@elisym/sdk 0.24.1 → 0.25.1

package/dist/index.cjs

@@ -97,7 +97,12 @@ var DEFAULTS = {
   // Default ceiling for a single iroh file transfer (seed/fetch). A tunable
   // default, not a protocol constant - the transfer is resumable and its own
   // budget, decoupled from the result-wait window.
-  IROH_FETCH_TIMEOUT_MS: 3e5
+  IROH_FETCH_TIMEOUT_MS: 3e5,
+  // Ceiling for a single Blossom blob upload (PUT /upload). Large blobs (up to
+  // LIMITS.MAX_FILE_SIZE) need far more than the 30s used for small media images.
+  BLOSSOM_UPLOAD_TIMEOUT_MS: 3e5,
+  // Ceiling for a single encrypted Blossom blob download (GET). Same budget as upload.
+  BLOSSOM_FETCH_TIMEOUT_MS: 3e5
 };
 var LIMITS = {
   MAX_INPUT_LENGTH: 1e5,
@@ -122,6 +127,12 @@ var LIMITS = {
   // providers may lower it per deployment.
   MAX_FILE_SIZE: 1073741824,
   // 1 GiB
+  // Cap for the ENCRYPTED Blossom path (web/SDK). The encrypt-then-upload flow is
+  // whole-buffer in WebCrypto + BlossomService (~3x file-size peak RAM), so this is
+  // deliberately far below MAX_FILE_SIZE to stay safe in a browser tab; larger files
+  // use iroh. The relay enforces a ~128 MiB server-side backstop.
+  MAX_BLOSSOM_ENCRYPTED_BYTES: 104857600,
+  // 100 MiB
   MAX_TIMEOUT_SECS: 600,
   // Upper bound for execution budgets (`max_execution_secs` / `execution_timeout_secs`).
   // Distinct from MAX_TIMEOUT_SECS (the result-wait cap): execution budgets may be
@@ -1200,6 +1211,180 @@ async function createPaymentRequestWithOnchainConfig(rpc, programId, recipient,
     options
   );
 }
+var KIND_BLOSSOM_AUTH = 24242;
+var DEFAULT_BLOSSOM_URL = "https://files.elisym.network";
+var AUTH_TTL_SECS = 600;
+var BlossomService = class {
+  constructor(serverUrl = DEFAULT_BLOSSOM_URL, fallback) {
+    this.serverUrl = serverUrl;
+    this.fallback = fallback;
+  }
+  /**
+   * Upload a file to the Blossom server, returning its descriptor. On any failure, falls
+   * back to the configured uploader (if any) and returns a normalized descriptor with
+   * `provider: 'fallback'`. Works with browser File objects and Node.js/Bun Blobs.
+   */
+  async upload(identity, file) {
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    if (bytes.byteLength > LIMITS.MAX_FILE_SIZE) {
+      throw new Error(
+        `File too large: ${bytes.byteLength} bytes exceeds limit of ${LIMITS.MAX_FILE_SIZE}.`
+      );
+    }
+    const hashBuffer = await crypto.subtle.digest("SHA-256", bytes);
+    const hashHex = [...new Uint8Array(hashBuffer)].map((b) => b.toString(16).padStart(2, "0")).join("");
+    try {
+      return await this.uploadToBlossom(identity, bytes, hashHex, file.type);
+    } catch (err) {
+      if (!this.fallback) {
+        throw err;
+      }
+      const url = await this.fallback(identity, file);
+      return {
+        url,
+        sha256: hashHex,
+        size: file.size,
+        type: file.type || "application/octet-stream",
+        provider: "fallback"
+      };
+    }
+  }
+  /** Delete a blob by sha256 (BUD-02). Blossom only - there is no fallback for deletes. */
+  async delete(identity, sha256) {
+    if (!/^[0-9a-f]{64}$/.test(sha256)) {
+      throw new Error("sha256 must be 64 lowercase hex chars.");
+    }
+    const authHeader = this.authHeader(identity, "delete", sha256);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DEFAULTS.BLOSSOM_UPLOAD_TIMEOUT_MS);
+    try {
+      const res = await fetch(`${this.serverUrl}/${sha256}`, {
+        method: "DELETE",
+        headers: { Authorization: authHeader },
+        signal: controller.signal
+      });
+      if (!res.ok) {
+        throw new Error(`Delete failed: ${res.status} ${res.statusText}`);
+      }
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  /**
+   * Download a public blob (BUD-01 GET, no auth). Bounds memory on the ACTUAL streamed bytes (never
+   * the declared Content-Length) and verifies the sha256 when `expectedSha256` is given. Browser-safe.
