@kehto/paja 0.16.2 → 0.16.4

package/README.md

@@ -186,7 +186,8 @@ When `PAJA_UPLOAD_SERVERS` is set, the runtime enables the Blossom upload rail
 and also makes those servers explicit NAP-RESOURCE fallbacks. It is not needed
 for read-side discovery: resources learned through OUTBOX use their event hints
 and hinted-author/publisher server lists first, then the active shell user's
-published list.
+published list, the current window's verified pointer-manifest servers, and
+finally configured runtime fallbacks.
 
 ## Installed intent handlers and delivery
 
@@ -324,8 +325,8 @@ without prefetching bytes. Resolution tries request and
 event-local server hints first, then lazily queries hinted authors' and the
 event publisher's newest BUD-03 kind `10063` lists through the verified
 NIP-65-aware OUTBOX router, then queries the active shell user's BUD-03 list
-through that same router, then uses host-configured runtime-pointer and
-upload-runtime fallbacks. The user-list
+through that same router, then uses the current window's verified
+pointer-manifest servers, followed by upload-runtime fallbacks. The user-list
 lookup works independently of upload mode; an upload runtime may reuse the same
 servers when present. ROM-specific event and publisher locations retain
 priority over the user/runtime fallbacks. The combined list is capped at eight
@@ -333,8 +334,14 @@ candidates. The only accepted identifier is `blossom:sha256:<hex>`;
 Paja refuses redirects, verifies the requested SHA-256, and permits plain-HTTP
 transport only for configured loopback development defaults. Browser-only Paja
 cannot pin DNS results, so production runtimes must add the draft's DNS-time
-private-address checks. This behavior targets draft
-[NAP-RESOURCE at `9511232`](https://github.com/napplet/naps/blob/9511232f69313aa7953d110e35d32cc28d506f66/naps/NAP-RESOURCE.md), with the merged package implementation
+private-address checks. The current
+[NAP-RESOURCE draft at `fa6bcc6`](https://github.com/napplet/naps/blob/fa6bcc6935aa19e7b70ab2a2c721dafca77c78e1/naps/NAP-RESOURCE.md)
+assigns fetching and policy to the runtime and defines no wire-level Blossom
+server-hint field. Retaining verified manifest servers per window is therefore
+Paja host policy, informed by the current
+[NIP-5D draft at `24711d9`](https://github.com/nostr-protocol/nips/blob/24711d9c47bbdd07908bf1d52bf677d9cbc530f0/5D.md),
+which defines manifest `server` tags. The existing request-server compatibility
+path comes from the earlier NAP-RESOURCE draft at `9511232`, with the merged package implementation
 [`napplet/web#206@19e0029b`](https://github.com/napplet/web/pull/206) released as
 `@napplet/core`/`@napplet/nap` 0.32.0, `@napplet/shim` 0.30.0, and
 `@napplet/sdk` 0.28.0. Publisher discovery follows

package/dist/browser-host.js

@@ -702,7 +702,7 @@ function createNapEnforceGate(config) {
 function formatDenialReason(capability) {
   return `denied: ${capability}`;
 }
-function createSessionRegistry(notifier) {
+function createSessionRegistry(notifier, onRegister) {
   const byWindowId2 = /* @__PURE__ */ new Map();
   const byPubkey2 = /* @__PURE__ */ new Map();
   const byWindowIdEntry = /* @__PURE__ */ new Map();
@@ -712,6 +712,7 @@ function createSessionRegistry(notifier) {
       byWindowId2.set(windowId, entry.pubkey);
       byPubkey2.set(entry.pubkey, entry);
       byWindowIdEntry.set(windowId, entry);
+      onRegister?.(windowId);
     },
     unregister(windowId) {
       const pubkey2 = byWindowId2.get(windowId);
@@ -931,6 +932,12 @@ function createFirewallState(persistence) {
       counters = result2.newState;
       return result2;
     },
+    resetInitBudget(initKey) {
+      if (!Object.hasOwn(counters.bursts, initKey)) return;
+      const bursts = { ...counters.bursts };
+      delete bursts[initKey];
+      counters = { ...counters, bursts };
+    },
     setPolicy(napplet, policy) {
       config = setPolicy(config, napplet, policy);
     },
@@ -2416,8 +2423,8 @@ function buildObservation(envelope, windowId, senderCap, sessionRegistry2, getFo
     size,
     initElapsedMs,
     // `windowId` comes from the host's source-bound session lookup, never the
-    // napplet message envelope. It scopes startup burst accounting to this
-    // registered realm while rate limits remain dTag-wide.
