@kehto/paja 0.18.1 → 0.19.0

package/dist/browser-host.js

@@ -15656,6 +15656,115 @@ function nappletNamespacePrelude(domains) {
     configurable: false
   });
 }
+function insertNappletHead(html, content) {
+  const opening = /^([\t\n\f\r ]*(?:<!doctype[\t\n\f\r ]+html[\t\n\f\r ]*>[\t\n\f\r ]*)?(?:<html>[\t\n\f\r ]*)?)(<head>)?/i.exec(html);
+  const prefix = opening[0];
+  const insertion = opening[2] ? content : `<head>${content}</head>`;
+  return `${prefix}${insertion}${html.slice(prefix.length)}`;
+}
+var DEFAULT_DIRECTIVES = {
+  "default-src": ["'none'"],
+  "script-src": ["'unsafe-inline'", "'wasm-unsafe-eval'"],
+  "style-src": ["'unsafe-inline'"],
+  "img-src": ["data:", "blob:"],
+  "font-src": ["data:"],
+  "connect-src": ["'none'"],
+  "worker-src": ["'none'"],
+  "child-src": ["'none'"],
+  "frame-src": ["'none'"],
+  "media-src": ["'none'"],
+  "object-src": ["'none'"],
+  "manifest-src": ["'none'"],
+  "base-uri": ["'none'"],
+  "form-action": ["'none'"]
+};
+var OPTIONAL_DIRECTIVES = /* @__PURE__ */ new Set([
+  "script-src-elem",
+  "script-src-attr",
+  "style-src-elem",
+  "style-src-attr"
+]);
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "'none'",
+  "'self'",
+  "'unsafe-inline'",
+  "'wasm-unsafe-eval'",
+  "'unsafe-hashes'",
+  "'strict-dynamic'",
+  "'report-sample'"
+]);
+function connectionOrigin(source) {
+  let url;
+  try {
+    url = new URL(source);
+  } catch {
+    throw new Error(`CSP connection grant must be an exact HTTP(S)/WS(S) origin: ${source}`);
+  }
+  if (!/^(https?|wss?):$/.test(url.protocol) || url.username || url.password || url.pathname !== "/" && url.pathname !== "" || url.search || url.hash || /[\s*\\;,"<>'`]/.test(source + url.origin) || !source.startsWith(`${url.protocol}//`)) {
+    throw new Error(`CSP connection grant must be an exact HTTP(S)/WS(S) origin: ${source}`);
+  }
+  return url.origin;
+}
+function validateSources(directive, sources2) {
+  if (!Array.isArray(sources2) || sources2.length === 0) {
+    throw new Error(`CSP ${directive} needs a nonempty source list; use 'none' to deny it`);
+  }
+  const result2 = [...new Set(sources2)];
+  for (const source of result2) {
+    if (typeof source !== "string" || !/^[\x21-\x7e]+$/.test(source) || /[;,"<>\\]/.test(source)) {
+      throw new Error(`Invalid CSP source in ${directive}`);
+    }
+    if (source.toLowerCase() === "'unsafe-eval'") {
+      throw new Error("NIP-5D CSP forbids 'unsafe-eval'; use 'wasm-unsafe-eval' for WebAssembly");
+    }
+    if (source.includes("'") && !KEYWORDS.has(source) && !/^'(?:nonce-|sha(?:256|384|512)-)[A-Za-z0-9+/_-]+=*'$/.test(source)) {
+      throw new Error(`Invalid CSP keyword in ${directive}: ${source}`);
+    }
+  }
+  if (result2.includes("'none'") && result2.length !== 1) {
+    throw new Error(`CSP ${directive} cannot combine 'none' with other sources`);
+  }
+  return result2;
+}
+function requireBootstrapScripts(directive, sources2) {
+  if (!sources2.includes("'unsafe-inline'") || sources2.some(
+    (source) => /^'(?:nonce-|sha(?:256|384|512)-|strict-dynamic')/.test(source)
+  )) {
+    throw new Error(`CSP ${directive} must allow the shell's inline namespace bootstrap`);
+  }
+}
+function buildNappletCsp(options = {}) {
+  const grants = [...new Set((options.connectOrigins ?? []).map(connectionOrigin))].sort();
+  const policy = {
+    ...DEFAULT_DIRECTIVES,
+    "connect-src": grants.length ? grants : ["'none'"]
+  };
+  for (const [directive, sources2] of Object.entries(options.directives ?? {})) {
