@blink-authority-com/claude-code-plugin 1.0.0

package/dist/tools/lint.js

@@ -0,0 +1,323 @@
+/**
+ * blink_lint tool handler.
+ *
+ * Analyses code for BLINK integration best practices using
+ * regex/pattern matching (no AST). Supports 8 rules.
+ */
+// ---------------------------------------------------------------------------
+// Helper: find line number for a match index
+// ---------------------------------------------------------------------------
+function lineOfIndex(code, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < code.length; i++) {
+        if (code[i] === '\n')
+            line++;
+    }
+    return line;
+}
+// ---------------------------------------------------------------------------
+// Helper: check if a position is inside a try block (approximate)
+// ---------------------------------------------------------------------------
+function isInsideTry(code, index) {
+    // Look backwards from index for 'try' followed by '{' before any '}'
+    const before = code.substring(0, index);
+    const lastTry = before.lastIndexOf('try');
+    if (lastTry === -1)
+        return false;
+    const afterTry = before.substring(lastTry);
+    const braceOpen = afterTry.indexOf('{');
+    if (braceOpen === -1)
+        return false;
+    // Count braces between try's { and our index
+    let depth = 0;
+    for (let i = lastTry + braceOpen; i < index; i++) {
+        if (code[i] === '{')
+            depth++;
+        if (code[i] === '}')
+            depth--;
+    }
+    return depth > 0;
+}
+// ---------------------------------------------------------------------------
+// Rule definitions
+// ---------------------------------------------------------------------------
+const RULES = [
+    // Rule 1: no-shutdown-handler
+    {
+        id: 'no-shutdown-handler',
+        severity: 'error',
+        check(lines, code) {
+            const hasConnect = /BlinkSigner\.connect/i.test(code);
+            const hasSigint = /process\.on\s*\(\s*['"]SIGINT['"]/i.test(code);
+            const hasSigterm = /process\.on\s*\(\s*['"]SIGTERM['"]/i.test(code);
+            if (hasConnect && !hasSigint && !hasSigterm) {
+                const match = code.match(/BlinkSigner\.connect/i);
+                const line = match ? lineOfIndex(code, match.index) : 1;
+                return [{
+                        rule: 'no-shutdown-handler',
+                        severity: 'error',
+                        line,
+                        message: 'BlinkSigner.connect() is called but no SIGINT/SIGTERM handler calls signer.close(). ' +
+                            'The BSEC connection will leak on process exit.',
+                        suggestion: 'Add process.on("SIGINT", async () => { await signer.close(); process.exit(0); }) ' +
+                            'and the same for SIGTERM.',
+                    }];
+            }
+            return [];
+        },
+    },
+    // Rule 2: signer-after-close
+    {
+        id: 'signer-after-close',
+        severity: 'error',
+        check(lines, code) {
+            const findings = [];
+            // Look for .close() followed by .sign( in the same scope
+            const closePattern = /\.close\s*\(\s*\)/g;
+            let closeMatch;
+            while ((closeMatch = closePattern.exec(code)) !== null) {
+                const afterClose = code.substring(closeMatch.index + closeMatch[0].length);
+                const signMatch = afterClose.match(/\.sign\s*\(/);
+                if (signMatch) {
+                    // Check they're not in different functions (rough heuristic: no function/=> between them)
+                    const between = afterClose.substring(0, signMatch.index);
+                    const hasFuncBoundary = /(?:function\s|=>\s*\{|async\s+function)/.test(between);
+                    if (!hasFuncBoundary) {
+                        findings.push({
+                            rule: 'signer-after-close',
+                            severity: 'error',
+                            line: lineOfIndex(code, closeMatch.index),
+                            message: 'signer.sign() is called after signer.close() in what appears to be the same scope. ' +
+                                'The signer connection is no longer active.',
+                            suggestion: 'Move the sign() call before close(), or create a new connection.',
+                        });
+                    }
+                }
+            }
+            return findings;
+        },
+    },
+    // Rule 3: envelope-not-base64
+    {
+        id: 'envelope-not-base64',
+        severity: 'warning',
+        check(lines, code) {
+            const findings = [];
+            const pattern = /toString\s*\(\s*['"]hex['"]\s*\)/g;
+            let match;
+            while ((match = pattern.exec(code)) !== null) {
+                // Check if "envelope" is mentioned nearby (within 200 chars before)
+                const before = code.substring(Math.max(0, match.index - 200), match.index);
+                if (/envelope/i.test(before)) {
+                    findings.push({
+                        rule: 'envelope-not-base64',
+                        severity: 'warning',
+                        line: lineOfIndex(code, match.index),
+                        message: 'Envelope appears to be converted to hex instead of base64. ' +
+                            'BLINK envelopes should be transmitted as base64.',
+                        suggestion: 'Use .toString("base64") instead of .toString("hex") for envelope encoding.',
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+    // Rule 4: no-sign-error-handling
+    {
+        id: 'no-sign-error-handling',
+        severity: 'warning',
+        check(lines, code) {
+            const findings = [];
+            const pattern = /\.sign\s*\(/g;
+            let match;
+            while ((match = pattern.exec(code)) !== null) {
+                // Skip if it's part of 'assign' or 'design' etc.
