diff --git a/README.md b/README.md
index 003ead9..02842c1 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,7 @@ Browser → RelayKit App → Dokploy API
 | Strfry          | [hoytech/strfry](https://github.com/hoytech/strfry) | |
 | Blossom         | [hzrd149/blossom](https://github.com/hzrd149/blossom) | |
 | nPanel          | [hzrd149/nsite-gateway](https://github.com/hzrd149/nsite-gateway) | Static sites on Nostr (NIP-5A) plus same-domain NIP-05 responses. Deploys nsite-gateway, a NIP-05 JSON sidecar, and a Caddy sidecar that serves `/.well-known/nostr.json` while rewriting `Host` for gateway traffic. |
+| Compute DVM     | [`app/presets/dvm-compute/worker/`](app/presets/dvm-compute/worker/) | Programmable, caching DVM (NIP-90): runs whitelisted Nostr code snippets (NIP-C0) in a quickjs sandbox and publishes cached results (`kind:31338`) clients read instead of crawling raw events. |
 
 ## Project Structure
 
@@ -184,6 +185,12 @@ issues:
 - [ ] dns check in prod not working right
 
 next:
+- [ ] data functions
+   - [ ] code ui rendering
+   - [ ] info to help query the new data
+   - [ ] human readable ttls
+   - [ ] runtime logs per run?
+   - [ ] fork a 1337/31337
 - [ ] convey real deployment status in UI (not assumed success) - especially as it starts up, to know when it's "ready"
    - [ ] inc adding a new service, doesn't appear immediately in the ui
    - [ ] restart ui option. 
diff --git a/app/frontend/src/components/RelayInput.tsx b/app/frontend/src/components/RelayInput.tsx
new file mode 100644
index 0000000..1a9047d
--- /dev/null
+++ b/app/frontend/src/components/RelayInput.tsx
@@ -0,0 +1,121 @@
+import { useEffect, useState, type ReactNode } from 'react';
+import { ActionIcon, Group, TagsInput, Text } from '@mantine/core';
+import { IconX } from '@tabler/icons-react';
+import { trpc } from '../trpc';
+import { isRelayType } from '../../../shared/serviceType';
+
+// normalize a host/url to a ws(s) url
+export const toWs = (url: string): string => {
+  const u = url.trim();
+  if (!u) return '';
+  if (u.startsWith('ws://') || u.startsWith('wss://')) return u;
+  if (u.startsWith('http://')) return 'ws://' + u.slice('http://'.length);
+  if (u.startsWith('https://')) return 'wss://' + u.slice('https://'.length);
+  return 'wss://' + u;
+};
+
+// relays the user has typed before, remembered across sessions
+const RELAY_HISTORY_KEY = 'relaykit:relay-history';
+const loadRelayHistory = (): string[] => {
+  try {
+    const r = JSON.parse(localStorage.getItem(RELAY_HISTORY_KEY) || '[]');
+    return Array.isArray(r) ? r.filter((x) => typeof x === 'string') : [];
+  } catch {
+    return [];
+  }
+};
+const rememberRelays = (relays: string[]): string[] => {
+  const merged = [...new Set([...relays, ...loadRelayHistory()].map((r) => r.trim()).filter(Boolean))].slice(0, 30);
+  localStorage.setItem(RELAY_HISTORY_KEY, JSON.stringify(merged));
+  return merged;
+};
+
+type RelayInputProps = {
+  label?: ReactNode;
+  description?: string;
+  placeholder?: string;
+  value: string[];
+  onChange: (relays: string[]) => void;
+  // single relay (renders as one chip) vs many
+  multiple?: boolean;
+  required?: boolean;
+};
+
+// Shared relay picker: chips + free entry, a dropdown seeded with this instance's relays plus the
+// user's remembered relays, and an × to forget a remembered one.
+export const RelayInput = ({
+  label,
+  description,
+  placeholder,
+  value,
+  onChange,
+  multiple = true,
+  required,
+}: RelayInputProps) => {
+  const [relayHistory, setRelayHistory] = useState<string[]>(loadRelayHistory);
+  const [appRelays, setAppRelays] = useState<string[]>([]);
+
+  useEffect(() => {
+    let cancelled = false;
+    trpc.listServices
+      .query()
+      .then((services: any[]) => {
+        if (cancelled) return;
+        const urls = services
+          .filter((s) => isRelayType(s.type))
+          .map((s) => s.domains?.[0]?.host ?? s.hostname)
+          .filter((h: string) => h && h !== 'No hostname configured')
+          .map((h: string) => toWs(h));
+        setAppRelays([...new Set(urls)]);
+      })
+      .catch(() => {});
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  const removeFromHistory = (relay: string) => {
+    const next = loadRelayHistory().filter((r) => r !== relay);
+    localStorage.setItem(RELAY_HISTORY_KEY, JSON.stringify(next));
+    setRelayHistory(next);
+  };
+
+  return (
+    <TagsInput
+      label={label}
+      description={description}
+      placeholder={value.length ? '' : placeholder}
+      required={required}
+      value={value}
+      data={[...new Set([...appRelays, ...relayHistory])]}
+      maxTags={multiple ? undefined : 1}
+      clearable
+      splitChars={[',', ' ']}
+      onChange={(vals) => {
+        const cleaned = vals.map(toWs).filter(Boolean);
+        onChange(cleaned);
+        setRelayHistory(rememberRelays(cleaned));
+      }}
+      renderOption={({ option }) => (
+        <Group justify="space-between" wrap="nowrap" w="100%" gap="xs">
+          <Text size="sm" truncate>{option.value}</Text>
+          {!appRelays.includes(option.value) && (
+            <ActionIcon
+              size="sm"
+              variant="subtle"
+              color="gray"
+              aria-label="remove from history"
+              onMouseDown={(e) => {
+                e.preventDefault();
+                e.stopPropagation();
+                removeFromHistory(option.value);
+              }}
+            >
+              <IconX size={13} />
+            </ActionIcon>
+          )}
+        </Group>
+      )}
+    />
+  );
+};
diff --git a/app/frontend/src/components/ServiceConfigPanel.tsx b/app/frontend/src/components/ServiceConfigPanel.tsx
new file mode 100644
index 0000000..f29f5c3
--- /dev/null
+++ b/app/frontend/src/components/ServiceConfigPanel.tsx
@@ -0,0 +1,129 @@
+import { useEffect, useMemo, useState } from 'react';
+import { Alert, Button, Group, Loader, ScrollArea, Stack, Switch, Text, TextInput } from '@mantine/core';
+import { IconAlertTriangle } from '@tabler/icons-react';
+import { toast } from 'sonner';
+import { trpc } from '../trpc';
+import { SERVICE_TYPE, isNpanelType } from '../../../shared/serviceType';
+import { NsiteDeployFields, prepareNsiteConfigForSave } from './NsiteDeployFields';
+
+type Field = { id: string; name: string; description?: string; type?: string; required?: boolean; default?: string };
+
+// The service's deploy-time config (env vars from the preset's requiredConfig), rendered inline
+// as a tab. Saving redeploys the service — same backend path the old modal used.
+export const ServiceConfigPanel = ({ service, onSaved }: { service: any; onSaved?: () => void }) => {
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [fields, setFields] = useState<Field[]>([]);
+  const [values, setValues] = useState<Record<string, string>>({});
+
+  const isNsite = isNpanelType(service?.type);
+
+  useEffect(() => {
+    let cancelled = false;
+    setLoading(true);
+    trpc.getServiceConfig
+      .query({ composeId: service.composeId })
+      .then((res: any) => {
+        if (cancelled) return;
+        setFields(res.fields || []);
+        setValues(res.config || {});
+      })
+      .catch((e: any) => !cancelled && setError(e?.message ?? 'failed to load config'))
+      .finally(() => !cancelled && setLoading(false));
+    return () => {
+      cancelled = true;
+    };
+  }, [service.composeId]);
+
+  const setField = (id: string, value: string) => setValues((v) => ({ ...v, [id]: value }));
+
+  const missingRequired = useMemo(
+    () => !isNsite && fields.some((f) => f.required && f.type !== 'boolean' && !(values[f.id] || '').trim()),
+    [fields, values, isNsite],
+  );
+
+  const save = async () => {
+    setSaving(true);
+    try {
+      const config = isNsite ? prepareNsiteConfigForSave(values) : values;
+      await trpc.updateServiceConfig.mutate({ composeId: service.composeId, config });
+      toast.success('config updated, redeploy started');
+      onSaved?.();
+    } catch (e: any) {
+      toast.error(`failed to update config: ${e?.message ?? e}`);
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  if (loading) {
+    return (
+      <Group gap="xs">
+        <Loader size="sm" />
+        <Text size="sm" c="dimmed">loading config…</Text>
+      </Group>
+    );
+  }
+
+  if (error) {
+    return (
+      <Alert color="red" icon={<IconAlertTriangle size={16} />} title="error">
+        {error}
+      </Alert>
+    );
+  }
+
+  const renderField = (field: Field) => {
+    if (field.type === 'boolean') {
+      const checked = (values[field.id] || String(field.default || 'false')).toLowerCase() === 'true';
+      return (
+        <Switch
+          key={field.id}
+          label={field.name}
+          description={field.description}
+          checked={checked}
+          onChange={(e) => setField(field.id, e.currentTarget.checked ? 'true' : 'false')}
+        />
+      );
+    }
+    return (
+      <TextInput
+        key={field.id}
+        label={field.name}
+        description={field.description}
+        required={field.required}
+        value={values[field.id] ?? String(field.default ?? '')}
+        onChange={(e) => setField(field.id, e.currentTarget.value)}
+      />
+    );
+  };
+
+  return (
+    <ScrollArea.Autosize mah="68vh" type="auto" offsetScrollbars>
+      <Stack gap="md" pr="sm">
+        {fields.length === 0 ? (
+          <Text size="sm" c="dimmed">no editable config for this service.</Text>
+        ) : (
+          <>
+            {isNsite ? (
+              <NsiteDeployFields
+                preset={{ id: SERVICE_TYPE.NPANEL, requiredConfig: fields }}
+                config={values}
+                setConfig={(next: any) => setValues((prev) => (typeof next === 'function' ? next(prev) : next))}
+                ownerPubkeyHex={null}
+              />
+            ) : (
+              fields.map(renderField)
+            )}
+            <Group justify="flex-end">
+              <Button color="green" loading={saving} disabled={saving || missingRequired} onClick={save}>
+                {saving ? 'saving…' : 'save + redeploy'}
+              </Button>
+            </Group>
+          </>
+        )}
+      </Stack>
+    </ScrollArea.Autosize>
+  );
+};
diff --git a/app/frontend/src/components/ServiceDetailsContent.tsx b/app/frontend/src/components/ServiceDetailsContent.tsx
index 764183f..aacf2b9 100644
--- a/app/frontend/src/components/ServiceDetailsContent.tsx
+++ b/app/frontend/src/components/ServiceDetailsContent.tsx
@@ -10,6 +10,8 @@ import { Text, Group, Anchor, Tooltip, ActionIcon, Button, Stack, Badge, Tabs, B
 import { IconExternalLink, IconCheck, IconX, IconAlertOctagon, IconAlertTriangle, IconCircleCheck, IconRefresh, IconPencil } from '@tabler/icons-react';
 import { InlineTextEditRow } from './InlineTextEditRow';
 import { CopyControl } from './CopyControl';
+import { ServiceDetailsScripts } from './ServiceDetailsScripts';
+import { ServiceConfigPanel } from './ServiceConfigPanel';
 import { trpc } from '../trpc';
 import { serviceTypeToRubixLoaderColor } from '../lib/serviceTypeColor';
 import { formatBytes, formatBytesPerSecond, formatPercent, formatWindow, getInsightSeverity, getOverallSeverity, getSeverityColor } from '../../../shared/insights';
@@ -921,6 +923,8 @@ export const ServiceDetailsContent = (props: ServiceDetailsContentProps) => {
   const hasDNS = domain && serverIp;
   const hasInsights = !!service.composeId;
   const hasLogs = !!service.composeId;
+  const hasScripts = !!service.composeId && service.presetId === 'dvm-compute';
+  const hasConfig = !!service.composeId;
   const activePanelBg = colorScheme === 'dark' ? theme.colors.dark[8] : theme.colors.gray[0];
   const panelShadow = colorScheme === 'dark'
     ? '0 4px 12px rgba(0,0,0,0.18)'
@@ -1017,9 +1021,13 @@ export const ServiceDetailsContent = (props: ServiceDetailsContentProps) => {
           >
             <Tabs.List aria-label="Details sections" miw={rem(132)} style={{ flexShrink: 0 }}>
               <Tabs.Tab value="info" style={getTabStyle(section === 'info')}>info</Tabs.Tab>
-              <Tabs.Tab value="dns" style={getTabStyle(section === 'dns')}>dns</Tabs.Tab>
-              <Tabs.Tab value="insights" style={getTabStyle(section === 'insights')}>insights</Tabs.Tab>
+              {!hasScripts && <Tabs.Tab value="dns" style={getTabStyle(section === 'dns')}>dns</Tabs.Tab>}
+              {!hasScripts && <Tabs.Tab value="insights" style={getTabStyle(section === 'insights')}>insights</Tabs.Tab>}
               <Tabs.Tab value="logs" style={getTabStyle(section === 'logs')}>logs</Tabs.Tab>
+              {hasScripts && (
+                <Tabs.Tab value="scripts" style={getTabStyle(section === 'scripts')}>data functions</Tabs.Tab>
+              )}
+              {hasConfig && <Tabs.Tab value="config" style={getTabStyle(section === 'config')}>config</Tabs.Tab>}
             </Tabs.List>
             <Box
               style={{
@@ -1077,6 +1085,24 @@ export const ServiceDetailsContent = (props: ServiceDetailsContentProps) => {
                   </Box>
                 )}
               </Transition>
+              {hasScripts && (
+                <Transition transition="fade" duration={FADE_MS} exitDuration={0} mounted={section === 'scripts'}>
+                  {(tStyle) => (
+                    <Box style={{ ...panelContentStyle, ...tStyle }}>
+                      <ServiceDetailsScripts composeId={service.composeId} />
+                    </Box>
+                  )}
+                </Transition>
+              )}
+              {hasConfig && (
+                <Transition transition="fade" duration={FADE_MS} exitDuration={0} mounted={section === 'config'}>
+                  {(tStyle) => (
+                    <Box style={{ ...panelContentStyle, ...tStyle }}>
+                      <ServiceConfigPanel service={service} />
+                    </Box>
+                  )}
+                </Transition>
+              )}
             </Box>
           </Group>
         </Tabs>
diff --git a/app/frontend/src/components/ServiceDetailsScripts.tsx b/app/frontend/src/components/ServiceDetailsScripts.tsx
new file mode 100644
index 0000000..2c69e97
--- /dev/null
+++ b/app/frontend/src/components/ServiceDetailsScripts.tsx
@@ -0,0 +1,882 @@
+import { useEffect, useState } from 'react';
+import { SimplePool, getPublicKey, nip19 } from 'nostr-tools';
+import type { Event, Filter } from 'nostr-tools';
+import {
+  ActionIcon,
+  Alert,
+  Badge,
+  Button,
+  Card,
+  Code,
+  Divider,
+  Group,
+  Loader,
+  ScrollArea,
+  Select,
+  Stack,
+  Text,
+  TextInput,
+  Textarea,
+  Tooltip,
+} from '@mantine/core';
+import {
+  IconAlertTriangle,
+  IconArrowLeft,
+  IconBolt,
+  IconDatabase,
+  IconPlus,
+  IconRefresh,
+  IconServer,
+  IconTrash,
+  IconUpload,
+} from '@tabler/icons-react';
+import { trpc } from '../trpc';
+import { RelayInput, toWs } from './RelayInput';
+
+// kinds the compute DVM speaks (mirror of dvm-compute/src/kinds.ts)
+const KIND = {
+  codeSnippet: 1337,
+  dataFunction: 31337,
+  jobRequest: 5910,
+  jobResult: 6910,
+  jobFeedback: 7000,
+  cachedResult: 31338,
+} as const;
+
+const BLANK = `async function main(inputs, nostr) {
+  // query nostr, return any json-serializable value
+  const events = await nostr.query([{ kinds: [1], limit: 100 }]);
+  return { count: events.length };
+}`;
+
+const SAMPLE = `async function main(inputs, nostr) {
+  const since = Math.floor(Date.now() / 1000) - 7 * 24 * 60 * 60;
+  const events = await nostr.query([{ kinds: [4223], '#t': ['weather'], since }]);
+  const temps = events
+    .map((e) => e.tags.find((t) => t[0] === 'temp'))
+    .filter(Boolean)
+    .map((t) => parseFloat(t[1]))
+    .filter((n) => !Number.isNaN(n));
+  const avg = temps.length ? temps.reduce((a, b) => a + b, 0) / temps.length : null;
+  return { avg_temp: avg, samples: temps.length, since };
+}`;
+
+const prettyResult = (raw: string): string => {
+  try {
+    return JSON.stringify(JSON.parse(raw), null, 2);
+  } catch {
+    return raw;
+  }
+};
+
+const errMsg = (e: any): string => {
+  if (e?.name === 'AggregateError' && Array.isArray(e.errors)) {
+    const msgs = e.errors.map((x: any) => x?.message || String(x)).filter(Boolean);
+    return msgs.length ? `relay unreachable / rejected: ${msgs.join('; ')}` : 'relay unreachable';
+  }
+  return e?.message ?? String(e);
+};
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+const sha256Hex = async (s: string): Promise<string> => {
+  const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s));
+  return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, '0')).join('');
+};
+
+const hexToBytes = (hex: string): Uint8Array => {
+  const clean = hex.trim().toLowerCase();
+  const out = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  return out;
+};
+
+// derive the dvm's public key from its secret (nsec or hex). the pubkey is public; safe to show.
