@qntx/nostr 0.0.1

package/dist/nips/blossom.mjs

@@ -0,0 +1,325 @@
+import { l as utf8Encoder, r as bytesToHex, t as assertHex32 } from "../util-6tfLQ9JF.mjs";
+import { a as NostrError, n as EventValidationError } from "../error-DZEs5OuZ.mjs";
+import { t as Kind } from "../kind-BLl4cLOc.mjs";
+import { t as EventBuilder } from "../builder-q0VsvnYE.mjs";
+import { n as requireGlobalFetch, r as sendManual, t as fetchManual } from "../http-D2rhokZo.mjs";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { base64urlnopad } from "@scure/base";
+//#region src/nips/blossom.ts
+/**
+* Blossom BUD-01/02/04/06 HTTP helpers, NIP-B7 kind 10063 server lists, and URL healing.
+* Auth is kind 24242, not NIP-98; the Authorization value is base64url.
+*
+* @see https://github.com/hzrd149/blossom
+* @see https://github.com/nostr-protocol/nips/blob/master/B7.md
+*/
+const AUTH_VERBS = /* @__PURE__ */ new Set([
+	"upload",
+	"delete",
+	"list",
+	"get",
+	"media"
+]);
+/** Default BUD-11 expiration: now + 1h. Servers 401 when the tag is missing. */
+const AUTH_EXPIRATION_SECS = 3600;
+var BlossomError = class extends NostrError {
+	status;
+	constructor(message, options) {
+		const { status, ...rest } = options ?? {};
+		super(message, rest);
+		this.status = status;
+	}
+};
+/** Last 64-char hex in the URL path (extension ignored). Null if none or the URL is invalid. */
+function getHashFromURL(url) {
+	let path;
+	try {
+		path = (url instanceof URL ? url : new URL(url)).pathname;
+	} catch {
+		return null;
+	}
+	const matches = path.match(/[0-9a-f]{64}/gi);
+	if (!matches?.length) return null;
+	return matches[matches.length - 1].toLowerCase();
+}
+async function sha256Blob(data) {
+	let bytes;
+	if (data instanceof Uint8Array) bytes = data;
+	else if (data instanceof ArrayBuffer) bytes = new Uint8Array(data);
+	else bytes = new Uint8Array(await data.arrayBuffer());
+	return bytesToHex(sha256(bytes));
+}
+/** True when `sha256Blob(data)` equals the expected hex (any case). */
+async function verifyBlob(data, sha256Hex) {
+	const expected = assertHex32(sha256Hex, "blob sha256");
+	return await sha256Blob(data) === expected;
+}
+/**
+* `Nostr ` + base64url(utf8 JSON), padding stripped.
+* NIP-98 uses standard base64; mixing them is a 401.
+*/
+function encodeAuthorizationHeader(event) {
+	return `Nostr ${base64urlnopad.encode(utf8Encoder.encode(JSON.stringify(event)))}`;
+}
+function createAuthTemplate(verb, opts) {
+	if (!AUTH_VERBS.has(verb)) throw new BlossomError(`invalid blossom auth verb: ${verb}`);
+	const expiration = opts?.expiration ?? Math.floor(Date.now() / 1e3) + AUTH_EXPIRATION_SECS;
+	const tags = [["t", verb], ["expiration", String(expiration)]];
+	if (opts?.sha256 !== void 0) tags.push(["x", assertHex32(opts.sha256, "blob sha256")]);
+	return {
+		kind: Kind.BlobsAuth,
+		created_at: Math.floor(Date.now() / 1e3),
+		tags,
+		content: opts?.message ?? ""
+	};
+}
+async function createUploadAuth(sign, file, opts) {
+	return sign(createAuthTemplate("upload", {
+		sha256: await sha256Blob(file),
+		...opts
+	}));
+}
+async function upload(server, file, auth, opts) {
+	const hash = await sha256Blob(file);
+	const headers = {
+		Authorization: encodeAuthorizationHeader(auth),
+		"X-SHA-256": hash
+	};
+	if (file.type) headers["Content-Type"] = file.type;
+	return requireDescriptorHash(parseBlobDescriptor(await readJson(await blossomRequest(opts?.fetch, blossomUrl(server, "/upload"), {
+		method: "PUT",
+		headers,
+		body: file,
+		signal: opts?.signal
+	}))), hash);
+}
+async function listBlobs(server, pubkey, auth, opts) {
+	const pk = assertHex32(pubkey, "pubkey");
+	const headers = {};
+	if (auth) headers.Authorization = encodeAuthorizationHeader(auth);
+	const res = await blossomRequest(opts?.fetch, blossomUrl(server, `/list/${pk}`), {
+		method: "GET",
+		headers,
+		signal: opts?.signal
+	});
+	const json = await readJson(res);
+	if (!Array.isArray(json)) throw new BlossomError("blossom list response must be a JSON array", { status: res.status });
+	return json.map(parseBlobDescriptor);
+}
+async function deleteBlob(server, sha256Hex, auth, opts) {
+	const hash = assertHex32(sha256Hex, "blob sha256");
+	await blossomRequest(opts?.fetch, blossomUrl(server, `/${hash}`), {
+		method: "DELETE",
+		headers: { Authorization: encodeAuthorizationHeader(auth) },
+		signal: opts?.signal
+	});
+}
+async function mirrorBlob(server, blob, opts) {
+	const hash = assertHex32(blob.sha256, "blob sha256");
+	const headers = {
+		Authorization: encodeAuthorizationHeader(opts.auth),
+		"Content-Type": "application/json",
+		"X-SHA-256": hash,
+		"X-Content-Length": String(blob.size)
+	};
+	if (blob.type) headers["X-Content-Type"] = blob.type;
+	return requireDescriptorHash(parseBlobDescriptor(await readJson(await blossomRequest(opts.fetch, blossomUrl(server, "/mirror"), {
+		method: "PUT",
+		headers,
+		body: JSON.stringify({ url: blob.url }),
+		signal: opts.signal
+	}))), hash);
+}
+/** BUD-06 preflight. Does not PUT the body. */
+async function checkUpload(server, file, auth, opts) {
+	const hash = await sha256Blob(file);
+	const headers = {
+		Authorization: encodeAuthorizationHeader(auth),
+		"X-SHA-256": hash,
+		"X-Content-Length": String(file.size)
+	};
+	if (file.type) headers["X-Content-Type"] = file.type;
+	await blossomRequest(opts?.fetch, blossomUrl(server, "/upload"), {
+		method: "HEAD",
+		headers,
+		signal: opts?.signal
+	});
+}
+/** Strict HEAD probe. 2xx → true. 404 → false. Other HTTP (including 405) / network → throw BlossomError. AbortError propagates. No GET fallback. */
+async function blobExists(server, sha256Hex, opts) {
+	const url = blossomUrl(server, `/${assertHex32(sha256Hex, "blob sha256")}`);
+	const res = await blossomFetch(opts?.fetch, url, {
+		method: "HEAD",
+		signal: opts?.signal
+	});
+	if (res.status === 404) return false;
+	if (res.ok) return true;
+	throw blossomHttpError("HEAD", url, res);
+}
+/** GET body, then verifyBlob. Non-2xx or sha256 mismatch → throw BlossomError. */
+async function getBlob(server, sha256Hex, opts) {
+	const hash = assertHex32(sha256Hex, "blob sha256");
+	const url = blossomUrl(server, `/${hash}`);
+	const res = await blossomFetch(opts?.fetch, url, {
+		method: "GET",
+		signal: opts?.signal
+	});
+	if (!res.ok) throw blossomHttpError("GET", url, res);
+	const bytes = new Uint8Array(await res.arrayBuffer());
+	if (!await verifyBlob(bytes, hash)) throw new BlossomError("blob sha256 mismatch");
+	return bytes;
+}
+/**
+* If `url` is not available, try `servers` for the same hash (NIP-B7 SHOULD).
