@fiscalmindset/blindfold 0.4.0

package/dist/lib/index.mjs

@@ -0,0 +1,2362 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/constants.ts
+var SENTINEL, DEFAULT_PORT, CONTRACT_TAIL, CONTRACT_VERSION, DEFAULT_DASHBOARD_PORT;
+var init_constants = __esm({
+  "src/constants.ts"() {
+    "use strict";
+    SENTINEL = "__BLINDFOLD__";
+    DEFAULT_PORT = 8787;
+    CONTRACT_TAIL = "blindfold-proxy";
+    CONTRACT_VERSION = "0.5.6";
+    DEFAULT_DASHBOARD_PORT = 8799;
+  }
+});
+
+// src/keychain.ts
+import { spawnSync } from "node:child_process";
+function has(cmd) {
+  const finder = isWin ? "where" : "which";
+  const r = spawnSync(finder, [cmd], { stdio: "ignore" });
+  return r.status === 0;
+}
+function winPS(op, target, secret) {
+  let body;
+  if (op === "set") {
+    body = `$b=[System.Text.Encoding]::UTF8.GetBytes($env:BF_SECRET);$p=[Runtime.InteropServices.Marshal]::AllocHGlobal($b.Length);[Runtime.InteropServices.Marshal]::Copy($b,0,$p,$b.Length);$c=New-Object BFCred+CREDENTIAL;$c.Type=1;$c.TargetName=$env:BF_TARGET;$c.UserName=$env:BF_TARGET;$c.CredentialBlobSize=$b.Length;$c.CredentialBlob=$p;$c.Persist=2;$ok=[BFCred]::CredWriteW([ref]$c,0);[Runtime.InteropServices.Marshal]::FreeHGlobal($p);if($ok){[Console]::Out.Write('BFOK')}`;
+  } else if (op === "get") {
+    body = `$ptr=[IntPtr]::Zero;if([BFCred]::CredReadW($env:BF_TARGET,1,0,[ref]$ptr)){$c=[Runtime.InteropServices.Marshal]::PtrToStructure($ptr,[BFCred+CREDENTIAL]);$n=[int]$c.CredentialBlobSize;$b=New-Object byte[] $n;[Runtime.InteropServices.Marshal]::Copy([IntPtr]$c.CredentialBlob,$b,0,$n);[BFCred]::CredFree($ptr);[Console]::Out.Write([System.Text.Encoding]::UTF8.GetString($b))}else{exit 1}`;
+  } else {
+    body = `if([BFCred]::CredDeleteW($env:BF_TARGET,1,0)){[Console]::Out.Write('BFOK')}`;
+  }
+  const env = { ...process.env, BF_TARGET: target };
+  if (secret !== void 0) env.BF_SECRET = secret;
+  const r = spawnSync(
+    "powershell",
+    ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", "-"],
+    { input: PS_HEADER + body, env, encoding: "utf8" }
+  );
+  return { status: r.status, stdout: typeof r.stdout === "string" ? r.stdout : "" };
+}
+function winTarget(account) {
+  return `${SERVICE}:${account}`;
+}
+function keychainAvailable() {
+  if (process.platform === "darwin") return has("security");
+  if (process.platform === "linux") return has("secret-tool");
+  if (isWin) return has("powershell");
+  return false;
+}
+function keychainGet(account) {
+  if (process.platform === "darwin") {
+    const r = spawnSync("security", ["find-generic-password", "-a", account, "-s", SERVICE, "-w"], { encoding: "utf8" });
+    if (r.status === 0 && typeof r.stdout === "string") return r.stdout.replace(/\n$/, "");
+    return null;
+  }
+  if (process.platform === "linux") {
+    const r = spawnSync("secret-tool", ["lookup", "service", SERVICE, "account", account], { encoding: "utf8" });
+    if (r.status === 0 && r.stdout) return r.stdout.replace(/\n$/, "");
+    return null;
+  }
+  if (isWin) {
+    const r = winPS("get", winTarget(account));
+    if (r.status === 0 && r.stdout) return r.stdout.replace(/\r?\n$/, "");
+    return null;
+  }
+  return null;
+}
+var SERVICE, isWin, WIN_CS, PS_HEADER;
+var init_keychain = __esm({
+  "src/keychain.ts"() {
+    "use strict";
+    SERVICE = "blindfold";
+    isWin = process.platform === "win32";
+    WIN_CS = `
+using System;
+using System.Runtime.InteropServices;
+public static class BFCred {
+  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
+  public struct CREDENTIAL {
+    public UInt32 Flags; public UInt32 Type;
+    [MarshalAs(UnmanagedType.LPWStr)] public string TargetName;
+    [MarshalAs(UnmanagedType.LPWStr)] public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public UInt32 CredentialBlobSize; public IntPtr CredentialBlob; public UInt32 Persist;
+    public UInt32 AttributeCount; public IntPtr Attributes;
+    [MarshalAs(UnmanagedType.LPWStr)] public string TargetAlias;
+    [MarshalAs(UnmanagedType.LPWStr)] public string UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredWriteW(ref CREDENTIAL c, UInt32 f);
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredReadW(string t, UInt32 ty, UInt32 f, out IntPtr c);
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredDeleteW(string t, UInt32 ty, UInt32 f);
+  [DllImport("advapi32.dll")] public static extern void CredFree(IntPtr c);
+}
+`;
+    PS_HEADER = `$ErrorActionPreference='Stop'
+Add-Type -TypeDefinition @"
+${WIN_CS}
+"@
+`;
+  }
+});
+
+// src/env.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+function repoRoot() {
+  if (_repoRoot) return _repoRoot;
+  let dir = process.cwd();
+  for (let i = 0; i < 12; i++) {
+    if (fs.existsSync(path.join(dir, ".env")) || fs.existsSync(path.join(dir, ".blindfold")) || fs.existsSync(path.join(dir, ".git"))) {
+      _repoRoot = dir;
+      return dir;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  _repoRoot = SRC_RELATIVE_ROOT;
+  return _repoRoot;
+}
+function homeDir() {
+  return path.join(os.homedir(), ".blindfold");
+}
+function configPath() {
+  return path.join(homeDir(), "config.json");
+}
+function stateDir() {
+  const override = process.env.BLINDFOLD_STATE_DIR;
+  if (override && override.trim()) return path.resolve(override.trim());
+  const home = homeDir();
+  if (!fs.existsSync(home)) {
+    try {
+      const legacy = path.join(repoRoot(), ".blindfold");
+      if (fs.existsSync(legacy) && fs.statSync(legacy).isDirectory()) {
+        fs.cpSync(legacy, home, { recursive: true });
+      } else {
+        fs.mkdirSync(home, { recursive: true });
+      }
+    } catch {
+      try {
+        fs.mkdirSync(home, { recursive: true });
+      } catch {
+      }
+    }
+  }
+  return home;
+}
+function assertSafeOverrideUrl(raw, label) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new Error(`${label} is not a valid URL: ${raw}`);
+  }
+  const isLocal = ["localhost", "127.0.0.1", "::1", "[::1]"].includes(u.hostname);
+  if (u.protocol !== "https:" && !isLocal) {
+    throw new Error(`${label} must be https (got ${u.protocol}//${u.hostname}); refusing to trust an insecure endpoint`);
+  }
+}
+function withFileLockSync(target, fn) {
+  const lockPath = `${target}.lock`;
+  const deadline = Date.now() + 1e4;
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+  const sleep = (ms) => {
+    try {
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+    } catch {
+    }
+  };
+  for (; ; ) {
+    try {
+      const fd = fs.openSync(lockPath, "wx");
+      fs.writeSync(fd, String(process.pid));
+      fs.closeSync(fd);
+      break;
+    } catch (e) {
+      if (e?.code !== "EEXIST") throw e;
+      try {
+        const st = fs.statSync(lockPath);
+        if (Date.now() - st.mtimeMs > 1e4) {
+          fs.rmSync(lockPath, { force: true });
+          continue;
+        }
+      } catch {
+      }
+      if (Date.now() > deadline) throw new Error(`timed out acquiring lock ${lockPath}`);
+      sleep(25);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    fs.rmSync(lockPath, { force: true });
+  }
+}
+function defaultEnvPath() {
+  return path.join(repoRoot(), ".env");
+}
+function loadEnvFromFile(envPath = path.join(repoRoot(), ".env")) {
+  if (!fs.existsSync(envPath)) return;
+  const text = fs.readFileSync(envPath, "utf8");
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    let val = line.slice(eq + 1).trim();
+    if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+      val = val.slice(1, -1);
+    }
+    if (process.env[key] === void 0) process.env[key] = val;
+  }
+}
+function loadHomeConfig() {
+  try {
+    const cfg = configPath();
+    if (fs.existsSync(cfg)) {
+      const obj = JSON.parse(fs.readFileSync(cfg, "utf8"));
+      for (const [k, v] of Object.entries(obj)) {
+        if (k === "T3N_API_KEY_STORE") continue;
+        if (typeof v === "string" && process.env[k] === void 0) process.env[k] = v;
+      }
+    }
+  } catch {
+  }
+  loadEnvFromFile(path.join(homeDir(), ".env"));
+  if (process.env.T3N_API_KEY === void 0 && process.env.DID && keychainAvailable()) {
+    const k = keychainGet(process.env.DID);
+    if (k) process.env.T3N_API_KEY = k;
+  }
+}
+function loadBlindfoldEnv() {
+  loadEnvFromFile();
+  loadHomeConfig();
+  const t3nApiKey = process.env.T3N_API_KEY ?? "";
+  const did = process.env.DID ?? "";
+  const port = Number.parseInt(process.env.BLINDFOLD_PORT ?? "8787", 10);
+  const t3EnvRaw = (process.env.BLINDFOLD_T3_ENV ?? "testnet").toLowerCase();
+  const t3Env = t3EnvRaw === "production" ? "production" : "testnet";
+  const t3BaseUrl = (process.env.T3_BASE_URL ?? process.env.BLINDFOLD_BASE_URL ?? "").trim();
+  if (t3BaseUrl) {
+    assertSafeOverrideUrl(t3BaseUrl, process.env.T3_BASE_URL ? "T3_BASE_URL" : "BLINDFOLD_BASE_URL");
+  }
+  const mock = process.env.BLINDFOLD_MOCK === "1";
+  return { t3nApiKey, did, port, t3Env, t3BaseUrl, mock };
+}
+function assertRealReady(env) {
+  if (env.mock) return;
+  const missing = [];
+  if (!env.t3nApiKey) missing.push("T3N_API_KEY");
+  if (!env.did) missing.push("DID");
+  if (missing.length > 0) {
+    throw new Error(
+      `Missing required env: ${missing.join(", ")}. Claim them at https://docs.terminal3.io/developers/adk/get-started/prerequisites/request-test-tokens, then put them in .env. Or set BLINDFOLD_MOCK=1 to use mock mode for the demo only.`
+    );
+  }
+}
+function pluckSecret(envName) {
+  const v = process.env[envName];
+  if (!v) {
+    throw new Error(`environment variable ${envName} is unset or empty`);
+  }
+  return v;
+}
+var HERE, SRC_RELATIVE_ROOT, _repoRoot;
+var init_env = __esm({
+  "src/env.ts"() {
+    "use strict";
+    init_keychain();
+    HERE = path.dirname(fileURLToPath(import.meta.url));
+    SRC_RELATIVE_ROOT = path.resolve(HERE, "..", "..", "..");
+    _repoRoot = null;
+  }
+});
+
+// src/log.ts
+function safeLog(level, obj) {
+  const safe = typeof obj === "string" ? { msg: obj } : redact(obj);
+  const line = JSON.stringify({ t: (/* @__PURE__ */ new Date()).toISOString(), level, ...safe });
+  process.stderr.write(line + "\n");
+}
+function redact(input) {
+  const out = {};
+  for (const [k, v] of Object.entries(input)) {
+    if (k === "headers" && v && typeof v === "object") {
+      out[k] = redactHeaders(v);
+    } else if (HEADER_BLOCKLIST.has(k.toLowerCase())) {
+      out[k] = "[redacted]";
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function redactHeaders(h) {
+  if (Array.isArray(h)) {
+    return h.map(([k, v]) => [k, HEADER_BLOCKLIST.has(k.toLowerCase()) ? "[redacted]" : v]);
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(h)) {
+    out[k] = HEADER_BLOCKLIST.has(k.toLowerCase()) ? "[redacted]" : String(v);
+  }
+  return out;
+}
+var HEADER_BLOCKLIST;
+var init_log = __esm({
+  "src/log.ts"() {
+    "use strict";
+    HEADER_BLOCKLIST = /* @__PURE__ */ new Set([
+      "authorization",
+      "proxy-authorization",
+      "x-api-key",
+      "cookie",
+      "set-cookie"
+    ]);
+  }
+});
+
+// src/t3-client.ts
+var t3_client_exports = {};
+__export(t3_client_exports, {
+  SignupEmailTakenError: () => SignupEmailTakenError,
+  T3TimeoutError: () => T3TimeoutError,
+  loadEgressHosts: () => loadEgressHosts,
+  openT3Client: () => openT3Client,
+  signupTenant: () => signupTenant
+});
+import { createHash, randomBytes } from "node:crypto";
+import fs2 from "node:fs";
+import path2 from "node:path";
+function withDeadline(promise, label, ms = T3_TIMEOUT_MS) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new T3TimeoutError(`T3 ${label} timed out after ${ms}ms`)), ms);
+    if (typeof timer.unref === "function") timer.unref();
+    promise.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e) => {
+        clearTimeout(timer);
+        reject(e);
+      }
+    );
+  });
+}
+function egressCachePath() {
+  return process.env.BLINDFOLD_EGRESS_CACHE ?? path2.join(stateDir(), "egress-hosts.json");
+}
+function loadEgressHosts(did) {
+  try {
+    const all = JSON.parse(fs2.readFileSync(egressCachePath(), "utf8"));
+    return Array.isArray(all[did]) ? all[did] : [];
+  } catch {
+    return [];
+  }
+}
+function saveEgressHosts(did, hosts) {
+  const p = egressCachePath();
+  withFileLockSync(p, () => {
+    let all = {};
+    try {
+      all = JSON.parse(fs2.readFileSync(p, "utf8"));
+    } catch {
+    }
+    const existing = Array.isArray(all[did]) ? all[did] : [];
+    all[did] = Array.from(/* @__PURE__ */ new Set([...existing, ...hosts])).sort();
+    fs2.mkdirSync(path2.dirname(p), { recursive: true });
+    fs2.writeFileSync(p, JSON.stringify(all, null, 2));
+  });
+}
+async function loadSdk() {
+  if (sdkCache) return sdkCache;
+  try {
+    const mod = await import("@terminal3/t3n-sdk");
+    sdkCache = mod;
+    return mod;
+  } catch {
+    throw new Error(
+      "@terminal3/t3n-sdk not installed. Run `npm install @terminal3/t3n-sdk` for REAL T3 mode, or set BLINDFOLD_MOCK=1 to keep using mock mode."
