@napplet/conformance-cli 0.1.0

package/dist/host-bundle.global.js

@@ -0,0 +1,775 @@
+"use strict";
+var NappletConformanceHostBundle = (() => {
+  // ../core/dist/index.js
+  var NAP_DOMAINS = ["relay", "identity", "storage", "inc", "theme", "keys", "media", "notify", "config", "resource", "connect", "class", "cvm", "outbox", "upload", "intent"];
+  function createDispatch() {
+    const handlers = /* @__PURE__ */ new Map();
+    function registerNap2(domain, handler) {
+      if (handlers.has(domain)) {
+        throw new Error(`NAP domain "${domain}" is already registered`);
+      }
+      handlers.set(domain, handler);
+    }
+    function dispatch2(message) {
+      const dotIndex = message.type.indexOf(".");
+      if (dotIndex <= 0) return false;
+      const domain = message.type.slice(0, dotIndex);
+      const handler = handlers.get(domain);
+      if (!handler) return false;
+      handler(message);
+      return true;
+    }
+    function getRegisteredDomains2() {
+      return Array.from(handlers.keys());
+    }
+    return { registerNap: registerNap2, dispatch: dispatch2, getRegisteredDomains: getRegisteredDomains2 };
+  }
+  var _default = createDispatch();
+  var registerNap = _default.registerNap;
+  var dispatch = _default.dispatch;
+  var getRegisteredDomains = _default.getRegisteredDomains;
+
+  // ../nap/dist/chunk-ESA5HG5Q.js
+  var ERR_PREFIX = "[@napplet/nap/connect]";
+  var ACCEPTED_SCHEMES = /* @__PURE__ */ new Set(["https", "wss", "http", "ws"]);
+  var DEFAULT_PORTS = {
+    https: "443",
+    wss: "443",
+    http: "80",
+    ws: "80"
+  };
+  function splitOriginScheme(origin) {
+    const schemeIdx = origin.indexOf("://");
+    if (schemeIdx < 0) {
+      throw new Error(`${ERR_PREFIX} origin missing scheme separator '://': ${origin}`);
+    }
+    const scheme = origin.slice(0, schemeIdx);
+    if (scheme !== scheme.toLowerCase()) {
+      throw new Error(`${ERR_PREFIX} scheme must be lowercase: ${origin}`);
+    }
+    if (!ACCEPTED_SCHEMES.has(scheme)) {
+      throw new Error(`${ERR_PREFIX} scheme must be one of https|wss|http|ws: ${origin}`);
+    }
+    return { scheme, rest: origin.slice(schemeIdx + 3) };
+  }
+  function assertOriginRest(rest, origin) {
+    if (rest.includes("/")) {
+      throw new Error(`${ERR_PREFIX} origin MUST NOT contain a path: ${origin}`);
+    }
+    if (rest.includes("?")) {
+      throw new Error(`${ERR_PREFIX} origin MUST NOT contain a query: ${origin}`);
+    }
+    if (rest.includes("#")) {
+      throw new Error(`${ERR_PREFIX} origin MUST NOT contain a fragment: ${origin}`);
+    }
+    if (rest.includes("*")) {
+      throw new Error(`${ERR_PREFIX} wildcard origins are not permitted: ${origin}`);
+    }
+    if (rest.startsWith("[")) {
+      throw new Error(`${ERR_PREFIX} IPv6 literal origins are out of v1 scope: ${origin}`);
+    }
+  }
+  function parseHost(scheme, rest, origin) {
+    let host = rest;
+    const portColonIdx = rest.lastIndexOf(":");
+    if (portColonIdx >= 0) {
+      host = rest.slice(0, portColonIdx);
+      const port = rest.slice(portColonIdx + 1);
+      if (!/^[0-9]+$/.test(port)) {
+        throw new Error(`${ERR_PREFIX} port must be decimal digits: ${origin}`);
+      }
+      const portNum = Number(port);
+      if (portNum < 1 || portNum > 65535) {
+        throw new Error(`${ERR_PREFIX} port out of range 1-65535: ${origin}`);
+      }
+      if (DEFAULT_PORTS[scheme] === port) {
+        throw new Error(`${ERR_PREFIX} default port ${port} MUST be omitted for scheme ${scheme}: ${origin}`);
+      }
+    }
+    validateHostBase(host, origin);
+    return host;
+  }
+  function validateHostBase(host, origin) {
+    if (host.includes(":")) {
+      throw new Error(`${ERR_PREFIX} IPv6 literal origins are out of v1 scope: ${origin}`);
+    }
+    if (host.length === 0) {
+      throw new Error(`${ERR_PREFIX} host is empty: ${origin}`);
+    }
+    if (host !== host.toLowerCase()) {
+      throw new Error(`${ERR_PREFIX} host MUST be lowercase: ${origin}`);
+    }
+    if (!/^[\x00-\x7F]+$/.test(host)) {
+      throw new Error(`${ERR_PREFIX} non-ASCII host MUST be Punycode-encoded (xn--...) before calling: ${origin}`);
+    }
+  }
+  function validateIpv4Host(host, origin) {
+    if (!/^[0-9]+(\.[0-9]+){3}$/.test(host)) return false;
+    for (const oct of host.split(".")) {
+      if (oct.length > 1 && oct.startsWith("0")) {
+        throw new Error(`${ERR_PREFIX} IPv4 octet MUST NOT have leading zeros: ${origin}`);
+      }
+      const n = Number(oct);
+      if (!Number.isInteger(n) || n < 0 || n > 255) {
