@napplet/conformance-cli 0.1.0

package/dist/ui/assets/index-D4WUxbBl.css

@@ -0,0 +1 @@
+:root{--bg: #150a22;--panel: #1e1230;--ink: #ece6f5;--muted: #a896c4;--line: #34244a;--pass: #46c98b;--fail: #ff6b81;--skip: #6b7a90;--warn: #f5b95b;--accent: #9d7bff;font-family:ui-sans-serif,system-ui,-apple-system,Segoe UI,Roboto,sans-serif}*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink);line-height:1.5}#app{max-width:980px;margin:0 auto;padding:2rem 1.25rem 4rem}.masthead h1{margin:0 0 .25rem;font-size:1.6rem}.masthead p{margin:0;color:var(--muted)}code{background:#9d7bff1f;padding:.05em .35em;border-radius:4px}.runbar{display:flex;gap:.5rem;margin:1.5rem 0 .5rem}.runbar input{flex:1;padding:.65rem .8rem;border-radius:8px;border:1px solid var(--line);background:var(--panel);color:var(--ink);font-size:.95rem}.runbar button{padding:.65rem 1.1rem;border:none;border-radius:8px;cursor:pointer;background:var(--accent);color:#150a22;font-weight:600}.runbar button:disabled{opacity:.6;cursor:progress}.runbar button.secondary{background:transparent;color:var(--accent);border:1px solid var(--line)}.live-badge{font-size:.7rem;font-weight:600;vertical-align:middle;margin-left:.5rem;padding:.1rem .5rem;border-radius:999px;border:1px solid var(--line);color:var(--warn)}.live-badge[data-state=connected]{color:var(--pass);border-color:var(--pass)}.live-badge[data-state=disconnected]{color:var(--fail);border-color:var(--fail)}.run-stamp{margin-left:auto;color:var(--muted);font-size:.78rem;font-variant-numeric:tabular-nums}.status{min-height:1.4rem;color:var(--muted);margin:.25rem 0 0}.status[data-kind=error]{color:var(--fail)}.verdict{display:flex;align-items:center;gap:1rem;margin:1.5rem 0 1rem;padding:.85rem 1rem;border-radius:10px;border:1px solid var(--line)}.verdict.conformant{border-color:var(--pass)}.verdict.non-conformant{border-color:var(--fail)}.verdict .result{font-weight:700;letter-spacing:.04em}.verdict.conformant .result{color:var(--pass)}.verdict.non-conformant .result{color:var(--fail)}.verdict .counts{color:var(--muted);font-size:.9rem}.area{margin-bottom:1rem}.area h3{margin:.5rem 0 .35rem;font-size:.8rem;text-transform:uppercase;letter-spacing:.08em;color:var(--muted)}.area ul{list-style:none;margin:0;padding:0}.check{display:flex;align-items:center;gap:.6rem;padding:.35rem 0;border-bottom:1px solid var(--line);flex-wrap:wrap}.badge{font-size:.68rem;font-weight:700;padding:.1rem .45rem;border-radius:999px;text-transform:uppercase}.badge.pass{background:#46c98b2e;color:var(--pass)}.badge.fail{background:#ff6b812e;color:var(--fail)}.badge.skip{background:#6b7a902e;color:var(--skip)}.check .id{font-family:ui-monospace,monospace;font-size:.88rem}.check .detail{color:var(--muted);font-size:.82rem}.tag.warn{background:#f5b95b2e;color:var(--warn);font-size:.66rem;padding:.05rem .4rem;border-radius:999px}.panels{display:grid;grid-template-columns:1fr 1fr;gap:1rem;margin-top:1.5rem}@media(max-width:760px){.panels{grid-template-columns:1fr}}.panel{background:var(--panel);border:1px solid var(--line);border-radius:10px;padding:.9rem 1rem}.panel h2{margin:0 0 .6rem;font-size:.95rem}.empty{color:var(--muted);font-size:.88rem}.envlog{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:.4rem}.env{padding:.4rem .5rem;border-radius:6px;border-left:3px solid var(--line);background:#ffffff05}.env code{display:block;word-break:break-all;background:none;font-size:.8rem}.env.ok{border-left-color:var(--pass)}.env.bad{border-left-color:var(--fail)}.errs{color:var(--fail);font-size:.78rem;margin-top:.3rem;font-family:ui-monospace,monospace}.manifest{width:100%;border-collapse:collapse;font-size:.85rem}.manifest th{text-align:left;color:var(--muted);font-weight:500;padding:.25rem .5rem .25rem 0;white-space:nowrap;vertical-align:top}.manifest td{font-family:ui-monospace,monospace;word-break:break-all;padding:.25rem 0}

package/dist/ui/assets/index-iVwcmekY.js

@@ -0,0 +1,34 @@
