@fiscalmindset/blindfold 0.4.0

package/src/keychain.ts

@@ -0,0 +1,155 @@
+/**
+ * OS keychain storage for the tenant key (T3N_API_KEY).
+ *
+ * v0.2 stored the tenant key in ~/.blindfold/config.json (0600). That's a
+ * plaintext file a prompt-injected agent could read — the residual risk. v0.3+
+ * moves it into the OS credential store so it isn't a readable file at all:
+ *   - macOS   → `security` (Keychain)
+ *   - Linux   → `secret-tool` (libsecret / GNOME Keyring)
+ *   - Windows → PowerShell + Win32 Credential Manager (advapi32 Cred*)
+ *   - other   → not available; callers fall back to the 0600 file.
+ *
+ * Dependency-free by design (shells out to the platform tool), matching the
+ * rest of Blindfold. The secret is keyed by tenant DID so multiple tenants can
+ * coexist. Values are never logged, and are passed to child processes via env
+ * or stdin (never argv) wherever the platform tool allows.
+ */
+import { spawnSync } from "node:child_process";
+
+const SERVICE = "blindfold";
+const isWin = process.platform === "win32";
+
+function has(cmd: string): boolean {
+  const finder = isWin ? "where" : "which";
+  const r = spawnSync(finder, [cmd], { stdio: "ignore" });
+  return r.status === 0;
+}
+
+/* -------------------- Windows Credential Manager (advapi32) --------------- */
+// A tiny C# shim compiled by Add-Type, calling CredWriteW/CredReadW/CredDeleteW.
+// The secret + target are passed via environment (BF_SECRET/BF_TARGET), never
+// on the command line.
+const WIN_CS = `
+using System;
+using System.Runtime.InteropServices;
+public static class BFCred {
+  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
+  public struct CREDENTIAL {
+    public UInt32 Flags; public UInt32 Type;
+    [MarshalAs(UnmanagedType.LPWStr)] public string TargetName;
+    [MarshalAs(UnmanagedType.LPWStr)] public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public UInt32 CredentialBlobSize; public IntPtr CredentialBlob; public UInt32 Persist;
+    public UInt32 AttributeCount; public IntPtr Attributes;
+    [MarshalAs(UnmanagedType.LPWStr)] public string TargetAlias;
+    [MarshalAs(UnmanagedType.LPWStr)] public string UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredWriteW(ref CREDENTIAL c, UInt32 f);
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredReadW(string t, UInt32 ty, UInt32 f, out IntPtr c);
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredDeleteW(string t, UInt32 ty, UInt32 f);
+  [DllImport("advapi32.dll")] public static extern void CredFree(IntPtr c);
+}
+`;
+
+const PS_HEADER = `$ErrorActionPreference='Stop'\nAdd-Type -TypeDefinition @"\n${WIN_CS}\n"@\n`;
+
+function winPS(op: "set" | "get" | "delete", target: string, secret?: string): { status: number | null; stdout: string } {
+  let body: string;
+  if (op === "set") {
+    body =
+      `$b=[System.Text.Encoding]::UTF8.GetBytes($env:BF_SECRET);` +
+      `$p=[Runtime.InteropServices.Marshal]::AllocHGlobal($b.Length);` +
+      `[Runtime.InteropServices.Marshal]::Copy($b,0,$p,$b.Length);` +
+      `$c=New-Object BFCred+CREDENTIAL;$c.Type=1;$c.TargetName=$env:BF_TARGET;$c.UserName=$env:BF_TARGET;` +
+      `$c.CredentialBlobSize=$b.Length;$c.CredentialBlob=$p;$c.Persist=2;` +
+      `$ok=[BFCred]::CredWriteW([ref]$c,0);[Runtime.InteropServices.Marshal]::FreeHGlobal($p);if($ok){[Console]::Out.Write('BFOK')}`;
+  } else if (op === "get") {
+    body =
+      `$ptr=[IntPtr]::Zero;` +
+      `if([BFCred]::CredReadW($env:BF_TARGET,1,0,[ref]$ptr)){` +
+      `$c=[Runtime.InteropServices.Marshal]::PtrToStructure($ptr,[BFCred+CREDENTIAL]);` +
+      `$n=[int]$c.CredentialBlobSize;$b=New-Object byte[] $n;` +
+      `[Runtime.InteropServices.Marshal]::Copy([IntPtr]$c.CredentialBlob,$b,0,$n);[BFCred]::CredFree($ptr);` +
+      `[Console]::Out.Write([System.Text.Encoding]::UTF8.GetString($b))}else{exit 1}`;
+  } else {
+    body = `if([BFCred]::CredDeleteW($env:BF_TARGET,1,0)){[Console]::Out.Write('BFOK')}`;
+  }
+  const env: Record<string, string> = { ...(process.env as Record<string, string>), BF_TARGET: target };
+  if (secret !== undefined) env.BF_SECRET = secret;
+  const r = spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", "-"],
+    { input: PS_HEADER + body, env, encoding: "utf8" });
+  return { status: r.status, stdout: typeof r.stdout === "string" ? r.stdout : "" };
+}
+
+function winTarget(account: string): string {
+  return `${SERVICE}:${account}`;
+}
+
+/* ------------------------------------------------------------------------- */
+
+/** True if an OS credential store is usable on this machine. */
+export function keychainAvailable(): boolean {
+  if (process.platform === "darwin") return has("security");
+  if (process.platform === "linux") return has("secret-tool");
+  if (isWin) return has("powershell");
+  return false;
+}
+
+/** Human-readable name of the active backend (for `whoami`). */
+export function keychainBackend(): string {
+  if (process.platform === "darwin") return "macOS Keychain";
+  if (process.platform === "linux") return "libsecret (secret-tool)";
+  if (isWin) return "Windows Credential Manager";
+  return "none";
+}
+
+/** Store `secret` under the tenant `account` (DID). Returns true on success. */
+export function keychainSet(account: string, secret: string): boolean {
+  if (process.platform === "darwin") {
+    const r = spawnSync("security", ["add-generic-password", "-a", account, "-s", SERVICE, "-w", secret, "-U"], { stdio: "ignore" });
+    return r.status === 0;
+  }
+  if (process.platform === "linux") {
+    const r = spawnSync("secret-tool", ["store", "--label=blindfold", "service", SERVICE, "account", account], { input: secret, stdio: ["pipe", "ignore", "ignore"] });
+    return r.status === 0;
+  }
+  // Status codes over piped PowerShell are unreliable; use an explicit stdout
+  // marker. (Fails with err 1312 in a non-interactive session — e.g. over SSH —
+  // where the Credential Manager isn't available; caller falls back to a file.)
+  if (isWin) return winPS("set", winTarget(account), secret).stdout.includes("BFOK");
+  return false;
+}
+
+/** Retrieve the secret for tenant `account` (DID), or null if absent. */
+export function keychainGet(account: string): string | null {
+  if (process.platform === "darwin") {
+    const r = spawnSync("security", ["find-generic-password", "-a", account, "-s", SERVICE, "-w"], { encoding: "utf8" });
+    if (r.status === 0 && typeof r.stdout === "string") return r.stdout.replace(/\n$/, "");
+    return null;
+  }
+  if (process.platform === "linux") {
+    const r = spawnSync("secret-tool", ["lookup", "service", SERVICE, "account", account], { encoding: "utf8" });
+    if (r.status === 0 && r.stdout) return r.stdout.replace(/\n$/, "");
+    return null;
+  }
+  if (isWin) {
+    const r = winPS("get", winTarget(account));
+    if (r.status === 0 && r.stdout) return r.stdout.replace(/\r?\n$/, "");
+    return null;
+  }
+  return null;
+}
+
+/** Remove the stored secret for tenant `account` (DID). */
+export function keychainDelete(account: string): boolean {
+  if (process.platform === "darwin") {
+    const r = spawnSync("security", ["delete-generic-password", "-a", account, "-s", SERVICE], { stdio: "ignore" });
+    return r.status === 0;
+  }
+  if (process.platform === "linux") {
+    const r = spawnSync("secret-tool", ["clear", "service", SERVICE, "account", account], { stdio: "ignore" });
+    return r.status === 0;
+  }
+  if (isWin) return winPS("delete", winTarget(account)).stdout.includes("BFOK");
+  return false;
+}

package/src/log.ts

@@ -0,0 +1,51 @@
+/**
+ * Logging utilities that never leak secret values.
