Skip to content

NUB-CONFIG: Per-napplet declarative configuration (JSON Schema-driven)#14

Open
dskvr wants to merge 6 commits intomasterfrom
nub-config
Open

NUB-CONFIG: Per-napplet declarative configuration (JSON Schema-driven)#14
dskvr wants to merge 6 commits intomasterfrom
nub-config

Conversation

@dskvr
Copy link
Copy Markdown
Contributor

@dskvr dskvr commented Apr 21, 2026

Status: Draft
Namespace: `window.napplet.config`
Discovery: `shell.supports("config")`

Summary

NUB-CONFIG defines a declarative per-napplet configuration surface driven by a JSON Schema shipped alongside the napplet. The shell renders the configuration UI from the schema, persists values per `(dTag, aggregateHash)`, and exposes them to the napplet via `window.napplet.config.get()` / `watch()`. Napplets ship the schema, not the UI.

Scope

  • Schema Contract — Core Subset of JSON Schema (types, enums, min/max, required, descriptions), explicit `$version` field, `pattern` exclusion, extension rules.
  • API Surface — `get`, `getAll`, `watch`, `describe`.
  • Wire Protocol — envelopes for config read / watch / change notification.
  • Shell Guarantees — MUST/SHOULD/MAY tables for persistence, validation, UI rendering, change notification ordering.
  • Error Codes + anti-features section (no code execution in schemas, no schema-side `pattern` regex to keep shells ReDoS-free, no cross-napplet config reads).
  • Security Considerations — schema source-identity binding, validation-before-persistence, shell-side input sanitization.

Implementations

`(none yet)`

References

  • NIP-5D: Core napplet protocol

dskvr added 6 commits April 17, 2026 12:43
…rn exclusion

- Enumerate Core Subset types, keywords, and constraints
- Document additionalProperties: false override at top level
- Specify deterministic default-resolution rule
- Standardized extensions table (x-napplet-secret, x-napplet-section, x-napplet-order, deprecationMessage, markdownDescription)
- $version as potentiality -- shell decides migration behavior
- Exclude pattern from v1 Core Subset citing CVE-2025-69873 (ReDoS)
- Forbid all $ref forms, combinatorial schemas, conditional schemas, tuple arrays, expression defaults
- Format as hint only; MUST NOT reject on format failure alone
- Depth limit of 4; schema-too-deep error code
- Forbid x-napplet-secret with default (secret-with-default)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant