@elisym/sdk 0.25.3 → 0.25.5

package/dist/index.d.cts

@@ -417,18 +417,20 @@ interface CapabilityCard {
     /**
      * MIME the capability expects as a file input (from a dynamic-script skill's
      * `input_mime`). Discovery hint only; the provider still content-sniffs the
-     * actual file. Its presence means the capability needs a file input - which
-     * the web app cannot send (no iroh transport), so the web app blocks the Buy
-     * button. `*` = any file, `image/*` = any image, `image/png` = exact.
+     * actual file. Its presence means the capability accepts a file input (the web
+     * app sends it over encrypted Blossom; the MCP/CLI over iroh), so clients show a
+     * file picker. `*` = any file, `image/*` = any image, `image/png` = exact.
      */
     inputMime?: string;
     /** MIME of a file result the capability produces (from `output_mime`). */
     outputMime?: string;
     /**
-     * Whether a file-input capability ALSO accepts a text prompt (from `input_text`):
-     * `'none'` = file only, `'optional'` = file + optional note, `'required'` = both.
-     * Discovery hint; the web app shows/hides its text box accordingly. Only meaningful
-     * with `inputMime`. Untrusted - gate on it, never render the raw value.
+     * How a file-input capability treats the text prompt (from `input_text`):
+     * `'none'` = file only, `'optional'` = file optional + instruction required (a
+     * generate-or-edit skill), `'required'` = file + text both required. Omitted =
+     * file required + optional note. Discovery hint; the web app shows/hides/gates its
+     * text box and file picker accordingly. Only meaningful with `inputMime`.
+     * Untrusted - gate on it, never render the raw value.
      */
     inputText?: 'required' | 'optional' | 'none';
 }
@@ -801,13 +803,22 @@ declare class BlossomService {
     /** Delete a blob by sha256 (BUD-02). Blossom only - there is no fallback for deletes. */
     delete(identity: ElisymIdentity, sha256: string): Promise<void>;
     /**
-     * Download a public blob (BUD-01 GET, no auth). Bounds memory on the ACTUAL streamed bytes (never
-     * the declared Content-Length) and verifies the sha256 when `expectedSha256` is given. Browser-safe.
+     * Download a content-addressed blob from THIS Blossom server (BUD-01 GET, no auth). Bounds memory
+     * on the ACTUAL streamed bytes (never the declared Content-Length) and verifies the sha256 when
+     * `expectedSha256` is given. Browser-safe.
+     *
+     * SSRF guard: `url` typically arrives inside a remote counterparty's encrypted job envelope, so it
+     * is untrusted. elisym blobs are content-addressed on the single configured server (`seedBytes`
+     * refuses non-content-addressed fallbacks), so a legitimate URL is always `<serverUrl>/<sha256>`.
+     * The origin is pinned to `serverUrl` and redirects are refused, so a crafted url (or a 30x from
+     * the host) can't coerce a fetch to loopback, cloud-metadata, or internal addresses. Federation
+     * across Blossom servers would replace this single-origin pin with an explicit allowlist.
      */
     download(url: string, opts?: {
         maxBytes?: number;
         timeoutMs?: number;
         expectedSha256?: string;
+        signal?: AbortSignal;
     }): Promise<Uint8Array>;
     private uploadToBlossom;
     private authHeader;
@@ -1171,6 +1182,8 @@ interface BlossomBlobTransport {
         transport: BlossomTransport;
         senderPubkey: string;
         maxBytes?: number;
+        /** Abort the in-flight download (e.g. job stop() / input-fetch budget). */
+        signal?: AbortSignal;
     }): Promise<Uint8Array>;
 }
 declare function createBlossomTransport(opts: {

package/dist/index.d.ts

@@ -417,18 +417,20 @@ interface CapabilityCard {
     /**
      * MIME the capability expects as a file input (from a dynamic-script skill's
      * `input_mime`). Discovery hint only; the provider still content-sniffs the
-     * actual file. Its presence means the capability needs a file input - which
-     * the web app cannot send (no iroh transport), so the web app blocks the Buy
-     * button. `*` = any file, `image/*` = any image, `image/png` = exact.
+     * actual file. Its presence means the capability accepts a file input (the web
+     * app sends it over encrypted Blossom; the MCP/CLI over iroh), so clients show a
+     * file picker. `*` = any file, `image/*` = any image, `image/png` = exact.
      */
     inputMime?: string;
     /** MIME of a file result the capability produces (from `output_mime`). */
     outputMime?: string;
     /**
-     * Whether a file-input capability ALSO accepts a text prompt (from `input_text`):
-     * `'none'` = file only, `'optional'` = file + optional note, `'required'` = both.
-     * Discovery hint; the web app shows/hides its text box accordingly. Only meaningful
-     * with `inputMime`. Untrusted - gate on it, never render the raw value.
+     * How a file-input capability treats the text prompt (from `input_text`):
+     * `'none'` = file only, `'optional'` = file optional + instruction required (a
+     * generate-or-edit skill), `'required'` = file + text both required. Omitted =
+     * file required + optional note. Discovery hint; the web app shows/hides/gates its
+     * text box and file picker accordingly. Only meaningful with `inputMime`.
+     * Untrusted - gate on it, never render the raw value.
      */
     inputText?: 'required' | 'optional' | 'none';
 }
@@ -801,13 +803,22 @@ declare class BlossomService {
     /** Delete a blob by sha256 (BUD-02). Blossom only - there is no fallback for deletes. */
     delete(identity: ElisymIdentity, sha256: string): Promise<void>;
     /**
-     * Download a public blob (BUD-01 GET, no auth). Bounds memory on the ACTUAL streamed bytes (never
-     * the declared Content-Length) and verifies the sha256 when `expectedSha256` is given. Browser-safe.
+     * Download a content-addressed blob from THIS Blossom server (BUD-01 GET, no auth). Bounds memory
+     * on the ACTUAL streamed bytes (never the declared Content-Length) and verifies the sha256 when
+     * `expectedSha256` is given. Browser-safe.
+     *
+     * SSRF guard: `url` typically arrives inside a remote counterparty's encrypted job envelope, so it
+     * is untrusted. elisym blobs are content-addressed on the single configured server (`seedBytes`
+     * refuses non-content-addressed fallbacks), so a legitimate URL is always `<serverUrl>/<sha256>`.
+     * The origin is pinned to `serverUrl` and redirects are refused, so a crafted url (or a 30x from
+     * the host) can't coerce a fetch to loopback, cloud-metadata, or internal addresses. Federation
+     * across Blossom servers would replace this single-origin pin with an explicit allowlist.
      */
     download(url: string, opts?: {
         maxBytes?: number;
         timeoutMs?: number;
         expectedSha256?: string;
+        signal?: AbortSignal;
     }): Promise<Uint8Array>;
     private uploadToBlossom;
     private authHeader;
@@ -1171,6 +1182,8 @@ interface BlossomBlobTransport {
         transport: BlossomTransport;
         senderPubkey: string;
         maxBytes?: number;
+        /** Abort the in-flight download (e.g. job stop() / input-fetch budget). */
+        signal?: AbortSignal;
     }): Promise<Uint8Array>;
 }
 declare function createBlossomTransport(opts: {

