Repository navigation
Version Packages - #417
Merged
Merged
Version Packages#417
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@kehto/firewall@0.8.0
Minor Changes
@kehto/paja@0.33.0
Minor Changes
249fe8c: Admit verified and development iframe bytes through shared Firewall approvals before execution. Add exact directive-scoped browser network decisions, a closed CSP, shared prompt and grant management, and source-bound retirement on revocation. Paja now rejects its ineffective firewall simulation mode and resolves development assets only through an approved origin.
249fe8c: Require scoped Firewall approval for mediated service operations, with immutable
resource, device, file, and relay plans, source-owned cancellation, and revocation
cleanup. Wire Paja's supported backends to the same operation contracts and
remove the retired NAP-RESOURCE wire inputs.
249fe8c: Require shared Firewall approval before gamepad input and notification effects in permission-enabled runtimes. Bind Paja notification permissions to verified app identity, suppress late effects after revocation, and document the retained legacy notification paths.
249fe8c: Require relay operations to plan immutable destinations before approval and
execute only those approved targets across runtime, reference services, shell,
and Paja integrations.
249fe8c: Route resource fetches through a protected one-hop transport with public-address
pinning, bounded bodies and deadlines, disconnect cancellation, and redirect
metadata for per-destination authorization. Reject direct proxy access from
untrusted frames before DNS or network activity.
Authorize Paja BUD-03 discovery relay sockets individually, preserve NIP-65 author routing, and scope discovery caches to a live source-window generation so cancellation or source replacement cannot deliver stale server lists. Refresh signer-derived bootstrap relays at host signer lifecycle boundaries, then use that cache during resource requests instead of invoking external signer hooks.
249fe8c: Require prepared, signer-bound upload plans for runtime approval, authorize exact
upload resources and selected network origins before signing or egress, and
cancel progress on revocation. Paja prepares its Blossom destination before
approval and the reference HTTP uploader rejects unapproved redirects.
Window teardown invalidates all callbacks before cancellation and continues
cleaning up sibling uploads when a backend cancellation throws.
249fe8c: Require runtime-approved WebRTC signaling plans, reject opaque peer factories,
and fail closed for configured ICE/TURN endpoints until typed Firewall support exists.
Patch Changes
@kehto/runtime@0.29.0
Minor Changes
249fe8c: Add independent temporal budgets for mediated operations and approval prompts, with caller-owned clocks and lifecycle counters. Permission grants cannot bypass this evaluator.
Add scoped approval adapters, durable-write-before-grant semantics, explicit revocation recovery, and service authorization bound to immutable source principals. LINK uses this coordinator with independent rate checks and ACL ceilings. Retiring or replacing a source cancels pending approval and removes its session grants.
Add pre-execution required/optional interface admission with generation-bound revalidation. Enforce shared interface approvals on built-in dispatch and registered extensions. Extensions capture bounded immutable JSON, reject replayed IDs, retain host-owned denial schemas, and apply independent blocking prompt-spam budgets.
Allow services to cancel one pending or active authorization using a request signal, without cancelling sibling work or accepting late grants. Preserve equivalent-request ordering and bound retained cancelled queue entries.
Invalidate pending extension approval when its host capability declaration changes.
249fe8c: Hosts with
RuntimeAdapter.permissionscan now change the operation budget after creation withruntime.permissions.setRateLimit(config), and read it withruntime.permissions.rateLimit. It coversunfocusedMultiplierand the startupburstguard, keeps running counters, and throwsRangeErroron out-of-range values.RuntimePermissionsimplementers must add both members.RateLimitConfignow accepts anunfocusedMultiplierabove 1, and aburst.windowMsorburst.maxOperationsof zero. A zero window turns the guard off.onFirewallEvent,firewallPersistenceand theruntime.firewallStatemutators act on the legacy gate only, so a runtime withpermissionswarns once withFW-RUNTIME-LEGACY-IGNORED-001when they're used.getFocusContextscales both. Withpermissions,aclDefaultPolicyis a ceiling that approvals can't exceed. DeferredfilterNappletMessageenvelopes meet approvals and budgets at release.@kehto/shellalso exportsRateLimitConfig.249fe8c: Require relay operations to plan immutable destinations before approval and
execute only those approved targets across runtime, reference services, shell,
and Paja integrations.
Patch Changes
@kehto/services@0.31.0
Minor Changes
249fe8c: Require scoped Firewall approval for mediated service operations, with immutable
resource, device, file, and relay plans, source-owned cancellation, and revocation
cleanup. Wire Paja's supported backends to the same operation contracts and
remove the retired NAP-RESOURCE wire inputs.
249fe8c: Require shared Firewall approval before gamepad input and notification effects in permission-enabled runtimes. Bind Paja notification permissions to verified app identity, suppress late effects after revocation, and document the retained legacy notification paths.
249fe8c: Require relay operations to plan immutable destinations before approval and
execute only those approved targets across runtime, reference services, shell,
and Paja integrations.
