@fiscalmindset/blindfold 0.4.0

package/dist/lib/register.mjs

@@ -0,0 +1,756 @@
+// src/env.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/keychain.ts
+import { spawnSync } from "node:child_process";
+var SERVICE = "blindfold";
+var isWin = process.platform === "win32";
+function has(cmd) {
+  const finder = isWin ? "where" : "which";
+  const r = spawnSync(finder, [cmd], { stdio: "ignore" });
+  return r.status === 0;
+}
+var WIN_CS = `
+using System;
+using System.Runtime.InteropServices;
+public static class BFCred {
+  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
+  public struct CREDENTIAL {
+    public UInt32 Flags; public UInt32 Type;
+    [MarshalAs(UnmanagedType.LPWStr)] public string TargetName;
+    [MarshalAs(UnmanagedType.LPWStr)] public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public UInt32 CredentialBlobSize; public IntPtr CredentialBlob; public UInt32 Persist;
+    public UInt32 AttributeCount; public IntPtr Attributes;
+    [MarshalAs(UnmanagedType.LPWStr)] public string TargetAlias;
+    [MarshalAs(UnmanagedType.LPWStr)] public string UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredWriteW(ref CREDENTIAL c, UInt32 f);
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredReadW(string t, UInt32 ty, UInt32 f, out IntPtr c);
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredDeleteW(string t, UInt32 ty, UInt32 f);
+  [DllImport("advapi32.dll")] public static extern void CredFree(IntPtr c);
+}
+`;
+var PS_HEADER = `$ErrorActionPreference='Stop'
+Add-Type -TypeDefinition @"
+${WIN_CS}
+"@
+`;
+function winPS(op, target, secret) {
+  let body;
+  if (op === "set") {
+    body = `$b=[System.Text.Encoding]::UTF8.GetBytes($env:BF_SECRET);$p=[Runtime.InteropServices.Marshal]::AllocHGlobal($b.Length);[Runtime.InteropServices.Marshal]::Copy($b,0,$p,$b.Length);$c=New-Object BFCred+CREDENTIAL;$c.Type=1;$c.TargetName=$env:BF_TARGET;$c.UserName=$env:BF_TARGET;$c.CredentialBlobSize=$b.Length;$c.CredentialBlob=$p;$c.Persist=2;$ok=[BFCred]::CredWriteW([ref]$c,0);[Runtime.InteropServices.Marshal]::FreeHGlobal($p);if($ok){[Console]::Out.Write('BFOK')}`;
+  } else if (op === "get") {
+    body = `$ptr=[IntPtr]::Zero;if([BFCred]::CredReadW($env:BF_TARGET,1,0,[ref]$ptr)){$c=[Runtime.InteropServices.Marshal]::PtrToStructure($ptr,[BFCred+CREDENTIAL]);$n=[int]$c.CredentialBlobSize;$b=New-Object byte[] $n;[Runtime.InteropServices.Marshal]::Copy([IntPtr]$c.CredentialBlob,$b,0,$n);[BFCred]::CredFree($ptr);[Console]::Out.Write([System.Text.Encoding]::UTF8.GetString($b))}else{exit 1}`;
+  } else {
+    body = `if([BFCred]::CredDeleteW($env:BF_TARGET,1,0)){[Console]::Out.Write('BFOK')}`;
+  }
+  const env = { ...process.env, BF_TARGET: target };
+  if (secret !== void 0) env.BF_SECRET = secret;
+  const r = spawnSync(
+    "powershell",
+    ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", "-"],
+    { input: PS_HEADER + body, env, encoding: "utf8" }
+  );
+  return { status: r.status, stdout: typeof r.stdout === "string" ? r.stdout : "" };
+}
+function winTarget(account) {
+  return `${SERVICE}:${account}`;
+}
+function keychainAvailable() {
+  if (process.platform === "darwin") return has("security");
+  if (process.platform === "linux") return has("secret-tool");
+  if (isWin) return has("powershell");
+  return false;
+}
+function keychainGet(account) {
+  if (process.platform === "darwin") {
+    const r = spawnSync("security", ["find-generic-password", "-a", account, "-s", SERVICE, "-w"], { encoding: "utf8" });
+    if (r.status === 0 && typeof r.stdout === "string") return r.stdout.replace(/\n$/, "");
