@kehto/shell 0.21.3 → 0.23.0

package/dist/index.js

@@ -1246,6 +1246,181 @@ function createShellBridge(hooks) {
   };
 }
 
+// src/intent-uri.ts
+function createIntentUriNormalizer() {
+  const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+  const fail = (message) => {
+    throw new TypeError(message);
+  };
+  const decode = (value, label) => {
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return fail(`Intent URI has malformed percent-encoding in ${label}`);
+    }
+  };
+  const decodeUtf8 = (bytes) => {
+    try {
+      return new TextDecoder("utf-8", { fatal: true }).decode(new Uint8Array(bytes));
+    } catch {
+      return fail("Intent URI fragment contains invalid UTF-8");
+    }
+  };
+  const decodeHint = (fragment) => {
+    if (!fragment.startsWith("naddr") || fragment !== fragment.toLowerCase()) {
+      return fail("Intent URI fragment must be a bare lowercase naddr");
+    }
+    const separator = fragment.lastIndexOf("1");
+    if (separator <= 0 || separator + 7 > fragment.length) fail("Intent URI fragment is not a valid naddr");
+    const alphabet = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+    const values = [];
+    for (const character of fragment.slice(separator + 1)) {
+      const value = alphabet.indexOf(character);
+      if (value < 0) fail("Intent URI fragment is not a valid naddr");
+      values.push(value);
+    }
+    const polymod = (input) => {
+      let checksum = 1;
+      for (const value of input) {
+        const top = checksum >>> 25;
+        checksum = (checksum & 33554431) << 5 ^ value;
+        if (top & 1) checksum ^= 996825010;
+        if (top & 2) checksum ^= 642813549;
+        if (top & 4) checksum ^= 513874426;
+        if (top & 8) checksum ^= 1027748829;
+        if (top & 16) checksum ^= 705979059;
+      }
+      return checksum;
+    };
+    const hrp = fragment.slice(0, separator);
+    const hrpValues = [...hrp].map((character) => character.charCodeAt(0) >>> 5).concat([0], [...hrp].map((character) => character.charCodeAt(0) & 31));
+    if (hrp !== "naddr" || polymod(hrpValues.concat(values)) !== 1) fail("Intent URI fragment is not a valid naddr");
+    const words = values.slice(0, -6);
+    const bytes = [];
+    let accumulator = 0;
+    let bits = 0;
+    for (const word of words) {
+      accumulator = accumulator << 5 | word;
+      bits += 5;
+      while (bits >= 8) {
+        bits -= 8;
+        bytes.push(accumulator >>> bits & 255);
+      }
+    }
+    if (bits >= 5 || (accumulator << 8 - bits & 255) !== 0) fail("Intent URI fragment is not a valid naddr");
+    let index = 0;
+    let identifier;
+    let pubkey;
+    let kind;
+    const relays = [];
+    while (index < bytes.length) {
+      if (index + 2 > bytes.length) fail("Intent URI fragment is not a valid naddr");
+      const type = bytes[index++];
+      const length = bytes[index++];
+      if (index + length > bytes.length) fail("Intent URI fragment is not a valid naddr");
+      const value = bytes.slice(index, index + length);
+      index += length;
+      if (type === 0) {
+        if (identifier !== void 0) fail("Intent URI fragment repeats its identifier");
+        identifier = decodeUtf8(value);
+      } else if (type === 1) {
+        const relay = decodeUtf8(value);
+        if (!relay) fail("Intent URI fragment has an empty relay hint");
+        relays.push(relay);
+      } else if (type === 2) {
+        if (pubkey !== void 0 || value.length !== 32) fail("Intent URI fragment has an invalid pubkey");
+        pubkey = value.map((part) => part.toString(16).padStart(2, "0")).join("");
+      } else if (type === 3) {
+        if (kind !== void 0 || value.length !== 4) fail("Intent URI fragment has an invalid kind");
