
+                    HostProfile.WEBSITE,
+                )
+            is NamedSiteEvent ->
+                NappletLauncher.buildLaunchParams(
+                    context,
+                    event.paths(),
+                    event.servers(),
+                    event.pubKey,
+                    event.identifier(),
+                    null,
+                    event.title() ?: event.identifier(),
+                    emptyList(),
+                    HostProfile.WEBSITE,
+                )
+            else -> null
+        }
+    }
+
+    /**
+     * The addressable coordinate `kind:pubkey:dtag` used to key an nsite/napplet favorite. Stored
+     * instead of the content hash so the favorite survives routine code/manifest updates.
+     */
+    fun coordinateOf(event: Event): String {
+        val dTag =
+            when (event) {
+                is NamedNappletEvent -> event.identifier()
+                is NamedSiteEvent -> event.identifier()
+                else -> ""
+            }
+        return "${event.kind}:${event.pubKey}:$dTag"
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/FavoriteAppsRegistry.kt

@@ -0,0 +1,214 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.favorites
+
+import android.content.Context
+import android.util.Log
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
+import com.vitorpamplona.quartz.nip01Core.core.JsonMapper
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.launch
+import kotlinx.serialization.Serializable
+import java.util.concurrent.ConcurrentHashMap
+
+private val Context.favoriteAppsDataStore by preferencesDataStore(name = "favorite_apps")
+
+/**
+ * The user's device-local list of [FavoriteApp]s — the single source of truth shared by the bottom
+ * bar, the Favorite Apps grid, and the browser launcher. Ordered (the user can reorder); de-duplicated
+ * by [FavoriteApp.id].
+ *
+ * Lives only in the **main process** (the launcher/UI consume it); the keyless `:napplet` sandbox never
+ * touches it. An in-memory [StateFlow] is authoritative for the session so Compose can observe it
+ * synchronously, with write-through persistence to a DataStore on a background scope. The list is
+ * stored as a single JSON array under one key (small, bounded, hand-curated data — no need for one key
+ * per entry).
+ */
+object FavoriteAppsRegistry {
+    private val KEY = stringPreferencesKey("favorites")
+
+    // Raw manifest event JSON for each favorited [FavoriteApp.NostrApp], keyed by its addressable
+    // coordinate. Cached so a pinned nsite/napplet resolves instantly on the next cold start — and
+    // offline — instead of waiting on a relay round-trip the way a [FavoriteApp.WebApp]'s URL never
+    // has to. The relay subscription that warms these favorites keeps the cache fresh.
+    private val MANIFESTS_KEY = stringPreferencesKey("manifests")
+
+    private val _favorites = MutableStateFlow<List<FavoriteApp>>(emptyList())
+    val favorites: StateFlow<List<FavoriteApp>> = _favorites.asStateFlow()
+
+    private val manifestCache = MutableStateFlow<Map<String, String>>(emptyMap())
+
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+
+    @Volatile private var appContext: Context? = null
+
+    // Hydration runs async on a background scope, so the user can add/remove before the disk list
+    // merges in. [removedBeforeHydration] tombstones any id removed in that window, so the merge can't
+    // resurrect a just-deleted favorite from disk.
+    @Volatile private var hydrated = false
+    private val removedBeforeHydration = ConcurrentHashMap.newKeySet<String>()
+
+    /** Binds the app context and hydrates the on-disk list into [favorites]. Idempotent. */
+    fun init(context: Context) {
+        if (appContext != null) return
+        val ctx = context.applicationContext
+        appContext = ctx
+        scope.launch {
+            val prefs = ctx.favoriteAppsDataStore.data.first()
+            val loaded = prefs[KEY]?.let { decode(it) } ?: emptyList()
+            // Don't clobber adds made in this session before hydration finished, and don't resurrect
+            // anything the user removed in that same window.
+            update { current -> (loaded.filterNot { it.id in removedBeforeHydration } + current).distinctBy { it.id } }
+
+            // Same race rules for the manifest cache: a cacheManifest() in this session wins over the
+            // disk copy, and a manifest whose favorite was removed pre-hydration must not come back.
+            val loadedManifests = prefs[MANIFESTS_KEY]?.let { decodeManifests(it) } ?: emptyMap()
+            updateManifests { current -> loadedManifests.filterKeys { "nostr:$it" !in removedBeforeHydration } + current }
+
+            hydrated = true
+            removedBeforeHydration.clear()
+        }
+    }
+
+    fun isFavorite(id: String): Boolean = _favorites.value.any { it.id == id }
+
+    /** Adds [app] to the end if not already present (by [FavoriteApp.id]). */
+    fun add(app: FavoriteApp) = update { current -> if (current.any { it.id == app.id }) current else current + app }
+
+    fun remove(id: String) {
+        if (!hydrated) removedBeforeHydration.add(id)
+        update { current -> current.filterNot { it.id == id } }
+        // Drop the cached manifest too — favorite ids for nsites/napplets are "nostr:<coordinate>".
+        if (id.startsWith("nostr:")) updateManifests { it - id.removePrefix("nostr:") }
+    }
+
+    /** The cached manifest event JSON for a favorited nsite/napplet [coordinate], or null if none. */
+    fun cachedManifest(coordinate: String): String? = manifestCache.value[coordinate]
+
+    /**
+     * Caches the raw manifest event [eventJson] for a favorited nsite/napplet [coordinate] so the next
+     * launch can resolve it instantly / offline. Write-through; no-ops when the JSON is unchanged.
+     */
+    fun cacheManifest(
+        coordinate: String,
+        eventJson: String,
+    ) = updateManifests { if (it[coordinate] == eventJson) it else it + (coordinate to eventJson) }
+
+    /** Replaces the whole list, e.g. after a drag-reorder. */
+    fun setOrder(newOrder: List<FavoriteApp>) = update { newOrder }
+
+    private inline fun update(transform: (List<FavoriteApp>) -> List<FavoriteApp>) {
+        val next = transform(_favorites.value)
+        if (next == _favorites.value) return
+        _favorites.value = next
+        persist(encode(next))
+    }
+
+    private inline fun updateManifests(transform: (Map<String, String>) -> Map<String, String>) {
+        val next = transform(manifestCache.value)
+        if (next == manifestCache.value) return
+        manifestCache.value = next
+        persistManifests(encodeManifests(next))
+    }
+
+    private fun persist(json: String) {
+        val ctx = appContext ?: return
+        scope.launch {
+            ctx.favoriteAppsDataStore.edit { it[KEY] = json }
+        }
+    }
+
+    private fun persistManifests(json: String) {
+        val ctx = appContext ?: return
+        scope.launch {
+            ctx.favoriteAppsDataStore.edit { it[MANIFESTS_KEY] = json }
+        }
+    }
+
+    // --- Persistence DTO ------------------------------------------------------------------------
+    // A flat, type-tagged record so we serialize one concrete shape instead of relying on
+    // polymorphic (sealed) (de)serialization. Mapping to/from the sealed model lives here.
+
+    @Serializable
+    private data class Entry(
+        val type: String,
+        val ref: String,
+        val label: String,
+        val addedAt: Long,
+        val iconUrl: String? = null,
+    )
+
+    private fun encode(list: List<FavoriteApp>): String =
+        JsonMapper.toJson(
+            list.map {
+                when (it) {
+                    is FavoriteApp.NostrApp -> Entry(TYPE_NOSTR, it.coordinate, it.label, it.addedAt, it.iconUrl)
+                    is FavoriteApp.WebApp -> Entry(TYPE_URL, it.url, it.label, it.addedAt, it.iconUrl)
+                }
+            },
+        )
+
+    private fun decode(json: String): List<FavoriteApp> =
+        try {
+            JsonMapper.fromJson<List<Entry>>(json).mapNotNull { entry ->
+                when (entry.type) {
+                    TYPE_NOSTR -> FavoriteApp.NostrApp(entry.ref, entry.label, entry.addedAt, entry.iconUrl)
+                    TYPE_URL -> FavoriteApp.WebApp(entry.ref, entry.label, entry.addedAt, entry.iconUrl)
+                    else -> null
+                }
+            }
+        } catch (e: Exception) {
+            Log.w("FavoriteAppsRegistry", "Failed to decode favorites", e)
+            emptyList()
+        }
+
+    private const val TYPE_NOSTR = "nostr"
+    private const val TYPE_URL = "url"
+
+    // --- Manifest cache persistence -------------------------------------------------------------
+    // Stored as a flat list of (coordinate, json) records under one key — same single-key, hand-curated
+    // shape as the favorites list, so we never serialize a raw polymorphic map.
+
+    @Serializable
+    private data class ManifestEntry(
+        val coordinate: String,
+        val json: String,
+    )
+
+    private fun encodeManifests(manifests: Map<String, String>): String = JsonMapper.toJson(manifests.map { ManifestEntry(it.key, it.value) })
+
+    private fun decodeManifests(json: String): Map<String, String> =
+        try {
+            JsonMapper.fromJson<List<ManifestEntry>>(json).associate { it.coordinate to it.json }
+        } catch (e: Exception) {
+            Log.w("FavoriteAppsRegistry", "Failed to decode favorite manifests", e)
+            emptyMap()
+        }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/FavoriteNostrAppPreloader.kt

@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.favorites
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.remember
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
+import com.vitorpamplona.amethyst.commons.relayClient.subscriptions.LifecycleAwareKeyDataSourceSubscription
+import com.vitorpamplona.amethyst.model.LocalCache
+import com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderQueryState
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.AccountViewModel
+
+/**
+ * Pre-fetches the addressable events behind the user's favorited [FavoriteApp.NostrApp]s (nSites /
+ * nApplets) while a screen that can launch them is on screen.
+ *
+ * A favorite stores only the addressable coordinate `kind:pubkey:dtag`, never the event. The launch
+ * path ([FavoriteAppLauncher.launchNostrApp] / [FavoriteAppLauncher.embedParams]) re-resolves the live
+ * event from [LocalCache] at tap time, so a favorite whose event hasn't streamed in yet can't launch —
+ * the user gets the "isn't loaded yet" toast / unavailable tab. Before this preloader, the only thing
+ * that pulled those events into the cache was visiting the nsite/napplet feed (it subscribes by author),
+ * which is why opening that feed and coming back made a favorite suddenly launchable.
+ *
+ * This subscribes each favorited coordinate to the shared
+ * [EventFinder][com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.EventFinderFilterAssembler]
+ * — the same lifecycle-aware loader [observeNote][com.vitorpamplona.amethyst.service.relayClient.reqCommand.event.observeNote]
+ * uses — so the manifests fetch (via the author's outbox relays) as soon as the launcher opens and are
+ * already in [LocalCache] by the time the user taps. The loader drops each coordinate from its filter
+ * once the event arrives, so this is a one-shot fetch, not a standing feed.
+ */
+@Composable
+fun PreloadFavoriteNostrApps(
+    apps: List<FavoriteApp>,
+    accountViewModel: AccountViewModel,
+) {
+    val account = accountViewModel.account
+    // Reuse the same query-state instances across recompositions (the manager ref-counts by identity),
+    // recomputing only when the favorite list or account changes. Events that already loaded are still
+    // included; the loader simply skips them because their note already has an event.
+    val states =
+        remember(apps, account) {
+            apps
+                .filterIsInstance<FavoriteApp.NostrApp>()
+                .mapNotNull { LocalCache.checkGetOrCreateAddressableNote(it.coordinate) }
+                .map { EventFinderQueryState(it, account) }
+        }
+
+    LifecycleAwareKeyDataSourceSubscription(states, accountViewModel.dataSources().eventFinder)
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/favorites/NappletFavoriteIcon.kt

@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.favorites
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.platform.LocalContext
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.commons.browser.OmniboxInput
+import com.vitorpamplona.amethyst.model.LocalCache
+import com.vitorpamplona.amethyst.napplethost.NappletBlobCache
+import com.vitorpamplona.amethyst.napplethost.NappletBlobPrefetcher
+import com.vitorpamplona.quartz.nip01Core.core.Event
+import com.vitorpamplona.quartz.nip5aStaticWebsites.NamedSiteEvent
+import com.vitorpamplona.quartz.nip5aStaticWebsites.RootSiteEvent
+import com.vitorpamplona.quartz.nip5aStaticWebsites.tags.PathTag
+import com.vitorpamplona.quartz.nip5dNapplets.NamedNappletEvent
+import com.vitorpamplona.quartz.nip5dNapplets.RootNappletEvent
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import java.io.File
+
+/** The chosen icon blob and the servers that hold it — resolved from the live manifest. */
+private class IconBlob(
+    val path: PathTag,
+    val servers: List<String>,
+)
+
+/**
+ * A Coil model (`file://…`) for the app icon an nsite/napplet bundles in its own content — the verified,
+ * content-addressed blob the [NappletIconPath][com.vitorpamplona.quartz.nip5aStaticWebsites.NappletIconPath]
+ * heuristic picks from the manifest's `path` tags — or null when the manifest declares no such icon (or it
+ * hasn't downloaded yet). Used to decorate an nsite/napplet favorite the same way a captured favicon
+ * decorates a web favorite, except this rides the same Tor-routed, sha256-verified blob path as the rest of
+ * the site instead of a clearnet favicon fetch.
+ *
+ * Unlike a webapp's favicon, this can't be captured live: the applet runs in a cross-origin sandboxed
+ * iframe under the trusted shell, so `WebChromeClient.onReceivedIcon` only ever reports the shell's icon,
+ * never the applet's. Deriving it from the bundled blobs is the only path that sees the real icon.
+ *
+ * Observes the addressable note, so the icon resolves whenever the manifest arrives or updates in
+ * LocalCache — not only if it already happened to be cached at first composition (on a cold start the
+ * event streams in from relays a moment later). Returns null until the blob is on disk; the icon then
+ * appears on the next recomposition. All disk + network work runs off the composition thread. The blob is
+ * usually already cached (the browse/feed card prefetches every manifest blob, this one included); the
+ * on-demand fetch here just covers favorites whose card isn't currently on screen.
+ */
+@Composable
+fun rememberNappletIconModel(coordinate: String): String? {
+    val context = LocalContext.current
+
+    // checkGetOrCreate returns null only for a malformed coordinate, so this early return is stable for a
+    // given coordinate (it never flips across recompositions, which would break composition structure).
+    val note = remember(coordinate) { LocalCache.checkGetOrCreateAddressableNote(coordinate) } ?: return null
+    val noteState by note
+        .flow()
+        .metadata.stateFlow
+        .collectAsStateWithLifecycle()
+
+    // Key on the event itself, not the NoteState wrapper: re-resolve only when the manifest actually
+    // changes, not on every unrelated metadata bump (a reaction/zap tracked on the note).
+    val event = noteState.note.event
+    val icon = remember(event) { resolveIconBlob(event) } ?: return null
+
+    var model by remember(icon.path.hash) { mutableStateOf<String?>(null) }
+    LaunchedEffect(icon.path.hash) {
+        withContext(Dispatchers.IO) {
+            val file = File(NappletBlobCache.dirFor(context.cacheDir), icon.path.hash.lowercase())
+            if (!file.isFile) {
+                val torPort = Amethyst.instance.torManager.activePortOrNull.value ?: -1
+                runCatching { NappletBlobPrefetcher.prefetch(listOf(icon.path), icon.servers, context.cacheDir, torPort) }
+            }
+            if (file.isFile) model = "file://" + file.absolutePath
+        }
+    }
+    return model
+}
+
+/** Asks each nsite/napplet event type for its bundled icon blob + the servers that hold it. */
+private fun resolveIconBlob(event: Event?): IconBlob? =
+    when (event) {
+        is RootNappletEvent -> event.iconBlob()?.let { IconBlob(it, event.servers()) }
+        is NamedNappletEvent -> event.iconBlob()?.let { IconBlob(it, event.servers()) }
+        is RootSiteEvent -> event.iconBlob()?.let { IconBlob(it, event.servers()) }
+        is NamedSiteEvent -> event.iconBlob()?.let { IconBlob(it, event.servers()) }
+        else -> null
+    }
+
+/**
+ * A Coil model (`file://…`) for the cached favicon of [url]'s host, or null when no favicon
+ * has been captured yet. The favicon is stored by [BrowserIconRegistry] at browse time (the
+ * WebView captures it in the sandboxed `:napplet` process); this composable just reads the cache.
+ *
+ * Early-returns null when [url] is blank or has no parseable host — this early return is stable
+ * for a given [url] (the host either always parses or never does), so composition structure is
+ * preserved across recompositions.
+ */
+@Composable
+fun rememberWebAppIconModel(url: String): String? {
+    val host = remember(url) { OmniboxInput.hostOf(url) } ?: return null
+    val iconKeys by BrowserIconRegistry.keys.collectAsStateWithLifecycle()
+    return remember(host, iconKeys) { BrowserIconRegistry.iconModelFor(host) }
+}
+
+/**
+ * A Coil model for the bundled icon of an napplet or nsite identified by [author] and
+ * [identifier]. Tries the napplet manifest (kinds 15129 / 35129) first, then falls back to the
+ * nsite manifest (kinds 15128 / 35128). Returns null until the blob lands on disk.
+ */
+@Composable
+fun rememberManifestIconModel(
+    author: String,
+    identifier: String,
+): String? {
+    val nappletCoord =
+        remember(author, identifier) {
+            if (identifier.isEmpty()) "${RootNappletEvent.KIND}:$author:" else "${NamedNappletEvent.KIND}:$author:$identifier"
+        }
+    val nsiteCoord =
+        remember(author, identifier) {
+            if (identifier.isEmpty()) "${RootSiteEvent.KIND}:$author:" else "${NamedSiteEvent.KIND}:$author:$identifier"
+        }
+    return rememberNappletIconModel(nappletCoord) ?: rememberNappletIconModel(nsiteCoord)
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/Account.kt

@@ -57,6 +57,7 @@ import com.vitorpamplona.amethyst.model.localRelays.ForwardKind0ToLocalRelayStat
 import com.vitorpamplona.amethyst.model.localRelays.LocalRelayListState
 import com.vitorpamplona.amethyst.model.marmot.KeyPackageRelayListState
 import com.vitorpamplona.amethyst.model.nip01UserMetadata.AccountHomeRelayState
+import com.vitorpamplona.amethyst.model.nip01UserMetadata.AccountMineRelayState
 import com.vitorpamplona.amethyst.model.nip01UserMetadata.AccountOutboxRelayState
 import com.vitorpamplona.amethyst.model.nip01UserMetadata.NotificationInboxRelayState
 import com.vitorpamplona.amethyst.model.nip01UserMetadata.UserMetadataState
@@ -72,6 +73,7 @@ import com.vitorpamplona.amethyst.model.nip17Dms.DmRelayListState
 import com.vitorpamplona.amethyst.model.nip30CustomEmojis.OwnedEmojiPacksState
 import com.vitorpamplona.amethyst.model.nip47WalletConnect.NwcSignerState
 import com.vitorpamplona.amethyst.model.nip51Lists.BookmarkListState
+import com.vitorpamplona.amethyst.model.nip51Lists.GitRepositoryListState
 import com.vitorpamplona.amethyst.model.nip51Lists.HiddenUsersState
 import com.vitorpamplona.amethyst.model.nip51Lists.OldBookmarkListState
 import com.vitorpamplona.amethyst.model.nip51Lists.PinListState
@@ -397,6 +399,7 @@ class Account(
     val appRecommendations = AppRecommendationsState(signer, cache, scope)
     val oldBookmarkState = OldBookmarkListState(signer, cache, scope)
     val bookmarkState = BookmarkListState(signer, cache, scope)
+    val gitRepositoryListState = GitRepositoryListState(signer, cache, scope)
     val pinState = PinListState(signer, cache, scope)
     val emoji = EmojiPackState(signer, cache, scope)
     val ownedEmojiPacks = OwnedEmojiPacksState(signer, cache, scope)
@@ -414,6 +417,7 @@ class Account(
     // Relay settings
     val homeRelays = AccountHomeRelayState(nip65RelayList, privateStorageRelayList, localRelayList, scope)
     val outboxRelays = AccountOutboxRelayState(nip65RelayList, privateStorageRelayList, localRelayList, broadcastRelayList, scope)
+    val mineRelays = AccountMineRelayState(nip65RelayList, privateStorageRelayList, localRelayList, proxyRelayList, scope)
     val dmRelays = DmInboxRelayState(dmRelayList, nip65RelayList, privateStorageRelayList, localRelayList, scope)
     val notificationRelays = NotificationInboxRelayState(nip65RelayList, localRelayList, scope)
 
@@ -425,6 +429,8 @@ class Account(
             scope = scope,
             assembler = cashuWalletFilterAssembler(),
             outboxRelaysFlow = outboxRelays.flow,
+            inboxRelaysFlow = notificationRelays.flow,
+            dmRelaysFlow = dmRelays.flow,
             settings = settings,
             okHttpClient = okHttpClientForMoney,
         )
@@ -504,6 +510,7 @@ class Account(
             followsRelays = defaultGlobalRelays.flow,
             blockedRelays = blockedRelayList.flow,
             proxyRelays = proxyRelayList.flow,
+            mineRelays = mineRelays.flow,
             relayFeeds = relayFeedsList.flow,
             caches = feedDecryptionCaches,
             signer = signer,
@@ -532,9 +539,18 @@ class Account(
     val livePicturesFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultPicturesFollowList)
     val livePicturesFollowListsPerRelay = OutboxLoaderState(livePicturesFollowLists, cache, scope).flow
 
+    val liveNappletsFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultNappletsFollowList)
+    val liveNappletsFollowListsPerRelay = OutboxLoaderState(liveNappletsFollowLists, cache, scope).flow
+
+    val liveNsitesFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultNsitesFollowList)
+    val liveNsitesFollowListsPerRelay = OutboxLoaderState(liveNsitesFollowLists, cache, scope).flow
+
     val liveWorkoutsFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultWorkoutsFollowList)
     val liveWorkoutsFollowListsPerRelay = OutboxLoaderState(liveWorkoutsFollowLists, cache, scope).flow
 
+    val liveGitRepositoriesFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultGitRepositoriesFollowList)
+    val liveGitRepositoriesFollowListsPerRelay = OutboxLoaderState(liveGitRepositoriesFollowLists, cache, scope).flow
+
     val liveCalendarsFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultCalendarsFollowList)
     val liveCalendarsFollowListsPerRelay = OutboxLoaderState(liveCalendarsFollowLists, cache, scope).flow
 
@@ -586,6 +602,11 @@ class Account(
     val liveFollowPacksFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultFollowPacksFollowList)
     val liveFollowPacksFollowListsPerRelay = OutboxLoaderState(liveFollowPacksFollowLists, cache, scope).flow
 
+    // App recommendations are read straight from LocalCache (no relay feed of its
+    // own), so only the in-memory author/tag matcher is needed here, not a
+    // per-relay outbox loader.
+    val liveAppRecommendationsFollowLists: StateFlow<IFeedTopNavFilter> = topNavFilterFlow(settings.defaultAppRecommendationsFollowList)
+
     override fun isWriteable(): Boolean = settings.isWriteable()
 
     suspend fun updateWarnReports(warnReports: Boolean): Boolean {
@@ -2032,6 +2053,14 @@ class Account(
         extraNotesToBroadcast.forEach { client.publish(it, relays) }
     }
 
+    /**
+     * The live [AddressableNote] backing a draft tag for this account. It is the same cached
+     * note that draft events are consumed into, so its `event` tracks the draft over time. The
+     * composer holds onto it (via DraftTagState) so [LocalCache]'s weak reference can't collect
+     * it before a deletion needs it, which would otherwise orphan the draft on the relays.
+     */
+    fun getOrCreateDraftNote(draftTag: String): AddressableNote = cache.getOrCreateAddressableNote(DraftWrapEvent.createAddress(signer.pubKey, draftTag))
+
     suspend fun createAndSendDraftIgnoreErrors(
         draftTag: String,
         template: EventTemplate<out Event>,
@@ -2068,18 +2097,25 @@ class Account(
         }
     }
 
-    suspend fun deleteDraftIgnoreErrors(draftTag: String) {
+    suspend fun deleteDraftIgnoreErrors(draftNote: AddressableNote?) {
         try {
-            deleteDraftInner(draftTag)
+            deleteDraftInner(draftNote)
         } catch (e: Exception) {
             if (e is CancellationException) throw e
         }
     }
 
-    suspend fun deleteDraftInner(draftTag: String) {
+    suspend fun deleteDraftInner(draftNote: AddressableNote?) {
         if (!isWriteable()) return
 
