@kehto/paja 0.15.0 → 0.15.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.md +6 -3
  2. package/dist/browser-host.js +441 -441
  3. package/dist/browser-host.js.map +1 -1
  4. package/dist/{chunk-DTRRHXYY.js → chunk-32QBJDAR.js} +2 -2
  5. package/dist/chunk-32QBJDAR.js.map +1 -0
  6. package/dist/cli.js +1 -1
  7. package/dist/index.js +1 -1
  8. package/package.json +2 -2
  9. package/dist/chunk-DTRRHXYY.js.map +0 -1
package/README.md CHANGED
@@ -59,7 +59,9 @@ warning, when the target would block the sandboxed frame.
59
59
 
60
60
  The console shows supported interfaces with per-domain injection toggles,
61
61
  runtime ACL controls, signer controls, and a filterable message log with visible
62
- error details. Paja auto-connects a browser NIP-07 signer when `window.nostr` is
62
+ error details. In runtime-pointer mode, ACL controls always display and mutate
63
+ the active tab's resolver-verified d-tag and aggregate hash; a grant or revoke
64
+ rerenders that same identity immediately. Paja auto-connects a browser NIP-07 signer when `window.nostr` is
63
65
  available, can connect to a bunker/NIP-46 URI, and only uses the generated local
64
66
  development signer when the Dev signer button is selected. Sign, publish, DM
65
67
  send, filesystem picker, Blossom upload, and external-link requests use one serialized in-page
@@ -217,8 +219,9 @@ shim capability.
217
219
 
218
220
  Before Paja assigns a verified runtime-pointer document to `srcdoc`, it inserts
219
221
  Kehto's local Class-1 CSP before the host-owned namespace prelude. The policy
220
- denies all defaults; permits inline script/style, `data:`/`blob:` images, and
221
- `data:` fonts; grants `connect-src` only to the resolved relay and Blossom
222
+ denies all defaults; permits inline script/style, WebAssembly compilation through
223
+ the narrow `'wasm-unsafe-eval'` source, `data:`/`blob:` images, and `data:` fonts;
224
+ keeps JavaScript string evaluation blocked; grants `connect-src` only to the resolved relay and Blossom
222
225
  origins; explicitly denies worker, child, frame, media, object, manifest,
223
226
  prefetch, base, and form capabilities; and ends with `frame-ancestors 'self'`.
224
227
  The NIP-5D verified-srcdoc and opaque-sandbox rules do not mandate this CSP;