@elisym/sdk 0.25.1 → 0.25.4

package/dist/index.js

@@ -73,6 +73,11 @@ var DEFAULTS = {
   // default, not a protocol constant - the transfer is resumable and its own
   // budget, decoupled from the result-wait window.
   IROH_FETCH_TIMEOUT_MS: 3e5,
+  // Ceiling for a single iroh SEED (addFromPath/addBytes/share). Seeding is local
+  // (hash + store-copy + ticket mint), so this is a generous backstop: it bounds
+  // the JS await so a wedged native call surfaces as a thrown error (and triggers a
+  // node reset) instead of an indefinite hang that stalls file delivery.
+  IROH_SEED_TIMEOUT_MS: 12e4,
   // Ceiling for a single Blossom blob upload (PUT /upload). Large blobs (up to
   // LIMITS.MAX_FILE_SIZE) need far more than the 30s used for small media images.
   BLOSSOM_UPLOAD_TIMEOUT_MS: 3e5,
@@ -1194,6 +1199,17 @@ var BlossomService = class {
     this.serverUrl = serverUrl;
     this.fallback = fallback;
   }
+  /**
+   * The content-addressed GET URL for a blob, derivable from its sha256 BEFORE
+   * upload (BUD-01: `<serverUrl>/<sha256>`, no extension for our octet-stream
+   * ciphertext uploads - same form `delete` addresses by). Lets a caller build a
+   * complete attachment descriptor and defer the actual byte upload (the descriptor
+   * is submitted first, the bytes PUT later). `upload()` re-verifies the server
+   * returns this exact url.
+   */
+  contentUrl(sha256) {
+    return `${this.serverUrl}/${sha256}`;
+  }
   /**
    * Upload a file to the Blossom server, returning its descriptor. On any failure, falls
    * back to the configured uploader (if any) and returns a normalized descriptor with
@@ -1246,18 +1262,38 @@ var BlossomService = class {
     }
   }
   /**
-   * Download a public blob (BUD-01 GET, no auth). Bounds memory on the ACTUAL streamed bytes (never
-   * the declared Content-Length) and verifies the sha256 when `expectedSha256` is given. Browser-safe.
+   * Download a content-addressed blob from THIS Blossom server (BUD-01 GET, no auth). Bounds memory
+   * on the ACTUAL streamed bytes (never the declared Content-Length) and verifies the sha256 when
+   * `expectedSha256` is given. Browser-safe.
+   *
+   * SSRF guard: `url` typically arrives inside a remote counterparty's encrypted job envelope, so it
+   * is untrusted. elisym blobs are content-addressed on the single configured server (`seedBytes`
+   * refuses non-content-addressed fallbacks), so a legitimate URL is always `<serverUrl>/<sha256>`.
+   * The origin is pinned to `serverUrl` and redirects are refused, so a crafted url (or a 30x from
+   * the host) can't coerce a fetch to loopback, cloud-metadata, or internal addresses. Federation
+   * across Blossom servers would replace this single-origin pin with an explicit allowlist.
    */
   async download(url, opts = {}) {
+    if (new URL(url).origin !== new URL(this.serverUrl).origin) {
+      throw new Error(`Refusing to download from a non-Blossom origin: ${url}`);
+    }
     const maxBytes = opts.maxBytes ?? LIMITS.MAX_FILE_SIZE;
     const controller = new AbortController();
     const timer = setTimeout(
       () => controller.abort(),
       opts.timeoutMs ?? DEFAULTS.BLOSSOM_FETCH_TIMEOUT_MS
     );
+    const externalSignal = opts.signal;
+    const onExternalAbort = () => controller.abort();
+    if (externalSignal !== void 0) {
+      if (externalSignal.aborted) {
+        controller.abort();
+      } else {
+        externalSignal.addEventListener("abort", onExternalAbort, { once: true });
+      }
+    }
     try {
-      const res = await fetch(url, { signal: controller.signal });
+      const res = await fetch(url, { signal: controller.signal, redirect: "error" });
       if (!res.ok) {
         throw new Error(`Download failed: ${res.status} ${res.statusText}`);
       }
@@ -1299,6 +1335,9 @@ var BlossomService = class {
       return bytes;
     } finally {
       clearTimeout(timer);
+      if (externalSignal !== void 0) {
+        externalSignal.removeEventListener("abort", onExternalAbort);
+      }
     }
   }
   async uploadToBlossom(identity, bytes, hashHex, mime) {
@@ -1432,6 +1471,9 @@ function parseCapabilityEvent(event, network) {
   if (card.inputMime !== void 0 && (typeof card.inputMime !== "string" || card.inputMime.length > 255) || card.outputMime !== void 0 && (typeof card.outputMime !== "string" || card.outputMime.length > 255)) {
     return null;
   }
+  if (card.inputText !== void 0 && !["required", "optional", "none"].includes(card.inputText)) {
+    card.inputText = void 0;
+  }
   if (card.payment?.job_price !== null && card.payment?.job_price !== void 0 && (!Number.isInteger(card.payment.job_price) || card.payment.job_price < 0)) {
     return null;
   }
@@ -2062,7 +2104,11 @@ var FileAttachmentSchema = z.object({
 var JobPayloadEnvelopeSchema = z.object({
   v: z.literal(ENVELOPE_VERSION),
   text: z.string().optional(),
-  attachment: FileAttachmentSchema.optional()
+  // Legacy single attachment - kept (and mirrored from `attachments[0]`) so an old
+  // decoder that doesn't know `attachments` still gets the first file.