+        throw new Error(`${ERR_PREFIX} IPv4 octet out of range 0-255: ${origin}`);
+      }
+    }
+    return true;
+  }
+  function validateDnsHost(host, origin) {
+    for (const label of host.split(".")) {
+      if (label.length === 0 || label.length > 63) {
+        throw new Error(`${ERR_PREFIX} invalid host label length: ${origin}`);
+      }
+      if (!/^[a-z0-9-]+$/.test(label)) {
+        throw new Error(`${ERR_PREFIX} host label contains invalid characters: ${origin}`);
+      }
+      if (label.startsWith("-") || label.endsWith("-")) {
+        throw new Error(`${ERR_PREFIX} host label MUST NOT start or end with hyphen: ${origin}`);
+      }
+    }
+  }
+  function normalizeConnectOrigin(origin) {
+    if (typeof origin !== "string" || origin.length === 0) {
+      throw new Error(`${ERR_PREFIX} origin must be a non-empty string`);
+    }
+    const { scheme, rest } = splitOriginScheme(origin);
+    assertOriginRest(rest, origin);
+    const host = parseHost(scheme, rest, origin);
+    if (!validateIpv4Host(host, origin)) {
+      validateDnsHost(host, origin);
+    }
+    return origin;
+  }
+
+  // ../conformance/dist/index.js
+  var ID = { id: "string" };
+  var ENVELOPE_SPECS = {
+    // ── relay ────────────────────────────────────────────────────────────────
+    "relay.subscribe": { dir: "out", fields: { ...ID, subId: "string", filters: "array" } },
+    "relay.close": { dir: "out", fields: { ...ID, subId: "string" } },
+    "relay.publish": { dir: "out", fields: { ...ID, event: "object" } },
+    "relay.publishEncrypted": { dir: "out", fields: { ...ID, event: "object", recipient: "string" } },
+    "relay.query": { dir: "out", fields: { ...ID, filters: "array" } },
+    "relay.event": { dir: "in" },
+    "relay.eose": { dir: "in" },
+    "relay.closed": { dir: "in" },
+    "relay.publish.result": { dir: "in" },
+    "relay.publishEncrypted.result": { dir: "in" },
+    "relay.query.result": { dir: "in" },
+    // ── identity ─────────────────────────────────────────────────────────────
+    "identity.getPublicKey": { dir: "out", fields: { ...ID } },
+    "identity.getRelays": { dir: "out", fields: { ...ID } },
+    "identity.getProfile": { dir: "out", fields: { ...ID } },
+    "identity.getFollows": { dir: "out", fields: { ...ID } },
+    "identity.getList": { dir: "out", fields: { ...ID, listType: "string" } },
+    "identity.getZaps": { dir: "out", fields: { ...ID } },
+    "identity.getMutes": { dir: "out", fields: { ...ID } },
+    "identity.getBlocked": { dir: "out", fields: { ...ID } },
+    "identity.getBadges": { dir: "out", fields: { ...ID } },
+    "identity.changed": { dir: "in" },
+    "identity.getPublicKey.result": { dir: "in" },
+    "identity.getRelays.result": { dir: "in" },
+    "identity.getProfile.result": { dir: "in" },
+    "identity.getFollows.result": { dir: "in" },
+    "identity.getList.result": { dir: "in" },
+    "identity.getZaps.result": { dir: "in" },
+    "identity.getMutes.result": { dir: "in" },
+    "identity.getBlocked.result": { dir: "in" },
+    "identity.getBadges.result": { dir: "in" },
+    // ── storage ──────────────────────────────────────────────────────────────
+    "storage.get": { dir: "out", fields: { ...ID, key: "string" } },
+    "storage.set": { dir: "out", fields: { ...ID, key: "string", value: "string" } },
+    "storage.remove": { dir: "out", fields: { ...ID, key: "string" } },
+    "storage.keys": { dir: "out", fields: { ...ID } },
+    "storage.get.result": { dir: "in" },
+    "storage.set.result": { dir: "in" },
+    "storage.remove.result": { dir: "in" },
+    "storage.keys.result": { dir: "in" },
+    // ── inc (inter-napplet communication) ─────────────────────────────────────
+    "inc.emit": { dir: "out", fields: { topic: "string" } },
+    "inc.subscribe": { dir: "out", fields: { ...ID, topic: "string" } },
+    "inc.unsubscribe": { dir: "out", fields: { topic: "string" } },
+    "inc.channel.open": { dir: "out", fields: { ...ID, target: "string" } },
+    "inc.channel.emit": { dir: "out", fields: { channelId: "string" } },
+    "inc.channel.broadcast": { dir: "out" },
+    "inc.channel.list": { dir: "out", fields: { ...ID } },
+    "inc.channel.close": { dir: "out", fields: { channelId: "string" } },
+    "inc.subscribe.result": { dir: "in" },
+    "inc.event": { dir: "in" },
+    "inc.channel.open.result": { dir: "in" },
+    "inc.channel.event": { dir: "in" },
+    "inc.channel.list.result": { dir: "in" },
+    "inc.channel.closed": { dir: "in" },
+    // ── theme ────────────────────────────────────────────────────────────────
