@kehto/paja 0.12.0 → 0.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -268,6 +268,21 @@ signer, discovery author, and signed authorization pubkeys must agree; a fixed
268
268
  pubkey without `signEvent` is read-only. This implements the draft
269
269
  [NAP-UPLOAD at `a7cc174`](https://github.com/napplet/naps/blob/a7cc17463cbf5d9cb87884b31071bc4fc826034c/naps/NAP-UPLOAD.md).
270
270
 
271
+ ## NAP-RESOURCE schemes
272
+
273
+ Paja supports locally decoded `data:` URLs and canonical
274
+ `blossom:sha256:<hex>` resources. Blossom hashes are resolved only through
275
+ host-owned runtime-pointer or upload server settings; there is no public
276
+ default. Servers use HTTPS, with plain HTTP allowed only for loopback
277
+ development. Paja refuses redirects, caps responses at 10 MiB, verifies the
278
+ requested SHA-256, and derives MIME from the returned bytes before delivery.
279
+
280
+ Direct `http:` and `https:` resource URLs remain disabled. They are distinct
281
+ from the HTTP(S) transport selected internally for a `blossom:` identifier and
282
+ still require a general DNS/private-address-safe fetch proxy. This behavior
283
+ targets draft
284
+ [NAP-RESOURCE at `fa6bcc6`](https://github.com/napplet/naps/blob/fa6bcc6935aa19e7b70ab2a2c721dafca77c78e1/naps/NAP-RESOURCE.md).
285
+
271
286
  Full package docs: [`docs/packages/paja.md`](../../docs/packages/paja.md).
272
287
  Getting started: [`docs/how-tos/paja-getting-started.md`](../../docs/how-tos/paja-getting-started.md).
273
288
  Local authoring how-to: [`docs/how-tos/paja-local-authoring.md`](../../docs/how-tos/paja-local-authoring.md).