+    );
+  }
+}
+async function signupTenant(opts) {
+  const sdk = await loadSdk();
+  sdk.setEnvironment(opts.env);
+  const baseUrl = opts.baseUrl || sdk.NODE_URLS[opts.env];
+  const wasmComponent = await sdk.loadWasmComponent();
+  const key = "0x" + randomBytes(32).toString("hex");
+  const address = sdk.eth_get_address(key);
+  const t3n = new sdk.T3nClient({
+    baseUrl,
+    wasmComponent,
+    handlers: { EthSign: sdk.metamask_sign(address, void 0, key) }
+  });
+  await t3n.handshake();
+  const did = String(await t3n.authenticate(sdk.createEthAuthInput(address)));
+  const channel = { emailChannel: { emailAddress: opts.email } };
+  await t3n.otpRequest(channel);
+  const code = String(await opts.getOtpCode(opts.email, "email")).trim();
+  const verify = await t3n.otpVerify({ otpCode: code, request: channel });
+  if (verify.mergeSuggestion) {
+    throw new SignupEmailTakenError(opts.email, verify.mergeSuggestion.existingDid);
+  }
+  if (verify.status === "otp_failed" || verify.status === "otp_expired") {
+    throw new Error(
+      verify.status === "otp_expired" ? "the code expired \u2014 run `blindfold signup` again to get a fresh one" : "that code was incorrect \u2014 re-run `blindfold signup` and enter the emailed code"
+    );
+  }
+  if (opts.onKeyReady) await opts.onKeyReady(key, did);
+  const result = await t3n.submitUserInput({
+    profile: { email_address: opts.email, ...opts.profile ?? {} },
+    becomeDevTenant: true
+  });
+  const admit = result.tenantAdmit;
+  return {
+    key,
+    did,
+    address,
+    env: opts.env,
+    admitStatus: admit?.status ?? "unknown",
+    grantedCredits: admit?.grantedCredits,
+    refusedReason: admit?.reason,
+    refusedDetail: admit?.detail
+  };
+}
+async function openT3Client(env) {
+  if (env.mock) return openMockClient();
+  assertRealReady(env);
+  return openRealClient(env);
+}
+async function openRealClient(env) {
+  if (!/^0x[0-9a-fA-F]{64}$/.test(env.t3nApiKey)) {
+    throw new Error("T3N_API_KEY must be a 0x-prefixed 32-byte hex (secp256k1 private key).");
+  }
+  if (!/^did:t3n:[0-9a-fA-F]+$/.test(env.did)) {
+    throw new Error('DID must look like "did:t3n:<hex>".');
+  }
+  const sdk = await loadSdk();
+  sdk.setEnvironment(env.t3Env);
+  const baseUrl = env.t3BaseUrl || sdk.NODE_URLS[env.t3Env];
+  const wasmComponent = await sdk.loadWasmComponent();
+  const address = sdk.eth_get_address(env.t3nApiKey);
+  const t3n = new sdk.T3nClient({
+    baseUrl,
+    wasmComponent,
+    handlers: { EthSign: sdk.metamask_sign(address, void 0, env.t3nApiKey) }
+  });
+  await t3n.handshake();
+  await t3n.authenticate(sdk.createEthAuthInput(address));
+  const tenant = new sdk.TenantClient({
+    environment: env.t3Env,
+    baseUrl,
+    tenantDid: env.did,
+    t3n
+  });
+  const seedSecret = async (name, value) => {
+    await tenant.executeControl("map-entry-set", {
+      map_name: tenant.canonicalName("secrets"),
+      key: name,
+      value
+    });
+    safeLog("info", { msg: "seeded", name });
+  };
+  const registerContract2 = async (wasm) => {
+    const r = await tenant.contracts.register({
+      tail: CONTRACT_TAIL,
+      version: CONTRACT_VERSION,
+      wasm
+    });
+    return {
+      contractId: r.contract_id ?? r.contractId ?? "(unknown)"
+    };
+  };
+  const invokeForward = async (req) => {
+    const raw = await withDeadline(tenant.contracts.execute(CONTRACT_TAIL, {
+      version: CONTRACT_VERSION,
+      functionName: "forward",
+      input: req
+    }), "forward");
+    if (typeof raw.status === "number" && Array.isArray(raw.headers)) {
+      return { status: raw.status, headers: raw.headers, body: raw.body ?? "" };
+    }
+    return {
+      status: raw.code ?? 502,
+      headers: [["content-type", "application/json"]],
+      body: raw.body ?? ""
+    };
+  };
+  const decodeSecret = (v) => {
+    if (typeof v === "string") return v;
+    if (Array.isArray(v)) return Buffer.from(v).toString("utf8");
+    if (v && typeof v === "object") {
+      const o = v;
+      if (typeof o.value === "string") return o.value;
+      if (Array.isArray(o.value)) return Buffer.from(o.value).toString("utf8");
+      const entry = o.entry;
+      if (entry && typeof entry.value === "string") return entry.value;
+    }
+    return "";
+  };
+  const releaseSecret = async (name) => {
+    try {
+      const r = await withDeadline(tenant.contracts.execute(CONTRACT_TAIL, {
+        version: CONTRACT_VERSION,
+        functionName: "release-to-tenant",
+        input: { secret_key: name }
+      }), "release-to-tenant");
+      if (r && r.ok && r.value) return r.value;
+    } catch (e) {
+      if (e instanceof T3TimeoutError) throw e;
+    }
+    const direct = decodeSecret(
+      await withDeadline(tenant.executeControl("map-entry-get", {
+        map_name: tenant.canonicalName("secrets"),
+        key: name
+      }), "map-entry-get")
+    );
+    if (!direct) throw new Error(`secret "${name}" not found in the secrets map`);
+    return direct;
+  };
+  const me = async () => {
+    const info = await tenant.tenant.me();
+    return { tenant: String(info.tenant ?? ""), status: info.status };
+  };
+  const agentAuthUpdate = async (agentDid, hosts, functions) => {
+    let ucv = "0.1.0";
+    if (typeof sdk.getScriptVersion === "function") {
+      try {
+        const v = await sdk.getScriptVersion(baseUrl, "tee:user/contracts");
+        if (typeof v === "string" && /^\d/.test(v)) ucv = v;
+      } catch {
+      }
+    }
+    const didHex = env.did.replace(/^did:t3n:/, "");
+    const revoking = functions.length === 0 && hosts.length === 0;
+    const scripts = [{
+      scriptName: `z:${didHex}:${CONTRACT_TAIL}`,
+      versionReq: `>=${CONTRACT_VERSION}`,
+      functions: revoking ? ["forward"] : functions,
+      allowedHosts: revoking ? [] : hosts
+    }];
+    await t3n.execute({
+      script_name: "tee:user/contracts",
+      script_version: ucv,
+      function_name: "agent-auth-update",
+      input: { agents: [{ agentDid, scripts }] }
+    });
+  };
+  const grantEgress = async (hosts, opts) => {
+    const prev = opts?.replace ? [] : loadEgressHosts(env.did);
+    const merged = Array.from(/* @__PURE__ */ new Set([...prev, ...hosts])).sort();
+    await agentAuthUpdate(env.did, merged, ["forward", "release-to-tenant"]);
+    saveEgressHosts(env.did, merged);
+    return merged;
+  };
+  const setAgentGrant = (agentDid, hosts, functions) => agentAuthUpdate(agentDid, hosts, functions);
+  const verifySecret = async (name) => {
+    try {
+      const value = await releaseSecret(name);
+      return { present: true, length: value.length, fingerprint: createHash("sha256").update(value).digest("hex").slice(0, 8) };
+    } catch {
+      return { present: false, length: 0, fingerprint: "" };
+    }
+  };
+  const getBalance = async () => {
+    const page = await withDeadline(tenant.token.getUsage(), "token.getUsage");
+    const b = page.balance ?? {};
+    return {
+      available: Number(b.available ?? 0),
+      reserved: Number(b.reserved ?? 0),
+      creditExhausted: Boolean(b.credit_exhausted),
+      storageDeposit: b.storage_deposit != null ? Number(b.storage_deposit) : void 0
+    };
+  };
+  return {
+    close: async () => {
+    },
+    seedSecret,
+    invokeForward,
+    registerContract: registerContract2,
+    releaseSecret,
+    me,
+    grantEgress,
+    setAgentGrant,
+    verifySecret,
+    getBalance,
+    isReal: true
+  };
+}
+function openMockClient() {
+  return {
+    close: async () => {
+    },
+    async seedSecret(name, value) {
+      if (!value || value.length === 0) throw new Error(`secret ${name} is empty`);
+      safeLog("info", { msg: "mock-seed (value dropped, length only)", name, length: value.length });
+    },
+    async registerContract(wasm) {
+      safeLog("info", { msg: "mock-register-contract", wasmBytes: wasm.byteLength });
+      return { contractId: "mock-contract-1" };
+    },
+    async invokeForward(req) {
+      safeLog("info", {
+        msg: "mock-forward",
+        method: req.method,
+        url: schemeAndHost(req.url),
+        secret_key: req.secret_key
+      });
+      const body = `{"mock":true,"note":"Blindfold mock mode \u2014 no real call made.","echo":{"url":${JSON.stringify(req.url)}}}`;
+      return { status: 200, headers: [["content-type", "application/json"]], body };
+    },
+    async releaseSecret(name) {
+      safeLog("info", { msg: "mock-release", name });
+      return `mock-released:${name}`;
+    },
+    async me() {
+      return { tenant: "did:t3n:mock", status: "active" };
+    },
+    async grantEgress(hosts) {
+      safeLog("info", { msg: "mock-grant-egress", hosts });
+      return hosts;
+    },
+    async setAgentGrant(agentDid, hosts, functions) {
+      safeLog("info", { msg: "mock-set-agent-grant", agentDid, hosts, functions });
+    },
+    async verifySecret(name) {
+      return { present: true, length: 0, fingerprint: `mock-${name}`.slice(0, 8) };
+    },
+    async getBalance() {
+      return { available: 1e9, reserved: 0, creditExhausted: false, mock: true };
+    },
+    isReal: false
+  };
+}
+function schemeAndHost(url) {
+  try {
+    const u = new URL(url);
+    return `${u.protocol}//${u.host}`;
+  } catch {
+    return "<bad-url>";
+  }
+}
+var T3_TIMEOUT_MS, T3TimeoutError, sdkCache, SignupEmailTakenError;
+var init_t3_client = __esm({
+  "src/t3-client.ts"() {
+    "use strict";
+    init_constants();
+    init_env();
+    init_log();
+    T3_TIMEOUT_MS = Number(process.env.BLINDFOLD_T3_TIMEOUT_MS) || 3e4;
+    T3TimeoutError = class extends Error {
+    };
+    sdkCache = null;
+    SignupEmailTakenError = class extends Error {
+      constructor(email, existingDid) {
+        super(`"${email}" is already registered to Terminal 3 tenant ${existingDid}.`);
+        this.email = email;
+        this.existingDid = existingDid;
+        this.name = "SignupEmailTakenError";
+      }
+    };
+  }
+});
+
+// src/index.ts
+init_constants();
+
+// src/proxy.ts
+init_constants();
+init_env();
+init_log();
+init_t3_client();
+import http from "node:http";
+import crypto from "node:crypto";
+import fs4 from "node:fs";
+import net from "node:net";
+
+// src/usage-log.ts
+init_env();
+import fs3 from "node:fs";
+import path3 from "node:path";
+function defaultLogPath() {
+  return process.env.BLINDFOLD_USAGE_LOG ?? path3.join(stateDir(), "usage.jsonl");
+}
+var USAGE_MAX_BYTES = Number(process.env.BLINDFOLD_USAGE_MAX_BYTES) || 10 * 1024 * 1024;
+function rotateIfNeeded(p) {
+  try {
+    const size = fs3.statSync(p).size;
+    if (size < USAGE_MAX_BYTES) return;
+    if (fs3.existsSync(`${p}.1`)) fs3.renameSync(`${p}.1`, `${p}.2`);
+    fs3.renameSync(p, `${p}.1`);
+  } catch {
+  }
+}
+var ensuredDirs = /* @__PURE__ */ new Set();
+var ROTATE_CHECK_EVERY = 500;
+var writesSinceRotateCheck = ROTATE_CHECK_EVERY;
+function logUsage(event) {
+  const p = defaultLogPath();
+  try {
+    const dir = path3.dirname(p);
+    if (!ensuredDirs.has(dir)) {
+      fs3.mkdirSync(dir, { recursive: true });
+      ensuredDirs.add(dir);
+    }
+    if (++writesSinceRotateCheck >= ROTATE_CHECK_EVERY) {
+      writesSinceRotateCheck = 0;
+      rotateIfNeeded(p);
+    }
+    fs3.appendFile(p, JSON.stringify(event) + "\n", () => {
+    });
+  } catch {
+  }
+}
+function readUsage() {
+  const p = defaultLogPath();
+  if (!fs3.existsSync(p)) return [];
+  return fs3.readFileSync(p, "utf8").split("\n").filter(Boolean).map((line) => {
+    try {
+      return JSON.parse(line);
+    } catch {
+      return null;
+    }
+  }).filter((e) => e !== null);
+}
+function readUsageTail(n = 500) {
+  const p = defaultLogPath();
+  if (!fs3.existsSync(p)) return [];
+  const fd = fs3.openSync(p, "r");
+  try {
+    const size = fs3.fstatSync(fd).size;
+    const readLen = Math.min(size, Math.max(64 * 1024, n * 2048));
+    const buf = Buffer.alloc(readLen);
+    fs3.readSync(fd, buf, 0, readLen, size - readLen);
+    let text = buf.toString("utf8");
+    if (readLen < size) {
+      const nl = text.indexOf("\n");
+      if (nl >= 0) text = text.slice(nl + 1);
+    }
+    const events = text.split("\n").filter(Boolean).map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        return null;
+      }
+    }).filter((e) => e !== null);
+    return events.slice(-n);
+  } finally {
+    fs3.closeSync(fd);
+  }
+}
+function clearUsage() {
+  const p = defaultLogPath();
+  if (fs3.existsSync(p)) fs3.unlinkSync(p);
+}
+function providerForUpstream(upstream) {
+  try {
+    const u = new URL(upstream);
+    const h = u.hostname;
+    if (h.endsWith("openai.com")) return "openai";
+    if (h.endsWith("anthropic.com")) return "anthropic";
+    if (h.endsWith("googleapis.com")) return "google";
+    if (h.endsWith("x.ai")) return "xai";
+    if (h.endsWith("groq.com")) return "groq";
+    return h;
+  } catch {
+    return "unknown";
+  }
+}
+
+// src/providers.ts
+init_constants();
+function amzDate(now = /* @__PURE__ */ new Date()) {
+  const p = (n) => String(n).padStart(2, "0");
+  return `${now.getUTCFullYear()}${p(now.getUTCMonth() + 1)}${p(now.getUTCDate())}T${p(now.getUTCHours())}${p(now.getUTCMinutes())}${p(now.getUTCSeconds())}Z`;
+}
+var awsRegion = () => process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || "us-east-1";
+var awsAccessKeyId = () => process.env.AWS_ACCESS_KEY_ID || "";
+function stripPrefix(path6, prefix) {
+  const rest = path6.slice(prefix.length - 1);
+  return rest.startsWith("/") ? rest : `/${rest}`;
+}
+var PROVIDERS = [
+  // ---- LLM providers (OpenAI-shaped, bearer). Back-compatible. --------------
+  { id: "openai", prefix: "/v1/", upstream: (p) => `https://api.openai.com${p}`, auth: () => ({ scheme: "bearer" }) },
+  { id: "openai", prefix: "/openai/", upstream: (p) => `https://api.openai.com${stripPrefix(p, "/openai/")}`, auth: () => ({ scheme: "bearer" }) },
+  // Anthropic REQUIRES the anthropic-version header on the raw REST API.
