@kehto/shell 0.20.0 → 0.21.0

package/README.md

@@ -2,7 +2,7 @@
 
 Browser adapter over @kehto/runtime — ShellBridge and domain proxies.
 
-> **Alpha status:** Kehto is an early runtime implementation for a draft NIP-5D
+> **Alpha status:** Kehto is an early runtime toolkit for a draft NIP-5D
 > protocol. NAP contracts and injected-domain behavior are still draft; treat
 > this package as current implementation guidance.
 
@@ -15,7 +15,7 @@ pnpm add @kehto/shell
 ## Published Napplet Compatibility
 
 `@kehto/shell` publishes against `@napplet/core` and `@napplet/nap`
-`>=0.31.0 <0.32.0`. The installed core 0.31.1 / nap 0.31.2 contracts follow
+`>=0.32.0 <0.33.0`. The installed core 0.32.0 / nap 0.32.0 contracts follow
 NAP-INTENT authority `5ac0490461ca6fec2f0d2e45b4835cf9bc08de24`, napplet/web#199
 source `3037200c932488f14f7f369b8583c39c9c16510a` / merge
 `b3f0007867eac109fa4917fac9c285d3b7cc6155`, and Version Packages #198 release
@@ -30,7 +30,12 @@ The primary entry point is `createShellBridge()` — it owns the postMessage lis
 Current draft behaviors this package enforces:
 
 - The shell does not inject a host-provided nostr object into napplets — NIP-5D explicitly forbids napplet-visible signing. Napplets call `relay.publish` / `relay.publishEncrypted` and the shell mediates the signing flow internally (NIP-44 default, NIP-04 opt-in for encrypted envelopes).
-- `injectNappletNamespacePrelude()` implements the NIP-5D injected-domain bootstrap and mandatory NAP-SHELL shim: hosts prepend it to `srcdoc` outside verified artifact bytes, install the parent-bound `shell.init` receiver, emit one `shell.ready`, and expose callable NAP interfaces before authored scripts run. Optional namespaces are filtered to the bare-domain allowlist; `shell` is always retained. Published core 0.31.1 and shim 0.29.2 omit generic mandatory shell, so Kehto retains this host-owned prelude under NAP-SHELL `5ac0490461ca6fec2f0d2e45b4835cf9bc08de24` until an upstream correction is reviewed.
+- `AuthHooks.getSigner(windowId?)` receives the originating iframe window ID
+  when the runtime can identify it. The shell forwards this optional context
+  without imposing a consent policy; host runtimes may ignore it or use it to
+  resolve their own identity-scoped signer decisions.
+- `injectNappletNamespacePrelude()` implements the NIP-5D injected-domain bootstrap and mandatory NAP-SHELL shim: hosts prepend it to `srcdoc` outside verified artifact bytes, install the parent-bound `shell.init` receiver, emit one `shell.ready`, and expose callable NAP interfaces before authored scripts run. Optional namespaces are filtered to the bare-domain allowlist; `shell` is always retained. Published core 0.32.0 and shim 0.30.0 omit generic mandatory shell, so Kehto retains this host-owned prelude under NAP-SHELL `5ac0490461ca6fec2f0d2e45b4835cf9bc08de24` until an upstream correction is reviewed.
+- The injected resource projection follows draft NAP-RESOURCE `9511232f69313aa7953d110e35d32cc28d506f66`: `bytes(url, { servers? })` carries advisory Blossom locations and `bytesMany(requests)` keeps each `{ url, servers? }` entry intact.
 - `window.napplet.shell.supports(domain)` answers synchronously and locally from the cached first `shell.init` environment. It returns `false` before `shell.init`, for unknown values, and for domains that are not live and granted to that napplet; it never sends a support-query message.
 - Five optional per-domain proxies — `createIdentityProxy`, `createThemeProxy`, `createKeysProxy`, `createMediaProxy`, `createNotifyProxy` — can be composed between napplet and runtime to intercept request traffic per NAP. They are NOT wired by default. Identity/theme proxy `emit()` compatibility members fail closed; hosts must deliver automatic changes through `ShellBridge.publishIdentityChanged()` / `publishTheme()`, which enforce live session, granted domain, and current ACL.
 - `keys.forward` is napplet-to-shell only. Active napplets suppress locally-bound keys from `keys.bindings` before forwarding; shell-initiated action triggers use `keys.action`.
@@ -56,7 +61,7 @@ dispatch, and does not infer payload kinds. Runtime delivery supplies the
 **runtime-attested dTag**; no caller sender is accepted, topic source exclusion
 is runtime-owned, and IDs and payloads are opaque.
 