+    return null;
+  }
+  if (process.platform === "linux") {
+    const r = spawnSync("secret-tool", ["lookup", "service", SERVICE, "account", account], { encoding: "utf8" });
+    if (r.status === 0 && r.stdout) return r.stdout.replace(/\n$/, "");
+    return null;
+  }
+  if (isWin) {
+    const r = winPS("get", winTarget(account));
+    if (r.status === 0 && r.stdout) return r.stdout.replace(/\r?\n$/, "");
+    return null;
+  }
+  return null;
+}
+
+// src/env.ts
+var HERE = path.dirname(fileURLToPath(import.meta.url));
+var SRC_RELATIVE_ROOT = path.resolve(HERE, "..", "..", "..");
+var _repoRoot = null;
+function repoRoot() {
+  if (_repoRoot) return _repoRoot;
+  let dir = process.cwd();
+  for (let i = 0; i < 12; i++) {
+    if (fs.existsSync(path.join(dir, ".env")) || fs.existsSync(path.join(dir, ".blindfold")) || fs.existsSync(path.join(dir, ".git"))) {
+      _repoRoot = dir;
+      return dir;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  _repoRoot = SRC_RELATIVE_ROOT;
+  return _repoRoot;
+}
+function homeDir() {
+  return path.join(os.homedir(), ".blindfold");
+}
+function configPath() {
+  return path.join(homeDir(), "config.json");
+}
+function stateDir() {
+  const override = process.env.BLINDFOLD_STATE_DIR;
+  if (override && override.trim()) return path.resolve(override.trim());
+  const home = homeDir();
+  if (!fs.existsSync(home)) {
+    try {
+      const legacy = path.join(repoRoot(), ".blindfold");
+      if (fs.existsSync(legacy) && fs.statSync(legacy).isDirectory()) {
+        fs.cpSync(legacy, home, { recursive: true });
+      } else {
+        fs.mkdirSync(home, { recursive: true });
+      }
+    } catch {
+      try {
+        fs.mkdirSync(home, { recursive: true });
+      } catch {
+      }
+    }
+  }
+  return home;
+}
+function assertSafeOverrideUrl(raw, label) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new Error(`${label} is not a valid URL: ${raw}`);
+  }
+  const isLocal = ["localhost", "127.0.0.1", "::1", "[::1]"].includes(u.hostname);
+  if (u.protocol !== "https:" && !isLocal) {
+    throw new Error(`${label} must be https (got ${u.protocol}//${u.hostname}); refusing to trust an insecure endpoint`);
+  }
+}
+function withFileLockSync(target, fn) {
+  const lockPath = `${target}.lock`;
+  const deadline = Date.now() + 1e4;
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+  const sleep = (ms) => {
+    try {
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+    } catch {
+    }
+  };
+  for (; ; ) {
+    try {
+      const fd = fs.openSync(lockPath, "wx");
+      fs.writeSync(fd, String(process.pid));
+      fs.closeSync(fd);
+      break;
+    } catch (e) {
+      if (e?.code !== "EEXIST") throw e;
+      try {
+        const st = fs.statSync(lockPath);
+        if (Date.now() - st.mtimeMs > 1e4) {
+          fs.rmSync(lockPath, { force: true });
+          continue;
+        }
+      } catch {
+      }
+      if (Date.now() > deadline) throw new Error(`timed out acquiring lock ${lockPath}`);
+      sleep(25);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    fs.rmSync(lockPath, { force: true });
+  }
+}
+function loadEnvFromFile(envPath = path.join(repoRoot(), ".env")) {
+  if (!fs.existsSync(envPath)) return;
+  const text = fs.readFileSync(envPath, "utf8");
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    let val = line.slice(eq + 1).trim();
+    if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+      val = val.slice(1, -1);
+    }
+    if (process.env[key] === void 0) process.env[key] = val;