+  { id: "anthropic", prefix: "/anthropic/", upstream: (p) => `https://api.anthropic.com${stripPrefix(p, "/anthropic/")}`, auth: () => ({ scheme: "bearer" }), defaultHeaders: { "anthropic-version": "2023-06-01" } },
+  { id: "xai", prefix: "/x/", upstream: (p) => `https://api.x.ai${stripPrefix(p, "/x/")}`, auth: () => ({ scheme: "bearer" }) },
+  { id: "groq", prefix: "/groq/", upstream: (p) => `https://api.groq.com/openai${stripPrefix(p, "/groq/")}`, auth: () => ({ scheme: "bearer" }) },
+  // ---- LLM: Google Gemini (native API — key rides in `x-goog-api-key`). ------
+  // Not OpenAI-shaped and NOT `Authorization: Bearer`. The sentinel is planted
+  // in Google's provider-specific header and swapped for the sealed key inside
+  // the enclave — proving Blindfold handles a provider's real auth convention,
+  // not just the one bearer shape.
+  {
+    id: "gemini",
+    prefix: "/gemini/",
+    upstream: (p) => `https://generativelanguage.googleapis.com${stripPrefix(p, "/gemini/")}`,
+    secretKey: "gemini_api_key",
+    auth: () => ({ scheme: "bearer" }),
+    sentinelHeader: { name: "x-goog-api-key", prefix: "" }
+  },
+  // ---- Payments: Stripe (bearer; pins the API version so behaviour is stable). -----
+  {
+    id: "stripe",
+    prefix: "/stripe/",
+    upstream: (p) => `https://api.stripe.com${stripPrefix(p, "/stripe/")}`,
+    secretKey: "stripe_secret_key",
+    auth: () => ({ scheme: "bearer" }),
+    defaultHeaders: { "stripe-version": "2024-06-20", "content-type": "application/x-www-form-urlencoded" }
+  },
+  // ---- Dev infra: GitHub. GitHub REJECTS requests with no User-Agent (403),
+  //      and best practice is to pin the REST API version + set the Accept type.
+  {
+    id: "github",
+    prefix: "/github/",
+    upstream: (p) => `https://api.github.com${stripPrefix(p, "/github/")}`,
+    secretKey: "github_token",
+    auth: () => ({ scheme: "bearer" }),
+    defaultHeaders: {
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28",
+      "user-agent": "blindfold"
+    }
+  },
+  // ---- Email: SendGrid (bearer; JSON v3 API). -------------------------------
+  {
+    id: "sendgrid",
+    prefix: "/sendgrid/",
+    upstream: (p) => `https://api.sendgrid.com${stripPrefix(p, "/sendgrid/")}`,
+    secretKey: "sendgrid_api_key",
+    auth: () => ({ scheme: "bearer" }),
+    defaultHeaders: { "content-type": "application/json" }
+  },
+  // ---- Comms: Slack (bearer bot token; Web API wants JSON+charset on POST). --
+  {
+    id: "slack",
+    prefix: "/slack/",
+    upstream: (p) => `https://slack.com/api${stripPrefix(p, "/slack/")}`,
+    secretKey: "slack_bot_token",
+    auth: () => ({ scheme: "bearer" }),
+    defaultHeaders: { "content-type": "application/json; charset=utf-8" }
+  },
+  // ---- Telephony: Twilio (HTTP Basic — base64 computed IN the enclave). -----
+  // Username = Account SID (not secret; also appears in the URL path). The
+  // sealed secret is the Auth Token. A generic proxy CANNOT do this: the
+  // base64 must be computed after the secret is joined, inside TDX.
+  {
+    id: "twilio",
+    prefix: "/twilio/",
+    upstream: (p) => `https://api.twilio.com${stripPrefix(p, "/twilio/")}`,
+    secretKey: "twilio_auth_token",
+    auth: () => ({ scheme: "basic", username: process.env.TWILIO_ACCOUNT_SID || "" }),
+    defaultHeaders: { "content-type": "application/x-www-form-urlencoded" }
+  },
+  // ---- Cloud: AWS SES (SigV4 — secret SIGNS, never transmitted). ------------
+  {
+    id: "aws-ses",
+    prefix: "/aws/ses/",
+    upstream: (p) => `https://email.${awsRegion()}.amazonaws.com${stripPrefix(p, "/aws/ses/")}`,
+    secretKey: "aws_secret_access_key",
+    auth: () => ({ scheme: "sigv4", access_key_id: awsAccessKeyId(), region: awsRegion(), service: "ses", amz_date: amzDate() })
+  },
+  // ---- Cloud: AWS S3 (SigV4). -----------------------------------------------
+  {
+    id: "aws-s3",
+    prefix: "/aws/s3/",
+    upstream: (p) => `https://s3.${awsRegion()}.amazonaws.com${stripPrefix(p, "/aws/s3/")}`,
+    secretKey: "aws_secret_access_key",
+    auth: () => ({ scheme: "sigv4", access_key_id: awsAccessKeyId(), region: awsRegion(), service: "s3", amz_date: amzDate() })
+  },
+  // ---- Webhook: Discord. The SECRET IS THE URL — the enclave substitutes the
+  //      sealed webhook URL for the sentinel, so the agent POSTs to /discord
+  //      with only a JSON body and never holds the URL. Needs egress for
+  //      discord.com (`blindfold grant --host discord.com`).
+  {
+    id: "discord",
+    prefix: "/discord",
+    upstream: () => SENTINEL,
+    // enclave replaces this with the sealed webhook URL
+    secretKey: "webhook_discord_url",
+    auth: () => ({ scheme: "webhook" })
+  }
+];
+function resolveProvider(path6) {
+  const def = PROVIDERS.filter((d) => path6.startsWith(d.prefix)).sort((a, b) => b.prefix.length - a.prefix.length)[0];
+  if (!def) return null;
+  return {
+    id: def.id,
+    upstream: def.upstream(path6),
+    secretKey: def.secretKey,
+    auth: def.auth(),
+    sentinelHeader: def.sentinelHeader,
+    defaultHeaders: def.defaultHeaders
+  };
+}
+
+// src/proxy.ts
+var MAX_BODY_BYTES = Number(process.env.BLINDFOLD_MAX_BODY_BYTES) || 5 * 1024 * 1024;
+var BODY_IDLE_MS = Number(process.env.BLINDFOLD_BODY_IDLE_MS) || 3e4;
+var MAX_INFLIGHT = Number(process.env.BLINDFOLD_MAX_INFLIGHT) || 64;
+var inflight = 0;
+var PayloadTooLargeError = class extends Error {
+};
+function tokenMatches(provided, expected) {
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
+var PROXY_TOKEN_HEADER = "x-blindfold-token";
+function isSocketLive(socketPath) {
+  return new Promise((resolve) => {
+    if (!fs4.existsSync(socketPath)) {
+      resolve(false);
+      return;
+    }
+    const c = net.connect(socketPath);
+    const done = (live) => {
+      try {
+        c.destroy();
+      } catch {
+      }
+      resolve(live);
+    };
+    c.once("connect", () => done(true));
+    c.once("error", () => done(false));
+    c.setTimeout(500, () => done(false));
+  });
+}
+async function startProxy(opts = {}) {
+  const env = loadBlindfoldEnv();
+  const port = opts.port ?? env.port ?? 8787;
+  const secretKey = opts.secretKey ?? "openai_api_key";
+  const token = (opts.token ?? process.env.BLINDFOLD_PROXY_TOKEN ?? "").trim() || void 0;
+  const socketPath = opts.socket?.trim() || void 0;
+  if (socketPath && await isSocketLive(socketPath)) {
+    throw new Error(`a Blindfold proxy is already listening on ${socketPath} \u2014 stop it first, or use a different --socket path`);
+  }
+  const t3 = await openT3Client(env);
+  const server = http.createServer((req, res) => {
+    handle(req, res, t3, secretKey, env, token).catch((e) => {
+      if (e instanceof PayloadTooLargeError) {
+        if (!res.headersSent) res.writeHead(413, { "content-type": "text/plain", "connection": "close" });
+        res.end("request body too large");
+        req.destroy();
+        return;
+      }
+      safeLog("error", { msg: "proxy_unhandled", error: e.message });
+      if (!res.headersSent) res.writeHead(500, { "content-type": "text/plain" });
+      res.end("internal proxy error");
+    });
+  });
+  return await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    let prevUmask;
+    const onListening = () => {
+      let url;
+      let bound = 0;
+      if (socketPath) {
+        try {
+          fs4.chmodSync(socketPath, 384);
+        } catch {
+        }
+        if (prevUmask !== void 0) {
+          try {
+            process.umask(prevUmask);
+          } catch {
+          }
+        }
+        url = `unix:${socketPath}`;
+      } else {
+        bound = server.address().port;
+        url = `http://127.0.0.1:${bound}`;
+      }
+      safeLog("info", { msg: "proxy_listening", url, mock: env.mock });
+      resolve({
+        url,
+        port: bound,
+        token,
+        socket: socketPath,
+        close: async () => {
+          await new Promise((r) => server.close(() => r()));
+          if (socketPath) {
+            try {
+              fs4.rmSync(socketPath, { force: true });
+            } catch {
+            }
+          }
+          await t3.close();
+        }
+      });
+    };
+    if (socketPath) {
+      try {
+        fs4.rmSync(socketPath, { force: true });
+      } catch {
+      }
+      prevUmask = process.umask(127);
+      server.listen(socketPath, onListening);
+    } else {
+      server.listen(port, "127.0.0.1", onListening);
+    }
+  });
+}
+async function handle(req, res, t3, secretKey, env, token) {
+  if (req.url === "/health") {
+    res.writeHead(200, { "content-type": "application/json" });
+    res.end(JSON.stringify({ ok: true, mock: env.mock, auth: Boolean(token) }));
+    return;
+  }
+  if (token) {
+    const provided = String(req.headers[PROXY_TOKEN_HEADER] ?? "");
+    if (!provided || !tokenMatches(provided, token)) {
+      safeLog("warn", { msg: "proxy_unauthorized", path: req.url });
+      res.writeHead(401, { "content-type": "text/plain" });
+      res.end(`unauthorized: missing or invalid ${PROXY_TOKEN_HEADER} header`);
+      return;
+    }
+  }
+  const provider = resolveProvider(req.url ?? "/");
+  if (!provider) {
+    res.writeHead(404, { "content-type": "text/plain" });
+    res.end(`no upstream mapping for ${req.url}`);
+    return;
+  }
+  const upstream = provider.upstream;
+  const providerSecretKey = provider.secretKey ?? secretKey;
+  const body = await readBody(req, MAX_BODY_BYTES);
+  const agentSuppliedAuth = Object.keys(req.headers).some((k) => k.toLowerCase() === "authorization");
+  const headers = forwardableHeaders(req.headers);
+  if (provider.auth.scheme === "bearer") {
+    const sh = provider.sentinelHeader ?? { name: "authorization", prefix: "Bearer " };
+    removeHeader(headers, "authorization");
+    ensureHeader(headers, sh.name, `${sh.prefix}${SENTINEL}`);
+  } else {
+    removeHeader(headers, "authorization");
+  }
+  for (const [name, value] of Object.entries(provider.defaultHeaders ?? {})) {
+    if (!headers.some(([k]) => k.toLowerCase() === name.toLowerCase())) {
+      headers.push([name, value]);
+    }
+  }
+  let outboundUrl = upstream;
+  let outboundBody = body.length ? body.toString("utf8") : void 0;
+  const contentType = (headers.find(([k]) => k.toLowerCase() === "content-type")?.[1] ?? "").toLowerCase();
+  if (provider.auth.scheme !== "webhook" && outboundBody && contentType.includes("application/x-www-form-urlencoded")) {
+    const u = new URL(outboundUrl);
+    for (const [k, v] of new URLSearchParams(outboundBody)) u.searchParams.append(k, v);
+    outboundUrl = u.toString();
+    outboundBody = void 0;
+    safeLog("info", { msg: "form_body_to_query", provider: provider.id });
+  }
+  const forwardReq = {
+    method: req.method ?? "GET",
+    url: outboundUrl,
+    headers,
+    body: outboundBody,
+    secret_key: providerSecretKey,
+    auth: provider.auth
+  };
+  safeLog("info", {
+    msg: "proxy_forward",
+    method: forwardReq.method,
+    upstream: upstream.replace(/\?.*$/, "")
+  });
+  if (inflight >= MAX_INFLIGHT) {
+    safeLog("warn", { msg: "proxy_saturated", inflight, max: MAX_INFLIGHT });
+    if (!res.headersSent) res.writeHead(503, { "content-type": "text/plain", "retry-after": "1" });
+    res.end("proxy saturated: too many concurrent enclave calls \u2014 retry shortly");
+    return;
+  }
+  const startedAt = Date.now();
+  let result;
+  inflight++;
+  try {
+    result = await t3.invokeForward(forwardReq);
+  } catch (e) {
+    const { status, body: body2 } = explainForwardError(e);
+    safeLog("error", { msg: "proxy_forward_failed", status, provider: provider.id, error: e.message });
+    if (!res.headersSent) res.writeHead(status, { "content-type": "application/json" });
+    res.end(body2);
+    return;
+  } finally {
+    inflight--;
+  }
+  const latency = Date.now() - startedAt;
+  logUsage({
+    t: (/* @__PURE__ */ new Date()).toISOString(),
+    mode: env.mock ? "mock" : "real",
+    provider: provider.id || providerForUpstream(upstream),
+    method: forwardReq.method,
+    path: req.url ?? "/",
+    upstream: upstream.replace(/\?.*$/, ""),
+    status: result.status,
+    latency_ms: latency,
+    agent_supplied_auth: agentSuppliedAuth,
+    auth_scheme: provider.auth.scheme,
+    sentinel_in_outbound: forwardReq.headers.some(([k, v]) => k.toLowerCase() === "authorization" && v.includes(SENTINEL)),
+    via: "proxy",
+    secret_key: providerSecretKey
+  });
+  res.writeHead(result.status, headersFromTuple(result.headers));
+  const bodyBytes = typeof result.body === "string" ? Buffer.from(result.body, "utf8") : Buffer.from(result.body);
+  res.end(bodyBytes);
+}
+function readBody(req, maxBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let aborted = false;
+    let timer;
+    const fail = (e) => {
+      aborted = true;
+      clearTimeout(timer);
+      reject(e);
+    };
+    const arm = () => {
+      clearTimeout(timer);
+      timer = setTimeout(() => {
+        if (!aborted) fail(new Error(`request body read timed out after ${BODY_IDLE_MS}ms`));
+      }, BODY_IDLE_MS);
+    };
+    arm();
+    req.on("data", (c) => {
+      if (aborted) return;
+      arm();
+      size += c.length;
+      if (size > maxBytes) {
+        fail(new PayloadTooLargeError(`request body exceeds ${maxBytes} bytes`));
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => {
+      clearTimeout(timer);
+      if (!aborted) resolve(Buffer.concat(chunks));
+    });
+    req.on("error", (e) => {
+      if (!aborted) fail(e);
+    });
+  });
+}
+var STRIPPED = /* @__PURE__ */ new Set(["host", "content-length", "connection", "transfer-encoding"]);
+function forwardableHeaders(h) {
+  const out = [];
+  for (const [k, v] of Object.entries(h)) {
+    if (v === void 0) continue;
+    if (STRIPPED.has(k.toLowerCase())) continue;
+    out.push([k, Array.isArray(v) ? v.join(", ") : v]);
+  }
+  return out;
+}
+function ensureHeader(h, name, value) {
+  const lower = name.toLowerCase();
+  const idx = h.findIndex(([k]) => k.toLowerCase() === lower);
+  if (idx >= 0) h[idx] = [name, value];
+  else h.push([name, value]);
+}
+function removeHeader(h, name) {
+  const lower = name.toLowerCase();
+  for (let i = h.length - 1; i >= 0; i--) {
+    if (h[i][0].toLowerCase() === lower) h.splice(i, 1);
+  }
+}
+function headersFromTuple(t) {
+  const out = {};
+  for (const [k, v] of t) out[k] = v;
+  return out;
+}
+function explainForwardError(err) {
+  const msg = err?.message ?? String(err);
+  if (err instanceof T3TimeoutError) {
+    return {
+      status: 504,
+      body: JSON.stringify({
+        error: "blindfold_forward_failed",
+        status: 504,
+        code: "t3_timeout",
+        detail: msg,
+        hint: "The T3 node did not respond within the deadline (BLINDFOLD_T3_TIMEOUT_MS). It may be slow or unreachable; retry, or point T3_BASE_URL at a healthy node."