249fe8c: Adopt the NAP-RESOURCE draft's canonical exact
url/orderedurlsrequests andpadded base64 result bytes. Resource authorization now covers the immutable
resource URL plus every resolver-reported HTTP(S) or WebSocket destination, with cancellation,
live revocation, and stale completion handling at the service boundary.
249fe8c: Integrate NAP-LINK with runtime-scoped interface and destination approvals, preserving canonical results and cancelling stale source work. Freeze trusted permission principals through shell source registration. Add live-source permission revocation handling, bounded replay protection, and a migration warning for host-only LINK openers. Unknown LINK actions are ignored and forbidden local/code schemes cannot be enabled by configuration.
Authorize each resource URL and immediate HTTP(S) origin through shared runtime grants. Hold authorization through response body consumption, propagate request cancellation, retain bulk partial outcomes, and diagnose resolver-only compatibility use once per service instance.
249fe8c: Require prepared, signer-bound upload plans for runtime approval, authorize exact
upload resources and selected network origins before signing or egress, and
cancel progress on revocation. Paja prepares its Blossom destination before
approval and the reference HTTP uploader rejects unapproved redirects.
Window teardown invalidates all callbacks before cancellation and continues
cleaning up sibling uploads when a backend cancellation throws.
249fe8c: Require runtime-approved WebRTC signaling plans, reject opaque peer factories,
and fail closed for configured ICE/TURN endpoints until typed Firewall support exists.
Patch Changes
249fe8c: Authorize immutable OUTBOX and COUNT relay plans before transport, signing, or
fanout, and suppress work and results after source revocation.
249fe8c: Prevent resource fetches after cancellation during asynchronous metadata lookup.
Capture bulk inputs, preserve cancellation ownership across duplicate IDs and
source replacement, and cancel outstanding work when the service detaches.
Require network approval for WebSocket resolver destinations and reject unsupported
network schemes or embedded credentials before invoking transport callbacks.
Retain the latest 1,024 completed resource IDs per source window to suppress
repeated side effects and terminal responses, while preserving cancellation and
clearing replay history on source destruction or service detachment.
249fe8c: Prevent duplicate
theme.changeddelivery when a host bridge owns theme broadcasts.Updated dependencies [249fe8c]
Updated dependencies [249fe8c]
Updated dependencies [249fe8c]
@kehto/shell@0.33.0
Minor Changes
249fe8c: Admit verified and development iframe bytes through shared Firewall approvals before execution. Add exact directive-scoped browser network decisions, a closed CSP, shared prompt and grant management, and source-bound retirement on revocation. Paja now rejects its ineffective firewall simulation mode and resolves development assets only through an approved origin.
249fe8c: Hosts with
RuntimeAdapter.permissionscan now change the operation budget after creation withruntime.permissions.setRateLimit(config), and read it withruntime.permissions.rateLimit. It coversunfocusedMultiplierand the startupburstguard, keeps running counters, and throwsRangeErroron out-of-range values.RuntimePermissionsimplementers must add both members.RateLimitConfignow accepts anunfocusedMultiplierabove 1, and aburst.windowMsorburst.maxOperationsof zero. A zero window turns the guard off.onFirewallEvent,firewallPersistenceand theruntime.firewallStatemutators act on the legacy gate only, so a runtime withpermissionswarns once withFW-RUNTIME-LEGACY-IGNORED-001when they're used.getFocusContextscales both. Withpermissions,aclDefaultPolicyis a ceiling that approvals can't exceed. DeferredfilterNappletMessageenvelopes meet approvals and budgets at release.@kehto/shellalso exportsRateLimitConfig.249fe8c: Require relay operations to plan immutable destinations before approval and
execute only those approved targets across runtime, reference services, shell,
and Paja integrations.
249fe8c: Adopt the NAP-RESOURCE draft's canonical exact
url/orderedurlsrequests andpadded base64 result bytes. Resource authorization now covers the immutable
resource URL plus every resolver-reported HTTP(S) or WebSocket destination, with cancellation,
live revocation, and stale completion handling at the service boundary.
249fe8c: Integrate NAP-LINK with runtime-scoped interface and destination approvals, preserving canonical results and cancelling stale source work. Freeze trusted permission principals through shell source registration. Add live-source permission revocation handling, bounded replay protection, and a migration warning for host-only LINK openers. Unknown LINK actions are ignored and forbidden local/code schemes cannot be enabled by configuration.
Authorize each resource URL and immediate HTTP(S) origin through shared runtime grants. Hold authorization through response body consumption, propagate request cancellation, retain bulk partial outcomes, and diagnose resolver-only compatibility use once per service instance.
Patch Changes
@kehto/cli@0.6.1
Patch Changes
@kehto/mocks@0.1.1
Patch Changes
planRelayOperation/executeRelayOperation) with local-only plans, so the Firewall approval runtime routes relay traffic to it instead of denying it as a legacy relay service.@test/harness@0.0.42
Patch Changes