+(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const n of document.querySelectorAll('link[rel="modulepreload"]'))i(n);new MutationObserver(n=>{for(const r of n)if(r.type==="childList")for(const a of r.addedNodes)a.tagName==="LINK"&&a.rel==="modulepreload"&&i(a)}).observe(document,{childList:!0,subtree:!0});function s(n){const r={};return n.integrity&&(r.integrity=n.integrity),n.referrerPolicy&&(r.referrerPolicy=n.referrerPolicy),n.crossOrigin==="use-credentials"?r.credentials="include":n.crossOrigin==="anonymous"?r.credentials="omit":r.credentials="same-origin",r}function i(n){if(n.ep)return;n.ep=!0;const r=s(n);fetch(n.href,r)}})();var j=["relay","identity","storage","inc","theme","keys","media","notify","config","resource","connect","class","cvm","outbox","upload","intent"],f="[@napplet/nap/connect]",K=new Set(["https","wss","http","ws"]),W={https:"443",wss:"443",http:"80",ws:"80"};function z(e){const t=e.indexOf("://");if(t<0)throw new Error(`${f} origin missing scheme separator '://': ${e}`);const s=e.slice(0,t);if(s!==s.toLowerCase())throw new Error(`${f} scheme must be lowercase: ${e}`);if(!K.has(s))throw new Error(`${f} scheme must be one of https|wss|http|ws: ${e}`);return{scheme:s,rest:e.slice(t+3)}}function V(e,t){if(e.includes("/"))throw new Error(`${f} origin MUST NOT contain a path: ${t}`);if(e.includes("?"))throw new Error(`${f} origin MUST NOT contain a query: ${t}`);if(e.includes("#"))throw new Error(`${f} origin MUST NOT contain a fragment: ${t}`);if(e.includes("*"))throw new Error(`${f} wildcard origins are not permitted: ${t}`);if(e.startsWith("["))throw new Error(`${f} IPv6 literal origins are out of v1 scope: ${t}`)}function J(e,t,s){let i=t;const n=t.lastIndexOf(":");if(n>=0){i=t.slice(0,n);const r=t.slice(n+1);if(!/^[0-9]+$/.test(r))throw new Error(`${f} port must be decimal digits: ${s}`);const a=Number(r);if(a<1||a>65535)throw new Error(`${f} port out of range 1-65535: ${s}`);if(W[e]===r)throw new Error(`${f} default port ${r} MUST be omitted for scheme ${e}: ${s}`)}return Z(i,s),i}function Z(e,t){if(e.includes(":"))throw new Error(`${f} IPv6 literal origins are out of v1 scope: ${t}`);if(e.length===0)throw new Error(`${f} host is empty: ${t}`);if(e!==e.toLowerCase())throw new Error(`${f} host MUST be lowercase: ${t}`);if(!/^[\x00-\x7F]+$/.test(e))throw new Error(`${f} non-ASCII host MUST be Punycode-encoded (xn--...) before calling: ${t}`)}function Y(e,t){if(!/^[0-9]+(\.[0-9]+){3}$/.test(e))return!1;for(const s of e.split(".")){if(s.length>1&&s.startsWith("0"))throw new Error(`${f} IPv4 octet MUST NOT have leading zeros: ${t}`);const i=Number(s);if(!Number.isInteger(i)||i<0||i>255)throw new Error(`${f} IPv4 octet out of range 0-255: ${t}`)}return!0}function X(e,t){for(const s of e.split(".")){if(s.length===0||s.length>63)throw new Error(`${f} invalid host label length: ${t}`);if(!/^[a-z0-9-]+$/.test(s))throw new Error(`${f} host label contains invalid characters: ${t}`);if(s.startsWith("-")||s.endsWith("-"))throw new Error(`${f} host label MUST NOT start or end with hyphen: ${t}`)}}function Q(e){if(typeof e!="string"||e.length===0)throw new Error(`${f} origin must be a non-empty string`);const{scheme:t,rest:s}=z(e);V(s,e);const i=J(t,s,e);return Y(i,e)||X(i,e),e}var o={id:"string"},ee={"relay.subscribe":{dir:"out",fields:{...o,subId:"string",filters:"array"}},"relay.close":{dir:"out",fields:{...o,subId:"string"}},"relay.publish":{dir:"out",fields:{...o,event:"object"}},"relay.publishEncrypted":{dir:"out",fields:{...o,event:"object",recipient:"string"}},"relay.query":{dir:"out",fields:{...o,filters:"array"}},"relay.event":{dir:"in"},"relay.eose":{dir:"in"},"relay.closed":{dir:"in"},"relay.publish.result":{dir:"in"},"relay.publishEncrypted.result":{dir:"in"},"relay.query.result":{dir:"in"},"identity.getPublicKey":{dir:"out",fields:{...o}},"identity.getRelays":{dir:"out",fields:{...o}},"identity.getProfile":{dir:"out",fields:{...o}},"identity.getFollows":{dir:"out",fields:{...o}},"identity.getList":{dir:"out",fields:{...o,listType:"string"}},"identity.getZaps":{dir:"out",fields:{...o}},"identity.getMutes":{dir:"out",fields:{...o}},"identity.getBlocked":{dir:"out",fields:{...o}},"identity.getBadges":{dir:"out",fields:{...o}},"identity.changed":{dir:"in"},"identity.getPublicKey.result":{dir:"in"},"identity.getRelays.result":{dir:"in"},"identity.getProfile.result":{dir:"in"},"identity.getFollows.result":{dir:"in"},"identity.getList.result":{dir:"in"},"identity.getZaps.result":{dir:"in"},"identity.getMutes.result":{dir:"in"},"identity.getBlocked.result":{dir:"in"},"identity.