@kehto/shell 0.19.2 → 0.20.1

package/README.md

@@ -2,7 +2,7 @@
 
 Browser adapter over @kehto/runtime — ShellBridge and domain proxies.
 
-> **Alpha status:** Kehto is an early runtime implementation for a draft NIP-5D
+> **Alpha status:** Kehto is an early runtime toolkit for a draft NIP-5D
 > protocol. NAP contracts and injected-domain behavior are still draft; treat
 > this package as current implementation guidance.
 
@@ -15,9 +15,11 @@ pnpm add @kehto/shell
 ## Published Napplet Compatibility
 
 `@kehto/shell` publishes against `@napplet/core` and `@napplet/nap`
-`>=0.31.0 <0.32.0`. The installed core/nap 0.31.0 contracts are from source
-`7b675622e13870628ce174833d7b2a33cf32a0ab` and release
-`03ad65b66413e5798536ef48695ffc4c2508f2c3`.
+`>=0.31.0 <0.32.0`. The installed core 0.31.1 / nap 0.31.2 contracts follow
+NAP-INTENT authority `5ac0490461ca6fec2f0d2e45b4835cf9bc08de24`, napplet/web#199
+source `3037200c932488f14f7f369b8583c39c9c16510a` / merge
+`b3f0007867eac109fa4917fac9c285d3b7cc6155`, and Version Packages #198 release
+source `dc1d24153c759152b6ba31a6ec9bea967798f2df`.
 
 ## Overview
 
@@ -28,11 +30,15 @@ The primary entry point is `createShellBridge()` — it owns the postMessage lis
 Current draft behaviors this package enforces:
 
 - The shell does not inject a host-provided nostr object into napplets — NIP-5D explicitly forbids napplet-visible signing. Napplets call `relay.publish` / `relay.publishEncrypted` and the shell mediates the signing flow internally (NIP-44 default, NIP-04 opt-in for encrypted envelopes).
-- `injectNappletNamespacePrelude()` implements the NIP-5D injected-domain bootstrap and mandatory NAP-SHELL shim: hosts prepend it to `srcdoc` outside verified artifact bytes, install the parent-bound `shell.init` receiver, emit one `shell.ready`, and expose callable NAP interfaces before authored scripts run. Optional namespaces are filtered to the bare-domain allowlist; `shell` is always retained. Published core 0.31.0 and shim 0.29.0 omit generic mandatory shell, so Kehto retains this host-owned prelude under NAP-SHELL `5ac0490461ca6fec2f0d2e45b4835cf9bc08de24` until an upstream correction is reviewed.
+- `AuthHooks.getSigner(windowId?)` receives the originating iframe window ID
+  when the runtime can identify it. The shell forwards this optional context
+  without imposing a consent policy; host runtimes may ignore it or use it to
+  resolve their own identity-scoped signer decisions.
+- `injectNappletNamespacePrelude()` implements the NIP-5D injected-domain bootstrap and mandatory NAP-SHELL shim: hosts prepend it to `srcdoc` outside verified artifact bytes, install the parent-bound `shell.init` receiver, emit one `shell.ready`, and expose callable NAP interfaces before authored scripts run. Optional namespaces are filtered to the bare-domain allowlist; `shell` is always retained. Published core 0.31.1 and shim 0.29.2 omit generic mandatory shell, so Kehto retains this host-owned prelude under NAP-SHELL `5ac0490461ca6fec2f0d2e45b4835cf9bc08de24` until an upstream correction is reviewed.
 - `window.napplet.shell.supports(domain)` answers synchronously and locally from the cached first `shell.init` environment. It returns `false` before `shell.init`, for unknown values, and for domains that are not live and granted to that napplet; it never sends a support-query message.
 - Five optional per-domain proxies — `createIdentityProxy`, `createThemeProxy`, `createKeysProxy`, `createMediaProxy`, `createNotifyProxy` — can be composed between napplet and runtime to intercept request traffic per NAP. They are NOT wired by default. Identity/theme proxy `emit()` compatibility members fail closed; hosts must deliver automatic changes through `ShellBridge.publishIdentityChanged()` / `publishTheme()`, which enforce live session, granted domain, and current ACL.
 - `keys.forward` is napplet-to-shell only. Active napplets suppress locally-bound keys from `keys.bindings` before forwarding; shell-initiated action triggers use `keys.action`.
-- `buildShellCapabilities()` advertises only live domains (including `dm` when the host adapter provides `hooks.dm`); disabled domains are absent from the delivered `domains` and named services snapshots.
+- `buildShellCapabilities()` advertises only live domains. Registered `dm` and `fs` services are injected only when their handlers exist; disabled domains are absent from the delivered `domains` and named services snapshots.
 
 ### NAP-INC binding and channel contract
 
@@ -54,7 +60,7 @@ dispatch, and does not infer payload kinds. Runtime delivery supplies the
 **runtime-attested dTag**; no caller sender is accepted, topic source exclusion
 is runtime-owned, and IDs and payloads are opaque.
 