+  }
+}
+function loadHomeConfig() {
+  try {
+    const cfg = configPath();
+    if (fs.existsSync(cfg)) {
+      const obj = JSON.parse(fs.readFileSync(cfg, "utf8"));
+      for (const [k, v] of Object.entries(obj)) {
+        if (k === "T3N_API_KEY_STORE") continue;
+        if (typeof v === "string" && process.env[k] === void 0) process.env[k] = v;
+      }
+    }
+  } catch {
+  }
+  loadEnvFromFile(path.join(homeDir(), ".env"));
+  if (process.env.T3N_API_KEY === void 0 && process.env.DID && keychainAvailable()) {
+    const k = keychainGet(process.env.DID);
+    if (k) process.env.T3N_API_KEY = k;
+  }
+}
+function loadBlindfoldEnv() {
+  loadEnvFromFile();
+  loadHomeConfig();
+  const t3nApiKey = process.env.T3N_API_KEY ?? "";
+  const did = process.env.DID ?? "";
+  const port = Number.parseInt(process.env.BLINDFOLD_PORT ?? "8787", 10);
+  const t3EnvRaw = (process.env.BLINDFOLD_T3_ENV ?? "testnet").toLowerCase();
+  const t3Env = t3EnvRaw === "production" ? "production" : "testnet";
+  const t3BaseUrl = (process.env.T3_BASE_URL ?? process.env.BLINDFOLD_BASE_URL ?? "").trim();
+  if (t3BaseUrl) {
+    assertSafeOverrideUrl(t3BaseUrl, process.env.T3_BASE_URL ? "T3_BASE_URL" : "BLINDFOLD_BASE_URL");
+  }
+  const mock = process.env.BLINDFOLD_MOCK === "1";
+  return { t3nApiKey, did, port, t3Env, t3BaseUrl, mock };
+}
+function assertRealReady(env) {
+  if (env.mock) return;
+  const missing = [];
+  if (!env.t3nApiKey) missing.push("T3N_API_KEY");
+  if (!env.did) missing.push("DID");
+  if (missing.length > 0) {
+    throw new Error(
+      `Missing required env: ${missing.join(", ")}. Claim them at https://docs.terminal3.io/developers/adk/get-started/prerequisites/request-test-tokens, then put them in .env. Or set BLINDFOLD_MOCK=1 to use mock mode for the demo only.`
+    );
+  }
+}
+function pluckSecret(envName) {
+  const v = process.env[envName];
+  if (!v) {
+    throw new Error(`environment variable ${envName} is unset or empty`);
+  }
+  return v;
+}
+
+// src/log.ts
+var HEADER_BLOCKLIST = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "x-api-key",
+  "cookie",
+  "set-cookie"
+]);
+function safeLog(level, obj) {
+  const safe = typeof obj === "string" ? { msg: obj } : redact(obj);
+  const line = JSON.stringify({ t: (/* @__PURE__ */ new Date()).toISOString(), level, ...safe });
+  process.stderr.write(line + "\n");
+}
+function redact(input) {
+  const out = {};
+  for (const [k, v] of Object.entries(input)) {
+    if (k === "headers" && v && typeof v === "object") {
+      out[k] = redactHeaders(v);
+    } else if (HEADER_BLOCKLIST.has(k.toLowerCase())) {
+      out[k] = "[redacted]";
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function redactHeaders(h) {
+  if (Array.isArray(h)) {
+    return h.map(([k, v]) => [k, HEADER_BLOCKLIST.has(k.toLowerCase()) ? "[redacted]" : v]);
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(h)) {
+    out[k] = HEADER_BLOCKLIST.has(k.toLowerCase()) ? "[redacted]" : String(v);
+  }
+  return out;
+}
+
+// src/prompt.ts
+async function readSecretLine(prompt) {
+  process.stderr.write(prompt);
+  const stdin = process.stdin;
+  if (!stdin.isTTY) {
+    return await readOneLine(stdin);
+  }
+  return await new Promise((resolve, reject) => {
+    let buf = "";
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const cleanup = () => {
+      stdin.removeListener("data", onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+    };
+    const onData = (chunk) => {
+      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      for (const ch of s) {
