@kehto/shell 0.22.0 → 0.24.0

package/dist/index.js

@@ -976,6 +976,7 @@ var audioManager = {
 
 // src/shell-init.ts
 var RUNTIME_NATIVE_DOMAINS = [
+  "shell",
   "relay",
   "identity",
   "storage",
@@ -1000,7 +1001,8 @@ var SERVICE_ONLY_DOMAINS = [
   "webrtc",
   "dm",
   "count",
-  "fs"
+  "fs",
+  "gamepad"
 ];
 function buildShellCapabilities(hooks) {
   const disabled = new Set(hooks.capabilities?.disabledDomains ?? []);
@@ -1096,14 +1098,21 @@ function handleShellReady({
   if (state.initSent.get(sourceWindow) === sourceRegistrationId) {
     return;
   }
-  const identity = resolveNip5dIdentity(hooks, windowId, sourceWindow);
-  if (!identity) return;
-  registerNip5dSessionIfNeeded({ origin, runtime, state, sourceRegistrationId, windowId, identity });
-  const environment = originRegistry.getEnvironment(sourceWindow) ?? resolveShellEnvironment(hooks, identity);
-  state.environments.set(windowId, environment);
+  const environment = registerSourceSession({ hooks, origin, runtime, state, sourceRegistrationId, sourceWindow, windowId });
+  if (!environment?.capabilities.domains.includes("shell")) return;
   postShellInit(sourceWindow, environment);
   state.initSent.set(sourceWindow, sourceRegistrationId);
 }
+function registerSourceSession(options) {
+  const { hooks, origin, runtime, state, sourceRegistrationId, sourceWindow, windowId } = options;
+  const identity = resolveNip5dIdentity(hooks, windowId, sourceWindow, runtime.sessionRegistry.getEntryByWindowId(windowId));
+  if (!identity) return null;
+  registerNip5dSessionIfNeeded({ origin, runtime, state, sourceRegistrationId, windowId, identity });
+  const existing = state.environments.get(windowId);
+  const environment = originRegistry.getEnvironment(sourceWindow) ?? existing ?? resolveShellEnvironment(hooks, identity);
+  state.environments.set(windowId, environment);
+  return environment;
+}
 function registerNip5dSessionIfNeeded({
   origin,
   runtime,
@@ -1118,9 +1127,14 @@ function registerNip5dSessionIfNeeded({
     return;
   }
   if (existing && previousRegistration !== void 0) {
+    runtime.destroyWindow(windowId);
     runtime.sessionRegistry.unregister(windowId);
+    state.environments.delete(windowId);
+  }
+  if (existing && previousRegistration === void 0) {
+    state.sessionRegistration.set(windowId, sourceRegistrationId);
+    return;
   }
-  if (existing && previousRegistration === void 0) return;
   const entry = {
     pubkey: "",
     windowId,
@@ -1135,7 +1149,7 @@ function registerNip5dSessionIfNeeded({
   runtime.sessionRegistry.register(windowId, entry);
   state.sessionRegistration.set(windowId, sourceRegistrationId);
 }
-function resolveNip5dIdentity(hooks, windowId, sourceWindow) {
+function resolveNip5dIdentity(hooks, windowId, sourceWindow, existingSession) {
   const hookIdentity = hooks.onNip5dIframeCreate?.(windowId);
   if (hookIdentity !== null && hookIdentity !== void 0) {
     return Object.freeze({
@@ -1145,7 +1159,8 @@ function resolveNip5dIdentity(hooks, windowId, sourceWindow) {
   }
   const originIdentity = originRegistry.getIdentity(sourceWindow);
   if (!originIdentity) {
-    return null;
+    if (existingSession?.provenance !== "nip-5d" || typeof existingSession.dTag !== "string" || typeof existingSession.aggregateHash !== "string") return null;
+    return Object.freeze({ dTag: existingSession.dTag, aggregateHash: existingSession.aggregateHash });
   }
   return Object.freeze({
     dTag: originIdentity.dTag,
@@ -1208,6 +1223,15 @@ function createShellBridge(hooks) {
       }
       const msg = event.data;
       if (typeof msg !== "object" || msg === null || typeof msg.type !== "string") return;
+      if (!registerSourceSession({
+        hooks,
+        origin: event.origin,