+ *
+ * Rule: `safeLog` is the ONLY logger used across Blindfold. It scrubs
+ * any header named authorization-ish before printing. CI greps for any
+ * `console.log` containing the substring "Bearer " — that should never
+ * appear in source.
+ */
+
+const HEADER_BLOCKLIST = new Set([
+  "authorization",
+  "proxy-authorization",
+  "x-api-key",
+  "cookie",
+  "set-cookie",
+]);
+
+export type Loggable = Record<string, unknown> | string;
+
+export function safeLog(level: "info" | "warn" | "error", obj: Loggable): void {
+  const safe = typeof obj === "string" ? { msg: obj } : redact(obj);
+  const line = JSON.stringify({ t: new Date().toISOString(), level, ...safe });
+  process.stderr.write(line + "\n");
+}
+
+export function redact(input: Record<string, unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(input)) {
+    if (k === "headers" && v && typeof v === "object") {
+      out[k] = redactHeaders(v as Record<string, unknown> | Array<[string, string]>);
+    } else if (HEADER_BLOCKLIST.has(k.toLowerCase())) {
+      out[k] = "[redacted]";
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+function redactHeaders(
+  h: Record<string, unknown> | Array<[string, string]>,
+): Record<string, string> | Array<[string, string]> {
+  if (Array.isArray(h)) {
+    return h.map(([k, v]): [string, string] => [k, HEADER_BLOCKLIST.has(k.toLowerCase()) ? "[redacted]" : v]);
+  }
+  const out: Record<string, string> = {};
+  for (const [k, v] of Object.entries(h)) {
+    out[k] = HEADER_BLOCKLIST.has(k.toLowerCase()) ? "[redacted]" : String(v);
+  }
+  return out;
+}

package/src/migrate.ts

@@ -0,0 +1,135 @@
+/**
+ * `blindfold migrate` — one command to move a whole .env into the enclave.
+ *
+ * Scans .env, seals every recognized SECRET (skipping config + T3 root creds),
+ * then rewrites .env to remove (or comment out) the sealed lines — with a backup.
+ * After this, the agent's environment holds zero plaintext API keys.
+ *
+ * SECURITY: this module never logs a secret value. It only reads names from
+ * .env and delegates the single plaintext touch to registerSecret (the one
+ * audit-critical path). The .env rewrite operates on line text, not values.
