@kehto/shell 0.24.3 → 0.24.5

package/README.md

@@ -27,6 +27,13 @@ source `dc1d24153c759152b6ba31a6ec9bea967798f2df`.
 
 The primary entry point is `createShellBridge()` — it owns the postMessage listener, the NAP-SHELL `shell.ready` / `shell.init` handshake, manifest verification, and every dispatch back into the runtime engine.
 
+ACL persistence uses the browser's `localStorage` key `napplet:acl`. A failed
+write is intentionally reported through `bridge.runtime.aclState.persist()` or
+`clear()` as `false`; the runtime keeps its already-applied live state, while a
+fresh bridge can still load the prior durable policy until the caller retries.
+Only ACL persistence has this result contract: unrelated browser persistence
+adapters retain their documented best-effort behavior.
+
 Current draft behaviors this package enforces:
 
 - The shell does not inject a host-provided nostr object into napplets — NIP-5D explicitly forbids napplet-visible signing. Napplets call `relay.publish` / `relay.publishEncrypted` and the shell mediates the signing flow internally (NIP-44 default, NIP-04 opt-in for encrypted envelopes).
@@ -297,3 +304,19 @@ for outer URL encoding, review, routing, and verified launcher behavior.
 ## GAMEPAD integration
 
 This non-normative guidance defers to the living [NAP-GAMEPAD](https://github.com/napplet/naps/pull/108). Services export `createGamepadService` and `browserGamepadOptions`; shell exports `denyNappletControllerAccess`. Paja and the playground register one host reader and deny native gamepad/HID/USB paths before frame execution. Source-bound subscriptions receive immediate full snapshots; only the visible host's input owner gets live controls. Focus loss supplies neutral controls and timestamp zero; unsubscribe, window destruction, and service removal release polling. Non-browser or denied native readers report the proposal's unavailable reasons. See [Controller input](https://github.com/kehto/web/blob/main/docs/gamepad.md).
+
+## UUID support on HTTP origins
+
+Shell event injection, cache queries, and source-session registration use native
+`crypto.randomUUID()` when available. On browsers that omit it (including
+non-localhost plain HTTP origins), the shell generates UUID v4 identifiers from
+16 `crypto.getRandomValues()` bytes. If both methods are unavailable, UUID
+creation throws an explicit capability error. This internal host UUID helper
+never falls back to weak randomness; other identifier generators are outside
+its scope. It does not provide secure-context APIs such as `crypto.subtle` on
+HTTP, so this change does not establish HTTP support for uploads or other domains.
+
+This is a supported platform capability choice, not a deprecated caller API.
+Both standard Web Crypto paths remain quiet. Source-bound identity and optional
+shell readiness are unchanged (NAP-SHELL at `napplet/naps`
+`1e1046bcadabbc552804f6d3354f565184f9fefb`).

package/dist/index.js

@@ -1,6 +1,20 @@
 // src/shell-bridge.ts
 import { createRuntime } from "@kehto/runtime";
 
+// src/random-uuid.ts
+function randomUUID() {
+  const provider = globalThis.crypto;
+  if (typeof provider?.randomUUID === "function") return provider.randomUUID();
+  if (typeof provider?.getRandomValues !== "function") {
+    throw new Error("@kehto/shell requires crypto.randomUUID or crypto.getRandomValues for UUID generation");
+  }
+  const bytes = provider.getRandomValues(new Uint8Array(16));
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
 // src/hooks-adapter.ts
 function bytesToHex(bytes) {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
@@ -66,7 +80,7 @@ function createCacheAdapter(shellHooks) {
     async query(filters) {
       const workerRelay = shellHooks.workerRelay.getWorkerRelay();
       if (!workerRelay) return [];
-      const subId = crypto.randomUUID();
+      const subId = randomUUID();
       return workerRelay.query(["REQ", subId, ...filters]);
     },
     store(event) {
@@ -113,7 +127,7 @@ function createCryptoAdapter(shellHooks) {
       return shellHooks.crypto.verifyEvent(event);
     },
     randomUUID() {
-      return crypto.randomUUID();
+      return randomUUID();
     },
     randomBytes(length) {
       const bytes = new Uint8Array(length);
@@ -125,10 +139,7 @@ function createCryptoAdapter(shellHooks) {
 function createAclPersistence() {
   return {
     persist(data) {
-      try {
-        localStorage.setItem("napplet:acl", data);
-      } catch {
-      }
+      localStorage.setItem("napplet:acl", data);
     },
     load() {
       try {
@@ -1143,7 +1154,7 @@ function registerNip5dSessionIfNeeded({
     dTag: identity.dTag,
     aggregateHash: identity.aggregateHash,
     registeredAt: Date.now(),
-    instanceId: crypto.randomUUID(),
+    instanceId: randomUUID(),
     provenance: "nip-5d"
   };
   runtime.sessionRegistry.register(windowId, entry);