+        runtime,
+        state: shellReadyState,
+        sourceRegistrationId: originRegistry.getRegistrationId(sourceWindow) ?? 0,
+        sourceWindow,
+        windowId
+      })) return;
       if (msg.type === "shell.ready") {
         handleShellReady({
           hooks,
@@ -1246,6 +1270,188 @@ function createShellBridge(hooks) {
   };
 }
 
+// src/gamepad-policy.ts
+var CONTROLLER_FEATURES = ["gamepad", "hid", "usb"];
+function denyNappletControllerAccess(frame) {
+  const remaining = (frame.getAttribute("allow") ?? "").split(";").map((entry) => entry.trim()).filter((entry) => entry && !CONTROLLER_FEATURES.some((feature) => entry === feature || entry.startsWith(`${feature} `)));
+  frame.setAttribute("allow", [...remaining, ...CONTROLLER_FEATURES.map((feature) => `${feature} 'none'`)].join("; "));
+}
+
+// src/intent-uri.ts
+function createIntentUriNormalizer() {
+  const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+  const fail = (message) => {
+    throw new TypeError(message);
+  };
+  const decode = (value, label) => {
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return fail(`Intent URI has malformed percent-encoding in ${label}`);
+    }
+  };
+  const decodeUtf8 = (bytes) => {
+    try {
+      return new TextDecoder("utf-8", { fatal: true }).decode(new Uint8Array(bytes));
+    } catch {
+      return fail("Intent URI fragment contains invalid UTF-8");
+    }
+  };
+  const decodeHint = (fragment) => {
+    if (!fragment.startsWith("naddr") || fragment !== fragment.toLowerCase()) {
+      return fail("Intent URI fragment must be a bare lowercase naddr");
+    }
+    const separator = fragment.lastIndexOf("1");
+    if (separator <= 0 || separator + 7 > fragment.length) fail("Intent URI fragment is not a valid naddr");
+    const alphabet = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+    const values = [];
+    for (const character of fragment.slice(separator + 1)) {
+      const value = alphabet.indexOf(character);
+      if (value < 0) fail("Intent URI fragment is not a valid naddr");
+      values.push(value);
+    }
+    const polymod = (input) => {
+      let checksum = 1;
+      for (const value of input) {
+        const top = checksum >>> 25;
+        checksum = (checksum & 33554431) << 5 ^ value;
+        if (top & 1) checksum ^= 996825010;
+        if (top & 2) checksum ^= 642813549;
+        if (top & 4) checksum ^= 513874426;
+        if (top & 8) checksum ^= 1027748829;
+        if (top & 16) checksum ^= 705979059;
+      }
+      return checksum;
+    };
+    const hrp = fragment.slice(0, separator);
+    const hrpValues = [...hrp].map((character) => character.charCodeAt(0) >>> 5).concat([0], [...hrp].map((character) => character.charCodeAt(0) & 31));
+    if (hrp !== "naddr" || polymod(hrpValues.concat(values)) !== 1) fail("Intent URI fragment is not a valid naddr");
+    const words = values.slice(0, -6);
+    const bytes = [];
+    let accumulator = 0;
+    let bits = 0;
+    for (const word of words) {
+      accumulator = accumulator << 5 | word;
+      bits += 5;
+      while (bits >= 8) {
+        bits -= 8;
+        bytes.push(accumulator >>> bits & 255);
+      }
+    }
+    if (bits >= 5 || (accumulator << 8 - bits & 255) !== 0) fail("Intent URI fragment is not a valid naddr");
+    let index = 0;
+    let identifier;
+    let pubkey;
+    let kind;
+    const relays = [];
+    while (index < bytes.length) {
+      if (index + 2 > bytes.length) fail("Intent URI fragment is not a valid naddr");
+      const type = bytes[index++];
+      const length = bytes[index++];
+      if (index + length > bytes.length) fail("Intent URI fragment is not a valid naddr");
+      const value = bytes.slice(index, index + length);