+    // napplet message envelope. Trusted register() calls retire this key's
+    // previous startup budget; ordinary messages cannot reset it.
     initKey: windowId,
     focused: focus.focused,
     msSinceFocusGain: focus.msSinceFocusGain,
@@ -2664,7 +2671,10 @@ function createRuntime(hooks) {
   const subscriptions = /* @__PURE__ */ new Map();
   const serviceRegistry = { ...hooks.services };
   const registeredServices = createRegisteredServices(serviceRegistry);
-  const sessionRegistry2 = createSessionRegistry(hooks.onPendingUpdate);
+  const firewallState = createFirewallState(hooks.firewallPersistence);
+  const sessionRegistry2 = createSessionRegistry(hooks.onPendingUpdate, (windowId) => {
+    firewallState.resetInitBudget(windowId);
+  });
   let incRuntime = null;
   const aclState = createAclState(hooks.aclPersistence, "permissive", (mutation) => {
     if (mutation.type === "revoke" && mutation.capability !== "relay:read") return;
@@ -2674,7 +2684,6 @@ function createRuntime(hooks) {
       }
     }
   });
-  const firewallState = createFirewallState(hooks.firewallPersistence);
   const manifestCache2 = createManifestCache(hooks.manifestPersistence);
   const replayDetector = createReplayDetector(
     hooks.getConfigOverrides ? () => hooks.getConfigOverrides().replayWindowSeconds : void 0
@@ -4033,16 +4042,29 @@ function nappletNamespacePrelude(domains) {
   function request(message, resultType, map, options = {}) {
     const requestId = message.id ?? id();
     const outbound = { ...message, id: requestId };
+    const timeoutMs = options.timeoutMs === void 0 ? requestTimeoutMs : options.timeoutMs;
+    if (options.signal?.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
     return new Promise((resolve, reject2) => {
-      const off = listen((event) => {
+      let timer;
+      let off;
+      const cleanup = () => {
+        off?.();
+        if (timer !== void 0) clearTimeout(timer);
+        options.signal?.removeEventListener("abort", abort);
+      };
+      const abort = () => {
+        cleanup();
+        if (options.cancelOnAbort) post({ type: "resource.cancel", id: requestId });
+        reject2(new DOMException("Aborted", "AbortError"));
+      };
+      off = listen((event) => {
         if (!isParentMessage(event)) return;
         const incoming = event.data;
         if (typeof incoming !== "object" || incoming === null) return;
         const msg = incoming;
         if (msg.type !== resultType && msg.type !== `${message.type}.error`) return;
         if (msg.id !== requestId) return;
-        off();
-        clearTimeout(timer);
+        cleanup();
         const error = typeof msg.error === "string" ? msg.error : "";
         if (error && options.rejectOnError !== false) {
           reject2(new Error(error));
@@ -4054,10 +4076,13 @@ function nappletNamespacePrelude(domains) {
           reject2(err2);
         }
       });
-      const timer = setTimeout(() => {
-        off();
-        reject2(new Error(`${message.type} timed out`));
-      }, requestTimeoutMs);
+      if (timeoutMs !== null) {
+        timer = setTimeout(() => {
+          cleanup();
+          reject2(new Error(`${message.type} timed out`));
+        }, timeoutMs);
+      }
+      options.signal?.addEventListener("abort", abort, { once: true });
       post(outbound);
     });
   }
@@ -4806,17 +4831,25 @@ function nappletNamespacePrelude(domains) {
       type: "resource.bytes",
       url,
       ...Array.isArray(options?.servers) ? { servers: Array.from(options.servers) } : {}
-    }, "resource.bytes.result", (msg) => msg.blob);
+    }, "resource.bytes.result", (msg) => msg.blob, {
+      timeoutMs: null,
+      signal: options?.signal,
+      cancelOnAbort: true
+    });
     return {
       info: () => request({ type: "resource.info" }, "resource.info.result", (msg) => msg.info),
