@oxy.so/protocol 1.0.0

package/dist/cjs/node/nodeApp.js

@@ -0,0 +1,344 @@
+"use strict";
+/**
+ * `createNodeApp` — the app-agnostic Express factory for an Oxy-protocol data
+ * node. A node stores and serves ONE owner's append-only signed-record log
+ * (their "personal repo") plus the content-addressed blobs the records point at.
+ *
+ * This is the engine extracted from `@oxy.so/node` so the SAME code can back many
+ * app-node deployments (the Oxy identity node, a future Mention node) that
+ * differ only by ENV: the namespace they serve, their well-known manifest path,
+ * their advertised protocol id + service-type, and their owner key. Everything
+ * app-specific is INJECTED:
+ *
+ *  - `store`     — a {@link RecordStore} + {@link BlobStore} (the node's SQLite
+ *                  store, or a test stub). The node holds exactly one subject's
+ *                  repo, so the store keys a single global chain and ignores the
+ *                  subject argument; `createNodeApp` passes the node's own key as
+ *                  a stable sentinel.
+ *  - `ownerAuth` — the single write authority. Records and blob pins are
+ *                  authorized against the node's configured owner key. This is
+ *                  injected (rather than importing `@oxy.so/core/server`) so the
+ *                  protocol package never depends on core.
+ *  - `config`    — the wire-shape knobs (well-known path, protocol id,
+ *                  service-type, mode, blob ceiling, collection allowlist).
+ *  - `logger`    — structured logging for the terminal error handler.
+ *
+ * Endpoints:
+ *  - `GET  <wellKnownPath>` — node identity + liveness (a probe target).
+ *  - `GET  /oxy/head`       — chain head `{ seq, headRecordId, recordCount }`.
+ *  - `GET  /oxy/log`        — ordered envelopes from a cursor (ingest).
+ *  - `POST /records`        — owner writes a single signed envelope.
+ *  - `POST /sync/push`      — owner pushes a batch of signed envelopes.
+ *  - `GET  /blobs/:hash`    — serve a content-addressed blob.
+ *  - `PUT  /blobs/:hash`    — owner pins a blob (signed-header auth).
+ *  - `GET  /health`         — container liveness.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlobHashMismatchError = void 0;
+exports.createNodeApp = createNodeApp;
+const express_1 = __importDefault(require("express"));
+const recordId_1 = require("../envelope/recordId");
+const rateLimit_1 = require("./rateLimit");
+const verifyRecord_1 = require("./verifyRecord");
+const constants_1 = require("./constants");
+/**
+ * Thrown by a {@link BlobStore.putBlob} implementation when bytes do not hash to
+ * the supplied address. Defined here (rather than in `@oxy.so/node`) so the node
+ * app can map it to `hash_mismatch` without importing the store implementation.
+ */
+class BlobHashMismatchError extends Error {
+    constructor(expected, actual) {
+        super(`blob hash mismatch: expected ${expected}, computed ${actual}`);
+        this.expected = expected;
+        this.actual = actual;
+        this.name = 'BlobHashMismatchError';
+    }
+}
+exports.BlobHashMismatchError = BlobHashMismatchError;
+/**
+ * Coerce a raw Express query value (`string | string[] | ParsedQs | undefined`)
+ * to a single string. A repeated/array param (`?since[]=a&since[]=b`) yields a
+ * non-string under qs; take its first string element so a tampered array can
+ * never reach a `typeof === 'string'` check as a non-string and cause type
+ * confusion. Returns `undefined` for anything that is not a string or a
+ * string-first array.
+ */
+function firstQueryValue(raw) {
+    if (typeof raw === 'string') {
+        return raw;
+    }
+    if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === 'string') {
+        return raw[0];
+    }
+    return undefined;
+}
+/** Clamp the `limit` query param into `[1, MAX_LOG_LIMIT]`, defaulting when absent/invalid. */
+function parseLimit(raw) {
+    const value = firstQueryValue(raw);
+    if (value === undefined || value.trim() === '') {
+        return constants_1.DEFAULT_LOG_LIMIT;
+    }
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        return constants_1.DEFAULT_LOG_LIMIT;
+    }
+    return Math.min(parsed, constants_1.MAX_LOG_LIMIT);
+}
+/** HTTP status for a chain-append rejection. */
+function appendStatus(reason) {
+    return reason === 'chain_conflict' ? 409 : 422;
+}
+/** True when `collection` is writable under the node's allowlist (empty = all). */
+function isCollectionAllowed(config, collection) {
+    return config.collections.length === 0 || config.collections.includes(collection);
+}
+/**
+ * Resolve the `/oxy/log` `since` query param to an exclusive lower-bound `seq`.
