feat(storage): Blossom Phase 0 — flag + vendored SDK + service skeleton (#30)

Phase 0 of docs/blossom-plan.md. No UX; off-by-default ("off = no trace").

- Vendored: pinned [email protected] bundled by scripts/build-blossom-sdk.mjs
  → vendor/blossom-client-sdk.bundle.min.js (esbuild, browser ESM, ~27KB). The
  optional @cashu/cashu-ts peer dep (BUD-07 payments, only reached on a lazy 402
  branch bitvid never hits) is aliased to a throwing stub. `npm run build:blossom-sdk`.
- Flag: FEATURE_BLOSSOM_STORAGE wired like FEATURE_AUDIO_INGEST / _BITCOIN_CONNECT
  (instance-config → config → constants), default FALSE.
- Service: js/services/blossomService.js implements the same
  uploadFile({…}) → {url,key} contract as s3UploadService (so a later
  isBlossomProvider branch drops into mediaUploader). Lazy-loads the SDK; core
  path = createUploadAuth(signer, sha256) + multiServerUpload (BUD-11 auth via
  bitvid's existing signer, BUD-04 mirror). Torrent parity + result-shape mapping +
  mediaUploader wiring + Storage-pane config land in Phase 1.

Tests: tests/blossom-service.test.mjs (5 — availability gate + input guards).
Lint + build clean. Nothing wired into the app yet.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

scripts/build-blossom-sdk.mjs

@@ -0,0 +1,51 @@
+// Bundles blossom-client-sdk into a single self-contained ESM file that bitvid
+// lazy-imports behind FEATURE_BLOSSOM_STORAGE (docs/blossom-plan.md, TODO #30).
+// Mirrors the bitcoin-connect / floating-ui vendor steps. Pinned via the exact
+// devDependency version in package.json.
+import { build } from "esbuild";
+import { mkdir, copyFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const entryPoint = path.join(repoRoot, "scripts/vendor/blossom-sdk-entry.mjs");
+const vendorDir = path.join(repoRoot, "vendor");
+const outFile = path.join(vendorDir, "blossom-client-sdk.bundle.min.js");
+const licenseSrc = path.join(
+  repoRoot,
+  "node_modules/blossom-client-sdk/LICENSE.txt",
+);
+const licenseOut = path.join(vendorDir, "blossom-client-sdk.LICENSE");
+
+await mkdir(vendorDir, { recursive: true });
+
+await build({
+  bundle: true,
+  entryPoints: [entryPoint],
+  outfile: outFile,
+  format: "esm",
+  splitting: false,
+  platform: "browser",
+  target: ["es2020"],
+  minify: true,
+  sourcemap: false,
+  define: {
+    "process.env.NODE_ENV": '"production"',
+    global: "globalThis",
+  },
+  // @cashu/cashu-ts is an OPTIONAL peer dep the SDK only lazy-imports on the
+  // BUD-07 payment branch (HTTP 402). bitvid uses free Blossom servers, so alias
+  // it to a throwing stub instead of pulling the dep.
+  alias: {
+    "@cashu/cashu-ts": path.join(repoRoot, "scripts/vendor/cashu-stub.mjs"),
+  },
+  logLevel: "info",
+});
+
+try {
+  await copyFile(licenseSrc, licenseOut);
+} catch (error) {
+  console.warn("[build-blossom-sdk] could not copy LICENSE:", error.message);
+}
+
+console.log("[build-blossom-sdk] wrote", path.relative(repoRoot, outFile));

scripts/vendor/blossom-sdk-entry.mjs

@@ -0,0 +1,25 @@
+// Vendor entry for blossom-client-sdk (hzrd149), bundled by
+// scripts/build-blossom-sdk.mjs into vendor/blossom-client-sdk.bundle.min.js so
+// bitvid can lazy-import it behind FEATURE_BLOSSOM_STORAGE without a runtime CDN.
+// Re-exports only the surface bitvid needs. See docs/blossom-plan.md.
+//
+// The action helpers live under the `./actions/*` subpaths (the root entry
+// namespaces them as `Actions`); auth + discovery are top-level modules.
+export {
+  createUploadAuth,
+  createMirrorAuth,
+  createListAuth,
+  encodeAuthorizationHeader,
+} from "blossom-client-sdk/auth";
+export {
+  getServersFromServerListEvent,
+  USER_BLOSSOM_SERVER_LIST_KIND,
+} from "blossom-client-sdk/nostr";
+export {
+  multiServerUpload,
+  multiServerMediaUpload,
+} from "blossom-client-sdk/actions/multi-server";
+export { uploadBlob } from "blossom-client-sdk/actions/upload";
+export { mirrorBlob } from "blossom-client-sdk/actions/mirror";
+export { listBlobs, iterateBlobs } from "blossom-client-sdk/actions/list";
+export { deleteBlob } from "blossom-client-sdk/actions/delete";

scripts/vendor/cashu-stub.mjs

@@ -0,0 +1,16 @@
+// Stub for the optional @cashu/cashu-ts peer dep, aliased in when bundling
+// blossom-client-sdk (scripts/build-blossom-sdk.mjs). The SDK only reaches for it
+// on the BUD-07 cashu-payment branch (a lazy `await import()` triggered by an HTTP
+// 402). bitvid targets free Blossom servers, so this never runs; the stubs throw
+// loudly if a payment-gated server is ever hit rather than silently misbehaving.
+function unsupported() {
+  throw new Error(
+    "Cashu payments (BUD-07) are not supported in the bitvid Blossom bundle",
+  );
+}
+
+export const getEncodedToken = unsupported;
+export const decodePaymentRequest = unsupported;
+export const getDecodedToken = unsupported;
+
+export default {};