nostr-bray 2.2.0 → 2.3.0

package/dist/cli/index.js

@@ -61,6 +61,7 @@ if (command === 'serve' && !args.includes('--help')) {
         quiet: args.includes('--quiet'),
         auth: args.includes('--auth') || args.includes('--eager-auth'),
         eagerAuth: args.includes('--eager-auth'),
+        blossom: args.includes('--blossom'),
     });
     console.error(`nostr-bray test relay running at ${relayServer.url}`);
     console.error('Press Ctrl+C to stop');
@@ -245,7 +246,7 @@ MuSig2 (BIP-327 multi-signature):
 
 Modes:
   (no command)                        Start MCP server (stdio)
-  serve [--port N] [--events file] [--auth] [--eager-auth]  Start in-memory test relay
+  serve [--port N] [--events file] [--auth] [--eager-auth] [--blossom]  Start in-memory test relay
                                       (--auth requires NIP-42; --eager-auth also challenges on connect)
   bunker connect <bunker://…>              Save remote bunker URI for future commands
   bunker authorize <hex-pubkey>           Pre-authorise an app pubkey on the local bunker

package/dist/serve.d.ts

@@ -19,6 +19,13 @@ export interface ServeOptions {
     auth?: boolean;
     /** Send the AUTH challenge on connect rather than waiting for a rejection. */
     eagerAuth?: boolean;
+    /**
+     * Serve Blossom blob endpoints (BUD-01/02) alongside the relay.
+     *
+     * bray has ten blossom tools but no way to exercise them without a real
+     * blossom server, the same gap `--auth` closed for NIP-42.
+     */
+    blossom?: boolean;
 }
 export declare function startRelay(opts?: ServeOptions): {
     url: string;