-        val extraRelays = cache.getAddressableNoteIfExists(DraftWrapEvent.createAddressTag(signer.pubKey, draftTag))?.relays ?: emptyList()
+        // Only a real, still-present draft needs a deletion signed. The note's event is null when
+        // no draft was ever saved (e.g. auto-drafts disabled) and already empty once it has been
+        // deleted — in both cases there is nothing to delete, so we avoid prompting the signer.
+        val draftEvent = draftNote?.event as? DraftWrapEvent
+        if (draftEvent == null || draftEvent.isDeleted()) return
+
+        val draftTag = draftNote.dTag()
+        val extraRelays = draftNote.relays
 
         val deletedDraft = DraftWrapEvent.createDeletedEvent(draftTag, signer)
         val deletionEvent = signer.sign(DeletionEvent.build(listOf(deletedDraft)))
@@ -2979,6 +3015,16 @@ class Account(
         delete(note)
     }
 
+    suspend fun addGitRepositoryBookmark(note: AddressableNote) {
+        if (!isWriteable()) return
+        sendMyPublicAndPrivateOutbox(gitRepositoryListState.addRepository(note))
+    }
+
+    suspend fun removeGitRepositoryBookmark(note: AddressableNote) {
+        if (!isWriteable()) return
+        gitRepositoryListState.removeRepository(note)?.let { sendMyPublicAndPrivateOutbox(it) }
+    }
+
     suspend fun addBookmark(
         note: Note,
         isPrivate: Boolean,

amethyst/src/main/java/com/vitorpamplona/amethyst/model/AccountSettings.kt

@@ -28,6 +28,7 @@ import com.vitorpamplona.amethyst.commons.model.nip28PublicChats.PublicChatListR
 import com.vitorpamplona.amethyst.commons.model.nip47WalletConnect.NwcWalletEntryNorm
 import com.vitorpamplona.amethyst.commons.model.payments.PaymentSource
 import com.vitorpamplona.amethyst.commons.model.payments.PaymentSourceResolver
+import com.vitorpamplona.amethyst.commons.relayauth.RelayAuthPolicy
 import com.vitorpamplona.amethyst.model.nip60Cashu.CashuPreferences
 import com.vitorpamplona.amethyst.ui.actions.mediaServers.DEFAULT_MEDIA_SERVERS
 import com.vitorpamplona.amethyst.ui.actions.mediaServers.ServerName
@@ -189,7 +190,10 @@ class AccountSettings(
     val defaultDiscoveryFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultPollsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultPicturesFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
+    val defaultNappletsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
+    val defaultNsitesFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultWorkoutsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
+    val defaultGitRepositoriesFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultCalendarsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultProductsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.AroundMe),
     val defaultShortsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
@@ -207,6 +211,7 @@ class AccountSettings(
     val defaultBrowseEmojiSetsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val defaultCommunitiesFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.AllFollows),
     val defaultFollowPacksFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
+    val defaultAppRecommendationsFollowList: MutableStateFlow<TopFilter> = MutableStateFlow(TopFilter.Global),
     val nwcWallets: MutableStateFlow<List<NwcWalletEntryNorm>> = MutableStateFlow(emptyList()),
     val clinkDebitWallets: MutableStateFlow<List<ClinkDebitWalletEntryNorm>> = MutableStateFlow(emptyList()),
     // The unified default spend rail (an NWC wallet OR a CLINK debit). Persisted under a
@@ -217,6 +222,7 @@ class AccountSettings(
     var hideNIP17WarningDialog: Boolean = false,
     val alwaysOnNotificationService: MutableStateFlow<Boolean> = MutableStateFlow(false),
     val splitNotificationsEnabled: MutableStateFlow<Boolean> = MutableStateFlow(false),
+    val showMessagesInNotifications: MutableStateFlow<Boolean> = MutableStateFlow(true),
     var backupUserMetadata: MetadataEvent? = null,
     var backupContactList: ContactListEvent? = null,
     var backupDMRelayList: ChatMessageRelayListEvent? = null,
@@ -262,6 +268,7 @@ class AccountSettings(
     var callVideoResolution: CallVideoResolution = CallVideoResolution.HD_720,
     var callMaxBitrateBps: Int = 1_500_000,
     val callsEnabled: MutableStateFlow<Boolean> = MutableStateFlow(true),
+    val defaultRelayAuthPolicy: MutableStateFlow<RelayAuthPolicy> = MutableStateFlow(RelayAuthPolicy.IF_IN_MY_LIST),
 ) : EphemeralChatRepository,
     PublicChatListRepository {
     val saveable = MutableStateFlow(AccountSettingsUpdater(null))
@@ -295,6 +302,13 @@ class AccountSettings(
         return newValue
     }
 
+    fun toggleShowMessagesInNotifications(): Boolean {
+        val newValue = !showMessagesInNotifications.value
+        showMessagesInNotifications.tryEmit(newValue)
+        saveAccountSettings()
+        return newValue
+    }
+
     // ---
     // Zaps and Reactions
     // ---
@@ -631,6 +645,28 @@ class AccountSettings(
         }
     }
 
+    fun changeDefaultNappletsFollowList(name: FeedDefinition) {
+        changeDefaultNappletsFollowList(name.code)
+    }
+
+    fun changeDefaultNappletsFollowList(name: TopFilter) {
+        if (defaultNappletsFollowList.value != name) {
+            defaultNappletsFollowList.tryEmit(name)
+            saveAccountSettings()
+        }
+    }
+
+    fun changeDefaultNsitesFollowList(name: FeedDefinition) {
+        changeDefaultNsitesFollowList(name.code)
+    }
+
+    fun changeDefaultNsitesFollowList(name: TopFilter) {
+        if (defaultNsitesFollowList.value != name) {
+            defaultNsitesFollowList.tryEmit(name)
+            saveAccountSettings()
+        }
+    }
+
     fun changeDefaultWorkoutsFollowList(name: FeedDefinition) {
         changeDefaultWorkoutsFollowList(name.code)
     }
@@ -642,6 +678,17 @@ class AccountSettings(
         }
     }
 
+    fun changeDefaultGitRepositoriesFollowList(name: FeedDefinition) {
+        changeDefaultGitRepositoriesFollowList(name.code)
+    }
+
+    fun changeDefaultGitRepositoriesFollowList(name: TopFilter) {
+        if (defaultGitRepositoriesFollowList.value != name) {
+            defaultGitRepositoriesFollowList.tryEmit(name)
+            saveAccountSettings()
+        }
+    }
+
     fun changeDefaultCalendarsFollowList(name: FeedDefinition) {
         changeDefaultCalendarsFollowList(name.code)
     }
@@ -818,6 +865,17 @@ class AccountSettings(
         }
     }
 
+    fun changeDefaultAppRecommendationsFollowList(name: FeedDefinition) {
+        changeDefaultAppRecommendationsFollowList(name.code)
+    }
+
+    fun changeDefaultAppRecommendationsFollowList(name: TopFilter) {
+        if (defaultAppRecommendationsFollowList.value != name) {
+            defaultAppRecommendationsFollowList.tryEmit(name)
+            saveAccountSettings()
+        }
+    }
+
     // ---
     // language services
     // ---
@@ -1420,6 +1478,13 @@ class AccountSettings(
             saveAccountSettings()
         }
     }
+
+    fun changeDefaultRelayAuthPolicy(policy: RelayAuthPolicy) {
+        if (defaultRelayAuthPolicy.value != policy) {
+            defaultRelayAuthPolicy.tryEmit(policy)
+            saveAccountSettings()
+        }
+    }
 }
 
 @Serializable

amethyst/src/main/java/com/vitorpamplona/amethyst/model/GitPullRequestUpdateIndex.kt

@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model
+
+import com.vitorpamplona.amethyst.model.LocalCache.observeEvents
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip34Git.pr.GitPullRequestUpdateEvent
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.flowOn
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.stateIn
+
+/**
+ * Cross-screen index of the most recent NIP-34 pull-request update event
+ * (kind 1619) per parent pull-request id, kept up to date from
+ * [LocalCache.observeEvents]. A PR update *revises* its parent PR with a
+ * newer commit / merge base, so the UI folds the latest one into the PR rather
+ * than listing updates separately. Like [GitStatusIndex], updates aren't tracked
+ * in `Note.replies`, so a per-row cache scan would otherwise be required.
+ *
+ * The kind-indexed [observeEvents] re-emits the whole matching list on every new
+ * 1619 (and seeds it from the cache index via `init()`), so [latestByPullRequest]
+ * is just that list reduced to the latest-per-parent map. Shared [SharingStarted.Eagerly]
+ * — never `WhileSubscribed` — because callers read `.value` synchronously and must
+ * not see a stale map when no one is actively collecting. `null` means "not loaded yet".
+ */
+object GitPullRequestUpdateIndex {
+    private val scope = CoroutineScope(Dispatchers.IO + SupervisorJob())
+
+    val latestByPullRequest: StateFlow<Map<HexKey, GitPullRequestUpdateEvent>?> =
+        LocalCache
+            .observeEvents<GitPullRequestUpdateEvent>(Filter(kinds = listOf(GitPullRequestUpdateEvent.KIND)))
+            .map { latestByParent(it) }
+            .flowOn(Dispatchers.IO)
+            .stateIn(scope, SharingStarted.Eagerly, null)
+
+    private fun latestByParent(events: List<GitPullRequestUpdateEvent>): Map<HexKey, GitPullRequestUpdateEvent> {
+        val latest = HashMap<HexKey, GitPullRequestUpdateEvent>()
+        for (event in events) {
+            val target = event.parentPullRequestId() ?: continue
+            val current = latest[target]
+            if (current == null || event.createdAt > current.createdAt) {
+                latest[target] = event
+            }
+        }
+        return latest
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/GitStatusIndex.kt

@@ -20,66 +20,78 @@
  */
 package com.vitorpamplona.amethyst.model
 
+import com.vitorpamplona.amethyst.model.LocalCache.observeEvents
 import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusAppliedEvent
+import com.vitorpamplona.quartz.nip34Git.status.GitStatusClosedEvent
 import com.vitorpamplona.quartz.nip34Git.status.GitStatusEvent
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.SharingStarted
 import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.onStart
-import kotlinx.coroutines.launch
-import java.util.concurrent.atomic.AtomicBoolean
+import kotlinx.coroutines.flow.flowOn
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.stateIn
 
 /**
  * Cross-screen index of the most recent NIP-34 status event (kinds
  * 1630-1633) per target id, kept up to date from
- * [LocalCache.live.newEventBundles]. Status events are not tracked in
+ * [LocalCache.observeEvents]. Status events are not tracked in
  * `Note.replies` (see `LocalCache.computeReplyTo`), so the only way to
  * find them otherwise would be a full cache scan per row.
+ *
+ * The kind-indexed [observeEvents] re-emits the whole matching list on every new
+ * status event (and seeds it from the cache index via `init()`), so [latestByTarget]
+ * is just that list reduced to the latest-per-target map. Shared [SharingStarted.Eagerly]
+ * — never `WhileSubscribed` — because callers (e.g. [isClosedOrResolved] and the feed
+ * filters) read `.value` synchronously and must not see a stale map when no one is
+ * actively collecting. `null` means "not loaded yet".
  */
 object GitStatusIndex {
     private val scope = CoroutineScope(Dispatchers.IO + SupervisorJob())
-    private val started = AtomicBoolean(false)
 
-    private val mutableLatestByTarget = MutableStateFlow<Map<HexKey, GitStatusEvent>?>(null)
-    val latestByTarget: StateFlow<Map<HexKey, GitStatusEvent>?> = mutableLatestByTarget.asStateFlow()
+    private val statusKinds =
+        listOf(
+            GitStatusEvent.KIND_OPEN,
+            GitStatusEvent.KIND_APPLIED,
+            GitStatusEvent.KIND_CLOSED,
+            GitStatusEvent.KIND_DRAFT,
+        )
 
-    fun startIfNeeded() {
-        if (!started.compareAndSet(false, true)) return
-        scope.launch {
-            // Subscribe to bundle updates BEFORE the initial scan via onStart, so any
-            // events that arrive between scan start and collector attach are picked up.
-            LocalCache.live.newEventBundles
-                .onStart {
-                    val initial = HashMap<HexKey, GitStatusEvent>()
-                    LocalCache.notes.forEach { _, note ->
-                        val event = note.event as? GitStatusEvent ?: return@forEach
-                        val target = event.rootEventId() ?: return@forEach
-                        val current = initial[target]
-                        if (current == null || event.createdAt > current.createdAt) {
-                            initial[target] = event
-                        }
-                    }
-                    mutableLatestByTarget.value = initial
-                }.collect { bundle -> processBundle(bundle) }
-        }
-    }
+    val latestByTarget: StateFlow<Map<HexKey, GitStatusEvent>?> =
+        LocalCache
+            .observeEvents<GitStatusEvent>(Filter(kinds = statusKinds))
+            .map { reduceLatestByTarget(it) }
+            .flowOn(Dispatchers.IO)
+            .stateIn(scope, SharingStarted.Eagerly, null)
 
-    private fun processBundle(bundle: Set<Note>) {
-        val snapshot = mutableLatestByTarget.value ?: emptyMap()
-        var modified: HashMap<HexKey, GitStatusEvent>? = null
-        for (note in bundle) {
-            val event = note.event as? GitStatusEvent ?: continue
+    private fun reduceLatestByTarget(events: List<GitStatusEvent>): Map<HexKey, GitStatusEvent> {
+        val latest = HashMap<HexKey, GitStatusEvent>()
+        for (event in events) {
             val target = event.rootEventId() ?: continue
-            val map = modified ?: snapshot
-            val current = map[target]
+            val current = latest[target]
             if (current == null || event.createdAt > current.createdAt) {
-                if (modified == null) modified = HashMap(snapshot)
-                modified[target] = event
+                latest[target] = event
             }
         }
-        modified?.let { mutableLatestByTarget.value = it }
+        return latest
+    }
+
+    /**
+     * Whether the latest status for [targetId] marks it as closed (kind 1632)
+     * or applied/resolved/merged (kind 1631). Items with no status event, or
+     * whose latest status is open (1630) or draft (1633), are considered open.
+     *
+     * Reads from the synchronous snapshot in [latestByTarget]; pass an explicit
+     * [map] to avoid re-reading the value across a batch.
+     */
+    fun isClosedOrResolved(
+        targetId: HexKey,
+        map: Map<HexKey, GitStatusEvent>? = latestByTarget.value,
+    ): Boolean {
+        val event = map?.get(targetId) ?: return false
+        return event is GitStatusClosedEvent || event is GitStatusAppliedEvent
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/LocalCache.kt

@@ -54,11 +54,13 @@ import com.vitorpamplona.quartz.experimental.attestations.recommendation.Attesto
 import com.vitorpamplona.quartz.experimental.attestations.request.AttestationRequestEvent
 import com.vitorpamplona.quartz.experimental.audio.header.AudioHeaderEvent
 import com.vitorpamplona.quartz.experimental.audio.track.AudioTrackEvent
+import com.vitorpamplona.quartz.experimental.birdstar.BirdDetectionEvent
 import com.vitorpamplona.quartz.experimental.birdstar.BirdexEvent
 import com.vitorpamplona.quartz.experimental.edits.TextNoteModificationEvent
 import com.vitorpamplona.quartz.experimental.ephemChat.chat.EphemeralChatEvent
 import com.vitorpamplona.quartz.experimental.ephemChat.chat.RoomId
 import com.vitorpamplona.quartz.experimental.ephemChat.list.EphemeralChatListEvent
+import com.vitorpamplona.quartz.experimental.fitness.workout.ExerciseTemplateEvent
 import com.vitorpamplona.quartz.experimental.fitness.workout.WorkoutRecordEvent
 import com.vitorpamplona.quartz.experimental.interactiveStories.InteractiveStoryPrologueEvent
 import com.vitorpamplona.quartz.experimental.interactiveStories.InteractiveStoryReadingStateEvent
@@ -75,6 +77,7 @@ import com.vitorpamplona.quartz.experimental.nipsOnNostr.NipTextEvent
 import com.vitorpamplona.quartz.experimental.nns.NNSEvent
 import com.vitorpamplona.quartz.experimental.notifications.wake.WakeUpEvent
 import com.vitorpamplona.quartz.experimental.profileGallery.ProfileGalleryEntryEvent
+import com.vitorpamplona.quartz.experimental.ps1saves.Ps1SaveEvent
 import com.vitorpamplona.quartz.experimental.roadstr.confirmation.RoadEventConfirmationEvent
 import com.vitorpamplona.quartz.experimental.roadstr.report.RoadEventReportEvent
 import com.vitorpamplona.quartz.experimental.zapPolls.ZapPollEvent
@@ -220,6 +223,8 @@ import com.vitorpamplona.quartz.nip59Giftwrap.seals.SealedRumorEvent
 import com.vitorpamplona.quartz.nip59Giftwrap.wraps.GiftWrapEvent
 import com.vitorpamplona.quartz.nip5aStaticWebsites.NamedSiteEvent
 import com.vitorpamplona.quartz.nip5aStaticWebsites.RootSiteEvent
+import com.vitorpamplona.quartz.nip5dNapplets.NamedNappletEvent
+import com.vitorpamplona.quartz.nip5dNapplets.RootNappletEvent
 import com.vitorpamplona.quartz.nip60Cashu.history.CashuSpendingHistoryEvent
 import com.vitorpamplona.quartz.nip60Cashu.quote.CashuMintQuoteEvent
 import com.vitorpamplona.quartz.nip60Cashu.token.CashuTokenEvent
@@ -286,6 +291,8 @@ import com.vitorpamplona.quartz.nipF4Podcasts.authored.AuthoredPodcastsEvent
 import com.vitorpamplona.quartz.nipF4Podcasts.episode.PodcastEpisodeEvent
 import com.vitorpamplona.quartz.nipF4Podcasts.favorites.FavoritePodcastsListEvent
 import com.vitorpamplona.quartz.nipF4Podcasts.metadata.PodcastMetadataEvent
+import com.vitorpamplona.quartz.nipXXPodcasting20.episode.Podcasting20EpisodeEvent
+import com.vitorpamplona.quartz.nipXXPodcasting20.trailer.Podcasting20TrailerEvent
 import com.vitorpamplona.quartz.utils.DualCase
 import com.vitorpamplona.quartz.utils.Hex
 import com.vitorpamplona.quartz.utils.Log
@@ -3484,6 +3491,14 @@ object LocalCache : ILocalCache, ICacheProvider {
                     consumeBaseReplaceable(event, relay, wasVerified)
                 }
 
+                is BirdDetectionEvent -> {
+                    consumeRegularEvent(event, relay, wasVerified)
+                }
+
+                is Ps1SaveEvent -> {
+                    consumeBaseReplaceable(event, relay, wasVerified)
+                }
+
                 is CommentEvent -> {
                     consumeRegularEvent(event, relay, wasVerified)
                 }
@@ -3624,6 +3639,14 @@ object LocalCache : ILocalCache, ICacheProvider {
                     consumeBaseReplaceable(event, relay, wasVerified)
                 }
 
+                is RootNappletEvent -> {
+                    consumeBaseReplaceable(event, relay, wasVerified)
+                }
+
+                is NamedNappletEvent -> {
+                    consumeBaseReplaceable(event, relay, wasVerified)
+                }
+
                 is ChessGameEvent -> {
                     consumeRegularEvent(event, relay, wasVerified)
                 }
@@ -3741,7 +3764,12 @@ object LocalCache : ILocalCache, ICacheProvider {
                 }
 
                 is PodcastMetadataEvent -> {
-                    consumeBaseReplaceable(event, relay, wasVerified)
+                    // Drop the known "Mock Podcast" spam flood instead of caching thousands of them.
+                    if (event.isMockSpam()) {
+                        false
+                    } else {
+                        consumeBaseReplaceable(event, relay, wasVerified)
+                    }
                 }
 
                 is AuthoredPodcastsEvent -> {
@@ -3752,6 +3780,14 @@ object LocalCache : ILocalCache, ICacheProvider {
                     consumeBaseReplaceable(event, relay, wasVerified)
                 }
 
+                is Podcasting20EpisodeEvent -> {
+                    consumeBaseReplaceable(event, relay, wasVerified)
+                }
+
+                is Podcasting20TrailerEvent -> {
+                    consumeBaseReplaceable(event, relay, wasVerified)
+                }
+
                 is LnZapEvent -> {
                     consume(event, relay, wasVerified)
                 }
@@ -4004,6 +4040,10 @@ object LocalCache : ILocalCache, ICacheProvider {
                     consumeRegularEvent(event, relay, wasVerified)
                 }
 
+                is ExerciseTemplateEvent -> {
+                    consumeBaseReplaceable(event, relay, wasVerified)
+                }
+
                 is PaymentTargetsEvent -> {
                     consume(event, relay, wasVerified)
                 }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/UiSettings.kt

@@ -22,8 +22,8 @@ package com.vitorpamplona.amethyst.model
 
 import androidx.compose.runtime.Stable
 import com.vitorpamplona.amethyst.R
-import com.vitorpamplona.amethyst.ui.navigation.bottombars.DefaultBottomBarItems
-import com.vitorpamplona.amethyst.ui.navigation.bottombars.NavBarItem
+import com.vitorpamplona.amethyst.ui.navigation.bottombars.BottomBarEntry
+import com.vitorpamplona.amethyst.ui.navigation.bottombars.DefaultBottomBarEntries
 import kotlinx.serialization.Serializable
 
 @Stable
@@ -44,7 +44,7 @@ data class UiSettings(
     val automaticallyProposeAiImprovements: BooleanType = BooleanType.ALWAYS,
     val useTrackedBroadcasts: BooleanType = BooleanType.ALWAYS,
     val automaticallyCreateDrafts: BooleanType = BooleanType.ALWAYS,
-    val bottomBarItems: List<NavBarItem> = DefaultBottomBarItems,
+    val bottomBarItems: List<BottomBarEntry> = DefaultBottomBarEntries,
     val showHomeNewThreadsTab: Boolean = true,
     val showHomeConversationsTab: Boolean = true,
     val showHomeEverythingTab: Boolean = false,
@@ -54,6 +54,15 @@ data class UiSettings(
     val showProfileFollowersFeed: Boolean = true,
     val dontShowOnchainPublicWarning: Boolean = false,
     val suggestWorkoutsFromHealthConnect: BooleanType = BooleanType.ALWAYS,
+    val accentColor: AccentColorType = AccentColorType.PURPLE,
+    val fontFamily: FontFamilyType = FontFamilyType.SYSTEM,
+    val fontSize: FontSizeType = FontSizeType.NORMAL,
+    val composeSignature: String = "",
+    // Whether the on-chain (Bitcoin/Taproot) wallet is shown across the app: the
+    // "Bitcoin" card on the wallet screen, the on-chain chip on profiles, and the
+    // on-chain rail in the Send Payment screen. Defaults to true (shown) so the
+    // behavior is unchanged for everyone who doesn't turn it off.
+    val showOnchainWallet: Boolean = true,
 )
 
 enum class ThemeType(
@@ -73,6 +82,68 @@ fun parseThemeType(code: Int?): ThemeType =
         else -> ThemeType.SYSTEM
     }
 
