@coldai/clip-wallet-media-client

Decides what an untrusted NFT media URL may become. Shared by the wallet UI (to build proxy URLs) and the media proxy service (to re-validate them), so both sides agree. Pure functions, no I/O.

• Sources: https, http, ipfs:// and ar://; public gateway URLs are rewritten to ipfs:// / ar://.
• Never: data:, blob:, javascript:, file:, credentials in URLs, odd ports, private, loopback, link-local or reserved addresses (in any spelling), IPv6 literals, single-label and special-use names. parseHost() reads a host the way fetch does; isBlockedHost() compares it as an address or by labels, never as a string.
• Output: raster images, sandboxed SVG, mp4/webm video, within MEDIA_LIMITS.

Pre-release: Clip Wallet runs on test networks only and has had no external audit.

Install

npm i @coldai/clip-wallet-media-client

Example

import { mediaProxyUrl } from "@coldai/clip-wallet-media-client";

// null = show a placeholder and fetch nothing.
const media = mediaProxyUrl("https://media.example.com", "ipfs://bafybeigdyrzt5sfp7udm7hu76uh7y26nf3efuylqabf3oclgtqy55fbzdi/1.png");
console.log(media); // { kind: "image", src: "https://media.example.com/v1/media?src=ipfs%3A%2F%2F…&kind=image" }

Without a configured proxy (services.mediaProxyUrl in clip.config.ts) the wallet fetches nothing remote.

Documentation

• Media proxy
• API reference

Versioning and provenance

Published from ColdAI-org/clip-wallet by CI with npm provenance: every tarball is signed and traceable to the commit that built it (npm audit signatures checks it). All @coldai/clip-wallet-* packages share one version; pin it exactly.

Licence

Apache-2.0: see LICENSE and NOTICE. "Clip Wallet" and "1Mask" are ColdAI trademarks (not licensed).