+    "theme.get": { dir: "out", fields: { ...ID } },
+    "theme.get.result": { dir: "in" },
+    "theme.changed": { dir: "in" },
+    // ── keys ─────────────────────────────────────────────────────────────────
+    "keys.forward": {
+      dir: "out",
+      fields: { key: "string", code: "string", ctrl: "boolean", alt: "boolean", shift: "boolean", meta: "boolean" }
+    },
+    "keys.registerAction": { dir: "out", fields: { ...ID, action: "object" } },
+    "keys.unregisterAction": { dir: "out", fields: { actionId: "string" } },
+    "keys.registerAction.result": { dir: "in" },
+    "keys.bindings": { dir: "in" },
+    "keys.action": { dir: "in" },
+    // ── media ────────────────────────────────────────────────────────────────
+    "media.session.create": { dir: "out", fields: { ...ID, owner: "object" } },
+    "media.session.update": { dir: "out", fields: { sessionId: "string", metadata: "object" } },
+    "media.session.destroy": { dir: "out", fields: { sessionId: "string" } },
+    "media.state": { dir: "out", fields: { sessionId: "string", status: "string" } },
+    "media.capabilities": { dir: "out", fields: { sessionId: "string", actions: "array" } },
+    "media.session.create.result": { dir: "in" },
+    "media.command": { dir: "in" },
+    "media.controls": { dir: "in" },
+    // ── notify ───────────────────────────────────────────────────────────────
+    "notify.send": { dir: "out", fields: { ...ID, title: "string" } },
+    "notify.dismiss": { dir: "out", fields: { notificationId: "string" } },
+    "notify.badge": { dir: "out", fields: { count: "number" } },
+    "notify.channel.register": { dir: "out", fields: { channelId: "string", label: "string" } },
+    "notify.permission.request": { dir: "out", fields: { ...ID } },
+    "notify.send.result": { dir: "in" },
+    "notify.permission.result": { dir: "in" },
+    "notify.action": { dir: "in" },
+    "notify.clicked": { dir: "in" },
+    "notify.dismissed": { dir: "in" },
+    "notify.controls": { dir: "in" },
+    // ── config ───────────────────────────────────────────────────────────────
+    "config.registerSchema": { dir: "out", fields: { ...ID, schema: "object" } },
+    "config.get": { dir: "out", fields: { ...ID } },
+    "config.subscribe": { dir: "out" },
+    "config.unsubscribe": { dir: "out" },
+    "config.openSettings": { dir: "out" },
+    "config.registerSchema.result": { dir: "in" },
+    "config.values": { dir: "in" },
+    "config.schemaError": { dir: "in" },
+    // ── resource ─────────────────────────────────────────────────────────────
+    "resource.bytes": { dir: "out", fields: { ...ID, url: "string" } },
+    "resource.cancel": { dir: "out", fields: { ...ID } },
+    "resource.bytes.result": { dir: "in" },
+    "resource.bytes.error": { dir: "in" },
+    // ── class (shell-initiated only) ─────────────────────────────────────────
+    "class.assigned": { dir: "in" },
+    // ── cvm ──────────────────────────────────────────────────────────────────
+    "cvm.discover": { dir: "out", fields: { ...ID } },
+    "cvm.request": { dir: "out", fields: { ...ID, server: "object", message: "object" } },
+    "cvm.close": { dir: "out", fields: { ...ID, server: "object" } },
+    "cvm.discover.result": { dir: "in" },
+    "cvm.request.result": { dir: "in" },
+    "cvm.close.result": { dir: "in" },
+    "cvm.event": { dir: "in" },
+    // ── outbox ───────────────────────────────────────────────────────────────
+    "outbox.query": { dir: "out", fields: { ...ID, filters: "present" } },
+    "outbox.subscribe": { dir: "out", fields: { ...ID, subId: "string", filters: "present" } },
+    "outbox.close": { dir: "out", fields: { ...ID, subId: "string" } },
+    "outbox.publish": { dir: "out", fields: { ...ID, event: "object" } },
+    "outbox.resolveRelays": { dir: "out", fields: { ...ID, target: "present" } },
+    "outbox.query.result": { dir: "in" },
+    "outbox.event": { dir: "in" },
+    "outbox.eose": { dir: "in" },
+    "outbox.closed": { dir: "in" },
+    "outbox.publish.result": { dir: "in" },
+    "outbox.resolveRelays.result": { dir: "in" },
+    // ── upload ───────────────────────────────────────────────────────────────
+    "upload.upload": { dir: "out", fields: { ...ID, request: "object" } },
+    "upload.status": { dir: "out", fields: { ...ID, uploadId: "string" } },
+    "upload.upload.result": { dir: "in" },
+    "upload.status.result": { dir: "in" },
+    "upload.status.changed": { dir: "in" },
+    // ── intent ───────────────────────────────────────────────────────────────
+    "intent.invoke": { dir: "out", fields: { ...ID, request: "object" } },