+    if (!Object.hasOwn(DEFAULT_DIRECTIVES, directive) && !OPTIONAL_DIRECTIVES.has(directive)) {
+      throw new Error(`Unsupported meta CSP directive: ${directive}`);
+    }
+    policy[directive] = validateSources(directive, sources2);
+  }
+  const connect = policy["connect-src"];
+  if (!(connect.length === 1 && connect[0] === "'none'")) {
+    policy["connect-src"] = [...new Set(connect.map((source) => {
+      const origin = connectionOrigin(source);
+      if (!grants.includes(origin)) throw new Error(`CSP connection origin was not granted: ${origin}`);
+      return origin;
+    }))].sort();
+  }
+  requireBootstrapScripts("script-src", policy["script-src"]);
+  if (policy["script-src-elem"]) requireBootstrapScripts("script-src-elem", policy["script-src-elem"]);
+  return Object.entries(policy).map(([name, sources2]) => `${name} ${sources2.join(" ")}`).join("; ");
+}
+function renderNappletCspMeta(options = {}) {
+  const policy = buildNappletCsp(options).replace(/&/g, "&amp;").replace(/"/g, "&quot;");
+  return `<meta http-equiv="Content-Security-Policy" content="${policy}">`;
+}
+function prepareNappletSrcdoc(html, options) {
+  const meta = renderNappletCspMeta(options.csp);
+  return insertNappletHead(html, meta + renderNappletNamespacePrelude(options));
+}
 
 // src/browser-console-panel.ts
 var PAJA_CONSOLE_PANEL_STORAGE_KEY = "kehto:paja:console:v1";
@@ -21333,265 +21442,6 @@ async function sha256Hex2(bytes) {
   return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
-// src/runtime-resolver.ts
-var PAJA_NAPPLET_MANIFEST_KINDS = NAPPLET_KINDS;
-function decodePajaPointer(value) {
-  const trimmed = value.trim();
-  const decoded = decode(trimmed);
-  if (decoded.type === "naddr") {
-    return {
-      type: "naddr",
-      value: trimmed,
-      identifier: decoded.data.identifier,
-      pubkey: decoded.data.pubkey,
-      kind: decoded.data.kind,
-      relays: [...decoded.data.relays ?? []]
-    };
-  }
-  if (decoded.type === "nevent") {
-    return {
-      type: "nevent",
-      value: trimmed,
-      id: decoded.data.id,
-      ...decoded.data.author ? { author: decoded.data.author } : {},
-      ...decoded.data.kind ? { kind: decoded.data.kind } : {},
-      relays: [...decoded.data.relays ?? []]
-    };
-  }
-  throw new Error(`Expected naddr or nevent pointer, got ${decoded.type}.`);
-}
-async function resolvePajaPointer(value, options = {}) {
-  const pointer = decodePajaPointer(value);
-  const relays = uniqueRelayUrls([...pointer.relays, ...options.relays ?? []]);
-  if (relays.length === 0) {
-    throw new Error("Pointer has no relay hints or enabled configured live relays.");
-  }
-  const pool = options.pool ?? new SimplePool();
-  const ownsPool = options.pool === void 0;
-  try {
-    const event = await resolvePointerEvent(pointer, pool, relays, normalizeMaxWaitMs(options.maxWaitMs));
-    const blossomServers = resolvePointerBlossomServers(event, options.blossomServers ?? []);
-    const resolved = await resolveNapplet({
-      event,
-      cache: await openNappletArtifactCache({ requireStorageEstimate: false }),
-      fetchBlob: (sha256Hex3, servers) => fetchBlob([...servers, ...blossomServers], sha256Hex3, async (url) => {
-        const response = await (options.fetcher ?? fetch)(url);
-        if (!response.ok) throw new Error(`[paja-runtime] blob ${url}: ${response.status}`);
-        return new Uint8Array(await response.arrayBuffer());
-      })
-    });
-    return {
-      pointer,
-      event,
-      relays,
-      blossomServers,