+ * Returns `null` when the page should be EMPTY (an unknown `recordId` cursor or
+ * an unrecognized cursor shape). Mirrors the legacy in-store cursor resolver,
+ * now split across the protocol `RecordStore` (numeric `getLogSince` +
+ * `resolveCursorSeq`).
+ */
+async function resolveSinceSeq(store, subject, since) {
+    if (since === undefined || since === '') {
+        return -1;
+    }
+    const lower = since.toLowerCase();
+    if (constants_1.SHA256_HEX.test(lower)) {
+        return store.resolveCursorSeq(subject, lower);
+    }
+    if (/^\d+$/.test(since)) {
+        const parsed = Number(since);
+        return Number.isSafeInteger(parsed) ? parsed : -1;
+    }
+    return null;
+}
+/** Map a stored envelope to the `/oxy/log` wire record. */
+async function toLogWireRecord(env) {
+    return {
+        seq: env.seq ?? 0,
+        recordId: await (0, recordId_1.computeRecordId)(env),
+        prev: env.prev ?? null,
+        issuedAt: env.issuedAt,
+        envelope: env,
+    };
+}
+function createNodeApp(deps) {
+    const { store, config, ownerAuth, logger } = deps;
+    // The node holds one subject's repo; the store keys a single global chain and
+    // ignores the subject argument. Pass the node's own key as a stable sentinel.
+    const subject = config.nodePublicKey;
+    const app = (0, express_1.default)();
+    app.disable('x-powered-by');
+    // JSON parser applies only to JSON bodies (it checks Content-Type), so the raw
+    // blob upload below is untouched by it.
+    const jsonParser = express_1.default.json({ limit: constants_1.JSON_BODY_LIMIT });
+    // Per-IP rate limiter on the owner-authorized write routes. Caps request rate
+    // BEFORE signature verification so a flood of bogus envelopes can't pin CPU.
+    // It owns a background sweep timer; expose its teardown as `app.stop()`.
+    const writeRateLimit = (0, rateLimit_1.createRateLimiter)(config.writeRateLimit ?? rateLimit_1.DEFAULT_WRITE_RATE_LIMIT);
+    app.stop = () => writeRateLimit.stop();
+    app.get('/health', (_req, res) => {
+        res.json({ status: 'ok' });
+    });
+    // ── Node identity / liveness ────────────────────────────────────────────────
+    app.get(config.wellKnownPath, async (_req, res, next) => {
+        try {
+            const head = await store.getHead(subject);
+            res.json({
+                nodePublicKey: config.nodePublicKey,
+                mode: config.mode,
+                version: config.protocolId,
+                serviceType: config.serviceType,
+                head: head && head.headRecordId !== null ? { seq: head.seq, headRecordId: head.headRecordId } : null,
+            });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    // ── Chain head ──────────────────────────────────────────────────────────────
+    app.get(constants_1.NODE_HEAD_PATH, async (_req, res, next) => {
+        try {
+            const head = await store.getHead(subject);
+            if (!head || head.headRecordId === null) {
+                res.json({ seq: null, headRecordId: null, recordCount: 0 });
+                return;
+            }
+            res.json({ seq: head.seq, headRecordId: head.headRecordId, recordCount: head.recordCount });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    // ── Ordered log (ingest) ──────────────────────────────────────────────────────
+    app.get(constants_1.NODE_LOG_PATH, async (req, res, next) => {
+        try {
+            const since = firstQueryValue(req.query.since);
+            const limit = parseLimit(req.query.limit);
+            const head = await store.getHead(subject);
+            const headWire = head && head.headRecordId !== null ? { seq: head.seq, headRecordId: head.headRecordId } : null;
+            const sinceSeq = await resolveSinceSeq(store, subject, since);
+            if (sinceSeq === null) {
+                res.json({ records: [], count: 0, head: headWire });
+                return;
+            }
+            const envelopes = await store.getLogSince(subject, sinceSeq, limit);