+   */
+  async download(url, opts = {}) {
+    const maxBytes = opts.maxBytes ?? LIMITS.MAX_FILE_SIZE;
+    const controller = new AbortController();
+    const timer = setTimeout(
+      () => controller.abort(),
+      opts.timeoutMs ?? DEFAULTS.BLOSSOM_FETCH_TIMEOUT_MS
+    );
+    try {
+      const res = await fetch(url, { signal: controller.signal });
+      if (!res.ok) {
+        throw new Error(`Download failed: ${res.status} ${res.statusText}`);
+      }
+      const declared = Number(res.headers.get("content-length"));
+      if (Number.isFinite(declared) && declared > maxBytes) {
+        throw new Error(`Blob too large: ${declared} bytes exceeds limit of ${maxBytes}.`);
+      }
+      if (!res.body) {
+        throw new Error("Download response has no body.");
+      }
+      const reader = res.body.getReader();
+      const chunks = [];
+      let total = 0;
+      let chunk = await reader.read();
+      while (!chunk.done) {
+        total += chunk.value.byteLength;
+        if (total > maxBytes) {
+          await reader.cancel();
+          throw new Error(`Blob exceeds limit of ${maxBytes} bytes.`);
+        }
+        chunks.push(chunk.value);
+        chunk = await reader.read();
+      }
+      const bytes = new Uint8Array(total);
+      let offset = 0;
+      for (const c of chunks) {
+        bytes.set(c, offset);
+        offset += c.byteLength;
+      }
+      if (opts.expectedSha256 !== void 0) {
+        const digest = await crypto.subtle.digest("SHA-256", bytes);
+        const hashHex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+        if (hashHex !== opts.expectedSha256) {
+          throw new Error(
+            `Download integrity check failed: got ${hashHex}, expected ${opts.expectedSha256}.`
+          );
+        }
+      }
+      return bytes;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async uploadToBlossom(identity, bytes, hashHex, mime) {
+    const contentType = mime || "application/octet-stream";
+    const authHeader = this.authHeader(identity, "upload", hashHex);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DEFAULTS.BLOSSOM_UPLOAD_TIMEOUT_MS);
+    try {
+      const res = await fetch(`${this.serverUrl}/upload`, {
+        method: "PUT",
+        headers: { Authorization: authHeader, "Content-Type": contentType },
+        body: bytes,
+        signal: controller.signal
+      });
+      if (!res.ok) {
+        throw new Error(`Upload failed: ${res.status} ${res.statusText}`);
+      }
+      let data;
+      try {
+        data = await res.json();
+      } catch {
+        throw new Error("Invalid response from Blossom server.");
+      }
+      if (!data.url || !data.sha256) {
+        throw new Error("No descriptor returned from Blossom server.");
+      }
+      if (data.sha256 !== hashHex) {
+        throw new Error(
+          `Blossom upload integrity check failed: server returned ${data.sha256}, expected ${hashHex}.`
+        );
+      }
+      return {
+        url: data.url,
+        sha256: data.sha256,
+        size: data.size ?? bytes.byteLength,
+        type: data.type ?? contentType,
+        uploaded: data.uploaded,
+        provider: "blossom"
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  authHeader(identity, verb, sha256) {
+    const now = Math.floor(Date.now() / 1e3);
+    const authEvent = nostrTools.finalizeEvent(
+      {
+        kind: KIND_BLOSSOM_AUTH,
+        created_at: now,
+        tags: [
+          ["t", verb],
+          ["x", sha256],
+          ["expiration", String(now + AUTH_TTL_SECS)]
+        ],
+        content: `${verb} blob via elisym SDK`
+      },
+      identity.secretKey
+    );
+    return "Nostr " + btoa(JSON.stringify(authEvent));
+  }
+};
 var RANKING_ACTIVITY_WINDOW_SECS = 30 * 24 * 60 * 60;
 var RANKING_BUCKET_SIZE_SECS = 60;
 var COLD_START_BUCKET = -Infinity;
@@ -1856,6 +2041,26 @@ var FileTransportSchema = zod.z.discriminatedUnion("kind", [
     kind: zod.z.literal("iroh"),
     /** Opaque iroh `BlobTicket` string. Parsed into a real ticket only at fetch time. */
     ticket: zod.z.string().min(1).max(MAX_TICKET_LENGTH)
+  }),
+  zod.z.object({
+    kind: zod.z.literal("blossom"),
+    /** Public HTTP(S) URL of the CIPHERTEXT blob on a Blossom relay. */
+    url: zod.z.string().url().max(2048),
+    /** sha256 (lowercase hex) of the ciphertext - what the relay stores and addresses. */
+    sha256: zod.z.string().regex(/^[0-9a-f]{64}$/),
+    /**
+     * Hybrid-encryption parameters. The file bytes are AES-256-GCM encrypted with a random
+     * content key; that key is NIP-44-wrapped to the recipient. `name`/`mime`/`size` on the
+     * attachment describe the PLAINTEXT and live only inside the (encrypted) envelope - never
+     * sent to the relay (the relay only ever sees opaque ciphertext).