+enum class AccentColorType(
+    val screenCode: Int,
+    val resourceId: Int,
+) {
+    PURPLE(0, R.string.accent_color_purple),
+    BLUE(1, R.string.accent_color_blue),
+    GREEN(2, R.string.accent_color_green),
+    ORANGE(3, R.string.accent_color_orange),
+    RED(4, R.string.accent_color_red),
+    PINK(5, R.string.accent_color_pink),
+}
+
+fun parseAccentColorType(screenCode: Int): AccentColorType =
+    when (screenCode) {
+        AccentColorType.PURPLE.screenCode -> AccentColorType.PURPLE
+        AccentColorType.BLUE.screenCode -> AccentColorType.BLUE
+        AccentColorType.GREEN.screenCode -> AccentColorType.GREEN
+        AccentColorType.ORANGE.screenCode -> AccentColorType.ORANGE
+        AccentColorType.RED.screenCode -> AccentColorType.RED
+        AccentColorType.PINK.screenCode -> AccentColorType.PINK
+        else -> AccentColorType.PURPLE
+    }
+
+enum class FontFamilyType(
+    val screenCode: Int,
+    val resourceId: Int,
+) {
+    SYSTEM(0, R.string.font_family_system),
+    SANS_SERIF(1, R.string.font_family_sans_serif),
+    SERIF(2, R.string.font_family_serif),
+    MONOSPACE(3, R.string.font_family_monospace),
+}
+
+fun parseFontFamilyType(screenCode: Int): FontFamilyType =
+    when (screenCode) {
+        FontFamilyType.SYSTEM.screenCode -> FontFamilyType.SYSTEM
+        FontFamilyType.SANS_SERIF.screenCode -> FontFamilyType.SANS_SERIF
+        FontFamilyType.SERIF.screenCode -> FontFamilyType.SERIF
+        FontFamilyType.MONOSPACE.screenCode -> FontFamilyType.MONOSPACE
+        else -> FontFamilyType.SYSTEM
+    }
+
+enum class FontSizeType(
+    val scale: Float,
+    val screenCode: Int,
+    val resourceId: Int,
+) {
+    SMALL(0.85f, 0, R.string.font_size_small),
+    NORMAL(1.0f, 1, R.string.font_size_normal),
+    LARGE(1.15f, 2, R.string.font_size_large),
+    HUGE(1.3f, 3, R.string.font_size_huge),
+}
+
+fun parseFontSizeType(screenCode: Int): FontSizeType =
+    when (screenCode) {
+        FontSizeType.SMALL.screenCode -> FontSizeType.SMALL
+        FontSizeType.NORMAL.screenCode -> FontSizeType.NORMAL
+        FontSizeType.LARGE.screenCode -> FontSizeType.LARGE
+        FontSizeType.HUGE.screenCode -> FontSizeType.HUGE
+        else -> FontSizeType.NORMAL
+    }
+
 enum class ConnectivityType(
     val prefCode: Boolean?,
     val screenCode: Int,

amethyst/src/main/java/com/vitorpamplona/amethyst/model/UiSettingsFlow.kt

@@ -21,8 +21,8 @@
 package com.vitorpamplona.amethyst.model
 
 import androidx.compose.runtime.Stable
-import com.vitorpamplona.amethyst.ui.navigation.bottombars.DefaultBottomBarItems
-import com.vitorpamplona.amethyst.ui.navigation.bottombars.NavBarItem
+import com.vitorpamplona.amethyst.ui.navigation.bottombars.BottomBarEntry
+import com.vitorpamplona.amethyst.ui.navigation.bottombars.DefaultBottomBarEntries
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.combine
@@ -44,7 +44,7 @@ class UiSettingsFlow(
     val automaticallyProposeAiImprovements: MutableStateFlow<BooleanType> = MutableStateFlow(BooleanType.ALWAYS),
     val useTrackedBroadcasts: MutableStateFlow<BooleanType> = MutableStateFlow(BooleanType.ALWAYS),
     val automaticallyCreateDrafts: MutableStateFlow<BooleanType> = MutableStateFlow(BooleanType.ALWAYS),
-    val bottomBarItems: MutableStateFlow<List<NavBarItem>> = MutableStateFlow(DefaultBottomBarItems),
+    val bottomBarItems: MutableStateFlow<List<BottomBarEntry>> = MutableStateFlow(DefaultBottomBarEntries),
     val showHomeNewThreadsTab: MutableStateFlow<Boolean> = MutableStateFlow(true),
     val showHomeConversationsTab: MutableStateFlow<Boolean> = MutableStateFlow(true),
     val showHomeEverythingTab: MutableStateFlow<Boolean> = MutableStateFlow(false),
@@ -54,6 +54,11 @@ class UiSettingsFlow(
     val showProfileFollowersFeed: MutableStateFlow<Boolean> = MutableStateFlow(true),
     val dontShowOnchainPublicWarning: MutableStateFlow<Boolean> = MutableStateFlow(false),
     val suggestWorkoutsFromHealthConnect: MutableStateFlow<BooleanType> = MutableStateFlow(BooleanType.ALWAYS),
+    val accentColor: MutableStateFlow<AccentColorType> = MutableStateFlow(AccentColorType.PURPLE),
+    val fontFamily: MutableStateFlow<FontFamilyType> = MutableStateFlow(FontFamilyType.SYSTEM),
+    val fontSize: MutableStateFlow<FontSizeType> = MutableStateFlow(FontSizeType.NORMAL),
+    val composeSignature: MutableStateFlow<String> = MutableStateFlow(""),
+    val showOnchainWallet: MutableStateFlow<Boolean> = MutableStateFlow(true),
 ) {
     val listOfFlows: List<Flow<Any?>> =
         listOf<Flow<Any?>>(
@@ -82,6 +87,11 @@ class UiSettingsFlow(
             showProfileFollowersFeed,
             dontShowOnchainPublicWarning,
             suggestWorkoutsFromHealthConnect,
+            accentColor,
+            fontFamily,
+            fontSize,
+            composeSignature,
+            showOnchainWallet,
         )
 
     // emits at every change in any of the propertyes.
@@ -104,7 +114,7 @@ class UiSettingsFlow(
                 flows[12] as BooleanType,
                 flows[13] as BooleanType,
                 flows[14] as BooleanType,
-                flows[15] as List<NavBarItem>,
+                flows[15] as List<BottomBarEntry>,
                 flows[16] as Boolean,
                 flows[17] as Boolean,
                 flows[18] as Boolean,
@@ -114,6 +124,11 @@ class UiSettingsFlow(
                 flows[22] as Boolean,
                 flows[23] as Boolean,
                 flows[24] as BooleanType,
+                flows[25] as AccentColorType,
+                flows[26] as FontFamilyType,
+                flows[27] as FontSizeType,
+                flows[28] as String,
+                flows[29] as Boolean,
             )
         }
 
@@ -144,6 +159,11 @@ class UiSettingsFlow(
             showProfileFollowersFeed.value,
             dontShowOnchainPublicWarning.value,
             suggestWorkoutsFromHealthConnect.value,
+            accentColor.value,
+            fontFamily.value,
+            fontSize.value,
+            composeSignature.value,
+            showOnchainWallet.value,
         )
 
     fun update(torSettings: UiSettings): Boolean {
@@ -249,6 +269,26 @@ class UiSettingsFlow(
             suggestWorkoutsFromHealthConnect.tryEmit(torSettings.suggestWorkoutsFromHealthConnect)
             any = true
         }
+        if (accentColor.value != torSettings.accentColor) {
+            accentColor.tryEmit(torSettings.accentColor)
+            any = true
+        }
+        if (fontFamily.value != torSettings.fontFamily) {
+            fontFamily.tryEmit(torSettings.fontFamily)
+            any = true
+        }
+        if (fontSize.value != torSettings.fontSize) {
+            fontSize.tryEmit(torSettings.fontSize)
+            any = true
+        }
+        if (composeSignature.value != torSettings.composeSignature) {
+            composeSignature.tryEmit(torSettings.composeSignature)
+            any = true
+        }
+        if (showOnchainWallet.value != torSettings.showOnchainWallet) {
+            showOnchainWallet.tryEmit(torSettings.showOnchainWallet)
+            any = true
+        }
 
         return any
     }
@@ -299,6 +339,11 @@ class UiSettingsFlow(
                 MutableStateFlow(uiSettings.showProfileFollowersFeed),
                 MutableStateFlow(uiSettings.dontShowOnchainPublicWarning),
                 MutableStateFlow(uiSettings.suggestWorkoutsFromHealthConnect),
+                MutableStateFlow(uiSettings.accentColor),
+                MutableStateFlow(uiSettings.fontFamily),
+                MutableStateFlow(uiSettings.fontSize),
+                MutableStateFlow(uiSettings.composeSignature),
+                MutableStateFlow(uiSettings.showOnchainWallet),
             )
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/UrlCachedPreviewer.kt

@@ -23,7 +23,7 @@ package com.vitorpamplona.amethyst.model
 import android.util.LruCache
 import androidx.compose.runtime.Stable
 import com.vitorpamplona.amethyst.commons.preview.UrlPreview
-import com.vitorpamplona.amethyst.ui.components.UrlPreviewState
+import com.vitorpamplona.amethyst.commons.ui.components.UrlPreviewState
 import okhttp3.OkHttpClient
 
 @Stable

amethyst/src/main/java/com/vitorpamplona/amethyst/model/accountsCache/AccountCacheState.kt

@@ -108,6 +108,39 @@ class AccountCacheState(
         }
     }
 
+    /** The on-disk root that [loadAccount] creates a per-account directory under. */
+    private fun accountsRootDir() = File(rootFilesDir(), "accounts")
+
+    /**
+     * Deletes the on-disk per-account directory (the MLS/Marmot stores created in
+     * [loadAccount]). Call only on permanent account deletion — [removeAccount] just
+     * drops the in-memory copy and leaves these files behind.
+     */
+    fun deleteAccountFiles(pubkey: HexKey) {
+        val dir = File(accountsRootDir(), pubkey)
+        if (dir.exists() && !dir.deleteRecursively()) {
+            Log.w("AccountCacheState", "Failed to delete account directory ${dir.absolutePath}")
+        }
+    }
+
+    /**
+     * Removes per-account directories left behind by accounts that are no longer saved
+     * (e.g. deleted before [deleteAccountFiles] existed). Keeps only [keepPubkeys]. Safe to
+     * run alongside [loadAccount]: it only loads saved accounts, whose pubkeys are kept.
+     */
+    fun pruneOrphanAccountDirs(keepPubkeys: Set<HexKey>) {
+        val children = accountsRootDir().listFiles() ?: return
+        children.forEach { child ->
+            if (child.isDirectory && child.name !in keepPubkeys) {
+                if (child.deleteRecursively()) {
+                    Log.d("AccountCacheState") { "Pruned orphan account dir ${child.name.take(8)}…" }
+                } else {
+                    Log.w("AccountCacheState", "Failed to prune orphan account dir ${child.absolutePath}")
+                }
+            }
+        }
+    }
+
     fun loadAccount(accountSettings: AccountSettings): Account =
         loadAccount(
             signer =

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip01UserMetadata/AccountMineRelayState.kt

@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.nip01UserMetadata
+
+import com.vitorpamplona.amethyst.model.edits.PrivateStorageRelayListState
+import com.vitorpamplona.amethyst.model.localRelays.LocalRelayListState
+import com.vitorpamplona.amethyst.model.nip51Lists.proxyRelays.ProxyRelayListState
+import com.vitorpamplona.amethyst.model.nip65RelayList.Nip65RelayListState
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.flowOn
+import kotlinx.coroutines.flow.stateIn
+
+/**
+ * The set of relays to read the user's *own* events from for the "Mine" top-nav selection:
+ * the user's NIP-65 outbox, their private-storage relays, their local relays and their proxy
+ * relays. Deliberately mirrors [AccountOutboxRelayState] **minus broadcast**: broadcast relays are
+ * write-only blast targets, so reading the user's own content back from them is wrong — they don't
+ * serve reads and would only waste a subscription.
+ */
+class AccountMineRelayState(
+    nip65: Nip65RelayListState,
+    privateStorage: PrivateStorageRelayListState,
+    local: LocalRelayListState,
+    proxy: ProxyRelayListState,
+    scope: CoroutineScope,
+) {
+    val flow =
+        combine(
+            nip65.outboxFlow,
+            privateStorage.flow,
+            local.flow,
+            proxy.flow,
+        ) { nip65Outbox, privateOutBox, localRelays, proxyRelays ->
+            nip65Outbox + privateOutBox + localRelays + proxyRelays
+        }.flowOn(Dispatchers.IO)
+            .stateIn(
+                scope,
+                SharingStarted.Eagerly,
+                nip65.outboxFlow.value +
+                    privateStorage.flow.value +
+                    local.flow.value +
+                    proxy.flow.value,
+            )
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip11RelayInfo/Nip11CachedRetriever.kt

@@ -36,6 +36,12 @@ class Nip11CachedRetriever(
     private val relayInformationDocumentCache = LruCache<NormalizedRelayUrl, RetrieveResult?>(1000)
     private val retriever = Nip11Retriever(okHttpClient)
 
+    fun trimToSize(maxItems: Int) {
+        relayInformationDocumentCache.trimToSize(maxItems)
+        // relayInformationEmptyCache holds only lightweight display-name+favicon-url placeholders;
+        // trimming it saves negligible memory but forces redundant NIP-11 HTTP fetches on resume.
+    }
+
     fun getEmpty(relay: NormalizedRelayUrl): Nip11RelayInformation {
         relayInformationEmptyCache.get(relay)?.let { return it }
 

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/BookmarkListState.kt

@@ -23,3 +23,5 @@ package com.vitorpamplona.amethyst.model.nip51Lists
 typealias BookmarkListState = com.vitorpamplona.amethyst.commons.model.nip51Lists.BookmarkListState
 
 typealias OldBookmarkListState = com.vitorpamplona.amethyst.commons.model.nip51Lists.OldBookmarkListState
+
+typealias GitRepositoryListState = com.vitorpamplona.amethyst.commons.model.nip51Lists.GitRepositoryListState

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip51Lists/trustedRelays/TrustedRelayListState.kt

@@ -68,7 +68,8 @@ class TrustedRelayListState(
             .stateIn(
                 scope,
                 SharingStarted.Eagerly,
-                emptySet(),
+                // Synchronously seed public tags from the backup; private tags may be absent on first boot.
+                settings.backupTrustedRelayList?.let { decryptionCache.cachedRelays(it) } ?: emptySet(),
             )
 
     suspend fun saveRelayList(trustedRelays: List<NormalizedRelayUrl>): TrustedRelayListEvent {

amethyst/src/main/java/com/vitorpamplona/amethyst/model/nip60Cashu/CashuWalletState.kt

@@ -20,6 +20,14 @@
  */
 package com.vitorpamplona.amethyst.model.nip60Cashu
 
+import com.vitorpamplona.amethyst.commons.cashu.CashuWalletReader
+import com.vitorpamplona.amethyst.commons.cashu.ops.CashuWalletOps
+import com.vitorpamplona.amethyst.commons.cashu.ops.MeltCompleted
+import com.vitorpamplona.amethyst.commons.cashu.ops.NutzapSent
+import com.vitorpamplona.amethyst.commons.cashu.ops.RestoreOutcome
+import com.vitorpamplona.amethyst.commons.cashu.ops.SendTokenCompleted
+import com.vitorpamplona.amethyst.commons.cashu.ops.TokenEntry
+import com.vitorpamplona.amethyst.commons.cashu.ops.describeMintError
 import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletFilterAssembler
 import com.vitorpamplona.amethyst.commons.relayClient.assemblers.CashuWalletQueryState
 import com.vitorpamplona.amethyst.model.AccountSettings
@@ -35,7 +43,6 @@ import com.vitorpamplona.quartz.nip09Deletions.DeletionEvent
 import com.vitorpamplona.quartz.nip60Cashu.history.CashuSpendingHistoryEvent
 import com.vitorpamplona.quartz.nip60Cashu.mintApi.DeterministicSecretFactory
 import com.vitorpamplona.quartz.nip60Cashu.mintApi.MeltQuoteBolt11ResponseDto
-import com.vitorpamplona.quartz.nip60Cashu.mintApi.ProofState
 import com.vitorpamplona.quartz.nip60Cashu.quote.CashuMintQuoteEvent
 import com.vitorpamplona.quartz.nip60Cashu.seed.CashuDeterministic
 import com.vitorpamplona.quartz.nip60Cashu.token.CashuTokenEvent
@@ -45,7 +52,6 @@ import com.vitorpamplona.quartz.nip61Nutzaps.info.NutzapInfoEvent
 import com.vitorpamplona.quartz.nip61Nutzaps.nutzap.NutzapEvent
 import com.vitorpamplona.quartz.nip87Ecash.recommendation.MintRecommendationEvent
 import com.vitorpamplona.quartz.utils.Log
-import com.vitorpamplona.quartz.utils.TimeUtils
 import com.vitorpamplona.quartz.utils.secp256k1.Secp256k1
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
@@ -97,6 +103,8 @@ class CashuWalletState(
     private val scope: CoroutineScope,
     private val assembler: CashuWalletFilterAssembler,
     private val outboxRelaysFlow: StateFlow<Set<NormalizedRelayUrl>>,
+    private val inboxRelaysFlow: StateFlow<Set<NormalizedRelayUrl>>,
+    private val dmRelaysFlow: StateFlow<Set<NormalizedRelayUrl>>,
     private val settings: AccountSettings,
     okHttpClient: (String) -> OkHttpClient,
 ) {
@@ -436,12 +444,31 @@ class CashuWalletState(
             triggerAutoRedeem()
         }
 
-        // Keep the relay subscription in sync with the outbox set.
+        // Keep the wallet subscription in sync with the relay sets it reads
+        // from. Following the NIP-65 outbox model, the two halves of the
+        // subscription read from different places:
+        //  - our own NIP-60 events (wallet/token/history) are read back from
+        //    our OUTBOX relays, where we published them;
+        //  - inbound kind:9321 nutzaps are read from our INBOX set, since
+        //    that is where other people deliver them. Per NIP-61 the source
+        //    of truth for "where to send me nutzaps" is the `relay` tags in
+        //    our own kind:10019 — and another client may have published that
+        //    with relays unrelated to our NIP-65 lists — so we listen on the
+        //    union of those plus our NIP-65 inbox + DM relays.
         jobs +=
             scope.launch(Dispatchers.IO) {
-                outboxRelaysFlow.collect { relays ->
-                    syncSubscription(relays)
-                }
+                combine(
+                    outboxRelaysFlow,
+                    inboxRelaysFlow,
+                    dmRelaysFlow,
+                    _nutzapInfoEvent,
+                ) { outbox, inbox, dm, info ->
+                    CashuWalletQueryState(
+                        pubkey = pubKey,
+                        ownEventRelays = outbox,
+                        inboxRelays = inbox + dm + (info?.relays() ?: emptyList()),
+                    )
+                }.collect { syncSubscription(it) }
             }
 
         // Reactive incremental update: any new event arrival that matches our
@@ -504,17 +531,16 @@ class CashuWalletState(
     // ============================================================
     // Subscription management
     // ============================================================
-    private fun syncSubscription(relays: Set<NormalizedRelayUrl>) {
+    private fun syncSubscription(next: CashuWalletQueryState) {
         val previous = currentSubscription
-        if (relays.isEmpty()) {
+        if (next.ownEventRelays.isEmpty() && next.inboxRelays.isEmpty()) {
             previous?.let { runCatching { assembler.unsubscribe(it) } }
             currentSubscription = null
             return
         }
-        if (previous != null && previous.relays == relays) return // unchanged
+        if (previous == next) return // unchanged
 
         previous?.let { runCatching { assembler.unsubscribe(it) } }
-        val next = CashuWalletQueryState(pubKey, relays)
         currentSubscription = next
         assembler.subscribe(next)
     }
@@ -712,44 +738,13 @@ class CashuWalletState(
             }
         }
 
-        // Apply `del` rollover.
-        val deletedIds = mutableSetOf<HexKey>()
-        all.forEach { evt -> tokenContents[evt.id]?.del?.let(deletedIds::addAll) }
-
-        val unspent =
-            all
-                .filter { it.id !in deletedIds && tokenContents.containsKey(it.id) }
-                .mapNotNull { evt -> tokenContents[evt.id]?.let { TokenEntry(evt, it) } }
-                .sortedByDescending { it.event.createdAt }
-
-        _tokenEntries.value = unspent
+        // Shared del-rollover + sort with the headless reader.
+        _tokenEntries.value = CashuWalletReader.computeUnspent(all, tokenContents)
     }
 
     private fun recomputePending() {
-        val now = TimeUtils.now()
-        // A quote is "pending" if (1) not expired, and (2) no kind:7376 history
-        // event references its id with a "destroyed" marker — completion of the
-        // mint flow deletes the kind:7374, and history records a `destroyed`
-        // reference to the now-fulfilled quote.
-        val destroyedQuoteIds =
-            historyEvents.values
-                .asSequence()
-                .flatMap { it.tags.asSequence() }
-                .filter { it.size >= 4 && it[0] == "e" && it[3] == "destroyed" }
-                .map { it[1] }
-                .toSet()
-
-        _pendingQuotes.value =
-            quoteEvents.values
-                .filter { it.id !in destroyedQuoteIds }
-                .filter { evt ->
-                    val exp =
-                        evt.tags
-                            .firstOrNull { it.size >= 2 && it[0] == "expiration" }
-                            ?.get(1)
-                            ?.toLongOrNull()
-                    exp == null || exp > now
-                }.sortedByDescending { it.createdAt }
+        // Shared destroyed/expired filter with the headless reader.
+        _pendingQuotes.value = CashuWalletReader.computePending(quoteEvents.values, historyEvents.values)
     }
 
     private fun scanCacheForOwnEvents(): List<Event> {
@@ -875,7 +870,11 @@ class CashuWalletState(
         ops.publishWalletEvents(
             mints = currentMints,
             p2pkPrivkeyHex = manualPrivkeyHex?.takeIf { it.isNotBlank() },
-            nutzapRelays = outboxRelaysFlow.value.toList(),
+            // Advertise our NIP-65 inbox relays as the nutzap relays (NIP-65
+            // outbox model): senders publish kind:9321 where we read inbound
+            // events. We listen on a wider set (inbox + DM + these tags), but
+            // the kind:10019 default copies the inbox relay list, not outbox.
+            nutzapRelays = inboxRelaysFlow.value.toList(),
         )
         // The NUT-13 seed (derived from the P2PK key) is invalidated by
         // applyEvents when the new kind:17375 round-trips in, so it re-derives
@@ -1040,6 +1039,161 @@ class CashuWalletState(
         return outcome
     }
 
