Merge branch 'master' into rvagg/extra-capabilities

Author: hugomrdias

.github/release-please-manifest.json

@@ -1,5 +1,5 @@
 {
-  "packages/synapse-sdk": "0.40.0",
-  "packages/synapse-core": "0.3.1",
+  "packages/synapse-sdk": "0.40.1",
+  "packages/synapse-core": "0.3.2",
   "packages/synapse-react": "0.2.2"
 }

.github/workflows/add-issues-and-prs-to-fs-project-board.yml

@@ -15,7 +15,14 @@ on:
   issues:
     types:
       - opened
-  pull_request:
+  # Using "pull_request_target" instead of "pull_request" to support PRs from forks.
+  # pull_request_target has access to secrets even for fork PRs, which is necessary
+  # for this action to authenticate and add items to the project board.
+  # pull_request_target runs the workflow file from the base branch (main),
+  # not from the PR branch, so attackers cannot modify this workflow via PR.
+  # This action does not check out nor execute user code so we should be safe.
+  # We also hardcode to specific hash to ensure no unintended changes underneath us.
+  pull_request_target:
     types:
       - opened
 
@@ -24,7 +31,8 @@ jobs:
     name: Add all issues and prs to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+        continue-on-error: true # Don't fail if item already exists in project. actions/add-to-project does not currently handle this case gracefully.
         with:
           project-url: https://github.com/orgs/FilOzone/projects/14
           github-token: ${{ secrets.FILOZZY_CI_ADD_TO_PROJECT }}

.github/workflows/release-please.yml

@@ -19,8 +19,10 @@ jobs:
       - uses: googleapis/release-please-action@v4
         id: release
         with:
-          # needs to be personal token so release PRs can run workflows
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # PAT so release PRs trigger other workflows (auto-label, add-issues-and-prs-to-fs-project-board).
+          # This PAT has the permissions outlined in https://github.com/googleapis/release-please-action?tab=readme-ov-file#workflow-permissions.
+          # Using GITHUB_TOKEN suppresses follow-on workflow runs, which would mean release please PRs wouldn't get properly labeled and added to the project board.
+          token: ${{ secrets.FILOZZY_RELEASE_PLEASE_PAT }}
           config-file: .github/release-please-config.json
           manifest-file: .github/release-please-manifest.json
   npm:

packages/synapse-core/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.3.2](https://github.com/FilOzone/synapse-sdk/compare/synapse-core-v0.3.1...synapse-core-v0.3.2) (2026-03-30)
+
+
+### Bug Fixes
+
+* **core:** fall back to Blob fetch body when ReadableStream not supported ([#681](https://github.com/FilOzone/synapse-sdk/issues/681)) ([6142cc4](https://github.com/FilOzone/synapse-sdk/commit/6142cc4fa119b2e830c9217979ed52e780f3c1b6))
+
+
+### Chores
+
+* **abi:** update ABI for 1.2.0 filecoin-services release ([#688](https://github.com/FilOzone/synapse-sdk/issues/688)) ([0259413](https://github.com/FilOzone/synapse-sdk/commit/0259413b86dd31e09c7bbc5c0d2f93cf50daadd6))
+
 ## [0.3.1](https://github.com/FilOzone/synapse-sdk/compare/synapse-core-v0.3.0...synapse-core-v0.3.1) (2026-03-17)
 
 

packages/synapse-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@filoz/synapse-core",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "JavaScript Standard Library for Filecoin Onchain Cloud",
   "repository": {
     "type": "git",

packages/synapse-core/src/abis/generated.ts

@@ -3224,8 +3224,8 @@ export const filecoinWarmStorageServiceConfig = {
 //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 
 /**
- * - [__View Contract on Filecoin Mainnet Filfox__](https://filfox.info/en/address/0x638a4986332bF9B889E5D7435B966C5ecdE077Fa)
- * - [__View Contract on Filecoin Calibration Filscan__](https://calibration.filscan.io/address/0x53d235D474585EC102ccaB7e0cdcE951dD00f716)
+ * - [__View Contract on Filecoin Mainnet Filfox__](https://filfox.info/en/address/0xB1B3A3d979c1f233c1021EF98dff9c0932FF1bb9)
+ * - [__View Contract on Filecoin Calibration Filscan__](https://calibration.filscan.io/address/0x537320bd004a7FDd3c1932ca64BD88268301322A)
  */
 export const filecoinWarmStorageServiceStateViewAbi = [
   {
@@ -3522,17 +3522,17 @@ export const filecoinWarmStorageServiceStateViewAbi = [
 ] as const
 
