@blink-authority-com/claude-code-plugin 1.0.0

package/dist/templates/approval-workflow.js

@@ -0,0 +1,467 @@
+/**
+ * Approval workflow scaffold template.
+ * Generates an M-of-N signing workflow with BLINK signatures.
+ */
+export function generateApprovalWorkflow(name, features) {
+    const files = {};
+    // --- package.json ---
+    files['package.json'] = JSON.stringify({
+        name,
+        version: '0.1.0',
+        description: `${name} — M-of-N approval workflow with BLINK Authority signatures`,
+        type: 'module',
+        scripts: {
+            build: 'tsc',
+            start: 'node dist/server.js',
+            dev: 'tsx src/server.ts',
+        },
+        dependencies: {
+            '@blink-technology/sdk': '^0.14.0',
+            express: '^4.21.0',
+            dotenv: '^16.4.0',
+        },
+        devDependencies: {
+            '@types/express': '^4.17.21',
+            '@types/node': '^22.15.2',
+            typescript: '^5.8.3',
+            tsx: '^4.19.0',
+        },
+    }, null, 2);
+    // --- tsconfig.json ---
+    files['tsconfig.json'] = JSON.stringify({
+        compilerOptions: {
+            target: 'ES2022',
+            module: 'Node16',
+            moduleResolution: 'Node16',
+            outDir: 'dist',
+            rootDir: 'src',
+            strict: true,
+            esModuleInterop: true,
+            skipLibCheck: true,
+            forceConsistentCasingInFileNames: true,
+            declaration: true,
+            sourceMap: true,
+        },
+        include: ['src/**/*'],
+        exclude: ['node_modules', 'dist'],
+    }, null, 2);
+    // --- .env.example ---
+    files['.env.example'] = `# BLINK Secure Engine connection
+BSEC_URL=http://localhost:9100
+BSEC_TOKEN=your-bsec-token-here
+SLOT_NAME=default
+
+# Server
+PORT=3000
+
+# Approval policy
+REQUIRED_APPROVALS=2
+`;
+    // --- src/blink.ts ---
+    files['src/blink.ts'] = `/**
+ * BLINK Secure Engine connection management.
+ *
+ * BLINK Authority — https://blink-authority.com
+ */
+
+import { BlinkSigner, BlinkVerifier, AlgoSuiteId } from '@blink-technology/sdk';
+
+let signer: BlinkSigner;
+let vrfPublicKey: Uint8Array;
+
+export async function initBlink(bsecUrl: string, slotName: string): Promise<void> {
+  signer = await BlinkSigner.connect(bsecUrl, slotName, AlgoSuiteId.Ed25519);
+  vrfPublicKey = await signer.vrfPublicKey();
+  console.log(
+    \`[blink] Connected to BSEC at \${bsecUrl} \` +
+    \`(slot=\${slotName}, pk=\${Buffer.from(vrfPublicKey).toString('hex').slice(0, 16)}...)\`,
+  );
+}
+
+export function getSigner(): BlinkSigner { return signer; }
+export function getVrfPublicKey(): Uint8Array { return vrfPublicKey; }
+export function getVrfPublicKeyHex(): string { return Buffer.from(vrfPublicKey).toString('hex'); }
+
+export function createVerifier(): BlinkVerifier {
+  return new BlinkVerifier(vrfPublicKey, {
+    freshnessWindowMs: 365 * 24 * 60 * 60 * 1000,
+    clockSkewToleranceMs: 60_000,
+  });
+}
+
+export async function shutdownBlink(): Promise<void> {
+  if (signer) {
+    await signer.close();
+    console.log('[blink] Disconnected from BLINK Secure Engine');
+  }
+}
+`;
+    // --- src/policy.ts ---
+    files['src/policy.ts'] = `/**
+ * Approval policy engine.
+ *
+ * Defines who can approve and how many approvals are needed (M-of-N).
+ * In production, load policies from a database or config file.
