Blossom specifications
Blossom is defined by a set of BUDs (Blossom Upgrade Documents). This page lists which BUDs Almond implements. Deviations from the spec text are documented in detail under Spec deviations.
Support matrix
| BUD | Title | Almond | Notes |
|---|---|---|---|
| 00 | Blossom Upgrade Documents | – | Meta document |
| 01 | Server requirements and blob retrieval | ✅ | GET/HEAD /<sha256>[.ext], range requests, ETag, Sunset. Operator routes are not CORS-public, and redirect targets are not checked for the required headers (deviations). |
| 02 | Blob upload and management | ✅ | PUT /upload, plus the chunked upload extension and the X-Expiration header |
| 03 | User Server List | ✅ | Client-side spec. Almond reads the ?as= author's kind 10063 list for upstream lookups. |
| 04 | Mirroring blobs | ✅ | PUT /mirror. Mirroring an HLS playlist also mirrors its segments. No MIME sniffing when the origin omits Content-Type. |
| 05 | Media optimization | ❌ | /media is not routed |
| 06 | Upload requirements | ✅ | HEAD /upload |
| 07 | Payment required | ⚠️ | Cashu, behind the cashu feature. The 402 challenge is not NUT-24 creqA, and an insufficient payment returns 402 instead of 400. |
| 08 | Nostr File Metadata Tags | ✅ | Blob descriptors carry nip94 |
| 09 | Blob Report | ⚠️ | PUT /report, off by default. Public mode accepts reports without an x tag, and no report rules are published. |
| 10 | Blossom URI Schema | – | Client-side only |
| 11 | Nostr Authorization | ✅ | Kind 24242 events; server tag optionally required (ALMOND_AUTH_REQUIRE_SERVER_TAG). Single-use authorizations for delete. |
| 12 | Blob management endpoints | ⚠️ | /list with cursor pagination and DELETE. /list/<pubkey> is not per-uploader, and deleting an absent blob returns 204. |
✅ implemented · ⚠️ implemented with deviations · ❌ not implemented · – not applicable to servers
Almond extensions
| Extension | Description |
|---|---|
| Chunked uploads | Resumable PATCH /upload in parts |
| Blob discovery filter | GET /filter lets clients check existence locally with Binary Fuse filters, without revealing hashes |
| Filter JS decoding | How clients decode and query the /filter response |
X-Expiration | Lets a client shorten its own upload's lifetime |
| Local Blossom Cache | Implements the upstream local cache profile |