+                const charBefore = match.index > 0 ? code[match.index - 1] : '';
+                if (/[a-zA-Z]/.test(charBefore))
+                    continue;
+                if (!isInsideTry(code, match.index)) {
+                    findings.push({
+                        rule: 'no-sign-error-handling',
+                        severity: 'warning',
+                        line: lineOfIndex(code, match.index),
+                        message: 'signer.sign() is called without a try/catch block. Signing can fail due to ' +
+                            'network issues, expired sessions, or invalid slots.',
+                        suggestion: 'Wrap the sign() call in a try/catch block and handle BSEC errors gracefully.',
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+    // Rule 5: vrf-key-not-cached
+    {
+        id: 'vrf-key-not-cached',
+        severity: 'warning',
+        check(lines, code) {
+            const findings = [];
+            const pattern = /vrfPublicKey\s*\(\s*\)/g;
+            let match;
+            while ((match = pattern.exec(code)) !== null) {
+                // Check if inside a route/request handler (look for app.get, app.post, router., req, res nearby)
+                const before = code.substring(Math.max(0, match.index - 500), match.index);
+                const isInHandler = /(?:app\.\w+\s*\(|router\.\w+\s*\(|req\s*,\s*res|request\s*,\s*response)/i.test(before);
+                if (isInHandler) {
+                    findings.push({
+                        rule: 'vrf-key-not-cached',
+                        severity: 'warning',
+                        line: lineOfIndex(code, match.index),
+                        message: 'vrfPublicKey() is called inside what appears to be a request handler. ' +
+                            'This makes a round-trip to BSEC on every request.',
+                        suggestion: 'Cache the VRF public key at startup: const vrfKey = await signer.vrfPublicKey(); ' +
+                            'Then use the cached value in request handlers.',
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+    // Rule 6: algorithm-not-explicit
+    {
+        id: 'algorithm-not-explicit',
+        severity: 'info',
+        check(lines, code) {
+            const findings = [];
+            const pattern = /BlinkSigner\.connect\s*\([^)]*\)/g;
+            let match;
+            while ((match = pattern.exec(code)) !== null) {
+                const argsStr = match[0];
+                // Count commas to estimate number of arguments
+                const commas = (argsStr.match(/,/g) || []).length;
+                // Also check if AlgoSuiteId is mentioned
+                const hasAlgo = /AlgoSuiteId|algorithm|algo/i.test(argsStr);
+                if (commas < 2 && !hasAlgo) {
+                    findings.push({
+                        rule: 'algorithm-not-explicit',
+                        severity: 'info',
+                        line: lineOfIndex(code, match.index),
+                        message: 'BlinkSigner.connect() is called without an explicit algorithm suite. ' +
+                            'The default (Ed25519) will be used.',
+                        suggestion: 'Consider specifying the algorithm explicitly: ' +
+                            'BlinkSigner.connect(url, token, AlgoSuiteId.Ed25519) for clarity.',
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+    // Rule 7: tls-reject-unhandled
+    {
+        id: 'tls-reject-unhandled',
+        severity: 'warning',
+        check(lines, code) {
+            const findings = [];
+            const pattern = /BlinkSigner\.connect\s*\(\s*['"`]https:\/\//g;
+            let match;
+            while ((match = pattern.exec(code)) !== null) {
+                const hasTlsVar = /NODE_TLS_REJECT_UNAUTHORIZED/i.test(code);
+                const hasTlsOption = /rejectUnauthorized|tlsOptions|tls:/i.test(code);
+                if (!hasTlsVar && !hasTlsOption) {
+                    findings.push({
+                        rule: 'tls-reject-unhandled',