+* Never throws on HTTP status. AbortError still throws.
+* Returns the original URL when no hash, original still available, or nothing else responds.
+*/
+async function healBlobUrl(url, servers, opts) {
+	const hash = getHashFromURL(url);
+	if (!hash) return url;
+	const ext = extensionFromHashUrl(url, hash);
+	const fetchImpl = opts?.fetch ?? requireGlobalFetch(missingBlossomFetch);
+	const originalStatus = await headStatus(fetchImpl, url, opts?.signal);
+	if (originalStatus !== void 0 && originalStatus >= 200 && originalStatus < 400) return url;
+	for (const server of servers) {
+		const base = parseHttpUrl(server);
+		if (!base) continue;
+		const candidate = `${base}/${hash}${ext}`;
+		const status = await headStatus(fetchImpl, candidate, opts?.signal);
+		if (status !== void 0 && status >= 200 && status < 300) return candidate;
+	}
+	return url;
+}
+/** PUT /upload to each server in order until one descriptor succeeds. */
+async function uploadToServers(servers, file, auth, opts) {
+	if (servers.length === 0) throw new BlossomError("no servers");
+	let last;
+	for (const server of servers) try {
+		return await upload(server, file, auth, opts);
+	} catch (err) {
+		if (isAbortError(err)) throw err;
+		last = err instanceof BlossomError ? err : new BlossomError("blossom upload failed", { cause: err instanceof Error ? err : void 0 });
+	}
+	throw last ?? new BlossomError("no servers");
+}
+function blossomServerListEventBuilder(servers) {
+	const tags = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const raw of servers) {
+		const url = parseHttpUrl(raw);
+		if (!url || seen.has(url)) continue;
+		seen.add(url);
+		tags.push(["server", url]);
+	}
+	return new EventBuilder(Kind.BlossomServerList, "").tags(tags);
+}
+function parseBlossomServerList(event) {
+	if (event.kind !== Kind.BlossomServerList) throw new EventValidationError(`expected kind ${Kind.BlossomServerList}, got ${event.kind}`);
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const tag of event.tags) {
+		if (tag[0] !== "server" || !tag[1]) continue;
+		const url = parseHttpUrl(tag[1]);
+		if (!url || seen.has(url)) continue;
+		seen.add(url);
+		out.push(url);
+	}
+	return out;
+}
+function parseHttpUrl(raw) {
+	try {
+		const u = new URL(raw);
+		if (u.protocol !== "http:" && u.protocol !== "https:") return void 0;
+		const path = u.pathname.replace(/\/+$/, "");
+		return `${u.origin}${path}`;
+	} catch {
+		return;
+	}
+}
+/** Join `/upload` etc. onto the stored server, keeping a path prefix (`/v1/upload`). */
+function blossomUrl(server, path) {
+	const base = parseHttpUrl(server);
+	if (!base) throw new BlossomError(`invalid blossom server URL: ${server}`);
+	return `${base}${path.startsWith("/") ? path : `/${path}`}`;
+}
+function isAbortError(err) {
+	return err instanceof Error && err.name === "AbortError";
+}
+/** Path suffix after the last 64-hex segment (`HASH.png` → `.png`). */
+function extensionFromHashUrl(url, hash) {
+	let pathname;
+	try {
+		pathname = new URL(url).pathname;
+	} catch {
+		return "";
+	}
+	const i = pathname.toLowerCase().lastIndexOf(hash);
+	if (i < 0) return "";
+	return pathname.slice(i + 64).match(/^\.[^/]+/)?.[0] ?? "";
+}
+function missingBlossomFetch() {
+	return new BlossomError("no fetch implementation available; pass opts.fetch");
+}
+function blossomHttpError(method, url, res) {
+	let reason;
+	try {
+		reason = res.headers.get("x-reason") ?? void 0;
+	} catch {
+		reason = void 0;
+	}
+	return new BlossomError(reason?.trim() || `blossom ${method} ${url} failed (${res.status})`, { status: res.status });
+}
+async function blossomFetch(fetchImpl, url, init) {
+	return fetchManual(fetchImpl ?? requireGlobalFetch(missingBlossomFetch), url, init, (err) => new BlossomError(`blossom ${init.method} ${url} failed`, { cause: err instanceof Error ? err : void 0 }));
+}
+/** HEAD with redirect:manual. Network → undefined. AbortError propagates. Never throws on HTTP status. */
+async function headStatus(fetchImpl, url, signal) {
+	try {
+		return (await sendManual(fetchImpl, url, {
+			method: "HEAD",
+			signal
+		})).status;
+	} catch (err) {
+		if (isAbortError(err)) throw err;
+		return;
+	}
+}
+async function blossomRequest(fetchImpl, url, init) {
+	const res = await blossomFetch(fetchImpl, url, init);
+	if (res.ok) return res;
+	throw blossomHttpError(init.method, url, res);
+}
+async function readJson(res) {
+	try {
+		return await res.json();
+	} catch (cause) {
+		throw new BlossomError("invalid blossom JSON response", {
+			cause: cause instanceof Error ? cause : void 0,
+			status: res.status
+		});
+	}
+}
+function parseBlobDescriptor(json) {
+	if (!json || typeof json !== "object" || Array.isArray(json)) throw new BlossomError("invalid blob descriptor");
+	const raw = json;
+	if (typeof raw.url !== "string" || !raw.url) throw new BlossomError("blob descriptor missing url");
+	if (typeof raw.sha256 !== "string") throw new BlossomError("blob descriptor missing sha256");
+	const hash = assertHex32(raw.sha256, "blob sha256");
+	if (typeof raw.size !== "number" || !Number.isInteger(raw.size) || raw.size < 0) throw new BlossomError("blob descriptor missing size");
+	const desc = {
+		url: raw.url,
+		sha256: hash,
+		size: raw.size
+	};
+	if (typeof raw.type === "string") desc.type = raw.type;
+	if (typeof raw.uploaded === "number" && Number.isInteger(raw.uploaded) && raw.uploaded >= 0) desc.uploaded = raw.uploaded;
+	return desc;
+}
+function requireDescriptorHash(desc, expected) {
+	if (desc.sha256 !== expected) throw new BlossomError("blob descriptor sha256 mismatch");