 /**
- * - [__View Contract on Filecoin Mainnet Filfox__](https://filfox.info/en/address/0x638a4986332bF9B889E5D7435B966C5ecdE077Fa)
- * - [__View Contract on Filecoin Calibration Filscan__](https://calibration.filscan.io/address/0x53d235D474585EC102ccaB7e0cdcE951dD00f716)
+ * - [__View Contract on Filecoin Mainnet Filfox__](https://filfox.info/en/address/0xB1B3A3d979c1f233c1021EF98dff9c0932FF1bb9)
+ * - [__View Contract on Filecoin Calibration Filscan__](https://calibration.filscan.io/address/0x537320bd004a7FDd3c1932ca64BD88268301322A)
  */
 export const filecoinWarmStorageServiceStateViewAddress = {
-  314: '0x638a4986332bF9B889E5D7435B966C5ecdE077Fa',
-  314159: '0x53d235D474585EC102ccaB7e0cdcE951dD00f716',
+  314: '0xB1B3A3d979c1f233c1021EF98dff9c0932FF1bb9',
+  314159: '0x537320bd004a7FDd3c1932ca64BD88268301322A',
 } as const
 
 /**
- * - [__View Contract on Filecoin Mainnet Filfox__](https://filfox.info/en/address/0x638a4986332bF9B889E5D7435B966C5ecdE077Fa)
- * - [__View Contract on Filecoin Calibration Filscan__](https://calibration.filscan.io/address/0x53d235D474585EC102ccaB7e0cdcE951dD00f716)
+ * - [__View Contract on Filecoin Mainnet Filfox__](https://filfox.info/en/address/0xB1B3A3d979c1f233c1021EF98dff9c0932FF1bb9)
+ * - [__View Contract on Filecoin Calibration Filscan__](https://calibration.filscan.io/address/0x537320bd004a7FDd3c1932ca64BD88268301322A)
  */
 export const filecoinWarmStorageServiceStateViewConfig = {
   address: filecoinWarmStorageServiceStateViewAddress,

packages/synapse-core/src/sp/sp.ts

@@ -17,7 +17,7 @@ import type { PieceCID } from '../piece/piece.ts'
 import * as Piece from '../piece/piece.ts'
 import type * as TypedData from '../typed-data/index.ts'
 import { RETRY_CONSTANTS, SIZE_CONSTANTS } from '../utils/constants.ts'
-import { isUint8Array } from '../utils/streams.ts'
+import { isUint8Array, supportsStreamingFetchBody } from '../utils/streams.ts'
 
 export namespace createDataSet {
   /**
@@ -319,7 +319,7 @@ export async function uploadPieceStreaming(
     ? new Blob([options.data as Uint8Array<ArrayBuffer>]).stream()
     : (options.data as ReadableStream) // ReadableStream types dont match between browsers and Node.js
 
-  const size = isUint8Array(options.data) ? options.data.length : options.size
+  let size = isUint8Array(options.data) ? options.data.length : options.size
 
   // Add size tracking and progress reporting
   let bytesUploaded = 0
@@ -363,19 +363,48 @@ export async function uploadPieceStreaming(
     ? dataStream.pipeThrough(trackingStream).pipeThrough(pieceCidStream)
     : dataStream.pipeThrough(trackingStream)
 
-  // PUT /pdp/piece/uploads/{uuid} with streaming body
+  // Determine fetch body: stream it directly when the environment supports
+  // ReadableStream as a request body (Chrome, Node.js), otherwise drain the
+  // pipeline into a Blob first (Firefox, Safari). Draining still runs the
+  // full TransformStream chain so CommP calculation and progress tracking
+  // both execute regardless of path.
+  let fetchBody: ReadableStream | Blob
+  let fetchOptions: Record<string, string> = {}
+
+  if (supportsStreamingFetchBody()) {
+    fetchBody = bodyStream
+    fetchOptions = { duplex: 'half' }
+  } else {
+    const chunks: Uint8Array[] = []
+    let totalSize = 0
+    const reader = bodyStream.getReader()
+    for (;;) {
+      const { done, value } = await reader.read()
+      if (done) break
+      chunks.push(value)
+      totalSize += value.length
+    }
+    fetchBody = new Blob(chunks as BlobPart[])
+    // Override Content-Length with the actual accumulated size since we now
+    // know it precisely, even for ReadableStream inputs without a pre-set size
+    if (size == null) {
+      size = totalSize
+    }
+  }
+
+  // PUT /pdp/piece/uploads/{uuid}
   const headers: Record<string, string> = {
     'Content-Type': 'application/octet-stream',
     ...(size != null ? { 'Content-Length': size.toString() } : {}),
   }
 