+const pubkeyFromSecret = (secret: string): string => {
+  try {
+    const s = (secret ?? '').trim();
+    if (!s) return '';
+    const sk = s.startsWith('nsec') ? (nip19.decode(s).data as Uint8Array) : hexToBytes(s);
+    return getPublicKey(sk);
+  } catch {
+    return '';
+  }
+};
+
+const fmtTime = (sec: number): string => new Date(sec * 1000).toLocaleString();
+
+const rtf = new Intl.RelativeTimeFormat('en', { numeric: 'auto' });
+const relTime = (sec: number): string => {
+  const diff = sec * 1000 - Date.now();
+  const table: [Intl.RelativeTimeFormatUnit, number][] = [
+    ['year', 31536000000],
+    ['month', 2592000000],
+    ['week', 604800000],
+    ['day', 86400000],
+    ['hour', 3600000],
+    ['minute', 60000],
+    ['second', 1000],
+  ];
+  for (const [unit, ms] of table) {
+    if (Math.abs(diff) >= ms || unit === 'second') return rtf.format(Math.round(diff / ms), unit);
+  }
+  return 'just now';
+};
+
+const host = (url: string): string => url.replace(/^wss?:\/\//, '').replace(/\/$/, '');
+
+// absolute time with the relative time in smaller brackets after it
+const TimeAgo = ({ sec, prefix }: { sec: number; prefix?: string }) => (
+  <Text size="xs" c="dimmed">
+    {prefix ? `${prefix} ` : ''}
+    {fmtTime(sec)} <Text span fz={10} c="dimmed">({relTime(sec)})</Text>
+  </Text>
+);
+
+// role → colour, shared by the relay inputs and the list badges
+const RELAY_COLOR = { home: 'violet', source: 'blue', output: 'cyan' } as const;
+
+const relayLabel = (color: string, text: string) => (
+  <Group gap={6} component="span" style={{ display: 'inline-flex', verticalAlign: 'middle' }}>
+    <span style={{ width: 8, height: 8, borderRadius: 2, background: `var(--mantine-color-${color}-5)` }} />
+    {text}
+  </Group>
+);
+
+// Bounded query: resolve on EOSE or after `ms`, so a slow relay can't stall the UI.
+const queryBounded = (pool: SimplePool, relays: string[], filter: Filter, ms = 3000): Promise<Event[]> =>
+  new Promise((resolve) => {
+    const out = new Map<string, Event>();
+    let done = false;
+    const finish = () => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      try { sub.close(); } catch { /* noop */ }
+      resolve([...out.values()]);
+    };
+    const timer = setTimeout(finish, ms);
+    const sub = pool.subscribeMany(relays, filter, {
+      onevent: (ev) => out.set(ev.id, ev),
+      oneose: finish,
+    });
+  });
+
+type Param = { key: string; value: string };
+type Inputs = {
+  subjectValue: string;
+  subjectType: string;
+  params: Param[];
+  sourceRelays: string[];
+};
+
+// Content-addressed cache key — must stay in sync with dvm-compute/src/cache.ts computeCacheKey.
+const computeCacheKey = async (scriptAddress: string, inputs: Inputs): Promise<string> => {
+  const params = Object.fromEntries(
+    inputs.params
+      .filter((p) => p.key.trim())
+      .map((p) => [p.key.trim(), p.value] as const)
+      .sort((a, b) => a[0].localeCompare(b[0])),
+  );
+  const canonical = JSON.stringify({
+    script: scriptAddress,
+    subject: inputs.subjectValue.trim() ? { value: inputs.subjectValue.trim(), type: inputs.subjectType } : null,
+    params,
+    relays: [...inputs.sourceRelays].sort(),
+  });
+  return sha256Hex(canonical);
+};
+
+const jobTags = (scriptAddress: string, dvmRelay: string, inputs: Inputs, extra: string[][]): string[][] => {
+  const tags: string[][] = [['a', scriptAddress, dvmRelay]];
+  if (inputs.subjectValue.trim()) tags.push(['i', inputs.subjectValue.trim(), inputs.subjectType]);
+  inputs.params.filter((p) => p.key.trim()).forEach((p) => tags.push(['param', p.key.trim(), p.value]));
+  if (inputs.sourceRelays.length) tags.push(['relays', ...inputs.sourceRelays]);
+  return [...tags, ...extra];
+};
+
+type Feedback = { status: string; message: string };
+type Result = { label: string; content: string; ts?: number } | null;
+
+export const ServiceDetailsScripts = ({ composeId }: { composeId: string }) => {
+  const [relayUrl, setRelayUrl] = useState('');
+  const [dvmPubkey, setDvmPubkey] = useState('');
+  const [defaultSourceRelays, setDefaultSourceRelays] = useState<string[]>([]);
+  // operator ceilings from the service config (authoritative default lives in the preset config,
+  // not hardcoded here) — seed per-data-function limits and cap them.
+  const [defaultRuntimeMs, setDefaultRuntimeMs] = useState('');
+  const [defaultMemoryMb, setDefaultMemoryMb] = useState('');
+  const [loadingConfig, setLoadingConfig] = useState(true);
+
+  const fnCacheKey = `relaykit:dvm-fns:${composeId}`;
+  const loadFnCache = (): Record<string, Event> => {
+    try {
+      return JSON.parse(localStorage.getItem(fnCacheKey) || '{}');
+    } catch {
+      return {};
+    }
+  };
+
+  const [view, setView] = useState<'list' | 'editor'>('list');
+  // seeded from localStorage so the list shows instantly, then refreshed in the background.
+  const [functions, setFunctions] = useState<Record<string, Event>>(loadFnCache);
+  const [loadingList, setLoadingList] = useState(false);
+
+  // editor state
+  const [dTag, setDTag] = useState('');
+  const [code, setCode] = useState(BLANK);
+  const [sourceRelays, setSourceRelays] = useState<string[]>([]);
+  const [outputRelay, setOutputRelay] = useState('');
+  const [ttl, setTtl] = useState('3600');
+  const [runtimeMs, setRuntimeMs] = useState('');
+  const [memoryMb, setMemoryMb] = useState('');
+  const [subjectValue, setSubjectValue] = useState('');
+  const [subjectType, setSubjectType] = useState('text');
+  const [params, setParams] = useState<Param[]>([]);
+  const [author, setAuthor] = useState<string | null>(null);
+  const [published, setPublished] = useState(false);
+  const [updatedAt, setUpdatedAt] = useState<number | null>(null);
+  const [cacheKeyHex, setCacheKeyHex] = useState('');
+
+  const [busy, setBusy] = useState<null | 'test' | 'get' | 'recache' | 'clear' | 'save'>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [feedback, setFeedback] = useState<Feedback[]>([]);
+  const [result, setResult] = useState<Result>(null);
+
+  useEffect(() => {
+    let cancelled = false;
+    trpc.getServiceConfig
+      .query({ composeId })
+      .then((res) => {
+        if (cancelled) return;
+        setRelayUrl(toWs(res.config?.RELAY_URL ?? ''));
+        setDvmPubkey(pubkeyFromSecret(res.config?.DVM_SECRET_KEY ?? ''));
+        const configured = (res.config?.SOURCE_RELAYS ?? '').split(',').map((s) => s.trim()).filter(Boolean);
+        setDefaultSourceRelays(configured.map(toWs));
+        if (res.config?.MAX_RUNTIME_MS) setDefaultRuntimeMs(String(res.config.MAX_RUNTIME_MS));
+        if (res.config?.MAX_MEMORY_MB) setDefaultMemoryMb(String(res.config.MAX_MEMORY_MB));
+      })
+      .catch((e) => !cancelled && setError(e?.message ?? 'failed to load config'))
+      .finally(() => !cancelled && setLoadingConfig(false));
+    return () => {
+      cancelled = true;
+    };
+  }, [composeId]);
+
+  const ensureNostr = () => {
+    if (!window.nostr) throw new Error('no nostr extension found (install alby / nos2x)');
+    return window.nostr;
+  };
+
+  const inputs: Inputs = { subjectValue, subjectType, params, sourceRelays };
+
+  // the content-addressed `d` of the cached result for the current inputs (shown in the consume box).
+  useEffect(() => {
+    if (!author || !dTag.trim()) {
+      setCacheKeyHex('');
+      return;
+    }
+    let cancelled = false;
+    const address = `${KIND.dataFunction}:${author}:${dTag.trim()}`;
+    computeCacheKey(address, { subjectValue, subjectType, params, sourceRelays }).then((k) => !cancelled && setCacheKeyHex(k));
+    return () => {
+      cancelled = true;
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [author, dTag, subjectValue, subjectType, params, sourceRelays]);
+
+  const loadFunctions = async (quiet = false) => {
+    if (!quiet) setError(null);
+    setLoadingList(true);
+    const relay = toWs(relayUrl);
+    const pool = new SimplePool();
+    try {
+      const pk = await ensureNostr().getPublicKey();
+      const events = await queryBounded(pool, [relay], { kinds: [KIND.dataFunction], authors: [pk] });
+      const byD: Record<string, Event> = {};
+      for (const ev of events) {
+        const d = ev.tags.find((t) => t[0] === 'd')?.[1] ?? '';
+        if (!d) continue;
+        if (!byD[d] || ev.created_at > byD[d].created_at) byD[d] = ev;
+      }
+      setFunctions(byD);
+      localStorage.setItem(fnCacheKey, JSON.stringify(byD));
+    } catch (e: any) {
+      if (!quiet) setError(errMsg(e));
+    } finally {
+      pool.close([relay]);
+      setLoadingList(false);
+    }
+  };
+
+  // auto-populate the list when the tab opens (if a signer is available), so it isn't empty.
+  useEffect(() => {
+    if (relayUrl && window.nostr) loadFunctions(true);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [relayUrl]);
+
+  const resetEditor = () => {
+    setError(null);
+    setFeedback([]);
+    setResult(null);
+    setBusy(null);
+  };
+
+  const openNew = () => {
+    resetEditor();
+    setDTag('');
+    setCode(SAMPLE);
+    setSourceRelays(defaultSourceRelays);
+    setOutputRelay(relayUrl);
+    setTtl('3600');
+    setRuntimeMs(defaultRuntimeMs);
+    setMemoryMb(defaultMemoryMb);
+    setSubjectValue('');
+    setSubjectType('text');
+    setParams([]);
+    setAuthor(null);
+    setPublished(false);
+    setUpdatedAt(null);
+    setView('editor');
+  };
+
+  // open a kind:31337 definition: restore its config, then fetch the referenced kind:1337 code.
+  const openExisting = async (def: Event) => {
+    resetEditor();
+    setView('editor');
+    const tagVal = (n: string) => def.tags.find((t) => t[0] === n);
+    setDTag(tagVal('d')?.[1] ?? '');
+    const relays = def.tags.filter((t) => t[0] === 'relays').flatMap((t) => t.slice(1)).filter(Boolean);
+    setSourceRelays(relays.length ? relays.map(toWs) : defaultSourceRelays);
+    setOutputRelay(tagVal('output')?.[1] || relayUrl);
+    setTtl(tagVal('ttl')?.[1] ?? '3600');
+    setRuntimeMs(tagVal('runtime_ms')?.[1] ?? defaultRuntimeMs);
+    setMemoryMb(tagVal('memory_mb')?.[1] ?? defaultMemoryMb);
+    const i = tagVal('i');
+    setSubjectValue(i?.[1] ?? '');
+    setSubjectType(i?.[2] ?? 'text');
+    setParams(def.tags.filter((t) => t[0] === 'param').map((t) => ({ key: t[1] ?? '', value: t[2] ?? '' })));
+    setAuthor(def.pubkey);
+    setPublished(true);
+    setUpdatedAt(def.created_at);
+
+    const codeAddr = tagVal('code')?.[1];
+    setCode('// loading code…');
+    if (!codeAddr) {
+      setCode(BLANK);
+      return;
+    }
+    const relay = toWs(relayUrl);
+    const pool = new SimplePool();
+    try {
+      const [, pk, d] = codeAddr.split(':');
+      const events = await pool.querySync([relay], { kinds: [KIND.codeSnippet], authors: [pk], '#d': [d] });
+      const latest = events.sort((a, b) => b.created_at - a.created_at)[0];
+      setCode(latest?.content ?? BLANK);
+    } catch {
+      setCode(BLANK);
+    } finally {
+      pool.close([relay]);
+    }
+  };
+
+  const addParam = () => setParams((p) => [...p, { key: '', value: '' }]);
+  const removeParam = (i: number) => setParams((p) => p.filter((_, idx) => idx !== i));
+  const updateParam = (i: number, field: keyof Param, val: string) =>
+    setParams((p) => p.map((row, idx) => (idx === i ? { ...row, [field]: val } : row)));
+
+  // 1) test run — execute the code right here in the browser, no relay job, no signing.
+  const testRun = async () => {
+    setError(null);
+    setResult(null);
+    setFeedback([]);
+    setBusy('test');
+    const relays = (sourceRelays.length ? sourceRelays : [relayUrl]).map(toWs).filter(Boolean);
+    const pool = new SimplePool();
+    const touched = new Set<string>(relays);
+    try {
+      if (!code.trim()) throw new Error('function body is empty');
+      if (!relays.length) throw new Error('set a source relay (or the dvm relay url) to query');
+      const nostr = {
+        query: async (filters: Filter | Filter[], queryRelays?: string[]) => {
+          const target = Array.isArray(queryRelays) && queryRelays.length ? queryRelays.map(toWs) : relays;
+          target.forEach((r) => touched.add(r));
+          const list = Array.isArray(filters) ? filters : [filters];
+          const byId = new Map<string, Event>();
+          for (const f of list) {
+            // bounded wait (slow relays can take ~10s to EOSE); collect whatever arrives.
+            const evs = await queryBounded(pool, target, f, 15000);
+            for (const e of evs) byId.set(e.id, e);
+          }
+          return [...byId.values()];
+        },
+      };
+      const runInputs = {
+        subject: subjectValue.trim() ? { value: subjectValue.trim(), type: subjectType } : undefined,
+        params: Object.fromEntries(params.filter((p) => p.key.trim()).map((p) => [p.key.trim(), p.value])),
+      };
+      setFeedback([{ status: 'running', message: `querying ${relays.join(', ')}` }]);
+      // eslint-disable-next-line no-new-func
+      const factory = new Function(
+        'inputs',
+        'nostr',
+        `"use strict";\n${code}\nif (typeof main !== 'function') throw new Error('must define async function main(inputs, nostr)');\nreturn main(inputs, nostr);`,
+      );
+      const out = await factory(runInputs, nostr);
+      setResult({ label: 'local test', content: JSON.stringify(out ?? null), ts: Math.floor(Date.now() / 1000) });
+      setFeedback([{ status: 'success', message: 'ran in browser' }]);
+    } catch (e: any) {
+      setError(errMsg(e));
+      setFeedback([]);
+    } finally {
+      pool.close([...touched]);
+      setBusy(null);
+    }
+  };
+
+  // 2) get cached — read the kind:31338 the worker stored for this exact (function, inputs, relays).
+  const getCached = async () => {
+    setError(null);
+    setResult(null);
+    setFeedback([]);
+    setBusy('get');
+    const relay = toWs(relayUrl);
+    const pool = new SimplePool();
+    try {
+      if (!author || !dTag.trim()) throw new Error('save the data function first so it has an address');
+      const address = `${KIND.dataFunction}:${author}:${dTag.trim()}`;
+      const key = await computeCacheKey(address, inputs);
+      const events = await pool.querySync([relay], { kinds: [KIND.cachedResult], '#d': [key] });
+      const latest = events.sort((a, b) => b.created_at - a.created_at)[0];
+      if (!latest) {
+        setFeedback([{ status: 'miss', message: 'nothing cached for these inputs — recache to compute it' }]);
+        return;
+      }
+      const exp = Number(latest.tags.find((t) => t[0] === 'expiration')?.[1] ?? 0);
+      const expired = exp > 0 && exp < Math.floor(Date.now() / 1000);
+      setResult({ label: expired ? 'cached (expired)' : 'cached', content: latest.content, ts: latest.created_at });
+    } catch (e: any) {
+      setError(errMsg(e));
+    } finally {
+      pool.close([relay]);
+      setBusy(null);
+    }
+  };
+
+  // shared path for recache/clear — publish a kind:5910 job and watch for feedback/result.
