@opendatalabs/vana-sdk 3.11.0 → 3.13.0

package/README.md

@@ -108,6 +108,33 @@ const result = await storage.upload(myBlob, "report.json");
 console.log(result.url);
 ```
 
+### Scope Vana storage by chain ID
+
+Set `chainId` when writing to Vana Storage for a specific chain (e.g. `1480` for
+Vana mainnet, `14800` for Moksha). Uploads then use chain-scoped routes
+(`/v1/chains/{chainId}/blobs/...`) so data for different chains never collides.
+
+```typescript
+import { createVanaStorageProvider } from "@opendatalabs/vana-sdk/node";
+
+const storage = createVanaStorageProvider({
+  endpoint: "https://storage.vana.org",
+  chainId: 14800,
+  signer: {
+    address: account.address,
+    signMessage: (msg) => account.signMessage({ message: msg }),
+  },
+});
+
+const result = await storage.upload(
+  myBlob,
+  "instagram.profile/2026-05-08T20:00:00.000Z",
+);
+```
+
+Chain-configured providers reject legacy blob URLs and URLs scoped to a
+different explicit chain ID.
+
 ## Build a Vana app
 
 Request user-approved data, read it from the user's Personal Server, and pay
@@ -262,7 +289,7 @@ in October 2025; the report is in [`audits/`](https://github.com/vana-com/vana-s
 
 - [Documentation](https://docs.vana.org/docs/sdk)
 - [API reference](https://vana-com.github.io/vana-sdk)
-- [Discord](https://discord.gg/vanabuilders)
+- [Discord](https://discord.gg/vanaofficial)
 
 ## License
 

package/dist/index.browser.js

@@ -29028,12 +29028,14 @@ async function buildWeb3SignedHeader(params) {
 
 // src/storage/providers/vana-storage.ts
 var DEFAULT_ENDPOINT = "https://storage.vana.org";
-var BLOB_PATH_PREFIX = "/v1/blobs";
+var LEGACY_BLOB_PATH_PREFIX = "/v1/blobs";
 var DEFAULT_TOKEN_TTL_SECONDS = 300;
 var MAX_UPLOAD_ATTEMPTS = 4;
 var MAX_RATE_LIMIT_DELAY_MS = 3e4;
 var VanaStorage = class {
   endpoint;
+  chainId;
+  blobPathPrefix;
   signer;
   ownerAddress;
   fetchImpl;
@@ -29046,6 +29048,15 @@ var VanaStorage = class {
       );
     }
     this.endpoint = (config.endpoint ?? DEFAULT_ENDPOINT).replace(/\/+$/, "");
+    if (config.chainId !== void 0 && !isValidChainId(config.chainId)) {
+      throw new StorageError(
+        `Unsupported vana-storage chainId '${String(config.chainId)}'`,
+        "INVALID_CHAIN_ID",
+        "vana-storage"
+      );
+    }
+    this.chainId = config.chainId;
+    this.blobPathPrefix = this.chainId !== void 0 ? `/v1/chains/${this.chainId}/blobs` : LEGACY_BLOB_PATH_PREFIX;
     this.signer = config.signer;
     this.ownerAddress = (config.ownerAddress ?? config.signer.address).toLowerCase();
     this.fetchImpl = config.fetchImpl ?? globalThis.fetch.bind(globalThis);
@@ -29066,7 +29077,7 @@ var VanaStorage = class {
       );
     }
     const subpath = encodeRelativePath(filename);
-    const path = `${BLOB_PATH_PREFIX}/${this.ownerAddress}/${subpath}`;
+    const path = `${this.blobPathPrefix}/${this.ownerAddress}/${subpath}`;
     const body = new Uint8Array(await file.arrayBuffer());
     const contentType = file.type !== "" ? file.type : "application/octet-stream";
     const header = await this.signRequest("PUT", path, body);
@@ -29234,12 +29245,17 @@ var VanaStorage = class {
         "vana-storage"
       );
     }
-    const segments = parsed.pathname.split("/").filter((s) => s.length > 0);
-    const isTraversal = (s) => s === "." || s === "..";
-    const valid = segments.length === 5 && segments[0] === "v1" && segments[1] === "blobs" && segments[2]?.toLowerCase() === this.ownerAddress && segments[3] !== void 0 && !isTraversal(segments[3]) && segments[4] !== void 0 && !isTraversal(segments[4]);
-    if (!valid) {
+    const route = parseBlobPath(parsed.pathname);
+    if (!route || route.owner.toLowerCase() !== this.ownerAddress) {
+      throw new StorageError(
+        `URL path '${parsed.pathname}' must be ${this.blobPathPrefix}/${this.ownerAddress}/{scope}/{collectedAt}`,
+        "INVALID_URL",
+        "vana-storage"
+      );
+    }
+    if (route.chainId !== this.chainId) {
       throw new StorageError(
-        `URL path '${parsed.pathname}' must be /v1/blobs/${this.ownerAddress}/{scope}/{collectedAt}`,
+        `URL chainId '${route.chainId ?? "legacy"}' does not match provider chainId '${this.chainId ?? "legacy"}'`,
         "INVALID_URL",
         "vana-storage"
       );
@@ -29247,6 +29263,27 @@ var VanaStorage = class {
     return parsed.pathname;
   }
 };
+function isValidChainId(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function parseBlobPath(pathname) {
+  const segments = pathname.split("/").filter((s) => s.length > 0);
+  const isTraversal = (s) => s === "." || s === "..";
+  if (segments.length === 5 && segments[0] === "v1" && segments[1] === "blobs") {
+    const [, , owner, scope, collectedAt] = segments;
+    if (isTraversal(scope) || isTraversal(collectedAt)) return null;
+    return { owner, scope, collectedAt };
+  }
+  if (segments.length === 7 && segments[0] === "v1" && segments[1] === "chains" && segments[3] === "blobs") {
+    const [, , chainIdSegment, , owner, scope, collectedAt] = segments;
+    if (!/^[0-9]+$/.test(chainIdSegment)) return null;
+    const chainId = Number(chainIdSegment);
+    if (!isValidChainId(chainId)) return null;
+    if (isTraversal(scope) || isTraversal(collectedAt)) return null;
+    return { chainId, owner, scope, collectedAt };
+  }
+  return null;
+}
 function encodeRelativePath(filename) {
   const parts = filename.split("/");
   if (parts.length !== 2 || parts.some((p) => p.length === 0 || p === "." || p === "..")) {