+      index += length;
+      if (type === 0) {
+        if (identifier !== void 0) fail("Intent URI fragment repeats its identifier");
+        identifier = decodeUtf8(value);
+      } else if (type === 1) {
+        const relay = decodeUtf8(value);
+        if (!relay) fail("Intent URI fragment has an empty relay hint");
+        relays.push(relay);
+      } else if (type === 2) {
+        if (pubkey !== void 0 || value.length !== 32) fail("Intent URI fragment has an invalid pubkey");
+        pubkey = value.map((part) => part.toString(16).padStart(2, "0")).join("");
+      } else if (type === 3) {
+        if (kind !== void 0 || value.length !== 4) fail("Intent URI fragment has an invalid kind");
+        kind = (value[0] << 24 >>> 0 | value[1] << 16 | value[2] << 8 | value[3]) >>> 0;
+      } else {
+        fail("Intent URI fragment has unsupported naddr data");
+      }
+    }
+    if (!identifier || !pubkey || kind !== 35129) fail("Intent URI fragment must recommend a named 35129 napplet");
+    return { address: `${kind}:${pubkey}:${identifier}`, ...relays.length > 0 ? { relays } : {} };
+  };
+  const normalizeHint = (value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) fail("Intent handlerHint must be an object");
+    const hint = value;
+    if (Object.keys(hint).some((key) => key !== "address" && key !== "relays")) fail("Intent handlerHint contains unsupported fields");
+    const address = hint.address;
+    if (typeof address !== "string" || !/^35129:[0-9a-f]{64}:.+$/u.test(address)) {
+      fail("Intent handlerHint address must be a named 35129 coordinate");
+    }
+    const relays = hint.relays;
+    if (relays !== void 0 && (!Array.isArray(relays) || relays.some((relay) => typeof relay !== "string" || relay.length === 0))) {
+      fail("Intent handlerHint relays must be non-empty text");
+    }
+    return { address, ...relays === void 0 ? {} : { relays: [...relays] } };
+  };
+  return function normalizeIntentUri2(uri, options) {
+    if (typeof uri !== "string") throw new TypeError("Intent URI must be text");
+    const match = /^napplet:([^/?#\s]+)\/([^/?#\s]+)(?:\?([^#]*))?(?:#(.*))?$/u.exec(uri);
+    if (match === null) return fail("Intent URI must be napplet:<archetype>/<action>");
+    const archetype = match[1];
+    const action = match[2];
+    if (!/^[a-z0-9][a-z0-9-]*$/u.test(archetype) || !/^[a-z0-9][a-z0-9-]*$/u.test(action)) {
+      fail("Intent URI archetype and action must be lowercase slugs");
+    }
+    const query = match[3];
+    const fragment = match[4];
+    const supplied = options === void 0 ? {} : options;
+    if (!supplied || typeof supplied !== "object" || Array.isArray(supplied)) fail("Intent options must be an object");
+    const parsedOptions = supplied;
+    if (Object.keys(parsedOptions).some((key) => key !== "payload" && key !== "handler" && key !== "handlerHint" && key !== "behavior")) {
+      fail("Intent options contain unsupported fields");
+    }
+    const handler = parsedOptions.handler;
+    if (handler !== void 0 && (typeof handler !== "string" || handler.length === 0)) {
+      fail("Intent handler must be non-empty text");
+    }
+    let behavior;
+    if (parsedOptions.behavior !== void 0) {
+      if (!parsedOptions.behavior || typeof parsedOptions.behavior !== "object" || Array.isArray(parsedOptions.behavior)) fail("Intent behavior must be an object");
+      const value = parsedOptions.behavior;
+      if (Object.keys(value).some((key) => key !== "focus" && key !== "reuse") || hasOwn(value, "focus") && typeof value.focus !== "boolean" || hasOwn(value, "reuse") && typeof value.reuse !== "boolean") fail("Intent behavior contains unsupported fields");
+      behavior = {