+  const submitJob = async (mode: 'recache' | 'clear') => {
+    setError(null);
+    setResult(null);
+    setFeedback([]);
+    setBusy(mode);
+    const relay = toWs(relayUrl);
+    const pool = new SimplePool();
+    try {
+      if (!author || !dTag.trim()) throw new Error('save the data function first so it has an address');
+      if (!relay) throw new Error('set the dvm relay url');
+      const address = `${KIND.dataFunction}:${author}:${dTag.trim()}`;
+      const extra = [['cache', mode === 'clear' ? 'clear' : 'no']];
+      if (ttl.trim()) extra.push(['ttl', ttl.trim()]);
+      const signed = (await ensureNostr().signEvent({
+        kind: KIND.jobRequest,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: jobTags(address, relay, inputs, extra),
+        content: '',
+      })) as Event;
+      await Promise.any(pool.publish([relay], signed));
+      setFeedback([{ status: 'submitted', message: mode === 'clear' ? 'clearing…' : 'recomputing…' }]);
+
+      const seen = new Set<string>();
+      for (let i = 0; i < 20; i++) {
+        await sleep(1000);
+        let terminal = false;
+        const fbs = await pool.querySync([relay], { kinds: [KIND.jobFeedback], '#e': [signed.id] });
+        for (const ev of fbs.sort((a, b) => a.created_at - b.created_at)) {
+          if (seen.has(ev.id)) continue;
+          seen.add(ev.id);
+          const s = ev.tags.find((t) => t[0] === 'status');
+          if (!s) continue;
+          setFeedback((prev) => [...prev, { status: s[1], message: s[2] ?? '' }]);
+          if (s[1] === 'error' || (mode === 'clear' && s[1] === 'success')) terminal = true;
+        }
+        if (mode === 'recache') {
+          const res = await pool.querySync([relay], { kinds: [KIND.jobResult], '#e': [signed.id] });
+          const latest = res.sort((a, b) => b.created_at - a.created_at)[0];
+          if (latest) {
+            setResult({ label: 'recomputed', content: latest.content, ts: latest.created_at });
+            return;
+          }
+        }
+        if (terminal) return;
+      }
+      setFeedback((prev) => [...prev, { status: 'timeout', message: 'no response from worker (is dvm-compute running?)' }]);
+    } catch (e: any) {
+      setError(errMsg(e));
+    } finally {
+      pool.close([relay]);
+      setBusy(null);
+    }
+  };
+
+  // save = publish two events: the reusable code (kind:1337) and the data function definition
+  // (kind:31337) that references it and bundles relays / output / params / subject / ttl.
+  const save = async () => {
+    setError(null);
+    setBusy('save');
+    const relay = toWs(relayUrl);
+    const pool = new SimplePool();
+    try {
+      const id = dTag.trim();
+      if (!id) throw new Error('data function id (d tag) is required');
+      if (!relay) throw new Error('set the dvm relay url');
+      const now = Math.floor(Date.now() / 1000);
+
+      const codeEv = (await ensureNostr().signEvent({
+        kind: KIND.codeSnippet,
+        created_at: now,
+        tags: [['d', id]],
+        content: code,
+      })) as Event;
+
+      const defTags: string[][] = [
+        ['d', id],
+        ['code', `${KIND.codeSnippet}:${codeEv.pubkey}:${id}`],
+      ];
+      if (sourceRelays.length) defTags.push(['relays', ...sourceRelays]);
+      if (outputRelay.trim()) defTags.push(['output', toWs(outputRelay)]);
+      if (ttl.trim()) defTags.push(['ttl', ttl.trim()]);
+      if (runtimeMs.trim()) defTags.push(['runtime_ms', runtimeMs.trim()]);
+      if (memoryMb.trim()) defTags.push(['memory_mb', memoryMb.trim()]);
+      if (subjectValue.trim()) defTags.push(['i', subjectValue.trim(), subjectType]);
+      params.filter((p) => p.key.trim()).forEach((p) => defTags.push(['param', p.key.trim(), p.value]));
+      const defEv = (await ensureNostr().signEvent({
+        kind: KIND.dataFunction,
+        created_at: now,
+        tags: defTags,
+        content: '',
+      })) as Event;
+
+      await Promise.any(pool.publish([relay], codeEv));
+      await Promise.any(pool.publish([relay], defEv));
+      setAuthor(defEv.pubkey);
+      setPublished(true);
+      setUpdatedAt(now);
+      setFunctions((prev) => {
+        const next = { ...prev, [id]: defEv };
+        localStorage.setItem(fnCacheKey, JSON.stringify(next));
+        return next;
+      });
+      setFeedback([{ status: 'success', message: `saved ${id}` }]);
+    } catch (e: any) {
+      setError(errMsg(e));
+    } finally {
+      pool.close([relay]);
+      setBusy(null);
+    }
+  };
+
+  if (loadingConfig) {
+    return (
+      <Group gap="xs">
+        <Loader size="sm" />
+        <Text size="sm" c="dimmed">loading service config…</Text>
+      </Group>
+    );
+  }
+
+  // ── list view ────────────────────────────────────────────────────────────
+  if (view === 'list') {
+    const items = Object.values(functions).sort((a, b) => b.created_at - a.created_at);
+    return (
+      <Stack gap="md">
+        <Group justify="space-between" align="center">
+          <Text size="sm" c="dimmed">
+            a data function (kind:31337) bundles reusable code (kind:1337) with its relays, params & ttl.
+            pick one to edit & test, or create a new one.
+          </Text>
+          <Group gap="xs">
+            <Button variant="default" size="sm" leftSection={<IconRefresh size={15} />} loading={loadingList} onClick={loadFunctions} disabled={!relayUrl}>
+              refresh
+            </Button>
+            <Button size="sm" leftSection={<IconPlus size={15} />} onClick={openNew}>
+              new
+            </Button>
+          </Group>
+        </Group>
+
+        {error && (
+          <Alert color="red" icon={<IconAlertTriangle size={16} />} title="error">
+            {error}
+          </Alert>
+        )}
+
+        {items.length === 0 ? (
+          <Card withBorder padding="lg">
+            <Stack gap={4} align="center">
+              <Text size="sm" c="dimmed">no data functions yet.</Text>
+              <Text size="xs" c="dimmed">hit refresh to load yours from the relay, or create a new one.</Text>
+            </Stack>
+          </Card>
+        ) : (
+          <Stack gap="xs">
+            {items.map((ev) => {
+              const d = ev.tags.find((t) => t[0] === 'd')?.[1] ?? '';
+              const source = ev.tags.filter((t) => t[0] === 'relays').flatMap((t) => t.slice(1)).filter(Boolean);
+              const out = ev.tags.find((t) => t[0] === 'output')?.[1];
+              const paramKeys = ev.tags.filter((t) => t[0] === 'param').map((t) => t[1]).filter(Boolean);
+              const ttlTag = ev.tags.find((t) => t[0] === 'ttl')?.[1];
+              const relayBadge = (role: keyof typeof RELAY_COLOR, url: string) => (
+                <Tooltip key={`${role}:${url}`} label={`${role}: ${url}`} withArrow>
+                  <Badge size="xs" variant="light" color={RELAY_COLOR[role]} leftSection={<IconServer size={10} />}>{host(url)}</Badge>
+                </Tooltip>
+              );
+              return (
+                <Card key={ev.id} withBorder padding="sm" onClick={() => openExisting(ev)} style={{ cursor: 'pointer' }}>
+                  <Group justify="space-between" wrap="nowrap" align="flex-start">
+                    <Stack gap={6}>
+                      <Text size="sm" fw={500}>{d || '(no id)'}</Text>
+                      <Group gap={6}>
+                        {relayUrl && relayBadge('home', relayUrl)}
+                        {source.map((r) => relayBadge('source', r))}
+                        {out && relayBadge('output', out)}
+                        {paramKeys.map((k) => (
+                          <Badge key={k} size="xs" variant="light" color="grape">{k}</Badge>
+                        ))}
+                        {ttlTag && <Badge size="xs" variant="light" color="teal">ttl {ttlTag}s</Badge>}
+                      </Group>
+                      <TimeAgo sec={ev.created_at} prefix="updated" />
+                    </Stack>
+                    <Badge variant="light" color="gray">kind:31337</Badge>
+                  </Group>
+                </Card>
+              );
+            })}
+          </Stack>
+        )}
+      </Stack>
+    );
+  }
+
+  // ── editor view ──────────────────────────────────────────────────────────
+  const canCache = published && !!author && !!dTag.trim();
+  return (
+    <ScrollArea.Autosize mah="68vh" type="auto" offsetScrollbars>
+      <Stack gap="md" pr="sm">
+        <Group justify="space-between" align="center">
+          <Button variant="subtle" size="compact-sm" leftSection={<IconArrowLeft size={15} />} onClick={() => setView('list')}>
+            data functions
+          </Button>
+          <Group gap="xs">
+            {published ? <Badge color="green" variant="light">saved</Badge> : <Badge color="yellow" variant="light">draft</Badge>}
+            {updatedAt && <TimeAgo sec={updatedAt} prefix="updated" />}
+          </Group>
+        </Group>
+
+        <Divider label="code  ·  kind:1337" labelPosition="left" />
+
+        <TextInput
+          label="data function id (d tag)"
+          description="addressable name shared by the code (1337) + definition (31337) — saving supersedes the old one"
+          value={dTag}
+          onChange={(e) => {
+            setDTag(e.currentTarget.value);
+            setPublished(false);
+          }}
+        />
+
+        <Textarea
+          label="function body"
+          description="must define: async function main(inputs, nostr) { … return <json> }"
+          value={code}
+          onChange={(e) => {
+            setCode(e.currentTarget.value);
+            setPublished(false);
+          }}
+          autosize
+          minRows={10}
+          maxRows={20}
+          styles={{ input: { fontFamily: 'monospace', fontSize: '0.8125rem' } }}
+        />
+
+        <Divider label="definition  ·  kind:31337" labelPosition="left" />
+
+        <RelayInput
+          label={relayLabel(RELAY_COLOR.home, 'home relay (dvm)')}
+          description="where the data function + cached results live and the worker listens for jobs"
+          value={relayUrl ? [relayUrl] : []}
+          onChange={(v) => setRelayUrl(v[0] ?? '')}
+          multiple={false}
+          placeholder="wss://relay.example.com"
+        />
+
+        <RelayInput
+          label={relayLabel(RELAY_COLOR.source, 'source relays')}
+          description="relays the data function reads from. the code can override per query."
+          placeholder="wss://relay.relaying.earth"
+          value={sourceRelays}
+          onChange={setSourceRelays}
+        />
+
+        <Group align="flex-end" gap="sm" grow>
+          <RelayInput
+            label={relayLabel(RELAY_COLOR.output, 'output relay')}
+            description="where the cached result is published (defaults to the home relay)"
+            value={outputRelay ? [outputRelay] : []}
+            onChange={(v) => setOutputRelay(v[0] ?? '')}
+            multiple={false}
+            placeholder="wss://relay.example.com"
+          />
+          <TextInput
+            label="ttl (seconds)"
+            description="how long a cached result stays fresh"
+            value={ttl}
+            onChange={(e) => setTtl(e.currentTarget.value)}
+            maw={160}
+          />
+        </Group>
+
+        <Group align="flex-end" gap="sm" grow>
+          <TextInput
+            label="max runtime (ms)"
+            description={defaultRuntimeMs ? `per-run limit · capped at ${defaultRuntimeMs}` : 'per-run limit'}
+            placeholder={defaultRuntimeMs ? `${defaultRuntimeMs} (service default)` : 'service default'}
+            value={runtimeMs}
+            onChange={(e) => setRuntimeMs(e.currentTarget.value)}
+          />
+          <TextInput
+            label="max memory (mb)"
+            description={defaultMemoryMb ? `per-run limit · capped at ${defaultMemoryMb}` : 'per-run limit'}
+            placeholder={defaultMemoryMb ? `${defaultMemoryMb} (service default)` : 'service default'}
+            value={memoryMb}
+            onChange={(e) => setMemoryMb(e.currentTarget.value)}
+          />
+        </Group>
+
+        <Group align="flex-end" gap="sm" grow>
+          <TextInput
+            label="subject"
+            description="the `i` tag — what the computation is about (optional)"
+            placeholder="event id, pubkey, …"
+            value={subjectValue}
+            onChange={(e) => setSubjectValue(e.currentTarget.value)}
+          />
+          <Select
+            label="subject type"
+            data={['text', 'event', 'pubkey', 'address', 'url']}
+            value={subjectType}
+            onChange={(v) => setSubjectType(v || 'text')}
+            maw={150}
+          />
+        </Group>
+
+        <Stack gap={6}>
+          <Text size="sm" fw={500}>params <Text span size="xs" c="dimmed">· `param` tags → inputs.params</Text></Text>
+          {params.map((p, i) => (
+            <Group key={i} gap="xs" align="center" wrap="nowrap">
+              <TextInput placeholder="key" value={p.key} onChange={(e) => updateParam(i, 'key', e.currentTarget.value)} style={{ flex: 1 }} />
+              <TextInput placeholder="value" value={p.value} onChange={(e) => updateParam(i, 'value', e.currentTarget.value)} style={{ flex: 1 }} />
+              <ActionIcon variant="subtle" color="gray" aria-label="remove param" onClick={() => removeParam(i)}>
+                <IconTrash size={15} />
+              </ActionIcon>
+            </Group>
+          ))}
+          <Group>
+            <Button variant="default" size="xs" leftSection={<IconPlus size={14} />} onClick={addParam}>
+              add param
+            </Button>
+          </Group>
+        </Stack>
+
+        <Group justify="flex-end">
+          <Tooltip label="set the home relay and data function id" disabled={!!relayUrl && !!dTag.trim()} withArrow>
+            <Button
+              leftSection={<IconUpload size={16} />}
+              loading={busy === 'save'}
+              onClick={save}
+              disabled={!relayUrl || !dTag.trim() || busy !== null}
+            >
+              save data function
+            </Button>
+          </Tooltip>
+        </Group>
+
+        {published && author && dTag.trim() && (
+          <>
+            <Divider label="consume" labelPosition="left" />
+            <Stack gap={6}>
+              <Text size="sm" c="dimmed">cache-first: read the result; if it's missing or stale, trigger a recompute.</Text>
+              <Text size="xs" fw={500}>1. read the cached result on <Code>{relayUrl}</Code>:</Text>
+              <Code block style={{ whiteSpace: 'pre-wrap', wordBreak: 'break-all' }}>{`{
+  "kinds": [${KIND.cachedResult}],
+  "authors": ["${dvmPubkey || '<dvm pubkey>'}"],
+  "#d": ["${cacheKeyHex || '…'}"]
+}`}</Code>
+              <Text size="xs" c="dimmed">use <Code>content</Code> (json) if found and <Code>created_at + {ttl || '<ttl>'}s</Code> is still in the future.</Text>
+              <Text size="xs" fw={500}>2. on miss/stale, publish a job (kind {KIND.jobRequest}) to recompute, then re-read step 1:</Text>
+              <Code block style={{ whiteSpace: 'pre-wrap', wordBreak: 'break-all' }}>{`{
+  "kind": ${KIND.jobRequest},
+  "tags": [["a", "${KIND.dataFunction}:${author}:${dTag.trim()}", "${relayUrl}"]],
+  "content": ""
+}`}</Code>
+              <Text size="xs" c="dimmed">the dvm publishes the <Code>{KIND.cachedResult}</Code> result (and a kind {KIND.jobResult} pointer).</Text>
+            </Stack>
+          </>
+        )}
+
+        <Divider label="run" labelPosition="left" />
+
+        {error && (
+          <Alert color="red" icon={<IconAlertTriangle size={16} />} title="error">
+            {error}
+          </Alert>
+        )}
+
+        <Group gap="sm">
+          <Tooltip label="run the code here in the browser — no relay job, no signing" withArrow>
+            <Button leftSection={<IconBolt size={16} />} loading={busy === 'test'} onClick={testRun} disabled={busy !== null || !code.trim()}>
+              test run
+            </Button>
+          </Tooltip>
+          <Tooltip label={canCache ? 'read the cached result for these inputs' : 'save the data function first'} withArrow>
+            <Button variant="light" leftSection={<IconDatabase size={16} />} loading={busy === 'get'} onClick={getCached} disabled={busy !== null || !canCache}>