+        kind = (value[0] << 24 >>> 0 | value[1] << 16 | value[2] << 8 | value[3]) >>> 0;
+      } else {
+        fail("Intent URI fragment has unsupported naddr data");
+      }
+    }
+    if (!identifier || !pubkey || kind !== 35129) fail("Intent URI fragment must recommend a named 35129 napplet");
+    return { address: `${kind}:${pubkey}:${identifier}`, ...relays.length > 0 ? { relays } : {} };
+  };
+  const normalizeHint = (value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) fail("Intent handlerHint must be an object");
+    const hint = value;
+    if (Object.keys(hint).some((key) => key !== "address" && key !== "relays")) fail("Intent handlerHint contains unsupported fields");
+    const address = hint.address;
+    if (typeof address !== "string" || !/^35129:[0-9a-f]{64}:.+$/u.test(address)) {
+      fail("Intent handlerHint address must be a named 35129 coordinate");
+    }
+    const relays = hint.relays;
+    if (relays !== void 0 && (!Array.isArray(relays) || relays.some((relay) => typeof relay !== "string" || relay.length === 0))) {
+      fail("Intent handlerHint relays must be non-empty text");
+    }
+    return { address, ...relays === void 0 ? {} : { relays: [...relays] } };
+  };
+  return function normalizeIntentUri2(uri, options) {
+    if (typeof uri !== "string") throw new TypeError("Intent URI must be text");
+    const match = /^napplet:([^/?#\s]+)\/([^/?#\s]+)(?:\?([^#]*))?(?:#(.*))?$/u.exec(uri);
+    if (match === null) return fail("Intent URI must be napplet:<archetype>/<action>");
+    const archetype = match[1];
+    const action = match[2];
+    if (!/^[a-z0-9][a-z0-9-]*$/u.test(archetype) || !/^[a-z0-9][a-z0-9-]*$/u.test(action)) {
+      fail("Intent URI archetype and action must be lowercase slugs");
+    }
+    const query = match[3];
+    const fragment = match[4];
+    const supplied = options === void 0 ? {} : options;
+    if (!supplied || typeof supplied !== "object" || Array.isArray(supplied)) fail("Intent options must be an object");
+    const parsedOptions = supplied;
+    if (Object.keys(parsedOptions).some((key) => key !== "payload" && key !== "handler" && key !== "handlerHint" && key !== "behavior")) {
+      fail("Intent options contain unsupported fields");
+    }
+    const handler = parsedOptions.handler;
+    if (handler !== void 0 && (typeof handler !== "string" || handler.length === 0)) {
+      fail("Intent handler must be non-empty text");
+    }
+    let behavior;
+    if (parsedOptions.behavior !== void 0) {
+      if (!parsedOptions.behavior || typeof parsedOptions.behavior !== "object" || Array.isArray(parsedOptions.behavior)) fail("Intent behavior must be an object");
+      const value = parsedOptions.behavior;
+      if (Object.keys(value).some((key) => key !== "focus" && key !== "reuse") || hasOwn(value, "focus") && typeof value.focus !== "boolean" || hasOwn(value, "reuse") && typeof value.reuse !== "boolean") fail("Intent behavior contains unsupported fields");
+      behavior = {
+        ...hasOwn(value, "focus") ? { focus: value.focus } : {},
+        ...hasOwn(value, "reuse") ? { reuse: value.reuse } : {}
+      };
+    }
+    let payload;
+    if (query !== void 0) {
+      if (hasOwn(parsedOptions, "payload")) fail("Intent URI query cannot accompany options.payload");
+      if (query.length > 0) {
+        const fields = /* @__PURE__ */ Object.create(null);
+        for (const field of query.split("&")) {
+          const equal = field.indexOf("=");
+          if (equal <= 0 || field.indexOf("=", equal + 1) >= 0) fail("Intent URI query fields must be name=value");
+          const name = decode(field.slice(0, equal), "a query name");