+ */
+
+export interface ApprovalPolicy {
+  /** Minimum number of approvals required. */
+  requiredApprovals: number;
+  /** List of authorized approver IDs. */
+  authorizedApprovers: string[];
+}
+
+// Default policy — override via environment or config
+const defaultPolicy: ApprovalPolicy = {
+  requiredApprovals: parseInt(process.env['REQUIRED_APPROVALS'] ?? '2', 10),
+  authorizedApprovers: ['approver-1', 'approver-2', 'approver-3'],
+};
+
+/** Get the current approval policy. */
+export function getPolicy(): ApprovalPolicy {
+  return defaultPolicy;
+}
+
+/** Check if an approver is authorized. */
+export function isAuthorized(approverId: string): boolean {
+  return defaultPolicy.authorizedApprovers.includes(approverId);
+}
+
+/** Check if the approval threshold has been met. */
+export function thresholdMet(approvalCount: number): boolean {
+  return approvalCount >= defaultPolicy.requiredApprovals;
+}
+`;
+    // --- src/multi-sign.ts ---
+    files['src/multi-sign.ts'] = `/**
+ * Multi-signature (M-of-N) signing logic.
+ *
+ * Each approval produces an individual BLINK signature.
+ * When the threshold is met, a final "composite" signature
+ * is created that references all individual approvals.
+ */
+
+import { randomUUID } from 'node:crypto';
+import { getSigner, getVrfPublicKeyHex } from './blink.js';
+
+export interface Approval {
+  id: string;
+  requestId: string;
+  approverId: string;
+  approverName: string;
+  comment?: string;
+  timestamp: string;
+  envelope: string;
+  signerPublicKey: string;
+}
+
+export interface ApprovalRequest {
+  id: string;
+  title: string;
+  description: string;
+  requiredApprovals: number;
+  approvals: Approval[];
+  status: 'pending' | 'approved' | 'rejected';
+  createdAt: string;
+  finalizedAt?: string;
+  finalEnvelope?: string;
+}
+
+/**
+ * Build the canonical payload for an individual approval signature.
+ */
+export function buildApprovalPayload(approval: Omit<Approval, 'envelope' | 'signerPublicKey'>): Uint8Array {
+  const canonical = {
+    type: 'approval',
+    id: approval.id,
+    requestId: approval.requestId,
+    approverId: approval.approverId,
+    approverName: approval.approverName,
+    timestamp: approval.timestamp,
+    ...(approval.comment ? { comment: approval.comment } : {}),
+  };
+  return new TextEncoder().encode(JSON.stringify(canonical));
+}
+
+/**
+ * Build the canonical payload for the final composite signature.
+ * Includes the request details and all approval IDs.
+ */
+export function buildFinalPayload(request: ApprovalRequest): Uint8Array {
+  const canonical = {
+    type: 'final_approval',
+    id: request.id,
+    title: request.title,
+    description: request.description,
+    requiredApprovals: request.requiredApprovals,
+    approvalIds: request.approvals.map(a => a.id),
+    finalizedAt: request.finalizedAt,
+  };
+  return new TextEncoder().encode(JSON.stringify(canonical));
+}
+
+/**
+ * Sign an individual approval.
+ */
+export async function signApproval(
+  requestId: string,
+  approverId: string,
+  approverName: string,
+  comment?: string,
+): Promise<Approval> {
+  const partial: Omit<Approval, 'envelope' | 'signerPublicKey'> = {
+    id: \`APR-\${randomUUID()}\`,
+    requestId,
+    approverId,
+    approverName,
+    comment,
+    timestamp: new Date().toISOString(),
+  };
+
+  const payload = buildApprovalPayload(partial);
+  const envelopeBytes = await getSigner().sign(payload);
+
+  return {
+    ...partial,
+    envelope: Buffer.from(envelopeBytes).toString('base64'),
+    signerPublicKey: getVrfPublicKeyHex(),
+  };
+}
+
+/**
+ * Create the final composite signature once the approval threshold is met.
+ */
+export async function signFinal(request: ApprovalRequest): Promise<string> {
+  request.finalizedAt = new Date().toISOString();
+  const payload = buildFinalPayload(request);
+  const envelopeBytes = await getSigner().sign(payload);
+  return Buffer.from(envelopeBytes).toString('base64');
+}
+`;
+    // --- src/approval.ts ---
+    files['src/approval.ts'] = `/**
+ * Approval request storage and lifecycle management.