+              get cached
+            </Button>
+          </Tooltip>
+          <Tooltip label={canCache ? 'force the worker to recompute & cache' : 'save the data function first'} withArrow>
+            <Button variant="light" leftSection={<IconRefresh size={16} />} loading={busy === 'recache'} onClick={() => submitJob('recache')} disabled={busy !== null || !canCache}>
+              recache
+            </Button>
+          </Tooltip>
+          <Tooltip label={canCache ? 'delete the cached result for these inputs' : 'save the data function first'} withArrow>
+            <Button variant="subtle" color="red" leftSection={<IconTrash size={16} />} loading={busy === 'clear'} onClick={() => submitJob('clear')} disabled={busy !== null || !canCache}>
+              clear cached
+            </Button>
+          </Tooltip>
+        </Group>
+
+        {(feedback.length > 0 || result != null) && (
+          <Stack gap="xs">
+            {feedback.length > 0 && (
+              <Stack gap={4}>
+                {feedback.map((f, i) => (
+                  <Text key={i} size="sm" c={f.status === 'error' || f.status === 'timeout' ? 'red' : 'dimmed'}>
+                    {f.status}{f.message ? `: ${f.message}` : ''}
+                  </Text>
+                ))}
+              </Stack>
+            )}
+            {result != null && (
+              <Stack gap={4}>
+                <Group gap={6} align="baseline">
+                  <Text size="sm" fw={500}>output <Text span size="xs" c="dimmed">· {result.label}</Text></Text>
+                  {result.ts && <TimeAgo sec={result.ts} />}
+                </Group>
+                <Code block>{prettyResult(result.content)}</Code>
+              </Stack>
+            )}
+          </Stack>
+        )}
+      </Stack>
+    </ScrollArea.Autosize>
+  );
+};
diff --git a/app/frontend/src/components/ServiceHostTitleView.tsx b/app/frontend/src/components/ServiceHostTitleView.tsx
index 7f52b38..b785593 100644
--- a/app/frontend/src/components/ServiceHostTitleView.tsx
+++ b/app/frontend/src/components/ServiceHostTitleView.tsx
@@ -14,11 +14,8 @@ export type ServiceHostTitleViewProps = {
   title: string;
   density: 'compact' | 'comfortable';
   domain: any | null | undefined;
-  canEditConfig: boolean;
   composeId: string;
-  service: any;
   onEditDomain: (composeId: string, domain: any) => void;
-  onEditConfig: (service: any) => void;
   rowStyle?: CSSProperties;
   trailing?: ReactNode;
 };
@@ -27,11 +24,8 @@ export const ServiceHostTitleView = ({
   title,
   density,
   domain,
-  canEditConfig,
   composeId,
-  service,
   onEditDomain,
-  onEditConfig,
   rowStyle,
   trailing,
 }: ServiceHostTitleViewProps) => {
@@ -103,13 +97,6 @@ export const ServiceHostTitleView = ({
           </ActionIcon>
         </Tooltip>
       )}
-      {!domain && canEditConfig && (
-        <Tooltip label="Edit config">
-          <ActionIcon variant="subtle" size={actionSize} style={{ flexShrink: 0 }} onClick={() => onEditConfig(service)} aria-label="Edit config">
-            <IconPencil size={iconPx} />
-          </ActionIcon>
-        </Tooltip>
-      )}
       {trailing}
       <style>{`
         .service-host-title-marquee-inner {
diff --git a/app/frontend/src/pages/ServicesPage.tsx b/app/frontend/src/pages/ServicesPage.tsx
index 50f3b3d..d90e3b7 100644
--- a/app/frontend/src/pages/ServicesPage.tsx
+++ b/app/frontend/src/pages/ServicesPage.tsx
@@ -445,7 +445,6 @@ const ServiceCard = ({
   onStart,
   onStop,
   onDelete,
-  onEditConfig,
   onMove,
   allEnvironments,
   availableRelays,
@@ -464,7 +463,6 @@ const ServiceCard = ({
   onStart: (composeId: string) => void;
   onStop: (composeId: string) => void;
   onDelete: (composeId: string, name: string) => void;
-  onEditConfig: (service: any) => void;
   onMove: (composeId: string, targetEnvironmentId: string) => void;
   allEnvironments: { environmentId: string; label: string }[];
   availableRelays: string[];
@@ -499,9 +497,6 @@ const ServiceCard = ({
   if (domain && !isEditing) {
     manageItems.push({ label: 'edit domain', onClick: () => onEditDomain(service.composeId, domain) });
   }
-  if (service.canEditConfig) {
-    manageItems.push({ label: 'edit config', onClick: () => onEditConfig(service) });
-  }
   if (statusNorm === 'running') {
     manageItems.push({ label: 'stop', onClick: () => onStop(service.composeId) });
   } else {
@@ -656,11 +651,8 @@ const ServiceCard = ({
                   title={domain ? domain.host : service.name}
                   density="comfortable"
                   domain={null}
-                  canEditConfig={false}
                   composeId={service.composeId}
-                  service={service}
                   onEditDomain={onEditDomain}
-                  onEditConfig={onEditConfig}
                   rowStyle={{ flex: 1, minWidth: 0 }}
                   trailing={
                     <Group gap={6} wrap="nowrap">
@@ -700,11 +692,8 @@ const ServiceCard = ({
                         title={domain ? domain.host : service.name}
                         density="compact"
                         domain={domain}
-                        canEditConfig={service.canEditConfig}
                         composeId={service.composeId}
-                        service={service}
                         onEditDomain={onEditDomain}
-                        onEditConfig={onEditConfig}
                         rowStyle={{ minWidth: 0, flex: 1 }}
                       />
                     )}
@@ -856,11 +845,8 @@ const ServiceCard = ({
                     title={domain ? domain.host : service.name}
                     density="comfortable"
                     domain={null}
-                    canEditConfig={false}
                     composeId={service.composeId}
-                    service={service}
                     onEditDomain={onEditDomain}
-                    onEditConfig={onEditConfig}
                     rowStyle={{ flex: 1, minWidth: 0 }}
                     trailing={nip42Badge}
                   />
@@ -915,11 +901,6 @@ export const ServiceList = () => {
 
   const [editingDomain, setEditingDomain] = useState<{ composeId: string; domainId: string; currentHost: string } | null>(null);
   const [newDomainHost, setNewDomainHost] = useState('');
-  const [editingConfigService, setEditingConfigService] = useState<any | null>(null);
-  const [editingConfigFields, setEditingConfigFields] = useState<any[]>([]);
-  const [editingConfigValues, setEditingConfigValues] = useState<Record<string, string>>({});
-  const [loadingConfigModal, setLoadingConfigModal] = useState(false);
-  const [savingConfig, setSavingConfig] = useState(false);
 
   const [newProjectName, setNewProjectName] = useState('');
   const [creatingProject, setCreatingProject] = useState(false);
@@ -1121,44 +1102,6 @@ export const ServiceList = () => {
     }
   };
 
-  const handleEditConfig = async (service: any) => {
-    setLoadingConfigModal(true);
-    try {
-      const result = await trpc.getServiceConfig.query({ composeId: service.composeId });
-      setEditingConfigService(service);
-      setEditingConfigFields(result.fields || []);
-      setEditingConfigValues(result.config || {});
-    } catch (error: any) {
-      toast.error(`Failed to load service config: ${error.message}`);
-    } finally {
-      setLoadingConfigModal(false);
-    }
-  };
-
-  const handleSaveConfig = async (nextValues: Record<string, string>) => {
-    if (!editingConfigService) return;
-    setSavingConfig(true);
-    try {
-      const configToSave =
-        isNpanelType(editingConfigService.type)
-          ? prepareNsiteConfigForSave(nextValues)
-          : nextValues;
-      await trpc.updateServiceConfig.mutate({
-        composeId: editingConfigService.composeId,
-        config: configToSave,
-      });
-      toast.success('Service config updated and redeploy started');
-      setEditingConfigService(null);
-      setEditingConfigFields([]);
-      setEditingConfigValues({});
-      await loadData();
-    } catch (error: any) {
-      toast.error(`Failed to update config: ${error.message}`);
-    } finally {
-      setSavingConfig(false);
-    }
-  };
-
   const handleCreateProject = async () => {
     if (!newProjectName.trim()) return;
     setCreatingProject(true);
@@ -1445,7 +1388,6 @@ export const ServiceList = () => {
                                   onStart={handleStartService}
                                   onStop={handleStopService}
                                   onDelete={openDeleteServiceConfirm}
-                                  onEditConfig={handleEditConfig}
                                   onMove={handleMoveService}
                                   allEnvironments={allEnvironments}
                                   availableRelays={availableRelays}
@@ -1526,7 +1468,6 @@ export const ServiceList = () => {
                                       onStart={handleStartService}
                                       onStop={handleStopService}
                                       onDelete={openDeleteServiceConfirm}
-                                      onEditConfig={handleEditConfig}
                                       onMove={handleMoveService}
                                       allEnvironments={allEnvironments}
                                       availableRelays={availableRelays}
@@ -1625,22 +1566,6 @@ export const ServiceList = () => {
           onCancel={() => setConfirmModal(null)}
         />
       )}
-      {(loadingConfigModal || editingConfigService) && (
-        <ConfigEditModal
-          loading={loadingConfigModal}
-          service={editingConfigService}
-          fields={editingConfigFields}
-          initialValues={editingConfigValues}
-          onSubmit={handleSaveConfig}
-          onClose={() => {
-            if (savingConfig) return;
-            setEditingConfigService(null);
-            setEditingConfigFields([]);
-            setEditingConfigValues({});
-          }}
-          saving={savingConfig}
-        />
-      )}
     </Stack>
   );
 };
@@ -1792,117 +1717,3 @@ const DeployModal = ({
   );
 };
 
-const ConfigEditModal = ({
-  loading,
-  service,
-  fields,
-  initialValues,
-  onSubmit,
-  onClose,
-  saving,
-}: {
-  loading: boolean;
-  service: any | null;
-  fields: any[];
-  initialValues: Record<string, string>;
-  onSubmit: (values: Record<string, string>) => void | Promise<void>;
-  onClose: () => void;
-  saving: boolean;
-}) => {
-  const isNsite = isNpanelType(service?.type);
-  const fakePreset = isNsite ? { id: SERVICE_TYPE.NPANEL, requiredConfig: fields } : null;
-  const form = useForm<Record<string, string>>({
-    initialValues,
-    validateInputOnChange: true,
-    validate: (vals: Record<string, string>) => {
-      const errors: Record<string, string> = {};
-      if (isNsite) return errors;
-      for (const field of fields) {
-        if (!field.required || field.type === 'boolean') continue;
-        if (!(vals[field.id] || '').trim()) {
-          errors[field.id] = `${field.name} is required`;
-        }
-      }
-      return errors;
-    },
-  });
-
-  useEffect(() => {
-    form.setValues(initialValues);
-    form.clearErrors();
-  }, [initialValues]);
-
-  const canSubmit = !saving && form.isValid();
-
-  const renderConfigField = (field: any) => {
-    if (field.type === 'boolean') {
-      const checked = (form.values[field.id] || String(field.default || 'false')).toLowerCase() === 'true';
-      return (
-        <Switch
-          key={field.id}
-          label={field.name}
-          description={field.description}
-          checked={checked}
-          onChange={(e) => form.setFieldValue(field.id, e.currentTarget.checked ? 'true' : 'false')}
-        />
-      );
-    }
-
-    return (
-      <TextInput
-        key={field.id}
-        label={field.name}
-        description={field.description}
-        required={field.required}
-        {...form.getInputProps(field.id)}
-        value={form.values[field.id] ?? String(field.default ?? '')}
-      />
-    );
-  };
-
-  return (
-    <Modal opened onClose={onClose} title="edit config" size="md" centered styles={{ body: { maxHeight: '85vh', overflow: 'auto' } }}>
-      <Stack gap="md">
-        <Text size="sm" c="dimmed">
-          {service ? `Update environment config for ${service.name}` : 'Loading service config...'}
-        </Text>
-        {loading ? (
-          <Text c="dimmed">Loading...</Text>
-        ) : fields.length === 0 ? (
-          <>
-            <Text c="dimmed">No editable config fields for this service.</Text>
-            <Button onClick={onClose} fullWidth>close</Button>
-          </>
-        ) : (
-          <form onSubmit={form.onSubmit((vals: Record<string, string>) => void onSubmit(vals))}>
-            <Stack gap="md">
-              {isNsite && fakePreset ? (
-                <NsiteDeployFields
-                  preset={fakePreset}
-                  config={form.values}
-                  setConfig={(next) => {
-                    const resolved = typeof next === 'function' ? next(form.values) : next;
-                    for (const [key, value] of Object.entries(resolved)) {
-                      form.setFieldValue(key, String(value ?? ''));
-                    }
-                  }}
-                  ownerPubkeyHex={null}
-                />
-              ) : (
-                fields.map(renderConfigField)
-              )}
-              <Group justify="space-between">
-                <Button variant="default" onClick={onClose} disabled={saving}>
-                  cancel
-                </Button>
-                <Button type="submit" color="green" loading={saving} disabled={!canSubmit}>
-                  {saving ? 'saving…' : 'save + redeploy'}
-                </Button>
-              </Group>
-            </Stack>
-          </form>
-        )}
-      </Stack>
-    </Modal>
-  );
-};
diff --git a/app/presets/dvm-compute/docker-compose.yml b/app/presets/dvm-compute/docker-compose.yml
new file mode 100644
index 0000000..69ec705
--- /dev/null
+++ b/app/presets/dvm-compute/docker-compose.yml
@@ -0,0 +1,25 @@
+# Outbound-only worker: dials relays, runs sandboxed scripts, publishes results. No inbound domain.
+# Runs the prebuilt local image (build it with: docker build -t relaykit-dvm-compute:local ./worker).
+# Must be on dokploy-network (Dokploy requirement).
+services:
+  dvm-compute:
+    image: relaykit-dvm-compute:local
+    pull_policy: never
+    restart: unless-stopped
+    mem_limit: ${CONTAINER_MEM_LIMIT:-512m}
+    environment:
+      RELAY_URL: ${RELAY_URL}
+      DVM_SECRET_KEY: ${DVM_SECRET_KEY}
+      SOURCE_RELAYS: ${SOURCE_RELAYS:-}
+      AUTHOR_WHITELIST: ${AUTHOR_WHITELIST:-}
+      REQUESTER_WHITELIST: ${REQUESTER_WHITELIST:-}
+      MAX_RUNTIME_MS: ${MAX_RUNTIME_MS:-5000}
+      MAX_MEMORY_MB: ${MAX_MEMORY_MB:-128}
+      MAX_CONCURRENT: ${MAX_CONCURRENT:-4}
+      LOG_JOBS: ${LOG_JOBS:-false}
+    networks:
+      - dokploy-network
+
+networks:
+  dokploy-network:
+    external: true
diff --git a/app/presets/dvm-compute/metadata.json b/app/presets/dvm-compute/metadata.json
new file mode 100644
index 0000000..5cbb0c4
--- /dev/null
+++ b/app/presets/dvm-compute/metadata.json
@@ -0,0 +1,83 @@
+{
+  "id": "dvm-compute",
+  "name": "Compute DVM",
+  "label": "Compute DVM",
+  "repo": "https://github.com/samthomson/relaykit/tree/master/app/presets/dvm-compute/worker",
+  "icon": "⚡",
+  "description": "A programmable, caching DVM (NIP-90) that runs whitelisted Nostr code snippets (NIP-C0) in a sandbox and publishes cached results.",
+  "version": "1.0.0",
+  "type": "dvm",
+  "serviceName": "dvm-compute",
+  "internalPort": 0,
+  "requiredConfig": [
+    {
+      "id": "RELAY_URL",
+      "name": "DVM relay url",
+      "type": "string",
+      "required": true,
+      "description": "relay the worker listens on for jobs and publishes results/caches to (e.g. wss://relay.example.com)",
+      "placeholder": "wss://relay.example.com"
+    },
+    {
+      "id": "DVM_SECRET_KEY",
+      "name": "signing key (nsec or hex)",
+      "type": "string",
+      "required": true,
+      "description": "the worker's nostr secret key used to sign results",
+      "placeholder": "nsec1..."