+          const value = decode(field.slice(equal + 1), "a query value");
+          if (!name || hasOwn(fields, name)) fail("Intent URI query names must be unique after decoding");
+          Object.defineProperty(fields, name, { value, enumerable: true, writable: true, configurable: true });
+        }
+        payload = fields;
+      }
+    } else if (hasOwn(parsedOptions, "payload")) {
+      payload = parsedOptions.payload;
+    }
+    if (fragment !== void 0) {
+      if (!fragment) fail("Intent URI fragment must be a bare naddr");
+      if (parsedOptions.handlerHint !== void 0) fail("Intent URI fragment cannot accompany options.handlerHint");
+    }
+    const handlerHint = fragment === void 0 ? parsedOptions.handlerHint === void 0 ? void 0 : normalizeHint(parsedOptions.handlerHint) : decodeHint(fragment);
+    return {
+      archetype,
+      action,
+      convention: `napplet:${archetype}/${action}`,
+      ...payload === void 0 ? {} : { payload },
+      ...handlerHint === void 0 ? {} : { handlerHint },
+      ...handler === void 0 ? {} : { handler },
+      ...behavior === void 0 ? {} : { behavior }
+    };
+  };
+}
+var normalizeIntentUri = createIntentUriNormalizer();
+
 // src/napplet-namespace.ts
 function uniqueBareDomains(domains) {
   const seen = /* @__PURE__ */ new Set();
@@ -1265,7 +1440,7 @@ function scriptJson(value) {
 }
 function renderNappletNamespacePrelude(options) {
   const domains = uniqueBareDomains(["shell", ...options.domains]);
-  return `<script data-kehto-nip5d-injection>(${nappletNamespacePrelude.toString()})(${scriptJson(domains)});</script>`;
+  return `<script data-kehto-nip5d-injection>(${nappletNamespacePrelude.toString()})(${scriptJson(domains)}, (${createIntentUriNormalizer.toString()})());</script>`;
 }
 function injectNappletNamespacePrelude(html, options) {
   const prelude = renderNappletNamespacePrelude(options);
@@ -1281,7 +1456,7 @@ function injectNappletNamespacePrelude(html, options) {
   }
   return `${prelude}${html}`;
 }
-function nappletNamespacePrelude(domains) {
+function nappletNamespacePrelude(domains, normalizeIntentUri2) {
   const target = window;
   const allowed = new Set(domains);
   const requestTimeoutMs = 3e4;
@@ -2324,7 +2499,14 @@ function nappletNamespacePrelude(domains) {
   }
   function makeIntent() {
     const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-    const normalizeRequest = (value) => {
+    let warnedLegacyObject = false;
+    const warnLegacyObject = () => {
+      if (warnedLegacyObject) return;
+      warnedLegacyObject = true;
+      console.warn("[KEHTO_COMPAT_INTENT_OBJECT_INVOKE] Object-form intent.invoke/open is deprecated; use intent.invoke(uri, options) or intent.open(uri, options). Warns once per napplet. See docs/compatibility.md.");
+    };
+    const normalizeLegacyRequest = (value) => {
+      warnLegacyObject();
       if (!value || typeof value !== "object" || Array.isArray(value)) {
         throw new TypeError("Intent request must be an object");
       }
@@ -2332,7 +2514,7 @@ function nappletNamespacePrelude(domains) {
       if (hasOwn(supplied, "sender")) {
         throw new TypeError("Intent callers cannot supply sender");
       }
-      const allowed2 = ["archetype", "action", "convention", "payload", "handler", "behavior"];
+      const allowed2 = ["archetype", "action", "convention", "payload", "handler", "handlerHint", "behavior"];
       if (Object.keys(supplied).some((field) => !allowed2.includes(field))) {
         throw new TypeError("Intent request contains unsupported fields");
       }
@@ -2343,51 +2525,63 @@ function nappletNamespacePrelude(domains) {
       if (typeof action !== "string" || action.length === 0) {