-      dTag: resolved.dTag,
-      aggregateHash: resolved.aggregateHash,
-      indexHtml: resolved.indexHtml,
-      manifest: resolved.manifest
-    };
-  } finally {
-    if (ownsPool) {
-      pool.close?.(relays);
-      pool.destroy?.();
-    }
-  }
-}
-function resolvePointerBlossomServers(event, configured) {
-  const servers = [];
-  for (const value of event.tags.flatMap(
-    (tag) => tag[0] === "server" && tag[1] ? [tag[1]] : []
-  )) {
-    const normalized = normalizePublicBlossomServer(value);
-    if (normalized && !servers.includes(normalized)) servers.push(normalized);
-  }
-  for (const value of configured) {
-    const server = normalizePublicBlossomServer(value) ?? value;
-    if (!servers.includes(server)) servers.push(server);
-  }
-  return servers;
-}
-function injectPajaRuntimeCsp(html, origins) {
-  const grantedOrigins = [...new Set(origins)].sort();
-  const connectSrc = grantedOrigins.length > 0 ? `connect-src ${grantedOrigins.join(" ")}` : "connect-src 'none'";
-  const value = [
-    "default-src 'none'",
-    "script-src 'unsafe-inline' 'wasm-unsafe-eval'",
-    "style-src 'unsafe-inline'",
-    "img-src data: blob:",
-    "font-src data:",
-    connectSrc,
-    "worker-src 'none'",
-    "child-src 'none'",
-    "frame-src 'none'",
-    "media-src 'none'",
-    "object-src 'none'",
-    "manifest-src 'none'",
-    "prefetch-src 'none'",
-    "base-uri 'none'",
-    "form-action 'none'",
-    "frame-ancestors 'self'"
-  ].join("; ");
-  const meta = `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(value)}">`;
-  if (/<head[^>]*>/i.test(html)) {
-    return html.replace(/<head[^>]*>/i, (open) => `${open}${meta}`);
-  }
-  if (/<html[^>]*>/i.test(html)) {
-    return html.replace(/<html[^>]*>/i, (open) => `${open}<head>${meta}</head>`);
-  }
-  return `${meta}${html}`;
-}
-async function resolvePointerEvent(pointer, pool, relays, maxWaitMs) {
-  const filter = pointer.type === "naddr" ? addressableFilter(pointer) : eventFilter(pointer);
-  const result2 = await queryPointerRelays(pool, relays, filter, maxWaitMs);
-  const event = result2.events.filter((candidate) => matchesPointer(pointer, candidate)).sort((a, b) => b.created_at - a.created_at)[0];
-  if (!event) {
-    if (result2.timedOut) {
-      throw new Error(
-        `Relay resolution timed out after ${maxWaitMs}ms for ${pointer.type} pointer across ${relays.length} relays before complete EOSE.`
-      );
-    }
-    const failures = relayFailureReasons(result2.reasons);
-    if (result2.error || failures.length > 0) {
-      const detail = result2.error instanceof Error ? result2.error.message : result2.error === void 0 ? failures.join("; ") : String(result2.error);
-      throw new Error(`Relay query failed for ${pointer.type} pointer before complete EOSE: ${detail}`);
-    }
-    throw new Error(
-      `All ${relays.length} relays reached EOSE without a matching ${pointer.type} napplet manifest event.`
-    );
-  }
-  if (!isNappletManifestKind(event.kind)) {
-    throw new Error(`Pointer resolved kind ${event.kind}; expected ${formatNappletManifestKinds()}.`);
-  }
-  return event;
-}
-function queryPointerRelays(pool, relays, filter, maxWaitMs) {
-  if (pool.subscribeManyEose) {
-    return queryPointerRelaySubscription(pool, relays, filter, maxWaitMs);
-  }
-  return queryPointerRelaySync(pool, relays, filter, maxWaitMs);
-}
-function queryPointerRelaySubscription(pool, relays, filter, maxWaitMs) {
-  return new Promise((resolve) => {
-    const events = [];