+    "intent.available": { dir: "out", fields: { ...ID, archetype: "string" } },
+    "intent.handlers": { dir: "out", fields: { ...ID } },
+    "intent.invoke.result": { dir: "in" },
+    "intent.available.result": { dir: "in" },
+    "intent.handlers.result": { dir: "in" },
+    "intent.changed": { dir: "in" }
+  };
+  function kindOf(value) {
+    if (value === void 0) return "undefined";
+    if (value === null) return "null";
+    if (Array.isArray(value)) return "array";
+    const t = typeof value;
+    if (t === "string" || t === "number" || t === "boolean") return t;
+    if (t === "object") return "object";
+    return "present";
+  }
+  function matchesKind(value, kind) {
+    if (kind === "present") return value !== void 0 && value !== null;
+    return kindOf(value) === kind;
+  }
+  function validateEnvelope(message) {
+    const errors = [];
+    if (typeof message !== "object" || message === null || Array.isArray(message)) {
+      return { ok: false, errors: [{ code: "not-an-object", message: "Envelope must be a non-null object" }] };
+    }
+    const record = message;
+    const type = record["type"];
+    if (typeof type !== "string") {
+      return { ok: false, errors: [{ code: "missing-type", message: "Envelope is missing a string `type` field" }] };
+    }
+    const dotIndex = type.indexOf(".");
+    if (dotIndex <= 0) {
+      return { ok: false, type, errors: [{ code: "malformed-type", message: `Envelope type "${type}" is not in domain.action form` }] };
+    }
+    const domain = type.slice(0, dotIndex);
+    if (!NAP_DOMAINS.includes(domain)) {
+      return { ok: false, type, domain, errors: [{ code: "unknown-domain", message: `"${domain}" is not a known NAP domain` }] };
+    }
+    const spec = ENVELOPE_SPECS[type];
+    if (!spec) {
+      return { ok: false, type, domain, errors: [{ code: "unknown-type", message: `"${type}" is not a known ${domain} message type` }] };
+    }
+    if (spec.dir === "in") {
+      return {
+        ok: false,
+        type,
+        domain,
+        direction: "in",
+        errors: [{ code: "inbound-type-emitted", message: `"${type}" is a shell\u2192napplet message; a napplet must not emit it` }]
+      };
+    }
+    for (const [field, kind] of Object.entries(spec.fields ?? {})) {
+      if (!(field in record) || record[field] === void 0) {
+        errors.push({ code: "missing-field", message: `Required field "${field}" is missing`, field });
+        continue;
+      }
+      if (!matchesKind(record[field], kind)) {
+        errors.push({
+          code: "wrong-type",
+          message: `Field "${field}" should be ${kind} but is ${kindOf(record[field])}`,
+          field
+        });
+      }
+    }
+    return { ok: errors.length === 0, type, domain, direction: "out", errors };
+  }
+  var NAPPLET_TYPE_RE = /^[a-z0-9][a-z0-9._:-]*$/;
+  var AGGREGATE_HASH_RE = /^[0-9a-f]{64}$/;
+  var NON_EXECUTING_SCRIPT_TYPES = /* @__PURE__ */ new Set([
+    "application/json",
+    "application/ld+json",
+    "importmap",
+    "speculationrules"
+  ]);
+  function readMeta(html, name) {
+    const tagRe = /<meta\b[^>]*>/gi;
+    let tag;
+    while ((tag = tagRe.exec(html)) !== null) {
+      const block = tag[0];
+      const nameMatch = /\bname\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(block);
+      const metaName = (nameMatch?.[1] ?? nameMatch?.[2] ?? "").trim();
+      if (metaName !== name) continue;
+      const contentMatch = /\bcontent\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(block);
+      return (contentMatch?.[1] ?? contentMatch?.[2] ?? "").trim();
+    }
+    return void 0;
+  }
+  function findInlineScripts(html) {
+    const stripped = html.replace(/<!--[\s\S]*?-->/g, "");
+    const scriptTagRe = /<script\b([\s\S]*?)>/gi;
+    const offenders = [];
+    let m;
+    while ((m = scriptTagRe.exec(stripped)) !== null) {
+      const tag = m[0];
+      const attrs = m[1] ?? "";
+      const srcMatch = /\bsrc\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(attrs);
+      if (srcMatch) {
+        const srcValue = (srcMatch[1] ?? srcMatch[2] ?? "").trim();
+        if (srcValue.length > 0) continue;
+        offenders.push(tag);
+        continue;
+      }
+      const typeMatch = /\btype\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(attrs);
+      const typeValue = (typeMatch?.[1] ?? typeMatch?.[2] ?? "").trim().toLowerCase();
+      if (typeValue && NON_EXECUTING_SCRIPT_TYPES.has(typeValue)) continue;
+      offenders.push(tag);
+    }
+    return offenders;
+  }
+  function usesPatternKeyword(node) {