+            const records = await Promise.all(envelopes.map(toLogWireRecord));
+            res.json({ records, count: records.length, head: headWire });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    // ── Owner write: a single signed envelope ────────────────────────────────────
+    app.post(constants_1.NODE_RECORDS_PATH, writeRateLimit, jsonParser, async (req, res, next) => {
+        try {
+            const verification = await (0, verifyRecord_1.verifyNodeRecordEnvelope)(req.body);
+            if (!verification.ok) {
+                res.status(400).json({ error: verification.reason });
+                return;
+            }
+            if (!ownerAuth.isOwnerKey(verification.envelope.publicKey)) {
+                res.status(403).json({ error: 'not_owner' });
+                return;
+            }
+            if (!isCollectionAllowed(config, verification.envelope.collection ?? '')) {
+                res.status(403).json({ error: 'foreign_collection' });
+                return;
+            }
+            const outcome = await store.append(subject, verification.envelope, verification.recordId);
+            if (!outcome.ok) {
+                res.status(appendStatus(outcome.reason)).json({ error: outcome.reason });
+                return;
+            }
+            res.status(201).json({ recordId: outcome.recordId, seq: outcome.seq });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    // ── Owner write: a batch push (verified + appended in order) ──────────────────
+    app.post(constants_1.NODE_SYNC_PUSH_PATH, writeRateLimit, jsonParser, async (req, res, next) => {
+        try {
+            const body = req.body;
+            const items = typeof body === 'object' && body !== null && Array.isArray(body.records)
+                ? body.records
+                : null;
+            if (!items) {
+                res.status(400).json({ error: 'invalid_batch' });
+                return;
+            }
+            if (items.length > constants_1.MAX_SYNC_BATCH) {
+                res.status(400).json({ error: 'batch_too_large' });
+                return;
+            }
+            const results = [];
+            for (const item of items) {
+                const verification = await (0, verifyRecord_1.verifyNodeRecordEnvelope)(item);
+                if (!verification.ok) {
+                    results.push({ ok: false, reason: verification.reason });
+                    continue;
+                }
+                if (!ownerAuth.isOwnerKey(verification.envelope.publicKey)) {
+                    results.push({ ok: false, reason: 'not_owner' });
+                    continue;
+                }
+                if (!isCollectionAllowed(config, verification.envelope.collection ?? '')) {
+                    results.push({ ok: false, reason: 'foreign_collection' });
+                    continue;
+                }
+                const outcome = await store.append(subject, verification.envelope, verification.recordId);
+                results.push(outcome.ok
+                    ? { ok: true, recordId: outcome.recordId, seq: outcome.seq }
+                    : { ok: false, reason: outcome.reason });
+            }
+            const accepted = results.filter((result) => result.ok).length;
+            res.json({ accepted, results });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    // ── Serve a content-addressed blob ───────────────────────────────────────────
+    app.get(`${constants_1.NODE_BLOBS_PATH}/:hash`, async (req, res, next) => {
+        try {
+            const hash = req.params.hash.toLowerCase();
+            if (!constants_1.SHA256_HEX.test(hash)) {
+                res.status(400).json({ error: 'invalid_hash' });
+                return;
+            }
+            const bytes = await store.getBlob(hash);
+            if (!bytes) {
+                res.status(404).json({ error: 'not_found' });
+                return;
+            }
+            res.setHeader('Content-Type', 'application/octet-stream');
+            // Content-addressed → immutable, safe to cache aggressively.
+            res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+            res.send(Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes));
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    // ── Owner pins a blob (signed-header authorization) ──────────────────────────
+    app.put(`${constants_1.NODE_BLOBS_PATH}/:hash`, writeRateLimit, express_1.default.raw({ type: () => true, limit: config.maxBlobBytes }), async (req, res, next) => {
+        try {
+            const rawHash = req.params.hash;
+            if (typeof rawHash !== 'string') {
+                res.status(400).json({ error: 'invalid_hash' });
+                return;
+            }
+            const hash = rawHash.toLowerCase();
+            if (!constants_1.SHA256_HEX.test(hash)) {
+                res.status(400).json({ error: 'invalid_hash' });
+                return;
+            }
+            const publicKey = req.header(constants_1.OWNER_AUTH_HEADERS.publicKey);
+            const signature = req.header(constants_1.OWNER_AUTH_HEADERS.signature);
+            const timestampRaw = req.header(constants_1.OWNER_AUTH_HEADERS.timestamp);
+            if (!publicKey || !signature || !timestampRaw) {
+                res.status(401).json({ error: 'missing_owner_auth' });
+                return;
+            }
+            const authorized = await ownerAuth.verifyBlobPin(hash, {
+                publicKey,
+                signature,
+                timestamp: Number(timestampRaw),
+            });
+            if (!authorized) {
+                res.status(403).json({ error: 'unauthorized' });
+                return;
+            }
+            const bytes = req.body;
+            if (!Buffer.isBuffer(bytes) || bytes.length === 0) {
+                res.status(400).json({ error: 'empty_blob' });
+                return;
+            }
+            try {
+                await store.putBlob(hash, bytes);
+            }
+            catch (error) {
+                if (error instanceof BlobHashMismatchError) {
+                    res.status(400).json({ error: 'hash_mismatch' });
+                    return;
+                }
+                throw error;
+            }
+            res.status(201).json({ hash, size: bytes.length });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    // ── Terminal error handler ───────────────────────────────────────────────────
+    app.use((error, _req, res, _next) => {
+        logger.error({ err: error }, 'unhandled request error');
+        res.status(500).json({ error: 'internal_error' });
+    });
+    return app;
+}

package/dist/cjs/node/nodeClient.js

@@ -0,0 +1,204 @@
+"use strict";
+/**
+ * `NodeClient` — the HTTP client that drives an Oxy-protocol data node's
+ * routes (head / log / records / blobs). It is the OUTBOUND half of the node
+ * protocol: oxy-api uses it to PULL a user's chain back from their node; a
+ * future Mention backend (B3) uses it to drive a node + push records/blobs.
+ *
+ * The client is transport-agnostic — it takes an injected {@link NodeFetch} so
+ * the protocol package never depends on `@oxy.so/core`. Oxy supplies an adapter
+ * over `@oxy.so/core/server`'s `safeFetch` (HTTPS-only, DNS-pinned, private-IP
+ * denylist, bounded redirects); a test supplies an in-process stub. Every
+ * response body is read with a hard byte ceiling, so a node cannot stream an
+ * unbounded body into the caller.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeClient = exports.NodeClientError = void 0;
+exports.trimTrailingSlashes = trimTrailingSlashes;
+const httpFetch_1 = require("./httpFetch");
+const constants_1 = require("./constants");
+/** A non-2xx node response (or a node that returned a malformed body). */
+class NodeClientError extends Error {
+    constructor(message, status, reason) {
+        super(message);
+        this.status = status;
+        this.reason = reason;
+        this.name = 'NodeClientError';
+    }
+}
+exports.NodeClientError = NodeClientError;
+function readError(body) {
+    if (typeof body === 'object' && body !== null && typeof body.error === 'string') {
+        return body.error;
+    }
+    return undefined;
+}
+/**
+ * Trim every trailing slash from a base URL in LINEAR time.
+ *
+ * Replaces an anchored-quantifier regex (`/\/+$/`) whose backtracking is a
+ * polynomial-ReDoS sink on a long all-slash input; a single-pass scan is O(n)
+ * with no ReDoS surface.