+	return desc;
+}
+//#endregion
+export { BlossomError, blobExists, blossomServerListEventBuilder, checkUpload, createAuthTemplate, createUploadAuth, deleteBlob, encodeAuthorizationHeader, getBlob, getHashFromURL, healBlobUrl, listBlobs, mirrorBlob, parseBlossomServerList, sha256Blob, upload, uploadToServers, verifyBlob };
+
+//# sourceMappingURL=blossom.mjs.map

package/dist/nips/blossom.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"blossom.mjs","names":[],"sources":["../../src/nips/blossom.ts"],"sourcesContent":["/**\n * Blossom BUD-01/02/04/06 HTTP helpers, NIP-B7 kind 10063 server lists, and URL healing.\n * Auth is kind 24242, not NIP-98; the Authorization value is base64url.\n *\n * @see https://github.com/hzrd149/blossom\n * @see https://github.com/nostr-protocol/nips/blob/master/B7.md\n */\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { base64urlnopad } from \"@scure/base\";\nimport { EventBuilder } from \"../core/builder.ts\";\nimport { EventValidationError, NostrError } from \"../core/error.ts\";\nimport type { Event, EventTemplate } from \"../core/event.ts\";\nimport { Kind } from \"../core/kind.ts\";\nimport type { Tag } from \"../core/tag.ts\";\nimport { assertHex32, bytesToHex, utf8Encoder } from \"../core/util.ts\";\nimport { fetchManual, requireGlobalFetch, sendManual, type ManualFetch } from \"./http.ts\";\n\nexport type BlobDescriptor = {\n  url: string;\n  sha256: string;\n  size: number;\n  type?: string;\n  uploaded?: number;\n};\n\nexport type BlossomFetch = ManualFetch;\n\n/** Signs a kind 24242 auth template (draft; pubkey is filled by the signer). */\nexport type BlossomSign = (template: EventTemplate) => Promise<Event>;\n\n/** BUD-11 `t` verbs. Mirror reuses `upload`; there is no `t=mirror`. */\nexport type BlossomAuthVerb = \"upload\" | \"delete\" | \"list\" | \"get\" | \"media\";\n\nconst AUTH_VERBS = new Set<BlossomAuthVerb>([\"upload\", \"delete\", \"list\", \"get\", \"media\"]);\n\n/** Default BUD-11 expiration: now + 1h. Servers 401 when the tag is missing. */\nconst AUTH_EXPIRATION_SECS = 3600;\n\nexport class BlossomError extends NostrError {\n  readonly status?: number;\n\n  constructor(message: string, options?: ErrorOptions & { status?: number }) {\n    const { status, ...rest } = options ?? {};\n    super(message, rest);\n    this.status = status;\n  }\n}\n\n/** Last 64-char hex in the URL path (extension ignored). Null if none or the URL is invalid. */\nexport function getHashFromURL(url: string | URL): string | null {\n  let path: string;\n  try {\n    path = (url instanceof URL ? url : new URL(url)).pathname;\n  } catch {\n    return null;\n  }\n  const matches = path.match(/[0-9a-f]{64}/gi);\n  if (!matches?.length) return null;\n  return matches[matches.length - 1]!.toLowerCase();\n}\n\nexport async function sha256Blob(data: Blob | ArrayBuffer | Uint8Array): Promise<string> {\n  let bytes: Uint8Array;\n  if (data instanceof Uint8Array) {\n    bytes = data;\n  } else if (data instanceof ArrayBuffer) {\n    bytes = new Uint8Array(data);\n  } else {\n    bytes = new Uint8Array(await data.arrayBuffer());\n  }\n  return bytesToHex(sha256(bytes));\n}\n\n/** True when `sha256Blob(data)` equals the expected hex (any case). */\nexport async function verifyBlob(\n  data: Blob | ArrayBuffer | Uint8Array,\n  sha256Hex: string,\n): Promise<boolean> {\n  const expected = assertHex32(sha256Hex, \"blob sha256\");\n  return (await sha256Blob(data)) === expected;\n}\n\n/**\n * `Nostr ` + base64url(utf8 JSON), padding stripped.\n * NIP-98 uses standard base64; mixing them is a 401.\n */\nexport function encodeAuthorizationHeader(event: Event): string {\n  return `Nostr ${base64urlnopad.encode(utf8Encoder.encode(JSON.stringify(event)))}`;\n}\n\nexport function createAuthTemplate(\n  verb: BlossomAuthVerb,\n  opts?: { sha256?: string; expiration?: number; message?: string },\n): EventTemplate {\n  if (!AUTH_VERBS.has(verb)) {\n    throw new BlossomError(`invalid blossom auth verb: ${verb}`);\n  }\n  const expiration = opts?.expiration ?? Math.floor(Date.now() / 1000) + AUTH_EXPIRATION_SECS;\n  const tags: Tag[] = [\n    [\"t\", verb],\n    [\"expiration\", String(expiration)],\n  ];\n  if (opts?.sha256 !== undefined) {\n    tags.push([\"x\", assertHex32(opts.sha256, \"blob sha256\")]);\n  }\n  return {\n    kind: Kind.BlobsAuth,\n    created_at: Math.floor(Date.now() / 1000),\n    tags,\n    content: opts?.message ?? \"\",\n  };\n}\n\nexport async function createUploadAuth(\n  sign: BlossomSign,\n  file: Blob,\n  opts?: { message?: string; expiration?: number },\n): Promise<Event> {\n  const hash = await sha256Blob(file);\n  return sign(createAuthTemplate(\"upload\", { sha256: hash, ...opts }));\n}\n\nexport async function upload(\n  server: string,\n  file: Blob,\n  auth: Event,\n  opts?: { fetch?: BlossomFetch; signal?: AbortSignal },\n): Promise<BlobDescriptor> {\n  const hash = await sha256Blob(file);\n  const headers: Record<string, string> = {\n    Authorization: encodeAuthorizationHeader(auth),\n    \"X-SHA-256\": hash,\n  };\n  if (file.type) headers[\"Content-Type\"] = file.type;\n  const res = await blossomRequest(opts?.fetch, blossomUrl(server, \"/upload\"), {\n    method: \"PUT\",\n    headers,\n    body: file,\n    signal: opts?.signal,\n  });\n  return requireDescriptorHash(parseBlobDescriptor(await readJson(res)), hash);\n}\n\nexport async function listBlobs(\n  server: string,\n  pubkey: string,\n  auth: Event | undefined,\n  opts?: { fetch?: BlossomFetch; signal?: AbortSignal },\n): Promise<BlobDescriptor[]> {\n  const pk = assertHex32(pubkey, \"pubkey\");\n  const headers: Record<string, string> = {};\n  if (auth) headers.Authorization = encodeAuthorizationHeader(auth);\n  const res = await blossomRequest(opts?.fetch, blossomUrl(server, `/list/${pk}`), {\n    method: \"GET\",\n    headers,\n    signal: opts?.signal,\n  });\n  const json = await readJson(res);\n  if (!Array.isArray(json)) {\n    throw new BlossomError(\"blossom list response must be a JSON array\", { status: res.status });\n  }\n  return json.map(parseBlobDescriptor);\n}\n\nexport async function deleteBlob(\n  server: string,\n  sha256Hex: string,\n  auth: Event,\n  opts?: { fetch?: BlossomFetch; signal?: AbortSignal },\n): Promise<void> {\n  const hash = assertHex32(sha256Hex, \"blob sha256\");\n  await blossomRequest(opts?.fetch, blossomUrl(server, `/${hash}`), {\n    method: \"DELETE\",\n    headers: { Authorization: encodeAuthorizationHeader(auth) },\n    signal: opts?.signal,\n  });\n}\n\nexport async function mirrorBlob(\n  server: string,\n  blob: BlobDescriptor,\n  opts: { auth: Event; fetch?: BlossomFetch; signal?: AbortSignal },\n): Promise<BlobDescriptor> {\n  const hash = assertHex32(blob.sha256, \"blob sha256\");\n  const headers: Record<string, string> = {\n    Authorization: encodeAuthorizationHeader(opts.auth),\n    \"Content-Type\": \"application/json\",\n    \"X-SHA-256\": hash,\n    \"X-Content-Length\": String(blob.size),\n  };\n  if (blob.type) headers[\"X-Content-Type\"] = blob.type;\n  const res = await blossomRequest(opts.fetch, blossomUrl(server, \"/mirror\"), {\n    method: \"PUT\",\n    headers,\n    body: JSON.stringify({ url: blob.url }),\n    signal: opts.signal,\n  });\n  return requireDescriptorHash(parseBlobDescriptor(await readJson(res)), hash);\n}\n\n/** BUD-06 preflight. Does not PUT the body. */\nexport async function checkUpload(\n  server: string,\n  file: Blob,\n  auth: Event,\n  opts?: { fetch?: BlossomFetch; signal?: AbortSignal },\n): Promise<void> {\n  const hash = await sha256Blob(file);\n  const headers: Record<string, string> = {\n    Authorization: encodeAuthorizationHeader(auth),\n    \"X-SHA-256\": hash,\n    \"X-Content-Length\": String(file.size),\n  };\n  if (file.type) headers[\"X-Content-Type\"] = file.type;\n  await blossomRequest(opts?.fetch, blossomUrl(server, \"/upload\"), {\n    method: \"HEAD\",\n    headers,\n    signal: opts?.signal,\n  });\n}\n\n/** Strict HEAD probe. 2xx → true. 404 → false. Other HTTP (including 405) / network → throw BlossomError. AbortError propagates. No GET fallback. */\nexport async function blobExists(\n  server: string,\n  sha256Hex: string,\n  opts?: { fetch?: BlossomFetch; signal?: AbortSignal },\n): Promise<boolean> {\n  const hash = assertHex32(sha256Hex, \"blob sha256\");\n  const url = blossomUrl(server, `/${hash}`);\n  const res = await blossomFetch(opts?.fetch, url, { method: \"HEAD\", signal: opts?.signal });\n  if (res.status === 404) return false;\n  if (res.ok) return true;\n  throw blossomHttpError(\"HEAD\", url, res);\n}\n\n/** GET body, then verifyBlob. Non-2xx or sha256 mismatch → throw BlossomError. */\nexport async function getBlob(\n  server: string,\n  sha256Hex: string,\n  opts?: { fetch?: BlossomFetch; signal?: AbortSignal },\n): Promise<Uint8Array> {\n  const hash = assertHex32(sha256Hex, \"blob sha256\");\n  const url = blossomUrl(server, `/${hash}`);\n  const res = await blossomFetch(opts?.fetch, url, { method: \"GET\", signal: opts?.signal });\n  if (!res.ok) throw blossomHttpError(\"GET\", url, res);\n  const bytes = new Uint8Array(await res.arrayBuffer());\n  if (!(await verifyBlob(bytes, hash))) {\n    throw new BlossomError(\"blob sha256 mismatch\");\n  }\n  return bytes;\n}\n\n/**\n * If `url` is not available, try `servers` for the same hash (NIP-B7 SHOULD).\n * Never throws on HTTP status. AbortError still throws.\n * Returns the original URL when no hash, original still available, or nothing else responds.\n */\nexport async function healBlobUrl(\n  url: string,\n  servers: readonly string[],\n  opts?: { fetch?: BlossomFetch; signal?: AbortSignal },\n): Promise<string> {\n  const hash = getHashFromURL(url);\n  if (!hash) return url;\n\n  const ext = extensionFromHashUrl(url, hash);\n  const fetchImpl = opts?.fetch ?? requireGlobalFetch(missingBlossomFetch);\n\n  const originalStatus = await headStatus(fetchImpl, url, opts?.signal);\n  // 2xx/3xx: still available. NIP-B7 only heals URLs that are not.\n  if (originalStatus !== undefined && originalStatus >= 200 && originalStatus < 400) {\n    return url;\n  }\n\n  for (const server of servers) {\n    const base = parseHttpUrl(server);\n    if (!base) continue;\n    const candidate = `${base}/${hash}${ext}`;\n    const status = await headStatus(fetchImpl, candidate, opts?.signal);\n    if (status !== undefined && status >= 200 && status < 300) return candidate;\n  }\n  return url;\n}\n\n/** PUT /upload to each server in order until one descriptor succeeds. */\nexport async function uploadToServers(\n  servers: readonly string[],\n  file: Blob,\n  auth: Event,\n  opts?: { fetch?: BlossomFetch; signal?: AbortSignal },\n): Promise<BlobDescriptor> {\n  if (servers.length === 0) {\n    throw new BlossomError(\"no servers\");\n  }\n  let last: BlossomError | undefined;\n  for (const server of servers) {\n    try {\n      return await upload(server, file, auth, opts);\n    } catch (err) {\n      if (isAbortError(err)) throw err;\n      last =\n        err instanceof BlossomError\n          ? err\n          : new BlossomError(\"blossom upload failed\", {\n              cause: err instanceof Error ? err : undefined,\n            });\n    }\n  }\n  throw last ?? new BlossomError(\"no servers\");\n}\n\nexport function blossomServerListEventBuilder(servers: readonly string[]): EventBuilder {\n  const tags: Tag[] = [];\n  const seen = new Set<string>();\n  for (const raw of servers) {\n    const url = parseHttpUrl(raw);\n    if (!url || seen.has(url)) continue;\n    seen.add(url);\n    tags.push([\"server\", url]);\n  }\n  return new EventBuilder(Kind.BlossomServerList, \"\").tags(tags);\n}\n\nexport function parseBlossomServerList(event: Pick<Event, \"kind\" | \"tags\">): string[] {\n  if (event.kind !