package/dist/serve.js

@@ -7,7 +7,7 @@
 import { WebSocketServer, WebSocket } from 'ws';
 import { createServer } from 'node:http';
 import { readFileSync } from 'node:fs';
-import { randomBytes } from 'node:crypto';
+import { randomBytes, createHash } from 'node:crypto';
 import { verifyEvent } from 'nostr-tools/pure';
 let subCounter = 0;
 /** Check if an event matches a single filter */
@@ -64,12 +64,137 @@ function checkAuthEvent(event, challenge) {
         return 'auth event timestamp too far from now';
     return undefined;
 }
+const SHA256_PATH = /^\/([0-9a-f]{64})(\.[a-z0-9]+)?$/i;
+const LIST_PATH = /^\/list\/([0-9a-f]{64})$/i;
+/** 10 MiB, matching what the client refuses to send. */
+const MAX_BLOB = 10 * 1024 * 1024;
+/** Does this URL belong to the Blossom surface rather than the relay? */
+function isBlossomRequest(url) {
+    const path = url.split('?')[0];
+    return path === '/upload' || SHA256_PATH.test(path) || LIST_PATH.test(path);
+}
+/**
+ * Check a BUD-01 `Authorization: Nostr <base64 kind 24242>` header.
+ *
+ * Returns the uploader pubkey, or a reason to reject. The `t` and `x` tags are
+ * both checked: without `x` an upload authorisation could be replayed to
+ * delete a different blob, which is the whole point of binding it to a hash.
+ */
+function checkBlossomAuth(header, action, sha256) {
+    if (!header?.startsWith('Nostr '))
+        return { error: 'missing Nostr authorization header' };
+    let event;
+    try {
+        event = JSON.parse(Buffer.from(header.slice(6), 'base64').toString('utf8'));
+    }
+    catch {
+        return { error: 'authorization header is not base64-encoded JSON' };
+    }
+    if (event.kind !== 24242)
+        return { error: `expected kind 24242, got ${event.kind}` };
+    if (!verifyEvent(event))
+        return { error: 'invalid signature' };
+    const t = event.tags?.find(tag => tag[0] === 't')?.[1];
+    if (t !== action)
+        return { error: `authorization is for "${t}", not "${action}"` };
+    const expiration = event.tags?.find(tag => tag[0] === 'expiration')?.[1];
+    if (expiration && Number(expiration) < Math.floor(Date.now() / 1000)) {
+        return { error: 'authorization expired' };
+    }
+    if (sha256) {
+        const x = event.tags?.filter(tag => tag[0] === 'x').map(tag => tag[1]) ?? [];
+        if (!x.includes(sha256))
+            return { error: 'authorization does not name this blob hash' };
+    }
+    return { pubkey: event.pubkey };
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (c) => {
+            size += c.length;
+            if (size > MAX_BLOB) {
+                reject(new Error(`blob exceeds ${MAX_BLOB} bytes`));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks)));
+        req.on('error', reject);
+    });
+}
+/** Serve BUD-01/02: PUT /upload, GET|HEAD /<sha256>, GET /list/<pubkey>, DELETE /<sha256>. */
+async function serveBlossom(req, res, blobs, hostname, log) {
+    const path = (req.url ?? '/').split('?')[0];
+    const port = (req.socket.localPort ?? 0);
+    const base = `http://${hostname}:${port}`;
+    const json = (code, body) => {
+        res.writeHead(code, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(body));
+    };
+    try {
+        if (path === '/upload' && req.method === 'PUT') {
+            const body = await readBody(req);
+            const sha256 = createHash('sha256').update(body).digest('hex');
+            const auth = checkBlossomAuth(req.headers.authorization, 'upload', sha256);
+            if ('error' in auth)
+                return json(401, { message: auth.error });
+            const type = req.headers['content-type'] ?? 'application/octet-stream';
+            const uploaded = Math.floor(Date.now() / 1000);
+            blobs.set(sha256, { data: body, type: String(type), uploader: auth.pubkey, uploaded });
+            log(`blossom: stored ${sha256.slice(0, 12)}… (${body.length} bytes)`);
+            return json(200, { url: `${base}/${sha256}`, sha256, size: body.length, type, uploaded });
+        }
+        const listMatch = LIST_PATH.exec(path);
+        if (listMatch && req.method === 'GET') {
+            const pubkey = listMatch[1].toLowerCase();
+            const owned = [...blobs.entries()]
+                .filter(([, b]) => b.uploader === pubkey)
+                .map(([sha256, b]) => ({ url: `${base}/${sha256}`, sha256, size: b.data.length, type: b.type, uploaded: b.uploaded }));
+            return json(200, owned);
+        }
+        const blobMatch = SHA256_PATH.exec(path);
+        if (blobMatch) {
+            const sha256 = blobMatch[1].toLowerCase();
+            const blob = blobs.get(sha256);
+            if (req.method === 'GET' || req.method === 'HEAD') {
+                if (!blob)
+                    return json(404, { message: 'blob not found' });
+                res.writeHead(200, { 'Content-Type': blob.type, 'Content-Length': String(blob.data.length) });
+                res.end(req.method === 'HEAD' ? undefined : blob.data);
+                return;
+            }
+            if (req.method === 'DELETE') {
+                const auth = checkBlossomAuth(req.headers.authorization, 'delete', sha256);
+                if ('error' in auth)
+                    return json(401, { message: auth.error });
+                if (!blob)
+                    return json(404, { message: 'blob not found' });
+                // Only the uploader may delete, otherwise anyone could clear the store
+                if (blob.uploader !== auth.pubkey)
+                    return json(403, { message: 'not the uploader of this blob' });
+                blobs.delete(sha256);
+                log(`blossom: deleted ${sha256.slice(0, 12)}…`);
+                return json(200, { message: 'deleted' });
+            }
+        }
+        json(405, { message: `method ${req.method} not allowed on ${path}` });
+    }
+    catch (e) {
+        json(400, { message: e.message });
+    }
+}
 export function startRelay(opts = {}) {
     const hostname = opts.hostname ?? 'localhost';
     const port = opts.port ?? 10547;
     const quiet = opts.quiet ?? false;
     const requireAuth = opts.auth ?? false;
     const eagerAuth = opts.eagerAuth ?? false;
+    const enableBlossom = opts.blossom ?? false;
+    /** sha256 -> blob. In memory, like the event store. */
+    const blobs = new Map();
     const log = quiet ? () => { } : (...args) => console.error('[relay]', ...args);
     // The bundled test relay has no auth and accepts arbitrary signed events.
     // Binding it to anything other than loopback exposes a writable Nostr endpoint
@@ -95,6 +220,10 @@ export function startRelay(opts = {}) {
         log(`Loaded ${events.size} events from ${opts.eventsFile}`);
     }
     const httpServer = createServer((req, res) => {
+        if (enableBlossom && isBlossomRequest(req.url ?? '/')) {
+            void serveBlossom(req, res, blobs, hostname, log);
+            return;
+        }
         // NIP-11 relay info document
         if (req.headers.accept?.includes('application/nostr+json')) {
             res.writeHead(200, { 'Content-Type': 'application/nostr+json' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "mcpName": "dev.forgesworn/bray",
   "description": "Trust-aware Nostr for AI and humans. Three dimensions of trust -- verification, proximity, and access -- woven into every interaction.",
   "type": "module",