+ */
+import fs from "node:fs";
+import { defaultEnvPath, loadEnvFromFile } from "./env.ts";
+import { registerSecret } from "./register.ts";
+
+/** Vars that must NEVER be sealed (root creds / config the runtime needs). */
+const NEVER_SEAL = new Set([
+  "T3N_API_KEY", "DID",
+  "BLINDFOLD_MOCK", "BLINDFOLD_PORT", "BLINDFOLD_T3_ENV", "BLINDFOLD_DASHBOARD_PORT", "BLINDFOLD_BASE_URL",
+]);
+
+/** Looks like config, not a secret (host/url/port/email/region/env). */
+function isConfigName(k: string): boolean {
+  return /(_HOST|_URL|_PORT|_EMAIL|_ENV|_REGION|_BASE_URL|_USER|_USERNAME)$/i.test(k)
+    || /^(NODE_ENV|PORT|HOST|PATH|HOME|USER|SHELL|LANG|PWD)$/i.test(k);
+}
+
+/** Alternate T3 team keys/DIDs (t1_*, t2_*, …) — these are root creds, skip. */
+function isAltT3(k: string): boolean {
+  return /^t\d+_/i.test(k) || /_DID$/i.test(k);
+}
+
+/** Name indicates a credential worth sealing. */
+function looksSecret(k: string): boolean {
+  return /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|_API|API_|_PAT|CREDENTIAL|ACCESS|PRIVATE)/i.test(k);
+}
+
+export interface MigratePlanItem {
+  envVar: string;
+  sealName: string;
+  bytes: number;
+  action: "seal" | "skip";
+  reason?: string;
+}
+
+/** Parse .env into ordered [key, rawLineIndex] without exposing values. */
+function readEnvVars(envPath: string): { keys: string[]; lines: string[] } {
+  const lines = fs.existsSync(envPath) ? fs.readFileSync(envPath, "utf8").split(/\r?\n/) : [];
+  const keys: string[] = [];
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    keys.push(line.slice(0, eq).trim());
+  }
+  return { keys, lines };
+}
+
+/** Build the migration plan: which vars get sealed, which are skipped and why. */
+export function planMigration(envPath = defaultEnvPath()): MigratePlanItem[] {
+  loadEnvFromFile(envPath); // populate process.env so we can read lengths
+  const { keys } = readEnvVars(envPath);
+  const seen = new Set<string>();
+  const plan: MigratePlanItem[] = [];
+  for (const k of keys) {
+    if (seen.has(k)) continue;
+    seen.add(k);
+    const val = process.env[k] ?? "";
+    const base: MigratePlanItem = { envVar: k, sealName: k.toLowerCase(), bytes: val.length, action: "skip" };
+    if (NEVER_SEAL.has(k)) plan.push({ ...base, reason: "root cred / config — must stay in .env" });
+    else if (isAltT3(k)) plan.push({ ...base, reason: "T3 team key/DID — root cred" });
+    else if (isConfigName(k)) plan.push({ ...base, reason: "config, not a secret" });
+    else if (!val) plan.push({ ...base, reason: "empty" });
+    else if (!looksSecret(k)) plan.push({ ...base, reason: "name doesn't look like a secret (seal manually if it is)" });
+    else plan.push({ ...base, action: "seal" });
+  }
+  return plan;
+}
+
+export interface MigrateResult extends MigratePlanItem {
+  sealed?: boolean;
+  error?: string;
+}
+
+/**
+ * Execute the plan: seal each "seal" item, then rewrite .env.
+ * @param opts.keep  comment the line out (prefix `# sealed→enclave: `) instead of deleting it.
+ */
+export async function runMigrate(opts: { envPath?: string; keep?: boolean } = {}): Promise<MigrateResult[]> {
+  const envPath = opts.envPath ?? defaultEnvPath();
+  const plan = planMigration(envPath);
+  const results: MigrateResult[] = [];
+  const sealedVars = new Set<string>();
+
+  for (const item of plan) {
+    if (item.action !== "seal") { results.push(item); continue; }
+    try {
+      await registerSecret({ name: item.sealName, fromEnv: item.envVar });
+      sealedVars.add(item.envVar);
+      results.push({ ...item, sealed: true });
+    } catch (e) {
+      results.push({ ...item, sealed: false, error: (e as Error).message });
+    }
+  }
+
+  // Rewrite .env (backup first) — drop/comment the successfully-sealed lines.
+  if (sealedVars.size > 0) {
+    const original = fs.readFileSync(envPath, "utf8");
+    // The backup contains ALL original plaintext secrets. Write it 0600 (owner
+    // only) so it isn't world/group readable, and warn the user to delete it
+    // once they've verified the migration.