+        ...hasOwn(value, "focus") ? { focus: value.focus } : {},
+        ...hasOwn(value, "reuse") ? { reuse: value.reuse } : {}
+      };
+    }
+    let payload;
+    if (query !== void 0) {
+      if (hasOwn(parsedOptions, "payload")) fail("Intent URI query cannot accompany options.payload");
+      if (query.length > 0) {
+        const fields = /* @__PURE__ */ Object.create(null);
+        for (const field of query.split("&")) {
+          const equal = field.indexOf("=");
+          if (equal <= 0 || field.indexOf("=", equal + 1) >= 0) fail("Intent URI query fields must be name=value");
+          const name = decode(field.slice(0, equal), "a query name");
+          const value = decode(field.slice(equal + 1), "a query value");
+          if (!name || hasOwn(fields, name)) fail("Intent URI query names must be unique after decoding");
+          Object.defineProperty(fields, name, { value, enumerable: true, writable: true, configurable: true });
+        }
+        payload = fields;
+      }
+    } else if (hasOwn(parsedOptions, "payload")) {
+      payload = parsedOptions.payload;
+    }
+    if (fragment !== void 0) {
+      if (!fragment) fail("Intent URI fragment must be a bare naddr");
+      if (parsedOptions.handlerHint !== void 0) fail("Intent URI fragment cannot accompany options.handlerHint");
+    }
+    const handlerHint = fragment === void 0 ? parsedOptions.handlerHint === void 0 ? void 0 : normalizeHint(parsedOptions.handlerHint) : decodeHint(fragment);
+    return {
+      archetype,
+      action,
+      convention: `napplet:${archetype}/${action}`,
+      ...payload === void 0 ? {} : { payload },
+      ...handlerHint === void 0 ? {} : { handlerHint },
+      ...handler === void 0 ? {} : { handler },
+      ...behavior === void 0 ? {} : { behavior }
+    };
+  };
+}
+var normalizeIntentUri = createIntentUriNormalizer();
+
 // src/napplet-namespace.ts
 function uniqueBareDomains(domains) {
   const seen = /* @__PURE__ */ new Set();
@@ -1264,8 +1470,8 @@ function scriptJson(value) {
   return JSON.stringify(value).replace(/</g, "\\u003c");
 }
 function renderNappletNamespacePrelude(options) {
-  const domains = uniqueBareDomains(["shell", ...options.domains]);
-  return `<script data-kehto-nip5d-injection>(${nappletNamespacePrelude.toString()})(${scriptJson(domains)});</script>`;
+  const domains = uniqueBareDomains(options.domains);
+  return `<script data-kehto-nip5d-injection>(${nappletNamespacePrelude.toString()})(${scriptJson(domains)}, (${createIntentUriNormalizer.toString()})());</script>`;
 }
 function injectNappletNamespacePrelude(html, options) {
   const prelude = renderNappletNamespacePrelude(options);
@@ -1281,7 +1487,7 @@ function injectNappletNamespacePrelude(html, options) {
   }
   return `${prelude}${html}`;
 }
-function nappletNamespacePrelude(domains) {
+function nappletNamespacePrelude(domains, normalizeIntentUri2) {
   const target = window;
   const allowed = new Set(domains);
   const requestTimeoutMs = 3e4;
@@ -1453,7 +1659,7 @@ function nappletNamespacePrelude(domains) {
       return Object.freeze(strings);
     }
     function supports(domain) {
-      return typeof domain === "string" && environment?.capabilities.domains.includes(domain) === true;
+      return typeof domain === "string" && !!target.napplet && Object.prototype.hasOwnProperty.call(target.napplet, domain);
     }
     const shell2 = {
       ready: () => ready,
@@ -2324,7 +2530,14 @@ function nappletNamespacePrelude(domains) {
   }
   function makeIntent() {
     const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-    const normalizeRequest = (value) => {
+    let warnedLegacyObject = false;
+    const warnLegacyObject = () => {
+      if (warnedLegacyObject) return;
+      warnedLegacyObject = true;