       bytes,
-      bytesMany: (requests) => request({
+      bytesMany: (requests, options) => request({
         type: "resource.bytesMany",
         requests: Array.from(requests || [], (entry) => ({
           url: entry.url,
           ...Array.isArray(entry.servers) ? { servers: Array.from(entry.servers) } : {}
         }))
-      }, "resource.bytesMany.result", (msg) => Array.isArray(msg.items) ? msg.items : []),
+      }, "resource.bytesMany.result", (msg) => Array.isArray(msg.items) ? msg.items : [], {
+        timeoutMs: null,
+        signal: options?.signal,
+        cancelOnAbort: true
+      }),
       bytesAsObjectURL(url) {
         let objectUrl = "";
         const handle = {
@@ -9572,6 +9605,9 @@ function isValidFilterArray2(value) {
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function actionRegistryKey(windowId, actionId) {
+  return JSON.stringify([windowId, actionId]);
+}
 var MODIFIER_ALIASES = {
   ctrl: "ctrl",
   control: "ctrl",
@@ -9640,7 +9676,7 @@ function bindingsForWindow(windowId, registry2, windowIndex) {
   if (!actionIds) return [];
   const bindings = [];
   for (const actionId of actionIds) {
-    const entry = registry2.get(actionId);
+    const entry = registry2.get(actionRegistryKey(windowId, actionId));
     if (!entry || entry.windowId !== windowId) continue;
     bindings.push({ actionId, key: entry.chordString });
   }
@@ -9653,10 +9689,9 @@ function pushBindings(windowId, registry2, windowIndex, send) {
   };
   send(payload);
 }
-function removeActionFromWindowIndex(actionId, windowIndex) {
-  for (const [wid, set] of windowIndex.entries()) {
-    if (set.delete(actionId) && set.size === 0) windowIndex.delete(wid);
-  }
+function removeActionFromWindowIndex(windowId, actionId, windowIndex) {
+  const actions = windowIndex.get(windowId);
+  if (actions?.delete(actionId) && actions.size === 0) windowIndex.delete(windowId);
 }
 var KEYS_SERVICE_VERSION = "1.3.0";
 function rememberActionForWindow(windowIndex, windowId, actionId) {
@@ -9664,7 +9699,7 @@ function rememberActionForWindow(windowIndex, windowId, actionId) {
   windowIndex.get(windowId).add(actionId);
 }
 function bindActionEntry(registry2, windowIndex, actionId, windowId, chord, chordString) {
-  registry2.set(actionId, { chord, chordString, windowId });
+  registry2.set(actionRegistryKey(windowId, actionId), { actionId, chord, chordString, windowId });
   rememberActionForWindow(windowIndex, windowId, actionId);
 }
 function bindActionAndMarkChanged(registry2, windowIndex, changedWindowIds, actionId, windowId, chord, chordString) {
@@ -9737,6 +9772,7 @@ function createKeysService(options = {}) {
     const bridgeSendHandles = /* @__PURE__ */ new Map();
     const unsubscribeHandles = /* @__PURE__ */ new Map();
     const handleBridgeRegisterAction = (windowId, m, send) => {
+      const registryKey = actionRegistryKey(windowId, m.action.id);
       bridgeSendHandles.set(windowId, send);
       let binding;
       const changedWindowIds = /* @__PURE__ */ new Set();
@@ -9744,8 +9780,8 @@ function createKeysService(options = {}) {
         try {
           const chord = parseChord(m.action.defaultKey);
           const normalizedChord = formatChord(chord);
-          const existingEntry = bridgeActionRegistry.get(m.action.id);
-          const existing = unsubscribeHandles.get(m.action.id);
+          const existingEntry = bridgeActionRegistry.get(registryKey);
+          const existing = unsubscribeHandles.get(registryKey);
           let nextUnsubscribe;
           if (!isUnavailableBinding(chord)) {
             nextUnsubscribe = bridge.subscribe(normalizedChord, (ev) => {
@@ -9771,13 +9807,13 @@ function createKeysService(options = {}) {
               existing();
             } catch {
             }
-            unsubscribeHandles.delete(m.action.id);