+                        severity: 'warning',
+                        line: lineOfIndex(code, match.index),
+                        message: 'Connecting to BSEC over HTTPS but no TLS certificate handling is visible. ' +
+                            'Self-signed BSEC certificates will cause connection failures.',
+                        suggestion: 'For self-signed BSEC certificates, set NODE_TLS_REJECT_UNAUTHORIZED="0" ' +
+                            'in development or provide a CA certificate bundle.',
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+    // Rule 8: sync-in-signing-path
+    {
+        id: 'sync-in-signing-path',
+        severity: 'warning',
+        check(lines, code) {
+            const findings = [];
+            const hasSign = /\.sign\s*\(/g.test(code);
+            if (!hasSign)
+                return [];
+            const syncPattern = /(?:readFileSync|writeFileSync|execSync|accessSync)\s*\(/g;
+            let match;
+            while ((match = syncPattern.exec(code)) !== null) {
+                findings.push({
+                    rule: 'sync-in-signing-path',
+                    severity: 'warning',
+                    line: lineOfIndex(code, match.index),
+                    message: `Synchronous operation "${match[0].replace('(', '')}" found in a file that also uses signer.sign(). ` +
+                        'Synchronous I/O blocks the event loop and can cause BSEC timeouts.',
+                    suggestion: 'Use async alternatives (readFile, writeFile, exec) to avoid blocking the event loop.',
+                });
+            }
+            return findings;
+        },
+    },
+];
+// ---------------------------------------------------------------------------
+// Handler
+// ---------------------------------------------------------------------------
+export function handleLint(args) {
+    const code = args.code;
+    // language arg accepted but rules currently target JS/TS patterns
+    // const language = ((args.language as string) || 'typescript').toLowerCase();
+    if (!code || typeof code !== 'string' || code.trim() === '') {
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: 'Missing or empty "code" parameter. Provide source code to analyse.',
+                    }),
+                }],
+        };
+    }
+    const lines = code.split('\n');
+    const allFindings = [];
+    for (const rule of RULES) {
+        try {
+            const findings = rule.check(lines, code);
+            allFindings.push(...findings);
+        }
+        catch {
+            // Rule failed — skip silently
+        }
+    }
+    // Sort by severity (error > warning > info), then by line
+    const severityOrder = { error: 0, warning: 1, info: 2 };
+    allFindings.sort((a, b) => {
+        const sevDiff = severityOrder[a.severity] - severityOrder[b.severity];
+        if (sevDiff !== 0)
+            return sevDiff;
+        return a.line - b.line;
+    });
+    // Summary
+    const errors = allFindings.filter((f) => f.severity === 'error').length;
+    const warnings = allFindings.filter((f) => f.severity === 'warning').length;
+    const infos = allFindings.filter((f) => f.severity === 'info').length;
+    let summary;
+    if (allFindings.length === 0) {
+        summary = 'No BLINK integration issues found. Code follows best practices.';
+    }
+    else {
+        const parts = [];
+        if (errors > 0)
+            parts.push(`${errors} error${errors > 1 ? 's' : ''}`);
+        if (warnings > 0)
+            parts.push(`${warnings} warning${warnings > 1 ? 's' : ''}`);
+        if (infos > 0)
+            parts.push(`${infos} info${infos > 1 ? 's' : ''}`);
+        summary = `Found ${allFindings.length} issue${allFindings.length > 1 ? 's' : ''}: ${parts.join(', ')}.`;
+        if (errors > 0) {
+            summary += ' Fix errors first — they indicate likely runtime failures.';
+        }
+    }
+    return {
+        content: [{
+                type: 'text',