   const uploadResponse = await request.put(new URL(`pdp/piece/uploads/${uploadUuid}`, options.serviceURL), {
-    body: bodyStream,
+    body: fetchBody,
     headers,
     timeout: false, // No timeout for streaming upload
     signal: options.signal,
-    duplex: 'half', // Required for streaming request bodies
-  } as Parameters<typeof request.put>[1] & { duplex: 'half' })
+    ...fetchOptions,
+  } as Parameters<typeof request.put>[1] & { duplex?: 'half' })
 
   if (uploadResponse.error) {
     if (HttpError.is(uploadResponse.error)) {

packages/synapse-core/src/utils/streams.ts

@@ -121,3 +121,38 @@ export async function* uint8ArrayToAsyncIterable(
 export function isUint8Array(value: unknown): value is Uint8Array {
   return value instanceof Uint8Array || (ArrayBuffer.isView(value) && value.constructor.name === 'Uint8Array')
 }
+
+let _supportsStreamBody: boolean | undefined
+
+/**
+ * Detect whether the current environment supports ReadableStream as a fetch
+ * request body. Firefox stringifies the stream to "[object ReadableStream]"
+ * instead of consuming it, and Safari silently ignores the stream body and
+ * the duplex option. This check catches both: a browser that stringifies will
+ * set Content-Type to text/plain (string body), and one that ignores duplex
+ * will fail the duplexAccessed gate. The try/catch handles any future browser
+ * that throws on the Request constructor.
+ *
+ * Result is memoized after the first call.
+ *
+ * @see https://developer.chrome.com/docs/capabilities/web-apis/fetch-streaming-requests
+ * @see https://bugzilla.mozilla.org/show_bug.cgi?id=1387483
+ */
+export function supportsStreamingFetchBody(): boolean {
+  if (_supportsStreamBody !== undefined) return _supportsStreamBody
+  try {
+    let duplexAccessed = false
+    const hasContentType = new Request('', {
+      body: new ReadableStream(),
+      method: 'POST',
+      get duplex() {
+        duplexAccessed = true
+        return 'half'
+      },
+    } as RequestInit).headers.has('Content-Type')
+    _supportsStreamBody = duplexAccessed && !hasContentType
+  } catch {
+    _supportsStreamBody = false
+  }
+  return _supportsStreamBody
+}

packages/synapse-sdk/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.40.1](https://github.com/FilOzone/synapse-sdk/compare/synapse-sdk-v0.40.0...synapse-sdk-v0.40.1) (2026-03-30)
+
+
+### Bug Fixes
+
+* installation instructions ([#692](https://github.com/FilOzone/synapse-sdk/issues/692)) ([966a389](https://github.com/FilOzone/synapse-sdk/commit/966a3898391435eaf581be23e23dfed88162020b))
+* **storage:** trim provider resolver & pass all erorrs through ([#702](https://github.com/FilOzone/synapse-sdk/issues/702)) ([02a0fc6](https://github.com/FilOzone/synapse-sdk/commit/02a0fc638f7ef00a5194601022e3f44fcd779ffd))
+
 ## [0.40.0](https://github.com/FilOzone/synapse-sdk/compare/synapse-sdk-v0.39.0...synapse-sdk-v0.40.0) (2026-03-17)
 
 

packages/synapse-sdk/README.md

@@ -33,10 +33,10 @@ The SDK handles all the complexity of blockchain interactions, provider selectio
 ## Installation
 
 ```bash
-pnpm install @filoz/synapse-sdk ethers
+pnpm install @filoz/synapse-sdk viem
 ```
 
-Note: `ethers` v6 is a peer dependency and must be installed separately.
+Note: `viem` is a peer dependency and must be installed separately.
 
 ## Docs