+      }, null, 2)
+    };
+  }
+  let status = Number(msg.match(/HTTP (\d{3})/)?.[1]) || 502;
+  let code = "";
+  let detail = msg;
+  let requestId = "";
+  const jsonM = msg.match(/\((\{.*\})\)\s*$/);
+  if (jsonM && jsonM[1]) {
+    try {
+      const o = JSON.parse(jsonM[1]);
+      code = o.code ?? "";
+      detail = o.detail ?? detail;
+      requestId = o.request_id ?? "";
+    } catch {
+    }
+  }
+  let hint = "";
+  if (/egress_denied|authorised_hosts|allowlist/i.test(detail)) {
+    const host = detail.match(/host '([^']+)'/)?.[1];
+    hint = `Egress is not authorized${host ? ` for '${host}'` : ""}. Run: blindfold grant --host ${host ?? "<host>"} \u2014 list every host you use in ONE command (grant replaces the allowlist unless merged).`;
+    if (status < 400) status = 403;
+  } else if (/fuel_per_minute|too_many_requests|rate limit/i.test(detail)) {
+    hint = "Rate limited by the testnet per-minute compute quota (fuel_per_minute). Retry in ~60s and space calls out \u2014 this is not an outage.";
+    status = 429;
+  } else if (/cannot read map|:secrets/i.test(detail)) {
+    hint = "The contract isn't authorized to read your secrets map (common right after publishing a new contract id). Run: blindfold init (re-grants the secrets read ACL).";
+  } else if (/parse_payload|expected value at line/i.test(detail)) {
+    hint = "The T3 host egress parses request bodies as JSON. For form-encoded APIs (Stripe/Twilio), send params in the query string with an empty body.";
+    if (status < 400) status = 400;
+  } else if (/secret .* not found|not found in the secrets map/i.test(detail)) {
+    hint = "That sealed secret name doesn't exist. Seal it: blindfold register --name <name> --from-env <ENV_VAR>.";
+  }
+  const payload = {
+    error: "blindfold_forward_failed",
+    status,
+    code: code || void 0,
+    detail,
+    request_id: requestId || void 0,
+    hint: hint || void 0
+  };
+  return { status, body: JSON.stringify(payload, null, 2) };
+}
+
+// src/dashboard.ts
+init_constants();
+init_env();
+import fs6 from "node:fs";
+import http2 from "node:http";
+import path5 from "node:path";
+import { timingSafeEqual } from "node:crypto";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/sealed-ledger.ts
+init_env();
+import fs5 from "node:fs";
+import path4 from "node:path";
+import { createHash as createHash2, createHmac, randomBytes as randomBytes2 } from "node:crypto";
+function defaultSealedLogPath() {
+  return process.env.BLINDFOLD_SEALED_LOG ?? path4.join(stateDir(), "sealed.jsonl");
+}
+function ledgerKey() {
+  try {
+    const keyPath = path4.join(stateDir(), "ledger.key");
+    if (fs5.existsSync(keyPath)) return Buffer.from(fs5.readFileSync(keyPath, "utf8").trim(), "hex");
+    fs5.mkdirSync(path4.dirname(keyPath), { recursive: true });
+    const key = randomBytes2(32);
+    fs5.writeFileSync(keyPath, key.toString("hex"), { mode: 384 });
+    try {
+      fs5.chmodSync(keyPath, 384);
+    } catch {
+    }
+    return key;
+  } catch {
+    return null;
+  }
+}
+function coreString(e) {
+  return JSON.stringify({
+    t: e.t,
+    name: e.name,
+    source: e.source,
+    length: e.length,
+    mode: e.mode,
+    tenant_did: e.tenant_did,
+    map_name: e.map_name
+  });
+}
+function sha(s) {
+  return createHash2("sha256").update(s).digest("hex");
+}
+function chainHash(key, prev, core) {
+  if (key) return { hash: createHmac("sha256", key).update(`${prev}
+${core}`).digest("hex"), alg: "hmac-sha256" };
+  return { hash: sha(`${prev}
+${core}`) };
+}
+function readLastLine(p) {
+  if (!fs5.existsSync(p)) return null;
+  const fd = fs5.openSync(p, "r");
+  try {
+    const size = fs5.fstatSync(fd).size;
+    if (size === 0) return null;
+    const readLen = Math.min(size, 64 * 1024);
+    const buf = Buffer.alloc(readLen);
+    fs5.readSync(fd, buf, 0, readLen, size - readLen);
+    const lines = buf.toString("utf8").split("\n").filter((l) => l.trim().length > 0);
+    return lines.length ? lines[lines.length - 1] : null;
+  } finally {
+    fs5.closeSync(fd);
+  }
+}
+function recordSealed(entry) {
+  const p = defaultSealedLogPath();
+  try {
+    withFileLockSync(p, () => {
+      let prevHash = "";
+      const last = readLastLine(p);
+      if (last) {
+        try {
+          prevHash = JSON.parse(last).hash ?? "";
+        } catch {
+          prevHash = "";
+        }
+      }
+      const { hash, alg } = chainHash(ledgerKey(), prevHash, coreString(entry));
+      const chained = { ...entry, prev: prevHash, hash, ...alg ? { alg } : {} };
+      fs5.mkdirSync(path4.dirname(p), { recursive: true });
+      fs5.appendFileSync(p, JSON.stringify(chained) + "\n");
+    });
+  } catch {
+  }
+}
+function readSealed() {
+  const p = defaultSealedLogPath();
+  if (!fs5.existsSync(p)) return [];
+  return fs5.readFileSync(p, "utf8").split("\n").filter(Boolean).map((l) => {
+    try {
+      return JSON.parse(l);
+    } catch {
+      return null;
+    }
+  }).filter((e) => e !== null);
+}
+function verifyLedgerChain() {
+  const entries = readSealed();
+  const key = ledgerKey();
+  let runningPrev = "";
+  let legacy = 0;
+  let firstBrokenIndex = -1;
+  entries.forEach((e, i) => {
+    if (!e.hash) {
+      legacy++;
+      return;
+    }
+    if (e.alg === "hmac-sha256") {
+      const expected = key ? createHmac("sha256", key).update(`${runningPrev}
+${coreString(e)}`).digest("hex") : null;
+      if (firstBrokenIndex < 0 && (e.prev !== runningPrev || expected !== null && e.hash !== expected)) {
+        firstBrokenIndex = i;
+      }
+      if (expected === null) legacy++;
+    } else {
+      legacy++;
+    }
+    runningPrev = e.hash;
+  });
+  return { ok: firstBrokenIndex < 0, total: entries.length, legacy, firstBrokenIndex };
+}
+
+// src/dashboard.ts
+async function startDashboard(opts = {}) {
+  const port = opts.port ?? DEFAULT_DASHBOARD_PORT;
+  const TOKEN = process.env.BLINDFOLD_DASHBOARD_TOKEN || "";
+  const tokenEq = (candidate) => {
+    const a = Buffer.from(candidate);
+    const b = Buffer.from(TOKEN);
+    return a.length === b.length && timingSafeEqual(a, b);
+  };
+  const authed = (req, url) => {
+    if (!TOKEN) return true;
+    const auth = req.headers.authorization || "";
+    if (auth.startsWith("Bearer ") && tokenEq(auth.slice(7))) return true;
+    try {
+      const t = new URL(url, "http://x").searchParams.get("token");
+      if (t && tokenEq(t)) return true;
+    } catch {
+    }
+    return false;
+  };
+  const server = http2.createServer(async (req, res) => {
+    const url = req.url ?? "/";
+    const pathname = url.split("?")[0];
+    if (!authed(req, url)) {
+      res.writeHead(401, { "content-type": "text/plain" });
+      res.end("unauthorized \u2014 append ?token=<BLINDFOLD_DASHBOARD_TOKEN>");
+      return;
+    }
+    if (req.method === "GET" && pathname === "/logo.png") {
+      try {
+        const HERE2 = path5.dirname(fileURLToPath2(import.meta.url));
+        const candidates = [
+          path5.resolve(HERE2, "..", "..", "..", "assets", "logo.png"),
+          path5.resolve(HERE2, "..", "assets", "logo.png")
+        ];
+        const logo = candidates.find((p) => fs6.existsSync(p));
+        if (logo) {
+          res.writeHead(200, { "content-type": "image/png", "cache-control": "max-age=3600" });
+          res.end(fs6.readFileSync(logo));
+        } else {
+          const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#8b5cf6"/><stop offset="1" stop-color="#ff8c2b"/></linearGradient></defs><rect width="100" height="100" rx="22" fill="#161b22"/><path d="M50 14l28 10v22c0 20-13 33-28 40-15-7-28-20-28-40V24z" fill="url(#g)" opacity="0.92"/><rect x="34" y="46" width="32" height="24" rx="5" fill="#0b0e14"/><rect x="42" y="36" width="16" height="16" rx="8" fill="none" stroke="#0b0e14" stroke-width="5"/></svg>`;
+          res.writeHead(200, { "content-type": "image/svg+xml", "cache-control": "max-age=3600" });
+          res.end(svg);
+        }
+      } catch {
+        res.writeHead(404, { "content-type": "text/plain" }).end("logo not found");
+      }
+      return;
+    }
+    if (req.method === "GET" && (pathname === "/" || pathname === "/index.html")) {
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(HTML);
+      return;
+    }
+    if (req.method === "GET" && pathname === "/api/events") {
+      const limit = Math.min(Number(new URL(url, "http://x").searchParams.get("limit")) || 500, 5e3);
+      const events = readUsageTail(limit);
+      const counters = {};
+      for (const e of events) counters[e.provider] = (counters[e.provider] ?? 0) + 1;
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ events, counters, returned: events.length, source: defaultLogPath() }));
+      return;
+    }
+    if (req.method === "GET" && pathname === "/api/sealed") {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ entries: readSealed(), source: defaultSealedLogPath() }));
+      return;
+    }
+    if (req.method === "GET" && pathname === "/api/stream") {
+      res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
+      res.write(": connected\n\n");
+      const send = () => {
+        try {
+          res.write("event: change\ndata: {}\n\n");
+        } catch {
+        }
+      };
+      const watchers = [];
+      for (const p of [defaultLogPath(), defaultSealedLogPath()]) {
+        try {
+          watchers.push(fs6.watch(path5.dirname(p), () => send()));
+        } catch {
+        }
+      }
+      const hb = setInterval(() => {
+        try {
+          res.write(": ping\n\n");
+        } catch {
+        }
+      }, 15e3);
+      req.on("close", () => {
+        clearInterval(hb);
+        for (const w of watchers) {
+          try {
+            w.close();
+          } catch {
+          }
+        }
+      });
+      return;
+    }
+    if (req.method === "GET" && pathname === "/api/audit/full") {
+      const env = loadBlindfoldEnv();
+      const sealed = readSealed();
+      const latest = /* @__PURE__ */ new Map();
+      for (const s of sealed) latest.set(s.name, s);
+      const results = [];
+      if (!env.mock) {
+        try {
+          const { openT3Client: openT3Client2 } = await Promise.resolve().then(() => (init_t3_client(), t3_client_exports));
+          const client = await openT3Client2(env);
+          try {
+            for (const e of latest.values()) {
+              const v = await client.verifySecret(e.name);
+              results.push({ name: e.name, present: v.present, enclave_len: v.length, ledger_len: e.length, fingerprint: v.fingerprint, ok: v.present && v.length === e.length });
+            }
+          } finally {
+            await client.close();
+          }
+        } catch (err) {
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({ mock: env.mock, error: err.message, results: [] }));
+          return;
+        }
+      }
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ mock: env.mock, results }));
+      return;
+    }
+    if (req.method === "GET" && pathname === "/api/status") {
+      const env = loadBlindfoldEnv();
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({
+        mode: env.mock ? "mock" : "real",
+        tenant_did: env.did || null,
+        tenant_did_short: env.did ? shortenDid(env.did) : null,
+        t3_env: env.t3Env,
+        contract_version: CONTRACT_VERSION,
+        proxy_port: env.port,
+        sdk_installed: isSdkInstalled()
+      }));
+      return;
+    }
+    if (req.method === "GET" && pathname === "/api/audit") {
+      const sealed = readSealed();
+      const envKeys = new Set(readEnvKeyNames());
+      const latestByName = /* @__PURE__ */ new Map();
+      for (const s of sealed) latestByName.set(s.name, s);
+      const exposed = Array.from(latestByName.values()).filter((latest) => envKeys.has(latest.name)).map((latest) => ({ name: latest.name, length: latest.length, sealed_at: latest.t }));
+      const uniqueSealed = latestByName.size;
+      const chain = verifyLedgerChain();
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({
+        exposed_in_env: exposed,
+        env_keys: Array.from(envKeys),
+        sealed_count: uniqueSealed,
+        ledger_chain: chain
+        // { ok, total, legacy, firstBrokenIndex }
+      }));
+      return;
+    }
+    if ((req.method === "POST" || req.method === "DELETE") && pathname === "/api/clear") {
+      clearUsage();
+      res.writeHead(204).end();
+      return;
+    }
+    res.writeHead(404, { "content-type": "text/plain" });
+    res.end("not found");
+  });
+  return await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", () => {
+      const { port: bound } = server.address();
+      resolve({
+        url: `http://127.0.0.1:${bound}`,
+        port: bound,
+        close: () => new Promise((r) => server.close(() => r()))
+      });
+    });
+  });
+}
+function shortenDid(did) {
+  const prefix = "did:t3n:";
+  if (!did.startsWith(prefix)) return did;
+  const tail = did.slice(prefix.length);
+  return tail.length <= 14 ? did : `${prefix}${tail.slice(0, 6)}\u2026${tail.slice(-4)}`;
+}
+function readEnvKeyNames() {
+  const ENV_PATH = defaultEnvPath();
+  if (!fs6.existsSync(ENV_PATH)) return [];