+    const backupPath = `${envPath}.bak.${Math.floor(Date.now() / 1000)}`;
+    fs.writeFileSync(backupPath, original, { mode: 0o600 });
+    try { fs.chmodSync(backupPath, 0o600); } catch { /* best effort (umask/FS) */ }
+    console.warn(
+      `⚠️  Wrote a PLAINTEXT backup of your secrets to ${backupPath} (mode 0600). ` +
+      `Delete it once you've verified the migration: rm "${backupPath}"`,
+    );
+    const out: string[] = [];
+    for (const raw of original.split(/\r?\n/)) {
+      const eq = raw.indexOf("=");
+      const key = eq > 0 ? raw.slice(0, eq).trim() : "";
+      if (key && sealedVars.has(key) && !raw.trim().startsWith("#")) {
+        if (opts.keep) out.push(`# sealed→enclave: ${key}  (value lives in T3, use \`blindfold use --name ${key.toLowerCase()}\`)`);
+        // else: drop the line entirely
+      } else {
+        out.push(raw);
+      }
+    }
+    fs.writeFileSync(envPath, out.join("\n"));
+  }
+
+  return results;
+}

package/src/prompt.ts

@@ -0,0 +1,114 @@
+/**
+ * Tiny stdlib-only helper for reading a secret from stdin with no echo.
+ * Like `npm login` / `gh auth login --with-token` — the value passes
+ * terminal → SDK → enclave and never touches the filesystem or shell
+ * history.
+ *
+ * Behaviour:
+ *   - prompts via stderr (so stdout stays clean for scripting)
+ *   - puts the TTY into raw mode and reads char-by-char
+ *   - handles Enter (commit), Backspace, Ctrl+C (abort)
+ *   - never prints the typed characters
+ *
+ * If stdin isn't a TTY (e.g. CI), we read a line normally without raw
+ * mode so piping still works (`echo $KEY | blindfold register …`).
+ */
+
+export async function readSecretLine(prompt: string): Promise<string> {
+  process.stderr.write(prompt);
+  const stdin = process.stdin;
+
+  // Non-TTY path: just read one line. Useful for piped input.
+  if (!stdin.isTTY) {
+    return await readOneLine(stdin);
+  }
+
+  return await new Promise<string>((resolve, reject) => {
+    let buf = "";
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+
+    const cleanup = (): void => {
+      stdin.removeListener("data", onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+    };
+
+    const onData = (chunk: string | Buffer): void => {
+      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      for (const ch of s) {
+        if (ch === "\n" || ch === "\r") {
+          cleanup();
+          process.stderr.write("\n");
+          resolve(buf);
+          return;
+        }
+        if (ch === "\u0003") {
+          // Ctrl+C
+          cleanup();
+          process.stderr.write("\n");
+          reject(new Error("aborted by user"));
+          return;
+        }
+        if (ch === "\u007f" || ch === "\b") {
+          if (buf.length > 0) buf = buf.slice(0, -1);
+          continue;
+        }
+        // Ignore other control chars
+        if (ch >= " " || ch === "\t") buf += ch;
+      }
+    };
+
+    stdin.on("data", onData);
+  });
+}
+
+/**
+ * Read one visible line from stdin (echo on). For non-secret prompts like an
+ * emailed OTP code, where hiding the input would just confuse the user.
+ */
+export async function readLine(prompt: string): Promise<string> {
+  process.stderr.write(prompt);
+  const stdin = process.stdin;
+  if (!stdin.isTTY) return await readOneLine(stdin);
+  return await new Promise<string>((resolve, reject) => {
+    let buf = "";
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const cleanup = (): void => {
+      stdin.removeListener("data", onData);
+      stdin.pause();
+    };
+    const onData = (chunk: string | Buffer): void => {
+      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      for (const ch of s) {
+        if (ch === "\r" || ch === "\n") {
+          process.stderr.write("\n");
+          cleanup();
+          resolve(buf);
+          return;
+        }
+        if (ch === "") { // Ctrl+C
+          cleanup();
+          reject(new Error("aborted"));
+          return;
+        }
+        buf += ch;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+
+function readOneLine(stdin: NodeJS.ReadStream): Promise<string> {
+  return new Promise((resolve, reject) => {
+    let buf = "";
+    stdin.setEncoding("utf8");
+    stdin.on("data", (d) => {
+      buf += d;
+    });
+    stdin.on("end", () => resolve(buf.replace(/\r?\n$/, "")));
+    stdin.on("error", reject);
+  });
+}

package/src/providers.ts

@@ -0,0 +1,224 @@
+import { SENTINEL } from "./constants.ts";
+
+/**
+ * Blindfold provider registry — concrete, first-class integrations.
