@kehto/paja 0.15.0 → 0.15.2

package/README.md

@@ -59,7 +59,9 @@ warning, when the target would block the sandboxed frame.
 
 The console shows supported interfaces with per-domain injection toggles,
 runtime ACL controls, signer controls, and a filterable message log with visible
-error details. Paja auto-connects a browser NIP-07 signer when `window.nostr` is
+error details. In runtime-pointer mode, ACL controls always display and mutate
+the active tab's resolver-verified d-tag and aggregate hash; a grant or revoke
+rerenders that same identity immediately. Paja auto-connects a browser NIP-07 signer when `window.nostr` is
 available, can connect to a bunker/NIP-46 URI, and only uses the generated local
 development signer when the Dev signer button is selected. Sign, publish, DM
 send, filesystem picker, Blossom upload, and external-link requests use one serialized in-page
@@ -217,8 +219,9 @@ shim capability.
 
 Before Paja assigns a verified runtime-pointer document to `srcdoc`, it inserts
 Kehto's local Class-1 CSP before the host-owned namespace prelude. The policy
-denies all defaults; permits inline script/style, `data:`/`blob:` images, and
-`data:` fonts; grants `connect-src` only to the resolved relay and Blossom
+denies all defaults; permits inline script/style, WebAssembly compilation through
+the narrow `'wasm-unsafe-eval'` source, `data:`/`blob:` images, and `data:` fonts;
+keeps JavaScript string evaluation blocked; grants `connect-src` only to the resolved relay and Blossom
 origins; explicitly denies worker, child, frame, media, object, manifest,
 prefetch, base, and form capabilities; and ends with `frame-ancestors 'self'`.
 The NIP-5D verified-srcdoc and opaque-sandbox rules do not mandate this CSP;