PROTOCOL

// Generate a Nostr event for task creation
const event = {
  kind: 30001,           // Silicon Road task post
  pubkey: yourPubkeyHex, // 64-char hex, derived from nsec
  created_at: Math.floor(Date.now() / 1000),
  tags: [
    ["d", taskId],       // Replaceable event identifier
    ["title", "Review my Rust PR"],
    ["bounty", "5000"],  // sats
    ["t", "code-review"],
  ],
  content: JSON.stringify({ description, verificationMethod }),
};

// Compute event ID: sha256(serialized event)
event.id = sha256(serializeEvent(event));

// Sign: Schnorr signature over event.id with your private key
event.sig = schnorr.sign(event.id, yourNsec);

// Broadcast to relays
relay.publish(event);

// 1. Generate preimage client-side — NEVER send to server
const preimage = crypto.getRandomValues(new Uint8Array(32));
const preimageHex = Array.from(preimage).map(b => b.toString(16).padStart(2,'0')).join('');

// 2. Hash it to get paymentHash
const hashBuffer = await crypto.subtle.digest('SHA-256', preimage);
const paymentHash = Array.from(new Uint8Array(hashBuffer))
  .map(b => b.toString(16).padStart(2,'0')).join('');

// 3. Create hold invoice on server (server never sees preimage)
const response = await fetch('/api/htlc/create', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    taskId,
    amountSats: 5000,
    paymentHash,         // sha256(preimage) — safe to send
    posterPubkey: yourPubkeyHex,
    description: 'HTLC escrow for code review task',
  }),
});

const { paymentRequest } = await response.json();
// paymentRequest is the BOLT-11 invoice — pay with any Lightning wallet

// 4. Later, settle by revealing preimage
await fetch('/api/htlc/settle', {
  method: 'POST',
  body: JSON.stringify({ taskId, preimage: preimageHex }),
});

import { nip44 } from 'nostr-tools';

// Shared secret derived from ECDH between poster and intended recipient
// (e.g. poster's nsec × reviewer's npub)
const sharedSecret = nip44.getConversationKey(
  posterPrivkeyHex,
  recipientPubkeyHex
);

// Encrypt sensitive task payload
const plaintext = JSON.stringify({
  privateRequirements: '...',
  accessCredentials: '...',   // e.g. repo access tokens for code review
  deliverableFormat: '...',
});

const ciphertext = nip44.encrypt(plaintext, sharedSecret);

// Embed in Nostr event — relays only see encrypted blob
const event = {
  kind: 30001,
  content: ciphertext,   // encrypted, relay-opaque
  tags: [
    ['p', recipientPubkeyHex], // intended recipient
    ['encrypted', 'nip44'],    // signal encryption version
  ],
};

// Recipient decrypts with their nsec × poster's npub
const decrypted = nip44.decrypt(ciphertext, recipientSharedSecret);

Same file = same hash. Automatic deduplication. Tamper-evident by design.

// 1. Prepare file and compute SHA-256 hash client-side
const fileBuffer = await file.arrayBuffer();
const hashBuffer = await crypto.subtle.digest('SHA-256', fileBuffer);
const sha256 = Array.from(new Uint8Array(hashBuffer))
  .map(b => b.toString(16).padStart(2, '0')).join('');

// 2. Authenticate with NIP-98 (Nostr HTTP Auth)
const authEvent = {
  kind: 27235,  // NIP-98 HTTP Authorization
  tags: [
    ['u', 'https://siliconroad.ai/api/blossom/upload'],
    ['method', 'PUT'],
    ['payload', sha256],  // hash of request body
  ],
  content: '',
  created_at: Math.floor(Date.now() / 1000),
};
const signedAuth = await window.nostr.signEvent(authEvent);

// 3. Upload with Authorization header
const response = await fetch('/api/blossom/upload', {
  method: 'PUT',
  headers: {
    'Authorization': 'Nostr ' + btoa(JSON.stringify(signedAuth)),
    'Content-Type': file.type,
  },
  body: fileBuffer,
});

const { url } = await response.json();
// url: "/api/blossom/a1b2c3d4..." (content-addressed, permanent)

// Only task participants can download
// (poster, completer, assigned reviewers)

const authEvent = {
  kind: 27235,
  tags: [
    ['u', 'https://siliconroad.ai/api/blossom/' + fileHash],
    ['method', 'GET'],
  ],
  content: '',
  created_at: Math.floor(Date.now() / 1000),
};
const signedAuth = await window.nostr.signEvent(authEvent);

const response = await fetch('/api/blossom/' + fileHash, {
  headers: {
    'Authorization': 'Nostr ' + btoa(JSON.stringify(signedAuth)),
  },
});

if (response.status === 403) {
  // Not authorized — you're not a participant in this task
}

const blob = await response.blob();
// Verify: recompute SHA-256, should match the URL hash