+      console.warn("[KEHTO_COMPAT_INTENT_OBJECT_INVOKE] Object-form intent.invoke/open is deprecated; use intent.invoke(uri, options) or intent.open(uri, options). Warns once per napplet. See docs/compatibility.md.");
+    };
+    const normalizeLegacyRequest = (value) => {
+      warnLegacyObject();
       if (!value || typeof value !== "object" || Array.isArray(value)) {
         throw new TypeError("Intent request must be an object");
       }
@@ -2332,7 +2545,7 @@ function nappletNamespacePrelude(domains) {
       if (hasOwn(supplied, "sender")) {
         throw new TypeError("Intent callers cannot supply sender");
       }
-      const allowed2 = ["archetype", "action", "convention", "payload", "handler", "behavior"];
+      const allowed2 = ["archetype", "action", "convention", "payload", "handler", "handlerHint", "behavior"];
       if (Object.keys(supplied).some((field) => !allowed2.includes(field))) {
         throw new TypeError("Intent request contains unsupported fields");
       }
@@ -2343,51 +2556,63 @@ function nappletNamespacePrelude(domains) {
       if (typeof action !== "string" || action.length === 0) {
         throw new TypeError("Intent action must be a non-empty string");
       }
-      if (supplied.convention !== void 0 && (typeof supplied.convention !== "string" || !/^napplet:[^/?#\s]+\/[^/?#\s]+$/.test(supplied.convention))) {
-        throw new TypeError("Intent convention must be queryless");
+      const uri = supplied.convention === void 0 ? `napplet:${supplied.archetype}/${action}` : supplied.convention;
+      if (typeof uri !== "string") throw new TypeError("Intent convention must be text");
+      if (uri.includes("?") || uri.includes("#")) throw new TypeError("Legacy intent convention must be queryless");
+      return normalizeIntentUri2(uri, {
+        ...hasOwn(supplied, "payload") ? { payload: supplied.payload } : {},
+        ...hasOwn(supplied, "handler") ? { handler: supplied.handler } : {},
+        ...hasOwn(supplied, "handlerHint") ? { handlerHint: supplied.handlerHint } : {},
+        ...hasOwn(supplied, "behavior") ? { behavior: supplied.behavior } : {}
+      });
+    };
+    const requestInvoke = (normalized) => request(
+      {
+        type: "intent.invoke",
+        request: normalized
+      },
+      "intent.invoke.result",
+      (msg) => fieldOrThrow(msg, "result", "intent.invoke.result missing result")
+    );
+    const invoke = (uri, options) => {
+      const normalized = typeof uri === "string" ? normalizeIntentUri2(uri, options) : normalizeLegacyRequest(uri);
+      return requestInvoke(normalized);
+    };
+    const open = (uri, options, legacyOptions) => {
+      if (typeof uri === "string" && uri.startsWith("napplet:") && legacyOptions === void 0) {
+        const normalized2 = normalizeIntentUri2(uri, options);
+        if (normalized2.action !== "open") throw new TypeError("intent.open requires a /open URI");
+        return requestInvoke(normalized2);
       }
-      if (supplied.handler !== void 0 && (typeof supplied.handler !== "string" || supplied.handler.length === 0)) {
-        throw new TypeError("Intent handler must be a non-empty string");
+      if (typeof uri !== "string" || !uri) throw new TypeError("Intent archetype must be non-empty text");
+      warnLegacyObject();
+      if (legacyOptions !== void 0 && (!legacyOptions || typeof legacyOptions !== "object" || Array.isArray(legacyOptions))) {
+        throw new TypeError("Intent options must be an object");
       }
-      const behaviorValue = supplied?.behavior;
-      const behavior = behaviorValue && typeof behaviorValue === "object" ? behaviorValue : void 0;