== Kind.BlossomServerList) {\n    throw new EventValidationError(`expected kind ${Kind.BlossomServerList}, got ${event.kind}`);\n  }\n  const out: string[] = [];\n  const seen = new Set<string>();\n  for (const tag of event.tags) {\n    if (tag[0] !== \"server\" || !tag[1]) continue;\n    const url = parseHttpUrl(tag[1]);\n    if (!url || seen.has(url)) continue;\n    seen.add(url);\n    out.push(url);\n  }\n  return out;\n}\n\nfunction parseHttpUrl(raw: string): string | undefined {\n  try {\n    const u = new URL(raw);\n    if (u.protocol !== \"http:\" && u.protocol !== \"https:\") return undefined;\n    const path = u.pathname.replace(/\\/+$/, \"\");\n    return `${u.origin}${path}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Join `/upload` etc. onto the stored server, keeping a path prefix (`/v1/upload`). */\nfunction blossomUrl(server: string, path: string): string {\n  const base = parseHttpUrl(server);\n  if (!base) {\n    throw new BlossomError(`invalid blossom server URL: ${server}`);\n  }\n  const suffix = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${base}${suffix}`;\n}\n\nfunction isAbortError(err: unknown): boolean {\n  return err instanceof Error && err.name === \"AbortError\";\n}\n\n/** Path suffix after the last 64-hex segment (`HASH.png` → `.png`). */\nfunction extensionFromHashUrl(url: string, hash: string): string {\n  let pathname: string;\n  try {\n    pathname = new URL(url).pathname;\n  } catch {\n    return \"\";\n  }\n  const i = pathname.toLowerCase().lastIndexOf(hash);\n  if (i < 0) return \"\";\n  const m = pathname.slice(i + 64).match(/^\\.[^/]+/);\n  return m?.[0] ?? \"\";\n}\n\nfunction missingBlossomFetch(): BlossomError {\n  return new BlossomError(\"no fetch implementation available; pass opts.fetch\");\n}\n\ntype ManualResponse = Awaited<ReturnType<ManualFetch>>;\n\nfunction blossomHttpError(method: string, url: string, res: ManualResponse): BlossomError {\n  let reason: string | undefined;\n  try {\n    reason = res.headers.get(\"x-reason\") ?? undefined;\n  } catch {\n    reason = undefined;\n  }\n  return new BlossomError(reason?.trim() || `blossom ${method} ${url} failed (${res.status})`, {\n    status: res.status,\n  });\n}\n\nasync function blossomFetch(\n  fetchImpl: BlossomFetch | undefined,\n  url: string,\n  init: {\n    method: string;\n    headers?: Record<string, string>;\n    body?: Blob | string | null;\n    signal?: AbortSignal;\n  },\n): Promise<ManualResponse> {\n  return fetchManual(\n    fetchImpl ?? requireGlobalFetch(missingBlossomFetch),\n    url,\n    init,\n    (err) =>\n      new BlossomError(`blossom ${init.method} ${url} failed`, {\n        cause: err instanceof Error ? err : undefined,\n      }),\n  );\n}\n\n/** HEAD with redirect:manual. Network → undefined. AbortError propagates. Never throws on HTTP status. */\nasync function headStatus(\n  fetchImpl: ManualFetch,\n  url: string,\n  signal?: AbortSignal,\n): Promise<number | undefined> {\n  try {\n    const res = await sendManual(fetchImpl, url, { method: \"HEAD\", signal });\n    return res.status;\n  } catch (err) {\n    if (isAbortError(err)) throw err;\n    return undefined;\n  }\n}\n\nasync function blossomRequest(\n  fetchImpl: BlossomFetch | undefined,\n  url: string,\n  init: {\n    method: string;\n    headers?: Record<string, string>;\n    body?: Blob | string | null;\n    signal?: AbortSignal;\n  },\n): Promise<ManualResponse> {\n  const res = await blossomFetch(fetchImpl, url, init);\n  if (res.ok) return res;\n  throw blossomHttpError(init.method, url, res);\n}\n\nasync function readJson(res: ManualResponse): Promise<unknown> {\n  try {\n    return await res.json();\n  } catch (cause) {\n    throw new BlossomError(\"invalid blossom JSON response\", {\n      cause: cause instanceof Error ? cause : undefined,\n      status: res.status,\n    });\n  }\n}\n\nfunction parseBlobDescriptor(json: unknown): BlobDescriptor {\n  if (!json || typeof json !== \"object\" || Array.isArray(json)) {\n    throw new BlossomError(\"invalid blob descriptor\");\n  }\n  const raw = json as Record<string, unknown>;\n  if (typeof raw.url !== \"string\" || !raw.url) {\n    throw new BlossomError(\"blob descriptor missing url\");\n  }\n  if (typeof raw.sha256 !== \"string\") {\n    throw new BlossomError(\"blob descriptor missing sha256\");\n  }\n  const hash = assertHex32(raw.sha256, \"blob sha256\");\n  if (typeof raw.size !== \"number\" || !Number.isInteger(raw.size) || raw.size < 0) {\n    throw new BlossomError(\"blob descriptor missing size\");\n  }\n  const desc: BlobDescriptor = { url: raw.url, sha256: hash, size: raw.size };\n  if (typeof raw.type === \"string\") desc.type = raw.type;\n  if (typeof raw.uploaded === \"number\" && Number.isInteger(raw.uploaded) && raw.uploaded >= 0) {\n    desc.uploaded = raw.uploaded;\n  }\n  return desc;\n}\n\nfunction requireDescriptorHash(desc: BlobDescriptor, expected: string): BlobDescriptor {\n  if (desc.sha256 !