getBadges.result":{dir:"in"},"storage.get":{dir:"out",fields:{...o,key:"string"}},"storage.set":{dir:"out",fields:{...o,key:"string",value:"string"}},"storage.remove":{dir:"out",fields:{...o,key:"string"}},"storage.keys":{dir:"out",fields:{...o}},"storage.get.result":{dir:"in"},"storage.set.result":{dir:"in"},"storage.remove.result":{dir:"in"},"storage.keys.result":{dir:"in"},"inc.emit":{dir:"out",fields:{topic:"string"}},"inc.subscribe":{dir:"out",fields:{...o,topic:"string"}},"inc.unsubscribe":{dir:"out",fields:{topic:"string"}},"inc.channel.open":{dir:"out",fields:{...o,target:"string"}},"inc.channel.emit":{dir:"out",fields:{channelId:"string"}},"inc.channel.broadcast":{dir:"out"},"inc.channel.list":{dir:"out",fields:{...o}},"inc.channel.close":{dir:"out",fields:{channelId:"string"}},"inc.subscribe.result":{dir:"in"},"inc.event":{dir:"in"},"inc.channel.open.result":{dir:"in"},"inc.channel.event":{dir:"in"},"inc.channel.list.result":{dir:"in"},"inc.channel.closed":{dir:"in"},"theme.get":{dir:"out",fields:{...o}},"theme.get.result":{dir:"in"},"theme.changed":{dir:"in"},"keys.forward":{dir:"out",fields:{key:"string",code:"string",ctrl:"boolean",alt:"boolean",shift:"boolean",meta:"boolean"}},"keys.registerAction":{dir:"out",fields:{...o,action:"object"}},"keys.unregisterAction":{dir:"out",fields:{actionId:"string"}},"keys.registerAction.result":{dir:"in"},"keys.bindings":{dir:"in"},"keys.action":{dir:"in"},"media.session.create":{dir:"out",fields:{...o,owner:"object"}},"media.session.update":{dir:"out",fields:{sessionId:"string",metadata:"object"}},"media.session.destroy":{dir:"out",fields:{sessionId:"string"}},"media.state":{dir:"out",fields:{sessionId:"string",status:"string"}},"media.capabilities":{dir:"out",fields:{sessionId:"string",actions:"array"}},"media.session.create.result":{dir:"in"},"media.command":{dir:"in"},"media.controls":{dir:"in"},"notify.send":{dir:"out",fields:{...o,title:"string"}},"notify.dismiss":{dir:"out",fields:{notificationId:"string"}},"notify.badge":{dir:"out",fields:{count:"number"}},"notify.channel.register":{dir:"out",fields:{channelId:"string",label:"string"}},"notify.permission.request":{dir:"out",fields:{...o}},"notify.send.result":{dir:"in"},"notify.permission.result":{dir:"in"},"notify.action":{dir:"in"},"notify.clicked":{dir:"in"},"notify.dismissed":{dir:"in"},"notify.controls":{dir:"in"},"config.registerSchema":{dir:"out",fields:{...o,schema:"object"}},"config.get":{dir:"out",fields:{...o}},"config.subscribe":{dir:"out"},"config.unsubscribe":{dir:"out"},"config.openSettings":{dir:"out"},"config.registerSchema.result":{dir:"in"},"config.values":{dir:"in"},"config.schemaError":{dir:"in"},"resource.bytes":{dir:"out",fields:{...o,url:"string"}},"resource.cancel":{dir:"out",fields:{...o}},"resource.bytes.result":{dir:"in"},"resource.bytes.error":{dir:"in"},"class.assigned":{dir:"in"},"cvm.discover":{dir:"out",fields:{...o}},"cvm.request":{dir:"out",fields:{...o,server:"object",message:"object"}},"cvm.close":{dir:"out",fields:{...o,server:"object"}},"cvm.discover.result":{dir:"in"},"cvm.request.result":{dir:"in"},"cvm.close.result":{dir:"in"},"cvm.event":{dir:"in"},"outbox.query":{dir:"out",fields:{...o,filters:"present"}},"outbox.subscribe":{dir:"out",fields:{...o,subId:"string",filters:"present"}},"outbox.close":{dir:"out",fields:{...o,subId:"string"}},"outbox.publish":{dir:"out",fields:{...o,event:"object"}},"outbox.resolveRelays":{dir:"out",fields:{...o,target:"present"}},"outbox.query.result":{dir:"in"},"outbox.event":{dir:"in"},"outbox.eose":{dir:"in"},"outbox.closed":{dir:"in"},"outbox.publish.result":{dir:"in"},"outbox.resolveRelays.result":{dir:"in"},"upload.upload":{dir:"out",fields:{...o,request:"object"}},"upload.status":{dir:"out",fields:{...o,uploadId:"string"}},"upload.upload.result":{dir:"in"},"upload.status.result":{dir:"in"},"upload.status.changed":{dir:"in"},"intent.invoke":{dir:"out",fields:{...o,request:"object"}},"intent.available":{dir:"out",fields:{...o,archetype:"string"}},"intent.handlers":{dir:"out",fields:{...o}},"intent.invoke.result":{dir:"in"},"intent.available.result":{dir:"in"},"intent.handlers.result":{dir:"in"},"intent.changed":{dir:"in"}};function H(e){if(e===void 0)return"undefined";if(e===null)return"null";if(Array.isArray(e))return"array";const t=typeof e;return t==="string"||t==="number"||t==="boolean"?t:t==="object"?"object":"present"}function te(e,t){return t==="present"?e!