+                text: JSON.stringify({ findings: allFindings, summary }, null, 2),
+            }],
+    };
+}
+//# sourceMappingURL=lint.js.map

package/dist/tools/lint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint.js","sourceRoot":"","sources":["../../src/tools/lint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAC9E,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAC9E,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnC,6CAA6C;IAC7C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,OAAO,GAAG,SAAS,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAC9E,MAAM,KAAK,GAAe;IACxB,8BAA8B;IAC9B;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,OAAO;QACjB,KAAK,CAAC,KAAe,EAAE,IAAY;YACjC,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClE,MAAM,UAAU,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpE,IAAI,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,CAAC;wBACN,IAAI,EAAE,qBAAqB;wBAC3B,QAAQ,EAAE,OAAO;wBACjB,IAAI;wBACJ,OAAO,EACL,sFAAsF;4BACtF,gDAAgD;wBAClD,UAAU,EACR,mFAAmF;4BACnF,2BAA2B;qBAC9B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;KACF;IAED,6BAA6B;IAC7B;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,OAAO;QACjB,KAAK,CAAC,KAAe,EAAE,IAAY;YACjC,MAAM,QAAQ,GAAkB,EAAE,CAAC;YACnC,yDAAyD;YACzD,MAAM,YAAY,GAAG,oBAAoB,CAAC;YAC1C,IAAI,UAAkC,CAAC;YAEvC,OAAO,CAAC,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBAClD,IAAI,SAAS,EAAE,CAAC;oBACd,0FAA0F;oBAC1F,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;oBACzD,MAAM,eAAe,GAAG,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAChF,IAAI,CAAC,eAAe,EAAE,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,oBAAoB;4BAC1B,QAAQ,EAAE,OAAO;4BACjB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC;4BACzC,OAAO,EACL,qFAAqF;gCACrF,4CAA4C;4BAC9C,UAAU,EACR,kEAAkE;yBACrE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,8BAA8B;IAC9B;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,SAAS;QACnB,KAAK,CAAC,KAAe,EAAE,IAAY;YACjC,MAAM,QAAQ,GAAkB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,mCAAmC,CAAC;YACpD,IAAI,KAA6B,CAAC;YAElC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,oEAAoE;gBACpE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3E,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,qBAAqB;wBAC3B,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;wBACpC,OAAO,EACL,6DAA6D;4BAC7D,kDAAkD;wBACpD,UAAU,EAAE,4EAA4E;qBACzF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,iCAAiC;IACjC;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,SAAS;QACnB,KAAK,CAAC,KAAe,EAAE,IAAY;YACjC,MAAM,QAAQ,GAAkB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,cAAc,CAAC;YAC/B,IAAI,KAA6B,CAAC;YAElC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,iDAAiD;gBACjD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;oBAAE,SAAS;gBAE1C,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,wBAAwB;wBAC9B,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;wBACpC,OAAO,EACL,6EAA6E;4BAC7E,qDAAqD;wBACvD,UAAU,EACR,8EAA8E;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,6BAA6B;IAC7B;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,SAAS;QACnB,KAAK,CAAC,KAAe,EAAE,IAAY;YACjC,MAAM,QAAQ,GAAkB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,yBAAyB,CAAC;YAC1C,IAAI,KAA6B,CAAC;YAElC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,iGAAiG;gBACjG,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3E,MAAM,WAAW,GAAG,0EAA0E,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE5G,IAAI,WAAW,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;wBACpC,OAAO,EACL,wEAAwE;4BACxE,mDAAmD;wBACrD,UAAU,EACR,mFAAmF;4BACnF,gDAAgD;qBACnD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,iCAAiC;IACjC;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,MAAM;QAChB,KAAK,CAAC,KAAe,EAAE,IAAY;YACjC,MAAM,QAAQ,GAAkB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,mCAAmC,CAAC;YACpD,IAAI,KAA6B,CAAC;YAElC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,+CAA+C;gBAC/C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAClD,yCAAyC;gBACzC,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAE5D,