+        if (ch === "\n" || ch === "\r") {
+          cleanup();
+          process.stderr.write("\n");
+          resolve(buf);
+          return;
+        }
+        if (ch === "") {
+          cleanup();
+          process.stderr.write("\n");
+          reject(new Error("aborted by user"));
+          return;
+        }
+        if (ch === "\x7F" || ch === "\b") {
+          if (buf.length > 0) buf = buf.slice(0, -1);
+          continue;
+        }
+        if (ch >= " " || ch === "	") buf += ch;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+function readOneLine(stdin) {
+  return new Promise((resolve, reject) => {
+    let buf = "";
+    stdin.setEncoding("utf8");
+    stdin.on("data", (d) => {
+      buf += d;
+    });
+    stdin.on("end", () => resolve(buf.replace(/\r?\n$/, "")));
+    stdin.on("error", reject);
+  });
+}
+
+// src/sealed-ledger.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+import { createHash, createHmac, randomBytes } from "node:crypto";
+function defaultSealedLogPath() {
+  return process.env.BLINDFOLD_SEALED_LOG ?? path2.join(stateDir(), "sealed.jsonl");
+}
+function ledgerKey() {
+  try {
+    const keyPath = path2.join(stateDir(), "ledger.key");
+    if (fs2.existsSync(keyPath)) return Buffer.from(fs2.readFileSync(keyPath, "utf8").trim(), "hex");
+    fs2.mkdirSync(path2.dirname(keyPath), { recursive: true });
+    const key = randomBytes(32);
+    fs2.writeFileSync(keyPath, key.toString("hex"), { mode: 384 });
+    try {
+      fs2.chmodSync(keyPath, 384);
+    } catch {
+    }
+    return key;
+  } catch {
+    return null;
+  }
+}
+function coreString(e) {
+  return JSON.stringify({
+    t: e.t,
+    name: e.name,
+    source: e.source,
+    length: e.length,
+    mode: e.mode,
+    tenant_did: e.tenant_did,
+    map_name: e.map_name
+  });
+}
+function sha(s) {
+  return createHash("sha256").update(s).digest("hex");
+}
+function chainHash(key, prev, core) {
+  if (key) return { hash: createHmac("sha256", key).update(`${prev}
+${core}`).digest("hex"), alg: "hmac-sha256" };
+  return { hash: sha(`${prev}
+${core}`) };
+}
+function readLastLine(p) {
+  if (!fs2.existsSync(p)) return null;
+  const fd = fs2.openSync(p, "r");
+  try {
+    const size = fs2.fstatSync(fd).size;
+    if (size === 0) return null;
+    const readLen = Math.min(size, 64 * 1024);
+    const buf = Buffer.alloc(readLen);
+    fs2.readSync(fd, buf, 0, readLen, size - readLen);
+    const lines = buf.toString("utf8").split("\n").filter((l) => l.trim().length > 0);
+    return lines.length ? lines[lines.length - 1] : null;
+  } finally {
+    fs2.closeSync(fd);
+  }
+}
+function recordSealed(entry) {
+  const p = defaultSealedLogPath();
+  try {
+    withFileLockSync(p, () => {
+      let prevHash = "";
+      const last = readLastLine(p);
+      if (last) {
+        try {
+          prevHash = JSON.parse(last).hash ?? "";
+        } catch {
+          prevHash = "";
+        }
+      }
+      const { hash, alg } = chainHash(ledgerKey(), prevHash, coreString(entry));
+      const chained = { ...entry, prev: prevHash, hash, ...alg ? { alg } : {} };
+      fs2.mkdirSync(path2.dirname(p), { recursive: true });
+      fs2.appendFileSync(p, JSON.stringify(chained) + "\n");
+    });
+  } catch {
+  }
+}
+
+// src/t3-client.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
+import fs3 from "node:fs";
+import path3 from "node:path";
+
+// src/constants.ts
+var SENTINEL = "__BLINDFOLD__";
+var CONTRACT_TAIL = "blindfold-proxy";
+var CONTRACT_VERSION = "0.5.6";
+
+// src/t3-client.ts