+    if (Array.isArray(node)) return node.some(usesPatternKeyword);
+    if (node && typeof node === "object") {
+      const record = node;
+      if ("pattern" in record) return true;
+      return Object.values(record).some(usesPatternKeyword);
+    }
+    return false;
+  }
+  function validateManifest(html, options = {}) {
+    const requireAggregateHash = options.requireAggregateHash ?? true;
+    const errors = [];
+    const warnings = [];
+    const nappletType = readMeta(html, "napplet-type");
+    if (!nappletType) {
+      errors.push({ code: "missing-napplet-type", message: 'No <meta name="napplet-type"> declared' });
+    } else if (!NAPPLET_TYPE_RE.test(nappletType)) {
+      errors.push({ code: "invalid-napplet-type", message: `napplet-type "${nappletType}" must match ${NAPPLET_TYPE_RE}` });
+    }
+    const aggregateHash = readMeta(html, "napplet-aggregate-hash");
+    if (!aggregateHash) {
+      if (requireAggregateHash) {
+        errors.push({ code: "missing-aggregate-hash", message: 'No <meta name="napplet-aggregate-hash"> \u2014 the build plugin injects it; build before testing' });
+      }
+    } else if (!AGGREGATE_HASH_RE.test(aggregateHash)) {
+      errors.push({ code: "invalid-aggregate-hash", message: `napplet-aggregate-hash "${aggregateHash}" is not a 64-char lowercase hex digest` });
+    }
+    const requiresRaw = readMeta(html, "napplet-requires");
+    const requires = requiresRaw ? requiresRaw.split(",").map((s) => s.trim()).filter(Boolean) : [];
+    for (const req of requires) {
+      const domain = req.startsWith("nap:") ? req.slice("nap:".length) : req;
+      if (!NAP_DOMAINS.includes(domain)) {
+        errors.push({ code: "unknown-required-nap", message: `napplet-requires lists "${req}" which is not a known NAP domain` });
+      }
+    }
+    const configSchemaRaw = readMeta(html, "napplet-config-schema");
+    if (configSchemaRaw) {
+      let parsed;
+      try {
+        parsed = JSON.parse(configSchemaRaw);
+      } catch {
+        parsed = void 0;
+        errors.push({ code: "invalid-config-schema", message: "napplet-config-schema is not valid JSON" });
+      }
+      if (parsed !== void 0) {
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+          errors.push({ code: "invalid-config-schema", message: "napplet-config-schema must be a JSON Schema object" });
+        } else if (usesPatternKeyword(parsed)) {
+          errors.push({ code: "invalid-config-schema", message: "napplet-config-schema uses the `pattern` keyword, which the draft-07 core subset excludes (CVE-2025-69873)" });
+        }
+      }
+    }
+    const connectRaw = readMeta(html, "napplet-connect-requires");
+    const connectTokens = connectRaw ? connectRaw.split(/\s+/).map((s) => s.trim()).filter(Boolean) : [];
+    const connectOrigins = [];
+    for (const origin of connectTokens) {
+      try {
+        connectOrigins.push(normalizeConnectOrigin(origin));
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        errors.push({ code: "invalid-connect-origin", message: `connect origin "${origin}" is invalid: ${reason}` });
+      }
+    }
+    for (const offender of findInlineScripts(html)) {
+      errors.push({ code: "inline-script", message: `Inline <script> is forbidden under script-src 'self': ${offender}` });
+    }
+    return {
+      ok: errors.length === 0,
+      nappletType,
+      aggregateHash,
+      requires,
+      connectOrigins,
+      errors,
+      warnings
+    };
+  }
+  var REFERENCE_PUBKEY = "f".repeat(64);
+  var REFERENCE_BLOB_URL = "https://reference.invalid/blob";
+  var ok = (v) => [v];
+  var none = () => [];
+  var RESPONDERS = {
+    // relay
+    "relay.subscribe": (e) => ok({ type: "relay.eose", subId: e.subId }),
+    "relay.close": none,
+    "relay.publish": (e) => ok({ type: "relay.publish.result", id: e.id, ok: true, event: e.event }),
+    "relay.publishEncrypted": (e) => ok({ type: "relay.publishEncrypted.result", id: e.id, ok: true, event: e.event }),
+    "relay.query": (e) => ok({ type: "relay.query.result", id: e.id, events: [] }),
+    // identity
+    "identity.getPublicKey": (e) => ok({ type: "identity.getPublicKey.result", id: e.id, pubkey: REFERENCE_PUBKEY }),
+    "identity.getRelays": (e) => ok({ type: "identity.getRelays.result", id: e.id, relays: {} }),
+    "identity.getProfile": (e) => ok({ type: "identity.getProfile.result", id: e.id, profile: null }),
+    "identity.getFollows": (e) => ok({ type: "identity.getFollows.result", id: e.id, pubkeys: [] }),
+    "identity.getList": (e) => ok({ type: "identity.getList.result", id: e.id, entries: [] }),