== expected) {\n    throw new BlossomError(\"blob descriptor sha256 mismatch\");\n  }\n  return desc;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAiCA,MAAM,6BAAa,IAAI,IAAqB;CAAC;CAAU;CAAU;CAAQ;CAAO;AAAO,CAAC;;AAGxF,MAAM,uBAAuB;AAE7B,IAAa,eAAb,cAAkC,WAAW;CAC3C;CAEA,YAAY,SAAiB,SAA8C;EACzE,MAAM,EAAE,QAAQ,GAAG,SAAS,WAAW,CAAC;EACxC,MAAM,SAAS,IAAI;EACnB,KAAK,SAAS;CAChB;AACF;;AAGA,SAAgB,eAAe,KAAkC;CAC/D,IAAI;CACJ,IAAI;EACF,QAAQ,eAAe,MAAM,MAAM,IAAI,IAAI,GAAG,EAAA,CAAG;CACnD,QAAQ;EACN,OAAO;CACT;CACA,MAAM,UAAU,KAAK,MAAM,gBAAgB;CAC3C,IAAI,CAAC,SAAS,QAAQ,OAAO;CAC7B,OAAO,QAAQ,QAAQ,SAAS,EAAE,CAAE,YAAY;AAClD;AAEA,eAAsB,WAAW,MAAwD;CACvF,IAAI;CACJ,IAAI,gBAAgB,YAClB,QAAQ;MACH,IAAI,gBAAgB,aACzB,QAAQ,IAAI,WAAW,IAAI;MAE3B,QAAQ,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;CAEjD,OAAO,WAAW,OAAO,KAAK,CAAC;AACjC;;AAGA,eAAsB,WACpB,MACA,WACkB;CAClB,MAAM,WAAW,YAAY,WAAW,aAAa;CACrD,OAAQ,MAAM,WAAW,IAAI,MAAO;AACtC;;;;;AAMA,SAAgB,0BAA0B,OAAsB;CAC9D,OAAO,SAAS,eAAe,OAAO,YAAY,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC;AACjF;AAEA,SAAgB,mBACd,MACA,MACe;CACf,IAAI,CAAC,WAAW,IAAI,IAAI,GACtB,MAAM,IAAI,aAAa,8BAA8B,MAAM;CAE7D,MAAM,aAAa,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;CACvE,MAAM,OAAc,CAClB,CAAC,KAAK,IAAI,GACV,CAAC,cAAc,OAAO,UAAU,CAAC,CACnC;CACA,IAAI,MAAM,WAAW,KAAA,GACnB,KAAK,KAAK,CAAC,KAAK,YAAY,KAAK,QAAQ,aAAa,CAAC,CAAC;CAE1D,OAAO;EACL,MAAM,KAAK;EACX,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC;EACA,SAAS,MAAM,WAAW;CAC5B;AACF;AAEA,eAAsB,iBACpB,MACA,MACA,MACgB;CAEhB,OAAO,KAAK,mBAAmB,UAAU;EAAE,QAAQ,MADhC,WAAW,IAAI;EACuB,GAAG;CAAK,CAAC,CAAC;AACrE;AAEA,eAAsB,OACpB,QACA,MACA,MACA,MACyB;CACzB,MAAM,OAAO,MAAM,WAAW,IAAI;CAClC,MAAM,UAAkC;EACtC,eAAe,0BAA0B,IAAI;EAC7C,aAAa;CACf;CACA,IAAI,KAAK,MAAM,QAAQ,kBAAkB,KAAK;CAO9C,OAAO,sBAAsB,oBAAoB,MAAM,SAAS,MAN9C,eAAe,MAAM,OAAO,WAAW,QAAQ,SAAS,GAAG;EAC3E,QAAQ;EACR;EACA,MAAM;EACN,QAAQ,MAAM;CAChB,CAAC,CACkE,CAAC,GAAG,IAAI;AAC7E;AAEA,eAAsB,UACpB,QACA,QACA,MACA,MAC2B;CAC3B,MAAM,KAAK,YAAY,QAAQ,QAAQ;CACvC,MAAM,UAAkC,CAAC;CACzC,IAAI,MAAM,QAAQ,gBAAgB,0BAA0B,IAAI;CAChE,MAAM,MAAM,MAAM,eAAe,MAAM,OAAO,WAAW,QAAQ,SAAS,IAAI,GAAG;EAC/E,QAAQ;EACR;EACA,QAAQ,MAAM;CAChB,CAAC;CACD,MAAM,OAAO,MAAM,SAAS,GAAG;CAC/B,IAAI,CAAC,MAAM,QAAQ,IAAI,GACrB,MAAM,IAAI,aAAa,8CAA8C,EAAE,QAAQ,IAAI,OAAO,CAAC;CAE7F,OAAO,KAAK,IAAI,mBAAmB;AACrC;AAEA,eAAsB,WACpB,QACA,WACA,MACA,MACe;CACf,MAAM,OAAO,YAAY,WAAW,aAAa;CACjD,MAAM,eAAe,MAAM,OAAO,WAAW,QAAQ,IAAI,MAAM,GAAG;EAChE,QAAQ;EACR,SAAS,EAAE,eAAe,0BAA0B,IAAI,EAAE;EAC1D,QAAQ,MAAM;CAChB,CAAC;AACH;AAEA,eAAsB,WACpB,QACA,MACA,MACyB;CACzB,MAAM,OAAO,YAAY,KAAK,QAAQ,aAAa;CACnD,MAAM,UAAkC;EACtC,eAAe,0BAA0B,KAAK,IAAI;EAClD,gBAAgB;EAChB,aAAa;EACb,oBAAoB,OAAO,KAAK,IAAI;CACtC;CACA,IAAI,KAAK,MAAM,QAAQ,oBAAoB,KAAK;CAOhD,OAAO,sBAAsB,oBAAoB,MAAM,SAAS,MAN9C,eAAe,KAAK,OAAO,WAAW,QAAQ,SAAS,GAAG;EAC1E,QAAQ;EACR;EACA,MAAM,KAAK,UAAU,EAAE,KAAK,KAAK,IAAI,CAAC;EACtC,QAAQ,KAAK;CACf,CAAC,CACkE,CAAC,GAAG,IAAI;AAC7E;;AAGA,eAAsB,YACpB,QACA,MACA,MACA,MACe;CACf,MAAM,OAAO,MAAM,WAAW,IAAI;CAClC,MAAM,UAAkC;EACtC,eAAe,0BAA0B,IAAI;EAC7C,aAAa;EACb,oBAAoB,OAAO,KAAK,IAAI;CACtC;CACA,IAAI,KAAK,MAAM,QAAQ,oBAAoB,KAAK;CAChD,MAAM,eAAe,MAAM,OAAO,WAAW,QAAQ,SAAS,GAAG;EAC/D,QAAQ;EACR;EACA,QAAQ,MAAM;CAChB,CAAC;AACH;;AAGA,eAAsB,WACpB,QACA,WACA,MACkB;CAElB,MAAM,MAAM,WAAW,QAAQ,IADlB,YAAY,WAAW,aACE,GAAG;CACzC,MAAM,MAAM,MAAM,aAAa,MAAM,OAAO,KAAK;EAAE,QAAQ;EAAQ,QAAQ,MAAM;CAAO,CAAC;CACzF,IAAI,IAAI,WAAW,KAAK,OAAO;CAC/B,IAAI,IAAI,IAAI,OAAO;CACnB,MAAM,iBAAiB,QAAQ,KAAK,GAAG;AACzC;;AAGA,eAAsB,QACpB,QACA,WACA,MACqB;CACrB,MAAM,OAAO,YAAY,WAAW,aAAa;CACjD,MAAM,MAAM,WAAW,QAAQ,IAAI,MAAM;CACzC,MAAM,MAAM,MAAM,aAAa,MAAM,OAAO,KAAK;EAAE,QAAQ;EAAO,QAAQ,MAAM;CAAO,CAAC;CACxF,IAAI,CAAC,IAAI,IAAI,MAAM,iBAAiB,OAAO,KAAK,GAAG;CACnD,MAAM,QAAQ,IAAI,WAAW,MAAM,IAAI,YAAY,CAAC;CACpD,IAAI,CAAE,MAAM,WAAW,OAAO,IAAI,GAChC,MAAM,IAAI,aAAa,sBAAsB;CAE/C,OAAO;AACT;;;;;;AAOA,eAAsB,YACpB,KACA,SACA,MACiB;CACjB,MAAM,OAAO,eAAe,GAAG;CAC/B,IAAI,CAAC,MAAM,OAAO;CAElB,MAAM,MAAM,qBAAqB,KAAK,IAAI;CAC1C,MAAM,YAAY,MAAM,SAAS,mBAAmB,mBAAmB;CAEvE,MAAM,iBAAiB,MAAM,WAAW,WAAW,KAAK,MAAM,MAAM;CAEpE,IAAI,mBAAmB,KAAA,KAAa,kBAAkB,OAAO,iBAAiB,KAC5E,OAAO;CAGT,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,OAAO,aAAa,MAAM;EAChC,IAAI,CAAC,MAAM;EACX,MAAM,YAAY,GAAG,KAAK,GAAG,OAAO;EACpC,MAAM,SAAS,MAAM,WAAW,WAAW,WAAW,MAAM,MAAM;EAClE,IAAI,WAAW,KAAA,KAAa,UAAU,OAAO,SAAS,KAAK,OAAO;CACpE;CACA,OAAO;AACT;;AAGA,eAAsB,gBACpB,SACA,MACA,MACA,MACyB;CACzB,IAAI,QAAQ,WAAW,GACrB,MAAM,IAAI,aAAa,YAAY;CAErC,IAAI;CACJ,KAAK,MAAM,UAAU,SACnB,IAAI;EACF,OAAO,MAAM,OAAO,QAAQ,MAAM,MAAM,IAAI;CAC9C,SAAS,KAAK;EACZ,IAAI,aAAa,GAAG,GAAG,MAAM;EAC7B,OACE,eAAe,eACX,MACA,IAAI,aAAa,yBAAyB,EACxC,OAAO,eAAe,QAAQ,MAAM,KAAA,EACtC,CAAC;CACT;CAEF,MAAM,QAAQ,IAAI,aAAa,YAAY;AAC7C;AAEA,SAAgB,8BAA8B,SAA0C;CACtF,MAAM,OAAc,CAAC;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,OAAO,SAAS;EACzB,MAAM,MAAM,aAAa,GAAG;EAC5B,IAAI,CAAC,OAAO,KAAK,IAAI,GAAG,GAAG;EAC3B,KAAK,IAAI,GAAG;EACZ,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC;CAC3B;CACA,OAAO,IAAI,aAAa,KAAK,mBAAmB,EAAE,CAAC,CAAC,KAAK,IAAI;AAC/D;AAEA,SAAgB,uBAAuB,OAA+C;CACpF,IAAI,MAAM,SAAS,KAAK,mBACtB,MAAM,IAAI,qBAAqB,iBAAiB,KAAK,kBAAkB,QAAQ,MAAM,MAAM;CAE7F,MAAM,MAAgB,CAAC;CACvB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,OAAO,MAAM,MAAM;EAC5B,IAAI,IAAI,OAAO,YAAY,CAAC,IAAI,IAAI;EACpC,MAAM,MAAM,aAAa,IAAI,EAAE;EAC/B,IAAI,CAAC,OAAO,KAAK,IAAI,GAAG,GAAG;EAC3B,KAAK,IAAI,GAAG;EACZ,IAAI,KAAK,GAAG;CACd;CACA,OAAO;AACT;AAEA,SAAS,aAAa,KAAiC;CACrD,IAAI;EACF,MAAM,IAAI,IAAI,IAAI,GAAG;EACrB,IAAI,EAAE,aAAa,WAAW,EAAE,aAAa,UAAU,OAAO,KAAA;EAC9D,MAAM,