@kehto/paja 0.15.2 → 0.16.1

package/README.md

@@ -156,7 +156,7 @@ outside this behavior.
 [NAP-IDENTITY at `6461e4b37c29dc09a20dff35d9515889c4433874`](https://github.com/napplet/naps/blob/6461e4b37c29dc09a20dff35d9515889c4433874/naps/NAP-IDENTITY.md)
 is byte-identical to the recorded `napplet/naps` master document for this phase.
 Pinned [NAP-OUTBOX at `4589a8f9a16d8aa29b3740e2b3b0cdca11e0976e`](https://github.com/napplet/naps/blob/4589a8f9a16d8aa29b3740e2b3b0cdca11e0976e/naps/NAP-OUTBOX.md)
-together with installed `@napplet/nap@0.31.2` types is the PoC contract because
+together with installed `@napplet/nap@0.32.0` types is the PoC contract because
 current master has no NAP-OUTBOX path. Paja therefore makes no current-master
 OUTBOX conformance claim. Blossom upload behavior targets pinned
 [NAP-UPLOAD at `a7cc17463cbf5d9cb87884b31071bc4fc826034c`](https://github.com/napplet/naps/blob/a7cc17463cbf5d9cb87884b31071bc4fc826034c/naps/NAP-UPLOAD.md).
@@ -183,8 +183,10 @@ node scripts/build-paja-pages.mjs
 ```
 
 When `PAJA_UPLOAD_SERVERS` is set, the runtime enables the Blossom upload rail
-with server discovery and uses those servers for Blossom NAP-RESOURCE
-resolution too.
+and also makes those servers explicit NAP-RESOURCE fallbacks. It is not needed
+for read-side discovery: resources learned through OUTBOX use their event hints
+and hinted-author/publisher server lists first, then the active shell user's
+published list.
 
 ## Installed intent handlers and delivery
 
@@ -210,7 +212,7 @@ identity. A superseded target/source, failed open/readiness, or terminal send is
 handled by the controller's replacement/retry/terminal policy and produces a
 canonical failed `IntentResult`.
 
-`@napplet/shim@0.29.2` supplies no generic shell API. Kehto deliberately keeps
+`@napplet/shim@0.30.0` supplies no generic shell API. Kehto deliberately keeps
 its host-owned mandatory `window.napplet.shell` prelude: it installs the live
 receiver before the one bare `shell.ready`, caches the first `shell.init`, and
 provides local `ready()`, `supports()`, read-only `services`, and one-shot
@@ -311,13 +313,30 @@ canonical `network-error`, while any CORS-readable response is returned as NAP
 bytes.
 
 `data:` remains locally decoded. `blossom:` is a separate, content-addressed
-boundary and is advertised only when at least one usable host-owned
-runtime-pointer or upload server is configured. The only accepted identifier is
-`blossom:sha256:<hex>`; Paja refuses redirects, verifies the requested SHA-256,
-and permits plain-HTTP Blossom transport only for configured loopback
-development servers. Resource-origin permissiveness does not alter Paja's
-independent signer confirmations. This behavior targets draft
-[NAP-RESOURCE at `fa6bcc6`](https://github.com/napplet/naps/blob/fa6bcc6935aa19e7b70ab2a2c721dafca77c78e1/naps/NAP-RESOURCE.md).
+boundary and is advertised because each request may provide server locations
+without a host default. Paja accepts only public-looking HTTPS origin hints,
+discards invalid/private literals, and deduplicates them. For a canonical URL
+previously returned to the same napplet window by `outbox.getEvent`,
+`outbox.query`, or `outbox.subscribe`, Paja retains bounded event context
+without prefetching bytes. Resolution tries request and
+event-local server hints first, then lazily queries hinted authors' and the
+event publisher's newest BUD-03 kind `10063` lists through the verified
+NIP-65-aware OUTBOX router, then queries the active shell user's BUD-03 list
+through that same router, then uses host-configured runtime-pointer and
+upload-runtime fallbacks. The user-list
+lookup works independently of upload mode; an upload runtime may reuse the same
+servers when present. ROM-specific event and publisher locations retain
+priority over the user/runtime fallbacks. The combined list is capped at eight
+candidates. The only accepted identifier is `blossom:sha256:<hex>`;
+Paja refuses redirects, verifies the requested SHA-256, and permits plain-HTTP
+transport only for configured loopback development defaults. Browser-only Paja
+cannot pin DNS results, so production runtimes must add the draft's DNS-time
+private-address checks. This behavior targets draft
+[NAP-RESOURCE at `9511232`](https://github.com/napplet/naps/blob/9511232f69313aa7953d110e35d32cc28d506f66/naps/NAP-RESOURCE.md), with the merged package implementation
+[`napplet/web#206@19e0029b`](https://github.com/napplet/web/pull/206) released as
+`@napplet/core`/`@napplet/nap` 0.32.0, `@napplet/shim` 0.30.0, and
+`@napplet/sdk` 0.28.0. Publisher discovery follows
+[Blossom BUD-03 at `b5bd280`](https://github.com/hzrd149/blossom/blob/b5bd2801d1763aa635fc8fea7a76597e0eb18990/buds/03.md).
 
 Full package docs: [`docs/packages/paja.md`](../../docs/packages/paja.md).
 Getting started: [`docs/how-tos/paja-getting-started.md`](../../docs/how-tos/paja-getting-started.md).