@kehto/paja 0.12.0 → 0.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -155,6 +155,20 @@ runtime tabs in local storage so returning to `/web/paja/` restores the previous
155
155
  pointer set. An explicit pointer in the URL still takes precedence over restored
156
156
  tabs.
157
157
 
158
+ The static artifact defaults to Paja's standard live relays and memory uploads.
159
+ To point it at specific live relays or Blossom upload servers, pass
160
+ comma-separated host lists when generating the artifact:
161
+
162
+ ```bash
163
+ PAJA_RELAY_URLS="wss://relay.example,wss://relay.example.net" \
164
+ PAJA_UPLOAD_SERVERS="https://blossom.example" \
165
+ node scripts/build-paja-pages.mjs
166
+ ```
167
+
168
+ When `PAJA_UPLOAD_SERVERS` is set, the runtime enables the Blossom upload rail
169
+ with server discovery and uses those servers for Blossom NAP-RESOURCE
170
+ resolution too.
171
+
158
172
  ## Installed intent handlers and delivery
159
173
 
160
174
  Paja keeps resolver-verified pointer and manifest facts in an installed catalog,
@@ -268,6 +282,21 @@ signer, discovery author, and signed authorization pubkeys must agree; a fixed
268
282
  pubkey without `signEvent` is read-only. This implements the draft
269
283
  [NAP-UPLOAD at `a7cc174`](https://github.com/napplet/naps/blob/a7cc17463cbf5d9cb87884b31071bc4fc826034c/naps/NAP-UPLOAD.md).
270
284
 
285
+ ## NAP-RESOURCE schemes
286
+
287
+ Paja supports locally decoded `data:` URLs and canonical
288
+ `blossom:sha256:<hex>` resources. Blossom hashes are resolved only through
289
+ host-owned runtime-pointer or upload server settings; there is no public
290
+ default. Servers use HTTPS, with plain HTTP allowed only for loopback
291
+ development. Paja refuses redirects, caps responses at 10 MiB, verifies the
292
+ requested SHA-256, and derives MIME from the returned bytes before delivery.
293
+
294
+ Direct `http:` and `https:` resource URLs remain disabled. They are distinct
295
+ from the HTTP(S) transport selected internally for a `blossom:` identifier and
296
+ still require a general DNS/private-address-safe fetch proxy. This behavior
297
+ targets draft
298
+ [NAP-RESOURCE at `fa6bcc6`](https://github.com/napplet/naps/blob/fa6bcc6935aa19e7b70ab2a2c721dafca77c78e1/naps/NAP-RESOURCE.md).
299
+
271
300
  Full package docs: [`docs/packages/paja.md`](../../docs/packages/paja.md).
272
301
  Getting started: [`docs/how-tos/paja-getting-started.md`](../../docs/how-tos/paja-getting-started.md).
273
302
  Local authoring how-to: [`docs/how-tos/paja-local-authoring.md`](../../docs/how-tos/paja-local-authoring.md).