+ *
+ * This is deliberately NOT a generic passthrough. Each entry is a real,
+ * named provider with its exact upstream host, the logical name of the sealed
+ * secret it uses, and — crucially — the *auth scheme* the enclave must apply.
+ *
+ * Three schemes, matching contract/src/forward.rs:
+ *   - bearer : `Authorization: Bearer <secret>`  (sentinel swap)
+ *   - basic  : `Authorization: Basic base64(user:secret)`  (computed in-enclave)
+ *   - sigv4  : AWS Signature Version 4  (secret SIGNS the request, never sent)
+ *
+ * The basic/sigv4 providers are the proof that Blindfold is properly
+ * provider-aware: for those, the raw secret is *consumed by a computation*
+ * inside TDX, so it never exists as a standalone header value anywhere.
+ */
+
+/** Auth descriptor resolved for a single outbound request. Serialises 1:1 into
+ * the contract's tagged `AuthSpec` enum. */
+export type ForwardAuth =
+  | { scheme: "bearer" }
+  | { scheme: "basic"; username: string }
+  | { scheme: "sigv4"; access_key_id: string; region: string; service: string; amz_date: string }
+  | { scheme: "webhook" };
+
+/** For bearer providers: which header carries the sentinel, and its prefix.
+ * Defaults to Authorization / "Bearer ". Google Gemini uses `x-goog-api-key`
+ * with no prefix — a real, distinct industry auth pattern (API key in a
+ * provider-specific header, not `Authorization`). */
+export interface SentinelHeader {
+  name: string;
+  prefix: string;
+}
+
+export interface ResolvedProvider {
+  /** Provider id for telemetry, e.g. "stripe". */
+  id: string;
+  /** Absolute upstream URL to call. */
+  upstream: string;
+  /** Sealed-secret name. `undefined` → use the proxy's default secret_key
+   *  (preserves back-compat for the OpenAI-shaped LLM providers). */
+  secretKey?: string;
+  /** How the enclave should authenticate this request. */
+  auth: ForwardAuth;
+  /** Bearer-only: header to plant the sentinel in. Defaults to Authorization. */
+  sentinelHeader?: SentinelHeader;
+  /** Provider-specific headers this API actually requires (version pins,
+   *  Accept, User-Agent, …). Injected only when the agent didn't set them, so
+   *  the integration knows the provider's conventions and the agent doesn't
+   *  have to. This is what makes each entry a real integration, not a host. */
+  defaultHeaders?: Record<string, string>;
+}
+
+interface ProviderDef {
+  id: string;
+  /** Path prefix the agent hits on the local proxy, e.g. "/stripe/". */
+  prefix: string;
+  /** Build the real upstream URL from the incoming proxy path. */
+  upstream: (path: string) => string;
+  secretKey?: string;
+  /** Resolve the auth descriptor (may read non-secret config from env). */
+  auth: () => ForwardAuth;
+  /** Bearer-only override for where the sentinel goes. */
+  sentinelHeader?: SentinelHeader;
+  /** Provider-specific required headers (see ResolvedProvider.defaultHeaders). */
+  defaultHeaders?: Record<string, string>;
+}
+
+/** AWS-style timestamp `YYYYMMDDTHHMMSSZ` (UTC). Not a secret — the enclave has