+            unsubscribeHandles.delete(registryKey);
           }
           if (existingEntry) changedWindowIds.add(existingEntry.windowId);
-          removeActionFromWindowIndex(m.action.id, bridgeWindowActions);
-          bridgeActionRegistry.delete(m.action.id);
+          removeActionFromWindowIndex(windowId, m.action.id, bridgeWindowActions);
+          bridgeActionRegistry.delete(registryKey);
           if (nextUnsubscribe) {
-            unsubscribeHandles.set(m.action.id, nextUnsubscribe);
+            unsubscribeHandles.set(registryKey, nextUnsubscribe);
             binding = bindActionAndMarkChanged(
               bridgeActionRegistry,
               bridgeWindowActions,
@@ -9807,18 +9843,19 @@ function createKeysService(options = {}) {
         send
       );
     };
-    const handleBridgeUnregisterAction = (_windowId, m, send) => {
+    const handleBridgeUnregisterAction = (windowId, m, send) => {
       if (!m.actionId) return;
-      const unsubscribe = unsubscribeHandles.get(m.actionId);
-      const entry = bridgeActionRegistry.get(m.actionId);
+      const registryKey = actionRegistryKey(windowId, m.actionId);
+      const unsubscribe = unsubscribeHandles.get(registryKey);
+      const entry = bridgeActionRegistry.get(registryKey);
       if (!unsubscribe) return;
       try {
         unsubscribe();
       } catch {
       }
-      unsubscribeHandles.delete(m.actionId);
-      bridgeActionRegistry.delete(m.actionId);
-      removeActionFromWindowIndex(m.actionId, bridgeWindowActions);
+      unsubscribeHandles.delete(registryKey);
+      bridgeActionRegistry.delete(registryKey);
+      removeActionFromWindowIndex(windowId, m.actionId, bridgeWindowActions);
       if (entry) {
         const ownerSend = bridgeSendHandles.get(entry.windowId) ?? send;
         pushBindings(entry.windowId, bridgeActionRegistry, bridgeWindowActions, ownerSend);
@@ -9838,15 +9875,16 @@ function createKeysService(options = {}) {
         const actions = bridgeWindowActions.get(windowId);
         if (!actions) return;
         for (const actionId of actions) {
-          const unsubscribe = unsubscribeHandles.get(actionId);
+          const registryKey = actionRegistryKey(windowId, actionId);
+          const unsubscribe = unsubscribeHandles.get(registryKey);
           if (unsubscribe) {
             try {
               unsubscribe();
             } catch {
             }
           }
-          unsubscribeHandles.delete(actionId);
-          bridgeActionRegistry.delete(actionId);
+          unsubscribeHandles.delete(registryKey);
+          bridgeActionRegistry.delete(registryKey);
         }
         bridgeWindowActions.delete(windowId);
         bridgeSendHandles.delete(windowId);
@@ -9899,13 +9937,13 @@ function createKeysService(options = {}) {
       });
     }
     if (isReserved) return;
-    for (const [actionId, entry] of actionRegistry.entries()) {
+    for (const entry of actionRegistry.values()) {
       if (chordMatches(entry.chord, ev)) {
         const send = sendHandles.get(entry.windowId);
         if (send) {
           const payload = {
             type: "keys.action",
-            actionId
+            actionId: entry.actionId
           };
           send(payload);
         }
@@ -9914,6 +9952,7 @@ function createKeysService(options = {}) {
   };
   target.addEventListener("keydown", listener);
   const handleDocumentRegisterAction = (windowId, m, send) => {
+    const registryKey = actionRegistryKey(windowId, m.action.id);
     sendHandles.set(windowId, send);
     let binding;
     const changedWindowIds = /* @__PURE__ */ new Set();
@@ -9921,11 +9960,11 @@ function createKeysService(options = {}) {
       try {
         const chord = parseChord(m.action.defaultKey);
         const normalizedChord = formatChord(chord);
-        const existing = actionRegistry.get(m.action.id);