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAAE;EAC1C,OAAO,GAAG,EAAE,SAAS;CACvB,QAAQ;EACN;CACF;AACF;;AAGA,SAAS,WAAW,QAAgB,MAAsB;CACxD,MAAM,OAAO,aAAa,MAAM;CAChC,IAAI,CAAC,MACH,MAAM,IAAI,aAAa,+BAA+B,QAAQ;CAGhE,OAAO,GAAG,OADK,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI;AAEnD;AAEA,SAAS,aAAa,KAAuB;CAC3C,OAAO,eAAe,SAAS,IAAI,SAAS;AAC9C;;AAGA,SAAS,qBAAqB,KAAa,MAAsB;CAC/D,IAAI;CACJ,IAAI;EACF,WAAW,IAAI,IAAI,GAAG,CAAC,CAAC;CAC1B,QAAQ;EACN,OAAO;CACT;CACA,MAAM,IAAI,SAAS,YAAY,CAAC,CAAC,YAAY,IAAI;CACjD,IAAI,IAAI,GAAG,OAAO;CAElB,OADU,SAAS,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,UAChC,CAAC,GAAG,MAAM;AACnB;AAEA,SAAS,sBAAoC;CAC3C,OAAO,IAAI,aAAa,oDAAoD;AAC9E;AAIA,SAAS,iBAAiB,QAAgB,KAAa,KAAmC;CACxF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,QAAQ,IAAI,UAAU,KAAK,KAAA;CAC1C,QAAQ;EACN,SAAS,KAAA;CACX;CACA,OAAO,IAAI,aAAa,QAAQ,KAAK,KAAK,WAAW,OAAO,GAAG,IAAI,WAAW,IAAI,OAAO,IAAI,EAC3F,QAAQ,IAAI,OACd,CAAC;AACH;AAEA,eAAe,aACb,WACA,KACA,MAMyB;CACzB,OAAO,YACL,aAAa,mBAAmB,mBAAmB,GACnD,KACA,OACC,QACC,IAAI,aAAa,WAAW,KAAK,OAAO,GAAG,IAAI,UAAU,EACvD,OAAO,eAAe,QAAQ,MAAM,KAAA,EACtC,CAAC,CACL;AACF;;AAGA,eAAe,WACb,WACA,KACA,QAC6B;CAC7B,IAAI;EAEF,QAAO,MADW,WAAW,WAAW,KAAK;GAAE,QAAQ;GAAQ;EAAO,CAAC,EAAA,CAC5D;CACb,SAAS,KAAK;EACZ,IAAI,aAAa,GAAG,GAAG,MAAM;EAC7B;CACF;AACF;AAEA,eAAe,eACb,WACA,KACA,MAMyB;CACzB,MAAM,MAAM,MAAM,aAAa,WAAW,KAAK,IAAI;CACnD,IAAI,IAAI,IAAI,OAAO;CACnB,MAAM,iBAAiB,KAAK,QAAQ,KAAK,GAAG;AAC9C;AAEA,eAAe,SAAS,KAAuC;CAC7D,IAAI;EACF,OAAO,MAAM,IAAI,KAAK;CACxB,SAAS,OAAO;EACd,MAAM,IAAI,aAAa,iCAAiC;GACtD,OAAO,iBAAiB,QAAQ,QAAQ,KAAA;GACxC,QAAQ,IAAI;EACd,CAAC;CACH;AACF;AAEA,SAAS,oBAAoB,MAA+B;CAC1D,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GACzD,MAAM,IAAI,aAAa,yBAAyB;CAElD,MAAM,MAAM;CACZ,IAAI,OAAO,IAAI,QAAQ,YAAY,CAAC,IAAI,KACtC,MAAM,IAAI,aAAa,6BAA6B;CAEtD,IAAI,OAAO,IAAI,WAAW,UACxB,MAAM,IAAI,aAAa,gCAAgC;CAEzD,MAAM,OAAO,YAAY,IAAI,QAAQ,aAAa;CAClD,IAAI,OAAO,IAAI,SAAS,YAAY,CAAC,OAAO,UAAU,IAAI,IAAI,KAAK,IAAI,OAAO,GAC5E,MAAM,IAAI,aAAa,8BAA8B;CAEvD,MAAM,OAAuB;EAAE,KAAK,IAAI;EAAK,QAAQ;EAAM,MAAM,IAAI;CAAK;CAC1E,IAAI,OAAO,IAAI,SAAS,UAAU,KAAK,OAAO,IAAI;CAClD,IAAI,OAAO,IAAI,aAAa,YAAY,OAAO,UAAU,IAAI,QAAQ,KAAK,IAAI,YAAY,GACxF,KAAK,WAAW,IAAI;CAEtB,OAAO;AACT;AAEA,SAAS,sBAAsB,MAAsB,UAAkC;CACrF,IAAI,KAAK,WAAW,UAClB,MAAM,IAAI,aAAa,iCAAiC;CAE1D,OAAO;AACT"}

package/dist/nips/nip04.d.mts

@@ -0,0 +1,8 @@
+//#region src/nips/nip04.d.ts
+/** Encrypt plaintext to a peer pubkey (NIP-04). */
+declare function encrypt(secretKey: string | Uint8Array, pubkey: string, text: string): string;
+/** Decrypt a NIP-04 payload from a peer pubkey. */
+declare function decrypt(secretKey: string | Uint8Array, pubkey: string, data: string): string;
+//#endregion
+export { decrypt, encrypt };
+//# sourceMappingURL=nip04.d.mts.map

package/dist/nips/nip04.mjs

@@ -0,0 +1,41 @@
+import { c as utf8Decoder, i as hexToBytes, l as utf8Encoder, t as assertHex32 } from "../util-6tfLQ9JF.mjs";
+import { t as CryptoError } from "../error-DZEs5OuZ.mjs";
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { cbc } from "@noble/ciphers/aes.js";
+import { randomBytes } from "@noble/hashes/utils.js";
+import { base64 } from "@scure/base";
+//#region src/nips/nip04.ts
+/**
+* NIP-04 legacy encrypted direct messages.
+* Prefer NIP-44 for new applications.
+*/
+function normalizeSharedSecret(privkey, pubkey) {
+	assertHex32(pubkey, "public key");
+	return secp256k1.getSharedSecret(privkey, hexToBytes("02" + pubkey.toLowerCase())).slice(1, 33);
+}
+function resolveSecret(secretKey) {
+	return typeof secretKey === "string" ? hexToBytes(assertHex32(secretKey, "secret key")) : secretKey;
+}
+/** Encrypt plaintext to a peer pubkey (NIP-04). */
+function encrypt(secretKey, pubkey, text) {
+	const normalizedKey = normalizeSharedSecret(resolveSecret(secretKey), pubkey);
+	const iv = randomBytes(16);
+	const plaintext = utf8Encoder.encode(text);
+	const ciphertext = cbc(normalizedKey, iv).encrypt(plaintext);
+	return `${base64.encode(ciphertext)}?iv=${base64.encode(iv)}`;
+}
+/** Decrypt a NIP-04 payload from a peer pubkey. */
+function decrypt(secretKey, pubkey, data) {
+	const privkey = resolveSecret(secretKey);
+	const parts = data.split("?iv=");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) throw new CryptoError("invalid NIP-04 payload: missing iv");
+	const normalizedKey = normalizeSharedSecret(privkey, pubkey);
+	const iv = base64.decode(parts[1]);
+	const ciphertext = base64.decode(parts[0]);
+	const plaintext = cbc(normalizedKey, iv).decrypt(ciphertext);
+	return utf8Decoder.decode(plaintext);
+}
+//#endregion
+export { decrypt, encrypt };
+
+//# sourceMappingURL=nip04.mjs.map

package/dist/nips/nip04.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"nip04.mjs","names":[],"sources":["../../src/nips/nip04.ts"],"sourcesContent":["/**\n * NIP-04 legacy encrypted direct messages.\n * Prefer NIP-44 for new applications.