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,wBAAwB;wBAC9B,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;wBACpC,OAAO,EACL,uEAAuE;4BACvE,qCAAqC;wBACvC,UAAU,EACR,gDAAgD;4BAChD,mEAAmE;qBACtE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,+BAA+B;IAC/B;QACE,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,SAAS;QACnB,KAAK,CAAC,KAAe,EAAE,IAAY;YACjC,MAAM,QAAQ,GAAkB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,8CAA8C,CAAC;YAC/D,IAAI,KAA6B,CAAC;YAElC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,MAAM,SAAS,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7D,MAAM,YAAY,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEtE,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;oBAChC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,sBAAsB;wBAC5B,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;wBACpC,OAAO,EACL,4EAA4E;4BAC5E,+DAA+D;wBACjE,UAAU,EACR,0EAA0E;4BAC1E,oDAAoD;qBACvD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IAED,+BAA+B;IAC/B;QACE,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,SAAS;QACnB,KAAK,CAAC,KAAe,EAAE,IAAY;YACjC,MAAM,QAAQ,GAAkB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;YAExB,MAAM,WAAW,GAAG,0DAA0D,CAAC;YAC/E,IAAI,KAA6B,CAAC;YAElC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;oBACpC,OAAO,EACL,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,kDAAkD;wBACrG,oEAAoE;oBACtE,UAAU,EACR,sFAAsF;iBACzF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;CACF,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CACxB,IAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0B,CAAC;IAC7C,kEAAkE;IAClE,8EAA8E;IAE9E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,oEAAoE;qBAC5E,CAAC;iBACH,CAAC;SACH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAkB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,aAAa,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAChF,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,UAAU;IACV,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEtE,IAAI,OAAe,CAAC;IACpB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,GAAG,iEAAiE,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,WAAW,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,SAAS,WAAW,CAAC,MAAM,SAAS,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACxG,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,IAAI,4DAA4D,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;aAClE,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/tools/scaffold.d.ts

@@ -0,0 +1,11 @@
+/**
+ * blink_scaffold tool handler.
+ * Dispatches to the appropriate template generator based on the requested template.
+ */
+export declare function handleScaffold(args: Record<string, unknown>): {
+    content: Array<{
+        type: string;
+        text: string;
+    }>;
+};
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/tools/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/tools/scaffold.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAmDpD"}

package/dist/tools/scaffold.js

@@ -0,0 +1,84 @@
+/**
+ * blink_scaffold tool handler.
+ * Dispatches to the appropriate template generator based on the requested template.
+ */
+import { generateExpressApi } from '../templates/express-api.js';
+import { generateCliTool } from '../templates/cli-tool.js';
+import { generateNotary } from '../templates/notary.js';
+import { generateAuditTrail } from '../templates/audit-trail.js';
+import { generateApprovalWorkflow } from '../templates/approval-workflow.js';
+const TEMPLATE_GENERATORS = {
+    'express-api': generateExpressApi,
+    'cli-tool': generateCliTool,
+    'notary': generateNotary,
+    'audit-trail': generateAuditTrail,
+    'approval-workflow': generateApprovalWorkflow,
+};
+const TEMPLATE_INSTRUCTIONS = {
+    'express-api': '1. Run `npm install`\n' +
+        '2. Copy `.env.example` to `.env` and configure your BSEC connection\n' +
+        '3. Run `npm run dev` to start the development server\n' +
+        '4. Add your API routes in `src/server.ts` — all JSON responses will be auto-signed',
