@kehto/paja 0.15.2 → 0.16.0

package/README.md

@@ -156,7 +156,7 @@ outside this behavior.
 [NAP-IDENTITY at `6461e4b37c29dc09a20dff35d9515889c4433874`](https://github.com/napplet/naps/blob/6461e4b37c29dc09a20dff35d9515889c4433874/naps/NAP-IDENTITY.md)
 is byte-identical to the recorded `napplet/naps` master document for this phase.
 Pinned [NAP-OUTBOX at `4589a8f9a16d8aa29b3740e2b3b0cdca11e0976e`](https://github.com/napplet/naps/blob/4589a8f9a16d8aa29b3740e2b3b0cdca11e0976e/naps/NAP-OUTBOX.md)
-together with installed `@napplet/nap@0.31.2` types is the PoC contract because
+together with installed `@napplet/nap@0.32.0` types is the PoC contract because
 current master has no NAP-OUTBOX path. Paja therefore makes no current-master
 OUTBOX conformance claim. Blossom upload behavior targets pinned
 [NAP-UPLOAD at `a7cc17463cbf5d9cb87884b31071bc4fc826034c`](https://github.com/napplet/naps/blob/a7cc17463cbf5d9cb87884b31071bc4fc826034c/naps/NAP-UPLOAD.md).
@@ -210,7 +210,7 @@ identity. A superseded target/source, failed open/readiness, or terminal send is
 handled by the controller's replacement/retry/terminal policy and produces a
 canonical failed `IntentResult`.
 
-`@napplet/shim@0.29.2` supplies no generic shell API. Kehto deliberately keeps
+`@napplet/shim@0.30.0` supplies no generic shell API. Kehto deliberately keeps
 its host-owned mandatory `window.napplet.shell` prelude: it installs the live
 receiver before the one bare `shell.ready`, caches the first `shell.init`, and
 provides local `ready()`, `supports()`, read-only `services`, and one-shot
@@ -311,13 +311,19 @@ canonical `network-error`, while any CORS-readable response is returned as NAP
 bytes.
 
 `data:` remains locally decoded. `blossom:` is a separate, content-addressed
-boundary and is advertised only when at least one usable host-owned
-runtime-pointer or upload server is configured. The only accepted identifier is
-`blossom:sha256:<hex>`; Paja refuses redirects, verifies the requested SHA-256,
-and permits plain-HTTP Blossom transport only for configured loopback
-development servers. Resource-origin permissiveness does not alter Paja's
-independent signer confirmations. This behavior targets draft
-[NAP-RESOURCE at `fa6bcc6`](https://github.com/napplet/naps/blob/fa6bcc6935aa19e7b70ab2a2c721dafca77c78e1/naps/NAP-RESOURCE.md).
+boundary and is advertised because each request may provide server locations
+without a host default. Paja accepts only public-looking HTTPS origin hints,
+discards invalid/private literals, deduplicates them, and tries them before
+host-configured runtime-pointer or upload defaults. The combined list is capped
+at eight candidates. The only accepted identifier is `blossom:sha256:<hex>`;
+Paja refuses redirects, verifies the requested SHA-256, and permits plain-HTTP
+transport only for configured loopback development defaults. Browser-only Paja
+cannot pin DNS results, so production runtimes must add the draft's DNS-time
+private-address checks. This behavior targets draft
+[NAP-RESOURCE at `9511232`](https://github.com/napplet/naps/blob/9511232f69313aa7953d110e35d32cc28d506f66/naps/NAP-RESOURCE.md), with the merged package implementation
+[`napplet/web#206@19e0029b`](https://github.com/napplet/web/pull/206) released as
+`@napplet/core`/`@napplet/nap` 0.32.0, `@napplet/shim` 0.30.0, and
+`@napplet/sdk` 0.28.0.
 
 Full package docs: [`docs/packages/paja.md`](../../docs/packages/paja.md).
 Getting started: [`docs/how-tos/paja-getting-started.md`](../../docs/how-tos/paja-getting-started.md).