+ * no wall clock, so the caller supplies it. */
+export function amzDate(now: Date = new Date()): string {
+  const p = (n: number) => String(n).padStart(2, "0");
+  return (
+    `${now.getUTCFullYear()}${p(now.getUTCMonth() + 1)}${p(now.getUTCDate())}` +
+    `T${p(now.getUTCHours())}${p(now.getUTCMinutes())}${p(now.getUTCSeconds())}Z`
+  );
+}
+
+const awsRegion = () => process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || "us-east-1";
+const awsAccessKeyId = () => process.env.AWS_ACCESS_KEY_ID || "";
+
+/** Strip a leading `/<segment>` from the path (e.g. "/stripe/v1/x" → "/v1/x"). */
+function stripPrefix(path: string, prefix: string): string {
+  const rest = path.slice(prefix.length - 1); // keep the leading slash
+  return rest.startsWith("/") ? rest : `/${rest}`;
+}
+
+const PROVIDERS: ProviderDef[] = [
+  // ---- LLM providers (OpenAI-shaped, bearer). Back-compatible. --------------
+  { id: "openai", prefix: "/v1/", upstream: (p) => `https://api.openai.com${p}`, auth: () => ({ scheme: "bearer" }) },
+  { id: "openai", prefix: "/openai/", upstream: (p) => `https://api.openai.com${stripPrefix(p, "/openai/")}`, auth: () => ({ scheme: "bearer" }) },
+  // Anthropic REQUIRES the anthropic-version header on the raw REST API.
+  { id: "anthropic", prefix: "/anthropic/", upstream: (p) => `https://api.anthropic.com${stripPrefix(p, "/anthropic/")}`, auth: () => ({ scheme: "bearer" }), defaultHeaders: { "anthropic-version": "2023-06-01" } },
+  { id: "xai", prefix: "/x/", upstream: (p) => `https://api.x.ai${stripPrefix(p, "/x/")}`, auth: () => ({ scheme: "bearer" }) },
+  { id: "groq", prefix: "/groq/", upstream: (p) => `https://api.groq.com/openai${stripPrefix(p, "/groq/")}`, auth: () => ({ scheme: "bearer" }) },
+
+  // ---- LLM: Google Gemini (native API — key rides in `x-goog-api-key`). ------
+  // Not OpenAI-shaped and NOT `Authorization: Bearer`. The sentinel is planted
+  // in Google's provider-specific header and swapped for the sealed key inside
+  // the enclave — proving Blindfold handles a provider's real auth convention,
+  // not just the one bearer shape.
+  {
+    id: "gemini",
+    prefix: "/gemini/",
+    upstream: (p) => `https://generativelanguage.googleapis.com${stripPrefix(p, "/gemini/")}`,
+    secretKey: "gemini_api_key",
+    auth: () => ({ scheme: "bearer" }),
+    sentinelHeader: { name: "x-goog-api-key", prefix: "" },
+  },
+
+  // ---- Payments: Stripe (bearer; pins the API version so behaviour is stable). -----
+  {
+    id: "stripe",
+    prefix: "/stripe/",
+    upstream: (p) => `https://api.stripe.com${stripPrefix(p, "/stripe/")}`,
+    secretKey: "stripe_secret_key",
+    auth: () => ({ scheme: "bearer" }),
+    defaultHeaders: { "stripe-version": "2024-06-20", "content-type": "application/x-www-form-urlencoded" },
+  },
+
+  // ---- Dev infra: GitHub. GitHub REJECTS requests with no User-Agent (403),
+  //      and best practice is to pin the REST API version + set the Accept type.