-    let settled = false;
-    let subscription;
-    const finish = (result2) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(deadline);
-      resolve({ events, ...result2 });
-    };
-    const deadline = setTimeout(() => {
-      finish({ reasons: [], timedOut: true });
-      void subscription?.close("Paja pointer relay deadline exceeded");
-    }, maxWaitMs);
-    try {
-      subscription = pool.subscribeManyEose([...relays], filter, {
-        maxWait: maxWaitMs,
-        label: "kehto-paja-runtime",
-        onevent(event) {
-          events.push(event);
-        },
-        onclose(reasons) {
-          finish({ reasons, timedOut: false });
-        }
-      });
-    } catch (error) {
-      finish({ reasons: [], timedOut: false, error });
-    }
-  });
-}
-function queryPointerRelaySync(pool, relays, filter, maxWaitMs) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const finish = (result2) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(deadline);
-      resolve(result2);
-    };
-    const deadline = setTimeout(() => {
-      finish({ events: [], reasons: [], timedOut: true });
-    }, maxWaitMs);
-    void pool.querySync([...relays], filter, {
-      maxWait: maxWaitMs,
-      label: "kehto-paja-runtime"
-    }).then(
-      (events) => finish({ events, reasons: [], timedOut: false }),
-      (error) => finish({ events: [], reasons: [], timedOut: false, error })
-    );
-  });
-}
-function relayFailureReasons(reasons) {
-  return [...new Set(reasons.map((reason) => reason.trim()).filter((reason) => reason.length > 0 && reason !== "closed automatically on eose").map((reason) => reason.slice(0, 160)))].slice(0, 3);
-}
-function normalizeMaxWaitMs(value) {
-  if (value === void 0) return 5e3;
-  if (!Number.isFinite(value) || value <= 0) {
-    throw new Error("Pointer relay deadline must be a positive number of milliseconds.");
-  }
-  return Math.floor(value);
-}
-function addressableFilter(pointer) {
-  if (pointer.kind !== NAPPLET_KIND_NAMED) {
-    throw new Error(`naddr kind ${pointer.kind} is not a named NIP-5D napplet manifest kind.`);
-  }
-  return {
-    kinds: [NAPPLET_KIND_NAMED],
-    authors: [pointer.pubkey],
-    "#d": [pointer.identifier],
-    limit: 1
-  };
-}
-function eventFilter(pointer) {
-  return {
-    ids: [pointer.id],
-    ...pointer.kind ? { kinds: [pointer.kind] } : {},
-    ...pointer.author ? { authors: [pointer.author] } : {},
-    limit: 1
-  };
-}
-function matchesPointer(pointer, event) {
-  if (pointer.type === "nevent") {
-    if (event.id !== pointer.id) return false;
-    if (pointer.author && event.pubkey !== pointer.author) return false;
-    if (pointer.kind && event.kind !== pointer.kind) return false;
-    return true;
-  }
-  return event.kind === pointer.kind && event.pubkey === pointer.pubkey && event.tags.some((tag) => tag[0] === "d" && tag[1] === pointer.identifier);
-}
-function uniqueRelayUrls(values) {
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const value of values) {
-    const url = normalizeRelayUrl2(value);
-    if (!url || seen.has(url)) continue;
-    seen.add(url);
-    out.push(url);
-  }
-  return out;
-}
-function normalizeRelayUrl2(value) {
-  const raw = value.trim();
-  if (!raw) return void 0;
-  try {
-    const url = new URL(raw);
-    if (url.protocol !== "wss:" && url.protocol !== "ws:") return void 0;
-    url.hash = "";
-    url.search = "";
-    return url.href.replace(/\/$/, "");
-  } catch {
-    return void 0;
-  }
-}
-function escapeAttribute(value) {