package/dist/index.js

@@ -9,6 +9,8 @@ import * as nip44 from 'nostr-tools/nip44';
 
 // src/constants.ts
 var RELAYS = [
+  // Dedicated elisym relay (self-hosted) first, public relays as fallback.
+  "wss://relay.elisym.network",
   "wss://relay.damus.io",
   "wss://nos.lol",
   "wss://relay.nostr.band",
@@ -1262,18 +1264,38 @@ var BlossomService = class {
     }
   }
   /**
-   * Download a public blob (BUD-01 GET, no auth). Bounds memory on the ACTUAL streamed bytes (never
-   * the declared Content-Length) and verifies the sha256 when `expectedSha256` is given. Browser-safe.
+   * Download a content-addressed blob from THIS Blossom server (BUD-01 GET, no auth). Bounds memory
+   * on the ACTUAL streamed bytes (never the declared Content-Length) and verifies the sha256 when
+   * `expectedSha256` is given. Browser-safe.
+   *
+   * SSRF guard: `url` typically arrives inside a remote counterparty's encrypted job envelope, so it
+   * is untrusted. elisym blobs are content-addressed on the single configured server (`seedBytes`
+   * refuses non-content-addressed fallbacks), so a legitimate URL is always `<serverUrl>/<sha256>`.
+   * The origin is pinned to `serverUrl` and redirects are refused, so a crafted url (or a 30x from
+   * the host) can't coerce a fetch to loopback, cloud-metadata, or internal addresses. Federation
+   * across Blossom servers would replace this single-origin pin with an explicit allowlist.
    */
   async download(url, opts = {}) {
+    if (new URL(url).origin !== new URL(this.serverUrl).origin) {
+      throw new Error(`Refusing to download from a non-Blossom origin: ${url}`);
+    }
     const maxBytes = opts.maxBytes ?? LIMITS.MAX_FILE_SIZE;
     const controller = new AbortController();
     const timer = setTimeout(
       () => controller.abort(),
       opts.timeoutMs ?? DEFAULTS.BLOSSOM_FETCH_TIMEOUT_MS
     );
+    const externalSignal = opts.signal;
+    const onExternalAbort = () => controller.abort();
+    if (externalSignal !== void 0) {
+      if (externalSignal.aborted) {
+        controller.abort();
+      } else {
+        externalSignal.addEventListener("abort", onExternalAbort, { once: true });
+      }
+    }
     try {
-      const res = await fetch(url, { signal: controller.signal });
+      const res = await fetch(url, { signal: controller.signal, redirect: "error" });
       if (!res.ok) {
         throw new Error(`Download failed: ${res.status} ${res.statusText}`);
       }
@@ -1315,6 +1337,9 @@ var BlossomService = class {
       return bytes;
     } finally {
       clearTimeout(timer);
+      if (externalSignal !== void 0) {
+        externalSignal.removeEventListener("abort", onExternalAbort);
+      }
     }
   }
   async uploadToBlossom(identity, bytes, hashHex, mime) {
@@ -3712,11 +3737,12 @@ function createBlossomTransport(opts) {
         enc: { alg: "AES-256-GCM", iv, key: wrappedKey }
       };
     },
-    async fetchToBytes({ transport, senderPubkey, maxBytes }) {
+    async fetchToBytes({ transport, senderPubkey, maxBytes, signal }) {
       const plaintextCap = maxBytes ?? LIMITS.MAX_BLOSSOM_ENCRYPTED_BYTES;
       const ciphertext = await blossom.download(transport.url, {
         maxBytes: plaintextCap + AES_GCM_TAG_BYTES,
-        expectedSha256: transport.sha256
+        expectedSha256: transport.sha256,
+        signal
       });
       return decryptBytesFromSender(
         ciphertext,