+    },
+    {
+      "id": "SOURCE_RELAYS",
+      "name": "source relays",
+      "type": "string",
+      "required": false,
+      "description": "comma-separated relays scripts pull data from (defaults to the dvm relay)"
+    },
+    {
+      "id": "AUTHOR_WHITELIST",
+      "name": "allowed script authors (hex)",
+      "type": "string",
+      "required": false,
+      "description": "comma-separated hex pubkeys whose code snippets may run. empty = any (not recommended)"
+    },
+    {
+      "id": "REQUESTER_WHITELIST",
+      "name": "allowed requesters (hex)",
+      "type": "string",
+      "required": false,
+      "description": "comma-separated hex pubkeys allowed to submit jobs. empty = anyone"
+    },
+    {
+      "id": "MAX_RUNTIME_MS",
+      "name": "max runtime per script (ms)",
+      "type": "string",
+      "required": false,
+      "default": "5000",
+      "description": "wall-clock budget for a single script run"
+    },
+    {
+      "id": "MAX_MEMORY_MB",
+      "name": "max memory per script (mb)",
+      "type": "string",
+      "required": false,
+      "default": "128",
+      "description": "memory cap for a single script run"
+    },
+    {
+      "id": "MAX_CONCURRENT",
+      "name": "max concurrent scripts",
+      "type": "string",
+      "required": false,
+      "default": "4",
+      "description": "how many scripts may run at once; the rest queue"
+    },
+    {
+      "id": "LOG_JOBS",
+      "name": "verbose job logging",
+      "type": "boolean",
+      "required": false,
+      "default": "false",
+      "description": "log a line per job (received, cache hit/miss, outcome) to the logs tab"
+    }
+  ]
+}
diff --git a/app/presets/dvm-compute/worker/.gitignore b/app/presets/dvm-compute/worker/.gitignore
new file mode 100644
index 0000000..b947077
--- /dev/null
+++ b/app/presets/dvm-compute/worker/.gitignore
@@ -0,0 +1,2 @@
+node_modules/
+dist/
diff --git a/app/presets/dvm-compute/worker/Dockerfile b/app/presets/dvm-compute/worker/Dockerfile
new file mode 100644
index 0000000..4d8198a
--- /dev/null
+++ b/app/presets/dvm-compute/worker/Dockerfile
@@ -0,0 +1,15 @@
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY package.json ./
+RUN corepack disable && npm install
+COPY tsconfig.json ./
+COPY src ./src
+RUN npm run build
+
+FROM node:22-alpine
+WORKDIR /app
+ENV NODE_ENV=production
+COPY package.json ./
+RUN npm install --omit=dev
+COPY --from=build /app/dist ./dist
+CMD ["node", "dist/index.js"]
diff --git a/app/presets/dvm-compute/worker/README.md b/app/presets/dvm-compute/worker/README.md
new file mode 100644
index 0000000..8fd4dd6
--- /dev/null
+++ b/app/presets/dvm-compute/worker/README.md
@@ -0,0 +1,81 @@
+# relaykit dvm-compute
+
+A programmable, caching DVM worker. Clients ask it to run a whitelisted **code snippet** (NIP-C0, `kind:1337`) against Nostr data; it runs the script in a sandboxed JS VM and publishes a **cached result** that clients read instead of crawling raw events.
+
+It's a NIP-90 DVM, but generic (the job picks which script to run) and cache-first (results are content-addressed and reused until they expire). Scripts run in a [quickjs-emscripten](https://github.com/justjake/quickjs-emscripten) WASM sandbox.
+
+## Event kinds
+
+| kind | name | who publishes | role |
+|------|------|---------------|------|
+| `1337` | code snippet (NIP-C0) | script author | the reusable code to run; referenced by definitions |
+| `31337` | data function definition (custom, addressable) | author/user | references a `1337` + bundles relays / params / ttl / output |
+| `5910` | job request (NIP-90) | client | thin pointer at a `31337` definition (+ optional overrides) |
+| `7000` | job feedback (NIP-90) | worker | status: processing / success / error |
+| `6910` | job result (NIP-90) | worker | notifies requester; points at the cached event |
+| `31338` | cached result (custom, addressable) | worker | the actual payload; `d = sha256(definition + inputs + relays)` |
+
+Read path = `31338` (or `6910`). Compute trigger = `5910`. Definition = `31337`. Code = `1337`.
+
+## Writing a script
+
+A snippet is a `kind:1337` event whose `content` defines `main`:
+
+```js
+// counts top-level comments (NIP-22, kind 1111) for the subject event id
+async function main(inputs, nostr) {
+  const target = inputs.subject.value
+  const comments = await nostr.query([{ kinds: [1111], '#E': [target] }])
+  return { comment_cnt: comments.length, ids: comments.map((e) => e.id) }
+}
+```
+
+- `inputs.subject` = `{ value, type }` from the job's `i` tag (e.g. an event id).
+- `inputs.params` = key/value map from the job's `param` tags.
+- `nostr.query(filters)` is the **only** capability: it queries the source relays (no fs/net/process/timers).
+- Return any JSON-serializable value; it becomes the cached result `content`.
+
+## Job request shape (`kind:5910`)
+
+```json
+{
+  "kind": 5910,
+  "tags": [
+    ["a", "1337:<author_pubkey>:<d>"],
+    ["i", "<event_id>", "event"],
+    ["param", "max", "500"],
+    ["relays", "wss://relay.example.com"],
+    ["ttl", "3600"]
+  ],
+  "content": ""
+}
+```
+
+Use `["e", "<id>"]` instead of `a` to pin a specific (non-updateable) script version.
+
+## Config (env vars)
+
+| var | required | default | description |
+|-----|----------|---------|-------------|
+| `RELAY_URL` | yes | – | relay the worker listens on and publishes results/caches to |
+| `DVM_SECRET_KEY` | yes | – | worker signing key (`nsec...` or hex) |
+| `SOURCE_RELAYS` | no | `RELAY_URL` | comma-separated relays scripts pull data from |
+| `AUTHOR_WHITELIST` | no | (open) | comma-separated hex pubkeys whose scripts may run |
+| `REQUESTER_WHITELIST` | no | (anyone) | comma-separated hex pubkeys allowed to submit jobs |
+| `MAX_RUNTIME_MS` | no | `5000` | per-script wall-clock budget |
+| `MAX_MEMORY_MB` | no | `128` | per-script memory cap |
+| `MAX_CONCURRENT` | no | `4` | scripts running at once |
+| `MAX_EVENTS_PER_JOB` | no | `5000` | events a script may fetch |
+| `MAX_OUTPUT_BYTES` | no | `524288` | max serialized result size |
+| `DEFAULT_TTL_SEC` / `MAX_TTL_SEC` | no | `3600` / `86400` | cache freshness window |
+
+## Dev
+
+```bash
+npm install
+RELAY_URL=wss://your.relay DVM_SECRET_KEY=nsec1... npm run dev
+```
+
+## Safety
+
+Defense in depth: quickjs VM (no ambient access; only `nostr.query` is injected) + memory/time/output limits + author whitelist + container resource limits. For fully untrusted code, also run behind OS isolation (per-job container / gVisor).
diff --git a/app/presets/dvm-compute/worker/package.json b/app/presets/dvm-compute/worker/package.json
new file mode 100644
index 0000000..43123db
--- /dev/null
+++ b/app/presets/dvm-compute/worker/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "relaykit-dvm-compute",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "description": "Programmable, caching DVM (NIP-90) worker that runs whitelisted Nostr code snippets (NIP-C0) in a quickjs sandbox and publishes cached results.",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/index.js",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "nostr-tools": "^2.10.4",
+    "quickjs-emscripten": "^0.31.0",
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "@types/ws": "^8.5.13",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2"
+  }
+}
diff --git a/app/presets/dvm-compute/worker/src/cache.ts b/app/presets/dvm-compute/worker/src/cache.ts
new file mode 100644
index 0000000..ef54733
--- /dev/null
+++ b/app/presets/dvm-compute/worker/src/cache.ts
@@ -0,0 +1,55 @@
+import { createHash } from 'node:crypto'
+import type { Event, EventTemplate } from 'nostr-tools'
+import { KIND } from './kinds.js'
+import { config } from './config.js'
+import { queryOne } from './nostr.js'
+import type { SandboxInputs } from './sandbox.js'
+
+export type ScriptRef = { id: string; address?: string }
+
+// Deterministic address for a (script, inputs, source relays) tuple.
+export const computeCacheKey = (
+  scriptRef: ScriptRef,
+  inputs: SandboxInputs,
+  sourceRelays: string[],
+): string => {
+  const canonical = JSON.stringify({
+    script: scriptRef.address ?? scriptRef.id,
+    subject: inputs.subject ?? null,
+    params: Object.fromEntries(Object.entries(inputs.params).sort(([a], [b]) => a.localeCompare(b))),
+    relays: [...sourceRelays].sort(),
+  })
+  return createHash('sha256').update(canonical).digest('hex')
+}
+
+export const findCached = async (key: string, ttlSec: number): Promise<Event | null> => {
+  const event = await queryOne(
+    [config.dvmRelay],
+    { kinds: [KIND.cachedResult], authors: [config.publicKey], '#d': [key] },
+    config.limits.sourceQueryTimeoutMs,
+  )
+  if (!event) return null
+  const ageSec = Math.floor(Date.now() / 1000) - event.created_at
+  return ageSec <= ttlSec ? event : null
+}
+
+export const buildCachedEvent = (
+  key: string,
+  scriptRef: ScriptRef,
+  inputs: SandboxInputs,
+  result: unknown,
+  ttlSec: number,
+): EventTemplate => {
+  const tags: string[][] = [
+    ['d', key],
+    ['script', scriptRef.address ?? scriptRef.id],
+    ['expiration', String(Math.floor(Date.now() / 1000) + ttlSec)],
+  ]
+  if (inputs.subject) tags.push(['i', inputs.subject.value, inputs.subject.type])
+  return {
+    kind: KIND.cachedResult,
+    created_at: Math.floor(Date.now() / 1000),
+    tags,
+    content: JSON.stringify(result ?? null),
+  }
+}
diff --git a/app/presets/dvm-compute/worker/src/config.ts b/app/presets/dvm-compute/worker/src/config.ts
new file mode 100644
index 0000000..07c73f3
--- /dev/null
+++ b/app/presets/dvm-compute/worker/src/config.ts
@@ -0,0 +1,78 @@
+import { nip19, getPublicKey } from 'nostr-tools'
+
+const hexToBytes = (hex: string): Uint8Array => {
+  const clean = hex.trim().toLowerCase()
+  if (clean.length % 2 !== 0 || /[^0-9a-f]/.test(clean)) throw new Error('invalid hex secret key')
+  const out = new Uint8Array(clean.length / 2)
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16)
+  return out
+}
+
+const num = (key: string, fallback: number): number => {
+  const raw = process.env[key]
+  if (!raw) return fallback
+  const n = Number(raw)
+  return Number.isFinite(n) ? n : fallback
+}
+
+const csv = (key: string): string[] =>
+  (process.env[key] ?? '')
+    .split(',')
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean)
+
+const bool = (key: string, fallback: boolean): boolean => {
+  const raw = process.env[key]
+  if (raw === undefined || raw === '') return fallback
+  return ['1', 'true', 'yes', 'on'].includes(raw.trim().toLowerCase())
+}
+
+const required = (key: string): string => {
+  const v = process.env[key]
+  if (!v) throw new Error(`Missing required env var ${key}`)
+  return v
+}
+
+// Accepts an nsec or raw hex secret key.
+const decodeSecretKey = (raw: string): Uint8Array => {
+  const trimmed = raw.trim()
+  if (trimmed.startsWith('nsec')) {
+    const { type, data } = nip19.decode(trimmed)
+    if (type !== 'nsec') throw new Error('DVM_SECRET_KEY is not a valid nsec')
+    return data as Uint8Array
+  }
+  return hexToBytes(trimmed)
+}
+
+const secretKey = decodeSecretKey(required('DVM_SECRET_KEY'))
+
+const dvmRelay = required('RELAY_URL')
+
+export const config = {
+  // Relay the DVM listens on for jobs and publishes results/caches to.
+  dvmRelay,
+  // Where scripts pull their source data from (defaults to the DVM relay).
+  sourceRelays: csv('SOURCE_RELAYS').length ? csv('SOURCE_RELAYS') : [dvmRelay],
+  secretKey,
+  publicKey: getPublicKey(secretKey),
+  // Only scripts authored by these pubkeys may run. Empty = allow any (not recommended in prod).
+  authorWhitelist: csv('AUTHOR_WHITELIST'),
+  // Optional: only these pubkeys may submit jobs. Empty = anyone.
+  requesterWhitelist: csv('REQUESTER_WHITELIST'),
+  limits: {
+    maxRuntimeMs: num('MAX_RUNTIME_MS', 5000),
+    maxMemoryMb: num('MAX_MEMORY_MB', 128),
+    maxConcurrent: num('MAX_CONCURRENT', 4),
+    maxEventsPerJob: num('MAX_EVENTS_PER_JOB', 0), // 0 = unlimited
+    maxOutputBytes: num('MAX_OUTPUT_BYTES', 524288),
+    sourceQueryTimeoutMs: num('SOURCE_QUERY_TIMEOUT_MS', 8000),
+  },
+  cache: {
+    defaultTtlSec: num('DEFAULT_TTL_SEC', 3600),
+    maxTtlSec: num('MAX_TTL_SEC', 86400),
+  },
+  // When on, log a line per job (received / cache hit-miss / outcome) to stdout (the logs tab).
+  logJobs: bool('LOG_JOBS', false),
+} as const
+
+export type Config = typeof config
diff --git a/app/presets/dvm-compute/worker/src/handler.ts b/app/presets/dvm-compute/worker/src/handler.ts
new file mode 100644
index 0000000..d1277c4
--- /dev/null
+++ b/app/presets/dvm-compute/worker/src/handler.ts
@@ -0,0 +1,256 @@
+import type { Event } from 'nostr-tools'
+import { KIND } from './kinds.js'
+import { config } from './config.js'
+import { collect, queryOne, sign, publish } from './nostr.js'
+import { runScript, type SandboxInputs } from './sandbox.js'
+import { computeCacheKey, findCached, buildCachedEvent, type ScriptRef } from './cache.js'
+
+const tag = (ev: Event, name: string): string[] | undefined => ev.tags.find((t) => t[0] === name)
+const tagsAll = (ev: Event, name: string): string[][] => ev.tags.filter((t) => t[0] === name)
+
+const log = (req: Event, msg: string) => {
+  if (config.logJobs) console.log(`[job ${req.id}] ${msg}`)
+}
+
+const clampTtl = (raw: number): number =>
+  Math.min(Number.isFinite(raw) ? raw : config.cache.defaultTtlSec, config.cache.maxTtlSec)
+
+// Per-function limits are clamped to the operator's global ceiling; unset/invalid falls back to it.
+const clampLimit = (raw: string | undefined, max: number): number => {
+  const n = Number(raw)
+  const v = Number.isFinite(n) && n > 0 ? n : max
+  return Math.min(v, max)
+}
+
+type Overrides = {
+  subject?: { value: string; type: string }
+  params: Record<string, string>
+  sourceRelays?: string[]
+  ttlSec?: number
+}
+
+type ParsedJob = {
+  // Inline code (for pre-publish testing), or a reference: `a` (a dataFunction:31337 or a
+  // codeSnippet:1337 address) or `e` (a code event id). Inline skips cache + author whitelist.
+  inlineCode?: string
+  aRef?: string
+  eRef?: string
+  overrides: Overrides
+  // `cache:no` forces a recompute; `cache:clear` deletes the cached result and returns.
+  noCache: boolean
+  clearCache: boolean
+}
+
+const parseJob = (req: Event): ParsedJob => {
+  const inlineCode = tag(req, 'exec')?.[1] === 'inline' ? req.content : undefined
+  const aRef = tag(req, 'a')?.[1]
+  const eRef = tag(req, 'e')?.[1]
+  if (!inlineCode && !aRef && !eRef) throw new Error('job has no reference (a or e tag, or inline exec)')
+
+  const subjectTag = tag(req, 'i')
+  const relayTag = tag(req, 'relays')
+  const ttlTag = tag(req, 'ttl')?.[1]
+  const cacheMode = tag(req, 'cache')?.[1]
+  return {
+    inlineCode,
+    aRef,
+    eRef,
+    overrides: {
+      subject: subjectTag ? { value: subjectTag[1], type: subjectTag[2] ?? 'text' } : undefined,
+      params: Object.fromEntries(tagsAll(req, 'param').map((t) => [t[1], t[2] ?? ''])),
+      sourceRelays: relayTag ? relayTag.slice(1).filter(Boolean) : undefined,
+      ttlSec: ttlTag !== undefined ? clampTtl(Number(ttlTag)) : undefined,
+    },
+    noCache: cacheMode === 'no' || cacheMode === 'clear',
+    clearCache: cacheMode === 'clear',
+  }
+}
+
+// Resolved, effective job: the cache identity (functionRef), the code to run, and merged inputs.
+type Resolved = {
+  functionRef: ScriptRef
+  codeRef: ScriptRef
+  inputs: SandboxInputs
+  sourceRelays: string[]
+  ttlSec: number
+  outputRelay: string
+  runtimeMs: number
+  memoryMb: number
+}
+
+const queryByAddress = async (address: string, kind: number): Promise<Event | null> => {
+  const [k, pubkey, d] = address.split(':')
+  if (Number(k) !== kind) throw new Error(`expected kind ${kind} address, got ${address}`)
+  return queryOne(
+    [config.dvmRelay],
+    { kinds: [kind], authors: [pubkey], '#d': [d] },
+    config.limits.sourceQueryTimeoutMs,
+  )
+}
+
+// Reads a dataFunction:31337 definition into its effective config (before 5910 overrides).