+ */
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47 /* '/' */) {
+        end -= 1;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
+class NodeClient {
+    constructor(options) {
+        this.baseUrl = trimTrailingSlashes(options.baseUrl);
+        this.fetch = options.fetch;
+        this.headersTimeoutMs = options.headersTimeoutMs ?? constants_1.DEFAULT_CLIENT_TIMEOUT_MS;
+        this.maxRedirects = options.maxRedirects ?? constants_1.DEFAULT_CLIENT_MAX_REDIRECTS;
+        this.headMaxBytes = options.headMaxBytes ?? constants_1.DEFAULT_HEAD_MAX_BYTES;
+        this.logMaxBytes = options.logMaxBytes ?? constants_1.DEFAULT_LOG_MAX_BYTES;
+        this.writeResponseMaxBytes = options.writeResponseMaxBytes ?? constants_1.DEFAULT_WRITE_RESPONSE_MAX_BYTES;
+        this.blobMaxBytes = options.blobMaxBytes ?? constants_1.DEFAULT_MAX_BLOB_BYTES;
+    }
+    /** Base request options shared by every call (timeout + redirect budget). */
+    init(extra) {
+        return {
+            headersTimeoutMs: this.headersTimeoutMs,
+            maxRedirects: this.maxRedirects,
+            ...extra,
+        };
+    }
+    /** The node's current chain head. Throws {@link NodeClientError} on a non-2xx. */
+    async head() {
+        const res = await this.fetch(`${this.baseUrl}${constants_1.NODE_HEAD_PATH}`, this.init({ method: 'GET' }));
+        if (res.status < 200 || res.status >= 300) {
+            res.destroy();
+            throw new NodeClientError(`node ${constants_1.NODE_HEAD_PATH} responded HTTP ${res.status}`, res.status);
+        }
+        const body = await (0, httpFetch_1.readBoundedJson)(res, this.headMaxBytes);
+        const obj = (typeof body === 'object' && body !== null ? body : {});
+        return {
+            seq: typeof obj.seq === 'number' ? obj.seq : null,
+            headRecordId: typeof obj.headRecordId === 'string' ? obj.headRecordId : null,
+            recordCount: typeof obj.recordCount === 'number' ? obj.recordCount : 0,
+        };
+    }
+    /**
+     * One ordered page of the node's log strictly after `sinceSeq` (pass `-1` from
+     * genesis), capped at `limit`. Throws {@link NodeClientError} on a non-2xx or a
+     * response missing the `records` array.
+     */
+    async log(sinceSeq, limit) {
+        // A genesis cursor (`sinceSeq < 0`) is expressed by OMITTING `since` — the
+        // node reads an absent cursor as "from genesis". A negative numeric `since`
+        // is not a valid cursor on the wire (only an absent one, a non-negative seq,
+        // or a recordId), so omitting it is the correct way to request the whole log.
+        const sinceParam = sinceSeq >= 0 ? `since=${encodeURIComponent(String(sinceSeq))}&` : '';
+        const url = `${this.baseUrl}${constants_1.NODE_LOG_PATH}?${sinceParam}limit=${encodeURIComponent(String(limit))}`;
+        const res = await this.fetch(url, this.init({ method: 'GET' }));
+        if (res.status < 200 || res.status >= 300) {
+            res.destroy();
+            throw new NodeClientError(`node ${constants_1.NODE_LOG_PATH} responded HTTP ${res.status}`, res.status);
+        }
+        const body = await (0, httpFetch_1.readBoundedJson)(res, this.logMaxBytes);
+        const records = body.records;
+        if (!Array.isArray(records)) {
+            throw new NodeClientError(`node ${constants_1.NODE_LOG_PATH} returned no records array`, res.status);
+        }
+        const headRaw = body.head;
+        const head = typeof headRaw === 'object' &&
+            headRaw !== null &&
+            typeof headRaw.seq === 'number' &&
+            typeof headRaw.headRecordId === 'string'
+            ? { seq: headRaw.seq, headRecordId: headRaw.headRecordId }
+            : null;
+        return { records, count: records.length, head };
+    }
+    /**
+     * Write a single owner-signed envelope (`POST /records`). Throws
+     * {@link NodeClientError} (carrying the node's `reason`) on any non-2xx — a
+     * chain rejection (`chain_gap`/`chain_fork`/`bad_seq`/`chain_conflict`) or an
+     * authorization failure.