+    "identity.getZaps": (e) => ok({ type: "identity.getZaps.result", id: e.id, zaps: [] }),
+    "identity.getMutes": (e) => ok({ type: "identity.getMutes.result", id: e.id, pubkeys: [] }),
+    "identity.getBlocked": (e) => ok({ type: "identity.getBlocked.result", id: e.id, pubkeys: [] }),
+    "identity.getBadges": (e) => ok({ type: "identity.getBadges.result", id: e.id, badges: [] }),
+    // storage
+    "storage.get": (e) => ok({ type: "storage.get.result", id: e.id, value: null }),
+    "storage.set": (e) => ok({ type: "storage.set.result", id: e.id }),
+    "storage.remove": (e) => ok({ type: "storage.remove.result", id: e.id }),
+    "storage.keys": (e) => ok({ type: "storage.keys.result", id: e.id, keys: [] }),
+    // inc
+    "inc.emit": none,
+    "inc.subscribe": (e) => ok({ type: "inc.subscribe.result", id: e.id }),
+    "inc.unsubscribe": none,
+    "inc.channel.open": (e) => ok({ type: "inc.channel.open.result", id: e.id, channelId: `chan-${String(e.id)}`, peer: "reference-peer" }),
+    "inc.channel.emit": none,
+    "inc.channel.broadcast": none,
+    "inc.channel.list": (e) => ok({ type: "inc.channel.list.result", id: e.id, channels: [] }),
+    "inc.channel.close": none,
+    // theme
+    "theme.get": (e) => ok({ type: "theme.get.result", id: e.id, theme: { colors: {}, mode: "dark" } }),
+    // keys
+    "keys.forward": none,
+    "keys.registerAction": (e) => ok({ type: "keys.registerAction.result", id: e.id, actionId: `action-${String(e.id)}` }),
+    "keys.unregisterAction": none,
+    // media
+    "media.session.create": (e) => ok({ type: "media.session.create.result", id: e.id, sessionId: `session-${String(e.id)}`, owner: e.owner }),
+    "media.session.update": none,
+    "media.session.destroy": none,
+    "media.state": none,
+    "media.capabilities": none,
+    // notify
+    "notify.send": (e) => ok({ type: "notify.send.result", id: e.id, notificationId: `notif-${String(e.id)}` }),
+    "notify.dismiss": none,
+    "notify.badge": none,
+    "notify.channel.register": none,
+    "notify.permission.request": (e) => ok({ type: "notify.permission.result", id: e.id, granted: true }),
+    // config
+    "config.registerSchema": (e) => ok({ type: "config.registerSchema.result", id: e.id, ok: true }),
+    "config.get": (e) => ok({ type: "config.values", id: e.id, values: {} }),
+    "config.subscribe": () => ok({ type: "config.values", values: {} }),
+    "config.unsubscribe": none,
+    "config.openSettings": none,
+    // resource
+    "resource.bytes": (e) => ok({ type: "resource.bytes.result", id: e.id, blob: new Blob([]), mime: "application/octet-stream" }),
+    "resource.cancel": none,
+    // cvm
+    "cvm.discover": (e) => ok({ type: "cvm.discover.result", id: e.id, servers: [] }),
+    "cvm.request": (e) => ok({ type: "cvm.request.result", id: e.id, message: {} }),
+    "cvm.close": (e) => ok({ type: "cvm.close.result", id: e.id }),
+    // outbox
+    "outbox.query": (e) => ok({ type: "outbox.query.result", id: e.id, events: [], relays: {} }),
+    "outbox.subscribe": (e) => ok({ type: "outbox.eose", subId: e.subId }),
+    "outbox.close": none,
+    "outbox.publish": (e) => ok({ type: "outbox.publish.result", id: e.id, ok: true }),
+    "outbox.resolveRelays": (e) => ok({ type: "outbox.resolveRelays.result", id: e.id, plan: {} }),
+    // upload
+    "upload.upload": (e) => ok({ type: "upload.upload.result", id: e.id, result: { url: REFERENCE_BLOB_URL } }),
+    "upload.status": (e) => ok({ type: "upload.status.result", id: e.id, status: {} }),
+    // intent
+    "intent.invoke": (e) => ok({ type: "intent.invoke.result", id: e.id, result: {} }),
+    "intent.available": (e) => ok({ type: "intent.available.result", id: e.id, availability: {} }),
+    "intent.handlers": (e) => ok({ type: "intent.handlers.result", id: e.id, handlers: [] })
+  };
+  function createReferenceShell(options = {}) {
+    const now = options.now ?? (() => Date.now());
+    const capabilities = {
+      naps: options.capabilities?.naps ?? [...NAP_DOMAINS],
+      sandbox: options.capabilities?.sandbox ?? []
+    };
+    const records = [];
+    function handle(envelope) {
+      const type = envelope && typeof envelope === "object" && typeof envelope.type === "string" ? envelope.type : void 0;
+      if (type === "shell.ready") {
+        return [{ type: "shell.init", capabilities: { naps: capabilities.naps, sandbox: capabilities.sandbox } }];
+      }
+      records.push({ envelope, verdict: validateEnvelope(envelope), timestamp: now() });
+      if (!type) return [];