-Merged NAP-INC and released `@napplet/nap@0.31.2` both deliver one `IncEvent`
+Merged NAP-INC and released `@napplet/nap@0.32.0` both deliver one `IncEvent`
 to `on(topic, callback)`.
 
 For channels, runtime ACL checks are open-only rather than per-message. The

package/dist/index.d.ts

@@ -3,6 +3,8 @@ export { ALL_CAPABILITIES, AclChecker, Capability, ConsentRequest, EnforceConfig
 import { NappletMessage, NostrEvent, NostrFilter } from '@napplet/core';
 export { NappletMessage, NostrEvent, NostrFilter, TOPICS, TopicKey, TopicValue } from '@napplet/core';
 import { Theme } from '@napplet/nap/theme/types';
+import { ResourceBytesItem, ResourceBytesRequest as ResourceBytesRequest$1, ResourceInfo } from '@napplet/nap/resource/types';
+export { ResourceInfo } from '@napplet/nap/resource/types';
 
 /** NIP-5D identity metadata associated with a registered iframe window. */
 interface OriginIdentity {
@@ -132,8 +134,15 @@ interface WindowManagerHooks {
 interface AuthHooks {
     /** Get the current user's pubkey, or null if not logged in. */
     getUserPubkey(): string | null;
-    /** Get the NIP-07 compatible signer, or null if unavailable. */
-    getSigner(): any | null;
+    /**
+     * Get the NIP-07 compatible signer, or null if unavailable.
+     *
+     * The optional window ID lets a shell bind its own signer policy to the
+     * requesting napplet without imposing that policy in Kehto.
+     *
+     * @param windowId - Originating napplet window, when available
+     */
+    getSigner(windowId?: string): any | null;
 }
 /** Hook for config. */
 interface ConfigHooks {
@@ -1296,15 +1305,11 @@ declare function createNotifyProxy(deps: NotifyProxyDeps): NotifyProxy;
  * @file internal-resource.ts
  *
  * Kehto-internal shell-side resource wire types. Per PROJECT.md Decision #31,
- * this is NOT a staging-ground duplicate of upstream `@napplet/nap/resource`:
- * Phase 44 audit confirmed the two surfaces diverge substantively — different
- * field names (kehto's legacy `requestId` vs upstream `id`; kehto's legacy
- * `bodyBase64` vs upstream `blob` + `mime`), different message-type names
- * (`ResourceBytesRequest` vs `ResourceBytesMessage`), and disjoint error
- * vocabularies (kehto: 4 codes `{denied, canceled, network-error, invalid-url}`;
- * upstream: 8 codes `{not-found, blocked-by-policy,
- * timeout, too-large, unsupported-scheme, decode-failed, network-error,
- * quota-exceeded}`).
+ * this is NOT a staging-ground duplicate of upstream `@napplet/nap/resource`.
+ * Canonical resource info, per-resource request, and result-item shapes are
+ * imported from the published package. The remaining local envelopes retain
+ * Kehto's legacy compatibility fields (`requestId`, `bodyBase64`, status, and
+ * headers) alongside the current `id`, `blob`, and `mime` fields.
  *
  * `resource-service.ts` now emits both legacy single-fetch compatibility
  * fields and the current upstream-compatible fields.
@@ -1315,20 +1320,12 @@ declare function createNotifyProxy(deps: NotifyProxyDeps): NotifyProxy;
  *             resource.bytes.result, resource.bytes.error,
  *             resource.bytesMany.result, resource.bytesMany.error
  */
+
 /**
  * Unique id for correlating a `resource.bytes` request to its later result /
  * error / cancel envelope.
  */
 type ResourceRequestId = string;
-/** Advisory resource capability and policy limits disclosed by the runtime. */
-interface ResourceInfo {
-    schemes: readonly {
-        scheme: string;
-        enabled: boolean;
-    }[];
-    maxBytes?: number;
-    maxUrls?: number;
-}
 /** Inbound: napplet asks for advisory resource policy and scheme support. */
 interface ResourceInfoRequest {
     type: 'resource.info';
@@ -1346,6 +1343,8 @@ interface ResourceBytesRequest {
     /** Legacy Kehto correlation ID. */
     requestId?: ResourceRequestId;
     url: string;
+    /** Advisory Blossom server locations. Ignored for other schemes. */
+    servers?: readonly string[];
     /** Optional subset of fetch init (method, headers). Body bytes are shell-proxy-internal. */
     init?: {
         method?: string;
@@ -1370,7 +1369,7 @@ interface ResourceCancelRequest {
 interface ResourceBytesManyRequest {
     type: 'resource.bytesMany';
     id: ResourceRequestId;
-    urls: readonly string[];
+    requests: readonly ResourceBytesRequest$1[];
 }
 /**
  * Outbound: successful fetch result.
@@ -1413,17 +1412,7 @@ interface ResourceBytesError {
 /**
  * Current NAP-RESOURCE bulk result item.
  */
-type ResourceBytesManyItem = {
-    url: string;
-    ok: true;
-    blob: Blob;
-    mime: string;
-} | {
-    url: string;
-    ok: false;
-    error: string;
-    message?: string;
-};
+type ResourceBytesManyItem = ResourceBytesItem;
 /**
  * Outbound: ordered bulk fetch result.
  */
@@ -1463,4 +1452,4 @@ type ResourceInbound = ResourceInfoRequest | ResourceBytesRequest | ResourceByte
  */
 type ResourceOutbound = ResourceInfoResult | ResourceInfoError | ResourceBytesResult | ResourceBytesError | ResourceBytesManyResult | ResourceBytesManyError;
 