+     */
+    enc: zod.z.object({
+      alg: zod.z.literal("AES-256-GCM"),
+      /** base64 12-byte GCM IV (non-secret). */
+      iv: zod.z.string().min(1).max(64),
+      /** NIP-44-wrapped content key. */
+      key: zod.z.string().min(1).max(2048)
+    })
   })
 ]);
 var FileAttachmentSchema = zod.z.object({
@@ -1864,8 +2069,18 @@ var FileAttachmentSchema = zod.z.object({
   /** Declared size in bytes (display/hint only; enforcement is on actual streamed bytes). */
   size: zod.z.number().int().nonnegative(),
   mime: zod.z.string().min(1).max(255),
-  /** Ordered by sender preference; at least one. */
-  transports: zod.z.array(FileTransportSchema).min(1),
+  /**
+   * Ordered by sender preference; at least one KNOWN transport. Parsed leniently: unknown
+   * transport `kind`s are dropped (not rejected) so adding a new transport never makes an older
+   * decoder throw away the whole envelope - it just ignores the kinds it doesn't know and uses
+   * the ones it does. At least one known transport must survive, else the attachment is invalid.
+   */
+  transports: zod.z.array(zod.z.unknown()).transform(
+    (arr) => arr.flatMap((t) => {
+      const parsed = FileTransportSchema.safeParse(t);
+      return parsed.success ? [parsed.data] : [];
+    })
+  ).refine((arr) => arr.length >= 1, { message: "attachment has no known transport" }),
   /** Optional provider hint (unix seconds) for when seeding may stop. */
   seedingExpiresAt: zod.z.number().int().nonnegative().optional()
 });
@@ -1874,6 +2089,37 @@ var JobPayloadEnvelopeSchema = zod.z.object({
   text: zod.z.string().optional(),
   attachment: FileAttachmentSchema.optional()
 });
+var ACCEPT_TRANSPORTS_TAG = "accept";
+var KNOWN_TRANSPORT_KINDS = ["iroh", "blossom"];
+function isKnownTransportKind(value) {
+  return KNOWN_TRANSPORT_KINDS.includes(value);
+}
+function buildAcceptTransportsTag(kinds) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [ACCEPT_TRANSPORTS_TAG];
+  for (const kind of kinds) {
+    if (isKnownTransportKind(kind) && !seen.has(kind)) {
+      seen.add(kind);
+      out.push(kind);
+    }
+  }
+  return out;
+}
+function readAcceptedTransports(tags) {
+  const tag = tags.find((t) => t[0] === ACCEPT_TRANSPORTS_TAG);
+  if (tag === void 0) {
+    return void 0;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const value of tag.slice(1)) {
+    if (isKnownTransportKind(value) && !seen.has(value)) {
+      seen.add(value);
+      out.push(value);
+    }
+  }
+  return out.length > 0 ? out : void 0;
+}
 function encodeJobPayload(payload) {
   const envelope = { v: ENVELOPE_VERSION };
   if (payload.text !== void 0) {
@@ -1976,6 +2222,12 @@ var MarketplaceService = class {
       tags.push(["p", options.providerPubkey]);
       tags.push(["encrypted", "nip44"]);
     }
+    if (options.acceptTransports && options.acceptTransports.length > 0) {
+      const acceptTag = buildAcceptTransportsTag(options.acceptTransports);
+      if (acceptTag.length > 1) {
+        tags.push(acceptTag);
+      }
+    }
     const kind = jobRequestKind(options.kindOffset ?? DEFAULT_KIND_OFFSET);
     const event = nostrTools.finalizeEvent(
       {
@@ -3363,6 +3615,7 @@ var ElisymClient = class {
   marketplace;
   ping;
   media;
+  blossom;
   policies;
   payment;
   constructor(config = {}) {
@@ -3371,6 +3624,10 @@ var ElisymClient = class {
     this.marketplace = new MarketplaceService(this.pool);
     this.ping = new PingService(this.pool);
     this.media = new MediaService(config.uploadUrl);
+    this.blossom = new BlossomService(
+      config.blossomUrl,
+      (identity, file) => this.media.upload(identity, file)