+    // ============================================================
+    // Find-my-wallet wizard support (cross-relay discovery)
+    // ============================================================
+
+    /**
+     * Decrypt a discovered kind:17375 (possibly authored by another client,
+     * pulled in by [com.vitorpamplona.amethyst.ui.screen.loggedIn.wallet.wizard.CashuWalletDiscovery])
+     * into its mint list + wallet P2PK private key. Returns null if the
+     * content can't be decrypted (not really ours / signer rejected).
+     */
+    suspend fun decryptDiscoveredWallet(event: CashuWalletEvent): DiscoveredWalletConfig? =
+        runCatching {
+            DiscoveredWalletConfig(
+                mints = event.mints(signer),
+                privkeyHex = event.privkey(signer),
+            )
+        }.onFailure {
+            Log.w("CashuWallet") { "Failed to decrypt discovered wallet ${event.id.take(8)}: ${it.message}" }
+        }.getOrNull()
+
+    /**
+     * Read-only probe of how much ecash is recoverable from a wallet's
+     * NUT-13 seed, per mint, WITHOUT publishing anything. Drives the
+     * wizard's "structural + balance" verification of each discovered
+     * wallet — including OLD/duplicate wallets whose [privkeyHex] differs
+     * from the main wallet's. Mints that error (unreachable, no funds) are
+     * simply absent from the result. Secrets already held by the main
+     * wallet are excluded so the figure reflects *new* recoverable funds.
+     */
+    suspend fun probeRecoverableFromSeed(
+        privkeyHex: String,
+        mints: List<String>,
+    ): Map<String, Long> {
+        check(started) { NOT_STARTED_MESSAGE }
+        val seed = CashuDeterministic.deriveWalletSeed(privkeyHex.hexToByteArray())
+        val existingSecrets =
+            _tokenEntries.value
+                .flatMap { it.content.proofs }
+                .mapTo(HashSet()) { it.secret }
+        val result = LinkedHashMap<String, Long>()
+        for (mint in mints) {
+            val recoverable =
+                runCatching { ops.scanRecoverableProofs(mint, seed, existingSecrets = existingSecrets) }
+                    .onFailure { Log.w("CashuWallet") { "Probe of $mint failed: ${describeMintError(it)}" } }
+                    .getOrNull() ?: continue
+            if (!recoverable.isEmpty) result[mint] = recoverable.amountSats
+        }
+        return result
+    }
+
+    /**
+     * Recover every spendable proof derivable from [privkeyHex]'s NUT-13
+     * seed at [mints] into the **current** wallet: each mint is re-scanned
+     * (NUT-09 + NUT-07) and its UNSPENT proofs are published as fresh
+     * kind:7375 owned by this account. Funds locked to an OLD wallet's key
+     * thus land in the main wallet as bearer proofs (surfacing as a
+     * configured- or unconfigured-mint balance the user can then move).
+     *
+     * [bumpCounter] advances this wallet's persistent NUT-13 counter past the
+     * recovered slots — correct ONLY when [privkeyHex] is the **main** wallet's
+     * own key (the wizard adopting a discovered wallet's own balance). For a
+     * FOREIGN old/duplicate wallet it must stay false: the foreign seed's slots
+     * are unrelated to the main seed's, so bumping would corrupt the main
+     * wallet's counter (see [CashuWalletOps.publishRecoveredProofs]).
+     *
+     * Returns the total sats recovered across all mints.
+     */
+    suspend fun recoverFromSeed(
+        privkeyHex: String,
+        mints: List<String>,
+        bumpCounter: Boolean = false,
+    ): Long {
+        check(started) { NOT_STARTED_MESSAGE }
+        val seed = CashuDeterministic.deriveWalletSeed(privkeyHex.hexToByteArray())
+        var total = 0L
+        for (mint in mints) {
+            // existingSecrets is re-read per mint so a proof published while
+            // recovering an earlier mint isn't double-counted here.
+            val existingSecrets =
+                _tokenEntries.value
+                    .flatMap { it.content.proofs }
+                    .mapTo(HashSet()) { it.secret }
+            val outcome =
+                runCatching {
+                    val recoverable = ops.scanRecoverableProofs(mint, seed, existingSecrets = existingSecrets)
+                    val published = ops.publishRecoveredProofs(recoverable)
+                    if (bumpCounter) {
+                        // Advance past EVERY slot the mint signed, even when all
+                        // recovered proofs were already spent (recoverable.proofs
+                        // empty after the NUT-07 filter). nextCounterAfterScan is
+                        // set from the pre-checkstate scan, so the delta still
+                        // covers those slots — without this a fully-spent adopt on
+                        // a fresh device would leave the counter at 0 and the next
+                        // mint would reuse an already-signed slot (unspendable).
+                        val current = settings.peekCashuCounter(recoverable.keysetId)
+                        val delta = (recoverable.nextCounterAfterScan - current).coerceAtLeast(0L)
+                        if (delta > 0) settings.reserveCashuCounters(recoverable.keysetId, delta.toInt())
+                    }
+                    published
+                }.onFailure { Log.w("CashuWallet") { "Recover from $mint failed: ${describeMintError(it)}" } }
+                    .getOrNull() ?: continue
+            total += outcome.amountRecoveredSats
+        }
+        return total
+    }
+
+    /**
+     * Adopt a discovered wallet as the account's live + main wallet by
+     * **re-signing a fresh** kind:17375 + kind:10019 with the discovered
+     * wallet's own mints and P2PK key.
+     *
+     * We deliberately do NOT rebroadcast the discovered event verbatim. The
+     * crawl may surface a wallet the user already DELETED: the user's own
+     * NIP-09 kind:5 (from [CashuWalletOps.deleteWallet]) carries both an `e`
+     * tag (the old event id) and an `a` tag (the replaceable `17375:pubkey:`
+     * address). Re-publishing the same event loses on both — relays that
+     * honored the deletion reject the duplicate id, and the `a`-tag rule
+     * re-deletes any version with `created_at <= deletion.created_at` the
+     * moment the kind:5 propagates back (on relays and in our own LocalCache).
+     *
+     * A freshly-signed event sidesteps both: a new id isn't covered by the
+     * `e` tag, and `created_at = now` is newer than the past deletion so it
+     * survives the `a`-tag rule. Same key + mints means the same nutzap
+     * address and the same recoverable funds (the NUT-13 seed is derived from
+     * the key, independent of the event id). [nutzapInfo] is unused in this
+     * path — publishWalletEvents re-issues a fresh kind:10019 advertising our
+     * current inbox relays — but is kept for the decrypt-failure fallback.
+     */
+    suspend fun adoptDiscoveredWallet(
+        wallet: CashuWalletEvent,
+        nutzapInfo: NutzapInfoEvent? = null,
+    ) {
+        check(started) { NOT_STARTED_MESSAGE }
+        val config = decryptDiscoveredWallet(wallet)
+        if (config != null && config.mints.isNotEmpty()) {
+            ops.publishWalletEvents(
+                mints = config.mints,
+                p2pkPrivkeyHex = config.privkeyHex,
+                nutzapRelays = inboxRelaysFlow.value.toList(),
+            )
+        } else {
+            // Couldn't decrypt (shouldn't happen for a wallet the wizard
+            // surfaced as valid) — fall back to rebroadcasting the raw event so
+            // it's at least findable. This keeps the original id/created_at and
+            // so remains vulnerable to a prior deletion, but it's the best we
+            // can do without the plaintext to re-sign from.
+            LocalCache.justConsumeMyOwnEvent(wallet)
+            publishEvent(wallet)
+            if (nutzapInfo != null) {
+                LocalCache.justConsumeMyOwnEvent(nutzapInfo)
+                publishEvent(nutzapInfo)
+            }
+        }
+    }
+
     /**
      * Scan held kind:7375 events for accidental duplicates and NIP-09
      * delete the redundant ones. An event B is redundant when there
@@ -1142,38 +1296,21 @@ class CashuWalletState(
                 .groupBy { it.content.mint }
                 .filterKeys { mintUrlFilter == null || it == mintUrlFilter }
         for ((mintUrl, entries) in byMint) {
-            val allProofs = entries.flatMap { it.content.proofs }
-            if (allProofs.isEmpty()) continue
-            val states =
-                runCatching { ops.checkProofStates(mintUrl, allProofs) }
+            // Shared NUT-07 check + NIP-09 delete with amy's `cashu maintenance
+            // scrub`. Returns the stale token events it published a deletion for.
+            val staleEvents =
+                runCatching { ops.scrubStaleProofs(mintUrl, entries) }
                     .onFailure {
-                        Log.w("CashuWallet", "checkProofStates($mintUrl) failed; skipping sweep", it)
+                        Log.w("CashuWallet", "scrubStaleProofs($mintUrl) failed; skipping sweep", it)
                     }.getOrNull()
                     ?: continue
-
-            // Any entry with at least one SPENT proof gets purged. Keeping
-            // mixed-state entries around would let the next send pick them
-            // and trip the same HTTP 400 we're trying to prevent.
-            val staleEntries =
-                entries.filter { entry ->
-                    entry.content.proofs.any { states[it.secret] == ProofState.SPENT }
-                }
-            if (staleEntries.isEmpty()) continue
+            if (staleEvents.isEmpty()) continue
             Log.i("CashuWallet") {
-                "Scrubbing ${staleEntries.size} stale kind:7375 event(s) at $mintUrl"
+                "Scrubbing ${staleEvents.size} stale kind:7375 event(s) at $mintUrl"
             }
-            val staleIds = staleEntries.map { it.event.id }.toSet()
-            runCatching {
-                val template = DeletionEvent.build(staleEntries.map { it.event })
-                val signed = signer.sign(template)
-                publishEvent(signed)
-            }.onFailure {
-                Log.w("CashuWallet", "Failed to NIP-09 delete stale entries for $mintUrl", it)
-            }
-            // Drop from internal indexes regardless of publish success — even
-            // if the kind:5 didn't go out, we know these proofs are unusable
-            // and shouldn't be selected for the next swap.
-            removeEvents(staleIds)
+            // Drop from internal indexes — even if the kind:5 didn't reach a
+            // relay, these proofs are unusable and must not be re-selected.
+            removeEvents(staleEvents.map { it.id }.toSet())
         }
     }
 
@@ -1453,6 +1590,15 @@ class CashuWalletState(
     }
 }
 
+/**
+ * Decrypted config of a discovered kind:17375 — its configured [mints] and
+ * wallet P2PK private key. See [CashuWalletState.decryptDiscoveredWallet].
+ */
+data class DiscoveredWalletConfig(
+    val mints: List<String>,
+    val privkeyHex: String?,
+)
+
 /** Mint + recipient pubkey resolved from a kind:10019. */
 data class NutzapTarget(
     val mintUrl: String,

amethyst/src/main/java/com/vitorpamplona/amethyst/model/preferences/UISharedPreferences.kt

@@ -31,15 +31,20 @@ import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringPreferencesKey
 import androidx.datastore.preferences.preferencesDataStore
 import com.vitorpamplona.amethyst.LocalPreferences
+import com.vitorpamplona.amethyst.model.AccentColorType
 import com.vitorpamplona.amethyst.model.BooleanType
 import com.vitorpamplona.amethyst.model.ConnectivityType
 import com.vitorpamplona.amethyst.model.FeatureSetType
+import com.vitorpamplona.amethyst.model.FontFamilyType
+import com.vitorpamplona.amethyst.model.FontSizeType
 import com.vitorpamplona.amethyst.model.ProfileGalleryType
 import com.vitorpamplona.amethyst.model.ThemeType
 import com.vitorpamplona.amethyst.model.UiSettings
 import com.vitorpamplona.amethyst.model.UiSettingsFlow
-import com.vitorpamplona.amethyst.ui.navigation.bottombars.DefaultBottomBarItems
+import com.vitorpamplona.amethyst.ui.navigation.bottombars.BottomBarEntry
+import com.vitorpamplona.amethyst.ui.navigation.bottombars.DefaultBottomBarEntries
 import com.vitorpamplona.amethyst.ui.navigation.bottombars.NavBarItem
+import com.vitorpamplona.quartz.nip01Core.core.JsonMapper
 import com.vitorpamplona.quartz.utils.Log
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
@@ -118,6 +123,11 @@ class UiSharedPreferences(
         val UI_SHOW_PROFILE_FOLLOWERS_FEED = booleanPreferencesKey("ui.show_profile_followers_feed")
         val UI_DONT_SHOW_ONCHAIN_PUBLIC_WARNING = booleanPreferencesKey("ui.dont_show_onchain_public_warning")
         val UI_SUGGEST_WORKOUTS_FROM_HEALTH_CONNECT = stringPreferencesKey("ui.suggest_workouts_from_health_connect")
+        val UI_ACCENT_COLOR = stringPreferencesKey("ui.accent_color")
+        val UI_FONT_FAMILY = stringPreferencesKey("ui.font_family")
+        val UI_FONT_SIZE = stringPreferencesKey("ui.font_size")
+        val UI_COMPOSE_SIGNATURE = stringPreferencesKey("ui.compose_signature")
+        val UI_SHOW_ONCHAIN_WALLET = booleanPreferencesKey("ui.show_onchain_wallet")
 
         suspend fun uiPreferences(context: Context): UiSettings? =
             try {
@@ -144,7 +154,7 @@ class UiSharedPreferences(
                         preferences[UI_USE_TRACKED_BROADCASTS]?.let { BooleanType.valueOf(it) }
                             ?: if (featureSet == FeatureSetType.COMPLETE) BooleanType.ALWAYS else BooleanType.NEVER,
                     automaticallyCreateDrafts = preferences[UI_AUTOMATICALLY_CREATE_DRAFTS]?.let { BooleanType.valueOf(it) } ?: BooleanType.ALWAYS,
-                    bottomBarItems = preferences[UI_BOTTOM_BAR_ITEMS]?.let { decodeBottomBarItems(it) } ?: DefaultBottomBarItems,
+                    bottomBarItems = preferences[UI_BOTTOM_BAR_ITEMS]?.let { decodeBottomBarItems(it) } ?: DefaultBottomBarEntries,
                     showHomeNewThreadsTab = preferences[UI_SHOW_HOME_NEW_THREADS_TAB] ?: true,
                     showHomeConversationsTab = preferences[UI_SHOW_HOME_CONVERSATIONS_TAB] ?: true,
                     showHomeEverythingTab = preferences[UI_SHOW_HOME_EVERYTHING_TAB] ?: false,
@@ -155,6 +165,11 @@ class UiSharedPreferences(
                     dontShowOnchainPublicWarning = preferences[UI_DONT_SHOW_ONCHAIN_PUBLIC_WARNING] ?: false,
                     suggestWorkoutsFromHealthConnect =
                         preferences[UI_SUGGEST_WORKOUTS_FROM_HEALTH_CONNECT]?.let { BooleanType.valueOf(it) } ?: BooleanType.ALWAYS,
+                    accentColor = preferences[UI_ACCENT_COLOR]?.let { AccentColorType.valueOf(it) } ?: AccentColorType.PURPLE,
+                    fontFamily = preferences[UI_FONT_FAMILY]?.let { FontFamilyType.valueOf(it) } ?: FontFamilyType.SYSTEM,
+                    fontSize = preferences[UI_FONT_SIZE]?.let { FontSizeType.valueOf(it) } ?: FontSizeType.NORMAL,
+                    composeSignature = preferences[UI_COMPOSE_SIGNATURE] ?: "",
+                    showOnchainWallet = preferences[UI_SHOW_ONCHAIN_WALLET] ?: true,
                 )
             } catch (e: Exception) {
                 if (e is CancellationException) throw e
@@ -194,7 +209,7 @@ class UiSharedPreferences(
                     preferences[UI_PROPOSE_AI_IMPROVEMENTS] = sharedSettings.automaticallyProposeAiImprovements.name
                     preferences[UI_USE_TRACKED_BROADCASTS] = sharedSettings.useTrackedBroadcasts.name
                     preferences[UI_AUTOMATICALLY_CREATE_DRAFTS] = sharedSettings.automaticallyCreateDrafts.name
-                    preferences[UI_BOTTOM_BAR_ITEMS] = sharedSettings.bottomBarItems.joinToString(",") { it.name }
+                    preferences[UI_BOTTOM_BAR_ITEMS] = encodeBottomBarItems(sharedSettings.bottomBarItems)
                     preferences[UI_SHOW_HOME_NEW_THREADS_TAB] = sharedSettings.showHomeNewThreadsTab
                     preferences[UI_SHOW_HOME_CONVERSATIONS_TAB] = sharedSettings.showHomeConversationsTab
                     preferences[UI_SHOW_HOME_EVERYTHING_TAB] = sharedSettings.showHomeEverythingTab
@@ -204,6 +219,11 @@ class UiSharedPreferences(
                     preferences[UI_SHOW_PROFILE_FOLLOWERS_FEED] = sharedSettings.showProfileFollowersFeed
                     preferences[UI_DONT_SHOW_ONCHAIN_PUBLIC_WARNING] = sharedSettings.dontShowOnchainPublicWarning
                     preferences[UI_SUGGEST_WORKOUTS_FROM_HEALTH_CONNECT] = sharedSettings.suggestWorkoutsFromHealthConnect.name
+                    preferences[UI_ACCENT_COLOR] = sharedSettings.accentColor.name
+                    preferences[UI_FONT_FAMILY] = sharedSettings.fontFamily.name
+                    preferences[UI_FONT_SIZE] = sharedSettings.fontSize.name
+                    preferences[UI_COMPOSE_SIGNATURE] = sharedSettings.composeSignature
+                    preferences[UI_SHOW_ONCHAIN_WALLET] = sharedSettings.showOnchainWallet
                 }
             } catch (e: Exception) {
                 if (e is CancellationException) throw e
@@ -212,17 +232,41 @@ class UiSharedPreferences(
             }
         }
 
-        private fun decodeBottomBarItems(raw: String): List<NavBarItem> {
-            if (raw.isEmpty()) return emptyList()
-            return raw
-                .split(",")
-                .mapNotNull { name ->
-                    try {
-                        NavBarItem.valueOf(name)
-                    } catch (_: IllegalArgumentException) {
-                        null
-                    }
-                }
+        /**
+         * Persists "follow the defaults" as a blank sentinel instead of the concrete default list.
+         *
+         * A user who resets the bottom bar (or who never customized it) should track whatever
+         * [DefaultBottomBarEntries] is in the *installed* app version. Storing the concrete list would
+         * pin them to today's default, so a future version that changes the default would never reach
+         * them. Storing a blank value instead makes [decodeBottomBarItems] resolve it back to the
+         * current [DefaultBottomBarEntries] on every load — i.e. the user is automatically migrated to
+         * the new default. Any genuinely customized bar is still stored as JSON.
+         */
+        internal fun encodeBottomBarItems(items: List<BottomBarEntry>): String = if (items == DefaultBottomBarEntries) "" else JsonMapper.toJson(items)
+
+        internal fun decodeBottomBarItems(raw: String): List<BottomBarEntry>? {
+            if (raw.isBlank()) return DefaultBottomBarEntries
+            // Current format: a JSON list of BottomBarEntry (built-ins + favorites).
+            runCatching { return JsonMapper.fromJson<List<BottomBarEntry>>(raw) }
+            // Configs written before the stable @SerialName discriminators used the fully-qualified
+            // class name as the polymorphic "type" value. Rewrite it to the short name and retry, so a
+            // customized bar survives the upgrade instead of silently resetting to defaults.
+            runCatching {
+                val migrated =
+                    raw
+                        .replace(LEGACY_BUILTIN_DISCRIMINATOR, "builtIn")
+                        .replace(LEGACY_FAVORITE_DISCRIMINATOR, "favorite")
+                return JsonMapper.fromJson<List<BottomBarEntry>>(migrated)
+            }
+            // Oldest format: comma-joined NavBarItem enum names (before favorites/unified entries).
+            val legacy = raw.split(",").mapNotNull { name -> runCatching { NavBarItem.valueOf(name) }.getOrNull() }
+            if (legacy.isNotEmpty()) return legacy.map { BottomBarEntry.BuiltIn(it) }
+            // Unrecognizable — fall back to the defaults rather than leaving the bar empty.
+            return DefaultBottomBarEntries
         }
+
+        // The pre-@SerialName polymorphic discriminators (fully-qualified class names) for migration.
+        private const val LEGACY_BUILTIN_DISCRIMINATOR = "com.vitorpamplona.amethyst.ui.navigation.bottombars.BottomBarEntry.BuiltIn"
+        private const val LEGACY_FAVORITE_DISCRIMINATOR = "com.vitorpamplona.amethyst.ui.navigation.bottombars.BottomBarEntry.Favorite"
     }
 }

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/FeedTopNavFilterState.kt

@@ -35,6 +35,7 @@ import com.vitorpamplona.amethyst.model.topNavFeeds.favoriteAlgoFeeds.FavoriteAl
 import com.vitorpamplona.amethyst.model.topNavFeeds.global.GlobalFeedFlow
 import com.vitorpamplona.amethyst.model.topNavFeeds.hashtag.HashtagFeedFlow
 import com.vitorpamplona.amethyst.model.topNavFeeds.hashtag.MultiHashtagFeedFlow
+import com.vitorpamplona.amethyst.model.topNavFeeds.mine.MineFeedFlow
 import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.NoteFeedFlow
 import com.vitorpamplona.amethyst.model.topNavFeeds.relay.RelayFeedFlow
 import com.vitorpamplona.amethyst.service.location.LocationState
@@ -62,6 +63,7 @@ class FeedTopNavFilterState(
     val followsRelays: StateFlow<Set<NormalizedRelayUrl>>,
     val blockedRelays: StateFlow<Set<NormalizedRelayUrl>>,
     val proxyRelays: StateFlow<Set<NormalizedRelayUrl>>,
+    val mineRelays: StateFlow<Set<NormalizedRelayUrl>>,
     val relayFeeds: StateFlow<Set<NormalizedRelayUrl>>,
     val caches: FeedDecryptionCaches,
     val signer: NostrSigner,
@@ -93,7 +95,7 @@ class FeedTopNavFilterState(
             }
 
             TopFilter.Mine -> {
-                AllFollowsFeedFlow(allFollows, followsRelays, blockedRelays, proxyRelays)
+                MineFeedFlow(signer.pubKey, mineRelays)
             }
 
             is TopFilter.Community, is TopFilter.PeopleList, is TopFilter.MuteList -> {

amethyst/src/main/java/com/vitorpamplona/amethyst/model/topNavFeeds/mine/MineFeedFlow.kt

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.model.topNavFeeds.mine
+
+import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedFlowsType
+import com.vitorpamplona.amethyst.model.topNavFeeds.IFeedTopNavFilter
+import com.vitorpamplona.amethyst.model.topNavFeeds.noteBased.author.AuthorsByProxyTopNavFilter
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.FlowCollector
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.map
+
+/**
+ * Resolves the "Mine" top-nav selection to an author filter scoped to the logged-in user's own
+ * pubkey, pinned to the user's own relays — their outbox, private-storage, local and proxy relays
+ * (see [com.vitorpamplona.amethyst.model.nip01UserMetadata.AccountMineRelayState]). Unlike the
+ * follow filters, "Mine" doesn't need per-author outbox resolution from cache: the only author is
+ * the user, and the user's relays are already known from their own account state — so we pin the
+ * fixed set directly via [AuthorsByProxyTopNavFilter] (it associates each given relay with the
+ * authors, which is exactly "query my relays for my events").
+ *
+ * This is the single source of truth for "Mine". Both the relay sub-assemblers (through each
+ * screen's `liveXFollowListsPerRelay`) and the local DAL filters (through `liveXFollowLists`)
+ * consume the produced [AuthorsByProxyTopNavFilter], so screens no longer need a dedicated
+ * `TopFilter.Mine` branch: the generic author path already narrows to the user. It also makes
+ * relay-set changes re-invalidate automatically — `liveXFollowListsPerRelay` re-emits whenever
+ * [mineRelays] changes, through the sub-assemblers' existing `followsPerRelayFlow` collector.
+ */
+class MineFeedFlow(
+    val myPubkey: HexKey,
+    val mineRelays: StateFlow<Set<NormalizedRelayUrl>>,
+) : IFeedFlowsType {
+    fun convert(relays: Set<NormalizedRelayUrl>): IFeedTopNavFilter =
+        AuthorsByProxyTopNavFilter(
+            authors = setOf(myPubkey),
+            proxyRelays = relays,
+        )
+
+    override fun flow(): Flow<IFeedTopNavFilter> = mineRelays.map(::convert)
+
+    override fun startValue(): IFeedTopNavFilter = convert(mineRelays.value)
+
+    override suspend fun startValue(collector: FlowCollector<IFeedTopNavFilter>) {
+        collector.emit(startValue())
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/DataStoreNappletPermissionStore.kt

@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import com.vitorpamplona.amethyst.commons.napplet.NappletCapability
+import com.vitorpamplona.amethyst.commons.napplet.permissions.GrantState
+import com.vitorpamplona.amethyst.commons.napplet.permissions.NappletPermissionStore
+import kotlinx.coroutines.flow.first
+
+private val Context.nappletPermissionsDataStore by preferencesDataStore(name = "napplet_permissions")
+
+/**
+ * Persists the standing napplet grants ([GrantState.ALLOW_ALWAYS] / [GrantState.DENY]) in a
+ * dedicated DataStore. Keyed by `"<coordinate>\u0000<capability>"` so a coordinate's grants can
+ * be read and cleared as a group. Session and one-shot grants are not persisted — the ledger
+ * keeps those in memory.
+ */
+class DataStoreNappletPermissionStore(
+    private val dataStore: DataStore<Preferences>,
+) : NappletPermissionStore {
+    constructor(context: Context) : this(context.applicationContext.nappletPermissionsDataStore)
+
+    override suspend fun load(coordinate: String): Map<NappletCapability, GrantState> {
+        val prefs = dataStore.data.first()
+        val prefix = "$coordinate$SEP"
+        val result = mutableMapOf<NappletCapability, GrantState>()
+        for ((key, value) in prefs.asMap()) {
+            val name = key.name
+            if (!name.startsWith(prefix)) continue
+            val capability = runCatching { NappletCapability.valueOf(name.substring(prefix.length)) }.getOrNull() ?: continue
+            val grant = runCatching { GrantState.valueOf(value as String) }.getOrNull() ?: continue
+            if (grant == GrantState.ALLOW_ALWAYS || grant == GrantState.DENY) result[capability] = grant
+        }
+        return result
+    }
+
+    override suspend fun store(
+        coordinate: String,
+        capability: NappletCapability,
+        grant: GrantState,
+    ) {
+        if (grant != GrantState.ALLOW_ALWAYS && grant != GrantState.DENY) return
+        dataStore.edit { it[keyOf(coordinate, capability)] = grant.name }
+    }
+
+    override suspend fun clear(coordinate: String) {
+        val prefix = "$coordinate$SEP"
+        dataStore.edit { prefs ->
+            val toRemove = prefs.asMap().keys.filter { it.name.startsWith(prefix) }
+            toRemove.forEach { prefs.remove(it) }
+        }
+    }
+
+    override suspend fun all(): Map<String, Map<NappletCapability, GrantState>> {
+        val prefs = dataStore.data.first()
+        val result = mutableMapOf<String, MutableMap<NappletCapability, GrantState>>()
+        for ((key, value) in prefs.asMap()) {
+            val name = key.name
+            // Key is "<coordinate> <CAPABILITY>"; the capability is the final space-delimited token.
+            val capName = name.substringAfterLast(SEP, "")
+            val coordinate = name.substringBeforeLast(SEP, "")
+            if (capName.isEmpty() || coordinate.isEmpty()) continue
+            val capability = runCatching { NappletCapability.valueOf(capName) }.getOrNull() ?: continue
+            val grant = runCatching { GrantState.valueOf(value as String) }.getOrNull() ?: continue
+            if (grant == GrantState.ALLOW_ALWAYS || grant == GrantState.DENY) {
+                result.getOrPut(coordinate) { mutableMapOf() }[capability] = grant
+            }
+        }
+        return result
+    }
+
+    override suspend fun remove(
+        coordinate: String,
+        capability: NappletCapability,
+    ) {
+        dataStore.edit { it.remove(keyOf(coordinate, capability)) }
+    }
+
+    private fun keyOf(
+        coordinate: String,
+        capability: NappletCapability,
+    ) = stringPreferencesKey("$coordinate$SEP${capability.name}")
+
+    companion object {
+        private const val SEP = "\u0000"
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/DataStoreNappletStorage.kt