-export { type AclCheckEvent, type AclEntry, type AclStore, type AudioManager, type AudioSource, type AuthHooks, type BleHooks, type BrowserDeps, type CapabilityHooks, type CommonHooks, type ConfigHooks, type CryptoHooks, type DmHooks, type HotkeyHooks, type IdentityProxy, type IdentityProxyDeps, type IntentHooks, type KeysProxy, type KeysProxyDeps, type LinkHooks, type ListsHooks, type ManifestCache, type ManifestCacheEntry, type MediaProxy, type MediaProxyDeps, type NappletNamespacePreludeOptions, type NotifyProxy, type NotifyProxyDeps, type OriginIdentity, type OriginRegistry, type ProxyOriginRegistry, type RelayConfigHooks, type RelayPoolHooks, type RelayPoolLike, type ResourceBytesError, type ResourceBytesManyError, type ResourceBytesManyItem, type ResourceBytesManyRequest, type ResourceBytesManyResult, type ResourceBytesRequest, type ResourceBytesResult, type ResourceCancelRequest, type ResourceErrorCode, type ResourceInbound, type ResourceInfo, type ResourceInfoError, type ResourceInfoRequest, type ResourceInfoResult, type ResourceOutbound, type ResourceRequestId, type SerialHooks, type SessionRegistry, type ShellAdapter, type ShellBridge, type ShellCapabilities, type ShellEnvironment, type ThemeProxy, type ThemeProxyDeps, type UnroutedMessageInfo, type UploadBackendLike, type UploadHooks, type WebrtcHooks, type WindowManagerHooks, type WorkerRelayHooks, type WorkerRelayLike, adaptHooks, audioManager, buildShellCapabilities, createIdentityProxy, createKeysProxy, createMediaProxy, createNotifyProxy, createShellBridge, createThemeProxy, injectNappletNamespacePrelude, manifestCache, nappKeyRegistry, originRegistry, renderNappletNamespacePrelude, resolveShellEnvironment, sessionRegistry };
+export { type AclCheckEvent, type AclEntry, type AclStore, type AudioManager, type AudioSource, type AuthHooks, type BleHooks, type BrowserDeps, type CapabilityHooks, type CommonHooks, type ConfigHooks, type CryptoHooks, type DmHooks, type HotkeyHooks, type IdentityProxy, type IdentityProxyDeps, type IntentHooks, type KeysProxy, type KeysProxyDeps, type LinkHooks, type ListsHooks, type ManifestCache, type ManifestCacheEntry, type MediaProxy, type MediaProxyDeps, type NappletNamespacePreludeOptions, type NotifyProxy, type NotifyProxyDeps, type OriginIdentity, type OriginRegistry, type ProxyOriginRegistry, type RelayConfigHooks, type RelayPoolHooks, type RelayPoolLike, type ResourceBytesError, type ResourceBytesManyError, type ResourceBytesManyItem, type ResourceBytesManyRequest, type ResourceBytesManyResult, type ResourceBytesRequest, type ResourceBytesResult, type ResourceCancelRequest, type ResourceErrorCode, type ResourceInbound, type ResourceInfoError, type ResourceInfoRequest, type ResourceInfoResult, type ResourceOutbound, type ResourceRequestId, type SerialHooks, type SessionRegistry, type ShellAdapter, type ShellBridge, type ShellCapabilities, type ShellEnvironment, type ThemeProxy, type ThemeProxyDeps, type UnroutedMessageInfo, type UploadBackendLike, type UploadHooks, type WebrtcHooks, type WindowManagerHooks, type WorkerRelayHooks, type WorkerRelayLike, adaptHooks, audioManager, buildShellCapabilities, createIdentityProxy, createKeysProxy, createMediaProxy, createNotifyProxy, createShellBridge, createThemeProxy, injectNappletNamespacePrelude, manifestCache, nappKeyRegistry, originRegistry, renderNappletNamespacePrelude, resolveShellEnvironment, sessionRegistry };