+      const responder = RESPONDERS[type];
+      return responder ? responder(envelope) : [];
+    }
+    return {
+      capabilities,
+      get records() {
+        return records;
+      },
+      handle,
+      reset() {
+        records.length = 0;
+      }
+    };
+  }
+  function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+  async function bootOnce(caps, opts, doc, win) {
+    const shell = createReferenceShell(caps ? { capabilities: caps } : void 0);
+    const iframe = doc.createElement("iframe");
+    iframe.setAttribute("sandbox", opts.allowSameOrigin ? "allow-scripts allow-same-origin" : "allow-scripts");
+    iframe.setAttribute("aria-hidden", "true");
+    iframe.style.position = "absolute";
+    iframe.style.width = "1px";
+    iframe.style.height = "1px";
+    iframe.style.left = "-9999px";
+    let resolveReady;
+    const readyPromise = new Promise((resolve) => {
+      resolveReady = resolve;
+    });
+    const listener = (event) => {
+      if (event.source !== iframe.contentWindow) return;
+      const responses = shell.handle(event.data);
+      const source = event.source;
+      for (const response of responses) source?.postMessage(response, "*");
+      const data = event.data;
+      if (data && typeof data === "object" && data.type === "shell.ready") resolveReady();
+    };
+    win.addEventListener("message", listener);
+    (doc.body ?? doc.documentElement).appendChild(iframe);
+    iframe.setAttribute("src", opts.url);
+    let installedGlobal = false;
+    let bootError = null;
+    const timedOut = /* @__PURE__ */ Symbol("timeout");
+    const race = await Promise.race([readyPromise.then(() => "ready"), sleep(opts.readyTimeoutMs).then(() => timedOut)]);
+    if (race === timedOut) {
+      bootError = `napplet did not boot (no shell.ready within ${opts.readyTimeoutMs}ms; a conformant napplet must run under sandbox="allow-scripts" without allow-same-origin)`;
+    } else {
+      installedGlobal = true;
+      await sleep(opts.settleMs);
+    }
+    win.removeEventListener("message", listener);
+    try {
+      iframe.remove();
+    } catch {
+    }
+    return { installedGlobal, bootError, emitted: [...shell.records] };
+  }
+  async function bootAndCollect(options) {
+    const doc = options.document ?? document;
+    const win = options.window ?? window;
+    const resolved = {
+      url: options.url,
+      readyTimeoutMs: options.readyTimeoutMs ?? 5e3,
+      settleMs: options.settleMs ?? 600,
+      allowSameOrigin: options.allowSameOrigin ?? false
+    };
+    const primary = await bootOnce(void 0, resolved, doc, win);
+    let degraded = null;
+    if (options.runDegraded ?? true) {
+      const d = await bootOnce({ naps: [], sandbox: [] }, resolved, doc, win);
+      degraded = { bootError: d.bootError, emitted: d.emitted };
+    }
+    return {
+      installedGlobal: primary.installedGlobal,
+      bootError: primary.bootError,
+      emitted: primary.emitted,
+      degraded
+    };
+  }
+  var pass = (detail) => ({ status: "pass", detail });
+  var fail = (detail, diagnostics) => ({ status: "fail", detail, diagnostics });
+  var skip = (detail) => ({ status: "skip", detail });
+  var result = { pass, fail, skip };
+  function manifestErrors(html, codes) {
+    return validateManifest(html).errors.filter((e) => codes.includes(e.code));
+  }
+  function hasMeta(html, name) {
+    return new RegExp(`name\\s*=\\s*["']${name}["']`, "i").test(html);
+  }
+  function manifestCheck(id, title, codes, skipMeta) {
+    return {
+      id,
+      area: "manifest",
+      severity: "error",
+      title,
+      run: (ctx) => {
+        if (skipMeta && !hasMeta(ctx.manifestHtml, skipMeta)) return result.skip(`No ${skipMeta} declared`);
+        const errs = manifestErrors(ctx.manifestHtml, codes);
+        return errs.length ? result.fail(errs[0].message, errs) : result.pass();
+      }
+    };
+  }
+  var CHECKS = [
+    // ── manifest ───────────────────────────────────────────────────────────────
+    manifestCheck("manifest/napplet-type", "Declares a valid napplet-type", ["missing-napplet-type", "invalid-napplet-type"]),
+    manifestCheck("manifest/aggregate-hash", "Build injected a valid aggregate hash", ["missing-aggregate-hash", "invalid-aggregate-hash"]),
+    manifestCheck("manifest/declared-naps", "napplet-requires lists only real NAP domains", ["unknown-required-nap"], "napplet-requires"),
+    manifestCheck("manifest/config-schema", "Config schema is a draft-07 core subset", ["invalid-config-schema"], "napplet-config-schema"),