=null:H(e)===t}function ie(e){const t=[];if(typeof e!="object"||e===null||Array.isArray(e))return{ok:!1,errors:[{code:"not-an-object",message:"Envelope must be a non-null object"}]};const s=e,i=s.type;if(typeof i!="string")return{ok:!1,errors:[{code:"missing-type",message:"Envelope is missing a string `type` field"}]};const n=i.indexOf(".");if(n<=0)return{ok:!1,type:i,errors:[{code:"malformed-type",message:`Envelope type "${i}" is not in domain.action form`}]};const r=i.slice(0,n);if(!j.includes(r))return{ok:!1,type:i,domain:r,errors:[{code:"unknown-domain",message:`"${r}" is not a known NAP domain`}]};const a=ee[i];if(!a)return{ok:!1,type:i,domain:r,errors:[{code:"unknown-type",message:`"${i}" is not a known ${r} message type`}]};if(a.dir==="in")return{ok:!1,type:i,domain:r,direction:"in",errors:[{code:"inbound-type-emitted",message:`"${i}" is a shell→napplet message; a napplet must not emit it`}]};for(const[p,d]of Object.entries(a.fields??{})){if(!(p in s)||s[p]===void 0){t.push({code:"missing-field",message:`Required field "${p}" is missing`,field:p});continue}te(s[p],d)||t.push({code:"wrong-type",message:`Field "${p}" should be ${d} but is ${H(s[p])}`,field:p})}return{ok:t.length===0,type:i,domain:r,direction:"out",errors:t}}var C=/^[a-z0-9][a-z0-9._:-]*$/,se=/^[0-9a-f]{64}$/,re=new Set(["application/json","application/ld+json","importmap","speculationrules"]);function $(e,t){const s=/<meta\b[^>]*>/gi;let i;for(;(i=s.exec(e))!==null;){const n=i[0],r=/\bname\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(n);if((r?.[1]??r?.[2]??"").trim()!==t)continue;const p=/\bcontent\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(n);return(p?.[1]??p?.[2]??"").trim()}}function ne(e){const t=e.replace(/<!--[\s\S]*?-->/g,""),s=/<script\b([\s\S]*?)>/gi,i=[];let n;for(;(n=s.exec(t))!==null;){const r=n[0],a=n[1]??"",p=/\bsrc\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(a);if(p){if((p[1]??p[2]??"").trim().length>0)continue;i.push(r);continue}const d=/\btype\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(a),y=(d?.[1]??d?.[2]??"").trim().toLowerCase();y&&re.has(y)||i.push(r)}return i}function T(e){if(Array.isArray(e))return e.some(T);if(e&&typeof e=="object"){const t=e;return"pattern"in t?!0:Object.values(t).some(T)}return!1}function N(e,t={}){const s=t.requireAggregateHash??!0,i=[],n=[],r=$(e,"napplet-type");r?C.test(r)||i.push({code:"invalid-napplet-type",message:`napplet-type "${r}" must match ${C}`}):i.push({code:"missing-napplet-type",message:'No <meta name="napplet-type"> declared'});const a=$(e,"napplet-aggregate-hash");a?se.test(a)||i.push({code:"invalid-aggregate-hash",message:`napplet-aggregate-hash "${a}" is not a 64-char lowercase hex digest`}):s&&i.push({code:"missing-aggregate-hash",message:'No <meta name="napplet-aggregate-hash"> — the build plugin injects it; build before testing'});const p=$(e,"napplet-requires"),d=p?p.split(",").map(c=>c.trim()).filter(Boolean):[];for(const c of d){const v=c.startsWith("nap:")?c.slice(4):c;j.includes(v)||i.push({code:"unknown-required-nap",message:`napplet-requires lists "${c}" which is not a known NAP domain`})}const y=$(e,"napplet-config-schema");if(y){let c;try{c=JSON.parse(y)}catch{c=void 0,i.push({code:"invalid-config-schema",message:"napplet-config-schema is not valid JSON"})}c!==void 0&&(typeof c!="object"||c===null||Array.isArray(c)?i.push({code:"invalid-config-schema",message:"napplet-config-schema must be a JSON Schema object"}):T(c)&&i.push({code:"invalid-config-schema",message:"napplet-config-schema uses the `pattern` keyword, which the draft-07 core subset excludes (CVE-2025-69873)"}))}const h=$(e,"napplet-connect-requires"),S=h?h.split(/\s+/).map(c=>c.trim()).filter(Boolean):[],q=[];for(const c of S)try{q.push(Q(c))}catch(v){const x=v instanceof Error?v.message:String(v);i.push({code:"invalid-connect-origin",message:`connect origin "${c}" is invalid: ${x}`})}for(const c of ne(e))i.push({code:"inline-script",message:`Inline <script> is forbidden under script-src 'self': ${c}`});return{ok:i.length===0,nappletType:r,aggregateHash:a,requires:d,connectOrigins:q,errors:i,warnings:n}}var