+  return fs6.readFileSync(ENV_PATH, "utf8").split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=", 1)[0]?.trim() ?? "").filter(Boolean);
+}
+function isSdkInstalled() {
+  try {
+    __require.resolve?.("@terminal3/t3n-sdk");
+    return true;
+  } catch {
+    try {
+      const HERE2 = path5.dirname(fileURLToPath2(import.meta.url));
+      return fs6.existsSync(path5.resolve(HERE2, "..", "..", "..", "node_modules", "@terminal3", "t3n-sdk"));
+    } catch {
+      return false;
+    }
+  }
+}
+var HTML = `<!DOCTYPE html>
+<html lang="en" data-theme="dark">
+<head>
+<meta charset="utf-8" />
+<title>Blindfold \u2014 Dashboard</title>
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<link rel="icon" type="image/png" href="/logo.png" />
+<style>
+  :root {
+    --bg:#0b0e14; --bg2:#0e1117; --card:#161b22; --card2:#1c2230; --line:#2a313c;
+    --fg:#e6edf3; --dim:#8b949e; --dim2:#6b7280;
+    --ok:#3fb950; --warn:#d29922; --bad:#f85149; --info:#58a6ff;
+    --accent:#8b5cf6; --accent2:#58a6ff;
+    --orange:#ff8c2b; --orange2:#ff6a3d; --brand:#ff8c2b;
+    --c1:#8b5cf6; --c2:#58a6ff; --c3:#3fb950; --c4:#ff8c2b; --c5:#f85149; --c6:#ff7b72; --c7:#39c5cf; --c8:#f778ba;
+    --line:#333b47; --line-strong:#465061;
+    --shadow:0 1px 3px rgba(0,0,0,.4), 0 8px 24px rgba(0,0,0,.18);
+  }
+  [data-theme="light"] {
+    --bg:#f6f8fa; --bg2:#fff; --card:#fff; --card2:#f3f4f6; --line:#d8dee4; --line-strong:#c2cad3;
+    --fg:#1f2328; --dim:#57606a; --dim2:#8b949e;
+    --shadow:0 1px 2px rgba(0,0,0,.06), 0 8px 24px rgba(0,0,0,.06);
+  }
+  * { box-sizing:border-box; }
+  html,body { max-width:100vw; overflow-x:hidden; }
+  body {
+    margin:0; padding:20px clamp(12px,4vw,40px);
+    font-family:-apple-system,BlinkMacSystemFont,"Segoe UI","Inter",system-ui,sans-serif;
+    background:radial-gradient(1200px 600px at 20% -10%, rgba(139,92,246,.10), transparent 60%), var(--bg);
+    color:var(--fg); line-height:1.5; transition:background .2s,color .2s;
+  }
+  a { color:var(--accent2); }
+  .topbar { display:flex; justify-content:space-between; align-items:center; gap:14px; flex-wrap:wrap; margin-bottom:18px;
+    border:1px solid var(--line-strong); border-radius:16px; padding:16px 20px;
+    background:linear-gradient(180deg,var(--card),var(--card2)); box-shadow:var(--shadow); }
+  .brandwrap { display:flex; align-items:center; gap:16px; min-width:0; }
+  .logo-img { width:clamp(76px,11vw,104px); height:clamp(76px,11vw,104px); border-radius:18px; object-fit:cover; background:var(--card); border:1px solid var(--line-strong); padding:0; box-shadow:var(--shadow); flex:none; animation:logoIn .6s cubic-bezier(.2,.8,.2,1) both; }
+  @keyframes logoIn { from{transform:scale(.7) rotate(-8deg);opacity:0;} to{transform:scale(1) rotate(0);opacity:1;} }
+  h1 { margin:0; font-size:clamp(24px,4.5vw,34px); font-weight:800; letter-spacing:-.5px; display:flex; align-items:baseline; gap:10px; flex-wrap:wrap; }
+  /* wordmark: ribbon-wrap animation \u2014 pure CSS, no runtime deps */
+  .brand { position:relative; display:inline-block; padding-bottom:6px; overflow:hidden; }
+  .brand::after { content:""; position:absolute; left:0; bottom:0; height:3px; width:100%; background:linear-gradient(90deg,var(--orange),var(--orange2)); border-radius:3px; transform-origin:left; transform:scaleX(0); opacity:0; animation:underlineIn .5s 2.2s cubic-bezier(.2,.8,.2,1) both; }
+  @keyframes underlineIn { from{transform:scaleX(0);opacity:.3;} to{transform:scaleX(1);opacity:1;} }
+  .letter { display:inline-block; position:relative; z-index:1; color:var(--fg); text-shadow:none; animation:protectLetter .35s cubic-bezier(.2,.8,.2,1) both; }
+  @keyframes protectLetter { to{ color:#bdc7d4; text-shadow:0 1px 4px rgba(139,92,246,.12); transform:translateY(-0.5px); } }
+  [data-theme="light"] .letter { animation:protectLetterLight .35s cubic-bezier(.2,.8,.2,1) both; }
+  @keyframes protectLetterLight { to{ color:#5a6478; text-shadow:0 1px 4px rgba(139,92,246,.10); transform:translateY(-0.5px); } }
+  .brand > .letter:nth-of-type(5) { animation-delay:0.90s; } .brand > .letter:nth-of-type(4) { animation-delay:0.94s; }
+  .brand > .letter:nth-of-type(6) { animation-delay:0.98s; } .brand > .letter:nth-of-type(3) { animation-delay:1.02s; }
+  .brand > .letter:nth-of-type(7) { animation-delay:1.06s; } .brand > .letter:nth-of-type(2) { animation-delay:1.10s; }
+  .brand > .letter:nth-of-type(8) { animation-delay:1.14s; } .brand > .letter:nth-of-type(1) { animation-delay:1.18s; }
+  .brand > .letter:nth-of-type(9) { animation-delay:1.22s; }
+  .ribbon { position:absolute; top:-25%; height:150%; width:55%; background:linear-gradient(180deg, rgba(50,54,62,0) 0%, rgba(38,42,50,.6) 12%, rgba(28,30,38,.92) 32%, rgba(22,24,30,1) 48%, rgba(28,30,38,.92) 64%, rgba(38,42,50,.6) 84%, rgba(50,54,62,0) 100%); border-radius:4px; z-index:2; pointer-events:none; will-change:transform; transform-origin:left center; animation:ribbonSweep 1.0s .5s cubic-bezier(.65,0,.35,1) both, ribbonSettle .7s 1.5s cubic-bezier(.34,1.56,.64,1) both, ribbonBreeze 3s 2.2s ease-in-out infinite; }
+  @keyframes ribbonSweep { 0%{ transform:translateX(100%) scaleX(.01); } 100%{ transform:translateX(22%) scaleX(1); } }
+  @keyframes ribbonSettle { 0%{ transform:translateX(22%) scaleX(1); } 100%{ transform:translateX(-6%) scaleX(.65) rotate(-1.5deg); } }
+  @keyframes ribbonBreeze { 0%,100%{ transform:translateX(-6%) scaleX(.65) rotate(-1.5deg); } 50%{ transform:translateX(-4%) scaleX(.68) rotate(.8deg); } }
+  @keyframes logoSeal { 0%{ filter:brightness(1) saturate(1); } 25%{ filter:brightness(1.06) saturate(1.1); box-shadow:0 0 0 1px rgba(139,92,246,.15); } 60%{ filter:brightness(1.03) saturate(1.05); } 100%{ filter:brightness(1) saturate(1); } }
+  .logo-img { animation:logoIn .6s cubic-bezier(.2,.8,.2,1) both, logoSeal 2.2s .6s ease both; }
+  .eyebrow { font-size:.42em; font-weight:600; color:var(--dim); text-transform:uppercase; letter-spacing:1.5px; }
+  .tagline { font-size:12px; color:var(--dim); margin-top:7px; display:flex; align-items:center; gap:6px; }
+  .tagline .lock { color:var(--orange); display:inline-block; animation:clack .5s .45s cubic-bezier(.3,1.4,.5,1) both; }
+  @keyframes clack { from{transform:rotate(-35deg) translateY(-2px);opacity:0;} to{transform:rotate(0) translateY(0);opacity:1;} }
+  /* --- Distinctive "decrypt \u2192 seal" wordmark animation (JS-driven) --- */
+  .letter.scrambling { color:var(--accent); font-family:ui-monospace,SFMono-Regular,Menlo,monospace; opacity:.92; }
+  .letter.sealed { animation:sealSnap .55s cubic-bezier(.2,1.4,.4,1) both; }
+  @keyframes sealSnap {
+    0%   { color:var(--accent); text-shadow:0 0 14px rgba(139,92,246,.95),0 0 4px rgba(139,92,246,.8); transform:translateY(-3px) scale(1.18); }
+    55%  { color:var(--fg);     text-shadow:0 0 8px rgba(139,92,246,.5);  transform:translateY(1px)  scale(.97);  }
+    100% { color:var(--fg);     text-shadow:none; transform:none; }
+  }
+  /* seal sweep: a vertical light bar that passes across the word once as it seals */
+  .sealbar { position:absolute; top:-22%; height:144%; width:16px; left:-8%; z-index:3; pointer-events:none; border-radius:9px; opacity:0;
+    background:linear-gradient(90deg,transparent, rgba(139,92,246,.55) 45%, rgba(88,166,255,.35) 60%, transparent); filter:blur(2px); }
+  .sealbar.run { animation:sealSweep 1.15s cubic-bezier(.5,0,.3,1) both; }
+  @keyframes sealSweep { 0%{ left:-8%; opacity:0;} 12%{opacity:1;} 86%{opacity:1;} 100%{ left:104%; opacity:0;} }
+  @media (prefers-reduced-motion:reduce){ .logo-img,.letter,.ribbon,.brand::after,.tagline .lock,.sealbar{ animation:none!important; } .ribbon,.sealbar{ display:none; } .letter{ color:var(--fg)!important; transform:none!important; text-shadow:none!important; } .brand::after{ transform:scaleX(1)!important; opacity:1!important; } }
+  .tagline b { color:var(--fg); font-weight:600; }
+  .tags { display:flex; gap:6px; margin-top:8px; flex-wrap:wrap; align-items:center; }
+  .tag { display:inline-flex; align-items:center; gap:5px; font-size:11px; color:var(--dim); background:var(--card); border:1px solid var(--line); border-radius:20px; padding:3px 10px; max-width:100%; }
+  .tag.live { color:var(--ok); border-color:rgba(63,185,80,.45); background:rgba(63,185,80,.08); font-weight:600; }
+  .tag.orange { color:var(--orange); border-color:rgba(255,140,43,.45); background:rgba(255,140,43,.08); }
+  .tag.path { color:var(--dim); }
+  .tag.path code { background:none; padding:0; max-width:min(52vw,420px); overflow:hidden; text-overflow:ellipsis; white-space:nowrap; display:inline-block; vertical-align:bottom; }
+  .live-dot { width:7px; height:7px; border-radius:50%; background:var(--ok); box-shadow:0 0 0 0 rgba(63,185,80,.6); animation:pulse 2s infinite; }
+  @keyframes pulse { 0%{box-shadow:0 0 0 0 rgba(63,185,80,.5);} 70%{box-shadow:0 0 0 6px rgba(63,185,80,0);} 100%{box-shadow:0 0 0 0 rgba(63,185,80,0);} }
+  .controls { display:flex; gap:8px; align-items:center; flex-wrap:wrap; }
+  .controls label { font-size:12px; color:var(--dim); display:flex; align-items:center; gap:4px; }
+  select,button { background:var(--card); color:var(--fg); border:1px solid var(--line-strong); border-radius:8px; padding:6px 10px; font-size:12px; cursor:pointer; transition:border-color .15s,background .15s,transform .05s; }
+  button:hover,select:hover { border-color:var(--orange); color:var(--orange); }
+  button:active { transform:translateY(1px); }
+  .copybtn { background:transparent; border:1px solid var(--line); border-radius:6px; padding:2px 9px; font-size:11px; cursor:pointer; color:var(--dim); transition:border-color .15s,color .15s; }
+  .copybtn:hover { border-color:var(--orange); color:var(--orange); }
+  .copybtn.done { color:var(--ok); border-color:var(--ok); }
+  .copybtn.err { color:var(--bad); border-color:var(--bad); }
+  .copybtn.ref { color:var(--orange); border-color:rgba(255,140,43,.4); }
+  .copybtn.ref:hover { background:rgba(255,140,43,.08); }
+  code.sentinel { color:var(--orange); background:rgba(255,140,43,.10); border:1px solid rgba(255,140,43,.22); font-weight:600; }
+  .cmdname { color:var(--accent2); font-weight:600; }
+  @media (max-width:620px){
+    .topbar { flex-direction:column; align-items:stretch; }
+    .controls { display:grid; grid-template-columns:1fr 1fr; gap:8px; }
+    .controls label { width:100%; }
+    .controls label select { flex:1; width:100%; }
+    .controls > button { width:100%; }
+  }
+  .grid { display:grid; gap:12px; grid-template-columns:repeat(auto-fit,minmax(170px,1fr)); margin-bottom:14px; }
+  .two-col { display:grid; gap:12px; grid-template-columns:1fr 1fr; margin-bottom:4px; }
+  @media (max-width:860px){ .two-col{ grid-template-columns:1fr; } }
+  .card {
+    background:linear-gradient(180deg,var(--card),var(--card2)); border:1px solid var(--line);
+    border-radius:12px; padding:14px 16px; min-width:0; box-shadow:var(--shadow); position:relative; overflow:hidden;
+    transition:transform .18s cubic-bezier(.2,.8,.2,1), border-color .18s, box-shadow .18s;
+  }
+  .card:hover { transform:translateY(-3px); border-color:var(--line-strong); box-shadow:0 6px 22px rgba(0,0,0,.28), 0 0 0 1px rgba(139,92,246,.08); }
+  /* KPI cards get a soft accent glow that brightens on hover */
+  .card.kpi::before { content:""; position:absolute; left:0; top:0; bottom:0; width:3px; background:var(--kpi,var(--accent)); box-shadow:0 0 12px var(--kpi,var(--accent)); opacity:.55; transition:opacity .18s; }
+  .card.kpi:hover::before { opacity:1; }
+  .card .label { font-size:10.5px; color:var(--dim); text-transform:uppercase; letter-spacing:.6px; display:flex; align-items:center; gap:5px; }
+  .card .value { font-size:clamp(20px,3.5vw,26px); font-weight:700; margin-top:5px; overflow-wrap:anywhere; }
+  .card .sub2 { font-size:11.5px; color:var(--dim); margin-top:3px; overflow-wrap:anywhere; }
+  .trend { font-size:11px; font-weight:600; padding:1px 6px; border-radius:20px; margin-left:6px; }
+  .trend.up { color:var(--ok); background:rgba(63,185,80,.12); }
+  .trend.down { color:var(--bad); background:rgba(248,81,73,.12); }
+  .trend.flat { color:var(--dim); background:rgba(139,148,158,.12); }
+  .section-title { font-size:11px; color:var(--dim); text-transform:uppercase; letter-spacing:.6px; margin:22px 0 8px; display:flex; align-items:center; gap:8px; cursor:pointer; user-select:none; }
+  .section-title .chev { transition:transform .15s; font-size:9px; color:var(--dim2); }
+  .section-title.collapsed .chev { transform:rotate(-90deg); }
+  .collapsed + * , .collapsed + * + * { display:none !important; }
+  .scroll { background:var(--card); border:1px solid var(--line); border-radius:12px; overflow-x:auto; -webkit-overflow-scrolling:touch; box-shadow:var(--shadow); }
+  table { width:100%; border-collapse:collapse; min-width:520px; }
+  th,td { text-align:left; padding:9px 12px; border-bottom:1px solid var(--line); font-size:13px; vertical-align:top; }
+  th { color:var(--dim); font-weight:600; text-transform:uppercase; font-size:10.5px; letter-spacing:.5px; white-space:nowrap; cursor:pointer; }
+  th:hover { color:var(--fg); }
+  tr:last-child td { border-bottom:none; }
+  tbody tr:hover { background:rgba(139,92,246,.05); }