+ */
+
+import { randomUUID } from 'node:crypto';
+import type { ApprovalRequest } from './multi-sign.js';
+
+// In-memory storage (replace with a database in production)
+const requests = new Map<string, ApprovalRequest>();
+
+/** Create a new approval request. */
+export function createRequest(input: {
+  title: string;
+  description: string;
+  requiredApprovals: number;
+}): ApprovalRequest {
+  const request: ApprovalRequest = {
+    id: \`REQ-\${randomUUID()}\`,
+    title: input.title,
+    description: input.description,
+    requiredApprovals: input.requiredApprovals,
+    approvals: [],
+    status: 'pending',
+    createdAt: new Date().toISOString(),
+  };
+  requests.set(request.id, request);
+  return request;
+}
+
+/** Get a request by ID. */
+export function getRequest(id: string): ApprovalRequest | undefined {
+  return requests.get(id);
+}
+
+/** List all requests. */
+export function listRequests(): ApprovalRequest[] {
+  return Array.from(requests.values());
+}
+`;
+    // --- src/server.ts ---
+    files['src/server.ts'] = `/**
+ * ${name} — M-of-N approval workflow with BLINK Authority signatures.
+ *
+ * Create approval requests, collect individual BLINK-signed approvals,
+ * and finalize with a composite signature when the threshold is met.
+ */
+
+import 'dotenv/config';
+import express from 'express';
+import { initBlink, shutdownBlink, getVrfPublicKeyHex } from './blink.js';
+import { getPolicy, isAuthorized, thresholdMet } from './policy.js';
+import { createRequest, getRequest, listRequests } from './approval.js';
+import { signApproval, signFinal } from './multi-sign.js';
+
+async function main(): Promise<void> {
+  const bsecUrl = process.env['BSEC_URL'] ?? 'http://localhost:9100';
+  const slotName = process.env['SLOT_NAME'] ?? 'default';
+  const port = parseInt(process.env['PORT'] ?? '3000', 10);
+
+  await initBlink(bsecUrl, slotName);
+
+  const app = express();
+  app.use(express.json());
+
+  // POST /requests — Create a new approval request
+  app.post('/requests', (req, res) => {
+    const { title, description } = req.body;
+    if (!title || !description) {
+      res.status(400).json({ error: 'Missing required fields: title, description' });
+      return;
+    }
+    const policy = getPolicy();
+    const request = createRequest({
+      title,
+      description,
+      requiredApprovals: policy.requiredApprovals,
+    });
+    res.status(201).json(request);
+  });
+
+  // GET /requests — List all approval requests
+  app.get('/requests', (_req, res) => {
+    res.json({ requests: listRequests() });
+  });
+
+  // GET /requests/:id — Get a single request
+  app.get('/requests/:id', (req, res) => {
+    const request = getRequest(req.params['id']!);
+    if (!request) {
+      res.status(404).json({ error: 'Request not found' });
+      return;
+    }
+    res.json(request);
+  });
+
+  // POST /requests/:id/approve — Add an approval
+  app.post('/requests/:id/approve', async (req, res, next) => {
+    try {
+      const request = getRequest(req.params['id']!);
+      if (!request) {
+        res.status(404).json({ error: 'Request not found' });
+        return;
+      }
+      if (request.status !== 'pending') {
+        res.status(409).json({ error: \`Request is \${request.status}, expected pending\` });
+        return;
+      }
+
+      const { approverId, approverName, comment } = req.body;
+      if (!approverId || !approverName) {
+        res.status(400).json({ error: 'Missing required fields: approverId, approverName' });
+        return;
+      }
+
+      // Check authorization
+      if (!isAuthorized(approverId)) {
+        res.status(403).json({ error: \`Approver \${approverId} is not authorized\` });
+        return;
+      }
+
+      // Check for duplicate approval
+      if (request.approvals.some(a => a.approverId === approverId)) {
+        res.status(409).json({ error: \`Approver \${approverId} has already approved\` });
+        return;
+      }
+
+      // Sign the individual approval with BLINK
+      const approval = await signApproval(request.id, approverId, approverName, comment);
+      request.approvals.push(approval);
+
+      // Check if threshold is met — if so, finalize with composite signature
+      if (thresholdMet(request.approvals.length)) {
+        request.status = 'approved';
+        request.finalEnvelope = await signFinal(request);
+      }
+
+      res.status(201).json({
+        approval,
+        request: {
+          id: request.id,
+          status: request.status,
+          approvalsReceived: request.approvals.length,
+          approvalsRequired: request.requiredApprovals,
+        },
+      });
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  // GET /health
+  app.get('/health', (_req, res) => {
+    res.json({
+      status: 'ok',
+      service: '${name}',
+      signerPublicKey: getVrfPublicKeyHex(),
+      policy: getPolicy(),
+      timestamp: new Date().toISOString(),
+    });
+  });
+
+  const server = app.listen(port, () => {
+    console.log(\`[server] ${name} listening on port \${port}\`);
+  });
+
+  // Graceful shutdown
+  const shutdown = async (signal: string) => {
+    console.log(\`[server] Received \${signal}, shutting down...\`);
+    server.close();
+    await shutdownBlink();
+    process.exit(0);
+  };
+
+  process.on('SIGINT', () => shutdown('SIGINT'));
+  process.on('SIGTERM', () => shutdown('SIGTERM'));
+}
+
+main().catch((err) => {
+  console.error('[server] Fatal error:', err);
+  process.exit(1);
+});
+`;
+    // --- README.md ---
+    files['README.md'] = `# ${name}
+
+M-of-N approval workflow with **BLINK Authority** signatures. Create requests that
+require multiple approvals, each individually signed with BLINK. When the threshold
+is met, a final composite signature is created.
