nostr-bray 2.3.0 → 2.4.0

package/dist/bunker.js

@@ -86,11 +86,33 @@ export function startBunker(opts) {
             case 'get_public_key':
                 result = ctx.activePublicKeyHex;
                 break;
-            case 'sign_event': {
-                const template = JSON.parse(request.params[0]);
+            // `sign_event_compact` is the Heartwood dialect, and Bray speaks it so a
+            // client does not have to keep two code paths or waste a round trip
+            // discovering it is unsupported.
+            //
+            // Two differences from NIP-46, both about not moving the event around as
+            // a string. params[0] may be the event OBJECT rather than a stringified
+            // event, which spares a signer an unescape pass costing twice the content
+            // in one allocation; and the compact reply returns only what the client
+            // cannot work out itself. On a hardware signer those two copies are the
+            // difference between a 12 KB and an 18 KB ceiling. Bray has no such
+            // limit, but matching the dialect keeps clients simple.
+            case 'sign_event':
+            case 'sign_event_compact': {
+                // Declared string[], but that was always a claim about the client
+                // rather than a guarantee, and here it is genuinely either.
+                const raw = request.params[0];
+                const template = (typeof raw === 'string' ? JSON.parse(raw) : raw);
                 const sign = ctx.getSigningFunction();
                 const signed = await sign(template);
-                result = JSON.stringify(signed);
+                result = request.method === 'sign_event_compact'
+                    ? JSON.stringify({
+                        id: signed.id,
+                        pubkey: signed.pubkey,
+                        created_at: signed.created_at,
+                        sig: signed.sig,
+                    })
+                    : JSON.stringify(signed);
                 break;
             }
             case 'nip04_encrypt': {

package/dist/cli/commands/identity.js

@@ -18,11 +18,25 @@ export async function dispatch(cmd, cmdArgs, h, ctx, pool) {
         case 'persona':
             out(await ctx.derivePersona(req(1, 'persona <name> [index]'), parseInt(cmdArgs[2] ?? '0', 10)));
             break;
-        case 'switch':
-            await ctx.switch(req(1, 'switch <target> [index]'), cmdArgs[2] ? parseInt(cmdArgs[2], 10) : undefined);
-            console.error(`Now signing as ${ctx.activeNpub}`);
+        case 'switch': {
+            const target = req(1, 'switch <target> [index]');
+            await ctx.switch(target, cmdArgs[2] ? parseInt(cmdArgs[2], 10) : undefined);
+            // Name the derivation path, not just the npub. A bare name means the
+            // persona path, so `switch work` and `derive work` are different keys;
+            // without the path on screen the difference is invisible until something
+            // has been signed by the wrong identity.
+            console.error(`Now signing as ${ctx.activeNpub} (${ctx.activePurpose})`);
+            if (target !== 'master' && !target.includes(':') && ctx.activePurpose === `persona/${target}`) {
+                console.error(`Note: "${target}" resolved to the persona path. The raw purpose ` +
+                    `"${target}" is a different key — see \`derive ${target}\`.`);
+            }
+            // The CLI is one process per command, so this applies to the rest of this
+            // invocation only. Say so rather than implying a saved default.
+            console.error('This switch applies to this command only; use --key or --bunker to sign as');
+            console.error('another identity in a later command.');
             console.log(ctx.activeNpub);
             break;
+        }
         case 'prove':
             out(await handleIdentityProve(ctx, { mode: (cmdArgs[1] === 'full' ? 'full' : 'blind') }));
             break;

package/dist/context.d.ts

@@ -13,6 +13,8 @@ export declare class IdentityContext implements ExtendedSigningContext {
     constructor(secretKey: string, format: 'nsec' | 'hex' | 'mnemonic', opts?: ContextOptions);
     /** Current active identity's npub (bech32) */
     get activeNpub(): string;
+    /** Derivation path of the current active identity, for reporting to a human */
+    get activePurpose(): string;
     /** Current active identity's hex public key — use this in relay filters */
     get activePublicKeyHex(): string;
     /** Derive a child identity by purpose and index */

package/dist/context.js

@@ -55,6 +55,10 @@ export class IdentityContext {
     get activeNpub() {
         return this.activeEntry.identity.npub;
     }
+    /** Derivation path of the current active identity, for reporting to a human */
+    get activePurpose() {
+        return this.activeEntry.purpose;
+    }
     /** Current active identity's hex public key — use this in relay filters */
     get activePublicKeyHex() {
         return Buffer.from(this.activeEntry.identity.publicKey).toString('hex');

package/dist/social/blossom.d.ts

@@ -8,6 +8,7 @@ export interface BlobDescriptor {
     type?: string;
     uploaded?: number;
 }
+export declare function detectContentType(body: Uint8Array): string | undefined;
 /** Upload a file to a blossom media server */
 export declare function handleBlossomUpload(ctx: SigningContext, args: {
     server: string;

package/dist/social/blossom.js

@@ -5,6 +5,36 @@ import { validatePublicUrl } from '../validation.js';
 // fetch. Keeps an attacker-chosen source from amplifying nostr-bray into a
 // megabyte-scale Blossom relay.
 const MAX_UPLOAD = 100 * 1024 * 1024;
+// Blossom servers sniff the body and reject a mismatched Content-Type, so
+// `application/octet-stream` fails for any format they recognise. Detect from
+// the leading bytes rather than the file name: the bytes are what the server
+// checks, and an uploader should not be able to mislabel a blob by renaming it.
+const MAGIC = [
+    { type: 'image/png', test: (b) => b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47 },
+    { type: 'image/jpeg', test: (b) => b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff },
+    { type: 'image/gif', test: (b) => b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 },
+    {
+        type: 'image/webp',
+        test: (b) => b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 &&
+            b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50,
+    },
+    { type: 'application/pdf', test: (b) => b[0] === 0x25 && b[1] === 0x50 && b[2] === 0x44 && b[3] === 0x46 },
+    { type: 'image/svg+xml', test: (b) => Buffer.from(b.subarray(0, 256)).toString('utf8').includes('<svg') },
+];
+export function detectContentType(body) {
+    if (body.byteLength < 4)
+        return undefined;
+    for (const { type, test } of MAGIC) {
+        try {
+            if (test(body))
+                return type;
+        }
+        catch {
+            // a short or odd buffer simply does not match this signature
+        }
+    }
+    return undefined;
+}
 /** Upload a file to a blossom media server */
 export async function handleBlossomUpload(ctx, args) {
     validatePublicUrl(args.server);
@@ -44,7 +74,7 @@ export async function handleBlossomUpload(ctx, args) {
         method: 'PUT',
         headers: {
             Authorization: authHeader,
-            'Content-Type': args.contentType ?? 'application/octet-stream',
+            'Content-Type': args.contentType ?? detectContentType(body) ?? 'application/octet-stream',
         },
         body: Buffer.from(body),
         signal: AbortSignal.timeout(30_000),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "mcpName": "dev.forgesworn/bray",
   "description": "Trust-aware Nostr for AI and humans. Three dimensions of trust -- verification, proximity, and access -- woven into every interaction.",
   "type": "module",