+var T3_TIMEOUT_MS = Number(process.env.BLINDFOLD_T3_TIMEOUT_MS) || 3e4;
+var T3TimeoutError = class extends Error {
+};
+function withDeadline(promise, label, ms = T3_TIMEOUT_MS) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new T3TimeoutError(`T3 ${label} timed out after ${ms}ms`)), ms);
+    if (typeof timer.unref === "function") timer.unref();
+    promise.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e) => {
+        clearTimeout(timer);
+        reject(e);
+      }
+    );
+  });
+}
+function egressCachePath() {
+  return process.env.BLINDFOLD_EGRESS_CACHE ?? path3.join(stateDir(), "egress-hosts.json");
+}
+function loadEgressHosts(did) {
+  try {
+    const all = JSON.parse(fs3.readFileSync(egressCachePath(), "utf8"));
+    return Array.isArray(all[did]) ? all[did] : [];
+  } catch {
+    return [];
+  }
+}
+function saveEgressHosts(did, hosts) {
+  const p = egressCachePath();
+  withFileLockSync(p, () => {
+    let all = {};
+    try {
+      all = JSON.parse(fs3.readFileSync(p, "utf8"));
+    } catch {
+    }
+    const existing = Array.isArray(all[did]) ? all[did] : [];
+    all[did] = Array.from(/* @__PURE__ */ new Set([...existing, ...hosts])).sort();
+    fs3.mkdirSync(path3.dirname(p), { recursive: true });
+    fs3.writeFileSync(p, JSON.stringify(all, null, 2));
+  });
+}
+var sdkCache = null;
+async function loadSdk() {
+  if (sdkCache) return sdkCache;
+  try {
+    const mod = await import("@terminal3/t3n-sdk");
+    sdkCache = mod;
+    return mod;
+  } catch {
+    throw new Error(
+      "@terminal3/t3n-sdk not installed. Run `npm install @terminal3/t3n-sdk` for REAL T3 mode, or set BLINDFOLD_MOCK=1 to keep using mock mode."
+    );
+  }
+}
+async function openT3Client(env) {
+  if (env.mock) return openMockClient();
+  assertRealReady(env);
+  return openRealClient(env);
+}
+async function openRealClient(env) {
+  if (!/^0x[0-9a-fA-F]{64}$/.test(env.t3nApiKey)) {
+    throw new Error("T3N_API_KEY must be a 0x-prefixed 32-byte hex (secp256k1 private key).");
+  }
+  if (!/^did:t3n:[0-9a-fA-F]+$/.test(env.did)) {
+    throw new Error('DID must look like "did:t3n:<hex>".');
+  }
+  const sdk = await loadSdk();
+  sdk.setEnvironment(env.t3Env);
+  const baseUrl = env.t3BaseUrl || sdk.NODE_URLS[env.t3Env];
+  const wasmComponent = await sdk.loadWasmComponent();
+  const address = sdk.eth_get_address(env.t3nApiKey);
+  const t3n = new sdk.T3nClient({
+    baseUrl,
+    wasmComponent,
+    handlers: { EthSign: sdk.metamask_sign(address, void 0, env.t3nApiKey) }
+  });
+  await t3n.handshake();
+  await t3n.authenticate(sdk.createEthAuthInput(address));
+  const tenant = new sdk.TenantClient({
+    environment: env.t3Env,
+    baseUrl,
+    tenantDid: env.did,
+    t3n
+  });
+  const seedSecret = async (name, value) => {
+    await tenant.executeControl("map-entry-set", {
+      map_name: tenant.canonicalName("secrets"),
+      key: name,
+      value
+    });
+    safeLog("info", { msg: "seeded", name });
+  };
+  const registerContract2 = async (wasm) => {
+    const r = await tenant.contracts.register({
+      tail: CONTRACT_TAIL,
+      version: CONTRACT_VERSION,
+      wasm
+    });
+    return {
+      contractId: r.contract_id ?? r.contractId ?? "(unknown)"
+    };
+  };
+  const invokeForward = async (req) => {
+    const raw = await withDeadline(tenant.contracts.execute(CONTRACT_TAIL, {
+      version: CONTRACT_VERSION,
+      functionName: "forward",
+      input: req
+    }), "forward");
+    if (typeof raw.status === "number" && Array.isArray(raw.headers)) {
