Made of little things.

# Map editor intents

The editor receives optional NAP-INTENT deliveries through the official
`@napplet/sdk` `intent.onDelivery` API. The runtime buffers deliveries until the
receiver registers. Missing INTENT leaves ordinary editor controls available.
There is no custom message receiver, INC bridge or URL launch-payload channel.

The advertised archetype is `black-site`; its actions are `map-edit`, `map-open`,
`map-remix` and `map-new`. These are application conventions over existing
NAP-INTENT, not new NAPs or
numbered payload formats. Manifest discovery advertises exact queryless names.

| Convention                     | Payload              | Behavior                                                                                                    |
| ------------------------------ | -------------------- | ----------------------------------------------------------------------------------------------------------- |
| `napplet:black-site/map-edit`  | `{address, relays?}` | Load a canonical published map through OUTBOX/RESOURCE; only its signed author may update it.               |
| `napplet:black-site/map-remix` | `{address, relays?}` | Load a published map and create a new ID under the connected player's identity, preserving remix lineage.   |
| `napplet:black-site/map-open`  | `{address, relays?}` | Open the map; use edit for its author and offer remix for another player's map.                             |
| `napplet:black-site/map-new`   | `{map?}`             | Start a new local map, optionally from validated map JSON. No publication base or signed event is accepted. |

`address` is exactly `35858:<64 lowercase hex author>:<map id>`; map IDs use the
game's lowercase letters/digits/hyphens rule and are at most 32 characters.
`relays` is optional, at most eight public WSS DNS-host URLs on port 443, with no
credentials/fragments. Hints do not bypass host relay policy. Duplicate URLs are
normalized and deduplicated. Published-target payloads are bounded to 4 KiB.
New-map JSON must pass the complete Black Site map validator and its serialized
UTF-8 size must not exceed 256 KiB. Unknown payload fields are rejected.

All delivered data is untrusted. The runtime supplies `sender` as a source label;
it never grants ownership or authorizes updates. Signed event data is loaded
through OUTBOX, and RESOURCE bytes must match its hash and schema. Source-provided
signed events cannot bypass those reads. Identity, unsaved-work confirmation,
request cancellation and workspace replacement are handled by the editor UI;
receiving an intent does not automatically publish anything.

Caller example using current official SDK:

```ts
import { intent } from '@napplet/sdk';

const result = await intent.invoke('napplet:black-site/map-edit', {
  payload: {
    address: `35858:${mapAuthor}:${mapId}`,
    relays: ['wss://relay.example.com'],
  },
});
if (!result.ok) showError(result.error);
```

For a local handoff:

```ts
await intent.invoke('napplet:black-site/map-new', { payload: { map: validatedMap } });
```

`result.ok` means the runtime accepted responsibility for delivery. It does not
prove the target already opened, loaded or edited the map. There is no target
acknowledgement or `handled` field in this current contract. The convention is
matched exactly; queried convention strings are not accepted as inbound identity.

The editor now uses SDK 0.29.0 (NAP/core 0.33.0), which implements `onDelivery`.
The adjacent soyLI source now installs shim0.31/core0.33 and implements the
INTENT workspace broker, verified catalog installation, default/chooser UI and
retained cold delivery. The original game invokes this editor with the current
URI API. A real source-host browser test installs a signed editor manifest and
proves game EDIT → broker → newly created editor with the correct published map.

The installed CLI and publicly deployed website are separate releases. Use the
updated source CLI for local preview; do not claim deployed support from source
tests. See [host integration](map-host-integration.md).