@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import com.vitorpamplona.amethyst.commons.napplet.NappletStorage
+import kotlinx.coroutines.flow.first
+
+private val Context.nappletStorageDataStore by preferencesDataStore(name = "napplet_storage")
+
+/**
+ * DataStore-backed [NappletStorage]. Every key is prefixed with the applet's coordinate, so one
+ * napplet's keys can never collide with another's, and this store is entirely separate from the
+ * app's own preferences.
+ */
+class DataStoreNappletStorage(
+    private val dataStore: DataStore<Preferences>,
+) : NappletStorage {
+    constructor(context: Context) : this(context.applicationContext.nappletStorageDataStore)
+
+    override suspend fun get(
+        coordinate: String,
+        key: String,
+    ): String? = dataStore.data.first()[keyOf(coordinate, key)]
+
+    override suspend fun set(
+        coordinate: String,
+        key: String,
+        value: String,
+    ) {
+        dataStore.edit { it[keyOf(coordinate, key)] = value }
+    }
+
+    override suspend fun remove(
+        coordinate: String,
+        key: String,
+    ) {
+        dataStore.edit { it.remove(keyOf(coordinate, key)) }
+    }
+
+    override suspend fun keys(coordinate: String): List<String> {
+        val prefix = "$coordinate "
+        return dataStore.data
+            .first()
+            .asMap()
+            .keys
+            .map { it.name }
+            .filter { it.startsWith(prefix) }
+            .map { it.removePrefix(prefix) }
+    }
+
+    private fun keyOf(
+        coordinate: String,
+        key: String,
+    ) = stringPreferencesKey("$coordinate\u0000$key")
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/DataStoreNostrSignerPermissionStore.kt

@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.PreferenceDataStoreFactory
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import com.vitorpamplona.amethyst.commons.napplet.signers.AppSignerPolicy
+import com.vitorpamplona.amethyst.commons.napplet.signers.NostrOpDecision
+import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerOp
+import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerPermissionStore
+import com.vitorpamplona.quartz.utils.cache.LargeCache
+import kotlinx.coroutines.flow.first
+import java.io.File
+import java.security.MessageDigest
+
+/**
+ * Per-coordinate DataStore-backed [NostrSignerPermissionStore]. One small `.preferences_pb`
+ * file per app (keyed by a SHA-256 prefix of the coordinate) so loading or saving one app's
+ * permissions never touches another app's data — essential at scale with 1000s of apps.
+ *
+ * The coordinate is stored inside each file under [KEY_COORDINATE] so [allPolicies] can
+ * reverse-map file → coordinate without scanning the filesystem.
+ */
+class DataStoreNostrSignerPermissionStore(
+    private val filesDir: File,
+) : NostrSignerPermissionStore {
+    constructor(context: Context) : this(context.applicationContext.filesDir)
+
+    private val cache = LargeCache<String, DataStore<Preferences>>()
+
+    private fun storeFor(coordinate: String): DataStore<Preferences> {
+        val file = File(filesDir, "datastore/nsp_${hash(coordinate)}.preferences_pb")
+        return cache.getOrCreate(file.absolutePath) {
+            PreferenceDataStoreFactory.create(produceFile = { file })
+        }
+    }
+
+    override suspend fun loadPolicy(coordinate: String): AppSignerPolicy? {
+        val raw = storeFor(coordinate).data.first()[KEY_POLICY] ?: return null
+        return runCatching { AppSignerPolicy.valueOf(raw) }.getOrNull()
+    }
+
+    override suspend fun storePolicy(
+        coordinate: String,
+        policy: AppSignerPolicy,
+    ) {
+        storeFor(coordinate).edit {
+            it[KEY_COORDINATE] = coordinate
+            it[KEY_POLICY] = policy.name
+        }
+    }
+
+    override suspend fun clearPolicy(coordinate: String) {
+        storeFor(coordinate).edit { it.remove(KEY_POLICY) }
+    }
+
+    override suspend fun loadOpDecision(
+        coordinate: String,
+        op: NostrSignerOp,
+    ): NostrOpDecision? {
+        val raw = storeFor(coordinate).data.first()[opKey(op)] ?: return null
+        return runCatching { NostrOpDecision.valueOf(raw) }.getOrNull()
+    }
+
+    override suspend fun storeOpDecision(
+        coordinate: String,
+        op: NostrSignerOp,
+        decision: NostrOpDecision,
+    ) {
+        storeFor(coordinate).edit {
+            it[KEY_COORDINATE] = coordinate
+            it[opKey(op)] = decision.name
+        }
+    }
+
+    override suspend fun clearOpDecision(
+        coordinate: String,
+        op: NostrSignerOp,
+    ) {
+        storeFor(coordinate).edit { it.remove(opKey(op)) }
+    }
+
+    override suspend fun allPolicies(): Map<String, AppSignerPolicy> {
+        val dir = File(filesDir, "datastore")
+        if (!dir.exists()) return emptyMap()
+        val result = mutableMapOf<String, AppSignerPolicy>()
+        for (file in dir.listFiles { f -> f.name.startsWith("nsp_") } ?: emptyArray()) {
+            val ds =
+                cache.getOrCreate(file.absolutePath) {
+                    PreferenceDataStoreFactory.create(produceFile = { file })
+                }
+            val coordinate = ds.data.first()[KEY_COORDINATE] ?: continue
+            val policy = loadPolicy(coordinate) ?: continue
+            result[coordinate] = policy
+        }
+        return result
+    }
+
+    override suspend fun allOpDecisions(coordinate: String): Map<String, NostrOpDecision> {
+        val prefs = storeFor(coordinate).data.first()
+        val result = mutableMapOf<String, NostrOpDecision>()
+        for ((key, value) in prefs.asMap()) {
+            val name = key.name
+            if (!name.startsWith(OP_PREFIX)) continue
+            // Skip expiry metadata keys — they end with the expiry suffix
+            if (name.endsWith(OP_EXPIRY_SUFFIX)) continue
+            val opKey = name.removePrefix(OP_PREFIX)
+            val decision = runCatching { NostrOpDecision.valueOf(value as String) }.getOrNull() ?: continue
+            result[opKey] = decision
+        }
+        return result
+    }
+
+    override suspend fun loadOpExpiry(
+        coordinate: String,
+        op: NostrSignerOp,
+    ): Long? {
+        val raw = storeFor(coordinate).data.first()[opExpiryKey(op)] ?: return null
+        return raw.toLongOrNull()
+    }
+
+    override suspend fun storeOpExpiry(
+        coordinate: String,
+        op: NostrSignerOp,
+        expiresAt: Long,
+    ) {
+        storeFor(coordinate).edit { it[opExpiryKey(op)] = expiresAt.toString() }
+    }
+
+    override suspend fun clearOpExpiry(
+        coordinate: String,
+        op: NostrSignerOp,
+    ) {
+        storeFor(coordinate).edit { it.remove(opExpiryKey(op)) }
+    }
+
+    override suspend fun loadLastUsed(coordinate: String): Long? {
+        val raw = storeFor(coordinate).data.first()[KEY_LAST_USED] ?: return null
+        return raw.toLongOrNull()
+    }
+
+    override suspend fun storeLastUsed(
+        coordinate: String,
+        epochSeconds: Long,
+    ) {
+        storeFor(coordinate).edit { it[KEY_LAST_USED] = epochSeconds.toString() }
+    }
+
+    override suspend fun clearAll(coordinate: String) {
+        storeFor(coordinate).edit { it.clear() }
+    }
+
+    private fun opKey(op: NostrSignerOp) = stringPreferencesKey("$OP_PREFIX${op.key}")
+
+    private fun opExpiryKey(op: NostrSignerOp) = stringPreferencesKey("$OP_PREFIX${op.key}$OP_EXPIRY_SUFFIX")
+
+    companion object {
+        private val KEY_COORDINATE = stringPreferencesKey("coordinate")
+        private val KEY_POLICY = stringPreferencesKey("policy")
+        private val KEY_LAST_USED = stringPreferencesKey("lastused")
+        private const val OP_PREFIX = "op:"
+        private const val OP_EXPIRY_SUFFIX = ":exp"
+
+        private fun hash(coordinate: String): String {
+            val digest = MessageDigest.getInstance("SHA-256").digest(coordinate.toByteArray())
+            return digest.take(8).joinToString("") { "%02x".format(it) }
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletBrokerService.kt

@@ -0,0 +1,431 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.app.Service
+import android.content.Intent
+import android.net.Uri
+import android.os.Bundle
+import android.os.Handler
+import android.os.IBinder
+import android.os.Looper
+import android.os.Message
+import android.os.Messenger
+import android.os.RemoteException
+import android.os.SystemClock
+import android.util.Log
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
+import com.vitorpamplona.amethyst.commons.napplet.NappletBroker
+import com.vitorpamplona.amethyst.commons.napplet.NappletCapability
+import com.vitorpamplona.amethyst.commons.napplet.NappletIdentity
+import com.vitorpamplona.amethyst.commons.napplet.NappletRequestRouter
+import com.vitorpamplona.amethyst.commons.napplet.permissions.NappletPermissionLedger
+import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletProtocolJson
+import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletResponse
+import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerPermissionLedger
+import com.vitorpamplona.amethyst.favorites.BrowserHistoryRegistry
+import com.vitorpamplona.amethyst.favorites.BrowserIconRegistry
+import com.vitorpamplona.amethyst.favorites.FavoriteAppsRegistry
+import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.amethyst.napplet.gateways.AccountNappletGateways
+import com.vitorpamplona.amethyst.napplethost.NappletIpc
+import com.vitorpamplona.amethyst.ui.MainActivity
+import com.vitorpamplona.amethyst.ui.screen.AccountState
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.launch
+
+/**
+ * The trust boundary's main-process endpoint. The untrusted `:napplet` process binds this
+ * service and sends requests as JSON over a [Messenger]; this is the only side that holds the
+ * signer, the relays, and the permission ledger. It runs each request through the shared
+ * [NappletBroker] (built per account by [AccountNappletGateways]) via the host-agnostic
+ * [NappletRequestRouter], which gates everything on consent and never returns key material.
+ *
+ * This class is intentionally thin: it owns the Messenger transport, the per-account broker cache,
+ * and the live-subscription registry, and delegates all decode/policy/execution to the shared core.
+ *
+ * `exported=false` in the manifest restricts binding to this app's own UID, so no other
+ * installed app can reach the broker. A renderer escape that reaches the `:napplet` process
+ * could still bind here — but it gains only what the user explicitly consents to, per
+ * capability, and never the private key (the broker's contract).
+ */
+class NappletBrokerService : Service() {
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+
+    // One ledger for the whole service lifetime: persistent grants on disk, session grants in RAM.
+    private val ledger by lazy { NappletPermissionLedger(Amethyst.instance.nappletPermissionStore) }
+
+    // Per-app internal-signer permission ledger (policy + per-op overrides). Lazy so it's only
+    // instantiated in the main process where the signer lives; never touched from :napplet.
+    private val signerLedger by lazy { NostrSignerPermissionLedger(Amethyst.instance.signerPermissionStore) }
+
+    // Per-applet sandboxed key-value store (namespaced by coordinate inside the impl).
+    private val storage by lazy { DataStoreNappletStorage(applicationContext) }
+
+    private val incoming by lazy { Messenger(Handler(Looper.getMainLooper(), ::handleMessage)) }
+
+    // The broker for the current account, rebuilt only on account switch (see broker()).
+    private var cachedBroker: Pair<Account, NappletBroker>? = null
+
+    // Live relay subscriptions, keyed by the applet's subId; reads the current account live.
+    private val liveSubscriptions = NappletLiveSubscriptions { Amethyst.instance.sessionManager.loggedInAccount() }
+
+    // The app-wide inc pub/sub bus: routes inc.emit between live napplet sessions as inc.event pushes.
+    private val incBus = NappletIncBus { replyTo, payload -> push(replyTo, payload) }
+
+    // Streams identity.changed pushes (account switch / connect / disconnect) to a watching applet.
+    private val identityWatch =
+        NappletIdentityWatch(scope) {
+            Amethyst.instance.sessionManager.accountContent
+                .map { (it as? AccountState.LoggedIn)?.account?.signer?.pubKey ?: "" }
+        }
+
+    // Binding is restricted to our own UID by exported=false in the manifest, enforced by the OS.
+    // A UID check here would be useless: onBind() runs once (the binder is cached and reused for all
+    // later clients) and outside any binder transaction, so getCallingUid() returns our own UID anyway.
+    override fun onBind(intent: Intent?): IBinder? = incoming.binder
+
+    override fun onDestroy() {
+        liveSubscriptions.closeAll()
+        identityWatch.stop()
+        // Drop any foreground holds this broker still owns so they don't leak past the service.
+        synchronized(foregroundLeases) {
+            repeat(foregroundLeases.size) { SandboxForegroundHold.release() }
+            foregroundLeases.clear()
+        }
+        scope.cancel()
+        super.onDestroy()
+    }
+
+    // Sandbox surfaces (full-screen :napplet hosts) currently reporting themselves foreground, mapped to
+    // the last time each renewed its lease (monotonic elapsedRealtime). While this map is non-empty the
+    // main process is held resumed (Tor/relays/AUTH up) via SandboxForegroundHold — the napplet host
+    // lives in :napplet and can't touch that lifecycle itself, so it signals over IPC.
+    //
+    // The host re-sends its foreground report on a heartbeat while genuinely resumed. We key on the
+    // launch token, so a repeated report just refreshes the timestamp (idempotent, no double-acquire).
+    // If a host's process dies while foreground it can't send its onPause "false", so the heartbeats
+    // simply stop and [foregroundLeaseWatchdog] reaps the stale lease — bounding any such leak to one
+    // [FOREGROUND_LEASE_TTL_MS] window instead of holding the network up forever.
+    private val foregroundLeases = HashMap<String, Long>()
+    private var foregroundLeaseWatchdog: Job? = null
+
+    private fun handleMessage(msg: Message): Boolean {
+        // A sandbox surface (full-screen :napplet host) entered, renewed, or left the foreground. Hold the
+        // main process resumed while at least one is foreground, so opening it doesn't tear down Tor/relays.
+        if (msg.what == NappletIpc.MSG_SET_FOREGROUND) {
+            val data = msg.data ?: return true
+            val token = data.getString(NappletIpc.KEY_LAUNCH_TOKEN) ?: return true
+            val foreground = data.getBoolean(NappletIpc.KEY_FOREGROUND, false)
+            synchronized(foregroundLeases) {
+                if (foreground) {
+                    val firstReport = !foregroundLeases.containsKey(token)
+                    // A foreground lease just pins Tor/relays (no key access), but a misbehaving sandbox
+                    // could still spam distinct keys to keep the network up. Bound the damage: refuse new
+                    // lease keys past the cap. Real usage holds only a handful of foreground surfaces.
+                    if (firstReport && foregroundLeases.size >= MAX_FOREGROUND_LEASES) {
+                        Log.w("NappletBrokerService", "Foreground lease cap reached; ignoring new lease $token")
+                        return true
+                    }
+                    foregroundLeases[token] = SystemClock.elapsedRealtime()
+                    if (firstReport) {
+                        SandboxForegroundHold.acquire()
+                        ensureForegroundLeaseWatchdog()
+                    }
+                } else if (foregroundLeases.remove(token) != null) {
+                    SandboxForegroundHold.release()
+                }
+            }
+            return true
+        }
+
+        // The direct-WebView browser relays a successfully loaded page; record it in the visit history
+        // (main process only). Only clean page-finishes reach here, so misspellings never get recorded.
+        if (msg.what == NappletIpc.MSG_RECORD_HISTORY) {
+            val data = msg.data ?: return true
+            val url = data.getString(NappletIpc.KEY_HISTORY_URL)?.takeIf { it.isNotBlank() } ?: return true
+            BrowserHistoryRegistry.init(applicationContext)
+            BrowserHistoryRegistry.record(url, data.getString(NappletIpc.KEY_HISTORY_TITLE).orEmpty())
+            return true
+        }
+
+        // The direct-WebView browser relays a favicon captured from the loaded page; store it by host.
+        if (msg.what == NappletIpc.MSG_RECORD_ICON) {
+            val data = msg.data ?: return true
+            val host = data.getString(NappletIpc.KEY_ICON_HOST)?.takeIf { it.isNotBlank() } ?: return true
+            val bytes = data.getByteArray(NappletIpc.KEY_ICON_BYTES) ?: return true
+            BrowserIconRegistry.init(applicationContext)
+            BrowserIconRegistry.record(host, bytes)
+            return true
+        }
+
+        // The direct-WebView browser requests a favorite toggle for the current URL (main process only).
+        if (msg.what == NappletIpc.MSG_TOGGLE_WEB_FAVORITE) {
+            val data = msg.data ?: return true
+            val url = data.getString(NappletIpc.KEY_FAVORITE_URL)?.takeIf { it.isNotBlank() } ?: return true
+            val label = data.getString(NappletIpc.KEY_FAVORITE_LABEL).orEmpty().ifBlank { url }
+            FavoriteAppsRegistry.init(applicationContext)
+            val id = "url:$url"
+            if (FavoriteAppsRegistry.isFavorite(id)) {
+                FavoriteAppsRegistry.remove(id)
+            } else {
+                FavoriteAppsRegistry.add(FavoriteApp.WebApp(url, label, System.currentTimeMillis()))
+            }
+            return true
+        }
+
+        // The direct-WebView browser relays its per-host Tor choice; persist it (main process only).
+        if (msg.what == NappletIpc.MSG_SET_WEB_TOR) {
+            val data = msg.data ?: return true
+            val host = data.getString(NappletIpc.KEY_WEB_HOST)?.takeIf { it.isNotBlank() } ?: return true
+            WebAppNetworkRegistry.init(applicationContext)
+            WebAppNetworkRegistry.set(host, data.getBoolean(NappletIpc.KEY_NETWORK_USE_TOR, true))
+            return true
+        }
+
+        // The sandbox relays the user's per-site network choice; persist it against the trusted
+        // coordinate the launch token resolves to (the sandbox can't state its own coordinate).
+        if (msg.what == NappletIpc.MSG_SET_NETWORK_MODE) {
+            val data = msg.data ?: return true
+            val session = NappletLaunchRegistry.resolve(data.getString(NappletIpc.KEY_LAUNCH_TOKEN)) ?: return true
+            NappletNetworkRegistry.init(applicationContext)
+            NappletNetworkRegistry.set(session.identity.coordinate, data.getBoolean(NappletIpc.KEY_NETWORK_USE_TOR, true))
+            return true
+        }
+
+        // A running full-screen sandbox surface asks to open its editable permission screen. The sandbox
+        // can't state its own coordinate, so a napplet/nsite sends its launch token (resolved here to the
+        // trusted coordinate) and a browser sends its visited origin (keyed as `browser:<origin>`). Open
+        // the main activity at that Connected Apps detail.
+        if (msg.what == NappletIpc.MSG_OPEN_PERMISSIONS) {
+            val data = msg.data ?: return true
+            val coordinate =
+                data.getString(NappletIpc.KEY_LAUNCH_TOKEN)?.let { NappletLaunchRegistry.resolve(it)?.identity?.coordinate }
+                    ?: data.getString(NappletIpc.KEY_BROWSER_ORIGIN)?.takeIf { it.isNotBlank() }?.let { "browser:$it" }
+                    ?: return true
+            openConnectedAppDetail(coordinate)
+            return true
+        }
+
+        // Browser mode mints a fresh launch token per visited origin, so NIP-07 consent is scoped to the
+        // one site the request came from. The origin is the trusted source origin the WebView reported
+        // (the sandbox can't forge it), and the synthetic identity keys the permission ledger per host.
+        if (msg.what == NappletIpc.MSG_MINT_BROWSER_TOKEN) {
+            val data = msg.data ?: return true
+            val replyTo = msg.replyTo ?: return true
+            val origin = data.getString(NappletIpc.KEY_BROWSER_ORIGIN)?.takeIf { it.isNotBlank() } ?: return true
+            val identity = NappletIdentity(authorPubKey = BROWSER_IDENTITY_AUTHOR, identifier = origin)
+            val token = NappletLaunchRegistry.register(identity, setOf(NappletCapability.IDENTITY, NappletCapability.RELAY))
+            val response =
+                Message.obtain(null, NappletIpc.MSG_BROWSER_TOKEN).apply {
+                    this.data =
+                        Bundle().apply {
+                            putString(NappletIpc.KEY_BROWSER_ORIGIN, origin)
+                            putString(NappletIpc.KEY_LAUNCH_TOKEN, token)
+                        }
+                }
+            runCatching { replyTo.send(response) }
+            return true
+        }
+
+        if (msg.what != NappletIpc.MSG_REQUEST) return false
+
+        val data = msg.data ?: return true
+        val replyTo = msg.replyTo ?: return true
+        val requestId = data.getString(NappletIpc.KEY_REQUEST_ID) ?: return true
+        val payload = data.getString(NappletIpc.KEY_PAYLOAD) ?: return true
+
+        val requestType = runCatching { NappletProtocolJson.readType(payload) }.getOrNull() ?: "napplet"
+
+        // Resolve the launch token to the trusted identity + declared set. The sandbox never states
+        // its own coordinate, so a compromised :napplet process can only ever act as the napplet it
+        // was launched as (it holds only its own token). An unknown token = no session; refuse.
+        val session = NappletLaunchRegistry.resolve(data.getString(NappletIpc.KEY_LAUNCH_TOKEN))
+        if (session == null) {
+            reply(replyTo, requestId, NappletProtocolJson.encodeResponse(requestType, NappletResponse.Failed("Unknown napplet session.")))
+            return true
+        }
+        val identity = session.identity
+        val declared = session.declared
+
+        scope.launch {
+            // The shared, host-agnostic router owns decode → broker → encode and the subscribe-vs-reply
+            // decision (it stays wire-identical with the future desktop host). This service only supplies
+            // the broker, the Messenger transport, and the live relay subscription each Outcome implies.
+            val broker = broker()
+            if (broker == null) {
+                reply(replyTo, requestId, NappletProtocolJson.encodeResponse(requestType, NappletResponse.Failed("No account is signed in.")))
+                return@launch
+            }
+            when (val outcome = NappletRequestRouter.route(broker, identity, declared, payload)) {
+                is NappletRequestRouter.Outcome.Ignore -> {}
+                is NappletRequestRouter.Outcome.Reply -> reply(replyTo, requestId, outcome.payload)
+                is NappletRequestRouter.Outcome.OpenSubscription -> liveSubscriptions.open(outcome.subId, outcome.filters) { push(replyTo, it) }
+                is NappletRequestRouter.Outcome.CloseSubscription -> liveSubscriptions.close(outcome.subId)
+                is NappletRequestRouter.Outcome.WatchIdentity -> identityWatch.start { push(replyTo, it) }
+                is NappletRequestRouter.Outcome.UnwatchIdentity -> identityWatch.stop()
+                is NappletRequestRouter.Outcome.Push -> outcome.payloads.forEach { push(replyTo, it) }
+                is NappletRequestRouter.Outcome.SubscribeInc -> incBus.subscribe(replyTo, outcome.topic)
+                is NappletRequestRouter.Outcome.UnsubscribeInc -> incBus.unsubscribe(replyTo, outcome.topic)
+                is NappletRequestRouter.Outcome.EmitInc -> incBus.emit(replyTo, identity.coordinate, outcome.topic, outcome.payloadRaw)
+            }
+        }
+        return true
+    }
+
+    /**
+     * Periodically reaps foreground leases that stopped renewing — the signature of a `:napplet` host
+     * process that died (or was killed) while foreground, so it never sent its onPause "false". Each
+     * reaped lease releases its [SandboxForegroundHold] so the network isn't held up forever by a host
+     * that's already gone. Runs only while at least one lease exists; cancelled with [scope] on destroy.
+     */
+    private fun ensureForegroundLeaseWatchdog() {
+        if (foregroundLeaseWatchdog != null) return
+        foregroundLeaseWatchdog =
+            scope.launch {
+                while (true) {
+                    delay(FOREGROUND_LEASE_CHECK_MS)
+                    synchronized(foregroundLeases) {
+                        val now = SystemClock.elapsedRealtime()
+                        val iterator = foregroundLeases.entries.iterator()
+                        while (iterator.hasNext()) {
+                            val entry = iterator.next()
+                            if (now - entry.value > FOREGROUND_LEASE_TTL_MS) {
+                                Log.w("NappletBrokerService", "Foreground lease ${entry.key} expired (host process gone?); releasing hold")
+                                iterator.remove()
+                                SandboxForegroundHold.release()
+                            }
+                        }
+                    }
+                }
+            }
+    }
+
+    /**
+     * The broker for the *currently* signed-in account, cached and rebuilt only when the account
+     * changes (reference identity). The gateways capture the account and read its flows live, so a
+     * cached broker stays correct across requests without per-request allocation.
+     */
+    @Synchronized
+    private fun broker(): NappletBroker? {
+        val account = Amethyst.instance.sessionManager.loggedInAccount() ?: return null
+        cachedBroker?.let { (acc, broker) -> if (acc === account) return broker }
+        val broker =
+            AccountNappletGateways(
+                account = account,
+                context = applicationContext,
+                ledger = ledger,
+                storage = storage,
+                // Per-applet Tor decision (see NappletResourceFetcher): the shared manager routes
+                // through Tor when asked + active, and falls back to clearnet otherwise.
+                httpClient = { useProxy -> Amethyst.instance.okHttpClients.getHttpClient(useProxy) },
+                signerLedger = signerLedger,
+            ).broker()
+        cachedBroker = account to broker
+        return broker
+    }
+
+    /**
+     * Brings the main activity (a `singleInstance`) forward at the Connected Apps detail for [coordinate],
+     * via the in-process `connectedapp?coordinate=` deep link that [com.vitorpamplona.amethyst.ui.uriToRoute]
+     * resolves. Used when a full-screen sandbox surface taps "Manage permissions".
+     */
+    private fun openConnectedAppDetail(coordinate: String) {
+        val intent =
+            Intent(applicationContext, MainActivity::class.java).apply {
+                addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                data = Uri.parse("nostr:connectedapp?coordinate=" + Uri.encode(coordinate))
+            }
+        runCatching { applicationContext.startActivity(intent) }
+            .onFailure { Log.w("NappletBrokerService", "Could not open Connected Apps detail", it) }
+    }
+
+    private fun reply(
+        replyTo: Messenger,
+        requestId: String,
+        payload: String,
+    ) {
+        val response =
+            Message.obtain(null, NappletIpc.MSG_RESPONSE).apply {
+                data =
+                    Bundle().apply {
+                        putString(NappletIpc.KEY_REQUEST_ID, requestId)
+                        putString(NappletIpc.KEY_PAYLOAD, payload)
+                    }
+            }
+        try {
+            replyTo.send(response)
+        } catch (e: RemoteException) {
+            Log.w("NappletBrokerService", "Applet host went away before reply could be delivered", e)
+        }
+    }
+
+    /** Sends an unsolicited push (a `relay.event`/`relay.eose` envelope) for the host to forward verbatim. */
+    private fun push(
+        replyTo: Messenger,
+        payload: String,
+    ) {
+        val message =
+            Message.obtain(null, NappletIpc.MSG_PUSH).apply {
+                data = Bundle().apply { putString(NappletIpc.KEY_PAYLOAD, payload) }
+            }
+        try {
+            replyTo.send(message)
+        } catch (e: RemoteException) {
+            Log.w("NappletBrokerService", "Applet host went away before push could be delivered", e)
+        }
+    }
+
+    companion object {
+        /**
+         * Sentinel "author" for a browser-mode per-origin identity. The real key is the visited origin,
+         * carried in the identity's identifier (which the consent dialog shows); this constant only fills
+         * the coordinate's author slot so each origin keys the permission ledger separately as
+         * `browser:<origin>`. It is never treated as a real pubkey.
+         */
+        private const val BROWSER_IDENTITY_AUTHOR = "browser"
+
+        /**
+         * How long a foreground lease stays valid without a renewing heartbeat. A live host re-reports
+         * every [NappletHostActivity.FOREGROUND_HEARTBEAT_MS][com.vitorpamplona.amethyst.napplethost.NappletHostActivity]
+         * (well under this), so only a host that's actually gone lets its lease age past it. Sized to
+         * tolerate a couple of missed/delayed heartbeats while still reaping a dead host's hold promptly.
+         */
+        private const val FOREGROUND_LEASE_TTL_MS = 90_000L
+
+        /** How often [ensureForegroundLeaseWatchdog] sweeps for stale leases. */
+        private const val FOREGROUND_LEASE_CHECK_MS = 20_000L
+
+        /**
+         * Cap on concurrent foreground leases. A foreground lease only keeps Tor/relays up (no key
+         * access), but this bounds how long a misbehaving sandbox can pin the network by spamming
+         * distinct lease keys. Comfortably above any realistic number of foreground sandbox surfaces.
+         */
+        private const val MAX_FOREGROUND_LEASES = 8
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletCapabilityLabels.kt