package/dist/browser-host.js

@@ -638,7 +638,7 @@ function deserialize2(json) {
   return defaultConfig();
 }
 
-// ../../node_modules/.pnpm/@napplet+core@0.31.1/node_modules/@napplet/core/dist/index.js
+// ../../node_modules/.pnpm/@napplet+core@0.32.0/node_modules/@napplet/core/dist/index.js
 function createDispatch() {
   const handlers = /* @__PURE__ */ new Map();
   function registerNap2(domain, handler) {
@@ -4802,11 +4802,21 @@ function nappletNamespacePrelude(domains) {
   }
   function makeResource() {
     const objectUrls = /* @__PURE__ */ new Set();
-    const bytes = (url) => request({ type: "resource.bytes", url }, "resource.bytes.result", (msg) => msg.blob);
+    const bytes = (url, options) => request({
+      type: "resource.bytes",
+      url,
+      ...Array.isArray(options?.servers) ? { servers: Array.from(options.servers) } : {}
+    }, "resource.bytes.result", (msg) => msg.blob);
     return {
       info: () => request({ type: "resource.info" }, "resource.info.result", (msg) => msg.info),
       bytes,
-      bytesMany: (urls) => request({ type: "resource.bytesMany", urls }, "resource.bytesMany.result", (msg) => Array.isArray(msg.items) ? msg.items : []),
+      bytesMany: (requests) => request({
+        type: "resource.bytesMany",
+        requests: Array.from(requests || [], (entry) => ({
+          url: entry.url,
+          ...Array.isArray(entry.servers) ? { servers: Array.from(entry.servers) } : {}
+        }))
+      }, "resource.bytesMany.result", (msg) => Array.isArray(msg.items) ? msg.items : []),
       bytesAsObjectURL(url) {
         let objectUrl = "";
         const handle = {
@@ -11155,7 +11165,8 @@ function normalizeResourceInfo(info) {
   return {
     schemes: Array.isArray(info.schemes) ? info.schemes.filter((scheme) => typeof scheme?.scheme === "string").map((scheme) => ({ scheme: scheme.scheme, enabled: scheme.enabled !== false })) : [],
     ...typeof info.maxBytes === "number" ? { maxBytes: info.maxBytes } : {},
-    ...typeof info.maxUrls === "number" ? { maxUrls: info.maxUrls } : {}
+    ...typeof info.maxUrls === "number" ? { maxUrls: info.maxUrls } : {},
+    ...typeof info.maxServers === "number" ? { maxServers: info.maxServers } : {}
   };
 }
 async function resolveResourceInfo(options, windowId) {
@@ -11194,10 +11205,11 @@ function classifyResourceFailure(error) {
     message: error instanceof Error ? error.message : String(error)
   };
 }
-async function fetchResourceItem(options, windowId, info, url, signal) {
+async function fetchResourceItem(options, windowId, info, request, signal) {
+  const { url } = request;
   const parsedUrl = parseResourceUrl(url);
   if (!parsedUrl) return resourceInvalidRequest(url, `invalid URL: ${url}`);
-  if (options.isOriginGranted && options.getConnectGrants) {
+  if (parsedUrl.origin !== "null" && options.isOriginGranted && options.getConnectGrants) {
     const identity = options.resolveIdentity?.(windowId) ?? null;
     if (!identity) {
       return {
@@ -11221,7 +11233,8 @@ async function fetchResourceItem(options, windowId, info, url, signal) {
   try {
     const response = await options.fetch(url, {
       method: "GET",
-      signal
+      signal,
+      ...parsedUrl.protocol === "blossom:" && request.servers !== void 0 ? { servers: [...request.servers] } : {}
     });
     const buffer = await response.arrayBuffer();
     if (info.maxBytes !== void 0 && buffer.byteLength > info.maxBytes) {
@@ -11245,12 +11258,12 @@ async function fetchResourceItem(options, windowId, info, url, signal) {
   }
 }
 async function handleBytes(options, state, windowId, msg, send) {
-  const { requestId, url } = msg;
+  const { requestId, ...request } = msg;
   const controller = new AbortController();
   trackRequest(state, requestId, windowId, controller);
   try {
     const info = await resolveResourceInfo(options, windowId);
-    const item = await fetchResourceItem(options, windowId, info, url, controller.signal);
+    const item = await fetchResourceItem(options, windowId, info, request, controller.signal);
     if (controller.signal.aborted) return;
     if (!item.ok) {
       sendResourceError(send, requestId, item.message, item.error);
@@ -11272,9 +11285,9 @@ async function handleBytes(options, state, windowId, msg, send) {
   }
 }
 async function handleBytesMany(options, state, windowId, msg, send) {
-  const { requestId, urls } = msg;
-  if (!Array.isArray(urls) || urls.length === 0 || urls.some((url) => typeof url !== "string")) {
-    sendBytesManyError(send, requestId, "resource.bytesMany requires a non-empty urls array", "invalid-request");
+  const { requestId, requests } = msg;
+  if (!isResourceRequestList(requests)) {
+    sendBytesManyError(send, requestId, "resource.bytesMany requires a non-empty requests array", "invalid-request");
     return;
   }
   let info;
@@ -11285,7 +11298,7 @@ async function handleBytesMany(options, state, windowId, msg, send) {