+
+## Quick Start
+
+\`\`\`bash
+npm install
+cp .env.example .env
+npm run dev
+\`\`\`
+
+## API
+
+### POST /requests
+Create a new approval request.
+
+### GET /requests
+List all requests.
+
+### POST /requests/:id/approve
+Add an approval. Requires \`approverId\` and \`approverName\`.
+When the threshold is met, the request is finalized with a composite BLINK signature.
+
+### GET /health
+Health check with policy details.
+
+## How M-of-N Works
+
+1. A request is created specifying the approval threshold
+2. Authorized approvers submit their approvals
+3. Each approval is individually signed with a BLINK single-use credential
+4. When M approvals are collected (out of N authorized approvers), a final
+   composite signature is created referencing all individual approvals
+5. The composite signature can be verified independently
+
+Built with [BLINK Authority](https://blink-authority.com).
+`;
+    return files;
+}
+//# sourceMappingURL=approval-workflow.js.map

package/dist/templates/approval-workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-workflow.js","sourceRoot":"","sources":["../../src/templates/approval-workflow.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,QAAkB;IAElB,MAAM,KAAK,GAA2B,EAAE,CAAC;IAEzC,uBAAuB;IACvB,KAAK,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,SAAS,CACpC;QACE,IAAI;QACJ,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,GAAG,IAAI,6DAA6D;QACjF,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,qBAAqB;YAC5B,GAAG,EAAE,mBAAmB;SACzB;QACD,YAAY,EAAE;YACZ,uBAAuB,EAAE,SAAS;YAClC,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,SAAS;SAClB;QACD,eAAe,EAAE;YACf,gBAAgB,EAAE,UAAU;YAC5B,aAAa,EAAE,UAAU;YACzB,UAAU,EAAE,QAAQ;YACpB,GAAG,EAAE,SAAS;SACf;KACF,EACD,IAAI,EACJ,CAAC,CACF,CAAC;IAEF,wBAAwB;IACxB,KAAK,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,SAAS,CACrC;QACE,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,gBAAgB,EAAE,QAAQ;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,IAAI;YAClB,gCAAgC,EAAE,IAAI;YACtC,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;SAChB;QACD,OAAO,EAAE,CAAC,UAAU,CAAC;QACrB,OAAO,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC;KAClC,EACD,IAAI,EACJ,CAAC,CACF,CAAC;IAEF,uBAAuB;IACvB,KAAK,CAAC,cAAc,CAAC,GAAG;;;;;;;;;;CAUzB,CAAC;IAEA,uBAAuB;IACvB,KAAK,CAAC,cAAc,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCzB,CAAC;IAEA,wBAAwB;IACxB,KAAK,CAAC,eAAe,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkC1B,CAAC;IAEA,4BAA4B;IAC5B,KAAK,CAAC,mBAAmB,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwG9B,CAAC;IAEA,0BAA0B;IAC1B,KAAK,CAAC,iBAAiB,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsC5B,CAAC;IAEA,wBAAwB;IACxB,KAAK,CAAC,eAAe,CAAC,GAAG;KACtB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiHS,IAAI;;;;;;;;6BAQO,IAAI;;;;;;;;;;;;;;;;;;;CAmBhC,CAAC;IAEA,oBAAoB;IACpB,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuC/B,CAAC;IAEA,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/templates/audit-trail.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Audit trail scaffold template.
+ * Generates a hash-chained audit log with BLINK signatures.
+ */
+export declare function generateAuditTrail(name: string, features: string[]): Record<string, string>;
+//# sourceMappingURL=audit-trail.d.ts.map

package/dist/templates/audit-trail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail.d.ts","sourceRoot":"","sources":["../../src/templates/audit-trail.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAAE,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuZxB"}