         throw new TypeError("Intent action must be a non-empty string");
       }
-      if (supplied.convention !== void 0 && (typeof supplied.convention !== "string" || !/^napplet:[^/?#\s]+\/[^/?#\s]+$/.test(supplied.convention))) {
-        throw new TypeError("Intent convention must be queryless");
+      const uri = supplied.convention === void 0 ? `napplet:${supplied.archetype}/${action}` : supplied.convention;
+      if (typeof uri !== "string") throw new TypeError("Intent convention must be text");
+      if (uri.includes("?") || uri.includes("#")) throw new TypeError("Legacy intent convention must be queryless");
+      return normalizeIntentUri2(uri, {
+        ...hasOwn(supplied, "payload") ? { payload: supplied.payload } : {},
+        ...hasOwn(supplied, "handler") ? { handler: supplied.handler } : {},
+        ...hasOwn(supplied, "handlerHint") ? { handlerHint: supplied.handlerHint } : {},
+        ...hasOwn(supplied, "behavior") ? { behavior: supplied.behavior } : {}
+      });
+    };
+    const requestInvoke = (normalized) => request(
+      {
+        type: "intent.invoke",
+        request: normalized
+      },
+      "intent.invoke.result",
+      (msg) => fieldOrThrow(msg, "result", "intent.invoke.result missing result")
+    );
+    const invoke = (uri, options) => {
+      const normalized = typeof uri === "string" ? normalizeIntentUri2(uri, options) : normalizeLegacyRequest(uri);
+      return requestInvoke(normalized);
+    };
+    const open = (uri, options, legacyOptions) => {
+      if (typeof uri === "string" && uri.startsWith("napplet:") && legacyOptions === void 0) {
+        const normalized2 = normalizeIntentUri2(uri, options);
+        if (normalized2.action !== "open") throw new TypeError("intent.open requires a /open URI");
+        return requestInvoke(normalized2);
       }
-      if (supplied.handler !== void 0 && (typeof supplied.handler !== "string" || supplied.handler.length === 0)) {
-        throw new TypeError("Intent handler must be a non-empty string");
+      if (typeof uri !== "string" || !uri) throw new TypeError("Intent archetype must be non-empty text");
+      warnLegacyObject();
+      if (legacyOptions !== void 0 && (!legacyOptions || typeof legacyOptions !== "object" || Array.isArray(legacyOptions))) {
+        throw new TypeError("Intent options must be an object");
       }
-      const behaviorValue = supplied?.behavior;
-      const behavior = behaviorValue && typeof behaviorValue === "object" ? behaviorValue : void 0;
-      if (behaviorValue !== void 0 && (!behavior || Array.isArray(behaviorValue) || Object.keys(behavior).some((field) => field !== "focus" && field !== "newWindow" && field !== "reuse") || hasOwn(behavior, "focus") && typeof behavior.focus !== "boolean" || hasOwn(behavior, "newWindow") && typeof behavior.newWindow !== "boolean" || hasOwn(behavior, "reuse") && typeof behavior.reuse !== "boolean")) {
-        throw new TypeError("Intent behavior contains unsupported fields");
+      const legacy = legacyOptions;
+      const convention = legacy?.convention === void 0 ? `napplet:${uri}/open` : legacy.convention;
+      if (typeof convention !== "string" || convention.includes("?") || convention.includes("#")) {
+        throw new TypeError("Legacy intent convention must be queryless");
       }
-      const sanitizedBehavior = {
-        ...typeof behavior?.focus === "boolean" ? { focus: behavior.focus } : {},
-        ...typeof behavior?.newWindow === "boolean" ? { newWindow: behavior.newWindow } : {},
-        ...typeof behavior?.reuse === "boolean" ? { reuse: behavior.reuse } : {}
-      };
-      return {
-        archetype: supplied.archetype,
-        action,
-        ...typeof supplied.convention === "string" ? { convention: supplied.convention } : {},