     sendBytesManyError(send, requestId, failure3.message, failure3.error);
     return;
   }
-  if (info.maxUrls !== void 0 && urls.length > info.maxUrls) {
+  if (info.maxUrls !== void 0 && requests.length > info.maxUrls) {
     sendBytesManyError(send, requestId, `resource.bytesMany exceeds ${info.maxUrls} URLs`, "too-large");
     return;
   }
@@ -11293,8 +11306,8 @@ async function handleBytesMany(options, state, windowId, msg, send) {
   trackRequest(state, requestId, windowId, controller);
   try {
     const items = [];
-    for (const url of urls) {
-      const item = await fetchResourceItem(options, windowId, info, url, controller.signal);
+    for (const request of requests) {
+      const item = await fetchResourceItem(options, windowId, info, request, controller.signal);
       if (controller.signal.aborted) return;
       if (item.ok) {
         items.push({
@@ -11326,6 +11339,12 @@ async function handleBytesMany(options, state, windowId, msg, send) {
     untrackRequest(state, windowId, requestId);
   }
 }
+function hasValidServerHints(request) {
+  return request.servers === void 0 || Array.isArray(request.servers) && request.servers.every((server) => typeof server === "string");
+}
+function isResourceRequestList(value) {
+  return Array.isArray(value) && value.length > 0 && value.every((request) => typeof request === "object" && request !== null && typeof request.url === "string" && hasValidServerHints(request));
+}
 function handleCancel(state, windowId, requestId) {
   const entry = state.inFlight.get(requestKey(windowId, requestId));
   if (entry) {
@@ -11363,11 +11382,15 @@ function createResourceService(options) {
           const m = message;
           const requestId = requestIdFromMessage(m);
           if (!requestId) return;
-          if (typeof m.url !== "string") {
-            sendResourceError(send, requestId, "resource.bytes requires a URL", "invalid-request");
+          if (typeof m.url !== "string" || !hasValidServerHints(m)) {
+            sendResourceError(send, requestId, "resource.bytes requires a URL and optional string servers", "invalid-request");
             return;
           }
-          handleBytes(options, state, windowId, { requestId, url: m.url }, send).catch(() => {
+          handleBytes(options, state, windowId, {
+            requestId,
+            url: m.url,
+            ...m.servers !== void 0 ? { servers: [...m.servers] } : {}
+          }, send).catch(() => {
           });
           return;
         }
@@ -11383,7 +11406,7 @@ function createResourceService(options) {
           const m = message;
           const requestId = requestIdFromMessage(m);
           if (!requestId) return;
-          handleBytesMany(options, state, windowId, { requestId, urls: m.urls ?? [] }, send).catch(() => {
+          handleBytesMany(options, state, windowId, { requestId, requests: m.requests ?? [] }, send).catch(() => {
           });
           return;
         }
@@ -18184,6 +18207,7 @@ async function resolveNapplet(options) {
 // src/browser-resource.ts
 var PAJA_RESOURCE_MAX_BYTES = 10 * 1024 * 1024;
 var PAJA_RESOURCE_MAX_URLS = 100;
+var PAJA_RESOURCE_MAX_SERVERS = 8;
 var UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
 var BLOSSOM_RESOURCE_PATTERN = /^blossom:sha256:([0-9a-f]{64})$/i;
 function createPajaResourceFetch(options = {}) {
@@ -18194,7 +18218,7 @@ function createPajaResourceFetch(options = {}) {
       throw new ResourceServiceError("invalid-request", "NAP-RESOURCE is read-only");
     }
     if (url.protocol === "blossom:") {
-      return fetchBlossomResource(value, init.signal, options);
+      return fetchBlossomResource(value, init.signal, init.servers ?? [], options);
     }
     if (url.protocol === "http:" || url.protocol === "https:") {
       return fetchNetworkResource(value, init.signal, options.fetch ?? globalThis.fetch);
@@ -18217,19 +18241,18 @@ function createPajaResourceFetch(options = {}) {
     return new Response(arrayBufferFor(bytes), { headers: { "content-type": mime } });
   };
 }
-function pajaResourceInfo(blossomServers = []) {
+function pajaResourceInfo() {
   const schemes = [
     { scheme: "data", enabled: true },
     { scheme: "https", enabled: true },
-    { scheme: "http", enabled: true }
+    { scheme: "http", enabled: true },
+    { scheme: "blossom", enabled: true }
   ];
-  if (usableBlossomServers(blossomServers).length > 0) {
-    schemes.push({ scheme: "blossom", enabled: true });
-  }
   return {
     schemes,
     maxBytes: PAJA_RESOURCE_MAX_BYTES,
-    maxUrls: PAJA_RESOURCE_MAX_URLS
+    maxUrls: PAJA_RESOURCE_MAX_URLS,
+    maxServers: PAJA_RESOURCE_MAX_SERVERS
   };
 }
 async function fetchNetworkResource(value, signal, fetcher) {
@@ -18261,20 +18284,24 @@ async function fetchNetworkResource(value, signal, fetcher) {
   }