+  {
+    id: "github",
+    prefix: "/github/",
+    upstream: (p) => `https://api.github.com${stripPrefix(p, "/github/")}`,
+    secretKey: "github_token",
+    auth: () => ({ scheme: "bearer" }),
+    defaultHeaders: {
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28",
+      "user-agent": "blindfold",
+    },
+  },
+
+  // ---- Email: SendGrid (bearer; JSON v3 API). -------------------------------
+  {
+    id: "sendgrid",
+    prefix: "/sendgrid/",
+    upstream: (p) => `https://api.sendgrid.com${stripPrefix(p, "/sendgrid/")}`,
+    secretKey: "sendgrid_api_key",
+    auth: () => ({ scheme: "bearer" }),
+    defaultHeaders: { "content-type": "application/json" },
+  },
+
+  // ---- Comms: Slack (bearer bot token; Web API wants JSON+charset on POST). --
+  {
+    id: "slack",
+    prefix: "/slack/",
+    upstream: (p) => `https://slack.com/api${stripPrefix(p, "/slack/")}`,
+    secretKey: "slack_bot_token",
+    auth: () => ({ scheme: "bearer" }),
+    defaultHeaders: { "content-type": "application/json; charset=utf-8" },
+  },
+
+  // ---- Telephony: Twilio (HTTP Basic — base64 computed IN the enclave). -----
+  // Username = Account SID (not secret; also appears in the URL path). The
+  // sealed secret is the Auth Token. A generic proxy CANNOT do this: the
+  // base64 must be computed after the secret is joined, inside TDX.
+  {
+    id: "twilio",
+    prefix: "/twilio/",
+    upstream: (p) => `https://api.twilio.com${stripPrefix(p, "/twilio/")}`,
+    secretKey: "twilio_auth_token",
+    auth: () => ({ scheme: "basic", username: process.env.TWILIO_ACCOUNT_SID || "" }),
+    defaultHeaders: { "content-type": "application/x-www-form-urlencoded" },
+  },
+
+  // ---- Cloud: AWS SES (SigV4 — secret SIGNS, never transmitted). ------------
+  {
+    id: "aws-ses",
+    prefix: "/aws/ses/",
+    upstream: (p) => `https://email.${awsRegion()}.amazonaws.com${stripPrefix(p, "/aws/ses/")}`,
+    secretKey: "aws_secret_access_key",
+    auth: () => ({ scheme: "sigv4", access_key_id: awsAccessKeyId(), region: awsRegion(), service: "ses", amz_date: amzDate() }),
+  },
+
+  // ---- Cloud: AWS S3 (SigV4). -----------------------------------------------
+  {
+    id: "aws-s3",
+    prefix: "/aws/s3/",
+    upstream: (p) => `https://s3.${awsRegion()}.amazonaws.com${stripPrefix(p, "/aws/s3/")}`,
+    secretKey: "aws_secret_access_key",
+    auth: () => ({ scheme: "sigv4", access_key_id: awsAccessKeyId(), region: awsRegion(), service: "s3", amz_date: amzDate() }),
+  },
+
+  // ---- Webhook: Discord. The SECRET IS THE URL — the enclave substitutes the
+  //      sealed webhook URL for the sentinel, so the agent POSTs to /discord
+  //      with only a JSON body and never holds the URL. Needs egress for
+  //      discord.com (`blindfold grant --host discord.com`).
+  {
+    id: "discord",
+    prefix: "/discord",
+    upstream: () => SENTINEL, // enclave replaces this with the sealed webhook URL
+    secretKey: "webhook_discord_url",
+    auth: () => ({ scheme: "webhook" }),
+  },
+];
+
+/**
+ * Resolve the incoming proxy path to a concrete provider. Longest-prefix match
+ * so "/aws/s3/" wins over any shorter prefix. Returns null for unmapped paths.
+ */
+export function resolveProvider(path: string): ResolvedProvider | null {
+  const def = PROVIDERS
+    .filter((d) => path.startsWith(d.prefix))
+    .sort((a, b) => b.prefix.length - a.prefix.length)[0];
+  if (!def) return null;
+  return {
+    id: def.id,
+    upstream: def.upstream(path),
+    secretKey: def.secretKey,
+    auth: def.auth(),
+    sentinelHeader: def.sentinelHeader,
+    defaultHeaders: def.defaultHeaders,
+  };
+}
+
+/** Names of the providers Blindfold ships first-class support for. */
+export function supportedProviders(): string[] {
+  return [...new Set(PROVIDERS.map((p) => p.id))];
+}