+    );
     this.policies = new PoliciesService(this.pool);
     this.payment = config.payment ?? new SolanaPaymentStrategy();
   }
@@ -3379,6 +3636,147 @@ var ElisymClient = class {
   }
 };
 
+// src/primitives/file-crypto.ts
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (const b of bytes) {
+    bin += String.fromCharCode(b);
+  }
+  return btoa(bin);
+}
+function base64ToBytes(b64) {
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i += 1) {
+    out[i] = bin.charCodeAt(i);
+  }
+  return out;
+}
+async function encryptBytesForRecipient(bytes, senderSk, recipientPubkey) {
+  const rawKey = crypto.getRandomValues(new Uint8Array(KEY_BYTES));
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const key = await crypto.subtle.importKey("raw", rawKey, "AES-GCM", false, ["encrypt"]);
+  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv, tagLength: 128 }, key, bytes);
+  const wrappedKey = nip44Encrypt(bytesToBase64(rawKey), senderSk, recipientPubkey);
+  return { ciphertext: new Uint8Array(ct), wrappedKey, iv: bytesToBase64(iv) };
+}
+async function decryptBytesFromSender(ciphertext, wrappedKey, iv, receiverSk, senderPubkey) {
+  const rawKey = base64ToBytes(nip44Decrypt(wrappedKey, receiverSk, senderPubkey));
+  const key = await crypto.subtle.importKey("raw", rawKey, "AES-GCM", false, ["decrypt"]);
+  const pt = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: base64ToBytes(iv), tagLength: 128 },
+    key,
+    ciphertext
+  );
+  return new Uint8Array(pt);
+}
+
+// src/transport/blossom-transport.ts
+var AES_GCM_TAG_BYTES = 16;
+function createBlossomTransport(opts) {
+  const { blossom, identity } = opts;
+  return {
+    async seedBytes({ bytes, recipientPubkey }) {
+      if (bytes.byteLength > LIMITS.MAX_BLOSSOM_ENCRYPTED_BYTES) {
+        throw new Error(
+          `File too large for encrypted Blossom: ${bytes.byteLength} bytes exceeds ${LIMITS.MAX_BLOSSOM_ENCRYPTED_BYTES}.`
+        );
+      }
+      const { ciphertext, wrappedKey, iv } = await encryptBytesForRecipient(
+        bytes,
+        identity.secretKey,
+        recipientPubkey
+      );
+      const blob = new Blob([ciphertext], { type: "application/octet-stream" });
+      const descriptor = await blossom.upload(identity, blob);
+      if (descriptor.provider !== "blossom") {
+        throw new Error("Blossom upload fell back to a non-content-addressed provider.");
+      }
+      return {
+        kind: "blossom",
+        url: descriptor.url,
+        sha256: descriptor.sha256,
+        enc: { alg: "AES-256-GCM", iv, key: wrappedKey }
+      };
+    },
+    async fetchToBytes({ transport, senderPubkey, maxBytes }) {
+      const plaintextCap = maxBytes ?? LIMITS.MAX_BLOSSOM_ENCRYPTED_BYTES;
+      const ciphertext = await blossom.download(transport.url, {
+        maxBytes: plaintextCap + AES_GCM_TAG_BYTES,
+        expectedSha256: transport.sha256
+      });
+      return decryptBytesFromSender(
+        ciphertext,
+        transport.enc.key,
+        transport.enc.iv,
+        identity.secretKey,
+        senderPubkey
+      );
+    }
+  };
+}
+
+// src/transport/file-jobs.ts
+var EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".exe",
+  ".dll",
+  ".bat",
+  ".cmd",
+  ".com",
+  ".msi",
+  ".sh",
+  ".app",
+  ".scr",
+  ".ps1"
+]);
+var EXECUTABLE_MIMES = /* @__PURE__ */ new Set([
+  "application/x-msdownload",
+  "application/x-msdos-program",
+  "application/x-sh",
+  "application/x-executable",
+  "application/vnd.microsoft.portable-executable",
+  "application/x-mach-binary"
+]);
+function looksExecutable(name, type) {
+  const dot = name.lastIndexOf(".");