+const parseDefinition = (def: Event, defAddress: string): Resolved => {
+  const codeTag = tag(def, 'code')?.[1]
+  if (!codeTag) throw new Error('data function has no `code` reference')
+  const relayTag = tag(def, 'relays')
+  const subjectTag = tag(def, 'i')
+  return {
+    functionRef: { id: defAddress, address: defAddress },
+    codeRef: { id: '', address: codeTag },
+    inputs: {
+      subject: subjectTag ? { value: subjectTag[1], type: subjectTag[2] ?? 'text' } : undefined,
+      params: Object.fromEntries(tagsAll(def, 'param').map((t) => [t[1], t[2] ?? ''])),
+    },
+    sourceRelays: relayTag ? relayTag.slice(1).filter(Boolean) : config.sourceRelays,
+    ttlSec: clampTtl(Number(tag(def, 'ttl')?.[1] ?? config.cache.defaultTtlSec)),
+    outputRelay: tag(def, 'output')?.[1] || config.dvmRelay,
+    runtimeMs: clampLimit(tag(def, 'runtime_ms')?.[1], config.limits.maxRuntimeMs),
+    memoryMb: clampLimit(tag(def, 'memory_mb')?.[1], config.limits.maxMemoryMb),
+  }
+}
+
+const applyOverrides = (base: Resolved, o: Overrides): Resolved => ({
+  ...base,
+  inputs: {
+    subject: o.subject ?? base.inputs.subject,
+    params: { ...base.inputs.params, ...o.params },
+  },
+  sourceRelays: o.sourceRelays ?? base.sourceRelays,
+  ttlSec: o.ttlSec ?? base.ttlSec,
+})
+
+// Turn a parsed job into a fully resolved one (fetches the definition when referenced).
+const resolveJob = async (job: ParsedJob): Promise<Resolved> => {
+  // `a` pointing at a dataFunction definition (the normal path).
+  if (job.aRef && Number(job.aRef.split(':')[0]) === KIND.dataFunction) {
+    const def = await queryByAddress(job.aRef, KIND.dataFunction)
+    if (!def) throw new Error('data function definition not found')
+    return applyOverrides(parseDefinition(def, job.aRef), job.overrides)
+  }
+  // `a` pointing straight at a codeSnippet, or `e` at a code event id (no definition).
+  const codeRef: ScriptRef = job.aRef ? { id: '', address: job.aRef } : { id: job.eRef! }
+  const base: Resolved = {
+    functionRef: codeRef,
+    codeRef,
+    inputs: { subject: job.overrides.subject, params: job.overrides.params },
+    sourceRelays: job.overrides.sourceRelays ?? config.sourceRelays,
+    ttlSec: job.overrides.ttlSec ?? config.cache.defaultTtlSec,
+    outputRelay: config.dvmRelay,
+    runtimeMs: config.limits.maxRuntimeMs,
+    memoryMb: config.limits.maxMemoryMb,
+  }
+  return base
+}
+
+const fetchCode = async (ref: ScriptRef, sourceRelays: string[]): Promise<Event | null> => {
+  const relays = [config.dvmRelay, ...sourceRelays]
+  if (ref.address) {
+    const [kind, pubkey, d] = ref.address.split(':')
+    if (Number(kind) !== KIND.codeSnippet) throw new Error(`code ref must be kind ${KIND.codeSnippet}`)
+    return queryOne(relays, { kinds: [KIND.codeSnippet], authors: [pubkey], '#d': [d] }, config.limits.sourceQueryTimeoutMs)
+  }
+  const [event] = await collect(relays, [{ ids: [ref.id] }], { timeoutMs: config.limits.sourceQueryTimeoutMs, max: 1 })
+  return event ?? null
+}
+
+const feedback = async (req: Event, status: 'processing' | 'success' | 'error', message = '') => {
+  const event = sign({
+    kind: KIND.jobFeedback,
+    created_at: Math.floor(Date.now() / 1000),
+    tags: [
+      ['status', status, message],
+      ['e', req.id],
+      ['p', req.pubkey],
+    ],
+    content: '',
+  })
+  await publish([config.dvmRelay], event)
+}
+
+const publishResult = async (req: Event, content: string, cacheEvent?: Event) => {
+  const tags: string[][] = [
+    ['e', req.id],
+    ['p', req.pubkey],
+  ]
+  if (cacheEvent) {
+    const cacheAddr = `${KIND.cachedResult}:${config.publicKey}:${tag(cacheEvent, 'd')?.[1] ?? ''}`
+    tags.push(['a', cacheAddr, config.dvmRelay])
+  }
+  const result = sign({
+    kind: KIND.jobResult,
+    created_at: Math.floor(Date.now() / 1000),
+    tags,
+    content,
+  })
+  await publish([config.dvmRelay], result)
+}
+
+export const handleJob = async (req: Event): Promise<void> => {
+  if (config.requesterWhitelist.length && !config.requesterWhitelist.includes(req.pubkey.toLowerCase())) {
+    return // silently ignore jobs from non-whitelisted requesters
+  }
+
+  try {
+    await feedback(req, 'processing')
+    const job = parseJob(req)
+
+    // Inline test run: execute the provided code directly, return the result, no caching.
+    if (job.inlineCode !== undefined) {
+      const sourceRelays = job.overrides.sourceRelays ?? config.sourceRelays
+      const inputs: SandboxInputs = { subject: job.overrides.subject, params: job.overrides.params }
+      log(req, 'inline run')
+      const result = await runScript(job.inlineCode, inputs, sourceRelays)
+      await publishResult(req, JSON.stringify(result ?? null))
+      await feedback(req, 'success', 'inline')
+      return
+    }
+
+    const r = await resolveJob(job)
+    const cacheKey = computeCacheKey(r.functionRef, r.inputs, r.sourceRelays)
+    log(req, `${r.functionRef.address ?? r.functionRef.id} (${job.clearCache ? 'clear' : job.noCache ? 'recompute' : 'cached'})`)
+
+    // clear: delete our cached result (NIP-09) for this key and stop.
+    if (job.clearCache) {
+      const addr = `${KIND.cachedResult}:${config.publicKey}:${cacheKey}`
+      const del = sign({
+        kind: 5,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [['a', addr]],
+        content: 'cache cleared',
+      })
+      await publish([...new Set([config.dvmRelay, r.outputRelay])], del)
+      log(req, 'cache cleared')
+      await feedback(req, 'success', 'cache cleared')
+      return
+    }
+
+    const cached = job.noCache ? null : await findCached(cacheKey, r.ttlSec)
+    if (cached) {
+      await publishResult(req, cached.content, cached)
+      log(req, 'cache hit')
+      await feedback(req, 'success', 'cache hit')
+      return
+    }
+
+    const code = await fetchCode(r.codeRef, r.sourceRelays)
+    if (!code) throw new Error('code event not found')
+    if (config.authorWhitelist.length && !config.authorWhitelist.includes(code.pubkey.toLowerCase())) {
+      throw new Error('code author not whitelisted')
+    }
+
+    const result = await runScript(code.content, r.inputs, r.sourceRelays, {
+      maxRuntimeMs: r.runtimeMs,
+      maxMemoryMb: r.memoryMb,
+    })
+
+    const cacheEvent = sign(buildCachedEvent(cacheKey, r.functionRef, r.inputs, result, r.ttlSec))
+    await publish([...new Set([config.dvmRelay, r.outputRelay])], cacheEvent)
+    await publishResult(req, cacheEvent.content, cacheEvent)
+    log(req, 'computed & cached')
+    await feedback(req, 'success')
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    console.error(`[job ${req.id}] failed: ${message}`)
+    await feedback(req, 'error', message)
+  }
+}
diff --git a/app/presets/dvm-compute/worker/src/index.ts b/app/presets/dvm-compute/worker/src/index.ts
new file mode 100644
index 0000000..4544b52
--- /dev/null
+++ b/app/presets/dvm-compute/worker/src/index.ts
@@ -0,0 +1,47 @@
+import type { Event } from 'nostr-tools'
+import { KIND } from './kinds.js'
+import { config } from './config.js'
+import { subscribe } from './nostr.js'
+import { handleJob } from './handler.js'
+
+// Bounded concurrency: at most `maxConcurrent` scripts run at once; the rest queue.
+const createLimiter = (max: number) => {
+  let active = 0
+  const queue: (() => void)[] = []
+  const next = () => {
+    if (active >= max || queue.length === 0) return
+    active++
+    queue.shift()!()
+  }
+  return (task: () => Promise<void>) => {
+    queue.push(() => {
+      task().finally(() => {
+        active--
+        next()
+      })
+    })
+    next()
+  }
+}
+
+const main = () => {
+  const limit = createLimiter(config.limits.maxConcurrent)
+  const seen = new Set<string>()
+
+  console.log('relaykit dvm-compute starting')
+  console.log(`  pubkey:        ${config.publicKey}`)
+  console.log(`  dvm relay:     ${config.dvmRelay}`)
+  console.log(`  source relays: ${config.sourceRelays.join(', ')}`)
+  console.log(`  authors:       ${config.authorWhitelist.length ? config.authorWhitelist.join(', ') : 'ANY (open)'}`)
+  console.log(`  max concurrent: ${config.limits.maxConcurrent}, runtime ${config.limits.maxRuntimeMs}ms, mem ${config.limits.maxMemoryMb}MB`)
+  console.log(`  job logging:   ${config.logJobs ? 'on' : 'off'}`)
+
+  const since = Math.floor(Date.now() / 1000)
+  subscribe([config.dvmRelay], { kinds: [KIND.jobRequest], since }, (ev: Event) => {
+    if (seen.has(ev.id)) return
+    seen.add(ev.id)
+    limit(() => handleJob(ev))
+  })
+}
+
+main()
diff --git a/app/presets/dvm-compute/worker/src/kinds.ts b/app/presets/dvm-compute/worker/src/kinds.ts
new file mode 100644
index 0000000..4500b9d
--- /dev/null
+++ b/app/presets/dvm-compute/worker/src/kinds.ts
@@ -0,0 +1,19 @@
+// Event kinds used by the compute DVM. See README for how they relate.
+export const KIND = {
+  // NIP-C0: the reusable code source lives here. Regular (non-replaceable) kind — the worker
+  // resolves the latest by created_at for a given `d`; older versions are not auto-replaced.
+  codeSnippet: 1337,
+  // Addressable "data function" definition: references a codeSnippet + bundles source relays,
+  // output relay, default params, subject and ttl. This is the unit clients reference.
+  dataFunction: 31337,
+  // NIP-90: client asks the DVM to run a data function (points at a dataFunction by `a`).
+  jobRequest: 5910,
+  // NIP-90: DVM returns the result (points at the cached event below).
+  jobResult: 6910,
+  // NIP-90: DVM status/errors for a request.
+  jobFeedback: 7000,
+  // Custom addressable cached output. `d` = hash(script + inputs + source relays).
+  cachedResult: 31338,
+} as const
+
+export type Kind = (typeof KIND)[keyof typeof KIND]
diff --git a/app/presets/dvm-compute/worker/src/nostr.ts b/app/presets/dvm-compute/worker/src/nostr.ts
new file mode 100644
index 0000000..74e7cf6
--- /dev/null
+++ b/app/presets/dvm-compute/worker/src/nostr.ts
@@ -0,0 +1,55 @@
+import { SimplePool, finalizeEvent, type Event, type EventTemplate, type Filter } from 'nostr-tools'
+import { useWebSocketImplementation } from 'nostr-tools/pool'
+import WebSocket from 'ws'
+import { config } from './config.js'
+
+useWebSocketImplementation(WebSocket)
+
+const pool = new SimplePool()
+
+// Collect events for the given filters until EOSE or timeout, capped at `max`.
+export const collect = async (
+  relays: string[],
+  filters: Filter[],
+  opts: { timeoutMs: number; max: number },
+): Promise<Event[]> => {
+  const events: Event[] = []
+  return new Promise((resolve) => {
+    let done = false
+    let eoseCount = 0
+    const finish = () => {
+      if (done) return
+      done = true
+      clearTimeout(timer)
+      subs.forEach((s) => s.close())
+      resolve(events)
+    }
+    const timer = setTimeout(finish, opts.timeoutMs)
+    const subs = filters.map((filter) =>
+      pool.subscribeMany(relays, filter, {
+        onevent(ev) {
+          events.push(ev)
+          if (events.length >= opts.max) finish()
+        },
+        oneose() {
+          eoseCount += 1
+          if (eoseCount >= filters.length) finish()
+        },
+      }),
+    )
+  })
+}
+
+export const queryOne = async (relays: string[], filter: Filter, timeoutMs: number): Promise<Event | null> => {
+  const events = await collect(relays, [{ ...filter, limit: 1 }], { timeoutMs, max: 1 })
+  return events[0] ?? null
+}
+
+export const sign = (template: EventTemplate): Event => finalizeEvent(template, config.secretKey)
+
+export const publish = async (relays: string[], event: Event): Promise<void> => {
+  await Promise.allSettled(pool.publish(relays, event))
+}
+
+export const subscribe = (relays: string[], filter: Filter, onevent: (ev: Event) => void) =>
+  pool.subscribeMany(relays, filter, { onevent })
diff --git a/app/presets/dvm-compute/worker/src/sandbox.ts b/app/presets/dvm-compute/worker/src/sandbox.ts
new file mode 100644
index 0000000..e962a5e
--- /dev/null
+++ b/app/presets/dvm-compute/worker/src/sandbox.ts
@@ -0,0 +1,128 @@
+import { getQuickJS } from 'quickjs-emscripten'
+import type { Event, Filter } from 'nostr-tools'
+import { collect } from './nostr.js'
+import { config } from './config.js'
+
+export type SandboxInputs = {
+  subject?: { value: string; type: string }
+  params: Record<string, string>
+}
+
+// A mediated nostr API is the ONLY capability handed to scripts: no fs, net, process, timers.
+const makeQueryFn = (defaultRelays: string[]) => {
+  let fetched = 0
+  return async (filtersJson: string, relaysJson: string): Promise<string> => {
+    const filters = JSON.parse(filtersJson) as Filter[]
+    const provided = relaysJson ? (JSON.parse(relaysJson) as string[] | null) : null
+    const relays = Array.isArray(provided) && provided.length ? provided : defaultRelays
+    // maxEventsPerJob <= 0 means unlimited; otherwise cap the total fetched across all queries.
+    const cap = config.limits.maxEventsPerJob
+    const remaining = cap > 0 ? cap - fetched : Infinity
+    if (remaining <= 0) return JSON.stringify([])
+    const events: Event[] = await collect(relays, filters, {
+      timeoutMs: config.limits.sourceQueryTimeoutMs,
+      max: remaining,
+    })
+    fetched += events.length
+    return JSON.stringify(events)
+  }
+}
+
+export type RunLimits = { maxRuntimeMs: number; maxMemoryMb: number }
+
+// Scripts must define: async function main(inputs, nostr) { ... return <json-serializable> }
+export const runScript = async (
+  code: string,
+  inputs: SandboxInputs,
+  sourceRelays: string[],
+  limits?: RunLimits,
+): Promise<unknown> => {
+  const maxRuntimeMs = limits?.maxRuntimeMs ?? config.limits.maxRuntimeMs
+  const maxMemoryMb = limits?.maxMemoryMb ?? config.limits.maxMemoryMb
+  const QuickJS = await getQuickJS()
+  const runtime = QuickJS.newRuntime()
+  runtime.setMemoryLimit(maxMemoryMb * 1024 * 1024)
+  runtime.setMaxStackSize(1024 * 512)
+  // Budget counts script CPU only: time spent awaiting nostr.query (host network I/O) is
+  // credited back to the deadline, so a slow source relay doesn't trip the interrupt.
+  let deadline = Date.now() + maxRuntimeMs
+  runtime.setInterruptHandler(() => Date.now() > deadline)
+
+  const ctx = runtime.newContext()
+  try {
+    const query = makeQueryFn(sourceRelays)
+    // __query returns a VM promise; the host resolves it once the async collect() finishes, then
+    // pumps the VM's pending jobs so the script's await chain advances. This is the standard
+    // quickjs-emscripten async bridge (deferred promise + executePendingJobs).