-      if (behaviorValue !== void 0 && (!behavior || Array.isArray(behaviorValue) || Object.keys(behavior).some((field) => field !== "focus" && field !== "newWindow" && field !== "reuse") || hasOwn(behavior, "focus") && typeof behavior.focus !== "boolean" || hasOwn(behavior, "newWindow") && typeof behavior.newWindow !== "boolean" || hasOwn(behavior, "reuse") && typeof behavior.reuse !== "boolean")) {
-        throw new TypeError("Intent behavior contains unsupported fields");
+      const legacy = legacyOptions;
+      const convention = legacy?.convention === void 0 ? `napplet:${uri}/open` : legacy.convention;
+      if (typeof convention !== "string" || convention.includes("?") || convention.includes("#")) {
+        throw new TypeError("Legacy intent convention must be queryless");
       }
-      const sanitizedBehavior = {
-        ...typeof behavior?.focus === "boolean" ? { focus: behavior.focus } : {},
-        ...typeof behavior?.newWindow === "boolean" ? { newWindow: behavior.newWindow } : {},
-        ...typeof behavior?.reuse === "boolean" ? { reuse: behavior.reuse } : {}
-      };
-      return {
-        archetype: supplied.archetype,
-        action,
-        ...typeof supplied.convention === "string" ? { convention: supplied.convention } : {},
-        ...hasOwn(supplied, "payload") ? { payload: supplied.payload } : {},
-        ...typeof supplied.handler === "string" ? { handler: supplied.handler } : {},
-        ...Object.keys(sanitizedBehavior).length === 0 ? {} : { behavior: sanitizedBehavior }
-      };
-    };
-    const invoke = (value) => {
-      const normalized = normalizeRequest(value);
-      return request(
-        {
-          type: "intent.invoke",
-          request: normalized
-        },
-        "intent.invoke.result",
-        (msg) => fieldOrThrow(msg, "result", "intent.invoke.result missing result")
-      );
+      const normalized = normalizeIntentUri2(`napplet:${uri}/open`, {
+        ...options === void 0 ? {} : { payload: options },
+        ...legacy === void 0 ? {} : Object.fromEntries(
+          Object.entries(legacy).filter(([key]) => key !== "convention")
+        )
+      });
+      const legacyNormalized = convention === `napplet:${uri}/open` ? normalized : normalizeIntentUri2(convention, {
+        ...options === void 0 ? {} : { payload: options },
+        ...legacy === void 0 ? {} : Object.fromEntries(
+          Object.entries(legacy).filter(([key]) => key !== "convention")
+        )
+      });
+      if (legacyNormalized.action !== "open") throw new TypeError("intent.open requires a /open URI");
+      return requestInvoke(legacyNormalized);
     };
     return {
       onDelivery: intentDelivery.onDelivery,
       invoke,
-      open: (archetype, payload, opts) => invoke({
-        archetype,
-        action: "open",
-        ...payload === void 0 ? {} : { payload },
-        ...opts
-      }),
+      open,
       available: (archetype) => request(
         { type: "intent.available", archetype },
         "intent.available.result",
@@ -2515,6 +2740,63 @@ function nappletNamespacePrelude(domains) {
       })
     };
   }
+  function makeGamepad() {
+    let state = { available: true, focused: false, pads: [] };
+    const handlers = /* @__PURE__ */ new Set();
+    const copy = (value) => ({
+      available: value.available,
+      focused: value.focused,
+      ...value.reason === void 0 ? {} : { reason: value.reason },
+      pads: value.pads.map((pad) => pad === null ? null : {
+        index: pad.index,
+        id: pad.id,
+        mapping: pad.mapping,
+        connected: true,
+        timestamp: pad.timestamp,
+        axes: [...pad.axes],
+        buttons: pad.buttons.map(({ value: value2, pressed, touched }) => ({ value: value2, pressed, touched }))
+      })
+    });
