@kehto/services 0.21.0 → 0.21.1

package/README.md

@@ -43,7 +43,7 @@ Current draft posture:
 - `createKeysService` and `createMediaService` ship real reference backends as of v1.4 (see the dedicated sections below). `createKeysService` attaches a document-level `keydown` listener by default and delivers `keys.action` push envelopes to registered napplets; `createMediaService` mirrors session metadata and playback state to `navigator.mediaSession` and emits `media.command` push envelopes on OS transport events. Both accept a host-bridge option (`HostKeysBridge` / `HostMediaBridge`) so Electron / Tauri / native shells can swap in OS-level backends without re-implementing the wire-protocol bookkeeping.
 - `createNotifyService` handles direct `notify.*` envelopes. It is not an INC
   topic handler.
-- `createOutboxService` supports `outbox.getEvent` from draft NAP-OUTBOX. Single-event lookups run through shell-owned relay routing and only return events whose ID matches the request. The draft wire contract keeps `outbox.query` one-shot and `outbox.subscribe` streaming; Kehto's concrete `createRelayPoolOutboxRouter` additionally exposes host-side `queryStream()` so verified query events can arrive before asynchronous NIP-65 discovery completes.
+- `createOutboxService` supports `outbox.getEvent` from draft NAP-OUTBOX. Single-event lookups run through shell-owned relay routing and only return events whose ID matches the request. Hosts can provide `getReadRouter` to scope all event-returning reads (`getEvent`, query, and subscription) to the authenticated source window, plus `getQueryRouter` when one-shot queries need an additional decorator. The draft wire contract keeps `outbox.query` one-shot and `outbox.subscribe` streaming; Kehto's concrete `createRelayPoolOutboxRouter` additionally exposes host-side `queryStream()` so verified query events can arrive before asynchronous NIP-65 discovery completes.
 - `createResourceService` implements NAP-RESOURCE at exact draft head `9511232f69313aa7953d110e35d32cc28d506f66` without choosing a runtime's network policy. Single requests carry optional advisory Blossom `servers`; bulk requests use canonical per-resource `requests: [{ url, servers? }]` entries. The service forwards hints to the injected resolver only for `blossom:`, preserves order and per-entry failures, and exposes optional `resource.info.maxServers`. By default it delegates every syntactically valid URL to the resolver; `resource.info.schemes` remains advisory. Runtimes that want hierarchical-origin grants can supply `isOriginGranted`, `getConnectGrants`, and `resolveIdentity` together, while scheme resolvers retain responsibility for hint validation, SSRF protection, redirects, and fallback policy. The service enforces supplied size/bulk caps, scopes cancellation to the requesting window, drops cancelled terminal envelopes, never forwards response headers, and preserves explicit `ResourceServiceError` codes.
 - `createUploadService` supports `upload.info` from draft NAP-UPLOAD. Hosts may expose configured rails, return URL forms, maximum bytes, and MIME type policy without requiring napplets to start an upload.
 - `createConfigService` implements draft NAP-CONFIG's shell-writer boundary: recursive bounded-subset schema validation, per-window schema/subscription state, deterministic defaults, invalid/orphan removal, version rollback rejection, scoped host persistence hooks, and settings-UI commits. Reads before schema registration fail closed with `no-schema`.

package/dist/index.d.ts

@@ -1416,6 +1416,8 @@ interface ResourceFetchInit {
     headers?: Record<string, string>;
     /** Request-scoped cancellation signal. */
     signal: AbortSignal;
+    /** Authenticated source window, for runtime-private scoped policy state. */
+    windowId?: string;
     /** Advisory Blossom server origins for this resource only. */
     servers?: readonly string[];
 }
@@ -1715,7 +1717,19 @@ interface OutboxServiceOptions {
     /** The outbox router the shell uses to reach relays. Required. */
     router: OutboxRouter;
     /**
-     * Optionally selects a request-scoped router for a live napplet source.
+     * Optionally selects a source-scoped router for event-returning reads.
+     *
+     * The selected router is used for `outbox.getEvent`, `outbox.query`, and
+     * `outbox.subscribe`. A query-specific router takes precedence when both
+     * hooks are supplied.
+     *
+     * @param windowId - The authenticated source window for the request.
+     * @param context - Narrow runtime context for source-bound policy checks.
+     * @returns Router used for that source's event-returning reads.
+     */
+    getReadRouter?(windowId: string, context: ServiceRuntimeContext | undefined): OutboxRouter;
+    /**
+     * Optionally selects a query-specific router for a live napplet source.
      *
      * @param windowId - The authenticated source window for the request.
      * @param context - Narrow runtime context for source-bound policy checks.

package/dist/index.js

@@ -2405,6 +2405,7 @@ async function fetchResourceItem(options, windowId, info, request, signal) {
     const response = await options.fetch(url, {
       method: "GET",
       signal,
+      windowId,
       ...parsedUrl.protocol === "blossom:" && request.servers !== void 0 ? { servers: [...request.servers] } : {}
     });
     const buffer = await response.arrayBuffer();
@@ -2720,7 +2721,7 @@ function createOutboxService(options) {
   if (!options || typeof options.router !== "object" || options.router === null) {
     throw new Error("createOutboxService: options.router is required");
   }
-  const { router, getQueryRouter } = options;
+  const { router, getReadRouter, getQueryRouter } = options;
   let runtimeContext;
   const subscriptions = /* @__PURE__ */ new Map();
   function handleQuery(windowId, msg, send) {
@@ -2731,7 +2732,7 @@ function createOutboxService(options) {
       send({ type: "outbox.query.result", id, events: [], error: "invalid filter" });
       return;
     }
-    const queryRouter = getQueryRouter?.(windowId, runtimeContext) ?? router;
+    const queryRouter = getQueryRouter?.(windowId, runtimeContext) ?? getReadRouter?.(windowId, runtimeContext) ?? router;
     void queryRouter.query(filters, sanitizeQueryOptions(m.options)).then(
       (result2) => send({
         type: "outbox.query.result",
@@ -2763,7 +2764,8 @@ function createOutboxService(options) {
         send({ type: "outbox.closed", subId, ...reason === void 0 ? {} : { reason } });
       }
     };
-    subscriptions.set(subKey, router.subscribe(filters, sanitizeSubscribeOptions(m.options), sink));
+    const readRouter = getReadRouter?.(windowId, runtimeContext) ?? router;
+    subscriptions.set(subKey, readRouter.subscribe(filters, sanitizeSubscribeOptions(m.options), sink));
   }
   function handleClose(windowId, msg, send) {
     const m = msg;
@@ -2818,7 +2820,7 @@ function createOutboxService(options) {
     handleMessage(windowId, message, send) {
       switch (message.type) {
         case "outbox.getEvent":
-          handleGetEvent(router, message, send);
+          handleGetEvent(getReadRouter?.(windowId, runtimeContext) ?? router, message, send);
           return;
         case "outbox.query":
           handleQuery(windowId, message, send);