+    'cli-tool': '1. Run `npm install`\n' +
+        '2. Run `npm run build && npm link` to install globally\n' +
+        '3. Use `<name> sign -f <file>` to sign a file\n' +
+        '4. Use `<name> verify -f <file> -e <envelope> -k <key>` to verify',
+    'notary': '1. Run `npm install`\n' +
+        '2. Copy `.env.example` to `.env` and configure your BSEC connection\n' +
+        '3. Run `npm run dev`\n' +
+        '4. POST a file to `/notarize` to get a notarization certificate',
+    'audit-trail': '1. Run `npm install`\n' +
+        '2. Copy `.env.example` to `.env` and configure your BSEC connection\n' +
+        '3. Run `npm run dev`\n' +
+        '4. POST to `/entries` to create hash-chained audit entries',
+    'approval-workflow': '1. Run `npm install`\n' +
+        '2. Copy `.env.example` to `.env` and configure your BSEC connection\n' +
+        '3. Run `npm run dev`\n' +
+        '4. POST to `/requests` to create an approval request, then POST to `/requests/:id/approve`',
+};
+export function handleScaffold(args) {
+    const template = String(args.template ?? '');
+    const name = String(args.name ?? '');
+    const features = args.features ?? ['graceful-shutdown', 'health-check'];
+    if (!template || !TEMPLATE_GENERATORS[template]) {
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: `Unknown template: "${template}". Valid templates: ${Object.keys(TEMPLATE_GENERATORS).join(', ')}`,
+                    }),
+                }],
+        };
+    }
+    if (!name) {
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify({ error: 'Missing required parameter: name' }),
+                }],
+        };
+    }
+    const generator = TEMPLATE_GENERATORS[template];
+    const filesMap = generator(name, features);
+    // Convert Record<string, string> to the expected file array format
+    const files = Object.entries(filesMap).map(([path, content]) => ({
+        path,
+        content,
+    }));
+    const instructions = (TEMPLATE_INSTRUCTIONS[template] ?? '')
+        .replace(/<name>/g, name);
+    const response = {
+        files,
+        instructions,
+        template,
+        name,
+        features,
+    };
+    return {
+        content: [{
+                type: 'text',
+                text: JSON.stringify(response, null, 2),
+            }],
+    };
+}
+//# sourceMappingURL=scaffold.js.map

package/dist/tools/scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/tools/scaffold.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,MAAM,mBAAmB,GAAiF;IACxG,aAAa,EAAE,kBAAkB;IACjC,UAAU,EAAE,eAAe;IAC3B,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,kBAAkB;IACjC,mBAAmB,EAAE,wBAAwB;CAC9C,CAAC;AAEF,MAAM,qBAAqB,GAA2B;IACpD,aAAa,EACX,wBAAwB;QACxB,uEAAuE;QACvE,wDAAwD;QACxD,oFAAoF;IACtF,UAAU,EACR,wBAAwB;QACxB,0DAA0D;QAC1D,iDAAiD;QACjD,mEAAmE;IACrE,QAAQ,EACN,wBAAwB;QACxB,uEAAuE;QACvE,wBAAwB;QACxB,iEAAiE;IACnE,aAAa,EACX,wBAAwB;QACxB,uEAAuE;QACvE,wBAAwB;QACxB,4DAA4D;IAC9D,mBAAmB,EACjB,wBAAwB;QACxB,uEAAuE;QACvE,wBAAwB;QACxB,4FAA4F;CAC/F,CAAC;AAEF,MAAM,UAAU,cAAc,CAC5B,IAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAI,IAAI,CAAC,QAAiC,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;IAElG,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,sBAAsB,QAAQ,uBAAuB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC1G,CAAC;iBACH,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;iBACpE,CAAC;SACH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE3C,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI;QACJ,OAAO;KACR,CAAC,CAAC,CAAC;IAEJ,MAAM,YAAY,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;SACzD,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5B,MAAM,QAAQ,GAAG;QACf,KAAK;QACL,YAAY;QACZ,QAAQ;QACR,IAAI;QACJ,QAAQ;KACT,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;aACxC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/tools/sign-test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * blink_sign_test tool handler.
+ *
+ * Live signing against a BSEC instance (connected mode).
+ * Requires --bsec-url and --bsec-token CLI arguments.