+  code { background:rgba(127,127,127,.12); padding:2px 5px; border-radius:4px; font-size:12px; overflow-wrap:anywhere; }
+  .pill { display:inline-block; padding:2px 8px; border-radius:20px; font-size:11px; font-weight:600; }
+  .pill-ok{background:rgba(63,185,80,.15);color:var(--ok);} .pill-bad{background:rgba(248,81,73,.15);color:var(--bad);}
+  .pill-warn{background:rgba(210,153,34,.15);color:var(--warn);} .pill-info{background:rgba(88,166,255,.15);color:var(--info);}
+  .pill-mock{background:rgba(139,92,246,.15);color:var(--accent);} .pill-real{background:rgba(63,185,80,.15);color:var(--ok);}
+  .pill-dim{background:rgba(127,127,127,.12);color:var(--dim);}
+  .empty { background:var(--card); border:1px dashed var(--line); border-radius:12px; padding:22px; text-align:center; color:var(--dim); }
+  .alert { border-radius:12px; padding:12px 16px; margin-bottom:14px; border:1px solid; box-shadow:var(--shadow); }
+  .alert .head { font-weight:700; margin-bottom:4px; }
+  .alert.ok { background:rgba(63,185,80,.07); border-color:rgba(63,185,80,.3); color:var(--ok); }
+  .footer { margin-top:24px; padding:14px 16px; background:var(--card); border:1px solid var(--line); border-radius:12px; font-size:12px; color:var(--dim); }
+  .footer b { color:var(--fg); }
+  /* donut + legend */
+  .donut-wrap { display:flex; align-items:center; gap:18px; flex-wrap:wrap; }
+  .legend { display:flex; flex-direction:column; gap:5px; font-size:12px; flex:1; min-width:120px; }
+  .legend .li { display:flex; align-items:center; gap:7px; cursor:default; }
+  .legend .dot { width:10px; height:10px; border-radius:3px; flex:none; }
+  .legend .li .n { margin-left:auto; color:var(--dim); }
+  /* segmented bar */
+  .segbar { display:flex; height:22px; border-radius:7px; overflow:hidden; background:rgba(127,127,127,.1); }
+  .segbar > div { transition:width .3s; }
+  /* horizontal bars */
+  .bar-row { display:flex; align-items:center; gap:8px; margin:7px 0; font-size:12px; }
+  .bar-row .name { width:120px; color:var(--dim); overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
+  .bar-row .track { flex:1; background:rgba(127,127,127,.1); border-radius:5px; height:16px; overflow:hidden; }
+  .bar-row .fill { height:100%; border-radius:5px; transition:width .3s; }
+  .bar-row .n { width:58px; text-align:right; }
+  /* sparkline */
+  .spark { display:flex; align-items:flex-end; gap:1px; height:60px; background:var(--card); border:1px solid var(--line); border-radius:12px; padding:8px; box-shadow:var(--shadow); }
+  .spark > .b { background:linear-gradient(180deg,var(--c2),var(--c1)); flex:1 1 0; min-width:1px; border-radius:2px 2px 0 0; transition:height .2s; }
+  .spark > .b.zero { background:var(--line); min-height:1px; }
+  .stat-row { display:flex; gap:14px; flex-wrap:wrap; font-size:12px; color:var(--dim); margin-top:7px; }
+  .stat-row span { color:var(--fg); font-weight:600; }
+  .filter { background:var(--card); color:var(--fg); border:1px solid var(--line); border-radius:8px; padding:5px 9px; font-size:12px; margin-left:auto; min-width:180px; }
+  #tooltip { position:fixed; pointer-events:none; background:var(--bg2); border:1px solid var(--line); border-radius:8px; padding:6px 9px; font-size:12px; box-shadow:var(--shadow); opacity:0; transition:opacity .1s; z-index:50; white-space:nowrap; }
+  @media (max-width:560px){ body{padding:12px;} .grid{grid-template-columns:1fr 1fr;gap:8px;} th,td{padding:7px 9px;font-size:12px;} .filter{min-width:120px;} }
+</style>
+</head>
+<body>
+  <div class="topbar">
+    <div class="brandwrap">
+      <img id="logo" class="logo-img" alt="Blindfold" />
+      <div>
+        <h1><span class="brand"><span class="letter">B</span><span class="letter">l</span><span class="letter">i</span><span class="letter">n</span><span class="letter">d</span><span class="letter">f</span><span class="letter">o</span><span class="letter">l</span><span class="letter">d</span><div class="ribbon" id="brand-ribbon"></div><div class="sealbar" id="brand-sealbar"></div></span><span class="eyebrow">Dashboard</span></h1>
+        <div class="tagline"><span class="lock">\u{1F512}</span> Secrets sealed in a <b>TEE</b> \u2014 keys you can't leak</div>
+        <div class="tags" id="tags"></div>
+      </div>
+    </div>
+    <div class="controls">
+      <label>range
+        <select id="range" onchange="setRange()">
+          <option value="15">15m</option><option value="60" selected>1h</option>
+          <option value="1440">24h</option><option value="0">all</option>
+        </select>
+      </label>
+      <label>refresh
+        <select id="refresh" onchange="setRefresh()">
+          <option value="2000">2s</option><option value="5000">5s</option>
+          <option value="10000">10s</option><option value="0">paused</option>
+        </select>
+      </label>
+      <button onclick="toggleTheme()" id="themeBtn" title="Toggle theme">\u{1F319}</button>
+      <button onclick="exportJson()">\u2B07 Export</button>
+      <button onclick="clearLog()">Clear</button>
+    </div>
+  </div>
+
+  <div id="alert-banner"></div>
+
+  <div class="grid" id="kpis"></div>
+
+  <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>Security posture
+    <button style="margin-left:auto" onclick="event.stopPropagation();runFullAudit()">\u{1F50E} Run full audit (live)</button>
+  </div>
+  <div class="grid" id="posture-cards"></div>
+  <div id="full-audit"></div>
+
+  <div class="two-col">
+    <div>
+      <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>Providers</div>
+      <div class="card" id="provider-chart"></div>
+    </div>
+    <div>
+      <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>Status codes</div>
+      <div class="card" id="status-chart"></div>
+    </div>
+  </div>
+
+  <div class="two-col">
+    <div>
+      <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>p95 latency trend</div>
+      <div class="card" id="trend-latency"></div>
+    </div>
+    <div>
+      <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>Success rate trend</div>
+      <div class="card" id="trend-success"></div>
+    </div>
+  </div>
+
+  <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>Requests per minute</div>
+  <div class="spark" id="spark"></div>
+  <div class="stat-row" id="spark-stats"></div>
+
+  <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>System</div>
+  <div class="grid" id="status-cards"></div>
+
+  <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>Sealed keys (metadata only)</div>
+  <div id="sealed-table-wrap"></div>
+
+  <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>Per-secret usage</div>
+  <div id="per-secret-wrap"></div>
+
+  <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>Blindfold commands</div>
+  <div id="commands-wrap"></div>
+
+  <div class="section-title" onclick="toggleSection(this)"><span class="chev">\u25BC</span>Recent activity
+    <input id="filter" class="filter" placeholder="filter\u2026" oninput="renderTable(rangeFiltered())" onclick="event.stopPropagation()" />
+  </div>
+  <div id="table-wrap"></div>
+
+  <div class="footer"><b>Privacy by design.</b> Metadata only \u2014 no request/response bodies, no header values, no secret values. See <code>usage-log.ts</code> + <code>sealed-ledger.ts</code>.</div>
+  <div id="tooltip"></div>
+
+<script>
+/* Distinctive wordmark: each letter scrambles through cipher glyphs, then
+   snap-seals into place \u2014 mirroring how a real key becomes __BLINDFOLD__.
+   Purely decorative; respects prefers-reduced-motion. */
+(function sealWordmark(){
+  try {
+    if (window.matchMedia && window.matchMedia('(prefers-reduced-motion:reduce)').matches) return;
+    var letters = Array.prototype.slice.call(document.querySelectorAll('.brand > .letter'));
+    if (!letters.length) return;
+    var GLYPHS = '\u2593\u2588\u2592\u2591#@$%&*/\\<>=+\xB7:';
+    var finals = letters.map(function(el){ return el.textContent; });
+    letters.forEach(function(el){ el.classList.add('scrambling'); });
+    var bar = document.getElementById('brand-sealbar');
+    if (bar) { bar.classList.add('run'); }
+    var start = performance.now();
+    var settleAt = letters.map(function(_, i){ return 260 + i * 95; }); // staggered lock, left\u2192right
+    function frame(now){
+      var t = now - start, done = 0;
+      letters.forEach(function(el, i){
+        if (el.dataset.sealed) { done++; return; }
+        if (t >= settleAt[i]) {
+          el.textContent = finals[i];
+          el.classList.remove('scrambling');
+          el.classList.add('sealed');
+          el.dataset.sealed = '1';
+          done++;
+        } else if (t % 60 < 20) {
+          el.textContent = GLYPHS[(Math.random() * GLYPHS.length) | 0];
+        }
+      });
+      if (done < letters.length) requestAnimationFrame(frame);
+    }
+    requestAnimationFrame(frame);
+  } catch (e) { /* animation must never break the dashboard */ }
+})();
+var PALETTE=['#8b5cf6','#58a6ff','#3fb950','#d29922','#f85149','#ff7b72','#39c5cf','#f778ba'];
+function hashIdx(s){var h=0;for(var i=0;i<s.length;i++)h=(h*31+s.charCodeAt(i))>>>0;return h%PALETTE.length;}
+function colorFor(name){return PALETTE[hashIdx(String(name||'?'))];}
+var TOK=new URLSearchParams(location.search).get('token');
+function api(p){return TOK?p+(p.indexOf('?')>=0?'&':'?')+'token='+encodeURIComponent(TOK):p;}
+function esc(s){return String(s).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'})[c];});}
+function timeAgo(iso){var ms=Date.now()-new Date(iso).getTime();if(ms<1000)return'just now';var s=(ms/1000)|0;if(s<60)return s+'s ago';var m=(s/60)|0;if(m<60)return m+'m ago';var h=(m/60)|0;if(h<24)return h+'h ago';return((h/24)|0)+'d ago';}
+function pillStatus(s){if(s>=200&&s<300)return'<span class="pill pill-ok">'+s+'</span>';if(s>=400)return'<span class="pill pill-bad">'+s+'</span>';return'<span class="pill pill-warn">'+s+'</span>';}
+function pillMode(m){return'<span class="pill pill-'+m+'">'+m+'</span>';}
+function pct(arr,p){if(!arr.length)return 0;var s=arr.slice().sort(function(a,b){return a-b;});return s[Math.min(s.length-1,Math.floor(p/100*s.length))];}
+
+// shared tooltip
+var TIP=null;
+function tip(ev,html){if(!TIP)TIP=document.getElementById('tooltip');TIP.innerHTML=html;TIP.style.opacity='1';TIP.style.left=(ev.clientX+12)+'px';TIP.style.top=(ev.clientY+12)+'px';}
+function tipHide(){if(TIP)TIP.style.opacity='0';}
+
+// state
+window._events=[]; window._sort={key:'t',dir:-1};
+function rangeMin(){return Number(document.getElementById('range').value);}
+function rangeFiltered(){var m=rangeMin();if(!m)return window._events;var cut=Date.now()-m*60000;return window._events.filter(function(e){return new Date(e.t).getTime()>=cut;});}
+
+function toggleTheme(){var h=document.documentElement;var d=h.getAttribute('data-theme')==='dark';h.setAttribute('data-theme',d?'light':'dark');document.getElementById('themeBtn').textContent=d?'\u2600':'\u{1F319}';try{localStorage.setItem('bf-theme',d?'light':'dark');}catch(e){}}
+(function(){try{var t=localStorage.getItem('bf-theme');if(t){document.documentElement.setAttribute('data-theme',t);document.getElementById('themeBtn').textContent=t==='light'?'\u2600':'\u{1F319}';}}catch(e){}})();
+function toggleSection(el){el.classList.toggle('collapsed');}
+function setRange(){poll();}
+function setRefresh(){var v=Number(document.getElementById('refresh').value);if(window._timer)clearInterval(window._timer);if(v>0)window._timer=setInterval(poll,v);}
+function exportJson(){var b=new Blob([JSON.stringify(window._events||[],null,2)],{type:'application/json'});var a=document.createElement('a');a.href=URL.createObjectURL(b);a.download='blindfold-usage-'+new Date().toISOString().slice(0,19).replace(/[:T]/g,'-')+'.json';a.click();}
+async function clearLog(){await fetch(api('/api/clear'),{method:'POST'});poll();}
+
+async function poll(){
+  try{
+    var r=await Promise.all([fetch(api('/api/status')).then(function(x){return x.json();}),fetch(api('/api/sealed')).then(function(x){return x.json();}),fetch(api('/api/events')).then(function(x){return x.json();}),fetch(api('/api/audit')).then(function(x){return x.json();})]);
+    var statusR=r[0],sealedR=r[1],eventsR=r[2],auditR=r[3];
+    window._events=eventsR.events||[];
+    var ev=rangeFiltered();
+    document.getElementById('tags').innerHTML=
+      '<span class="tag live"><span class="live-dot"></span>live</span>'
+      +'<span class="tag orange">'+new Date().toLocaleTimeString()+'</span>'
+      +'<span class="tag">'+(statusR.mode==='real'?'REAL \xB7 '+esc(statusR.t3_env||''):'MOCK')+'</span>'
+      +'<span class="tag path">usage <code title="'+esc(eventsR.source)+'">'+esc(eventsR.source)+'</code></span>';
+    renderAlert(auditR,ev);
+    renderKpis(ev,auditR,statusR);
+    renderPosture(auditR,statusR);
+    renderStatus(statusR);
+    renderDonut(ev);
+    renderStatusBar(ev);
+    renderTrends(ev);
+    renderSpark(ev);
+    renderSealed(sealedR.entries||[]);
+    renderPerSecret(ev);
+    renderTable(ev);
+  }catch(e){}
+}
+
+function trendBadge(cur,prev){if(prev===0&&cur===0)return'<span class="trend flat">\u2014</span>';if(prev===0)return'<span class="trend up">new</span>';var d=Math.round((cur-prev)/prev*100);if(Math.abs(d)<2)return'<span class="trend flat">0%</span>';return'<span class="trend '+(d>0?'up':'down')+'">'+(d>0?'\u25B2':'\u25BC')+Math.abs(d)+'%</span>';}