+    const numberIn = (value, min, max) => typeof value === "number" && Number.isFinite(value) && value >= min && value <= max;
+    const valid = (value) => {
+      if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+      const candidate = value;
+      if (typeof candidate.available !== "boolean" || typeof candidate.focused !== "boolean" || !Array.isArray(candidate.pads)) return false;
+      if (candidate.available ? candidate.reason !== void 0 : candidate.focused || !["blocked", "unavailable"].includes(candidate.reason ?? "")) return false;
+      return Array.from(candidate.pads).every((pad) => {
+        if (pad === null) return true;
+        if (!pad || typeof pad !== "object" || !Number.isInteger(pad.index) || pad.index < 0 || typeof pad.id !== "string" || typeof pad.mapping !== "string" || pad.connected !== true || !Number.isFinite(pad.timestamp) || !Array.isArray(pad.axes) || !Array.isArray(pad.buttons)) return false;
+        if (!candidate.focused && pad.timestamp !== 0) return false;
+        if (!Array.from(pad.axes).every((axis) => numberIn(axis, -1, 1) && (candidate.focused || axis === 0))) return false;
+        return Array.from(pad.buttons).every((button) => button && numberIn(button.value, 0, 1) && typeof button.pressed === "boolean" && typeof button.touched === "boolean" && (candidate.focused || button.value === 0 && !button.pressed && !button.touched));
+      });
+    };
+    listen((event) => {
+      if (!isParentMessage(event)) return;
+      const incoming = event.data;
+      if (!incoming || incoming.type !== "gamepad.state" || "id" in incoming || !valid(incoming)) return;
+      state = copy(incoming);
+      const snapshot = copy(state);
+      const recipients = Array.from(handlers);
+      for (const entry of recipients) if (handlers.has(entry)) entry.handler(copy(snapshot));
+    });
+    const api = {
+      get available() {
+        return state.available;
+      },
+      get focused() {
+        return state.focused;
+      },
+      getGamepads: () => copy(state).pads,
+      onChange(handler) {
+        const entry = { handler };
+        handlers.add(entry);
+        return subscriptionHandle(() => handlers.delete(entry));
+      }
+    };
+    post({ type: "gamepad.subscribe" });
+    return api;
+  }
   function makeDm() {
     const req = (type, payload) => request({ type, ...payload }, `${type}.result`, withoutEnvelope, { rejectOnError: false });
     return {
@@ -2561,7 +2843,8 @@ function nappletNamespacePrelude(domains) {
     };
   }
   const intentDelivery = allowed.has("intent") ? makeIntentDelivery() : void 0;
-  const shell = makeShell();
+  const shell = allowed.has("shell") ? makeShell() : void 0;
+  let gamepad;
   let inc;
   let identity;
   let theme;
@@ -2584,9 +2867,10 @@ function nappletNamespacePrelude(domains) {
     return intent;
   }
   function isProtectedDomain(domain) {
-    return domain === "shell" || domain === "inc" || domain === "identity" || domain === "theme" || domain === "intent";
+    return domain === "gamepad" || domain === "shell" || domain === "inc" || domain === "identity" || domain === "theme" || domain === "intent";
   }
   function makeDomain(domain, existing) {
+    if (domain === "gamepad") return gamepad ??= makeGamepad();
     if (domain === "shell") return shell;
     if (domain === "inc") return makeProtectedInc(existing);
     if (domain === "identity") return makeProtectedIdentity();
@@ -2900,11 +3184,13 @@ export {
   createNotifyProxy,
   createShellBridge,
   createThemeProxy,
+  denyNappletControllerAccess,
   formatDenialReason,
   injectNappletCsp,
   injectNappletNamespacePrelude,
   manifestCache,
   nappKeyRegistry,
+  normalizeIntentUri,
   originRegistry,
   prepareNappletSrcdoc,
   renderNappletCspMeta,