oe="f".repeat(64),ae="https://reference.invalid/blob",l=e=>[e],g=()=>[],le={"relay.subscribe":e=>l({type:"relay.eose",subId:e.subId}),"relay.close":g,"relay.publish":e=>l({type:"relay.publish.result",id:e.id,ok:!0,event:e.event}),"relay.publishEncrypted":e=>l({type:"relay.publishEncrypted.result",id:e.id,ok:!0,event:e.event}),"relay.query":e=>l({type:"relay.query.result",id:e.id,events:[]}),"identity.getPublicKey":e=>l({type:"identity.getPublicKey.result",id:e.id,pubkey:oe}),"identity.getRelays":e=>l({type:"identity.getRelays.result",id:e.id,relays:{}}),"identity.getProfile":e=>l({type:"identity.getProfile.result",id:e.id,profile:null}),"identity.getFollows":e=>l({type:"identity.getFollows.result",id:e.id,pubkeys:[]}),"identity.getList":e=>l({type:"identity.getList.result",id:e.id,entries:[]}),"identity.getZaps":e=>l({type:"identity.getZaps.result",id:e.id,zaps:[]}),"identity.getMutes":e=>l({type:"identity.getMutes.result",id:e.id,pubkeys:[]}),"identity.getBlocked":e=>l({type:"identity.getBlocked.result",id:e.id,pubkeys:[]}),"identity.getBadges":e=>l({type:"identity.getBadges.result",id:e.id,badges:[]}),"storage.get":e=>l({type:"storage.get.result",id:e.id,value:null}),"storage.set":e=>l({type:"storage.set.result",id:e.id}),"storage.remove":e=>l({type:"storage.remove.result",id:e.id}),"storage.keys":e=>l({type:"storage.keys.result",id:e.id,keys:[]}),"inc.emit":g,"inc.subscribe":e=>l({type:"inc.subscribe.result",id:e.id}),"inc.unsubscribe":g,"inc.channel.open":e=>l({type:"inc.channel.open.result",id:e.id,channelId:`chan-${String(e.id)}`,peer:"reference-peer"}),"inc.channel.emit":g,"inc.channel.broadcast":g,"inc.channel.list":e=>l({type:"inc.channel.list.result",id:e.id,channels:[]}),"inc.channel.close":g,"theme.get":e=>l({type:"theme.get.result",id:e.id,theme:{colors:{},mode:"dark"}}),"keys.forward":g,"keys.registerAction":e=>l({type:"keys.registerAction.result",id:e.id,actionId:`action-${String(e.id)}`}),"keys.unregisterAction":g,"media.session.create":e=>l({type:"media.session.create.result",id:e.id,sessionId:`session-${String(e.id)}`,owner:e.owner}),"media.session.update":g,"media.session.destroy":g,"media.state":g,"media.capabilities":g,"notify.send":e=>l({type:"notify.send.result",id:e.id,notificationId:`notif-${String(e.id)}`}),"notify.dismiss":g,"notify.badge":g,"notify.channel.register":g,"notify.permission.request":e=>l({type:"notify.permission.result",id:e.id,granted:!0}),"config.registerSchema":e=>l({type:"config.registerSchema.result",id:e.id,ok:!0}),"config.get":e=>l({type:"config.values",id:e.id,values:{}}),"config.subscribe":()=>l({type:"config.values",values:{}}),"config.unsubscribe":g,"config.openSettings":g,"resource.bytes":e=>l({type:"resource.bytes.result",id:e.id,blob:new Blob([]),mime:"application/octet-stream"}),"resource.cancel":g,"cvm.discover":e=>l({type:"cvm.discover.result",id:e.id,servers:[]}),"cvm.request":e=>l({type:"cvm.request.result",id:e.id,message:{}}),"cvm.close":e=>l({type:"cvm.close.result",id:e.id}),"outbox.query":e=>l({type:"outbox.query.result",id:e.id,events:[],relays:{}}),"outbox.subscribe":e=>l({type:"outbox.eose",subId:e.subId}),"outbox.close":g,"outbox.publish":e=>l({type:"outbox.publish.result",id:e.id,ok:!0}),"outbox.resolveRelays":e=>l({type:"outbox.resolveRelays.result",id:e.id,plan:{}}),"upload.upload":e=>l({type:"upload.upload.result",id:e.id,result:{url:ae}}),"upload.status":e=>l({type:"upload.status.result",id:e.id,status:{}}),"intent.invoke":e=>l({type:"intent.invoke.result",id:e.id,result:{}}),"intent.available":e=>l({type:"intent.available.result",id:e.id,availability:{}}),"intent.handlers":e=>l({type:"intent.handlers.result",id:e.id,handlers:[]})};function de(e={}){const t=e.now??(()=>Date.now()),s={naps:e.capabilities?.naps??[...j],sandbox:e.capabilities?.sandbox??[]},i=[];function n(r){const a=r&&typeof r=="object"&&typeof r.type=="string"?r.type:void 0;if(a==="shell.ready")return[{type:"shell.init",capabilities:{naps:s.naps,sandbox:s.sandbox}}];if(i.push({envelope:r,verdict:ie(r),timestamp:t()}),!a)return[];const p=le[a];return p?p(r):[]}return{capabilities:s,get records(){return i},handle:n,reset(){i.length=0}}}function ce(e){return{manifestHtml:e.manifestHtml,sandbox:e.sandbox??