+  attachment: FileAttachmentSchema.optional(),
+  // Multiple result/input files. Additive; old decoders strip this unknown key.
+  attachments: z.array(FileAttachmentSchema).optional()
 });
 var ACCEPT_TRANSPORTS_TAG = "accept";
 var KNOWN_TRANSPORT_KINDS = ["iroh", "blossom"];
@@ -2095,12 +2141,21 @@ function readAcceptedTransports(tags) {
   }
   return out.length > 0 ? out : void 0;
 }
+function attachmentsOf(decoded) {
+  if (decoded.attachments !== void 0 && decoded.attachments.length > 0) {
+    return decoded.attachments;
+  }
+  return decoded.attachment !== void 0 ? [decoded.attachment] : [];
+}
 function encodeJobPayload(payload) {
   const envelope = { v: ENVELOPE_VERSION };
   if (payload.text !== void 0) {
     envelope.text = payload.text;
   }
-  if (payload.attachment !== void 0) {
+  if (payload.attachments !== void 0 && payload.attachments.length > 0) {
+    envelope.attachments = payload.attachments;
+    envelope.attachment = payload.attachments[0];
+  } else if (payload.attachment !== void 0) {
     envelope.attachment = payload.attachment;
   }
   return JSON.stringify(envelope);
@@ -2128,7 +2183,11 @@ function decodeJobPayload(content) {
       `Invalid elisym job payload (v=${JSON.stringify(version)}): ${result.error.message}`
     );
   }
-  return { text: result.data.text, attachment: result.data.attachment };
+  return {
+    text: result.data.text,
+    attachment: result.data.attachment,
+    attachments: result.data.attachments
+  };
 }
 
 // src/services/marketplace.ts
@@ -2293,7 +2352,7 @@ var MarketplaceService = class {
       }
       resultDelivered = true;
       try {
-        cb.onResult?.(decoded.text ?? "", ev.id, decoded.attachment);
+        cb.onResult?.(decoded.text ?? "", ev.id, decoded.attachment, attachmentsOf(decoded));
       } catch {
       } finally {
         done();
@@ -2457,8 +2516,8 @@ var MarketplaceService = class {
     );
   }
   /** Submit a job result with NIP-44 encrypted content. Result kind is derived from the request kind. */
-  async submitJobResult(identity, requestEvent, content, amount, attachment) {
-    const hasAttachment = attachment !== void 0;
+  async submitJobResult(identity, requestEvent, content, amount, attachments) {
+    const hasAttachment = attachments !== void 0 && attachments.length > 0;
     if (!content && !hasAttachment) {
       throw new Error("Job result content must not be empty.");
     }
@@ -2472,7 +2531,7 @@ var MarketplaceService = class {
       );
     }
     const shouldEncrypt = isEncrypted(requestEvent);
-    const payload = hasAttachment ? encodeJobPayload({ text: content || void 0, attachment }) : content;
+    const payload = hasAttachment ? encodeJobPayload({ text: content || void 0, attachments }) : content;
     if (shouldEncrypt) {
       const payloadBytes = utf8ByteLength(payload);
       if (payloadBytes > LIMITS.NIP44_MAX_PLAINTEXT_BYTES) {
@@ -2513,11 +2572,11 @@ var MarketplaceService = class {
    * With maxAttempts=3: try, ~1s, try, ~2s, try, throw.
