@entros/pulse-sdk 1.0.1 → 1.1.0

package/dist/index.mjs

@@ -25,7 +25,7 @@ var PROGRAM_IDS = {
 var AGENT_REGISTRY_CONFIG = {
   programIdDevnet: "8oo4J9tBB3Hna1jRQ3rWvJjojqM5DYTDJo5cejUuJy3C",
   programIdMainnet: "8oo4dC4JvBLwy5tGgiH3WwK4B9PWxL9Z4XjA2jzkQMbQ",
-  metadataKey: "iam:human-operator"
+  metadataKey: "entros:human-operator"
 };
 var SAS_CONFIG = {
   programId: "22zoJMtdu4tQc2PzL74ZUT7FrwgB1Udec8DdW4yw4BdG",
@@ -2315,6 +2315,116 @@ var PulseSession = class {
       );
     this.touchStageState = "skipped";
   }
+  // --- Test hooks (internal builds only) ---
+  /**
+   * @internal Test-only. Primes the session with pre-captured sensor data,
+   * bypassing browser capture APIs. Throws unless built with IAM_INTERNAL_TEST=1.
+   * Stripped from the published .d.ts so npm consumers never see it. Used by the
+   * red team harness to drive the real verification pipeline (extraction →
+   * SimHash → TBH → proof → submit) against synthetic sensor data — never
+   * available to npm consumers.
+   */
+  __injectSensorData(data) {
+    if (true) {
+      throw new Error(
+        "PulseSession.__injectSensorData is only available in internal test builds. Set IAM_INTERNAL_TEST=1 when building pulse-sdk from source."
+      );
+    }
+    const conflicts = [];
+    if (this.audioStageState === "capturing") conflicts.push("audio");
+    if (this.motionStageState === "capturing") conflicts.push("motion");
+    if (this.touchStageState === "capturing") conflicts.push("touch");
+    if (conflicts.length > 0) {
+      throw new Error(
+        `__injectSensorData: cannot inject while stages are capturing: ${conflicts.join(", ")}. Create a fresh session via sdk.createSession() and inject before any startAudio/startMotion/startTouch call.`
+      );
+    }
+    if (!data.audio || data.audio.samples.length < MIN_AUDIO_SAMPLES) {
+      throw new Error(
+        `__injectSensorData: audio required, minimum ${MIN_AUDIO_SAMPLES} samples (got ${data.audio?.samples.length ?? 0}).`
+      );
+    }
+    if (data.motion.length < MIN_MOTION_SAMPLES) {
+      throw new Error(
+        `__injectSensorData: motion required, minimum ${MIN_MOTION_SAMPLES} samples (got ${data.motion.length}).`
+      );
+    }
+    if (data.touch.length < MIN_TOUCH_SAMPLES) {
+      throw new Error(
+        `__injectSensorData: touch required, minimum ${MIN_TOUCH_SAMPLES} samples (got ${data.touch.length}).`
+      );
+    }
+    this.audioData = data.audio;
+    this.motionData = data.motion;
+    this.touchData = data.touch;
+    this.audioStageState = "captured";
+    this.motionStageState = "captured";
+    this.touchStageState = "captured";
+  }
+  /**
+   * @internal
+   *
+   * Run the validation step of the verify pipeline only: feature extraction
+   * + `/validate-features` POST. Returns the validation outcome without ever
+   * touching the on-chain submission path. Mirrors the production user
+   * flow's pre-payment gate — the validation server runs without requiring
+   * the wallet to have SOL, just like a real user gets a validation result
+   * before being prompted to sign the on-chain mint.
+   *
+   * Note: this is a strict subset of `complete()`. It skips the data-quality
+   * gates and re-verification check that `processSensorData` performs. The
+   * validation server still runs its full pipeline (Tier 1 + Tier 2 +
+   * phrase binding); only the client-side pre-flight checks differ.
+   *
+   * Use case: red team campaigns measuring server-side validation at scale
+   * without per-attempt SOL funding. Build-time gated identically to
+   * `__injectSensorData`; throws in production builds.
+   */
+  async __validateOnly(walletAddress) {
+    if (true) {
+      throw new Error(
+        "PulseSession.__validateOnly is only available in internal test builds. Set IAM_INTERNAL_TEST=1 when building pulse-sdk from source."
+      );
+    }
+    if (typeof walletAddress !== "string" || walletAddress.length === 0) {
+      throw new Error(
+        "__validateOnly requires a non-empty walletAddress string (used as wallet_id in the /validate-features payload)."
+      );
+    }
+    const active = [];
+    if (this.audioStageState === "capturing") active.push("audio");
+    if (this.motionStageState === "capturing") active.push("motion");
+    if (this.touchStageState === "capturing") active.push("touch");
+    if (active.length > 0) {
+      throw new Error(
+        `Cannot validate: stages still capturing: ${active.join(", ")}`
+      );
+    }
+    if (!this.audioData || this.motionData.length === 0 || this.touchData.length === 0) {
+      throw new Error(
+        "__validateOnly requires sensor data first \u2014 call __injectSensorData() before this."
+      );
+    }
+    const sensorData = {
+      audio: this.audioData,
+      motion: this.motionData,
+      touch: this.touchData,
+      modalities: {
+        audio: true,
+        motion: true,
+        touch: true
+      }
+    };
+    const extraction = await extractFingerprintAndValidate(
+      sensorData,
+      this.config,
+      walletAddress
+    );
+    if (!extraction.ok) {
+      return { validated: false, error: extraction.error };
+    }
+    return { validated: true };
+  }
   // --- Complete ---
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Solana types are optional peer deps
   async complete(wallet, connection, onProgress) {
@@ -2989,7 +3099,10 @@ export {
   DEFAULT_THRESHOLD,
   FINGERPRINT_BITS,
   MAX_CAPTURE_MS,
+  MIN_AUDIO_SAMPLES,
   MIN_CAPTURE_MS,
+  MIN_MOTION_SAMPLES,
+  MIN_TOUCH_SAMPLES,
   PROGRAM_IDS,
   PulseSDK,
   PulseSession,