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import androidx.annotation.StringRes
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.napplet.NappletCapability
+
+/** Localized display name for a capability, shared by the consent dialog and the permissions screen. */
+@StringRes
+fun NappletCapability.labelRes(): Int =
+    when (this) {
+        NappletCapability.SHELL -> R.string.napplet_cap_shell
+        NappletCapability.IDENTITY -> R.string.napplet_cap_identity
+        NappletCapability.KEYS -> R.string.napplet_cap_keys
+        NappletCapability.RELAY -> R.string.napplet_cap_relay
+        NappletCapability.STORAGE -> R.string.napplet_cap_storage
+        NappletCapability.VALUE -> R.string.napplet_cap_value
+        NappletCapability.RESOURCE -> R.string.napplet_cap_resource
+        NappletCapability.UPLOAD -> R.string.napplet_cap_upload
+        NappletCapability.THEME -> R.string.napplet_cap_theme
+        NappletCapability.NOTIFY -> R.string.napplet_cap_notify
+        NappletCapability.INC -> R.string.napplet_cap_inc
+    }
+
+/** Localized one-line description of what a capability lets a napplet do. */
+@StringRes
+fun NappletCapability.descriptionRes(): Int =
+    when (this) {
+        NappletCapability.SHELL -> R.string.napplet_cap_shell_desc
+        NappletCapability.IDENTITY -> R.string.napplet_cap_identity_desc
+        NappletCapability.KEYS -> R.string.napplet_cap_keys_desc
+        NappletCapability.RELAY -> R.string.napplet_cap_relay_desc
+        NappletCapability.STORAGE -> R.string.napplet_cap_storage_desc
+        NappletCapability.VALUE -> R.string.napplet_cap_value_desc
+        NappletCapability.RESOURCE -> R.string.napplet_cap_resource_desc
+        NappletCapability.UPLOAD -> R.string.napplet_cap_upload_desc
+        NappletCapability.THEME -> R.string.napplet_cap_theme_desc
+        NappletCapability.NOTIFY -> R.string.napplet_cap_notify_desc
+        NappletCapability.INC -> R.string.napplet_cap_inc_desc
+    }

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletConnectActivity.kt

@@ -0,0 +1,288 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Button
+import androidx.compose.material3.ButtonDefaults
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalConfiguration
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.window.Dialog
+import androidx.compose.ui.window.DialogProperties
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteAppIcon
+import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
+import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.commons.napplet.signers.AppConnectResult
+import com.vitorpamplona.amethyst.commons.napplet.signers.AppSignerPolicy
+import com.vitorpamplona.amethyst.ui.theme.AmethystTheme
+
+class NappletConnectActivity : ComponentActivity() {
+    private var token: String? = null
+    private var decided = false
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val token = intent.getStringExtra(NappletConnectCoordinator.EXTRA_TOKEN)
+        this.token = token
+        val info = token?.let { NappletConnectCoordinator.infoFor(it) }
+        if (token == null || info == null) {
+            finish()
+            return
+        }
+
+        setContent {
+            AmethystTheme {
+                NappletConnectScreen(
+                    info = info,
+                    onConnect = { policy ->
+                        decided = true
+                        NappletConnectCoordinator.complete(token, AppConnectResult.Connected(policy))
+                        finish()
+                    },
+                    onBlock = {
+                        decided = true
+                        NappletConnectCoordinator.complete(token, AppConnectResult.Blocked)
+                        finish()
+                    },
+                    onCancel = {
+                        decided = true
+                        NappletConnectCoordinator.complete(token, AppConnectResult.Cancelled)
+                        finish()
+                    },
+                )
+            }
+        }
+    }
+
+    override fun finish() {
+        if (!decided) token?.let { NappletConnectCoordinator.cancel(it) }
+        super.finish()
+    }
+}
+
+@Composable
+private fun NappletConnectScreen(
+    info: NappletConnectInfo,
+    onConnect: (AppSignerPolicy) -> Unit,
+    onBlock: () -> Unit,
+    onCancel: () -> Unit,
+) {
+    var selected by remember { mutableStateOf(AppSignerPolicy.REASONABLE) }
+    val maxHeight = LocalConfiguration.current.screenHeightDp.dp * 0.9f
+
+    Dialog(
+        onDismissRequest = onCancel,
+        properties = DialogProperties(usePlatformDefaultWidth = false),
+    ) {
+        Surface(
+            modifier =
+                Modifier
+                    .fillMaxWidth()
+                    .padding(horizontal = 16.dp)
+                    .heightIn(max = maxHeight),
+            shape = MaterialTheme.shapes.extraLarge,
+            color = MaterialTheme.colorScheme.surface,
+            tonalElevation = 6.dp,
+        ) {
+            Column(
+                modifier =
+                    Modifier
+                        .verticalScroll(rememberScrollState())
+                        .padding(vertical = 24.dp),
+            ) {
+                // Centered header: icon + app name + connect subtitle
+                Column(
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    horizontalAlignment = Alignment.CenterHorizontally,
+                    verticalArrangement = Arrangement.spacedBy(8.dp),
+                ) {
+                    val isBrowser = info.coordinate.startsWith("browser:")
+                    FavoriteAppIcon(
+                        app =
+                            if (isBrowser) {
+                                FavoriteApp.WebApp(info.coordinate.substringAfter(':'), info.appletTitle, 0L, info.iconUrl)
+                            } else {
+                                FavoriteApp.NostrApp(info.coordinate, info.appletTitle, 0L, info.iconUrl)
+                            },
+                        tint = MaterialTheme.colorScheme.onPrimaryContainer,
+                        modifier = Modifier.size(56.dp),
+                    )
+                    Text(
+                        info.appletTitle,
+                        style = MaterialTheme.typography.titleLarge,
+                        textAlign = TextAlign.Center,
+                    )
+                    Text(
+                        stringResource(R.string.napplet_connect_subtitle),
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        textAlign = TextAlign.Center,
+                    )
+                    Text(
+                        info.domain,
+                        style = MaterialTheme.typography.labelSmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        textAlign = TextAlign.Center,
+                    )
+                }
+
+                Spacer(Modifier.height(16.dp))
+                HorizontalDivider()
+                Spacer(Modifier.height(12.dp))
+
+                Text(
+                    stringResource(R.string.napplet_connect_how_handle),
+                    style = MaterialTheme.typography.bodyMedium,
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                )
+                Spacer(Modifier.height(8.dp))
+
+                // Trust level options
+                Column(
+                    modifier = Modifier.padding(horizontal = 24.dp),
+                    verticalArrangement = Arrangement.spacedBy(8.dp),
+                ) {
+                    PolicyOption(
+                        selected = selected == AppSignerPolicy.FULL_TRUST,
+                        icon = "❤",
+                        label = stringResource(R.string.napplet_policy_full_trust),
+                        description = stringResource(R.string.napplet_policy_full_trust_desc),
+                        onClick = { selected = AppSignerPolicy.FULL_TRUST },
+                    )
+                    PolicyOption(
+                        selected = selected == AppSignerPolicy.REASONABLE,
+                        icon = "👍",
+                        label = stringResource(R.string.napplet_policy_reasonable),
+                        description = stringResource(R.string.napplet_policy_reasonable_desc),
+                        onClick = { selected = AppSignerPolicy.REASONABLE },
+                    )
+                    PolicyOption(
+                        selected = selected == AppSignerPolicy.PARANOID,
+                        icon = "🕶",
+                        label = stringResource(R.string.napplet_policy_paranoid),
+                        description = stringResource(R.string.napplet_policy_paranoid_desc),
+                        onClick = { selected = AppSignerPolicy.PARANOID },
+                    )
+                }
+
+                Spacer(Modifier.height(16.dp))
+                HorizontalDivider()
+                Spacer(Modifier.height(8.dp))
+
+                Row(
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    horizontalArrangement = Arrangement.spacedBy(12.dp),
+                ) {
+                    OutlinedButton(onClick = onCancel, modifier = Modifier.weight(1f)) {
+                        Text(stringResource(R.string.cancel))
+                    }
+                    Button(onClick = { onConnect(selected) }, modifier = Modifier.weight(1f)) {
+                        Text(stringResource(R.string.napplet_connect_button))
+                    }
+                }
+
+                OutlinedButton(
+                    onClick = onBlock,
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
+                ) {
+                    Text(
+                        stringResource(R.string.napplet_connect_block, info.domain),
+                        style = MaterialTheme.typography.bodyMedium,
+                    )
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun PolicyOption(
+    selected: Boolean,
+    icon: String,
+    label: String,
+    description: String,
+    onClick: () -> Unit,
+) {
+    val borderColor = if (selected) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.outline.copy(alpha = 0.3f)
+    val bgColor = if (selected) MaterialTheme.colorScheme.primaryContainer.copy(alpha = 0.2f) else MaterialTheme.colorScheme.surface
+
+    Surface(
+        modifier =
+            Modifier
+                .fillMaxWidth()
+                .border(width = if (selected) 2.dp else 1.dp, color = borderColor, shape = RoundedCornerShape(12.dp))
+                .clickable(onClick = onClick),
+        shape = RoundedCornerShape(12.dp),
+        color = bgColor,
+    ) {
+        Row(
+            modifier = Modifier.padding(16.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.spacedBy(12.dp),
+        ) {
+            Text(icon, style = MaterialTheme.typography.headlineSmall)
+            Column(modifier = Modifier.weight(1f)) {
+                Text(label, style = MaterialTheme.typography.titleSmall, color = MaterialTheme.colorScheme.onSurface)
+                Text(description, style = MaterialTheme.typography.bodySmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
+            }
+            if (selected) {
+                Icon(
+                    symbol = MaterialSymbols.Check,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.primary,
+                )
+            }
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletConnectCoordinator.kt

@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import android.content.Intent
+import com.vitorpamplona.amethyst.commons.napplet.signers.AppConnectResult
+import kotlinx.coroutines.CompletableDeferred
+import java.util.UUID
+import java.util.concurrent.ConcurrentHashMap
+
+/** Everything the "Connect to Nostr" dialog needs to render. */
+data class NappletConnectInfo(
+    val appletTitle: String,
+    val coordinate: String,
+    val domain: String,
+    val iconUrl: String? = null,
+)
+
+/**
+ * Bridges the broker to the "Connect to Nostr" first-connect UI. Suspends in [requestConnect];
+ * the Activity resolves the deferred with the user's choice.
+ * A dismissed dialog resolves to [AppConnectResult.Cancelled] — fails closed, no silent grant.
+ */
+object NappletConnectCoordinator {
+    private class Pending(
+        val info: NappletConnectInfo,
+        val deferred: CompletableDeferred<AppConnectResult>,
+    )
+
+    private val pending = ConcurrentHashMap<String, Pending>()
+
+    suspend fun requestConnect(
+        context: Context,
+        info: NappletConnectInfo,
+    ): AppConnectResult {
+        val token = UUID.randomUUID().toString()
+        val deferred = CompletableDeferred<AppConnectResult>()
+        pending[token] = Pending(info, deferred)
+
+        context.startActivity(
+            Intent(context, NappletConnectActivity::class.java)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                .putExtra(EXTRA_TOKEN, token),
+        )
+
+        return try {
+            deferred.await()
+        } finally {
+            pending.remove(token)
+        }
+    }
+
+    fun infoFor(token: String): NappletConnectInfo? = pending[token]?.info
+
+    fun complete(
+        token: String,
+        result: AppConnectResult,
+    ) {
+        pending[token]?.deferred?.complete(result)
+    }
+
+    fun cancel(token: String) {
+        pending[token]?.deferred?.complete(AppConnectResult.Cancelled)
+    }
+
+    const val EXTRA_TOKEN = "napplet_connect_token"
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletConsentActivity.kt

@@ -0,0 +1,241 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.text.selection.SelectionContainer
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Button
+import androidx.compose.material3.ButtonDefaults
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalConfiguration
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.window.Dialog
+import androidx.compose.ui.window.DialogProperties
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteAppIcon
+import com.vitorpamplona.amethyst.commons.napplet.permissions.GrantState
+import com.vitorpamplona.amethyst.ui.theme.AmethystTheme
+
+/**
+ * The capability-consent dialog, shown in the **main** process (the only place trusted to
+ * make a grant). It renders the [NappletConsentInfo] for a pending request and reports the
+ * user's [GrantState] back through [NappletConsentCoordinator]. The untrusted applet never
+ * sees or drives this UI.
+ */
+class NappletConsentActivity : ComponentActivity() {
+    private var token: String? = null
+    private var decided = false
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        val token = intent.getStringExtra(NappletConsentCoordinator.EXTRA_TOKEN)
+        this.token = token
+        val info = token?.let { NappletConsentCoordinator.infoFor(it) }
+
+        if (token == null || info == null) {
+            finish()
+            return
+        }
+
+        setContent {
+            AmethystTheme {
+                NappletConsentDialog(
+                    info = info,
+                    onDecision = { grant ->
+                        decided = true
+                        NappletConsentCoordinator.complete(token, grant)
+                        finish()
+                    },
+                    onDismiss = {
+                        decided = true
+                        NappletConsentCoordinator.cancel(token)
+                        finish()
+                    },
+                )
+            }
+        }
+    }
+
+    override fun finish() {
+        // If the system tears us down before the user chose, fail closed.
+        if (!decided) token?.let { NappletConsentCoordinator.cancel(it) }
+        super.finish()
+    }
+}
+
+@Composable
+private fun NappletConsentDialog(
+    info: NappletConsentInfo,
+    onDecision: (GrantState) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    val maxHeight = LocalConfiguration.current.screenHeightDp.dp * 0.85f
+
+    Dialog(
+        onDismissRequest = onDismiss,
+        properties = DialogProperties(usePlatformDefaultWidth = false),
+    ) {
+        Surface(
+            modifier =
+                Modifier
+                    .fillMaxWidth()
+                    .padding(horizontal = 16.dp)
+                    .heightIn(max = maxHeight),
+            shape = MaterialTheme.shapes.extraLarge,
+            color = MaterialTheme.colorScheme.surface,
+            tonalElevation = 6.dp,
+        ) {
+            Column(
+                modifier =
+                    Modifier
+                        .verticalScroll(rememberScrollState())
+                        .padding(vertical = 24.dp),
+            ) {
+                // Centered header: icon + app name + capability category + coordinate
+                Column(
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    horizontalAlignment = Alignment.CenterHorizontally,
+                    verticalArrangement = Arrangement.spacedBy(8.dp),
+                ) {
+                    val isBrowser = info.coordinate.startsWith("browser:")
+                    FavoriteAppIcon(
+                        app =
+                            if (isBrowser) {
+                                FavoriteApp.WebApp(info.coordinate.substringAfter(':'), info.appletTitle, 0L, info.iconUrl)
+                            } else {
+                                FavoriteApp.NostrApp(info.coordinate, info.appletTitle, 0L, info.iconUrl)
+                            },
+                        tint = MaterialTheme.colorScheme.onPrimaryContainer,
+                        modifier = Modifier.size(56.dp),
+                    )
+                    Text(
+                        info.appletTitle,
+                        style = MaterialTheme.typography.titleLarge,
+                        textAlign = TextAlign.Center,
+                    )
+                    Text(
+                        info.capabilityLabel,
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        textAlign = TextAlign.Center,
+                    )
+                    Text(
+                        info.coordinate.substringAfter(':', "").ifBlank { info.coordinate.substringBefore(':').take(12) + "…" },
+                        style = MaterialTheme.typography.labelSmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        textAlign = TextAlign.Center,
+                    )
+                }
+
+                // Operation detail box (may include content preview)
+                if (info.operationSummary.isNotBlank()) {
+                    Spacer(Modifier.height(12.dp))
+                    Surface(
+                        modifier = Modifier.padding(horizontal = 24.dp).fillMaxWidth(),
+                        color = MaterialTheme.colorScheme.surfaceVariant,
+                        shape = MaterialTheme.shapes.medium,
+                    ) {
+                        SelectionContainer {
+                            Text(
+                                info.operationSummary,
+                                modifier = Modifier.padding(12.dp),
+                                style = MaterialTheme.typography.bodySmall,
+                            )
+                        }
+                    }
+                }
+
+                Spacer(Modifier.height(16.dp))
+                HorizontalDivider()
+                Spacer(Modifier.height(8.dp))
+
+                if (info.allowAlways) {
+                    Button(
+                        onClick = { onDecision(GrantState.ALLOW_ALWAYS) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_consent_allow_always))
+                    }
+                    OutlinedButton(
+                        onClick = { onDecision(GrantState.ALLOW_ONCE) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_consent_allow_once))
+                    }
+                } else {
+                    Button(
+                        onClick = { onDecision(GrantState.ALLOW_ONCE) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_consent_allow_once))
+                    }
+                }
+
+                Spacer(Modifier.height(4.dp))
+                HorizontalDivider()
+                Spacer(Modifier.height(8.dp))
+
+                OutlinedButton(
+                    onClick = { onDecision(GrantState.ASK) },
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                ) {
+                    Text(
+                        stringResource(R.string.napplet_consent_not_now),
+                        style = MaterialTheme.typography.bodyMedium,
+                    )
+                }
+                OutlinedButton(
+                    onClick = { onDecision(GrantState.DENY) },
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
+                ) {
+                    Text(
+                        stringResource(R.string.napplet_consent_deny_always),
+                        style = MaterialTheme.typography.bodyMedium,
+                    )
+                }
+            }
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletConsentCoordinator.kt

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import android.content.Intent
+import com.vitorpamplona.amethyst.commons.napplet.permissions.GrantState
+import kotlinx.coroutines.CompletableDeferred
+import java.util.UUID
+import java.util.concurrent.ConcurrentHashMap
+
+/** Everything the consent dialog needs to describe what an applet is asking permission to do. */
+data class NappletConsentInfo(
+    val appletTitle: String,
+    val coordinate: String,
+    val capabilityLabel: String,
+    val operationSummary: String,
+    /** Whether a persistent "Always allow" choice may be offered (false for per-use caps like payments). */
+    val allowAlways: Boolean,
+    val iconUrl: String? = null,
+)
+
+/**
+ * Bridges the main-process broker to the consent UI. The broker suspends in
+ * [requestConsent]; this launches [NappletConsentActivity], holds the pending decision keyed
+ * by a one-time token, and resolves it when the activity reports the user's choice.
+ *
+ * A dismissed dialog resolves to [GrantState.ASK] — i.e. "not authorized, ask again next
+ * time" — so closing the prompt never silently grants nor permanently blocks.
+ */
+object NappletConsentCoordinator {
+    private class Pending(
+        val info: NappletConsentInfo,
+        val deferred: CompletableDeferred<GrantState>,
+    )
+
+    private val pending = ConcurrentHashMap<String, Pending>()
+
+    suspend fun requestConsent(
+        context: Context,
+        info: NappletConsentInfo,
+    ): GrantState {
+        val token = UUID.randomUUID().toString()
+        val deferred = CompletableDeferred<GrantState>()
+        pending[token] = Pending(info, deferred)
+
+        val intent =
+            Intent(context, NappletConsentActivity::class.java)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                .putExtra(EXTRA_TOKEN, token)
+        context.startActivity(intent)
+
+        return try {
+            deferred.await()
+        } finally {
+            pending.remove(token)
+        }
+    }
+
+    /** Called by [NappletConsentActivity] to render the prompt. */
+    fun infoFor(token: String): NappletConsentInfo? = pending[token]?.info
+
+    /** Called by [NappletConsentActivity] with the user's decision. */
+    fun complete(
+        token: String,
+        grant: GrantState,
+    ) {
+        pending[token]?.deferred?.complete(grant)
+    }
+
+    /** Called when the dialog is dismissed without a choice — fails closed (no grant). */
+    fun cancel(token: String) {
+        pending[token]?.deferred?.complete(GrantState.ASK)
+    }
+
+    const val EXTRA_TOKEN = "napplet_consent_token"
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletConsentSummary.kt