\n */\nimport { cbc } from \"@noble/ciphers/aes.js\";\nimport { secp256k1 } from \"@noble/curves/secp256k1.js\";\nimport { randomBytes } from \"@noble/hashes/utils.js\";\nimport { base64 } from \"@scure/base\";\nimport { CryptoError } from \"../core/error.ts\";\nimport { assertHex32, hexToBytes, utf8Decoder, utf8Encoder } from \"../core/util.ts\";\n\nfunction normalizeSharedSecret(privkey: Uint8Array, pubkey: string): Uint8Array {\n  assertHex32(pubkey, \"public key\");\n  const key = secp256k1.getSharedSecret(privkey, hexToBytes(\"02\" + pubkey.toLowerCase()));\n  return key.slice(1, 33);\n}\n\nfunction resolveSecret(secretKey: string | Uint8Array): Uint8Array {\n  return typeof secretKey === \"string\"\n    ? hexToBytes(assertHex32(secretKey, \"secret key\"))\n    : secretKey;\n}\n\n/** Encrypt plaintext to a peer pubkey (NIP-04). */\nexport function encrypt(secretKey: string | Uint8Array, pubkey: string, text: string): string {\n  const privkey = resolveSecret(secretKey);\n  const normalizedKey = normalizeSharedSecret(privkey, pubkey);\n  const iv = randomBytes(16);\n  const plaintext = utf8Encoder.encode(text);\n  const ciphertext = cbc(normalizedKey, iv).encrypt(plaintext);\n  return `${base64.encode(ciphertext)}?iv=${base64.encode(iv)}`;\n}\n\n/** Decrypt a NIP-04 payload from a peer pubkey. */\nexport function decrypt(secretKey: string | Uint8Array, pubkey: string, data: string): string {\n  const privkey = resolveSecret(secretKey);\n  const parts = data.split(\"?iv=\");\n  if (parts.length !== 2 || !parts[0] || !parts[1]) {\n    throw new CryptoError(\"invalid NIP-04 payload: missing iv\");\n  }\n  const normalizedKey = normalizeSharedSecret(privkey, pubkey);\n  const iv = base64.decode(parts[1]);\n  const ciphertext = base64.decode(parts[0]);\n  const plaintext = cbc(normalizedKey, iv).decrypt(ciphertext);\n  return utf8Decoder.decode(plaintext);\n}\n"],"mappings":";;;;;;;;;;;AAWA,SAAS,sBAAsB,SAAqB,QAA4B;CAC9E,YAAY,QAAQ,YAAY;CAEhC,OADY,UAAU,gBAAgB,SAAS,WAAW,OAAO,OAAO,YAAY,CAAC,CAC5E,CAAC,CAAC,MAAM,GAAG,EAAE;AACxB;AAEA,SAAS,cAAc,WAA4C;CACjE,OAAO,OAAO,cAAc,WACxB,WAAW,YAAY,WAAW,YAAY,CAAC,IAC/C;AACN;;AAGA,SAAgB,QAAQ,WAAgC,QAAgB,MAAsB;CAE5F,MAAM,gBAAgB,sBADN,cAAc,SACoB,GAAG,MAAM;CAC3D,MAAM,KAAK,YAAY,EAAE;CACzB,MAAM,YAAY,YAAY,OAAO,IAAI;CACzC,MAAM,aAAa,IAAI,eAAe,EAAE,CAAC,CAAC,QAAQ,SAAS;CAC3D,OAAO,GAAG,OAAO,OAAO,UAAU,EAAE,MAAM,OAAO,OAAO,EAAE;AAC5D;;AAGA,SAAgB,QAAQ,WAAgC,QAAgB,MAAsB;CAC5F,MAAM,UAAU,cAAc,SAAS;CACvC,MAAM,QAAQ,KAAK,MAAM,MAAM;CAC/B,IAAI,MAAM,WAAW,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,IAC5C,MAAM,IAAI,YAAY,oCAAoC;CAE5D,MAAM,gBAAgB,sBAAsB,SAAS,MAAM;CAC3D,MAAM,KAAK,OAAO,OAAO,MAAM,EAAE;CACjC,MAAM,aAAa,OAAO,OAAO,MAAM,EAAE;CACzC,MAAM,YAAY,IAAI,eAAe,EAAE,CAAC,CAAC,QAAQ,UAAU;CAC3D,OAAO,YAAY,OAAO,SAAS;AACrC"}

package/dist/nips/nip05.d.mts

@@ -0,0 +1,89 @@
+import { a as NostrError } from "../error-WEFS-R-4.mjs";
+import { f as ProfilePointer } from "../nip19-D7905oIv.mjs";
+import { t as ManualFetch } from "../http-6vevbBlu.mjs";
+//#region src/nips/nip05.d.ts
+/** Root local-part (`_@domain` rendered as just the domain). */
+declare const NIP05_ROOT_LOCAL = "_";
+declare const WELL_KNOWN_PATH = "/.well-known/nostr.json";
+/**
+ * NIP-05 identifier string.
+ * - Full: `name@domain`
+ * - Root: `domain` or `_@domain`
+ */
+type Nip05 = string;
+type Nip05Address = {
+  /** Local part (lowercased). `_` for domain-only identifiers. */
+  local: string;
+  /** Domain (lowercased). */
+  domain: string;
+};
+/**
+ * 46.md appendix discovery metadata (`{relays, nostrconnect_url}`).
+ * Not a bunker pointer.
+ */
+type Nip05Nip46 = {
+  relays?: string[];
+  nostrconnectUrl?: string;
+};
+type Nip05Document = {
+  names: Record<string, string>;
+  /** NIP-05 profile relay hints */
+  relays?: Record<string, string[]>;
+  nip46?: Nip05Nip46;
+};
+type Nip05Fetch = ManualFetch;
+declare class Nip05Error extends NostrError {
+  constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * Matches optional local@domain.
+ * Groups: 1=local (optional), 2=domain.
+ */
+declare const NIP05_REGEX: RegExp;
+declare function isNip05(value: unknown): value is string;
+/**
+ * Parse an identifier into local + domain.
+ * Accepts `name@domain`, `_@domain`, or bare `domain` (local becomes `_`).
+ */
+declare function parseNip05(input: string): Nip05Address;
+/** Build the well-known HTTPS URL for an address. */
+declare function wellKnownUrl(address: Nip05Address): string;
+/**
+ * Parse nostr.json `nip46`: 46.md appendix `{relays, nostrconnect_url}`.
+ * Hex-pubkey maps and other keys are ignored.
+ */
+declare function parseNip05Nip46(raw: unknown): Nip05Nip46 | undefined;
+/** Parse and validate a nostr.json document body. */
+declare function parseNip05Document(json: unknown): Nip05Document;
+/** Resolve local name from an already-parsed document. */
+declare function lookupFromDocument(doc: Nip05Document, address: Nip05Address): ProfilePointer | undefined;
+/**
+ * Fetch and parse `/.well-known/nostr.json`.
+ * Returns `null` on network/parse failure (does not throw for those).
+ * Rejects HTTP redirects (non-200) per NIP-05 security constraints.
+ * AbortError rethrows; it is not mapped to `null`.
+ */
+declare function queryNip05Document(identifier: string, opts?: {
+  fetch?: Nip05Fetch;
+  signal?: AbortSignal;
+}): Promise<{
+  address: Nip05Address;
+  doc: Nip05Document;
+} | null>;
+/**
+ * Query `/.well-known/nostr.json` for an identifier.
+ * Returns `null` on network/parse/lookup failure (does not throw for those).
+ * Profile `relays` only. `nip46` is discovery metadata, not a bunker pointer.
+ */
+declare function queryProfile(identifier: string, opts?: {
+  fetch?: Nip05Fetch;
+  signal?: AbortSignal;
+}): Promise<ProfilePointer | null>;
+/** True when the identifier resolves to exactly `pubkey`. */
+declare function verifyNip05(pubkey: string, identifier: string, opts?: {
+  fetch?: Nip05Fetch;
+  signal?: AbortSignal;
+}): Promise<boolean>;
+//#endregion
+export { NIP05_REGEX, NIP05_ROOT_LOCAL, Nip05, Nip05Address, Nip05Document, Nip05Error, Nip05Fetch, Nip05Nip46, WELL_KNOWN_PATH, isNip05, lookupFromDocument, parseNip05, parseNip05Document, parseNip05Nip46, queryNip05Document, queryProfile, verifyNip05, wellKnownUrl };
+//# sourceMappingURL=nip05.d.mts.map