+
+function renderKpis(ev,a,s){
+  var half=ev.slice().sort(function(x,y){return new Date(x.t)-new Date(y.t);});
+  var mid=Math.floor(half.length/2);var prevHalf=half.slice(0,mid),curHalf=half.slice(mid);
+  function ok(arr){return arr.filter(function(e){return e.status>=200&&e.status<300;}).length;}
+  var total=ev.length;
+  var succ=total?Math.round(ok(ev)/total*100):0;
+  var prevSucc=prevHalf.length?Math.round(ok(prevHalf)/prevHalf.length*100):0;
+  var curSucc=curHalf.length?Math.round(ok(curHalf)/curHalf.length*100):0;
+  var p95=pct(ev.map(function(e){return e.latency_ms||0;}),95);
+  var p95p=pct(prevHalf.map(function(e){return e.latency_ms||0;}),95);
+  var p95c=pct(curHalf.map(function(e){return e.latency_ms||0;}),95);
+  var sealed=(a&&a.sealed_count)||0;
+  var posture=postureScore(a,s).score;
+  var cards=[
+    ['Requests',total,'',trendBadge(curHalf.length,prevHalf.length),'var(--c1)'],
+    ['Success rate',succ+'%',ok(ev)+'/'+total+' 2xx',trendBadge(curSucc,prevSucc),succ>=95?'var(--ok)':succ>=80?'var(--warn)':'var(--bad)'],
+    ['p95 latency',p95+' ms',ev.length+' samples',trendBadge(p95c,p95p),'var(--c2)'],
+    ['Sealed secrets',sealed,'in the enclave','','var(--c7)'],
+    ['Posture',posture+'<span style="font-size:13px;color:var(--dim)">/100</span>','security score','',posture>=90?'var(--ok)':posture>=60?'var(--warn)':'var(--bad)']
+  ];
+  document.getElementById('kpis').innerHTML=cards.map(function(c){return '<div class="card kpi" style="--kpi:'+c[4]+'"><div class="label">'+c[0]+'</div><div class="value">'+c[1]+c[3]+'</div><div class="sub2">'+c[2]+'</div></div>';}).join('');
+}
+
+function postureScore(a,s){var exposed=((a&&a.exposed_in_env)||[]).length;var chain=(a&&a.ledger_chain)||{ok:true,total:0};var sealed=(a&&a.sealed_count)||0;var score=100;var notes=[];if(exposed>0){score-=30;notes.push(exposed+' key(s) in .env');}if(chain.total>0&&!chain.ok){score-=40;notes.push('ledger TAMPERED');}if(s&&s.mode!=='real'){score-=10;notes.push('MOCK mode');}if(s&&!s.sdk_installed){score-=10;notes.push('SDK missing');}if(sealed===0){score-=10;notes.push('nothing sealed');}return{score:Math.max(0,score),notes:notes};}
+
+function renderAlert(a,ev){
+  var msgs=[];var chain=(a&&a.ledger_chain)||{};
+  if(chain.total>0&&!chain.ok)msgs.push(['bad','\u{1F534} Ledger TAMPERED \u2014 a sealed-keys line was edited or removed']);
+  if(((a&&a.exposed_in_env)||[]).length>0)msgs.push(['warn','\u{1F7E0} '+a.exposed_in_env.length+' sealed key(s) still in .env \u2014 delete them']);
+  var recent=(ev||[]).filter(function(e){return Date.now()-new Date(e.t).getTime()<300000;});
+  var errs=recent.filter(function(e){return(e.status||0)>=400;}).length;
+  if(recent.length>=5&&errs/recent.length>0.3)msgs.push(['warn','\u{1F7E0} '+Math.round(errs/recent.length*100)+'% errors in the last 5 min ('+errs+'/'+recent.length+')']);
+  var el=document.getElementById('alert-banner');
+  if(!msgs.length){el.innerHTML='';return;}
+  var bad=msgs.some(function(m){return m[0]==='bad';});
+  el.innerHTML='<div class="alert" style="background:'+(bad?'rgba(248,81,73,.08)':'rgba(210,153,34,.08)')+';border-color:'+(bad?'rgba(248,81,73,.4)':'rgba(210,153,34,.4)')+';color:'+(bad?'var(--bad)':'var(--warn)')+'"><div class="head">\u26A0 Attention</div>'+msgs.map(function(m){return esc(m[1]);}).join('<br/>')+'</div>';
+}
+
+function renderPosture(a,s){
+  var p=postureScore(a,s);var exposed=((a&&a.exposed_in_env)||[]).length;var chain=(a&&a.ledger_chain)||{ok:true,total:0,legacy:0};
+  var chainTxt=chain.total===0?'empty':(chain.ok?'intact':'TAMPERED');
+  var cards=[
+    ['.env leak surface',exposed===0?'0 \u2705':exposed+' \u26A0','sealed keys still in .env',exposed===0?'var(--ok)':'var(--warn)'],
+    ['Ledger integrity',(chainTxt==='TAMPERED'?'\u2716 ':chainTxt==='intact'?'\u2705 ':'')+chainTxt,(chain.legacy||0)+' legacy entries',chainTxt==='TAMPERED'?'var(--bad)':'var(--ok)'],
+    ['Mode',s&&s.mode==='real'?'REAL':'MOCK',s&&s.mode==='real'?'connected to '+esc(s.t3_env||''):'BLINDFOLD_MOCK=1','var(--c1)'],
+    ['Issues',p.notes.length,p.notes.length?esc(p.notes.join(' \xB7 ')):'all clear',p.notes.length?'var(--warn)':'var(--ok)']
+  ];
+  document.getElementById('posture-cards').innerHTML=cards.map(function(c){return '<div class="card kpi" style="--kpi:'+c[3]+'"><div class="label">'+c[0]+'</div><div class="value">'+c[1]+'</div><div class="sub2">'+c[2]+'</div></div>';}).join('');
+}
+
+function renderStatus(s){
+  var cards=[
+    [s.mode==='real'?'REAL':'MOCK','Mode',s.mode==='real'?'T3 '+esc(s.t3_env):'mock'],
+    [esc(s.contract_version||'\u2014'),'Contract','blindfold-proxy'],
+    [esc(s.tenant_did_short||'(none)'),'Tenant',s.tenant_did?'full in title':'set creds'],
+    [s.proxy_port,'Proxy port','127.0.0.1:'+s.proxy_port],
+    [s.sdk_installed?'\u2713':'\u2717','SDK',s.sdk_installed?'installed':'missing']
+  ];
+  document.getElementById('status-cards').innerHTML=cards.map(function(c){return '<div class="card"><div class="label">'+esc(c[1])+'</div><div class="value">'+esc(c[0])+'</div><div class="sub2">'+esc(c[2])+'</div></div>';}).join('');
+}
+
+function donutSvg(rows,total){
+  var r=42,c=2*Math.PI*r,off=0,seg='';
+  rows.forEach(function(row){var frac=total?row[1]/total:0;var len=frac*c;var col=colorFor(row[0]);seg+='<circle cx="60" cy="60" r="'+r+'" fill="none" stroke="'+col+'" stroke-width="16" stroke-dasharray="'+len.toFixed(2)+' '+(c-len).toFixed(2)+'" stroke-dashoffset="'+(-off).toFixed(2)+'" transform="rotate(-90 60 60)"><title>'+esc(row[0])+': '+row[1]+'</title></circle>';off+=len;});
+  return '<svg viewBox="0 0 120 120" style="width:120px;height:120px;flex:none">'+seg+'<text x="60" y="56" text-anchor="middle" fill="var(--fg)" font-size="22" font-weight="700">'+total+'</text><text x="60" y="74" text-anchor="middle" fill="var(--dim)" font-size="9">requests</text></svg>';
+}
+function renderDonut(ev){
+  var by={};ev.forEach(function(e){var k=e.provider||'(unknown)';by[k]=(by[k]||0)+1;});
+  var rows=Object.keys(by).map(function(k){return[k,by[k]];}).sort(function(a,b){return b[1]-a[1];});
+  var el=document.getElementById('provider-chart');
+  if(!rows.length){el.innerHTML='<div style="color:var(--dim);font-size:13px">No traffic yet.</div>';return;}
+  var legend=rows.map(function(row){return '<div class="li"><span class="dot" style="background:'+colorFor(row[0])+'"></span>'+esc(row[0])+'<span class="n">'+row[1]+'</span></div>';}).join('');
+  el.innerHTML='<div class="donut-wrap">'+donutSvg(rows,ev.length)+'<div class="legend">'+legend+'</div></div>';
+}
+
+function renderStatusBar(ev){
+  var b={'2xx':0,'3xx':0,'4xx':0,'5xx':0};ev.forEach(function(e){var k=Math.floor((e.status||0)/100)+'xx';if(b[k]!==undefined)b[k]++;});
+  var col={'2xx':'var(--ok)','3xx':'var(--info)','4xx':'var(--warn)','5xx':'var(--bad)'};
+  var total=ev.length;var el=document.getElementById('status-chart');
+  if(!total){el.innerHTML='<div style="color:var(--dim);font-size:13px">No traffic yet.</div>';return;}
+  var segs=Object.keys(b).filter(function(k){return b[k]>0;}).map(function(k){return '<div style="width:'+(b[k]/total*100)+'%;background:'+col[k]+'" title="'+k+': '+b[k]+'"></div>';}).join('');
+  var legend=Object.keys(b).map(function(k){return '<div class="li"><span class="dot" style="background:'+col[k]+'"></span>'+k+'<span class="n">'+b[k]+'</span></div>';}).join('');
+  el.innerHTML='<div class="segbar">'+segs+'</div><div class="legend" style="flex-direction:row;flex-wrap:wrap;gap:14px;margin-top:12px">'+legend+'</div>';
+}
+
+function areaSvg(values,color,maxOpt){
+  var w=300,h=70,n=values.length;if(n<2)values=values.concat(values);n=values.length;
+  var max=Math.max(maxOpt||0,Math.max.apply(null,values),1);
+  var pts=values.map(function(v,i){return (i/(n-1)*w).toFixed(1)+','+(h-(v/max)*h).toFixed(1);});
+  var gid='g'+Math.floor(Math.random()*1e6);
+  var poly=pts.join(' ');var area='0,'+h+' '+poly+' '+w+','+h;
+  return '<svg viewBox="0 0 '+w+' '+h+'" preserveAspectRatio="none" style="width:100%;height:72px;display:block"><defs><linearGradient id="'+gid+'" x1="0" y1="0" x2="0" y2="1"><stop offset="0%" stop-color="'+color+'" stop-opacity="0.35"/><stop offset="100%" stop-color="'+color+'" stop-opacity="0"/></linearGradient></defs><polygon points="'+area+'" fill="url(#'+gid+')"/><polyline points="'+poly+'" fill="none" stroke="'+color+'" stroke-width="2" vector-effect="non-scaling-stroke"/></svg>';
+}
+function renderTrends(ev){
+  var now=Date.now();var lat=[],ok=[],tot=[];for(var i=0;i<60;i++){lat.push([]);ok.push(0);tot.push(0);}
+  ev.forEach(function(e){var ageMin=Math.floor((now-new Date(e.t).getTime())/60000);if(ageMin>=0&&ageMin<60){var idx=59-ageMin;lat[idx].push(e.latency_ms||0);tot[idx]++;if((e.status||0)>=200&&(e.status||0)<300)ok[idx]++;}});
+  var p95=lat.map(function(a){return a.length?pct(a,95):0;});
+  var succ=tot.map(function(t,i){return t?Math.round(ok[i]/t*100):0;});
+  document.getElementById('trend-latency').innerHTML=areaSvg(p95,'var(--c1)')+'<div class="stat-row">peak p95 <span>'+Math.max.apply(null,p95.concat(0))+' ms</span></div>';
+  document.getElementById('trend-success').innerHTML=areaSvg(succ,'var(--ok)',100)+'<div class="stat-row">latest <span>'+(succ[59]||0)+'%</span></div>';
+}
+
+function renderSpark(ev){
+  var now=Date.now();var b=[];for(var i=0;i<60;i++)b.push(0);
+  ev.forEach(function(e){var ageMin=Math.floor((now-new Date(e.t).getTime())/60000);if(ageMin>=0&&ageMin<60)b[59-ageMin]++;});
+  var max=Math.max.apply(null,b.concat(1));
+  document.getElementById('spark').innerHTML=b.map(function(v,i){var hh=Math.max(1,Math.round(v/max*44));return '<div class="b '+(v===0?'zero':'')+'" style="height:'+hh+'px" title="'+v+' req \xB7 '+(59-i)+'m ago"></div>';}).join('');
+  var sum=b.reduce(function(a,c){return a+c;},0);
+  document.getElementById('spark-stats').innerHTML='last 60 min <span>'+sum+'</span> \xB7 peak minute <span>'+max+'</span>';
+}
+
+function renderSealed(entries){
+  if(!entries.length){document.getElementById('sealed-table-wrap').innerHTML='<div class="empty">No keys sealed yet. <code>blindfold register --name &lt;K&gt;</code></div>';return;}
+  var latest={};entries.forEach(function(e){latest[e.name]=e;});
+  var rows=Object.keys(latest).map(function(k){return latest[k];}).sort(function(a,b){return a.t<b.t?1:-1;}).map(function(e){return '<tr><td><span class="dot" style="display:inline-block;width:8px;height:8px;border-radius:2px;margin-right:6px;background:'+colorFor(e.name)+'"></span><code>'+esc(e.name)+'</code></td><td>'+e.length+' B</td><td>'+pillMode(e.mode)+'</td><td title="'+esc(e.t)+'">'+timeAgo(e.t)+'</td><td><code class="sentinel">__BLINDFOLD__</code></td><td style="white-space:nowrap"><button class="copybtn cmd" data-name="'+esc(e.name)+'" title="Copy a ready-to-run verify command">\u29C9 cmd</button> <button class="copybtn ref" data-name="'+esc(e.name)+'" title="Copy the Blindfold sentinel \u2014 put this where the real key would go; the enclave substitutes the sealed value at call time">\u29C9 sealed token</button></td></tr>';}).join('');
+  document.getElementById('sealed-table-wrap').innerHTML='<div class="scroll"><table><thead><tr><th>Name</th><th>Bytes</th><th>Mode</th><th>Sealed</th><th>Sealed token</th><th>Copy</th></tr></thead><tbody>'+rows+'</tbody></table></div>';
+  function flash(b,txt,cls){var o=b.textContent;b.textContent=txt;b.classList.add(cls||'done');setTimeout(function(){b.textContent=o;b.classList.remove('done','err');},1400);}
+  var cmds=document.querySelectorAll('#sealed-table-wrap .copybtn.cmd');
+  for(var i=0;i<cmds.length;i++){(function(b){b.onclick=function(){var cmd='npm run blindfold -- use --name '+b.getAttribute('data-name')+' --check';try{navigator.clipboard.writeText(cmd);}catch(e){}flash(b,'\u2713 copied');};})(cmds[i]);}
+  var refs=document.querySelectorAll('#sealed-table-wrap .copybtn.ref');
+  for(var j=0;j<refs.length;j++){(function(b){b.onclick=function(){try{navigator.clipboard.writeText('__BLINDFOLD__');}catch(e){}flash(b,'\u2713 sentinel copied');};})(refs[j]);}
+}
+
+function renderPerSecret(ev){
+  var by={};ev.forEach(function(e){var k=e.secret_key||'(unknown)';by[k]=(by[k]||0)+1;});
+  var rows=Object.keys(by).map(function(k){return[k,by[k]];}).sort(function(a,b){return b[1]-a[1];});
+  var el=document.getElementById('per-secret-wrap');
+  if(!rows.length){el.innerHTML='<div class="empty">No secret usage yet. Try <code>blindfold use --name &lt;X&gt; -- &lt;cmd&gt;</code> or the proxy.</div>';return;}
+  var max=Math.max.apply(null,rows.map(function(r){return r[1];}).concat(1));
+  el.innerHTML='<div class="card">'+rows.map(function(r){return '<div class="bar-row"><div class="name" title="'+esc(r[0])+'">'+esc(r[0])+'</div><div class="track"><div class="fill" style="width:'+(r[1]/max*100)+'%;background:'+colorFor(r[0])+'"></div></div><div class="n">'+r[1]+'</div></div>';}).join('')+'</div>';
+}
+
+function sortBy(k){if(window._sort.key===k)window._sort.dir*=-1;else window._sort={key:k,dir:-1};renderTable(rangeFiltered());}
+function renderTable(ev){
+  var q=(document.getElementById('filter').value||'').toLowerCase().trim();