+    const queryFn = ctx.newFunction('__query', (filtersHandle, relaysHandle) => {
+      const filtersJson = ctx.getString(filtersHandle)
+      const relaysJson = relaysHandle ? ctx.getString(relaysHandle) : ''
+      const deferred = ctx.newPromise()
+      const t0 = Date.now()
+      query(filtersJson, relaysJson).then(
+        (json) => {
+          deadline += Date.now() - t0
+          const h = ctx.newString(json)
+          deferred.resolve(h)
+          h.dispose()
+        },
+        (err: unknown) => {
+          deadline += Date.now() - t0
+          const h = ctx.newString(err instanceof Error ? err.message : String(err))
+          deferred.reject(h)
+          h.dispose()
+        },
+      )
+      deferred.settled.then(() => runtime.executePendingJobs())
+      return deferred.handle
+    })
+    ctx.setProp(ctx.global, '__query', queryFn)
+    queryFn.dispose()
+
+    const inputsHandle = ctx.newString(JSON.stringify(inputs))
+    ctx.setProp(ctx.global, '__inputsJson', inputsHandle)
+    inputsHandle.dispose()
+
+    const harness = `
+      globalThis.inputs = JSON.parse(globalThis.__inputsJson);
+      globalThis.nostr = {
+        query: (filters, relays) => globalThis.__query(JSON.stringify(filters || []), JSON.stringify(relays || null)).then((s) => JSON.parse(s)),
+      };
+      ${code}
+      ;(() => {
+        if (typeof main !== 'function') throw new Error('script must define async function main(inputs, nostr)');
+        globalThis.__p = Promise.resolve(main(globalThis.inputs, globalThis.nostr));
+      })();
+      globalThis.__p
+    `
+
+    const evalResult = ctx.evalCode(harness)
+    if (evalResult.error) {
+      const err = ctx.dump(evalResult.error)
+      evalResult.error.dispose()
+      throw new Error(`script error: ${typeof err === 'string' ? err : JSON.stringify(err)}`)
+    }
+    const promiseHandle = evalResult.value
+    const resultPromise = ctx.resolvePromise(promiseHandle)
+    promiseHandle.dispose()
+    runtime.executePendingJobs()
+
+    const resolved = await resultPromise
+    if (resolved.error) {
+      const err = ctx.dump(resolved.error)
+      resolved.error.dispose()
+      throw new Error(`script error: ${typeof err === 'string' ? err : JSON.stringify(err)}`)
+    }
+    const result = ctx.dump(resolved.value)
+    resolved.value.dispose()
+
+    const serialized = JSON.stringify(result ?? null)
+    if (serialized.length > config.limits.maxOutputBytes) {
+      throw new Error(`output exceeds max size (${config.limits.maxOutputBytes} bytes)`)
+    }
+    return result
+  } finally {
+    ctx.dispose()
+    runtime.dispose()
+  }
+}
diff --git a/app/presets/dvm-compute/worker/test/definition.mjs b/app/presets/dvm-compute/worker/test/definition.mjs
new file mode 100644
index 0000000..033604f
--- /dev/null
+++ b/app/presets/dvm-compute/worker/test/definition.mjs
@@ -0,0 +1,62 @@
+import { SimplePool, generateSecretKey, finalizeEvent, getPublicKey } from 'nostr-tools'
+
+const RELAY = process.env.RELAY_URL || 'ws://stirfry-556lem-strfry-1:7777'
+const sk = generateSecretKey()
+const pk = getPublicKey(sk)
+const pool = new SimplePool()
+const now = Math.floor(Date.now() / 1000)
+const id = 'test-fn-' + now
+
+// 1) code (kind:1337)
+const code = finalizeEvent(
+  { kind: 1337, created_at: now, tags: [['d', id]], content: 'async function main(inputs){ return { hello: inputs.params.name || "world" } }' },
+  sk,
+)
+// 2) definition (kind:31337) referencing the code
+const def = finalizeEvent(
+  {
+    kind: 31337,
+    created_at: now,
+    tags: [
+      ['d', id],
+      ['code', `1337:${pk}:${id}`],
+      ['param', 'name', 'relaykit'],
+      ['ttl', '600'],
+    ],
+    content: '',
+  },
+  sk,
+)
+// 3) job (kind:5910) pointing at the definition
+const job = finalizeEvent(
+  { kind: 5910, created_at: now + 1, tags: [['a', `31337:${pk}:${id}`, RELAY]], content: '' },
+  sk,
+)
+
+console.log('publishing code + definition…')
+await Promise.allSettled(pool.publish([RELAY], code))
+await Promise.allSettled(pool.publish([RELAY], def))
+await new Promise((r) => setTimeout(r, 500))
+console.log('publishing job', job.id.slice(0, 8))
+await Promise.any(pool.publish([RELAY], job))
+
+const result = await new Promise((resolve) => {
+  const sub = pool.subscribeMany([RELAY], { kinds: [6910, 7000], '#e': [job.id] }, {
+    onevent(ev) {
+      if (ev.kind === 7000) {
+        const s = ev.tags.find((t) => t[0] === 'status')
+        console.log('feedback:', s?.[1], s?.[2] ?? '')
+      } else if (ev.kind === 6910) {
+        console.log('RESULT:', ev.content)
+        const a = ev.tags.find((t) => t[0] === 'a')
+        console.log('cache pointer:', a?.[1] ?? '(none)')
+        resolve(ev.content)
+      }
+    },
+  })
+  setTimeout(() => { sub.close(); resolve(null) }, 15000)
+})
+
+console.log(result ? 'DEFINITION ROUND TRIP OK' : 'TIMEOUT')
+pool.close([RELAY])
+process.exit(result ? 0 : 1)
diff --git a/app/presets/dvm-compute/worker/test/inline.mjs b/app/presets/dvm-compute/worker/test/inline.mjs
new file mode 100644
index 0000000..962a5a1
--- /dev/null
+++ b/app/presets/dvm-compute/worker/test/inline.mjs
@@ -0,0 +1,44 @@
+// Inline test-run: send the script in the job (no 1337 publish). Mirrors the UI "run & test".
+// Usage: RELAY=ws://dvm-test-relay:7777 SOURCE=wss://relay.relaying.earth node test/inline.mjs
+import { SimplePool, finalizeEvent, generateSecretKey } from 'nostr-tools'
+import { useWebSocketImplementation } from 'nostr-tools/pool'
+import WebSocket from 'ws'
+
+useWebSocketImplementation(WebSocket)
+
+const RELAY = process.env.RELAY
+const SOURCE = process.env.SOURCE || 'wss://relay.relaying.earth'
+if (!RELAY) { console.error('set RELAY'); process.exit(1) }
+
+const CODE = `
+async function main(inputs, nostr) {
+  const since = Math.floor(Date.now() / 1000) - 7 * 24 * 60 * 60;
+  const events = await nostr.query([{ kinds: [4223], '#t': ['weather'], since }]);
+  const temps = events.map((e) => e.tags.find((t) => t[0] === 'temp')).filter(Boolean).map((t) => parseFloat(t[1])).filter((n) => !Number.isNaN(n));
+  const avg = temps.length ? temps.reduce((a, b) => a + b, 0) / temps.length : null;
+  return { avg_temp: avg, samples: temps.length, since };
+}
+`
+
+const sk = generateSecretKey()
+const pool = new SimplePool()
+const now = () => Math.floor(Date.now() / 1000)
+const job = finalizeEvent({ kind: 5910, created_at: now(), tags: [['exec', 'inline'], ['relays', SOURCE], ['ttl', '60']], content: CODE }, sk)
+
+const run = async () => {
+  await Promise.allSettled(pool.publish([RELAY], job))
+  console.log('inline job id:', job.id, '\nwaiting...')
+  const sub = pool.subscribeMany([RELAY], { kinds: [6910, 7000], '#e': [job.id] }, {
+    onevent(ev) {
+      if (ev.kind === 7000) {
+        const s = ev.tags.find((t) => t[0] === 'status')
+        console.log('feedback:', s?.[1], s?.[2] ?? '')
+      } else {
+        console.log('RESULT:', ev.content)
+        sub.close(); pool.close([RELAY]); process.exit(0)
+      }
+    },
+  })
+  setTimeout(() => { console.error('timed out after 40s'); process.exit(1) }, 40000)
+}
+run()
diff --git a/app/presets/dvm-compute/worker/test/roundtrip.mjs b/app/presets/dvm-compute/worker/test/roundtrip.mjs
new file mode 100644
index 0000000..a3df35e
--- /dev/null
+++ b/app/presets/dvm-compute/worker/test/roundtrip.mjs
@@ -0,0 +1,44 @@
+import { SimplePool, generateSecretKey, finalizeEvent } from 'nostr-tools'
+
+const RELAY = process.env.RELAY_URL || 'ws://stirfry-556lem-strfry-1:7777'
+const sk = generateSecretKey()
+const pool = new SimplePool()
+
+const req = finalizeEvent(
+  {
+    kind: 5910,
+    created_at: Math.floor(Date.now() / 1000),
+    tags: [['exec', 'inline']],
+    content: 'async function main(inputs, nostr) { return { ok: 42, ts: Date.now() } }',
+  },
+  sk,
+)
+
+console.log('publishing inline job', req.id.slice(0, 8))
+await Promise.any(pool.publish([RELAY], req))
+
+const result = await new Promise((resolve) => {
+  const sub = pool.subscribeMany(
+    [RELAY],
+    { kinds: [6910, 7000], '#e': [req.id] },
+    {
+      onevent(ev) {
+        if (ev.kind === 7000) {
+          const s = ev.tags.find((t) => t[0] === 'status')
+          console.log('feedback:', s?.[1], s?.[2] ?? '')
+        } else if (ev.kind === 6910) {
+          console.log('RESULT:', ev.content)
+          resolve(ev.content)
+        }
+      },
+    },
+  )
+  setTimeout(() => {
+    sub.close()
+    resolve(null)
+  }, 15000)
+})
+
+console.log(result ? 'ROUND TRIP OK' : 'TIMEOUT (no result)')
+pool.close([RELAY])
+process.exit(result ? 0 : 1)
diff --git a/app/presets/dvm-compute/worker/test/smoke.mjs b/app/presets/dvm-compute/worker/test/smoke.mjs
new file mode 100644
index 0000000..020d415
--- /dev/null
+++ b/app/presets/dvm-compute/worker/test/smoke.mjs
@@ -0,0 +1,82 @@
+// End-to-end smoke test for the compute DVM.
+// Publishes a code snippet (1337) + a job request (5910), then waits for the result.
+//
+// Usage:
+//   RELAY=wss://your-dvm-relay AUTHOR_NSEC=nsec1... SUBJECT=<event_id_to_count_comments_for> \
+//     node dvm-compute/test/smoke.mjs
+//
+// - RELAY: the DVM relay url (same as the deployed worker's "DVM relay url").
+// - AUTHOR_NSEC: the script author key. Its pubkey MUST be in the worker's
+//   "allowed script authors" list. Omit to auto-generate one (it prints the pubkey to whitelist).
+// - SUBJECT: an event id that has NIP-22 comments (kind 1111) on your source relays.
+import { SimplePool, finalizeEvent, generateSecretKey, getPublicKey, nip19 } from 'nostr-tools'
+import { useWebSocketImplementation } from 'nostr-tools/pool'
+import WebSocket from 'ws'
+
+useWebSocketImplementation(WebSocket)
+
+const RELAY = process.env.RELAY
+const SUBJECT = process.env.SUBJECT
+if (!RELAY || !SUBJECT) {
+  console.error('set RELAY and SUBJECT env vars (see header)')
+  process.exit(1)
+}
+
+const sk = process.env.AUTHOR_NSEC ? nip19.decode(process.env.AUTHOR_NSEC).data : generateSecretKey()
+const pk = getPublicKey(sk)
+console.log('author pubkey (must be whitelisted):', pk)
+
+const pool = new SimplePool()
+const now = () => Math.floor(Date.now() / 1000)
+
+// A sample script: count NIP-22 comments (kind 1111) referencing the subject event.
+const SCRIPT_SRC = `
+async function main(inputs, nostr) {
+  const target = inputs.subject.value
+  const comments = await nostr.query([{ kinds: [1111], '#E': [target] }])
+  return { comment_cnt: comments.length, ids: comments.map((e) => e.id) }
+}
+`
+
+const scriptD = 'comment-counter'
+const script = finalizeEvent({ kind: 1337, created_at: now(), tags: [['d', scriptD]], content: SCRIPT_SRC }, sk)
+
+const jobReq = finalizeEvent({
+  kind: 5910,
+  created_at: now(),
+  tags: [
+    ['a', `1337:${pk}:${scriptD}`],
+    ['i', SUBJECT, 'event'],
+    ['relays', RELAY],
+    ['ttl', '3600'],
+  ],
+  content: '',
+}, sk)
+
+const run = async () => {
+  console.log('publishing script (1337) and job request (5910)...')
+  await Promise.allSettled(pool.publish([RELAY], script))
+  await Promise.allSettled(pool.publish([RELAY], jobReq))
+  console.log('job id:', jobReq.id, '\nwaiting for result (6910 / feedback 7000)...')
+
+  const sub = pool.subscribeMany([RELAY], { kinds: [6910, 7000], '#e': [jobReq.id] }, {
+    onevent(ev) {
+      if (ev.kind === 7000) {
+        const status = ev.tags.find((t) => t[0] === 'status')
+        console.log('feedback:', status?.[1], status?.[2] ?? '')
+      } else {
+        console.log('RESULT:', ev.content)
+        sub.close()
+        pool.close([RELAY])
+        process.exit(0)
+      }
+    },
+  })
+
+  setTimeout(() => {
+    console.error('timed out after 30s (is the worker deployed and connected to this relay?)')
+    process.exit(1)
+  }, 30000)
+}
+
+run()
diff --git a/app/presets/dvm-compute/worker/test/weather.mjs b/app/presets/dvm-compute/worker/test/weather.mjs
new file mode 100644
index 0000000..1db5b9f
--- /dev/null
+++ b/app/presets/dvm-compute/worker/test/weather.mjs
@@ -0,0 +1,80 @@
+// Example: average weather-station temperature (kind 4223, `temp` tag) over the last week.
+// Publishes the script (1337) + a job request (5910) to the DVM relay, then prints the result.
+//
+// Usage:
+//   RELAY=wss://relay.local SOURCE=wss://relay.relaying.earth AUTHOR_NSEC=nsec1... \
+//     node dvm-compute/test/weather.mjs
+//
+// - RELAY:  the DVM relay url (same as the worker's "DVM relay url").
+// - SOURCE: relay the weather events live on (default wss://relay.relaying.earth).
+// - AUTHOR_NSEC: script author key; its pubkey must be in the worker's "allowed script authors"
+//   (or leave the worker's whitelist empty). Omit to auto-generate (prints the pubkey to whitelist).
+// For self-signed/mkcert relays (e.g. relay.local): prefix with NODE_TLS_REJECT_UNAUTHORIZED=0.
+import { SimplePool, finalizeEvent, generateSecretKey, getPublicKey, nip19 } from 'nostr-tools'
+import { useWebSocketImplementation } from 'nostr-tools/pool'
+import WebSocket from 'ws'
+
+useWebSocketImplementation(WebSocket)
+
+const RELAY = process.env.RELAY
+const SOURCE = process.env.SOURCE || 'wss://relay.relaying.earth'
+if (!RELAY) {
+  console.error('set RELAY (the DVM relay url)')
+  process.exit(1)
+}
+
+const sk = process.env.AUTHOR_NSEC ? nip19.decode(process.env.AUTHOR_NSEC).data : generateSecretKey()
+const pk = getPublicKey(sk)
+console.log('author pubkey (must be whitelisted, or leave whitelist empty):', pk)
+
+const SCRIPT_SRC = `
+async function main(inputs, nostr) {
+  const since = Math.floor(Date.now() / 1000) - 7 * 24 * 60 * 60;
+  const events = await nostr.query([{ kinds: [4223], '#t': ['weather'], since }]);
+  const temps = events
+    .map((e) => e.tags.find((t) => t[0] === 'temp'))
+    .filter(Boolean)
+    .map((t) => parseFloat(t[1]))
+    .filter((n) => !Number.isNaN(n));
+  const avg = temps.length ? temps.reduce((a, b) => a + b, 0) / temps.length : null;
+  return { avg_temp: avg, samples: temps.length, since };
+}
+`
+
+const pool = new SimplePool()
+const now = () => Math.floor(Date.now() / 1000)
+const scriptD = 'avg-weekly-temp'
+
+const script = finalizeEvent({ kind: 1337, created_at: now(), tags: [['d', scriptD]], content: SCRIPT_SRC }, sk)
+const jobReq = finalizeEvent({
+  kind: 5910,
+  created_at: now(),
+  tags: [
+    ['a', `1337:${pk}:${scriptD}`],
+    ['relays', SOURCE],
+    ['ttl', '3600'],
+  ],
+  content: '',
+}, sk)
+
+const run = async () => {
+  console.log(`publishing script + job to ${RELAY} (source: ${SOURCE})...`)
+  await Promise.allSettled(pool.publish([RELAY], script))
+  await Promise.allSettled(pool.publish([RELAY], jobReq))
+  console.log('job id:', jobReq.id, '\nwaiting for result...')