+     */
+    async writeRecord(envelope) {
+        const res = await this.fetch(`${this.baseUrl}${constants_1.NODE_RECORDS_PATH}`, this.init({
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: Buffer.from(JSON.stringify(envelope), 'utf8'),
+        }));
+        const body = await (0, httpFetch_1.readBoundedJson)(res, this.writeResponseMaxBytes);
+        if (res.status < 200 || res.status >= 300) {
+            const reason = readError(body);
+            throw new NodeClientError(`node ${constants_1.NODE_RECORDS_PATH} responded HTTP ${res.status}${reason ? ` (${reason})` : ''}`, res.status, reason);
+        }
+        const obj = body;
+        if (typeof obj.recordId !== 'string' || typeof obj.seq !== 'number') {
+            throw new NodeClientError(`node ${constants_1.NODE_RECORDS_PATH} returned a malformed write result`, res.status);
+        }
+        return { recordId: obj.recordId, seq: obj.seq };
+    }
+    /**
+     * Push a batch of owner-signed envelopes (`POST /sync/push`). Returns the
+     * node's per-item results. Throws {@link NodeClientError} only on a non-2xx
+     * batch-level failure (`invalid_batch` / `batch_too_large`).
+     */
+    async pushRecords(envelopes) {
+        const res = await this.fetch(`${this.baseUrl}${constants_1.NODE_SYNC_PUSH_PATH}`, this.init({
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: Buffer.from(JSON.stringify({ records: envelopes }), 'utf8'),
+        }));
+        const body = await (0, httpFetch_1.readBoundedJson)(res, this.writeResponseMaxBytes);
+        if (res.status < 200 || res.status >= 300) {
+            const reason = readError(body);
+            throw new NodeClientError(`node ${constants_1.NODE_SYNC_PUSH_PATH} responded HTTP ${res.status}${reason ? ` (${reason})` : ''}`, res.status, reason);
+        }
+        const obj = body;
+        return {
+            accepted: typeof obj.accepted === 'number' ? obj.accepted : 0,
+            results: Array.isArray(obj.results)
+                ? obj.results
+                : [],
+        };
+    }
+    /** Fetch a content-addressed blob. Returns `null` on a 404; throws on other non-2xx. */
+    async getBlob(hash) {
+        const res = await this.fetch(`${this.baseUrl}${constants_1.NODE_BLOBS_PATH}/${encodeURIComponent(hash)}`, this.init({ method: 'GET' }));
+        if (res.status === 404) {
+            res.destroy();
+            return null;
+        }
+        if (res.status < 200 || res.status >= 300) {
+            res.destroy();
+            throw new NodeClientError(`node ${constants_1.NODE_BLOBS_PATH}/:hash responded HTTP ${res.status}`, res.status);
+        }
+        return (0, httpFetch_1.readBoundedBytes)(res, this.blobMaxBytes);
+    }
+    /**
+     * Pin a content-addressed blob with an owner-signed authorization
+     * (`PUT /blobs/:hash`). The caller signs the pin (it holds the owner key) and
+     * passes the resulting `{ publicKey, signature, timestamp }`; the client sets
+     * the owner-auth headers. Throws {@link NodeClientError} on a non-2xx.
+     */
+    async putBlob(hash, bytes, auth) {
+        const res = await this.fetch(`${this.baseUrl}${constants_1.NODE_BLOBS_PATH}/${encodeURIComponent(hash)}`, this.init({
+            method: 'PUT',
+            headers: {
+                'Content-Type': 'application/octet-stream',
+                [constants_1.OWNER_AUTH_HEADERS.publicKey]: auth.publicKey,
+                [constants_1.OWNER_AUTH_HEADERS.signature]: auth.signature,
+                [constants_1.OWNER_AUTH_HEADERS.timestamp]: String(auth.timestamp),
+            },
+            body: bytes,
+        }));
+        const body = await (0, httpFetch_1.readBoundedJson)(res, this.writeResponseMaxBytes);
+        if (res.status < 200 || res.status >= 300) {
+            const reason = readError(body);
+            throw new NodeClientError(`node ${constants_1.NODE_BLOBS_PATH}/:hash responded HTTP ${res.status}${reason ? ` (${reason})` : ''}`, res.status, reason);
+        }
+        const obj = body;
+        if (typeof obj.hash !== 'string' || typeof obj.size !== 'number') {
+            throw new NodeClientError(`node ${constants_1.NODE_BLOBS_PATH}/:hash returned a malformed pin result`, res.status);
+        }
+        return { hash: obj.hash, size: obj.size };
+    }
+}
+exports.NodeClient = NodeClient;