    * Jitter: 0.5x-1.0x of calculated delay.
    */
-  async submitJobResultWithRetry(identity, requestEvent, content, amount, maxAttempts = DEFAULTS.RESULT_RETRY_COUNT, baseDelayMs = DEFAULTS.RESULT_RETRY_BASE_MS, attachment) {
+  async submitJobResultWithRetry(identity, requestEvent, content, amount, maxAttempts = DEFAULTS.RESULT_RETRY_COUNT, baseDelayMs = DEFAULTS.RESULT_RETRY_BASE_MS, attachments) {
     const attempts = Math.max(1, maxAttempts);
     for (let attempt = 0; attempt < attempts; attempt++) {
       try {
-        return await this.submitJobResult(identity, requestEvent, content, amount, attachment);
+        return await this.submitJobResult(identity, requestEvent, content, amount, attachments);
       } catch (e) {
         if (attempt >= attempts - 1) {
           throw e;
@@ -3676,11 +3735,12 @@ function createBlossomTransport(opts) {
         enc: { alg: "AES-256-GCM", iv, key: wrappedKey }
       };
     },
-    async fetchToBytes({ transport, senderPubkey, maxBytes }) {
+    async fetchToBytes({ transport, senderPubkey, maxBytes, signal }) {
       const plaintextCap = maxBytes ?? LIMITS.MAX_BLOSSOM_ENCRYPTED_BYTES;
       const ciphertext = await blossom.download(transport.url, {
         maxBytes: plaintextCap + AES_GCM_TAG_BYTES,
-        expectedSha256: transport.sha256
+        expectedSha256: transport.sha256,
+        signal
       });
       return decryptBytesFromSender(
         ciphertext,
@@ -3694,6 +3754,10 @@ function createBlossomTransport(opts) {
 }
 
 // src/transport/file-jobs.ts
+async function sha256Hex(bytes) {
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
 var EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".exe",
   ".dll",
@@ -3719,21 +3783,56 @@ function looksExecutable(name, type) {
   const ext = dot >= 0 ? name.slice(dot).toLowerCase() : "";
   return EXECUTABLE_EXTENSIONS.has(ext) || EXECUTABLE_MIMES.has(type);
 }
-async function buildEncryptedFileInput(args) {
+async function prepareEncryptedFileInput(args) {
   const { file, providerPubkey, identity, blossom } = args;
   const name = file.name ?? "upload";
   if (looksExecutable(name, file.type)) {
     throw new Error("Refusing to upload an executable file.");
   }
-  const transport = createBlossomTransport({ blossom, identity });
   const bytes = new Uint8Array(await file.arrayBuffer());
-  const member = await transport.seedBytes({ bytes, recipientPubkey: providerPubkey });
-  return {
+  if (bytes.byteLength > LIMITS.MAX_BLOSSOM_ENCRYPTED_BYTES) {
+    throw new Error(
+      `File too large for the encrypted-Blossom transport: ${bytes.byteLength} bytes (max ${LIMITS.MAX_BLOSSOM_ENCRYPTED_BYTES}).`
+    );
+  }
+  const { ciphertext, wrappedKey, iv } = await encryptBytesForRecipient(
+    bytes,
+    identity.secretKey,
+    providerPubkey
+  );
+  const sha256 = await sha256Hex(ciphertext);
+  const member = {
+    kind: "blossom",
+    url: blossom.contentUrl(sha256),
+    sha256,
+    enc: { alg: "AES-256-GCM", iv, key: wrappedKey }
+  };
+  const attachment = {
     name,
     size: bytes.byteLength,
     mime: file.type || "application/octet-stream",
     transports: [member]
   };
+  const upload = async () => {
+    const descriptor = await blossom.upload(
+      identity,
+      new Blob([ciphertext], { type: "application/octet-stream" })
+    );
+    if (descriptor.provider !== "blossom") {
+      throw new Error("Blossom upload fell back to a non-content-addressed provider.");
+    }
+    if (descriptor.sha256 !== sha256 || descriptor.url !== member.url) {
+      throw new Error(
+        `Blossom upload descriptor mismatch (expected ${member.url} / ${sha256}, got ${descriptor.url} / ${descriptor.sha256}).`
+      );
+    }