+        const existing = actionRegistry.get(registryKey);
         if (existing) {
           changedWindowIds.add(existing.windowId);
-          removeActionFromWindowIndex(m.action.id, windowActions);
-          actionRegistry.delete(m.action.id);
+          removeActionFromWindowIndex(windowId, m.action.id, windowActions);
+          actionRegistry.delete(registryKey);
         }
         if (!isUnavailableBinding(chord)) {
           binding = bindActionAndMarkChanged(actionRegistry, windowActions, changedWindowIds, m.action.id, windowId, chord, normalizedChord);
@@ -9943,10 +9982,12 @@ function createKeysService(options = {}) {
     sendRegisterActionResult2(send, m, binding);
     pushChangedBindings(changedWindowIds, actionRegistry, windowActions, sendHandles, send);
   };
-  const handleDocumentUnregisterAction = (_windowId, m, send) => {
-    if (!m.actionId || !actionRegistry.has(m.actionId)) return;
-    const entry = actionRegistry.get(m.actionId);
-    actionRegistry.delete(m.actionId);
+  const handleDocumentUnregisterAction = (windowId, m, send) => {
+    if (!m.actionId) return;
+    const registryKey = actionRegistryKey(windowId, m.actionId);
+    const entry = actionRegistry.get(registryKey);
+    if (!entry) return;
+    actionRegistry.delete(registryKey);
     const set = windowActions.get(entry.windowId);
     if (set) {
       set.delete(m.actionId);
@@ -9966,7 +10007,7 @@ function createKeysService(options = {}) {
     onWindowDestroyed(windowId) {
       const actions = windowActions.get(windowId);
       if (actions) {
-        for (const actionId of actions) actionRegistry.delete(actionId);
+        for (const actionId of actions) actionRegistry.delete(actionRegistryKey(windowId, actionId));
         windowActions.delete(windowId);
       }
       sendHandles.delete(windowId);
@@ -17220,6 +17261,7 @@ function createPajaBlossomEventResolver(options) {
   const now2 = options.now ?? Date.now;
   const ttl = Math.max(0, options.serverListTtlMs ?? DEFAULT_SERVER_LIST_TTL_MS);
   const windows = /* @__PURE__ */ new Map();
+  const windowServers = /* @__PURE__ */ new Map();
   const serverLists = /* @__PURE__ */ new Map();
   const pendingServerLists = /* @__PURE__ */ new Map();
   function observe(windowId, results) {
@@ -17297,9 +17339,20 @@ function createPajaBlossomEventResolver(options) {
       );
       for (const list of lists) appendUnique(servers, list);
     }
+    if (windowId) appendUnique(servers, windowServers.get(windowId) ?? []);
     appendUnique(servers, options.getConfiguredServers());
     return servers.slice(0, PAJA_RESOURCE_MAX_SERVERS);
   }
+  function setWindowServers(windowId, servers) {
+    if (!windowId) return;
+    const normalized = [];
+    for (const value of servers) {
+      const server = normalizePublicBlossomServer(value);
+      if (server) appendUnique(normalized, [server]);
+    }
+    if (normalized.length > 0) windowServers.set(windowId, normalized);
+    else windowServers.delete(windowId);
+  }
   async function discoverServerList(pubkey2) {
     const cached = serverLists.get(pubkey2);
     if (cached && cached.expiresAt > now2()) return [...cached.servers];
@@ -17344,7 +17397,11 @@ function createPajaBlossomEventResolver(options) {
     observe,
     decorate,
     getServers,
-    clearWindow: (windowId) => windows.delete(windowId)
+    setWindowServers,
+    clearWindow(windowId) {
+      windows.delete(windowId);
+      windowServers.delete(windowId);
+    }
   };
 }
 function extractEventResourceLocations(event) {
@@ -20240,7 +20297,11 @@ function createDevServices(backend, getSimulation, relayConfig, onThemeService,
     return wasWebrtcEnabled !== webrtcEnabled || dmChanged;
   }
   refreshAvailability();
-  return { services, refreshAvailability };
+  return {
+    services,