{allowScripts:!0,allowSameOrigin:!1},installedGlobal:e.boot.installedGlobal,bootError:e.boot.bootError,emitted:e.boot.emitted,forbiddenGlobals:e.forbiddenGlobals??[],degraded:e.boot.degraded,lifecycle:e.lifecycle??null}}function L(e){return new Promise(t=>setTimeout(t,e))}async function B(e,t,s,i){const n=de(e?{capabilities:e}:void 0),r=s.createElement("iframe");r.setAttribute("sandbox",t.allowSameOrigin?"allow-scripts allow-same-origin":"allow-scripts"),r.setAttribute("aria-hidden","true"),r.style.position="absolute",r.style.width="1px",r.style.height="1px",r.style.left="-9999px";let a;const p=new Promise(c=>{a=c}),d=c=>{if(c.source!==r.contentWindow)return;const v=n.handle(c.data),x=c.source;for(const U of v)x?.postMessage(U,"*");const A=c.data;A&&typeof A=="object"&&A.type==="shell.ready"&&a()};i.addEventListener("message",d),(s.body??s.documentElement).appendChild(r),r.setAttribute("src",t.url);let y=!1,h=null;const S=Symbol("timeout");await Promise.race([p.then(()=>"ready"),L(t.readyTimeoutMs).then(()=>S)])===S?h=`napplet did not boot (no shell.ready within ${t.readyTimeoutMs}ms; a conformant napplet must run under sandbox="allow-scripts" without allow-same-origin)`:(y=!0,await L(t.settleMs)),i.removeEventListener("message",d);try{r.remove()}catch{}return{installedGlobal:y,bootError:h,emitted:[...n.records]}}async function ue(e){const t=e.document??document,s=e.window??window,i={url:e.url,readyTimeoutMs:e.readyTimeoutMs??5e3,settleMs:e.settleMs,allowSameOrigin:e.allowSameOrigin??!1},n=await B(void 0,i,t,s);let r=null;{const a=await B({naps:[],sandbox:[]},i,t,s);r={bootError:a.bootError,emitted:a.emitted}}return{installedGlobal:n.installedGlobal,bootError:n.bootError,emitted:n.emitted,degraded:r}}var pe=e=>({status:"pass",detail:e}),fe=(e,t)=>({status:"fail",detail:e,diagnostics:t}),ge=e=>({status:"skip",detail:e}),u={pass:pe,fail:fe,skip:ge};function _(e,t){return N(e).errors.filter(s=>t.includes(s.code))}function D(e,t){return new RegExp(`name\\s*=\\s*["']${t}["']`,"i").test(e)}function E(e,t,s,i){return{id:e,area:"manifest",severity:"error",title:t,run:n=>{if(i&&!D(n.manifestHtml,i))return u.skip(`No ${i} declared`);const r=_(n.manifestHtml,s);return r.length?u.fail(r[0].message,r):u.pass()}}}var me=[E("manifest/napplet-type","Declares a valid napplet-type",["missing-napplet-type","invalid-napplet-type"]),E("manifest/aggregate-hash","Build injected a valid aggregate hash",["missing-aggregate-hash","invalid-aggregate-hash"]),E("manifest/declared-naps","napplet-requires lists only real NAP domains",["unknown-required-nap"],"napplet-requires"),E("manifest/config-schema","Config schema is a draft-07 core subset",["invalid-config-schema"],"napplet-config-schema"),E("manifest/connect-origins","Declared connect origins are valid",["invalid-connect-origin"],"napplet-connect-requires"),{id:"manifest/no-inline-scripts",area:"manifest",severity:"error",title:"No inline <script> (incompatible with script-src 'self')",run:e=>{const t=_(e.manifestHtml,["inline-script"]);return t.length?u.fail(`${t.length} inline script(s) found`,t):u.pass()}},{id:"boot/sandbox-allow-scripts",area:"boot",severity:"error",title:"Runs under allow-scripts without allow-same-origin",run:e=>e.sandbox.allowScripts?e.sandbox.allowSameOrigin?u.fail("Napplet relied on allow-same-origin, which a shell must not grant"):u.pass():u.fail("Napplet was not loaded with allow-scripts")},{id:"boot/installs-global",area:"boot",severity:"error",title:"Installs window.napplet",run:e=>e.installedGlobal?u.pass():u.fail("window.napplet was not present after load")},{id:"boot/no-boot-error",area:"boot",severity:"error",title:"Boots without an uncaught error",run:e=>e.bootError?u.fail(e.bootError):u.pass()},{id:"boot/no-forbidden-globals",area:"boot",severity:"error",title:"Does not access forbidden globals (e.g. window.nostr)",run:e=>e.forbiddenGlobals.length?u.fail(`Accessed forbidden global(s): ${e.forbiddenGlobals.join(", ")}`,e.forbiddenGlobals):u.pass()},{id:"wire/envelope-well-formed",area:"wire",severity:"error",title:"Every emitted envelope is well-formed",run:e=>{if(e.emitted.length===0)return u.skip("Napplet emitted no envelopes");const t=e.emitted.filter(i=>!i.verdict.ok);if(t.length===0)return