package/dist/index.js

@@ -88,8 +88,8 @@ function createAuthAdapter(shellHooks) {
     getUserPubkey() {
       return shellHooks.auth.getUserPubkey();
     },
-    getSigner() {
-      return shellHooks.auth.getSigner();
+    getSigner(windowId) {
+      return shellHooks.auth.getSigner(windowId);
     }
   };
 }
@@ -2071,11 +2071,21 @@ function nappletNamespacePrelude(domains) {
   }
   function makeResource() {
     const objectUrls = /* @__PURE__ */ new Set();
-    const bytes = (url) => request({ type: "resource.bytes", url }, "resource.bytes.result", (msg) => msg.blob);
+    const bytes = (url, options) => request({
+      type: "resource.bytes",
+      url,
+      ...Array.isArray(options?.servers) ? { servers: Array.from(options.servers) } : {}
+    }, "resource.bytes.result", (msg) => msg.blob);
     return {
       info: () => request({ type: "resource.info" }, "resource.info.result", (msg) => msg.info),
       bytes,
-      bytesMany: (urls) => request({ type: "resource.bytesMany", urls }, "resource.bytesMany.result", (msg) => Array.isArray(msg.items) ? msg.items : []),
+      bytesMany: (requests) => request({
+        type: "resource.bytesMany",
+        requests: Array.from(requests || [], (entry) => ({
+          url: entry.url,
+          ...Array.isArray(entry.servers) ? { servers: Array.from(entry.servers) } : {}
+        }))
+      }, "resource.bytesMany.result", (msg) => Array.isArray(msg.items) ? msg.items : []),
       bytesAsObjectURL(url) {
         let objectUrl = "";
         const handle = {