-        ...hasOwn(supplied, "payload") ? { payload: supplied.payload } : {},
-        ...typeof supplied.handler === "string" ? { handler: supplied.handler } : {},
-        ...Object.keys(sanitizedBehavior).length === 0 ? {} : { behavior: sanitizedBehavior }
-      };
-    };
-    const invoke = (value) => {
-      const normalized = normalizeRequest(value);
-      return request(
-        {
-          type: "intent.invoke",
-          request: normalized
-        },
-        "intent.invoke.result",
-        (msg) => fieldOrThrow(msg, "result", "intent.invoke.result missing result")
-      );
+      const normalized = normalizeIntentUri2(`napplet:${uri}/open`, {
+        ...options === void 0 ? {} : { payload: options },
+        ...legacy === void 0 ? {} : Object.fromEntries(
+          Object.entries(legacy).filter(([key]) => key !== "convention")
+        )
+      });
+      const legacyNormalized = convention === `napplet:${uri}/open` ? normalized : normalizeIntentUri2(convention, {
+        ...options === void 0 ? {} : { payload: options },
+        ...legacy === void 0 ? {} : Object.fromEntries(
+          Object.entries(legacy).filter(([key]) => key !== "convention")
+        )
+      });
+      if (legacyNormalized.action !== "open") throw new TypeError("intent.open requires a /open URI");
+      return requestInvoke(legacyNormalized);
     };
     return {
       onDelivery: intentDelivery.onDelivery,
       invoke,
-      open: (archetype, payload, opts) => invoke({
-        archetype,
-        action: "open",
-        ...payload === void 0 ? {} : { payload },
-        ...opts
-      }),
+      open,
       available: (archetype) => request(
         { type: "intent.available", archetype },
         "intent.available.result",
@@ -2694,6 +2888,124 @@ function nappletNamespacePrelude(domains) {
   });
 }
 
+// src/napplet-head.ts
+function insertNappletHead(html, content) {
+  const opening = /^([\t\n\f\r ]*(?:<!doctype[\t\n\f\r ]+html[\t\n\f\r ]*>[\t\n\f\r ]*)?(?:<html>[\t\n\f\r ]*)?)(<head>)?/i.exec(html);
+  const prefix = opening[0];
+  const insertion = opening[2] ? content : `<head>${content}</head>`;
+  return `${prefix}${insertion}${html.slice(prefix.length)}`;
+}
+
+// src/napplet-csp.ts
+var DEFAULT_DIRECTIVES = {
+  "default-src": ["'none'"],
+  "script-src": ["'unsafe-inline'", "'wasm-unsafe-eval'"],
+  "style-src": ["'unsafe-inline'"],
+  "img-src": ["data:", "blob:"],
+  "font-src": ["data:"],
+  "connect-src": ["'none'"],
+  "worker-src": ["'none'"],
+  "child-src": ["'none'"],
+  "frame-src": ["'none'"],
+  "media-src": ["'none'"],
+  "object-src": ["'none'"],
+  "manifest-src": ["'none'"],
+  "base-uri": ["'none'"],
+  "form-action": ["'none'"]
+};
+var OPTIONAL_DIRECTIVES = /* @__PURE__ */ new Set([
+  "script-src-elem",
+  "script-src-attr",
+  "style-src-elem",
+  "style-src-attr"
+]);
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "'none'",
+  "'self'",
+  "'unsafe-inline'",
+  "'wasm-unsafe-eval'",
+  "'unsafe-hashes'",
+  "'strict-dynamic'",
+  "'report-sample'"
+]);
+function connectionOrigin(source) {
+  let url;
+  try {
+    url = new URL(source);
+  } catch {
+    throw new Error(`CSP connection grant must be an exact HTTP(S)/WS(S) origin: ${source}`);
+  }
+  if (!/^(https?|wss?):$/.test(url.protocol) || url.username || url.password || url.pathname !== "/" && url.pathname !== "" || url.search || url.hash || /[\s*\\;,"<>'`]/.test(source + url.origin) || !source.startsWith(`${url.protocol}//`)) {
+    throw new Error(`CSP connection grant must be an exact HTTP(S)/WS(S) origin: ${source}`);
+  }
+  return url.origin;
+}
+function validateSources(directive, sources2) {