-  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-}
-function formatNappletManifestKinds() {
-  return PAJA_NAPPLET_MANIFEST_KINDS.join(" / ");
-}
-
 // src/browser-target-frame.ts
 function resolvePajaFrameEnvironment(hooks, identity) {
   if (typeof identity.dTag !== "string" || !identity.aggregateHash) {
@@ -21634,16 +21484,20 @@ async function navigateFrame(frame, config, generation, adapter, resolvedTarget,
       }
     }
     if (isCurrent && !isCurrent()) return null;
+    const srcdoc = prepareNappletSrcdoc(resolvedTarget.indexHtml, {
+      domains,
+      csp: {
+        ...config.csp,
+        connectOrigins: [
+          ...connectOrigins([...resolvedTarget.relays, ...resolvedTarget.blossomServers]),
+          ...config.csp?.connectOrigins ?? []
+        ]
+      }
+    });
     const registeredWindowId2 = registerFrameForGeneration(frame, config, generation, identity, environment, windowId);
     onRegistered?.(registeredWindowId2);
     frame.removeAttribute("src");
-    frame.srcdoc = injectNappletNamespacePrelude(
-      injectPajaRuntimeCsp(
-        resolvedTarget.indexHtml,
-        connectOrigins([...resolvedTarget.relays, ...resolvedTarget.blossomServers])
-      ),
-      { domains }
-    );
+    frame.srcdoc = srcdoc;
     return registeredWindowId2;
   }
   const html = await fetchTargetHtml();
@@ -21666,11 +21520,7 @@ function connectOrigins(urls) {
   for (const value of urls) {
     try {
       const url = new URL(value);
-      if (url.protocol === "wss:" || url.protocol === "ws:") {
-        out.add(value.replace(/\/$/, ""));
-      } else {
-        out.add(url.origin);
-      }
+      if (["https:", "http:", "wss:", "ws:"].includes(url.protocol)) out.add(url.origin);
     } catch {
     }
   }
@@ -21689,7 +21539,7 @@ async function fetchTargetHtml() {
   return response.text();
 }
 function injectBaseHref(html, targetUrl) {
-  const base = `<base href="${escapeAttribute2(targetUrl)}">`;
+  const base = `<base href="${escapeAttribute(targetUrl)}">`;
   if (/<head[^>]*>/i.test(html)) {
     return html.replace(/<head[^>]*>/i, (open) => `${open}${base}`);
   }
@@ -21698,7 +21548,7 @@ function injectBaseHref(html, targetUrl) {
   }
   return `${base}${html}`;
 }
-function escapeAttribute2(value) {
+function escapeAttribute(value) {
   return escapeHtml(value).replaceAll('"', "&quot;");
 }
 function escapeHtml(value) {
@@ -23271,6 +23121,232 @@ function installLocalFileControls(load) {
 function disposeNothing() {
 }
 
+// src/runtime-resolver.ts
+var PAJA_NAPPLET_MANIFEST_KINDS = NAPPLET_KINDS;
+function decodePajaPointer(value) {
+  const trimmed = value.trim();
+  const decoded = decode(trimmed);
+  if (decoded.type === "naddr") {
+    return {
+      type: "naddr",
+      value: trimmed,
+      identifier: decoded.data.identifier,
+      pubkey: decoded.data.pubkey,
+      kind: decoded.data.kind,
+      relays: [...decoded.data.relays ?? []]
+    };
+  }
+  if (decoded.type === "nevent") {
+    return {
+      type: "nevent",
+      value: trimmed,
+      id: decoded.data.id,
+      ...decoded.data.author ? { author: decoded.data.author } : {},
+      ...decoded.data.kind ? { kind: decoded.data.kind } : {},
+      relays: [...decoded.data.relays ?? []]
+    };
+  }
+  throw new Error(`Expected naddr or nevent pointer, got ${decoded.type}.`);
+}
+async function resolvePajaPointer(value, options = {}) {
+  const pointer = decodePajaPointer(value);
+  const relays = uniqueRelayUrls([...pointer.relays, ...options.relays ?? []]);
+  if (relays.length === 0) {
