@kehto/paja 0.13.0 → 0.15.0

package/README.md

@@ -63,8 +63,23 @@ error details. Paja auto-connects a browser NIP-07 signer when `window.nostr` is
 available, can connect to a bunker/NIP-46 URI, and only uses the generated local
 development signer when the Dev signer button is selected. Sign, publish, DM
 send, filesystem picker, Blossom upload, and external-link requests use one serialized in-page
-confirmation dialog. Deny has initial focus, Escape denies, and there is no
-bypass list. Upload consent identifies the requesting napplet, file, MIME type,
+confirmation dialog. Deny has initial focus and Escape denies. A napplet-scoped
+sign request defaults to one-time approval, with explicit options to remember
+that event kind or trust every kind from the napplet identity and target. The trust
+choice carries a visible warning. Remembered signing authority is keyed by the
+active signer pubkey, host-owned napplet d-tag and aggregate hash, and the Paja
+target boundary. Runtime pointers are isolated by verified artifact hash;
+direct development targets are isolated by exact target URL, and their trust
+survives code reloads at that URL. Changing the signer, identity, artifact, or
+target asks again. Missing source identity or a nonnumeric kind remains
+one-shot, denials are never remembered, and the signer controls can revoke
+every remembered approval. If durable deletion fails, Paja keeps the approval
+listed and logs the failure instead of claiming revocation. A full Paja host
+reload creates a new ephemeral Dev signer and therefore asks again; a stable
+NIP-07 or NIP-46 account can reuse its saved choice. Publish and other operation
+confirmations continue to prompt independently. This is Paja runtime policy under draft
+[NAP-RELAY PR #2 at `0be8abce18beb46ca37bd4ddd042f58d30b4eedc`](https://github.com/napplet/naps/pull/2), not
+a Kehto kernel default. Upload consent identifies the requesting napplet, file, MIME type,
 size, selected server, and durable public effect before bytes leave the browser.
 A denial or a live publish with no accepting relay returns a canonical failure
 and is not added to Paja's in-memory relay view. Paja's scoped-relay hook
@@ -155,6 +170,20 @@ runtime tabs in local storage so returning to `/web/paja/` restores the previous
 pointer set. An explicit pointer in the URL still takes precedence over restored
 tabs.
 
+The static artifact defaults to Paja's standard live relays and memory uploads.
+To point it at specific live relays or Blossom upload servers, pass
+comma-separated host lists when generating the artifact:
+
+```bash
+PAJA_RELAY_URLS="wss://relay.example,wss://relay.example.net" \
+PAJA_UPLOAD_SERVERS="https://blossom.example" \
+node scripts/build-paja-pages.mjs
+```
+
+When `PAJA_UPLOAD_SERVERS` is set, the runtime enables the Blossom upload rail
+with server discovery and uses those servers for Blossom NAP-RESOURCE
+resolution too.
+
 ## Installed intent handlers and delivery
 
 Paja keeps resolver-verified pointer and manifest facts in an installed catalog,
@@ -270,17 +299,21 @@ pubkey without `signEvent` is read-only. This implements the draft
 
 ## NAP-RESOURCE schemes
 
-Paja supports locally decoded `data:` URLs and canonical
-`blossom:sha256:<hex>` resources. Blossom hashes are resolved only through
-host-owned runtime-pointer or upload server settings; there is no public
-default. Servers use HTTPS, with plain HTTP allowed only for loopback
-development. Paja refuses redirects, caps responses at 10 MiB, verifies the
-requested SHA-256, and derives MIME from the returned bytes before delivery.
-
-Direct `http:` and `https:` resource URLs remain disabled. They are distinct
-from the HTTP(S) transport selected internally for a `blossom:` identifier and
-still require a general DNS/private-address-safe fetch proxy. This behavior
-targets draft
+Paja's developer-runtime policy accepts arbitrary `http:` and `https:` resource
+URLs so a normal remote image does not look broken merely because its origin was
+not pre-granted. Paja resolves those URLs with browser `fetch`, omits credentials
+and referrer data, caps responses at 10 MiB, and classifies MIME from returned
+bytes. Browser network and CORS rules still apply: an unreadable response is the
+canonical `network-error`, while any CORS-readable response is returned as NAP
+bytes.
+
+`data:` remains locally decoded. `blossom:` is a separate, content-addressed
+boundary and is advertised only when at least one usable host-owned
+runtime-pointer or upload server is configured. The only accepted identifier is
+`blossom:sha256:<hex>`; Paja refuses redirects, verifies the requested SHA-256,
+and permits plain-HTTP Blossom transport only for configured loopback
+development servers. Resource-origin permissiveness does not alter Paja's
+independent signer confirmations. This behavior targets draft
 [NAP-RESOURCE at `fa6bcc6`](https://github.com/napplet/naps/blob/fa6bcc6935aa19e7b70ab2a2c721dafca77c78e1/naps/NAP-RESOURCE.md).
 
 Full package docs: [`docs/packages/paja.md`](../../docs/packages/paja.md).