u.pass(`${e.emitted.length} envelope(s) valid`);const s=t.map(i=>({envelope:i.envelope,errors:i.verdict.errors}));return u.fail(`${t.length}/${e.emitted.length} emitted envelope(s) invalid`,s)}},{id:"wire/declared-naps-only",area:"wire",severity:"warning",title:"Only emits NAP domains it declared in napplet-requires",run:e=>{if(e.emitted.length===0)return u.skip("Napplet emitted no envelopes");if(!D(e.manifestHtml,"napplet-requires"))return u.skip("No napplet-requires to compare against");const t=new Set(N(e.manifestHtml).requires.map(n=>n.startsWith("nap:")?n.slice(4):n)),i=[...new Set(e.emitted.map(n=>n.verdict.domain).filter(n=>typeof n=="string"))].filter(n=>!t.has(n));return i.length?u.fail(`Emitted undeclared NAP domain(s): ${i.join(", ")}`,i):u.pass()}},{id:"degrade/supports-false",area:"degradation",severity:"error",title:"Does not crash when shell.supports() is false",run:e=>e.degraded?e.degraded.bootError?u.fail(`Crashed under a no-capability shell: ${e.degraded.bootError}`):u.pass():u.skip("Host did not run the degraded (no-capabilities) pass")},{id:"lifecycle/clean-teardown",area:"lifecycle",severity:"warning",title:"Tears down listeners on unload",run:e=>e.lifecycle?e.lifecycle.listenerLeak?u.fail("Message listeners remained after unload"):u.pass():u.skip("Lifecycle not measured")}];function ye(e,t={}){const s=t.now??(()=>Date.now()),i=t.checks??me,n=s(),r=i.map(d=>{const y=d.run(e);return{id:d.id,area:d.area,severity:d.severity,title:d.title,status:y.status,detail:y.detail,diagnostics:y.diagnostics}}),a={total:r.length,passed:r.filter(d=>d.status==="pass").length,failed:r.filter(d=>d.status==="fail").length,skipped:r.filter(d=>d.status==="skip").length,errors:r.filter(d=>d.status==="fail"&&d.severity==="error").length,warnings:r.filter(d=>d.status==="fail"&&d.severity==="warning").length};return{napplet:N(e.manifestHtml).nappletType,startedAt:n,finishedAt:s(),checks:r,summary:a,ok:a.errors===0}}const he=/\bwindow\s*\.\s*nostr\b|\bglobalThis\s*\.\s*nostr\b/,be="/__conformance__/events",F=new URLSearchParams(location.search),G=F.get("live")==="1";function b(e){return String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}const w=document.getElementById("app");function ve(){return w.innerHTML=`
+    <header class="masthead">
+      <h1>napplet conformance ${G?'<span class="live-badge" id="live-badge">● live</span>':""}</h1>
+      <p>Load a napplet by URL and run NAP protocol conformance live. Same engine as <code>napplet-conformance</code> CI.</p>
+    </header>
+    <form id="run-form" class="runbar">
+      <input id="url" type="url" placeholder="https://localhost:5173/  (a napplet served with permissive CORS)" autocomplete="off" />
+      <button id="run" type="submit">Run conformance</button>
+      <button id="rerun" type="button" class="secondary" hidden>Re-run</button>
+    </form>
+    <p id="status" class="status" role="status"></p>
+    <section id="output" class="output"></section>
+  `,{urlInput:w.querySelector("#url"),runButton:w.querySelector("#run"),rerunButton:w.querySelector("#rerun"),liveBadge:w.querySelector("#live-badge")??document.createElement("span"),status:w.querySelector("#status"),output:w.querySelector("#output")}}const m=ve();let k="",M=0;function I(e,t="info"){m.status.textContent=e,m.status.dataset.kind=t}function R(e){return String(e).padStart(2,"0")}function we(e){const t=new Date(e);return`${R(t.getHours())}:${R(t.getMinutes())}:${R(t.getSeconds())}`}async function $e(e){try{const s=await(await fetch(e,{mode:"cors"})).text();return{html:s,forbidden:he.test(s)?["window.nostr"]:[],fetched:!0}}catch{return{html:"",forbidden:[],fetched:!1}}}function Ee(e){const t=e.ok?"conformant":"non-conformant",i=[...new Set(e.checks.map(a=>a.area))].map(a=>{const p=e.checks.filter(d=>d.area===a).map(d=>{const y=d.severity==="warning"&&d.status==="fail"?' <span class="tag warn">warning</span>':"",h=d.detail?`<span class="detail">${b(d.detail)}</span>`:"";return`<li class="check ${d.status}"><span class="badge ${d.status}">${d.status}</span><span class="id">${b(d.id)}</span>${y}${h}</li>`}).join("");return`<div class="area"><h3>${b(a)}</h3><ul>${p}</ul></div>`}).join(""),n=e.summary,r=M>1?`<span class="run-stamp">run #${M} · ${we(e.finishedAt)}</span>`:"";return`