+    throw new Error("Pointer has no relay hints or enabled configured live relays.");
+  }
+  const pool = options.pool ?? new SimplePool();
+  const ownsPool = options.pool === void 0;
+  try {
+    const event = await resolvePointerEvent(pointer, pool, relays, normalizeMaxWaitMs(options.maxWaitMs));
+    const blossomServers = resolvePointerBlossomServers(event, options.blossomServers ?? []);
+    const resolved = await resolveNapplet({
+      event,
+      cache: await openNappletArtifactCache({ requireStorageEstimate: false }),
+      fetchBlob: (sha256Hex3, servers) => fetchBlob([...servers, ...blossomServers], sha256Hex3, async (url) => {
+        const response = await (options.fetcher ?? fetch)(url);
+        if (!response.ok) throw new Error(`[paja-runtime] blob ${url}: ${response.status}`);
+        return new Uint8Array(await response.arrayBuffer());
+      })
+    });
+    return {
+      pointer,
+      event,
+      relays,
+      blossomServers,
+      dTag: resolved.dTag,
+      aggregateHash: resolved.aggregateHash,
+      indexHtml: resolved.indexHtml,
+      manifest: resolved.manifest
+    };
+  } finally {
+    if (ownsPool) {
+      pool.close?.(relays);
+      pool.destroy?.();
+    }
+  }
+}
+function resolvePointerBlossomServers(event, configured) {
+  const servers = [];
+  for (const value of event.tags.flatMap(
+    (tag) => tag[0] === "server" && tag[1] ? [tag[1]] : []
+  )) {
+    const normalized = normalizePublicBlossomServer(value);
+    if (normalized && !servers.includes(normalized)) servers.push(normalized);
+  }
+  for (const value of configured) {
+    const server = normalizePublicBlossomServer(value) ?? value;
+    if (!servers.includes(server)) servers.push(server);
+  }
+  return servers;
+}
+async function resolvePointerEvent(pointer, pool, relays, maxWaitMs) {
+  const filter = pointer.type === "naddr" ? addressableFilter(pointer) : eventFilter(pointer);
+  const result2 = await queryPointerRelays(pool, relays, filter, maxWaitMs);
+  const event = result2.events.filter((candidate) => matchesPointer(pointer, candidate)).sort((a, b) => b.created_at - a.created_at)[0];
+  if (!event) {
+    if (result2.timedOut) {
+      throw new Error(
+        `Relay resolution timed out after ${maxWaitMs}ms for ${pointer.type} pointer across ${relays.length} relays before complete EOSE.`
+      );
+    }
+    const failures = relayFailureReasons(result2.reasons);
+    if (result2.error || failures.length > 0) {
+      const detail = result2.error instanceof Error ? result2.error.message : result2.error === void 0 ? failures.join("; ") : String(result2.error);
+      throw new Error(`Relay query failed for ${pointer.type} pointer before complete EOSE: ${detail}`);
+    }
+    throw new Error(
+      `All ${relays.length} relays reached EOSE without a matching ${pointer.type} napplet manifest event.`
+    );
+  }
+  if (!isNappletManifestKind(event.kind)) {
+    throw new Error(`Pointer resolved kind ${event.kind}; expected ${formatNappletManifestKinds()}.`);
+  }
+  return event;
+}
+function queryPointerRelays(pool, relays, filter, maxWaitMs) {
+  if (pool.subscribeManyEose) {
+    return queryPointerRelaySubscription(pool, relays, filter, maxWaitMs);
+  }
+  return queryPointerRelaySync(pool, relays, filter, maxWaitMs);
+}
+function queryPointerRelaySubscription(pool, relays, filter, maxWaitMs) {
+  return new Promise((resolve) => {
+    const events = [];
+    let settled = false;
+    let subscription;