@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.browser.OmniboxInput
+import com.vitorpamplona.amethyst.commons.napplet.NappletCapability
+import com.vitorpamplona.amethyst.commons.napplet.NappletIdentity
+import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletRequest
+import com.vitorpamplona.amethyst.favorites.BrowserIconRegistry
+import com.vitorpamplona.amethyst.ui.pluralStringRes
+import com.vitorpamplona.quartz.lightning.LnInvoiceUtil
+
+/**
+ * Turns a pending [NappletRequest] into the human-readable [NappletConsentInfo] the consent dialog
+ * shows — the applet's title, the capability label, and a per-operation summary (e.g. a note preview
+ * or a sat amount). Localized via app resources; holds only a [Context], no account state.
+ */
+class NappletConsentSummary(
+    private val context: Context,
+) {
+    fun info(
+        identity: NappletIdentity,
+        capability: NappletCapability,
+        request: NappletRequest,
+    ): NappletConsentInfo {
+        val untitled = context.getString(R.string.napplet_fallback_title, identity.authorPubKey.take(8))
+        val (title, iconUrl) =
+            if (identity.authorPubKey == "browser") {
+                val host = OmniboxInput.hostOf(identity.identifier) ?: identity.identifier
+                host to BrowserIconRegistry.iconModelFor(host)
+            } else {
+                resolveNappletMeta(identity.authorPubKey, identity.identifier, untitled)
+            }
+        return NappletConsentInfo(
+            appletTitle = title,
+            coordinate = identity.coordinate,
+            capabilityLabel = context.getString(capability.labelRes()),
+            operationSummary = summaryFor(request),
+            allowAlways = capability.canGrantAlways,
+            iconUrl = iconUrl,
+        )
+    }
+
+    private fun summaryFor(request: NappletRequest): String =
+        when (request) {
+            is NappletRequest.GetPublicKey -> context.getString(R.string.napplet_consent_get_pubkey)
+            is NappletRequest.IdentityRead -> context.getString(R.string.napplet_consent_identity_read)
+            is NappletRequest.Publish -> {
+                val preview = request.content.take(160).trim()
+                if (preview.isEmpty()) {
+                    context.getString(R.string.napplet_consent_publish, request.kind)
+                } else {
+                    context.getString(R.string.napplet_consent_publish_preview, request.kind) + "\n“$preview”"
+                }
+            }
+            is NappletRequest.SignEvent -> {
+                val preview = request.content.take(160).trim()
+                if (preview.isEmpty()) {
+                    context.getString(R.string.napplet_consent_sign, request.kind)
+                } else {
+                    context.getString(R.string.napplet_consent_sign, request.kind) + "\n“$preview”"
+                }
+            }
+            is NappletRequest.PublishEncrypted -> context.getString(R.string.napplet_consent_publish_encrypted)
+            is NappletRequest.QueryEvents, is NappletRequest.Subscribe -> context.getString(R.string.napplet_consent_query)
+            is NappletRequest.StorageGet, is NappletRequest.StorageSet, is NappletRequest.StorageRemove, is NappletRequest.StorageKeys ->
+                context.getString(R.string.napplet_consent_storage)
+            is NappletRequest.NotifyCreate -> {
+                val preview = request.title.take(80).trim()
+                if (preview.isEmpty()) context.getString(R.string.napplet_consent_notify) else context.getString(R.string.napplet_consent_notify) + "\n“$preview”"
+            }
+            is NappletRequest.NotifyList, is NappletRequest.NotifyDismiss -> context.getString(R.string.napplet_consent_notify)
+            is NappletRequest.PayInvoice -> {
+                val sats = runCatching { LnInvoiceUtil.getAmountInSats(request.invoice).toLong() }.getOrNull()
+                if (sats != null) {
+                    pluralStringRes(context, R.plurals.napplet_consent_pay_amount, sats.toInt(), sats)
+                } else {
+                    context.getString(R.string.napplet_consent_pay)
+                }
+            }
+            is NappletRequest.ResourceBytes -> context.getString(R.string.napplet_consent_resource)
+            is NappletRequest.UploadBlob -> context.getString(R.string.napplet_consent_upload)
+            // Resolved in the broker before consent (negotiation / shell-mediated / cosmetic); never shown.
+            is NappletRequest.ShellSupports, is NappletRequest.RegisterAction, is NappletRequest.UnregisterAction, is NappletRequest.ThemeGet -> ""
+        }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletIdentityWatch.kt

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletProtocolJson
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.drop
+import kotlinx.coroutines.launch
+
+/**
+ * Streams `identity.changed` pushes to an applet that registered `napplet.identity.onChanged`. It
+ * collects the active user's public key ([pubKey]) and, on every *subsequent* change (the current
+ * value is dropped — the applet already has it via `getPublicKey`), encodes and pushes the new key
+ * (or `""` when no account is signed in) to the caller-supplied sink.
+ *
+ * One watch at a time per host binding; [start] replaces any prior one. Reached only after the
+ * router confirmed the applet declared the IDENTITY capability.
+ */
+class NappletIdentityWatch(
+    private val scope: CoroutineScope,
+    private val pubKey: () -> Flow<String>,
+) {
+    private var job: Job? = null
+
+    fun start(push: (String) -> Unit) {
+        stop()
+        job =
+            scope.launch {
+                pubKey()
+                    .distinctUntilChanged()
+                    .drop(1)
+                    .collect { push(NappletProtocolJson.encodeIdentityChanged(it)) }
+            }
+    }
+
+    fun stop() {
+        job?.cancel()
+        job = null
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletIncBus.kt

@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.os.Messenger
+import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletProtocolJson
+
+/**
+ * The NAP `inc` bus: a topic pub/sub that fans an `inc.emit` out to **other** napplet sessions
+ * subscribed to that topic as an `inc.event` push (never echoing back to the sender). Lives in the
+ * main-process broker service, which is the single point every sandbox session binds to, so it can
+ * route between them.
+ *
+ * Subscribers are keyed by their reply [Messenger] (one per live napplet host). A napplet must have
+ * declared the `inc` capability to subscribe or emit (enforced by the router before we get here).
+ *
+ * NOTE: Amethyst runs napplets **foreground-only, one at a time**, so in practice two sessions rarely
+ * overlap and cross-napplet delivery is usually a no-op — but the bus is correct if they ever do.
+ * The bus is app-wide (not scoped per author), so it deliberately allows different napplets to talk;
+ * a future refinement could namespace topics by author if cross-napplet isolation is wanted.
+ */
+class NappletIncBus(
+    private val deliver: (Messenger, String) -> Unit,
+) {
+    // topic -> the reply Messengers of the napplet sessions subscribed to it.
+    private val subscribers = HashMap<String, MutableSet<Messenger>>()
+
+    @Synchronized
+    fun subscribe(
+        who: Messenger,
+        topic: String,
+    ) {
+        subscribers.getOrPut(topic) { mutableSetOf() }.add(who)
+    }
+
+    @Synchronized
+    fun unsubscribe(
+        who: Messenger,
+        topic: String,
+    ) {
+        subscribers[topic]?.let { set ->
+            set.remove(who)
+            if (set.isEmpty()) subscribers.remove(topic)
+        }
+    }
+
+    /** Delivers an `inc.event` for [topic] to every subscriber except [from] (no self-echo). */
+    @Synchronized
+    fun emit(
+        from: Messenger,
+        sender: String,
+        topic: String,
+        payloadRaw: String,
+    ) {
+        val set = subscribers[topic] ?: return
+        if (set.isEmpty()) return
+        val envelope = NappletProtocolJson.encodeIncEvent(topic, payloadRaw, sender)
+        set.filter { it != from }.forEach { deliver(it, envelope) }
+    }
+
+    /** Drops [who] from every topic (e.g. when its napplet host goes away). */
+    @Synchronized
+    fun removeAll(who: Messenger) {
+        val empties = mutableListOf<String>()
+        for ((topic, set) in subscribers) {
+            set.remove(who)
+            if (set.isEmpty()) empties.add(topic)
+        }
+        empties.forEach { subscribers.remove(it) }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletLaunchRegistry.kt

@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import com.vitorpamplona.amethyst.commons.napplet.NappletCapability
+import com.vitorpamplona.amethyst.commons.napplet.NappletIdentity
+import com.vitorpamplona.quartz.nip01Core.core.toHexKey
+import java.security.SecureRandom
+
+/**
+ * Main-process registry that binds a sandbox launch to its **trusted** identity + declared capability
+ * set, addressed by an unguessable launch token.
+ *
+ * Why: the broker (main process) must know *which* napplet a brokered request belongs to, but the
+ * request travels up from the sandboxed `:napplet` process, which is the very thing we don't fully
+ * trust (a WebView/renderer escape runs code there). If the identity rode along inside each IPC
+ * message, a compromised sandbox could simply claim another napplet's coordinate and read/act as it.
+ *
+ * Instead, [NappletLauncher] (main process) mints a random token here at launch time, hands only that
+ * token to the sandbox, and the broker resolves it back to the identity it was registered with. The
+ * sandbox only ever holds *its own* token, so even a fully compromised `:napplet` process can act as
+ * nothing but the napplet it was launched as.
+ *
+ * Both the launcher and [NappletBrokerService] run in the main process, so they share this singleton.
+ */
+object NappletLaunchRegistry {
+    data class Session(
+        val identity: NappletIdentity,
+        val declared: Set<NappletCapability>,
+    )
+
+    // Access-ordered + capped so tokens from long-closed napplets can't accumulate without bound. The
+    // active napplet always re-touches its token, so only stale sessions are ever evicted.
+    private const val MAX_SESSIONS = 128
+    private val sessions =
+        object : LinkedHashMap<String, Session>(16, 0.75f, true) {
+            override fun removeEldestEntry(eldest: Map.Entry<String, Session>) = size > MAX_SESSIONS
+        }
+    private val secureRandom = SecureRandom()
+
+    @Synchronized
+    fun register(
+        identity: NappletIdentity,
+        declared: Set<NappletCapability>,
+    ): String {
+        val token = ByteArray(32).also(secureRandom::nextBytes).toHexKey()
+        sessions[token] = Session(identity, declared)
+        return token
+    }
+
+    @Synchronized
+    fun resolve(token: String?): Session? = token?.let { sessions[it] }
+
+    @Synchronized
+    fun unregister(token: String?) {
+        token?.let { sessions.remove(it) }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletLauncher.kt

@@ -0,0 +1,161 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import android.content.Intent
+import android.content.res.Configuration
+import android.os.Bundle
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.amethyst.commons.napplet.NappletIdentity
+import com.vitorpamplona.amethyst.model.LocalCache
+import com.vitorpamplona.amethyst.model.ThemeType
+import com.vitorpamplona.amethyst.napplethost.HostProfile
+import com.vitorpamplona.amethyst.napplethost.NappletHostActivity
+import com.vitorpamplona.amethyst.napplethost.NappletHostContract
+import com.vitorpamplona.quartz.nip01Core.core.HexKey
+import com.vitorpamplona.quartz.nip5aStaticWebsites.tags.PathTag
+import com.vitorpamplona.quartz.nip5dNapplets.NappletManifest
+import com.vitorpamplona.quartz.nipB7Blossom.BlossomServersEvent
+
+/**
+ * Opens a napplet/nsite in the sandboxed [NappletHostActivity] (the `:napplet` process). Only
+ * the verified manifest data the host needs to render and broker for the applet is passed —
+ * the declared `path → hash` map, the Blossom servers, the applet's identity coordinate, the
+ * declared capabilities, and a display title. No account state crosses into the sandbox process.
+ */
+object NappletLauncher {
+    /** Opens a NIP-5D napplet, forwarding its declared capabilities to the broker. */
+    fun launch(
+        context: Context,
+        manifest: NappletManifest,
+        authorPubKey: HexKey,
+        identifier: String,
+    ) = launch(
+        context = context,
+        paths = manifest.paths(),
+        servers = manifest.servers(),
+        authorPubKey = authorPubKey,
+        identifier = identifier,
+        aggregateHash = manifest.declaredAggregateHash() ?: manifest.computeAggregateHash(),
+        title = manifest.title() ?: identifier.ifBlank { "Napplet" },
+        requires = manifest.requires(),
+    )
+
+    /**
+     * Opens any NIP-5A static site (nsite or napplet). [requires] is empty for a plain nsite —
+     * the broker then refuses every capability, so the site renders as inert static content.
+     */
+    fun launch(
+        context: Context,
+        paths: List<PathTag>,
+        servers: List<String>,
+        authorPubKey: HexKey,
+        identifier: String,
+        aggregateHash: HexKey?,
+        title: String,
+        requires: List<String>,
+        // nSites open as [HostProfile.WEBSITE]: a NIP-07 window.nostr provider + normal network. The
+        // broker then grants the IDENTITY + RELAY capabilities NIP-07 needs (consent-gated), regardless
+        // of the (empty) manifest `requires`. Napplets keep the default locked [HostProfile.NAPPLET].
+        profile: HostProfile = HostProfile.NAPPLET,
+    ) {
+        val params = buildLaunchParams(context, paths, servers, authorPubKey, identifier, aggregateHash, title, requires, profile)
+        val intent =
+            Intent(context, NappletHostActivity::class.java).apply {
+                putExtras(params)
+                if (context !is android.app.Activity) addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+            }
+        context.startActivity(intent)
+    }
+
+    /**
+     * Builds the verified launch parameters — minting the launch token, augmenting the Blossom server
+     * set, resolving the per-site Tor choice and capability labels — as a [Bundle] keyed by the
+     * [NappletHostContract] EXTRA_* names. Used both for the activity intent (above) and for the
+     * embedded [com.vitorpamplona.amethyst.napplethost.NappletHostService] session (carried over
+     * Messenger), so the two host paths launch from identical, main-process-minted parameters.
+     */
+    fun buildLaunchParams(
+        context: Context,
+        paths: List<PathTag>,
+        servers: List<String>,
+        authorPubKey: HexKey,
+        identifier: String,
+        aggregateHash: HexKey?,
+        title: String,
+        requires: List<String>,
+        profile: HostProfile,
+    ): Bundle {
+        val proxyPort = Amethyst.instance.torManager.activePortOrNull.value ?: -1
+
+        // Augment the manifest's servers with the author's published Blossom list (kind:10063), if
+        // we already hold it, so a blob the manifest's servers dropped can still be fetched. The
+        // host re-verifies every blob's sha256, so a wrong/extra server can never inject content.
+        val authorBlossomServers =
+            runCatching {
+                (LocalCache.getAddressableNoteIfExists(BlossomServersEvent.createAddressTag(authorPubKey))?.event as? BlossomServersEvent)?.servers()
+            }.getOrNull().orEmpty()
+        val allServers = (servers + authorBlossomServers).distinct()
+
+        // Mint the launch token in the (trusted) main process: the broker resolves the sandbox's
+        // requests back to THIS identity + declared set, regardless of anything the sandbox sends.
+        val identity = NappletIdentity(authorPubKey = authorPubKey, identifier = identifier, aggregateHash = aggregateHash)
+        val declared = profile.declaredCapabilities(requires)
+        val launchToken = NappletLaunchRegistry.register(identity, declared)
+
+        // Resolve the per-site network choice (Tor default; a site can be opted out to the open web).
+        // Locked napplets always keep Tor for their blob fetches — only nSites expose the toggle.
+        NappletNetworkRegistry.init(context.applicationContext)
+        val useTor = if (profile.exposesNetwork) NappletNetworkRegistry.useTor(identity.coordinate) else true
+
+        // Resolve capability labels here (the app has the resources) so the sandbox module needs none.
+        val capLabels = declared.map { context.getString(it.labelRes()) }
+
+        val themeType = Amethyst.instance.uiPrefs.value.theme.value
+        val theme =
+            when (themeType) {
+                ThemeType.DARK -> "DARK"
+                ThemeType.LIGHT -> "LIGHT"
+                ThemeType.SYSTEM -> {
+                    val nightMask = context.resources.configuration.uiMode and Configuration.UI_MODE_NIGHT_MASK
+                    if (nightMask == Configuration.UI_MODE_NIGHT_YES) "DARK" else "LIGHT"
+                }
+            }
+
+        return Bundle().apply {
+            putStringArrayList(NappletHostContract.EXTRA_PATHS, ArrayList(paths.map { it.path }))
+            putStringArrayList(NappletHostContract.EXTRA_HASHES, ArrayList(paths.map { it.hash }))
+            putStringArrayList(NappletHostContract.EXTRA_SERVERS, ArrayList(allServers))
+            putString(NappletHostContract.EXTRA_AUTHOR, authorPubKey)
+            putString(NappletHostContract.EXTRA_IDENTIFIER, identifier)
+            putString(NappletHostContract.EXTRA_AGGREGATE_HASH, aggregateHash)
+            putString(NappletHostContract.EXTRA_TITLE, title)
+            putStringArrayList(NappletHostContract.EXTRA_REQUIRES, ArrayList(requires))
+            putStringArrayList(NappletHostContract.EXTRA_CAP_LABELS, ArrayList(capLabels))
+            putString(NappletHostContract.EXTRA_LAUNCH_TOKEN, launchToken)
+            putInt(NappletHostContract.EXTRA_PROXY_PORT, proxyPort)
+            putString(NappletHostContract.EXTRA_HOST_PROFILE, profile.name)
+            putBoolean(NappletHostContract.EXTRA_USE_TOR, useTor)
+            putString(NappletHostContract.EXTRA_THEME, theme)
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletLiveSubscriptions.kt

@@ -0,0 +1,119 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletProtocolJson
+import com.vitorpamplona.amethyst.model.Account
+import com.vitorpamplona.quartz.nip01Core.core.Event
+import com.vitorpamplona.quartz.nip01Core.relay.client.INostrClient
+import com.vitorpamplona.quartz.nip01Core.relay.client.reqs.SubscriptionListener
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip01Core.relay.normalizer.NormalizedRelayUrl
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.atomic.AtomicBoolean
+import java.util.concurrent.atomic.AtomicInteger
+
+/**
+ * The registry of live relay subscriptions an applet has open, keyed by its `subId`. Each entry
+ * holds the exact [INostrClient] that opened it, so teardown unsubscribes from the right account
+ * even after an account switch, plus an EOSE latch so a multi-relay subscription emits a single
+ * `relay.eose`. Encodes the `relay.event`/`relay.eose`/`relay.closed` pushes and hands them to the
+ * caller-supplied sink — it never touches the transport itself.
+ *
+ * [account] is read live (so it always targets the currently signed-in account); [open] is reached
+ * only after the broker authorized the subscription (RELAY consent).
+ */
+class NappletLiveSubscriptions(
+    private val account: () -> Account?,
+) {
+    private val liveSubs = ConcurrentHashMap<String, LiveSub>()
+    private val liveSeq = AtomicInteger(0)
+
+    private class LiveSub(
+        val clientSubId: String,
+        val client: INostrClient,
+    ) {
+        val eoseSent = AtomicBoolean(false)
+    }
+
+    /**
+     * Opens a live relay subscription for [nappletSubId], streaming `relay.event`/`relay.eose`/
+     * `relay.closed` envelopes to [push] as events arrive. Replaces any existing subscription for
+     * the same id. With no account/relays/filters it pushes a single empty EOSE to close it.
+     */
+    fun open(
+        nappletSubId: String,
+        filters: List<Filter>,
+        push: (String) -> Unit,
+    ) {
+        val account = account()
+        val relays = account?.homeRelays?.flow?.value ?: emptySet()
+        if (account == null || filters.isEmpty() || relays.isEmpty()) {
+            push(NappletProtocolJson.encodeRelayEose(nappletSubId))
+            return
+        }
+
+        close(nappletSubId)
+        // liveSeq guarantees a unique client subId, so a rapid re-open of the same applet subId
+        // can't collide with the subscription it's replacing.
+        val sub = LiveSub("napplet-$nappletSubId-${liveSeq.incrementAndGet()}", account.client)
+        liveSubs[nappletSubId] = sub
+
+        val listener =
+            object : SubscriptionListener {
+                override fun onEvent(
+                    event: Event,
+                    isLive: Boolean,
+                    relay: NormalizedRelayUrl,
+                    forFilters: List<Filter>?,
+                ) = push(NappletProtocolJson.encodeRelayEvent(nappletSubId, event))
+
+                // A subscription fans out to several relays; collapse their EOSEs into the single
+                // relay.eose the SDK expects (fired when the first relay finishes its stored events).
+                override fun onEose(
+                    relay: NormalizedRelayUrl,
+                    forFilters: List<Filter>?,
+                ) {
+                    if (sub.eoseSent.compareAndSet(false, true)) push(NappletProtocolJson.encodeRelayEose(nappletSubId))
+                }
+
+                override fun onClosed(
+                    message: String,
+                    relay: NormalizedRelayUrl,
+                    forFilters: List<Filter>?,
+                ) = push(NappletProtocolJson.encodeRelayClosed(nappletSubId, message))
+            }
+
+        runCatching { sub.client.subscribe(sub.clientSubId, relays.associateWith { filters }, listener) }
+    }
+
+    /** Stops the live subscription for [nappletSubId], unsubscribing from the client that opened it. */
+    fun close(nappletSubId: String) {
+        val sub = liveSubs.remove(nappletSubId) ?: return
+        runCatching { sub.client.unsubscribe(sub.clientSubId) }
+    }
+
+    /** Tears down every open subscription (service teardown). */
+    fun closeAll() {
+        liveSubs.values.forEach { sub -> runCatching { sub.client.unsubscribe(sub.clientSubId) } }
+        liveSubs.clear()
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletManifestLookup.kt

@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.quartz.nip01Core.relay.filters.Filter
+import com.vitorpamplona.quartz.nip5aStaticWebsites.NamedSiteEvent
+import com.vitorpamplona.quartz.nip5aStaticWebsites.RootSiteEvent
+import com.vitorpamplona.quartz.nip5dNapplets.NamedNappletEvent
+import com.vitorpamplona.quartz.nip5dNapplets.NappletManifest
+import com.vitorpamplona.quartz.nip5dNapplets.RootNappletEvent
+
+/**
+ * Looks up the best-effort human title and icon URL for a napplet or nsite from the local cache.
+ * Falls back to the d-identifier or [untitled] when no manifest is cached.
+ */
+fun resolveNappletMeta(
+    author: String,
+    identifier: String,
+    untitled: String,
+): Pair<String, String?> {
+    val events =
+        Amethyst.instance.cache
+            .filter(
+                Filter(
+                    kinds = listOf(RootNappletEvent.KIND, NamedNappletEvent.KIND, RootSiteEvent.KIND, NamedSiteEvent.KIND),
+                    authors = listOf(author),
+                ),
+            ).mapNotNull { it.event }
+    val match =
+        events.firstOrNull { ev ->
+            when (ev) {
+                is NamedNappletEvent -> ev.identifier() == identifier
+                is RootNappletEvent -> identifier.isEmpty()
+                is NamedSiteEvent -> ev.identifier() == identifier
+                is RootSiteEvent -> identifier.isEmpty()
+                else -> false
+            }
+        }
+    val title =
+        when (match) {
+            is NappletManifest -> match.title()
+            is RootSiteEvent -> match.title()
+            is NamedSiteEvent -> match.title()
+            else -> null
+        }?.ifBlank { null } ?: identifier.ifBlank { untitled }
+    val iconUrl =
+        when (match) {
+            is NappletManifest -> match.icon()
+            is RootSiteEvent -> match.icon()
+            is NamedSiteEvent -> match.icon()
+            else -> null
+        }?.ifBlank { null }
+    return title to iconUrl
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletNetworkRegistry.kt