+  var list=ev;
+  if(q)list=ev.filter(function(e){return(e.provider||'').toLowerCase().indexOf(q)>=0||(e.path||'').toLowerCase().indexOf(q)>=0||(e.via||'').toLowerCase().indexOf(q)>=0||String(e.status||'').indexOf(q)>=0||(e.mode||'').toLowerCase().indexOf(q)>=0;});
+  var k=window._sort.key,dir=window._sort.dir;
+  list=list.slice().sort(function(a,b){var x=a[k],y=b[k];if(k==='t'){x=new Date(a.t).getTime();y=new Date(b.t).getTime();}return x<y?-dir:x>y?dir:0;}).slice(0,80);
+  if(!list.length){document.getElementById('table-wrap').innerHTML='<div class="empty">'+(q?'No requests match "'+esc(q)+'".':'No traffic in range. Use a secret or the proxy.')+'</div>';return;}
+  var rows=list.map(function(e){return '<tr><td>'+timeAgo(e.t)+'</td><td><span class="dot" style="display:inline-block;width:8px;height:8px;border-radius:2px;margin-right:6px;background:'+colorFor(e.provider)+'"></span>'+esc(e.provider)+'</td><td><span class="pill pill-info">'+esc(e.via||'proxy')+'</span></td><td><code>'+esc(e.method)+' '+esc(e.path)+'</code></td><td>'+pillStatus(e.status)+'</td><td>'+e.latency_ms+' ms</td><td>'+pillMode(e.mode)+'</td></tr>';}).join('');
+  document.getElementById('table-wrap').innerHTML='<div class="scroll"><table><thead><tr><th data-k="t">When</th><th data-k="provider">Provider</th><th data-k="via">Via</th><th>Request</th><th data-k="status">Status</th><th data-k="latency_ms">Latency</th><th data-k="mode">Mode</th></tr></thead><tbody>'+rows+'</tbody></table></div>';
+  var ths=document.querySelectorAll('#table-wrap th[data-k]');for(var ti=0;ti<ths.length;ti++){(function(th){th.onclick=function(){sortBy(th.getAttribute('data-k'));};})(ths[ti]);}
+}
+
+async function runFullAudit(){
+  var el=document.getElementById('full-audit');el.innerHTML='<div class="empty">Running live enclave reconciliation\u2026</div>';
+  try{
+    var r=await fetch(api('/api/audit/full')).then(function(x){return x.json();});
+    if(r.mock){el.innerHTML='<div class="alert ok"><div class="head">MOCK mode</div>Reconciliation only runs in REAL mode.</div>';return;}
+    if(r.error){el.innerHTML='<div class="alert" style="border-color:rgba(248,81,73,.4);color:var(--bad)"><div class="head">Audit error</div>'+esc(r.error)+'</div>';return;}
+    var rows=(r.results||[]).map(function(x){return '<tr><td><code>'+esc(x.name)+'</code></td><td>'+(x.present?'<span class="pill pill-ok">present</span>':'<span class="pill pill-bad">MISSING</span>')+'</td><td>'+x.enclave_len+' B</td><td>'+x.ledger_len+' B</td><td>'+(x.ok?'<span class="pill pill-ok">ok</span>':'<span class="pill pill-warn">drift</span>')+'</td><td><code>'+esc(x.fingerprint||'')+'</code></td></tr>';}).join('');
+    var okN=(r.results||[]).filter(function(x){return x.ok;}).length;
+    el.innerHTML='<div class="scroll" style="margin-bottom:6px"><table><thead><tr><th>Secret</th><th>Enclave</th><th>Enc bytes</th><th>Ledger bytes</th><th>Match</th><th>Fingerprint</th></tr></thead><tbody>'+rows+'</tbody></table></div><div class="stat-row">'+okN+'/'+(r.results||[]).length+' verified against the enclave</div>';
+  }catch(e){el.innerHTML='<div class="alert" style="border-color:rgba(248,81,73,.4);color:var(--bad)"><div class="head">Audit failed</div>'+esc(String(e))+'</div>';}
+}
+
+function startStream(){try{var es=new EventSource(api('/api/stream'));es.addEventListener('change',function(){poll();});es.onerror=function(){};}catch(e){}}
+
+function renderCommands(){
+  var C=[
+    ['doctor','doctor','Check your key + tenant are healthy'],
+    ['status','status','Mode, tenant, and every sealed secret'],
+    ['audit','audit','Verify the ledger + reconcile against the enclave'],
+    ['migrate','migrate','Seal every secret in .env in one shot'],
+    ['register','register --name NAME --from-env NAME','Seal a secret into the enclave'],
+    ['use','use --name NAME -- COMMAND','Run any tool with a sealed secret injected'],
+    ['use --check','use --name NAME --check','Confirm a sealed secret is usable'],
+    ['rotate','rotate --name NAME --from-env NAME','Replace a secret value (rollback-safe)'],
+    ['rollback','rollback --name NAME','Restore the previous value'],
+    ['versions','versions --name NAME','List rollback snapshots'],
+    ['grant','grant --host api.openai.com','Authorize the contract to call a host'],
+    ['share','share --to DID --host HOST','Let a teammate agent use your keys'],
+    ['revoke','revoke --to DID','Remove a teammate access'],
+    ['proxy','proxy','Run the local OpenAI/Anthropic proxy'],
+    ['publish','publish','Publish the contract to T3'],
+    ['sealed','sealed','List sealed keys (metadata only)'],
+    ['dashboard','dashboard','Launch this dashboard'],
+    ['export','export --name NAME','CI: inject a sealed secret into the job env']
+  ];
+  var rows=C.map(function(c){return '<tr><td><span class="cmdname">'+esc(c[0])+'</span></td><td><code>npm run blindfold -- '+esc(c[1])+'</code></td><td>'+esc(c[2])+'</td><td><button class="copybtn" data-cmd="npm run blindfold -- '+esc(c[1])+'">\u29C9 copy</button></td></tr>';}).join('');
+  document.getElementById('commands-wrap').innerHTML='<div class="scroll"><table><thead><tr><th>Command</th><th>Run</th><th>What it does</th><th>Copy</th></tr></thead><tbody>'+rows+'</tbody></table></div>';
+  var btns=document.querySelectorAll('#commands-wrap .copybtn');
+  for(var i=0;i<btns.length;i++){(function(b){b.onclick=function(){try{navigator.clipboard.writeText(b.getAttribute('data-cmd'));}catch(e){}var o=b.textContent;b.textContent='\u2713 copied';b.classList.add('done');setTimeout(function(){b.textContent=o;b.classList.remove('done');},1300);};})(btns[i]);}
+}
+
+document.getElementById('logo').src=api('/logo.png');
+renderCommands();
+poll();setRefresh();startStream();
+</script>
+</body>
+</html>
+`;
+
+// src/register.ts
+init_env();
+init_log();
+
+// src/prompt.ts
+async function readSecretLine(prompt) {
+  process.stderr.write(prompt);
+  const stdin = process.stdin;
+  if (!stdin.isTTY) {
+    return await readOneLine(stdin);
+  }
+  return await new Promise((resolve, reject) => {
+    let buf = "";
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const cleanup = () => {
+      stdin.removeListener("data", onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+    };
+    const onData = (chunk) => {
+      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      for (const ch of s) {
+        if (ch === "\n" || ch === "\r") {
+          cleanup();
+          process.stderr.write("\n");
+          resolve(buf);
+          return;
+        }
+        if (ch === "") {
+          cleanup();
+          process.stderr.write("\n");
+          reject(new Error("aborted by user"));
+          return;
+        }
+        if (ch === "\x7F" || ch === "\b") {
+          if (buf.length > 0) buf = buf.slice(0, -1);
+          continue;
+        }
+        if (ch >= " " || ch === "	") buf += ch;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+function readOneLine(stdin) {
+  return new Promise((resolve, reject) => {
+    let buf = "";
+    stdin.setEncoding("utf8");
+    stdin.on("data", (d) => {
+      buf += d;
+    });
+    stdin.on("end", () => resolve(buf.replace(/\r?\n$/, "")));
+    stdin.on("error", reject);
+  });
+}
+
+// src/register.ts
+init_t3_client();
+init_constants();
+async function registerSecret(opts) {
+  const env = loadBlindfoldEnv();
+  const t3 = await openT3Client(env);
+  try {
+    let source = "stdin";
+    let value;
+    if (opts.value !== void 0) {
+      value = opts.value;
+      source = "explicit";
+    } else if (opts.fromEnv) {
+      value = pluckSecret(opts.fromEnv);
+      source = `env:${opts.fromEnv}`;
+    } else {
+      value = await readSecretLine(`  Value for "${opts.name}" (input is hidden): `);
+      if (!value) throw new Error("empty value");
+    }
+    if (value.includes(SENTINEL)) {
+      throw new Error(`Secret value contains the Blindfold sentinel string "${SENTINEL}" \u2014 this would cause infinite substitution. Use a different value.`);
+    }
+    await t3.seedSecret(opts.name, value);
+    const length = value.length;
+    const mode = env.mock ? "mock" : "real";
+    recordSealed({
+      t: (/* @__PURE__ */ new Date()).toISOString(),
+      name: opts.name,
+      source,
+      length,
+      mode,
+      tenant_did: env.did,
+      map_name: env.did ? `z:${env.did.replace(/^did:t3n:/, "")}:secrets` : "(mock)"
+    });
+    safeLog("info", { msg: "registered", name: opts.name, source, length, mode });
+  } finally {
+    await t3.close();
+  }
+}
+async function registerContract(wasm) {
+  const env = loadBlindfoldEnv();
+  const t3 = await openT3Client(env);
+  try {
+    return await t3.registerContract(wasm);
+  } finally {
+    await t3.close();
+  }
+}
+
+// src/release.ts
+init_env();
+init_t3_client();
+var clientCache = /* @__PURE__ */ new Map();
+function sharedClient(env) {
+  const key = `${env.did}|${env.t3Env}|${env.t3BaseUrl}|${env.mock ? 1 : 0}`;
+  let c = clientCache.get(key);
+  if (!c) {
+    c = openT3Client(env).catch((e) => {
+      clientCache.delete(key);
+      throw e;
+    });
+    clientCache.set(key, c);
+  }
+  return c;
+}
+async function release(name, opts) {
+  const env = opts?.env ?? loadBlindfoldEnv();
+  const useShared = !opts?.env;
+  const t3 = useShared ? await sharedClient(env) : await openT3Client(env);
+  const startedAt = Date.now();
+  try {
+    const value = await t3.releaseSecret(name);
+    logUsage({
+      t: (/* @__PURE__ */ new Date()).toISOString(),
+      mode: env.mock ? "mock" : "real",
+      provider: "(enclave)",
+      method: "RELEASE",
+      path: name,
+      upstream: "t3-enclave",
+      status: 200,
+      latency_ms: Date.now() - startedAt,
+      agent_supplied_auth: false,
+      sentinel_in_outbound: false,
+      via: opts?.via ?? "release",
+      secret_key: name
+    });
+    return value;
+  } finally {
+    if (!useShared) await t3.close();
+  }
+}
+
+// src/wrap.ts
+init_constants();
+import http3 from "node:http";
+var PROXY_TOKEN_HEADER2 = "x-blindfold-token";
+function socketFetch(socketPath, token) {
+  return async (input, init = {}) => {
+    const reqObj = typeof Request !== "undefined" && input instanceof Request ? input : void 0;
+    const rawUrl = reqObj ? reqObj.url : String(input);
+    const url = new URL(rawUrl);
+    const method = init?.method ?? reqObj?.method ?? "GET";
+    const headers = new Headers(init?.headers ?? reqObj?.headers);
+    if (token) headers.set(PROXY_TOKEN_HEADER2, token);
+    const outHeaders = {};
+    headers.forEach((v, k) => {
+      outHeaders[k] = v;
+    });
+    return await new Promise((resolve, reject) => {
+      const req = http3.request(
+        { socketPath, path: url.pathname + url.search, method, headers: outHeaders },
+        (res) => {
+          const chunks = [];
+          res.on("data", (c) => chunks.push(c));
+          res.on("end", () => {
+            const respHeaders = new Headers();
+            for (const [k, v] of Object.entries(res.headers)) {
+              if (typeof v === "string") respHeaders.set(k, v);
+              else if (Array.isArray(v)) respHeaders.set(k, v.join(", "));
+            }
+            resolve(new Response(Buffer.concat(chunks), {
+              status: res.statusCode ?? 502,
+              statusText: res.statusMessage ?? "",
+              headers: respHeaders
+            }));
+          });
+        }
+      );
+      req.on("error", reject);
+      const body = init?.body;
+      if (body != null) {
+        if (typeof body === "string" || body instanceof Buffer || body instanceof Uint8Array) req.write(body);
+        else if (typeof URLSearchParams !== "undefined" && body instanceof URLSearchParams) req.write(body.toString());
+        else if (ArrayBuffer.isView(body)) {
+          const v = body;
+          req.write(Buffer.from(v.buffer, v.byteOffset, v.byteLength));
+        } else if (body instanceof ArrayBuffer) req.write(Buffer.from(body));
+        else {
+          req.destroy();
+          reject(new Error("socketFetch: unsupported body type (use string/Buffer/typed-array/URLSearchParams)"));
+          return;
+        }
+      }
+      req.end();
+    });
+  };
+}
+function wrap(client, opts = {}) {
+  const baseUrl = opts.baseUrl ?? `http://127.0.0.1:${DEFAULT_PORT}/v1`;
+  client.baseURL = baseUrl;
+  client.apiKey = SENTINEL;
+  const token = (opts.token ?? process.env.BLINDFOLD_PROXY_TOKEN ?? "").trim() || void 0;
+  const socket = (opts.socket ?? process.env.BLINDFOLD_PROXY_SOCKET ?? "").trim() || void 0;
+  if (socket) {
+    client.fetch = socketFetch(socket, token);
+  } else if (token) {
+    const base = client.fetch ?? fetch;
+    client.fetch = (input, init = {}) => {
+      const headers = new Headers(init?.headers);
+      headers.set(PROXY_TOKEN_HEADER2, token);
+      return base(input, { ...init, headers });
+    };
+  }
+  return client;
+}
+
+// src/index.ts
+init_env();
+export {
+  CONTRACT_TAIL,
+  CONTRACT_VERSION,
+  DEFAULT_DASHBOARD_PORT,
+  DEFAULT_PORT,
+  SENTINEL,
+  assertRealReady,
+  clearUsage,
+  defaultLogPath,
+  loadBlindfoldEnv,
+  readUsage,
+  registerContract,
+  registerSecret,
+  release,
+  startDashboard,
+  startProxy,
+  wrap
+};