-Merged NAP-INC and released `@napplet/nap@0.31.0` both deliver one `IncEvent`
+Merged NAP-INC and released `@napplet/nap@0.31.2` both deliver one `IncEvent`
 to `on(topic, callback)`.
 
 For channels, runtime ACL checks are open-only rather than per-message. The

package/dist/index.d.ts

@@ -132,8 +132,15 @@ interface WindowManagerHooks {
 interface AuthHooks {
     /** Get the current user's pubkey, or null if not logged in. */
     getUserPubkey(): string | null;
-    /** Get the NIP-07 compatible signer, or null if unavailable. */
-    getSigner(): any | null;
+    /**
+     * Get the NIP-07 compatible signer, or null if unavailable.
+     *
+     * The optional window ID lets a shell bind its own signer policy to the
+     * requesting napplet without imposing that policy in Kehto.
+     *
+     * @param windowId - Originating napplet window, when available
+     */
+    getSigner(windowId?: string): any | null;
 }
 /** Hook for config. */
 interface ConfigHooks {

package/dist/index.js

@@ -88,8 +88,8 @@ function createAuthAdapter(shellHooks) {
     getUserPubkey() {
       return shellHooks.auth.getUserPubkey();
     },
-    getSigner() {
-      return shellHooks.auth.getSigner();
+    getSigner(windowId) {
+      return shellHooks.auth.getSigner(windowId);
     }
   };
 }
@@ -999,7 +999,8 @@ var SERVICE_ONLY_DOMAINS = [
   "ble",
   "webrtc",
   "dm",
-  "count"
+  "count",
+  "fs"
 ];
 function buildShellCapabilities(hooks) {
   const disabled = new Set(hooks.capabilities?.disabledDomains ?? []);
@@ -1046,8 +1047,6 @@ function isServiceDomainLive(hooks, domain) {
       return hooks.ble?.isAvailable() === true;
     case "webrtc":
       return hooks.webrtc?.isAvailable() === true;
-    case "dm":
-      return hooks.dm !== void 0;
     default:
       return true;
   }
@@ -2433,6 +2432,30 @@ function nappletNamespacePrelude(domains) {
       }
     };
   }
+  function makeFs() {
+    const withOptions = (payload, options) => {
+      if (options !== void 0) payload.options = options;
+      return payload;
+    };
+    const req = (action, payload, map) => request({ type: `fs.${action}`, ...payload }, `fs.${action}.result`, map);
+    return {
+      info: () => req("info", {}, (msg) => fieldOrThrow(msg, "info", "fs.info.result missing info")),
+      pickFile: (options) => req("pickFile", withOptions({}, options), (msg) => fieldOrThrow(msg, "result", "fs.pickFile.result missing result")),
+      pickFiles: (options) => req("pickFiles", withOptions({}, options), (msg) => fieldOrThrow(msg, "result", "fs.pickFiles.result missing result")),
+      pickDirectory: (options) => req("pickDirectory", withOptions({}, options), (msg) => fieldOrThrow(msg, "result", "fs.pickDirectory.result missing result")),
+      pickSaveFile: (options) => req("pickSaveFile", withOptions({}, options), (msg) => fieldOrThrow(msg, "result", "fs.pickSaveFile.result missing result")),
+      stat: (path) => req("stat", { path }, (msg) => fieldOrThrow(msg, "metadata", "fs.stat.result missing metadata")),
+      list: (path) => req("list", { path }, (msg) => fieldOrThrow(msg, "entries", "fs.list.result missing entries")),
+      read: (path, options) => req("read", withOptions({ path }, options), (msg) => fieldOrThrow(msg, "result", "fs.read.result missing result")),
+      write: (path, data, options) => req("write", withOptions({ path, data }, options), (msg) => fieldOrThrow(msg, "result", "fs.write.result missing result")),
+      mkdir: (path, options) => req("mkdir", withOptions({ path }, options), (msg) => voidResult(msg, "fs mkdir failed")),
+      remove: (path, recursive) => req("remove", { path, ...recursive === void 0 ? {} : { recursive } }, (msg) => voidResult(msg, "fs remove failed")),
+      move: (fromPath, toPath) => req("move", { fromPath, toPath }, (msg) => voidResult(msg, "fs move failed")),
+      watch: (path, options) => req("watch", withOptions({ path }, options), (msg) => fieldOrThrow(msg, "watchId", "fs.watch.result missing watchId")),
+      unwatch: (watchId) => req("unwatch", { watchId }, (msg) => voidResult(msg, "fs unwatch failed")),
+      onChanged: (callback) => domainEventHandle("fs.changed", callback, (msg) => msg.change)
+    };
+  }
   const shell = makeShell();
   let inc;
   let identity;
@@ -2502,6 +2525,8 @@ function nappletNamespacePrelude(domains) {
         return makeSerial();
       case "dm":
         return makeDm();
+      case "fs":
+        return makeFs();
       default:
         return {};
     }