@@ -0,0 +1,103 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.launch
+import java.util.concurrent.ConcurrentHashMap
+
+private val Context.nappletNetworkDataStore by preferencesDataStore(name = "napplet_network")
+
+/**
+ * Per-nSite network-routing preference: whether a site's traffic goes through **Tor** (the default)
+ * or over the **open web**. Keyed by the site's coordinate (`author:identifier`), like the permission
+ * ledger, so the choice survives across launches and routine code updates.
+ *
+ * When Tor is active, nSites route through it by default; a user can opt a specific site out (e.g. a
+ * site that breaks or is unusably slow over Tor) from the sandbox top bar. "Open web" makes
+ * *everything* for that site direct — both its live web traffic and its blob fetches.
+ *
+ * An in-memory map is authoritative for the session ([NappletLauncher] reads it synchronously while
+ * building the launch intent) with write-through persistence. Absent = Tor (the safe default), so a
+ * site never silently starts on the open web before the on-disk preference has hydrated.
+ *
+ * Lives only in the **main process**: the launcher reads it, and [NappletBrokerService] writes it
+ * when the key-free `:napplet` sandbox relays a toggle over IPC. The sandbox never touches it.
+ */
+object NappletNetworkRegistry {
+    private const val OPEN_WEB = "OPEN"
+    private const val TOR = "TOR"
+
+    // coordinate -> useTor. Absent means "never chosen" -> Tor.
+    private val modes = ConcurrentHashMap<String, Boolean>()
+    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+
+    @Volatile private var appContext: Context? = null
+
+    @Volatile private var hydration: Job? = null
+
+    /** Binds the app context and hydrates the on-disk preferences into memory. Idempotent. */
+    fun init(context: Context) {
+        if (appContext != null) return
+        val ctx = context.applicationContext
+        appContext = ctx
+        hydration =
+            scope.launch {
+                ctx.nappletNetworkDataStore.data.first().asMap().forEach { (key, value) ->
+                    // putIfAbsent: never clobber a choice made in this session before hydration finished.
+                    modes.putIfAbsent(key.name, value != OPEN_WEB)
+                }
+            }
+    }
+
+    /**
+     * Suspends until [init]'s on-disk hydration has finished, so [useTor] reflects the user's remembered
+     * per-site choices instead of the bare Tor default. The startup preloader awaits this before making
+     * any routing decision, so a site the user pinned to the open web isn't wrongly treated as Tor on a
+     * cold start. Returns at once once hydrated, or immediately if [init] was never called.
+     */
+    suspend fun awaitReady() {
+        hydration?.join()
+    }
+
+    /** Whether [coordinate] routes through Tor. Defaults to true (Tor) for any site never set. */
+    fun useTor(coordinate: String): Boolean = modes[coordinate] ?: true
+
+    /** Records [useTor] for [coordinate] in memory and persists it. */
+    fun set(
+        coordinate: String,
+        useTor: Boolean,
+    ) {
+        modes[coordinate] = useTor
+        val ctx = appContext ?: return
+        scope.launch {
+            ctx.nappletNetworkDataStore.edit { it[stringPreferencesKey(coordinate)] = if (useTor) TOR else OPEN_WEB }
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletNotificationStore.kt

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import com.vitorpamplona.amethyst.commons.napplet.NappletNotification
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.atomic.AtomicLong
+
+/**
+ * Per-coordinate registry of the notifications a napplet created via the NAP `notify` domain. Lives
+ * in the main process (the broker's process) and survives broker rebuilds on account switch, so a
+ * napplet's `notify.list`/`notify.dismiss` see the same set it created.
+ *
+ * Namespaced by applet coordinate, like [DataStoreNappletStorage]: a napplet can only ever see and
+ * dismiss its **own** notifications. In-memory only — notifications are ephemeral UI, not durable state.
+ */
+object NappletNotificationStore {
+    // coordinate -> (id -> notification), insertion-ordered so list() is stable.
+    private val byCoordinate = ConcurrentHashMap<String, LinkedHashMap<String, NappletNotification>>()
+    private val seq = AtomicLong(0)
+
+    fun create(
+        coordinate: String,
+        title: String,
+        body: String,
+    ): String {
+        val id = "n${System.currentTimeMillis()}-${seq.incrementAndGet()}"
+        val map = byCoordinate.getOrPut(coordinate) { LinkedHashMap() }
+        synchronized(map) { map[id] = NappletNotification(id, title, body) }
+        return id
+    }
+
+    fun list(coordinate: String): List<NappletNotification> {
+        val map = byCoordinate[coordinate] ?: return emptyList()
+        return synchronized(map) { map.values.toList() }
+    }
+
+    fun dismiss(
+        coordinate: String,
+        id: String,
+    ) {
+        val map = byCoordinate[coordinate] ?: return
+        synchronized(map) { map.remove(id) }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletSignerConsentActivity.kt

@@ -0,0 +1,325 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.compose.foundation.horizontalScroll
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.text.selection.SelectionContainer
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Button
+import androidx.compose.material3.ButtonDefaults
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalConfiguration
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.window.Dialog
+import androidx.compose.ui.window.DialogProperties
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteApp
+import com.vitorpamplona.amethyst.commons.favorites.FavoriteAppIcon
+import com.vitorpamplona.amethyst.commons.icons.symbols.Icon
+import com.vitorpamplona.amethyst.commons.icons.symbols.MaterialSymbols
+import com.vitorpamplona.amethyst.commons.napplet.signers.SignerOpGrant
+import com.vitorpamplona.amethyst.ui.theme.AmethystTheme
+import com.vitorpamplona.quartz.utils.TimeUtils
+
+class NappletSignerConsentActivity : ComponentActivity() {
+    private var token: String? = null
+    private var decided = false
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val token = intent.getStringExtra(NappletSignerConsentCoordinator.EXTRA_TOKEN)
+        this.token = token
+        val info = token?.let { NappletSignerConsentCoordinator.infoFor(it) }
+        if (token == null || info == null) {
+            finish()
+            return
+        }
+
+        setContent {
+            AmethystTheme {
+                NappletSignerConsentDialog(
+                    info = info,
+                    onGrant = { grant ->
+                        decided = true
+                        NappletSignerConsentCoordinator.complete(token, grant)
+                        finish()
+                    },
+                    onDismiss = {
+                        decided = true
+                        NappletSignerConsentCoordinator.cancel(token)
+                        finish()
+                    },
+                )
+            }
+        }
+    }
+
+    override fun finish() {
+        if (!decided) token?.let { NappletSignerConsentCoordinator.cancel(it) }
+        super.finish()
+    }
+}
+
+@Composable
+private fun NappletSignerConsentDialog(
+    info: NappletSignerConsentInfo,
+    onGrant: (SignerOpGrant) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    var showRawData by remember { mutableStateOf(false) }
+    var showMoreOptions by remember { mutableStateOf(false) }
+    val scrollState = rememberScrollState()
+    val maxHeight = LocalConfiguration.current.screenHeightDp.dp * 0.85f
+
+    Dialog(
+        onDismissRequest = onDismiss,
+        properties = DialogProperties(usePlatformDefaultWidth = false),
+    ) {
+        Surface(
+            modifier =
+                Modifier
+                    .fillMaxWidth()
+                    .padding(horizontal = 16.dp)
+                    .heightIn(max = maxHeight),
+            shape = MaterialTheme.shapes.extraLarge,
+            color = MaterialTheme.colorScheme.surface,
+            tonalElevation = 6.dp,
+        ) {
+            Column(
+                modifier =
+                    Modifier
+                        .verticalScroll(scrollState)
+                        .padding(vertical = 24.dp),
+            ) {
+                // Centered header: icon + title + description
+                Column(
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    horizontalAlignment = Alignment.CenterHorizontally,
+                    verticalArrangement = Arrangement.spacedBy(8.dp),
+                ) {
+                    val isBrowser = info.coordinate.startsWith("browser:")
+                    FavoriteAppIcon(
+                        app =
+                            if (isBrowser) {
+                                FavoriteApp.WebApp(info.coordinate.substringAfter(':'), info.appletTitle, 0L, info.iconUrl)
+                            } else {
+                                FavoriteApp.NostrApp(info.coordinate, info.appletTitle, 0L, info.iconUrl)
+                            },
+                        tint = MaterialTheme.colorScheme.onPrimaryContainer,
+                        modifier = Modifier.size(56.dp),
+                    )
+                    Text(
+                        info.appletTitle,
+                        style = MaterialTheme.typography.titleLarge,
+                        textAlign = TextAlign.Center,
+                    )
+                    Text(
+                        stringResource(R.string.napplet_consent_wants_to, info.operationSummary),
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        textAlign = TextAlign.Center,
+                    )
+                    Text(
+                        info.coordinate.substringAfter(':', "").ifBlank { info.coordinate.substringBefore(':').take(12) + "…" },
+                        style = MaterialTheme.typography.labelSmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        textAlign = TextAlign.Center,
+                    )
+                }
+
+                val hasContent = info.contentPreview.isNotBlank() || info.rawData.isNotBlank()
+                if (hasContent) {
+                    Spacer(Modifier.height(12.dp))
+                    Surface(
+                        modifier =
+                            Modifier
+                                .padding(horizontal = 24.dp)
+                                .fillMaxWidth(),
+                        color = MaterialTheme.colorScheme.surfaceVariant,
+                        shape = MaterialTheme.shapes.medium,
+                    ) {
+                        Column(modifier = Modifier.padding(12.dp)) {
+                            if (info.contentPreview.isNotBlank()) {
+                                Text(
+                                    "“${info.contentPreview}”",
+                                    style = MaterialTheme.typography.bodySmall,
+                                )
+                            }
+                            if (info.rawData.isNotBlank()) {
+                                if (showRawData) {
+                                    Spacer(Modifier.height(8.dp))
+                                    Box(modifier = Modifier.horizontalScroll(rememberScrollState())) {
+                                        SelectionContainer {
+                                            Text(
+                                                info.rawData,
+                                                style =
+                                                    MaterialTheme.typography.labelSmall.copy(
+                                                        fontFamily = FontFamily.Monospace,
+                                                    ),
+                                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                                softWrap = false,
+                                            )
+                                        }
+                                    }
+                                }
+                                TextButton(
+                                    onClick = { showRawData = !showRawData },
+                                    contentPadding = PaddingValues(horizontal = 4.dp, vertical = 0.dp),
+                                ) {
+                                    Text(
+                                        if (showRawData) {
+                                            stringResource(R.string.napplet_consent_hide_event)
+                                        } else {
+                                            stringResource(R.string.napplet_consent_show_event)
+                                        },
+                                        style = MaterialTheme.typography.labelSmall,
+                                    )
+                                }
+                            }
+                        }
+                    }
+                }
+
+                Spacer(Modifier.height(16.dp))
+                HorizontalDivider()
+                Spacer(Modifier.height(8.dp))
+
+                // Primary: always allow this op
+                Button(
+                    onClick = { onGrant(SignerOpGrant.AllowForOp(info.op)) },
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                ) {
+                    Text(stringResource(R.string.napplet_consent_allow_always))
+                }
+
+                // Secondary: allow just once
+                OutlinedButton(
+                    onClick = { onGrant(SignerOpGrant.AllowOnce) },
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                ) {
+                    Text(stringResource(R.string.napplet_signer_allow_once))
+                }
+
+                // "More options" toggle: session and time-bound grants
+                TextButton(
+                    onClick = { showMoreOptions = !showMoreOptions },
+                    modifier = Modifier.fillMaxWidth(),
+                    contentPadding = PaddingValues(horizontal = 24.dp, vertical = 8.dp),
+                ) {
+                    Row(
+                        verticalAlignment = Alignment.CenterVertically,
+                        horizontalArrangement = Arrangement.spacedBy(4.dp),
+                    ) {
+                        Text(
+                            if (showMoreOptions) {
+                                stringResource(R.string.napplet_consent_fewer_options)
+                            } else {
+                                stringResource(R.string.napplet_consent_more_options)
+                            },
+                            style = MaterialTheme.typography.bodyMedium,
+                        )
+                        Icon(
+                            if (showMoreOptions) MaterialSymbols.ExpandLess else MaterialSymbols.ExpandMore,
+                            contentDescription = null,
+                            modifier = Modifier.size(18.dp),
+                        )
+                    }
+                }
+
+                if (showMoreOptions) {
+                    OutlinedButton(
+                        onClick = { onGrant(SignerOpGrant.AllowForSession(info.op)) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_signer_allow_session))
+                    }
+                    OutlinedButton(
+                        onClick = { onGrant(SignerOpGrant.AllowUntil(info.op, TimeUtils.now() + 86_400L)) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_signer_allow_24h))
+                    }
+                    OutlinedButton(
+                        onClick = { onGrant(SignerOpGrant.AllowUntil(info.op, TimeUtils.now() + 30L * 86_400L)) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_signer_allow_30d))
+                    }
+                    OutlinedButton(
+                        onClick = { onGrant(SignerOpGrant.AllowAll) },
+                        modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    ) {
+                        Text(stringResource(R.string.napplet_signer_allow_all))
+                    }
+                }
+
+                Spacer(Modifier.height(4.dp))
+                HorizontalDivider()
+                Spacer(Modifier.height(8.dp))
+
+                OutlinedButton(
+                    onClick = { onGrant(SignerOpGrant.DenyOnce) },
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
+                ) {
+                    Text(stringResource(R.string.napplet_signer_deny_once))
+                }
+                OutlinedButton(
+                    onClick = { onGrant(SignerOpGrant.DenyForOp(info.op)) },
+                    modifier = Modifier.fillMaxWidth().padding(horizontal = 24.dp),
+                    colors = ButtonDefaults.outlinedButtonColors(contentColor = MaterialTheme.colorScheme.error),
+                ) {
+                    Text(stringResource(R.string.napplet_signer_deny_op, info.operationSummary))
+                }
+            }
+        }
+    }
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NappletSignerConsentCoordinator.kt

@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import android.content.Intent
+import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerOp
+import com.vitorpamplona.amethyst.commons.napplet.signers.SignerOpGrant
+import kotlinx.coroutines.CompletableDeferred
+import java.util.UUID
+import java.util.concurrent.ConcurrentHashMap
+
+/** Everything the per-operation consent dialog needs to render. */
+data class NappletSignerConsentInfo(
+    val appletTitle: String,
+    val coordinate: String,
+    val op: NostrSignerOp,
+    val operationSummary: String,
+    /** Short excerpt shown in the dialog body (≤ 160 chars). */
+    val contentPreview: String,
+    /**
+     * Full raw content for the "See more" toggle — event JSON for sign/encrypt operations,
+     * decrypted plaintext for decrypt (Amethyst decrypts first, then asks permission to expose).
+     */
+    val rawData: String = "",
+    val iconUrl: String? = null,
+)
+
+/**
+ * Bridges the broker to the per-operation signer consent UI.
+ * A dismissed dialog resolves to [SignerOpGrant.DenyOnce] — fails closed.
+ */
+object NappletSignerConsentCoordinator {
+    private class Pending(
+        val info: NappletSignerConsentInfo,
+        val deferred: CompletableDeferred<SignerOpGrant>,
+    )
+
+    private val pending = ConcurrentHashMap<String, Pending>()
+
+    suspend fun requestConsent(
+        context: Context,
+        info: NappletSignerConsentInfo,
+    ): SignerOpGrant {
+        val token = UUID.randomUUID().toString()
+        val deferred = CompletableDeferred<SignerOpGrant>()
+        pending[token] = Pending(info, deferred)
+
+        context.startActivity(
+            Intent(context, NappletSignerConsentActivity::class.java)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                .putExtra(EXTRA_TOKEN, token),
+        )
+
+        return try {
+            deferred.await()
+        } finally {
+            pending.remove(token)
+        }
+    }
+
+    fun infoFor(token: String): NappletSignerConsentInfo? = pending[token]?.info
+
+    fun complete(
+        token: String,
+        grant: SignerOpGrant,
+    ) {
+        pending[token]?.deferred?.complete(grant)
+    }
+
+    fun cancel(token: String) {
+        pending[token]?.deferred?.complete(SignerOpGrant.DenyOnce)
+    }
+
+    const val EXTRA_TOKEN = "napplet_signer_consent_token"
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/NostrSignerOpLabels.kt

@@ -0,0 +1,118 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import android.content.Context
+import com.vitorpamplona.amethyst.R
+import com.vitorpamplona.amethyst.commons.browser.OmniboxInput
+import com.vitorpamplona.amethyst.commons.napplet.NappletIdentity
+import com.vitorpamplona.amethyst.commons.napplet.protocol.NappletRequest
+import com.vitorpamplona.amethyst.commons.napplet.signers.NostrSignerOp
+import com.vitorpamplona.amethyst.favorites.BrowserIconRegistry
+import com.vitorpamplona.amethyst.ui.screen.loggedIn.relays.kindNameFor
+import com.vitorpamplona.quartz.nip01Core.jackson.JacksonMapper
+import com.vitorpamplona.quartz.nip01Core.signers.EventTemplate
+import com.vitorpamplona.quartz.utils.TimeUtils
+
+/** Human-readable label for a [NostrSignerOp]. */
+fun NostrSignerOp.label(context: Context): String =
+    when (this) {
+        is NostrSignerOp.SignKind -> context.getString(R.string.napplet_op_sign_kind_named, kindNameFor(context, kind), kind)
+        NostrSignerOp.Encrypt -> context.getString(R.string.napplet_op_encrypt)
+        NostrSignerOp.Decrypt -> context.getString(R.string.napplet_op_decrypt)
+    }
+
+/** Builds the [NappletSignerConsentInfo] needed by the per-op consent dialog. */
+fun buildSignerConsentInfo(
+    context: Context,
+    identity: NappletIdentity,
+    op: NostrSignerOp,
+    request: NappletRequest,
+): NappletSignerConsentInfo {
+    val untitled = context.getString(R.string.napplet_fallback_title, identity.authorPubKey.take(8))
+    val (title, iconUrl) =
+        if (identity.authorPubKey == "browser") {
+            val host = OmniboxInput.hostOf(identity.identifier) ?: identity.identifier
+            host to BrowserIconRegistry.iconModelFor(host)
+        } else {
+            resolveNappletMeta(identity.authorPubKey, identity.identifier, untitled)
+        }
+    val summary = op.label(context)
+    val preview =
+        when (request) {
+            is NappletRequest.Publish -> request.content.take(160).trim()
+            is NappletRequest.SignEvent -> request.content.take(160).trim()
+            is NappletRequest.PublishEncrypted -> request.content.take(160).trim()
+            else -> ""
+        }
+    val rawData =
+        when (request) {
+            is NappletRequest.Publish ->
+                JacksonMapper.toJsonPretty(EventTemplate<Nothing>(TimeUtils.now(), request.kind, request.tags, request.content))
+            is NappletRequest.SignEvent ->
+                JacksonMapper.toJsonPretty(EventTemplate<Nothing>(request.createdAt, request.kind, request.tags, request.content))
+            is NappletRequest.PublishEncrypted -> {
+                val node = JacksonMapper.mapper.createObjectNode()
+                node.put("kind", request.kind)
+                node.put("recipient", request.recipient)
+                node.put("encryption", request.encryption)
+                val tagsNode = node.putArray("tags")
+                for (tag in request.tags) {
+                    val tagNode = tagsNode.addArray()
+                    for (item in tag) tagNode.add(item)
+                }
+                node.put("content", request.content)
+                JacksonMapper.mapper.writerWithDefaultPrettyPrinter().writeValueAsString(node)
+            }
+            else -> ""
+        }
+    return NappletSignerConsentInfo(
+        appletTitle = title,
+        coordinate = identity.coordinate,
+        op = op,
+        operationSummary = summary,
+        contentPreview = preview,
+        rawData = rawData,
+        iconUrl = iconUrl,
+    )
+}
+
+/** Creates a [NappletConnectInfo] for the first-connect dialog. */
+fun buildConnectInfo(
+    context: Context,
+    identity: NappletIdentity,
+): NappletConnectInfo {
+    val untitled = context.getString(R.string.napplet_fallback_title, identity.authorPubKey.take(8))
+    val (title, iconUrl) =
+        if (identity.authorPubKey == "browser") {
+            val host = OmniboxInput.hostOf(identity.identifier) ?: identity.identifier
+            host to BrowserIconRegistry.iconModelFor(host)
+        } else {
+            resolveNappletMeta(identity.authorPubKey, identity.identifier, untitled)
+        }
+    val domain =
+        if (identity.authorPubKey == "browser") {
+            OmniboxInput.hostOf(identity.identifier) ?: identity.identifier
+        } else {
+            identity.identifier.ifBlank { identity.authorPubKey.take(12) + "…" }
+        }
+    return NappletConnectInfo(appletTitle = title, coordinate = identity.coordinate, domain = domain, iconUrl = iconUrl)
+}

amethyst/src/main/java/com/vitorpamplona/amethyst/napplet/SandboxForegroundHold.kt

@@ -0,0 +1,128 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.napplet
+
+import com.vitorpamplona.amethyst.Amethyst
+import com.vitorpamplona.quartz.utils.Log
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+
+/**
+ * Keeps Amethyst's **main** process in "resumed" resource posture while a full-screen sandbox surface
+ * (a `:napplet`-process browser/napplet/nSite host) is in the foreground.
+ *
+ * The problem it solves: opening one of those full-screen surfaces backgrounds `MainActivity`. Its
+ * Compose collectors (`ManageRelayServices` / `ManageWebOkHttp`) are lifecycle-aware, so they stop —
+ * and the underlying `WhileSubscribed` flows then scale everything down on their timers: Tor's port
+ * after ~2 s, the relay pool after ~30 s, dropping the relay AUTH sessions with it. The user is still
+ * actively using a Nostr surface (the sandbox brokers NIP-07 + relays back through this very process),
+ * so tearing the network down is wrong — the next signed request or relay read pays a full reconnect.
+ *
+ * The fix is a **ref-counted hold**, acquired only while such a surface is foreground. While the count
+ * is > 0 it subscribes to exactly the flows the resumed UI subscribes to — keeping Tor, the relay pool,
+ * and the AUTH sessions up. When the last surface leaves, it releases and normal background scaling
+ * resumes. It deliberately does *not* keep anything alive when nothing is foreground, so the intended
+ * battery/bandwidth scaling is preserved.
+ *
+ * Switching between several sandbox surfaces must not restart the network. Android tears the old
+ * surface down and brings the new one up as `old.onPause() → new.onResume()`, which would dip the
+ * count to 0 and back to 1. To keep the same collectors running straight through that dip, releasing to
+ * 0 only *schedules* the stop after a short [LINGER_MS] linger; a re-acquire within the window cancels
+ * the pending stop and the existing collectors are never even cancelled — so swapping between open
+ * napplets/nSites/browser apps holds Tor + relays + AUTH perfectly steady.
+ *
+ * Embedded favorite tabs need no hold: they render inside `MainActivity`, which stays resumed.
+ *
+ * Threading: [acquire]/[release] are `@Synchronized` and may be called from any thread (Activity main
+ * thread, broker IPC handler). The keep-alive collectors run on [AppModules.applicationIOScope].
+ */
+object SandboxForegroundHold {
+    /**
+     * How long the resource hold lingers after the last sandbox surface backgrounds, before the
+     * collectors are actually torn down. Sized to comfortably bridge an activity-to-activity handoff
+     * (`old.onPause → new.onResume`, plus the async IPC hop for `:napplet` surfaces) so switching
+     * between open surfaces never restarts Tor/relays. A genuine exit still releases after this short
+     * window, restoring normal background scaling.
+     */
+    private const val LINGER_MS = 5_000L
+
+    private var holdCount = 0
+
+    // The live keep-alive collectors. Non-null whenever the resources are being held up (including
+    // during a linger after the count hit 0 but before the scheduled stop fires).
+    private var holdJob: Job? = null
+
+    // The pending teardown scheduled when the count hit 0; cancelled if a surface re-acquires first.
+    private var stopJob: Job? = null
+
+    @Synchronized
+    fun acquire() {
+        holdCount++
+        if (holdCount == 1) {
+            // Cancel any lingering teardown and keep the existing collectors running if they're still
+            // up (the common "switch between two surfaces" path) — only start fresh if fully released.
+            stopJob?.cancel()
+            stopJob = null
+            if (holdJob == null) start()
+        }
+    }
+
+    @Synchronized
+    fun release() {
+        if (holdCount == 0) return
+        holdCount--
+        if (holdCount == 0) scheduleStop()
+    }
+
+    private fun start() {
+        // Only ever invoked in the main process (broker + main-process activities); instance is set.
+        val app = Amethyst.instance
+        Log.d("SandboxForegroundHold", "Holding main-process resources up for a foreground sandbox surface")
+        holdJob =
+            app.applicationIOScope.launch {
+                // Mirror exactly what the resumed UI collects (AccountScreen's ManageRelayServices +
+                // ManageWebOkHttp): keeping these subscribed keeps the relay pool connected (and so the
+                // relay AUTH sessions), and — transitively, via the relay connector's combine and the
+                // okHttp proxy-port provider — keeps Tor up too.
+                launch { app.relayProxyClientConnector.relayServices.collect {} }
+                launch { app.okHttpClients.defaultHttpClient.collect {} }
+                launch { app.okHttpClients.defaultHttpClientWithoutProxy.collect {} }
+            }
+    }
+
+    private fun scheduleStop() {
+        stopJob?.cancel()
+        stopJob =
+            Amethyst.instance.applicationIOScope.launch {
+                delay(LINGER_MS)
+                synchronized(this@SandboxForegroundHold) {
+                    // A surface may have re-acquired while we waited; only tear down if still released.
+                    if (holdCount == 0) {
+                        Log.d("SandboxForegroundHold", "No foreground sandbox surface for ${LINGER_MS}ms; releasing the resource hold")
+                        holdJob?.cancel()
+                        holdJob = null
+                    }
+                    stopJob = null
+                }
+            }
+    }
+}