+    refreshAvailability,
+    setWindowBlossomServers: blossomEventResolver.setWindowServers
+  };
 }
 function createPajaAdapter(config, getSimulation, onThemeService, onThemeBroadcast, confirmRequest, signerProvider, getIdentity, onEnvironmentChanged, intentHost, userActivation, notifyOptions, configOptions) {
   const resolveIdentity = (windowId) => getIdentity?.(windowId) ?? {
@@ -20308,6 +20369,7 @@ function createPajaAdapter(config, getSimulation, onThemeService, onThemeBroadca
   });
   return {
     ready,
+    setWindowBlossomServers: serviceBundle.setWindowBlossomServers,
     relayPool: createPajaRelayHooks(relayBackend, getSimulation, relayConfig),
     relayConfig,
     windowManager: { createWindow: () => null },
@@ -20400,7 +20462,7 @@ async function resolvePajaPointer(value, options = {}) {
   const ownsPool = options.pool === void 0;
   try {
     const event = await resolvePointerEvent(pointer, pool, relays, normalizeMaxWaitMs(options.maxWaitMs));
-    const blossomServers = [...options.blossomServers ?? []];
+    const blossomServers = resolvePointerBlossomServers(event, options.blossomServers ?? []);
     const resolved = await resolveNapplet({
       event,
       cache: await openNappletArtifactCache({ requireStorageEstimate: false }),
@@ -20427,6 +20489,20 @@ async function resolvePajaPointer(value, options = {}) {
     }
   }
 }
+function resolvePointerBlossomServers(event, configured) {
+  const servers = [];
+  for (const value of event.tags.flatMap(
+    (tag) => tag[0] === "server" && tag[1] ? [tag[1]] : []
+  )) {
+    const normalized = normalizePublicBlossomServer(value);
+    if (normalized && !servers.includes(normalized)) servers.push(normalized);
+  }
+  for (const value of configured) {
+    const server = normalizePublicBlossomServer(value) ?? value;
+    if (!servers.includes(server)) servers.push(server);
+  }
+  return servers;
+}
 function injectPajaRuntimeCsp(html, origins) {
   const grantedOrigins = [...new Set(origins)].sort();
   const connectSrc = grantedOrigins.length > 0 ? `connect-src ${grantedOrigins.join(" ")}` : "connect-src 'none'";
@@ -21852,6 +21928,9 @@ function resolvedTargetKey(target) {
 function runtimeTabGenerationId(tab) {
   return `${tab.id}:${tab.generation}`;
 }
+function bindRuntimeTabBlossomServers(adapter, windowId, resolvedTarget) {
+  adapter.setWindowBlossomServers(windowId, resolvedTarget.blossomServers);
+}
 function getActiveTab(state) {
   return state.tabs.find((tab) => tab.id === state.activeTabId) ?? null;
 }
@@ -22129,23 +22208,25 @@ function startRuntimeTabNavigation(tab, state, context) {
   tab.status = "booting";
   context.setStatus(state, "booting");
   renderRuntimeTabs(state);
+  const windowId = runtimeTabWindowId(context.config, tab);
+  bindRuntimeTabBlossomServers(context.adapter, windowId, tab.resolvedTarget);
   void context.navigateFrame(
     tab.frame,
     context.config,
     generation,
     context.adapter,
     tab.resolvedTarget,
-    runtimeTabWindowId(context.config, tab),
+    windowId,
     () => tab.generation === generation,
-    (windowId) => {
+    (windowId2) => {
       if (tab.generation !== generation) return;
-      tab.windowId = windowId;
-      if (state.activeTabId === tab.id) context.runtime.currentWindowId = windowId;
+      tab.windowId = windowId2;
+      if (state.activeTabId === tab.id) context.runtime.currentWindowId = windowId2;
     }
-  ).then((windowId) => {
+  ).then((windowId2) => {
     if (tab.generation !== generation) return;
-    tab.windowId = windowId;
-    if (state.activeTabId === tab.id) context.runtime.currentWindowId = windowId;
+    tab.windowId = windowId2;
+    if (state.activeTabId === tab.id) context.runtime.currentWindowId = windowId2;
   }).catch((error) => {
     if (tab.generation !== generation) return;
     tab.frame.removeAttribute("src");