+    <div class="verdict ${t}">
+      <span class="result">${e.ok?"CONFORMANT":"NON-CONFORMANT"}</span>
+      <span class="counts">${n.passed} passed · ${n.failed} failed · ${n.skipped} skipped${n.warnings?` · ${n.warnings} warning(s)`:""}</span>
+      ${r}
+    </div>
+    <div class="checks">${i}</div>
+  `}function ke(e){return e.length===0?'<p class="empty">No envelopes were emitted.</p>':`<ul class="envlog">${e.map(s=>{const i=s.verdict.ok?"ok":"bad",n=s.verdict.ok?"":`<div class="errs">${s.verdict.errors.map(r=>b(`${r.code}: ${r.message}`)).join("<br>")}</div>`;return`<li class="env ${i}"><code>${b(JSON.stringify(s.envelope))}</code>${n}</li>`}).join("")}</ul>`}function Se(e,t){if(!t)return`<p class="empty">Couldn't fetch the napplet HTML (likely CORS). Serve it with <code>Access-Control-Allow-Origin: *</code>, or use the CLI for the authoritative manifest checks.</p>`;const s=N(e),i=(n,r)=>`<tr><th>${b(n)}</th><td>${r?b(String(r)):"<em>—</em>"}</td></tr>`;return`
+    <table class="manifest">
+      ${i("napplet-type",s.nappletType)}
+      ${i("aggregate-hash",s.aggregateHash)}
+      ${i("requires",s.requires.join(", "))}
+      ${i("connect origins",s.connectOrigins.join(", "))}
+    </table>
+    ${s.errors.length?`<div class="errs">${s.errors.map(n=>b(`${n.code}: ${n.message}`)).join("<br>")}</div>`:""}
+  `}function Ie(e,t,s,i){m.output.innerHTML=`
+    ${Ee(e)}
+    <div class="panels">
+      <section class="panel"><h2>Emitted envelopes (${t.length})</h2>${ke(t)}</section>
+      <section class="panel"><h2>Manifest</h2>${Se(s,i)}</section>
+    </div>
+  `}async function O(e){k=e,m.runButton.disabled=!0,m.rerunButton.disabled=!0;try{I(`Fetching manifest for ${e} …`);const{html:t,forbidden:s,fetched:i}=await $e(e);I("Booting napplet in a sandboxed iframe …");const n=await ue({url:e,readyTimeoutMs:5e3,settleMs:800,runDegraded:!0}),r=ce({manifestHtml:t,boot:n,forbiddenGlobals:s}),a=ye(r);M+=1,I(a.ok?"Done — conformant.":"Done — non-conformant.",a.ok?"info":"error"),Ie(a,n.emitted,t,i),m.rerunButton.hidden=!1}catch(t){I(`Error: ${t instanceof Error?t.message:String(t)}`,"error")}finally{m.runButton.disabled=!1,m.rerunButton.disabled=!1}}function Ne(){if(!G||typeof EventSource>"u")return;let e=!1;const t=new EventSource(be);t.addEventListener("rerun",()=>{!k||e||(e=!0,setTimeout(()=>{e=!1,O(k)},50))}),t.addEventListener("open",()=>{m.liveBadge&&(m.liveBadge.dataset.state="connected")}),t.addEventListener("error",()=>{m.liveBadge&&(m.liveBadge.dataset.state="disconnected")})}m.runButton.parentElement.addEventListener("submit",e=>{e.preventDefault();const t=m.urlInput.value.trim();if(t){const s=new URL(location.href);s.searchParams.set("url",t),history.replaceState(null,"",s),O(t)}});m.rerunButton.addEventListener("click",()=>{k&&O(k)});Ne();const P=F.get("url");P&&(m.urlInput.value=P,O(P));

package/dist/ui/index.html

@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>napplet conformance runtime</title>
+    <meta name="description" content="Load a napplet and run NAP protocol conformance checks live in your browser." />
+    <script type="module" crossorigin src="/assets/index-iVwcmekY.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-D4WUxbBl.css">
+  </head>
+  <body>
+    <div id="app"></div>
+  </body>
+</html>

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@napplet/conformance-cli",
+  "version": "0.1.0",
+  "description": "Headless CLI that runs @napplet/conformance against a napplet in real Chromium via Playwright — the `test:conformance` runner",
+  "type": "module",
+  "bin": {
+    "napplet-conformance": "./dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "playwright": "^1.59.1",
+    "@napplet/conformance": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.0",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3",
+    "@napplet/conformance-web": "0.0.1"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sandwichfarm/napplet.git",
+    "directory": "packages/conformance-cli"
+  },
+  "keywords": [
+    "nostr",
+    "napplet",
+    "conformance",
+    "cli",
+    "playwright",
+    "nip-5d"
+  ],
+  "scripts": {
+    "build": "tsup && node scripts/copy-ui.mjs",
+    "type-check": "tsc --noEmit",
+    "test:unit": "vitest run"
+  }
+}