+  const ext = dot >= 0 ? name.slice(dot).toLowerCase() : "";
+  return EXECUTABLE_EXTENSIONS.has(ext) || EXECUTABLE_MIMES.has(type);
+}
+async function buildEncryptedFileInput(args) {
+  const { file, providerPubkey, identity, blossom } = args;
+  const name = file.name ?? "upload";
+  if (looksExecutable(name, file.type)) {
+    throw new Error("Refusing to upload an executable file.");
+  }
+  const transport = createBlossomTransport({ blossom, identity });
+  const bytes = new Uint8Array(await file.arrayBuffer());
+  const member = await transport.seedBytes({ bytes, recipientPubkey: providerPubkey });
+  return {
+    name,
+    size: bytes.byteLength,
+    mime: file.type || "application/octet-stream",
+    transports: [member]
+  };
+}
+async function fetchEncryptedFileOutput(args) {
+  const { attachment, providerPubkey, identity, blossom, maxBytes } = args;
+  const member = attachment.transports.find(
+    (t) => t.kind === "blossom"
+  );
+  if (member === void 0) {
+    throw new Error("Attachment has no blossom transport.");
+  }
+  const transport = createBlossomTransport({ blossom, identity });
+  const bytes = await transport.fetchToBytes({
+    transport: member,
+    senderPubkey: providerPubkey,
+    maxBytes
+  });
+  return { bytes, name: attachment.name, mime: attachment.mime };
+}
+
 // src/services/jobErrors.ts
 var AGENT_UNAVAILABLE_MARKERS = [
   "agent temporarily unavailable",
@@ -3950,6 +4348,8 @@ function makeCensor() {
   };
 }
 
+exports.ACCEPT_TRANSPORTS_TAG = ACCEPT_TRANSPORTS_TAG;
+exports.BlossomService = BlossomService;
 exports.BoundedSet = BoundedSet;
 exports.DEFAULTS = DEFAULTS;
 exports.DEFAULT_KIND_OFFSET = DEFAULT_KIND_OFFSET;
@@ -3995,6 +4395,8 @@ exports.assertExpiry = assertExpiry;
 exports.assertLamports = assertLamports;
 exports.assetByKey = assetByKey;
 exports.assetKey = assetKey;
+exports.buildAcceptTransportsTag = buildAcceptTransportsTag;
+exports.buildEncryptedFileInput = buildEncryptedFileInput;
 exports.buildPaymentInstructions = buildPaymentInstructions;
 exports.calculateProtocolFee = calculateProtocolFee;
 exports.classifyJobError = classifyJobError;
@@ -4003,13 +4405,17 @@ exports.clearProtocolConfigCache = clearProtocolConfigCache;
 exports.clearQuickVerifyCache = clearQuickVerifyCache;
 exports.compareAgentsByRank = compareAgentsByRank;
 exports.computeRankKey = computeRankKey;
+exports.createBlossomTransport = createBlossomTransport;
 exports.createPaymentRequestWithOnchainConfig = createPaymentRequestWithOnchainConfig;
 exports.createSlidingWindowLimiter = createSlidingWindowLimiter;
 exports.decodeJobPayload = decodeJobPayload;
+exports.decryptBytesFromSender = decryptBytesFromSender;
 exports.encodeJobPayload = encodeJobPayload;
+exports.encryptBytesForRecipient = encryptBytesForRecipient;
 exports.estimateNetworkBaseline = estimateNetworkBaseline;
 exports.estimatePriorityFeeMicroLamports = estimatePriorityFeeMicroLamports;
 exports.estimateSolFeeLamports = estimateSolFeeLamports;
+exports.fetchEncryptedFileOutput = fetchEncryptedFileOutput;
 exports.formatAssetAmount = formatAssetAmount;
 exports.formatFeeBreakdown = formatFeeBreakdown;
 exports.formatNetworkBaseline = formatNetworkBaseline;
@@ -4025,6 +4431,7 @@ exports.nip44Encrypt = nip44Encrypt;
 exports.parseAssetAmount = parseAssetAmount;
 exports.parsePaymentRequest = parsePaymentRequest;
 exports.pickPercentileFee = pickPercentileFee;
+exports.readAcceptedTransports = readAcceptedTransports;
 exports.resolveAssetFromPaymentRequest = resolveAssetFromPaymentRequest;
 exports.resolveKnownAsset = resolveKnownAsset;
 exports.timeAgo = timeAgo;