+
+  const sub = pool.subscribeMany([RELAY], { kinds: [6910, 7000], '#e': [jobReq.id] }, {
+    onevent(ev) {
+      if (ev.kind === 7000) {
+        const s = ev.tags.find((t) => t[0] === 'status')
+        console.log('feedback:', s?.[1], s?.[2] ?? '')
+      } else {
+        console.log('RESULT:', ev.content)
+        sub.close(); pool.close([RELAY]); process.exit(0)
+      }
+    },
+  })
+  setTimeout(() => { console.error('timed out after 40s'); process.exit(1) }, 40000)
+}
+
+run()
diff --git a/app/presets/dvm-compute/worker/tsconfig.json b/app/presets/dvm-compute/worker/tsconfig.json
new file mode 100644
index 0000000..01b7b87
--- /dev/null
+++ b/app/presets/dvm-compute/worker/tsconfig.json
@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ES2022",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022"],
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": false,
+    "sourceMap": false
+  },
+  "include": ["src/**/*"]
+}
diff --git a/app/presets/dvm-compute/worker/yarn.lock b/app/presets/dvm-compute/worker/yarn.lock
new file mode 100644
index 0000000..b657373
--- /dev/null
+++ b/app/presets/dvm-compute/worker/yarn.lock
@@ -0,0 +1,328 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"@esbuild/aix-ppc64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz#7a289c158e29cbf59ea0afc83cc80f06d1c89402"
+  integrity sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==
+
+"@esbuild/android-arm64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz#b8828d9edfa3a92660644eb8de6e4f3c203d7b17"
+  integrity sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==
+
+"@esbuild/android-arm@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/android-arm/-/android-arm-0.28.0.tgz#5ec1847605e05b5dbe5df90db9ff7e3e4c58dca7"
+  integrity sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==
+
+"@esbuild/android-x64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/android-x64/-/android-x64-0.28.0.tgz#390642175b88ef82bad4cce03f8ab13fe9b1912e"
+  integrity sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==
+
+"@esbuild/darwin-arm64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz#ae45325960d5950cd6951e4f97396f4e1ff7d8d3"
+  integrity sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==
+
+"@esbuild/darwin-x64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz#c079247d589b6b99449659d94f06951b84bff2e4"
+  integrity sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==
+
+"@esbuild/freebsd-arm64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz#45c456215a486593c94900297202dc11c880a37a"
+  integrity sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==
+
+"@esbuild/freebsd-x64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz#0399494c1c85e4388e9b7040bd60d48f2a5b0d2c"
+  integrity sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==
+
+"@esbuild/linux-arm64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz#d6d9f09ef0de54116bf459a4d53cac7e0952fe39"
+  integrity sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==
+
+"@esbuild/linux-arm@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz#7b42ffa84c288ae94fdc431c1b28a89e3c3b9278"
+  integrity sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==
+
+"@esbuild/linux-ia32@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz#deb15d112ed8dd605346b6b953d23a21ff81253f"
+  integrity sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==
+
+"@esbuild/linux-loong64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz#81fb89d07eecc79b157dea61033757726fce0ca4"
+  integrity sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==
+
+"@esbuild/linux-mips64el@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz#d0e42691b3ff7af9fb2217b70fc01f343bdb62bb"
+  integrity sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==
+
+"@esbuild/linux-ppc64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz#389f3e5e98f17d477c467cc87136e1a076eead87"
+  integrity sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==
+
+"@esbuild/linux-riscv64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz#763bd60d59b242be12da1e67d5729f3024c605fa"
+  integrity sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==
+
+"@esbuild/linux-s390x@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz#aac6061634872e4677de693bce8030d73b1fd055"
+  integrity sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==
+
+"@esbuild/linux-x64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz#4f2917747188fe77632bcec65b2d84b422419779"
+  integrity sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==
+
+"@esbuild/netbsd-arm64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz#814df0ae57a0c386814491b8397eeba82094a947"
+  integrity sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==
+
+"@esbuild/netbsd-x64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz#e01bdf7e60fa1a08e46d46d960b0d9bb8ac210af"
+  integrity sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==
+
+"@esbuild/openbsd-arm64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz#4a15c36aacca68d2d5a4c90b710c06759f4c1ffa"
+  integrity sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==
+
+"@esbuild/openbsd-x64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz#475e6101498a8ecce3008d7c388111d7a27c17bd"
+  integrity sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==
+
+"@esbuild/openharmony-arm64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz#cfdc3957f0b7a69f1bde129aad17fcc2f6fa033e"
+  integrity sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==
+
+"@esbuild/sunos-x64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz#a013c856fecacd1c3aec985c8afe1d1cb017497d"
+  integrity sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==
+
+"@esbuild/win32-arm64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz#eae05e0f35271cad3898b43168d3e9a3bbaf47e5"
+  integrity sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==
+
+"@esbuild/win32-ia32@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz#06161ebc5bf75c08d69feb3c6b22560515913998"
+  integrity sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==
+
+"@esbuild/win32-x64@0.28.0":
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz#04d90d5752b4ce65d2b6ac25eba08ff7624fe07c"
+  integrity sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==
+
+"@jitl/quickjs-ffi-types@0.31.0":
+  version "0.31.0"
+  resolved "https://registry.yarnpkg.com/@jitl/quickjs-ffi-types/-/quickjs-ffi-types-0.31.0.tgz#1f5cbec1c1ec03eba860842ea59914db3cf3c69a"
+  integrity sha512-1yrgvXlmXH2oNj3eFTrkwacGJbmM0crwipA3ohCrjv52gBeDaD7PsTvFYinlAnqU8iPME3LGP437yk05a2oejw==
+
+"@jitl/quickjs-wasmfile-debug-asyncify@0.31.0":
+  version "0.31.0"
+  resolved "https://registry.yarnpkg.com/@jitl/quickjs-wasmfile-debug-asyncify/-/quickjs-wasmfile-debug-asyncify-0.31.0.tgz#0a707fe7ed25e0d5986c8346ae02788a648c9c63"
+  integrity sha512-YkdzQdr1uaftFhgEnTRjTTZHk2SFZdpWO7XhOmRVbi6CEVsH9g5oNF8Ta1q3OuSJHRwwT8YsuR1YzEiEIJEk6w==
+  dependencies:
+    "@jitl/quickjs-ffi-types" "0.31.0"
+
+"@jitl/quickjs-wasmfile-debug-sync@0.31.0":
+  version "0.31.0"
+  resolved "https://registry.yarnpkg.com/@jitl/quickjs-wasmfile-debug-sync/-/quickjs-wasmfile-debug-sync-0.31.0.tgz#aac7f901c4df7fdf3aea456c66dbf38f48b0564e"
+  integrity sha512-8XvloaaWBONqcHXYs5tWOjdhQVxzULilIfB2hvZfS6S+fI4m2+lFiwQy7xeP8ExHmiZ7D8gZGChNkdLgjGfknw==
+  dependencies:
+    "@jitl/quickjs-ffi-types" "0.31.0"
+
+"@jitl/quickjs-wasmfile-release-asyncify@0.31.0":
+  version "0.31.0"
+  resolved "https://registry.yarnpkg.com/@jitl/quickjs-wasmfile-release-asyncify/-/quickjs-wasmfile-release-asyncify-0.31.0.tgz#00b11f65b540e7c9472bd08fb499adac77f4a227"
+  integrity sha512-uz0BbQYTxNsFkvkurd7vk2dOg57ElTBLCuvNtRl4rgrtbC++NIndD5qv2+AXb6yXDD3Uy1O2PCwmoaH0eXgEOg==
+  dependencies:
+    "@jitl/quickjs-ffi-types" "0.31.0"
+
+"@jitl/quickjs-wasmfile-release-sync@0.31.0":
+  version "0.31.0"
+  resolved "https://registry.yarnpkg.com/@jitl/quickjs-wasmfile-release-sync/-/quickjs-wasmfile-release-sync-0.31.0.tgz#66939a090f4a5132e25e15b76e76d09c25f92ea6"
+  integrity sha512-hYduecOByj9AsAfsJhZh5nA6exokmuFC8cls39+lYmTCGY51bgjJJJwReEu7Ff7vBWaQCL6TeDdVlnp2WYz0jw==
+  dependencies:
+    "@jitl/quickjs-ffi-types" "0.31.0"
+
+"@noble/ciphers@2.1.1":
+  version "2.1.1"
+  resolved "https://registry.yarnpkg.com/@noble/ciphers/-/ciphers-2.1.1.tgz#c8c74fcda8c3d1f88797d0ecda24f9fc8b92b052"
+  integrity sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw==
+
+"@noble/curves@2.0.1":
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/@noble/curves/-/curves-2.0.1.tgz#64ba8bd5e8564a02942655602515646df1cdb3ad"
+  integrity sha512-vs1Az2OOTBiP4q0pwjW5aF0xp9n4MxVrmkFBxc6EKZc6ddYx5gaZiAsZoq0uRRXWbi3AT/sBqn05eRPtn1JCPw==
+  dependencies:
+    "@noble/hashes" "2.0.1"
+
+"@noble/hashes@2.0.1":
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/@noble/hashes/-/hashes-2.0.1.tgz#fc1a928061d1232b0a52bb754393c37a5216c89e"
+  integrity sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==
+
+"@scure/base@2.0.0":
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/@scure/base/-/base-2.0.0.tgz#ba6371fddf92c2727e88ad6ab485db6e624f9a98"
+  integrity sha512-3E1kpuZginKkek01ovG8krQ0Z44E3DHPjc5S2rjJw9lZn3KSQOs8S7wqikF/AH7iRanHypj85uGyxk0XAyC37w==
+
+"@scure/bip32@2.0.1":
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/@scure/bip32/-/bip32-2.0.1.tgz#4ceea207cee8626d3fe8f0b6ab68b6af8f81c482"
+  integrity sha512-4Md1NI5BzoVP+bhyJaY3K6yMesEFzNS1sE/cP+9nuvE7p/b0kx9XbpDHHFl8dHtufcbdHRUUQdRqLIPHN/s7yA==
+  dependencies:
+    "@noble/curves" "2.0.1"
+    "@noble/hashes" "2.0.1"
+    "@scure/base" "2.0.0"
+
+"@scure/bip39@2.0.1":
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/@scure/bip39/-/bip39-2.0.1.tgz#47a6dc15e04faf200041239d46ae3bb7c3c96add"
+  integrity sha512-PsxdFj/d2AcJcZDX1FXN3dDgitDDTmwf78rKZq1a6c1P1Nan1X/Sxc7667zU3U+AN60g7SxxP0YCVw2H/hBycg==
+  dependencies:
+    "@noble/hashes" "2.0.1"
+    "@scure/base" "2.0.0"
+
+"@types/node@*":
+  version "25.9.1"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-25.9.1.tgz#3bda556db500ae4319c08e7fc9ab94f19013ba0b"
+  integrity sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==
+  dependencies:
+    undici-types ">=7.24.0 <7.24.7"
+
+"@types/node@^22.10.0":
+  version "22.19.19"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-22.19.19.tgz#3124bf26ded54168b768138321fef99b420c6112"
+  integrity sha512-dyh/xO2Fh5bYrfWaaqGrRQQGkNdmYw6AmaAUvYeUMNTWQtvb796ikLdmTchRmOlOiIJ1TDXfWgVx1QkUlQ6Hew==
+  dependencies:
+    undici-types "~6.21.0"
+
+"@types/ws@^8.5.13":
+  version "8.18.1"
+  resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.18.1.tgz#48464e4bf2ddfd17db13d845467f6070ffea4aa9"
+  integrity sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==
+  dependencies:
+    "@types/node" "*"
+
+esbuild@~0.28.0:
+  version "0.28.0"
+  resolved "https://registry.yarnpkg.com/esbuild/-/esbuild-0.28.0.tgz#5dee347ffb3e3874212a35a69836b077b1ce6d96"
+  integrity sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==
+  optionalDependencies:
+    "@esbuild/aix-ppc64" "0.28.0"
+    "@esbuild/android-arm" "0.28.0"
+    "@esbuild/android-arm64" "0.28.0"
+    "@esbuild/android-x64" "0.28.0"
+    "@esbuild/darwin-arm64" "0.28.0"
+    "@esbuild/darwin-x64" "0.28.0"
+    "@esbuild/freebsd-arm64" "0.28.0"
+    "@esbuild/freebsd-x64" "0.28.0"
+    "@esbuild/linux-arm" "0.28.0"
+    "@esbuild/linux-arm64" "0.28.0"
+    "@esbuild/linux-ia32" "0.28.0"
+    "@esbuild/linux-loong64" "0.28.0"
+    "@esbuild/linux-mips64el" "0.28.0"
+    "@esbuild/linux-ppc64" "0.28.0"
+    "@esbuild/linux-riscv64" "0.28.0"
+    "@esbuild/linux-s390x" "0.28.0"
+    "@esbuild/linux-x64" "0.28.0"
+    "@esbuild/netbsd-arm64" "0.28.0"
+    "@esbuild/netbsd-x64" "0.28.0"
+    "@esbuild/openbsd-arm64" "0.28.0"
+    "@esbuild/openbsd-x64" "0.28.0"
+    "@esbuild/openharmony-arm64" "0.28.0"
+    "@esbuild/sunos-x64" "0.28.0"
+    "@esbuild/win32-arm64" "0.28.0"
+    "@esbuild/win32-ia32" "0.28.0"
+    "@esbuild/win32-x64" "0.28.0"
+
+fsevents@~2.3.3:
+  version "2.3.3"
+  resolved "https://registry.yarnpkg.com/fsevents/-/fsevents-2.3.3.tgz#cac6407785d03675a2a5e1a5305c697b347d90d6"
+  integrity sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==
+
+nostr-tools@^2.10.4:
+  version "2.23.5"
+  resolved "https://registry.yarnpkg.com/nostr-tools/-/nostr-tools-2.23.5.tgz#46fa68a35cf6e918c4f59208a2ed7585c72a68a0"
+  integrity sha512-Fa7ZlUdjfUW1P4E7H3yBexhOHYi18XNyvd2n7eNHkYR085xADX6Y8V8Vm7nT/XQajaFOBrptXmVIGkJ2E4vfVw==
+  dependencies:
+    "@noble/ciphers" "2.1.1"
+    "@noble/curves" "2.0.1"
+    "@noble/hashes" "2.0.1"
+    "@scure/base" "2.0.0"
+    "@scure/bip32" "2.0.1"
+    "@scure/bip39" "2.0.1"
+    nostr-wasm "0.1.0"
+
+nostr-wasm@0.1.0:
+  version "0.1.0"
+  resolved "https://registry.yarnpkg.com/nostr-wasm/-/nostr-wasm-0.1.0.tgz#17af486745feb2b7dd29503fdd81613a24058d94"
+  integrity sha512-78BTryCLcLYv96ONU8Ws3Q1JzjlAt+43pWQhIl86xZmWeegYCNLPml7yQ+gG3vR6V5h4XGj+TxO+SS5dsThQIA==
+
+quickjs-emscripten-core@0.31.0:
+  version "0.31.0"
+  resolved "https://registry.yarnpkg.com/quickjs-emscripten-core/-/quickjs-emscripten-core-0.31.0.tgz#22cbccec207adb6ce486ec1e90730499815e3e15"
+  integrity sha512-oQz8p0SiKDBc1TC7ZBK2fr0GoSHZKA0jZIeXxsnCyCs4y32FStzCW4d1h6E1sE0uHDMbGITbk2zhNaytaoJwXQ==
+  dependencies:
+    "@jitl/quickjs-ffi-types" "0.31.0"
+
+quickjs-emscripten@^0.31.0:
+  version "0.31.0"
+  resolved "https://registry.yarnpkg.com/quickjs-emscripten/-/quickjs-emscripten-0.31.0.tgz#6dbd7dbb5ddf84cf3eb28c3d1411a8300affe3a9"
+  integrity sha512-K7Yt78aRPLjPcqv3fIuLW1jW3pvwO21B9pmFOolsjM/57ZhdVXBr51GqJpalgBlkPu9foAvhEAuuQPnvIGvLvQ==
+  dependencies:
+    "@jitl/quickjs-wasmfile-debug-asyncify" "0.31.0"
+    "@jitl/quickjs-wasmfile-debug-sync" "0.31.0"
+    "@jitl/quickjs-wasmfile-release-asyncify" "0.31.0"
+    "@jitl/quickjs-wasmfile-release-sync" "0.31.0"
+    quickjs-emscripten-core "0.31.0"
+
+tsx@^4.19.2:
+  version "4.22.4"
+  resolved "https://registry.yarnpkg.com/tsx/-/tsx-4.22.4.tgz#0ab3b7fb4ec7feeee74e5b1f26337caa71e44700"
+  integrity sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==
+  dependencies:
+    esbuild "~0.28.0"
+  optionalDependencies:
+    fsevents "~2.3.3"
+
+typescript@^5.7.2:
+  version "5.9.3"
+  resolved "https://registry.yarnpkg.com/typescript/-/typescript-5.9.3.tgz#5b4f59e15310ab17a216f5d6cf53ee476ede670f"
+  integrity sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==
+
+"undici-types@>=7.24.0 <7.24.7":
+  version "7.24.6"
+  resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-7.24.6.tgz#61275b485d7fd4e9d269c7cf04ec2873c9cc0f91"
+  integrity sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==
+
+undici-types@~6.21.0:
+  version "6.21.0"
+  resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-6.21.0.tgz#691d00af3909be93a7faa13be61b3a5b50ef12cb"
+  integrity sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==
+
+ws@^8.18.0:
+  version "8.21.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.0.tgz#012e413fc07429945121b0c153158c4343086951"
+  integrity sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==
diff --git a/docker-compose.yml b/docker-compose.yml
index 83438aa..6b2fe7b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -118,9 +118,14 @@ services:
       - NODE_ENV=development
       - PORT=4000
       - JWT_SECRET=${JWT_SECRET}
+      - YARN_CACHE_FOLDER=/yarn-cache
     volumes:
       - ./app:/app
       - relaykit_data:/app/.relaykit
+      # Persist installed deps (and yarn cache) so cold starts don't re-fetch everything.
+      # The named volume at /app/node_modules also shadows the host bind mount for that path.
+      - relaykit_node_modules:/app/node_modules
+      - relaykit_yarn_cache:/yarn-cache
       - /var/run/docker.sock:/var/run/docker.sock:ro
     depends_on:
       dokploy:
@@ -157,6 +162,8 @@ volumes:
   redis_data:
   dokploy_data:
   relaykit_data:
+  relaykit_node_modules:
+  relaykit_yarn_cache:
 
 networks:
   relaykit-network: