JS app runtime: HTTP requests, assets, streams, and transpiler fixes

frameos/src/frameos/js_runtime/README.md

@@ -110,7 +110,29 @@ uses QuickJS only to execute the resulting JavaScript.
 - Builds a CommonJS-style module wrapper around app source.
 - Runs the native module transform before loading the wrapper into QuickJS.
 - Exposes a `frameos` API object to JS apps, including logging, state updates,
-  image operations, sleep scheduling, HTTP helpers, and context access.
+  image operations, sleep scheduling, HTTP helpers, and context access:
+  - `fetchText(url)` / `fetchJson(url)`: bounded GET requests.
+  - `httpRequest(url, {method, headers, body, bodyBase64, base64, timeoutMs})`:
+    bounded requests with any method/headers; returns `{status, body}` or
+    `{status, bodyBase64}` when `base64: true` (required for binary responses,
+    since raw bytes cannot cross the JS boundary as strings), or
+    `{status: 0, error}` on transport failure.
+  - `listAssets(dir)`, `assetExists(path)`, `assetSize(path)`,
+    `readAsset(path, {offset, length}?)`, `writeAsset(path, base64)`,
+    `appendAsset(path, base64)`, `deleteAsset(path)`: asset management scoped
+    to the frame's assets folder. Full-buffer reads are capped on embedded
+    targets (2MB) — read bigger files in ranged chunks or via streams.
+  - `loadAssetImage(path)`: decode an asset image within display bounds
+    (memory-aware, streams from disk) and return an image reference.
+  - `openAssetStream(path, "r"|"w"|"a")`, `createStream(base64?)`,
+    `streamRead(ref, length?)`, `streamWrite(ref, base64)`, `streamAtEnd(ref)`,
+    `streamRewind(ref)`, `streamClose(ref)`: simple string/asset-file streams
+    for chunked processing. Stream refs are plain JSON (`{__frameosType:
+    "streamRef", id}`) held in a global capped registry, so a data app can
+    return one and a downstream app can consume it.
+  - `getSetting(...path)`: read `frameConfig.settings` values (API keys etc.);
+    only namespaces listed in the app config's `"settings"` array are
+    accessible, so access travels visibly with the scene JSON.
 - Calls exported app lifecycle functions such as `init` and `get`.
 - Tracks persistent and transient image references so overwritten dynamic image
   fields can be released.