+    const finish = (result2) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      resolve({ events, ...result2 });
+    };
+    const deadline = setTimeout(() => {
+      finish({ reasons: [], timedOut: true });
+      void subscription?.close("Paja pointer relay deadline exceeded");
+    }, maxWaitMs);
+    try {
+      subscription = pool.subscribeManyEose([...relays], filter, {
+        maxWait: maxWaitMs,
+        label: "kehto-paja-runtime",
+        onevent(event) {
+          events.push(event);
+        },
+        onclose(reasons) {
+          finish({ reasons, timedOut: false });
+        }
+      });
+    } catch (error) {
+      finish({ reasons: [], timedOut: false, error });
+    }
+  });
+}
+function queryPointerRelaySync(pool, relays, filter, maxWaitMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (result2) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      resolve(result2);
+    };
+    const deadline = setTimeout(() => {
+      finish({ events: [], reasons: [], timedOut: true });
+    }, maxWaitMs);
+    void pool.querySync([...relays], filter, {
+      maxWait: maxWaitMs,
+      label: "kehto-paja-runtime"
+    }).then(
+      (events) => finish({ events, reasons: [], timedOut: false }),
+      (error) => finish({ events: [], reasons: [], timedOut: false, error })
+    );
+  });
+}
+function relayFailureReasons(reasons) {
+  return [...new Set(reasons.map((reason) => reason.trim()).filter((reason) => reason.length > 0 && reason !== "closed automatically on eose").map((reason) => reason.slice(0, 160)))].slice(0, 3);
+}
+function normalizeMaxWaitMs(value) {
+  if (value === void 0) return 5e3;
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new Error("Pointer relay deadline must be a positive number of milliseconds.");
+  }
+  return Math.floor(value);
+}
+function addressableFilter(pointer) {
+  if (pointer.kind !== NAPPLET_KIND_NAMED) {
+    throw new Error(`naddr kind ${pointer.kind} is not a named NIP-5D napplet manifest kind.`);
+  }
+  return {
+    kinds: [NAPPLET_KIND_NAMED],
+    authors: [pointer.pubkey],
+    "#d": [pointer.identifier],
+    limit: 1
+  };
+}
+function eventFilter(pointer) {
+  return {
+    ids: [pointer.id],
+    ...pointer.kind ? { kinds: [pointer.kind] } : {},
+    ...pointer.author ? { authors: [pointer.author] } : {},
+    limit: 1
+  };
+}
+function matchesPointer(pointer, event) {
+  if (pointer.type === "nevent") {
+    if (event.id !== pointer.id) return false;
+    if (pointer.author && event.pubkey !== pointer.author) return false;
+    if (pointer.kind && event.kind !== pointer.kind) return false;
+    return true;
+  }
+  return event.kind === pointer.kind && event.pubkey === pointer.pubkey && event.tags.some((tag) => tag[0] === "d" && tag[1] === pointer.identifier);
+}
+function uniqueRelayUrls(values) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const url = normalizeRelayUrl2(value);
+    if (!url || seen.has(url)) continue;
+    seen.add(url);
+    out.push(url);
+  }
+  return out;
+}
+function normalizeRelayUrl2(value) {
+  const raw = value.trim();
+  if (!raw) return void 0;
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "wss:" && url.protocol !== "ws:") return void 0;
+    url.hash = "";
+    url.search = "";
+    return url.href.replace(/\/$/, "");
+  } catch {
+    return void 0;
+  }
+}
+function formatNappletManifestKinds() {
+  return PAJA_NAPPLET_MANIFEST_KINDS.join(" / ");
+}
+
 // src/browser-intent-host.ts
 function createPajaIntentTargetOptions(getState, getContext, effects = {}) {
   return {