+ */
+import { PluginBsecClient } from '../bsec-client.js';
+type ToolResult = {
+    content: Array<{
+        type: string;
+        text: string;
+    }>;
+    isError?: boolean;
+};
+export declare function handleSignTest(args: Record<string, unknown>, bsecClient: PluginBsecClient | null): ToolResult | Promise<ToolResult>;
+export {};
+//# sourceMappingURL=sign-test.d.ts.map

package/dist/tools/sign-test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-test.d.ts","sourceRoot":"","sources":["../../src/tools/sign-test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAmB,MAAM,mBAAmB,CAAC;AAOtE,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAKxF,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAClC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAgDlC"}

package/dist/tools/sign-test.js

@@ -0,0 +1,126 @@
+/**
+ * blink_sign_test tool handler.
+ *
+ * Live signing against a BSEC instance (connected mode).
+ * Requires --bsec-url and --bsec-token CLI arguments.
+ */
+import { BsecClientError } from '../bsec-client.js';
+import { createHash } from 'crypto';
+// ---------------------------------------------------------------------------
+// Handler
+// ---------------------------------------------------------------------------
+export function handleSignTest(args, bsecClient) {
+    // Gate: connected mode required
+    if (!bsecClient) {
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: 'Connected mode not configured',
+                        help: [
+                            'To enable live BSEC signing, start the plugin with:',
+                            '  --bsec-url https://your-bsec-instance:8443',
+                            '  --bsec-token YOUR_SESSION_TOKEN',
+                            '',
+                            'Example Claude Code config (settings.json):',
+                            '{',
+                            '  "mcpServers": {',
+                            '    "blink": {',
+                            '      "command": "npx",',
+                            '      "args": [',
+                            '        "@blink-authority-com/claude-code-plugin",',
+                            '        "--bsec-url", "https://localhost:8443",',
+                            '        "--bsec-token", "your-session-token"',
+                            '      ]',
+                            '    }',
+                            '  }',
+                            '}',
+                        ].join('\n'),
+                    }, null, 2),
+                }],
+            isError: true,
+        };
+    }
+    const payload = args.payload;
+    if (!payload || typeof payload !== 'string' || payload.trim() === '') {
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify({ error: 'Missing or empty "payload" parameter.' }),
+                }],
+            isError: true,
+        };
+    }
+    const algorithm = args.algorithm || 'ed25519';
+    const algoSuiteId = algorithm.toLowerCase().includes('ml-dsa') ? 2 : 1;
+    return doSign(bsecClient, payload, algoSuiteId, algorithm);
+}
+// ---------------------------------------------------------------------------
+// Async signing
+// ---------------------------------------------------------------------------
+async function doSign(client, payload, algoSuiteId, algorithm) {
+    const timestamp = new Date().toISOString();
+    const domainInput = `test:${timestamp}`;
+    // Hash the payload (SHA-256)
+    const payloadHash = createHash('sha256').update(payload, 'utf-8').digest('hex');
+    const payloadBuffer = Buffer.from(payloadHash, 'hex');
+    const startMs = Date.now();
+    let result;
+    try {
+        result = await client.vrfCompositeSign(payloadBuffer, domainInput, algoSuiteId);
+    }
+    catch (err) {
+        const msg = err instanceof BsecClientError
+            ? `BSEC returned status ${err.status}`
+            : 'Failed to connect to BSEC instance';
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: msg,
+                        help: 'Ensure the BSEC instance is running and the session token is valid.',
+                    }),
+                }],
+            isError: true,
+        };
+    }
+    const elapsedMs = Date.now() - startMs;
+    // Build the envelope
+    const envelope = {
+        signature: result.signature,