+  };
+  return { attachment, upload };
+}
+async function buildEncryptedFileInput(args) {
+  const prepared = await prepareEncryptedFileInput(args);
+  await prepared.upload();
+  return prepared.attachment;
 }
 async function fetchEncryptedFileOutput(args) {
   const { attachment, providerPubkey, identity, blossom, maxBytes } = args;
@@ -4323,6 +4422,6 @@ function makeCensor() {
   };
 }
 
-export { ACCEPT_TRANSPORTS_TAG, BlossomService, BoundedSet, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ELISYM_PROTOCOL_TAG, ENVELOPE_VERSION, ElisymClient, ElisymIdentity, GlobalConfigSchema, INPUT_REDACT_PATHS, JobWaitTimeoutError, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_LONG_FORM_ARTICLE, KIND_PING, KIND_PONG, KNOWN_ASSETS, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, NATIVE_SOL, NostrPool, POLICY_D_TAG_PREFIX, POLICY_TYPE_REGEX, POLICY_T_TAG, PROTOCOL_PROGRAM_ID_DEVNET, PaymentRequestSchema, PingService, PoliciesService, RELAYS, SECRET_REDACT_PATHS, SessionSpendLimitEntrySchema, SolanaPaymentStrategy, USDC_SOLANA_DEVNET, aggregateNetworkStats, assertExpiry, assertLamports, assetByKey, assetKey, buildAcceptTransportsTag, buildEncryptedFileInput, buildPaymentInstructions, calculateProtocolFee, classifyJobError, clearPriorityFeeCache, clearProtocolConfigCache, clearQuickVerifyCache, compareAgentsByRank, computeRankKey, createBlossomTransport, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, decodeJobPayload, decryptBytesFromSender, encodeJobPayload, encryptBytesForRecipient, estimateNetworkBaseline, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, fetchEncryptedFileOutput, formatAssetAmount, formatFeeBreakdown, formatNetworkBaseline, formatSol, getNetworkStats, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parseAssetAmount, parsePaymentRequest, pickPercentileFee, readAcceptedTransports, resolveAssetFromPaymentRequest, resolveKnownAsset, timeAgo, toDTag, truncateKey, utf8ByteLength, validateAgentName, validateExpiry, verifyJobPaymentQuick };
+export { ACCEPT_TRANSPORTS_TAG, BlossomService, BoundedSet, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ELISYM_PROTOCOL_TAG, ENVELOPE_VERSION, ElisymClient, ElisymIdentity, GlobalConfigSchema, INPUT_REDACT_PATHS, JobWaitTimeoutError, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_LONG_FORM_ARTICLE, KIND_PING, KIND_PONG, KNOWN_ASSETS, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, NATIVE_SOL, NostrPool, POLICY_D_TAG_PREFIX, POLICY_TYPE_REGEX, POLICY_T_TAG, PROTOCOL_PROGRAM_ID_DEVNET, PaymentRequestSchema, PingService, PoliciesService, RELAYS, SECRET_REDACT_PATHS, SessionSpendLimitEntrySchema, SolanaPaymentStrategy, USDC_SOLANA_DEVNET, aggregateNetworkStats, assertExpiry, assertLamports, assetByKey, assetKey, attachmentsOf, buildAcceptTransportsTag, buildEncryptedFileInput, buildPaymentInstructions, calculateProtocolFee, classifyJobError, clearPriorityFeeCache, clearProtocolConfigCache, clearQuickVerifyCache, compareAgentsByRank, computeRankKey, createBlossomTransport, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, decodeJobPayload, decryptBytesFromSender, encodeJobPayload, encryptBytesForRecipient, estimateNetworkBaseline, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, fetchEncryptedFileOutput, formatAssetAmount, formatFeeBreakdown, formatNetworkBaseline, formatSol, getNetworkStats, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parseAssetAmount, parsePaymentRequest, pickPercentileFee, prepareEncryptedFileInput, readAcceptedTransports, resolveAssetFromPaymentRequest, resolveKnownAsset, timeAgo, toDTag, truncateKey, utf8ByteLength, validateAgentName, validateExpiry, verifyJobPaymentQuick };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map