   return new Response(arrayBufferFor(bytes), { headers: { "content-type": mime } });
 }
-async function fetchBlossomResource(value, signal, options) {
+async function fetchBlossomResource(value, signal, requestServers, options) {
   const match = BLOSSOM_RESOURCE_PATTERN.exec(value);
   if (!match?.[1]) {
     throw new ResourceServiceError("invalid-request", "expected blossom:sha256:<64 hex characters>");
   }
   const expectedHash = match[1].toLowerCase();
-  const servers = usableBlossomServers(options.getBlossomServers?.() ?? []);
+  const servers = resolveBlossomServers(
+    requestServers,
+    options.getBlossomServers?.() ?? []
+  );
   if (servers.length === 0) {
-    throw new ResourceServiceError("blocked-by-policy", "Paja has no configured Blossom server");
+    throw new ResourceServiceError("blocked-by-policy", "Paja has no accepted Blossom server");
   }
   const fetcher = options.fetch ?? globalThis.fetch;
   let foundHashMismatch = false;
   let foundNotFound = false;
-  let lastNetworkMessage = "all configured Blossom servers failed";
+  let foundInconclusive = false;
+  let lastNetworkMessage = "all accepted Blossom servers failed";
   for (const server of servers) {
     if (signal.aborted) throw new DOMException("Resource request cancelled", "AbortError");
     const resourceUrl = `${server}/${expectedHash}`;
@@ -18284,10 +18311,13 @@ async function fetchBlossomResource(value, signal, options) {
         method: "GET",
         signal,
         redirect: "error",
-        cache: "no-store"
+        cache: "no-store",
+        credentials: "omit",
+        referrerPolicy: "no-referrer"
       });
     } catch (error) {
       if (signal.aborted || isAbortError(error)) throw error;
+      foundInconclusive = true;
       lastNetworkMessage = error instanceof Error ? error.message : String(error);
       continue;
     }
@@ -18296,6 +18326,7 @@ async function fetchBlossomResource(value, signal, options) {
       continue;
     }
     if (!response.ok) {
+      foundInconclusive = true;
       lastNetworkMessage = `Blossom server returned HTTP ${response.status}`;
       continue;
     }
@@ -18313,11 +18344,48 @@ async function fetchBlossomResource(value, signal, options) {
   if (foundHashMismatch) {
     throw new ResourceServiceError("decode-failed", "Blossom response did not match the requested SHA-256");
   }
+  if (foundInconclusive) {
+    throw new ResourceServiceError("network-error", lastNetworkMessage);
+  }
   if (foundNotFound) {
     throw new ResourceServiceError("not-found", "Blossom resource was not found");
   }
   throw new ResourceServiceError("network-error", lastNetworkMessage);
 }
+function resolveBlossomServers(requestServers, configuredServers) {
+  const servers = [];
+  for (const value of requestServers) {
+    const server = normalizePublicBlossomHint(value);
+    if (server && !servers.includes(server)) servers.push(server);
+    if (servers.length === PAJA_RESOURCE_MAX_SERVERS) return servers;
+  }
+  for (const server of usableBlossomServers(configuredServers)) {
+    if (!servers.includes(server)) servers.push(server);
+    if (servers.length === PAJA_RESOURCE_MAX_SERVERS) break;
+  }
+  return servers;
+}
+function normalizePublicBlossomHint(value) {
+  if (typeof value !== "string" || value.trim().length === 0) return null;
+  try {
+    const url = new URL(value.trim());
+    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" || !isPublicHostname(url.hostname)) return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function isPublicHostname(value) {
+  const hostname = value.replace(/^\[|\]$/gu, "").toLowerCase();
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || !hostname.includes(".")) return false;
+  if (hostname.includes(":")) {
+    return hostname !== "::" && hostname !== "::1" && !hostname.startsWith("::ffff:") && !/^(?:fc|fd|fe[89ab]|ff)/iu.test(hostname) && !hostname.startsWith("2001:db8:");
+  }
+  const octets = hostname.split(".").map(Number);
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return true;
+  const [first, second] = octets;
+  return first !== 0 && first !== 10 && first !== 127 && first < 224 && !(first === 100 && second >= 64 && second <= 127) && !(first === 169 && second === 254) && !(first === 172 && second >= 16 && second <= 31) && !(first === 192 && second === 168) && !(first === 198 && (second === 18 || second === 19));
+}
 function usableBlossomServers(values) {
   const servers = [];
   for (const value of values) {
@@ -19649,7 +19717,7 @@ function createDevServices(backend, getSimulation, relayConfig, onThemeService,
   const services = {
     resource: createResourceService({
       fetch: createPajaResourceFetch({ getBlossomServers }),
-      resourceInfo: () => pajaResourceInfo(getBlossomServers())
+      resourceInfo: () => pajaResourceInfo()
     })
   };
   if (getSimulation().capabilities.domains.keys && typeof document !== "undefined") {