+        ephemeral_public_key: result.ephemeral_public_key,
+        vrf_proof: result.vrf_proof,
+        p_derive: result.p_derive,
+        domain_input: result.domain_input,
+        timestamp,
+        algorithm,
+        payload_hash: payloadHash,
+        algo_suite_id: result.algo_suite_id,
+    };
+    const envelopeB64 = Buffer.from(JSON.stringify(envelope)).toString('base64');
+    const response = {
+        warning: 'Data was sent to an external BSEC instance for signing.',
+        envelope_base64: envelopeB64,
+        envelope_decoded: envelope,
+        timing: {
+            elapsed_ms: elapsedMs,
+            timestamp,
+        },
+        field_explanations: {
+            signature: 'The Ed25519/ML-DSA digital signature over the payload hash, created by the ephemeral key.',
+            ephemeral_public_key: 'One-time public key derived from the VRF. Destroyed after signing.',
+            vrf_proof: 'Verifiable Random Function proof linking P_derive to the ephemeral key.',
+            p_derive: 'Persistent VRF public key (P_derive). Used to verify the proof chain.',
+            domain_input: 'Context string binding the signature to a specific purpose and time.',
+            payload_hash: 'SHA-256 hash of the original payload that was signed.',
+            algo_suite_id: '1 = Ed25519, 2 = ML-DSA-44 (post-quantum).',
+        },
+    };
+    return {
+        content: [{
+                type: 'text',
+                text: JSON.stringify(response, null, 2),
+            }],
+    };
+}
+//# sourceMappingURL=sign-test.js.map

package/dist/tools/sign-test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-test.js","sourceRoot":"","sources":["../../src/tools/sign-test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAoB,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAOpC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAC5B,IAA6B,EAC7B,UAAmC;IAEnC,gCAAgC;IAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,+BAA+B;wBACtC,IAAI,EAAE;4BACJ,qDAAqD;4BACrD,8CAA8C;4BAC9C,mCAAmC;4BACnC,EAAE;4BACF,6CAA6C;4BAC7C,GAAG;4BACH,mBAAmB;4BACnB,gBAAgB;4BAChB,yBAAyB;4BACzB,iBAAiB;4BACjB,oDAAoD;4BACpD,iDAAiD;4BACjD,8CAA8C;4BAC9C,SAAS;4BACT,OAAO;4BACP,KAAK;4BACL,GAAG;yBACJ,CAAC,IAAI,CAAC,IAAI,CAAC;qBACb,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;YACF,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;iBACzE,CAAC;YACF,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAI,IAAI,CAAC,SAAoB,IAAI,SAAS,CAAC;IAC1D,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,OAAO,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAC9E,KAAK,UAAU,MAAM,CACnB,MAAwB,EACxB,OAAe,EACf,WAAmB,EACnB,SAAiB;IAEjB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,WAAW,GAAG,QAAQ,SAAS,EAAE,CAAC;IAExC,6BAA6B;IAC7B,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,eAAe;YACxC,CAAC,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE;YACtC,CAAC,CAAC,oCAAoC,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,GAAG;wBACV,IAAI,EAAE,qEAAqE;qBAC5E,CAAC;iBACH,CAAC;YACF,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IAEvC,qBAAqB;IACrB,MAAM,QAAQ,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS;QACT,SAAS;QACT,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,yDAAyD;QAClE,eAAe,EAAE,WAAW;QAC5B,gBAAgB,EAAE,QAAQ;QAC1B,MAAM,EAAE;YACN,UAAU,EAAE,SAAS;YACrB,SAAS;SACV;QACD,kBAAkB,EAAE;YAClB,SAAS,EAAE,2FAA2F;YACtG,oBAAoB,EAAE,oEAAoE;YAC1F,SAAS,EAAE,yEAAyE;YACpF,QAAQ,EAAE,uEAAuE;YACjF,YAAY,EAAE,sEAAsE;YACpF,YAAY,EAAE,uDAAuD;YACrE,aAAa,EAAE,4CAA4C;SAC5D;KACF,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;aACxC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/tools/test-vectors.d.ts

@@ -0,0 +1,13 @@
+/**
+ * blink_generate_test_vectors tool handler.
+ *
+ * Generates deterministic mock BLINK envelopes for unit testing.
+ * Uses seed-based pseudorandom generation for reproducibility.
+ */
+export declare function handleGenerateTestVectors(args: Record<string, unknown>): {
+    content: Array<{
+        type: string;
+        text: string;
+    }>;
+};
+//# sourceMappingURL=test-vectors.d.ts.map

package/dist/tools/test-vectors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-vectors.d.ts","sourceRoot":"","sources":["../../src/tools/test-vectors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoDH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAwIpD"}