+    manifestCheck("manifest/connect-origins", "Declared connect origins are valid", ["invalid-connect-origin"], "napplet-connect-requires"),
+    {
+      id: "manifest/no-inline-scripts",
+      area: "manifest",
+      severity: "error",
+      title: "No inline <script> (incompatible with script-src 'self')",
+      run: (ctx) => {
+        const errs = manifestErrors(ctx.manifestHtml, ["inline-script"]);
+        return errs.length ? result.fail(`${errs.length} inline script(s) found`, errs) : result.pass();
+      }
+    },
+    // ── boot ─────────────────────────────────────────────────────────────────────
+    {
+      id: "boot/sandbox-allow-scripts",
+      area: "boot",
+      severity: "error",
+      title: "Runs under allow-scripts without allow-same-origin",
+      run: (ctx) => {
+        if (!ctx.sandbox.allowScripts) return result.fail("Napplet was not loaded with allow-scripts");
+        if (ctx.sandbox.allowSameOrigin) return result.fail("Napplet relied on allow-same-origin, which a shell must not grant");
+        return result.pass();
+      }
+    },
+    {
+      id: "boot/installs-global",
+      area: "boot",
+      severity: "error",
+      title: "Installs window.napplet",
+      run: (ctx) => ctx.installedGlobal ? result.pass() : result.fail("window.napplet was not present after load")
+    },
+    {
+      id: "boot/no-boot-error",
+      area: "boot",
+      severity: "error",
+      title: "Boots without an uncaught error",
+      run: (ctx) => ctx.bootError ? result.fail(ctx.bootError) : result.pass()
+    },
+    {
+      id: "boot/no-forbidden-globals",
+      area: "boot",
+      severity: "error",
+      title: "Does not access forbidden globals (e.g. window.nostr)",
+      run: (ctx) => ctx.forbiddenGlobals.length ? result.fail(`Accessed forbidden global(s): ${ctx.forbiddenGlobals.join(", ")}`, ctx.forbiddenGlobals) : result.pass()
+    },
+    // ── wire ─────────────────────────────────────────────────────────────────────
+    {
+      id: "wire/envelope-well-formed",
+      area: "wire",
+      severity: "error",
+      title: "Every emitted envelope is well-formed",
+      run: (ctx) => {
+        if (ctx.emitted.length === 0) return result.skip("Napplet emitted no envelopes");
+        const bad = ctx.emitted.filter((r) => !r.verdict.ok);
+        if (bad.length === 0) return result.pass(`${ctx.emitted.length} envelope(s) valid`);
+        const diag = bad.map((r) => ({ envelope: r.envelope, errors: r.verdict.errors }));
+        return result.fail(`${bad.length}/${ctx.emitted.length} emitted envelope(s) invalid`, diag);
+      }
+    },
+    {
+      id: "wire/declared-naps-only",
+      area: "wire",
+      severity: "warning",
+      title: "Only emits NAP domains it declared in napplet-requires",
+      run: (ctx) => {
+        if (ctx.emitted.length === 0) return result.skip("Napplet emitted no envelopes");
+        if (!hasMeta(ctx.manifestHtml, "napplet-requires")) return result.skip("No napplet-requires to compare against");
+        const declared = new Set(validateManifest(ctx.manifestHtml).requires.map((r) => r.startsWith("nap:") ? r.slice(4) : r));
+        const used = new Set(
+          ctx.emitted.map((r) => r.verdict.domain).filter((d) => typeof d === "string")
+        );
+        const undeclared = [...used].filter((d) => !declared.has(d));
+        return undeclared.length ? result.fail(`Emitted undeclared NAP domain(s): ${undeclared.join(", ")}`, undeclared) : result.pass();
+      }
+    },
+    // ── degradation ───────────────────────────────────────────────────────────────
+    {
+      id: "degrade/supports-false",
+      area: "degradation",
+      severity: "error",
+      title: "Does not crash when shell.supports() is false",
+      run: (ctx) => {
+        if (!ctx.degraded) return result.skip("Host did not run the degraded (no-capabilities) pass");
+        return ctx.degraded.bootError ? result.fail(`Crashed under a no-capability shell: ${ctx.degraded.bootError}`) : result.pass();
+      }
+    },
+    // ── lifecycle ─────────────────────────────────────────────────────────────────
+    {
+      id: "lifecycle/clean-teardown",
+      area: "lifecycle",
+      severity: "warning",
+      title: "Tears down listeners on unload",
+      run: (ctx) => {
+        if (!ctx.lifecycle) return result.skip("Lifecycle not measured");
+        return ctx.lifecycle.listenerLeak ? result.fail("Message listeners remained after unload") : result.pass();
+      }
+    }
+  ];
+
+  // src/host-entry.ts
+  window.NappletConformanceHost = {
+    run(opts) {
+      return bootAndCollect(opts);
+    }
+  };
+})();