+  if (!Array.isArray(sources2) || sources2.length === 0) {
+    throw new Error(`CSP ${directive} needs a nonempty source list; use 'none' to deny it`);
+  }
+  const result = [...new Set(sources2)];
+  for (const source of result) {
+    if (typeof source !== "string" || !/^[\x21-\x7e]+$/.test(source) || /[;,"<>\\]/.test(source)) {
+      throw new Error(`Invalid CSP source in ${directive}`);
+    }
+    if (source.toLowerCase() === "'unsafe-eval'") {
+      throw new Error("NIP-5D CSP forbids 'unsafe-eval'; use 'wasm-unsafe-eval' for WebAssembly");
+    }
+    if (source.includes("'") && !KEYWORDS.has(source) && !/^'(?:nonce-|sha(?:256|384|512)-)[A-Za-z0-9+/_-]+=*'$/.test(source)) {
+      throw new Error(`Invalid CSP keyword in ${directive}: ${source}`);
+    }
+  }
+  if (result.includes("'none'") && result.length !== 1) {
+    throw new Error(`CSP ${directive} cannot combine 'none' with other sources`);
+  }
+  return result;
+}
+function requireBootstrapScripts(directive, sources2) {
+  if (!sources2.includes("'unsafe-inline'") || sources2.some(
+    (source) => /^'(?:nonce-|sha(?:256|384|512)-|strict-dynamic')/.test(source)
+  )) {
+    throw new Error(`CSP ${directive} must allow the shell's inline namespace bootstrap`);
+  }
+}
+function buildNappletCsp(options = {}) {
+  const grants = [...new Set((options.connectOrigins ?? []).map(connectionOrigin))].sort();
+  const policy = {
+    ...DEFAULT_DIRECTIVES,
+    "connect-src": grants.length ? grants : ["'none'"]
+  };
+  for (const [directive, sources2] of Object.entries(options.directives ?? {})) {
+    if (!Object.hasOwn(DEFAULT_DIRECTIVES, directive) && !OPTIONAL_DIRECTIVES.has(directive)) {
+      throw new Error(`Unsupported meta CSP directive: ${directive}`);
+    }
+    policy[directive] = validateSources(directive, sources2);
+  }
+  const connect = policy["connect-src"];
+  if (!(connect.length === 1 && connect[0] === "'none'")) {
+    policy["connect-src"] = [...new Set(connect.map((source) => {
+      const origin = connectionOrigin(source);
+      if (!grants.includes(origin)) throw new Error(`CSP connection origin was not granted: ${origin}`);
+      return origin;
+    }))].sort();
+  }
+  requireBootstrapScripts("script-src", policy["script-src"]);
+  if (policy["script-src-elem"]) requireBootstrapScripts("script-src-elem", policy["script-src-elem"]);
+  return Object.entries(policy).map(([name, sources2]) => `${name} ${sources2.join(" ")}`).join("; ");
+}
+function renderNappletCspMeta(options = {}) {
+  const policy = buildNappletCsp(options).replace(/&/g, "&amp;").replace(/"/g, "&quot;");
+  return `<meta http-equiv="Content-Security-Policy" content="${policy}">`;
+}
+function injectNappletCsp(html, options = {}) {
+  return insertNappletHead(html, renderNappletCspMeta(options));
+}
+
+// src/napplet-srcdoc.ts
+function prepareNappletSrcdoc(html, options) {
+  const meta = renderNappletCspMeta(options.csp);
+  return insertNappletHead(html, meta + renderNappletNamespacePrelude(options));
+}
+
 // src/index.ts
 import { ALL_CAPABILITIES as ALL_CAPABILITIES2 } from "@kehto/runtime";
 import { createEnforceGate, createNapEnforceGate, formatDenialReason } from "@kehto/runtime";
@@ -2772,6 +3084,7 @@ export {
   TOPICS,
   adaptHooks,
   audioManager,
+  buildNappletCsp,
   buildShellCapabilities,
   createEnforceGate,
   createIdentityProxy,
@@ -2782,10 +3095,14 @@ export {
   createShellBridge,
   createThemeProxy,
   formatDenialReason,
+  injectNappletCsp,
   injectNappletNamespacePrelude,
   manifestCache,
   nappKeyRegistry,
+  normalizeIntentUri,
   originRegistry,
+  prepareNappletSrcdoc,
+  renderNappletCspMeta,
   renderNappletNamespacePrelude,
   resolveShellEnvironment,
   sessionRegistry