+      return { status: raw.status, headers: raw.headers, body: raw.body ?? "" };
+    }
+    return {
+      status: raw.code ?? 502,
+      headers: [["content-type", "application/json"]],
+      body: raw.body ?? ""
+    };
+  };
+  const decodeSecret = (v) => {
+    if (typeof v === "string") return v;
+    if (Array.isArray(v)) return Buffer.from(v).toString("utf8");
+    if (v && typeof v === "object") {
+      const o = v;
+      if (typeof o.value === "string") return o.value;
+      if (Array.isArray(o.value)) return Buffer.from(o.value).toString("utf8");
+      const entry = o.entry;
+      if (entry && typeof entry.value === "string") return entry.value;
+    }
+    return "";
+  };
+  const releaseSecret = async (name) => {
+    try {
+      const r = await withDeadline(tenant.contracts.execute(CONTRACT_TAIL, {
+        version: CONTRACT_VERSION,
+        functionName: "release-to-tenant",
+        input: { secret_key: name }
+      }), "release-to-tenant");
+      if (r && r.ok && r.value) return r.value;
+    } catch (e) {
+      if (e instanceof T3TimeoutError) throw e;
+    }
+    const direct = decodeSecret(
+      await withDeadline(tenant.executeControl("map-entry-get", {
+        map_name: tenant.canonicalName("secrets"),
+        key: name
+      }), "map-entry-get")
+    );
+    if (!direct) throw new Error(`secret "${name}" not found in the secrets map`);
+    return direct;
+  };
+  const me = async () => {
+    const info = await tenant.tenant.me();
+    return { tenant: String(info.tenant ?? ""), status: info.status };
+  };
+  const agentAuthUpdate = async (agentDid, hosts, functions) => {
+    let ucv = "0.1.0";
+    if (typeof sdk.getScriptVersion === "function") {
+      try {
+        const v = await sdk.getScriptVersion(baseUrl, "tee:user/contracts");
+        if (typeof v === "string" && /^\d/.test(v)) ucv = v;
+      } catch {
+      }
+    }
+    const didHex = env.did.replace(/^did:t3n:/, "");
+    const revoking = functions.length === 0 && hosts.length === 0;
+    const scripts = [{
+      scriptName: `z:${didHex}:${CONTRACT_TAIL}`,
+      versionReq: `>=${CONTRACT_VERSION}`,
+      functions: revoking ? ["forward"] : functions,
+      allowedHosts: revoking ? [] : hosts
+    }];
+    await t3n.execute({
+      script_name: "tee:user/contracts",
+      script_version: ucv,
+      function_name: "agent-auth-update",
+      input: { agents: [{ agentDid, scripts }] }
+    });
+  };
+  const grantEgress = async (hosts, opts) => {
+    const prev = opts?.replace ? [] : loadEgressHosts(env.did);
+    const merged = Array.from(/* @__PURE__ */ new Set([...prev, ...hosts])).sort();
+    await agentAuthUpdate(env.did, merged, ["forward", "release-to-tenant"]);
+    saveEgressHosts(env.did, merged);
+    return merged;
+  };
+  const setAgentGrant = (agentDid, hosts, functions) => agentAuthUpdate(agentDid, hosts, functions);
+  const verifySecret = async (name) => {
+    try {
+      const value = await releaseSecret(name);
+      return { present: true, length: value.length, fingerprint: createHash2("sha256").update(value).digest("hex").slice(0, 8) };
+    } catch {
+      return { present: false, length: 0, fingerprint: "" };
+    }
+  };
+  const getBalance = async () => {
+    const page = await withDeadline(tenant.token.getUsage(), "token.getUsage");
+    const b = page.balance ?? {};
+    return {
+      available: Number(b.available ?? 0),
+      reserved: Number(b.reserved ?? 0),
+      creditExhausted: Boolean(b.credit_exhausted),
+      storageDeposit: b.storage_deposit != null ? Number(b.storage_deposit) : void 0
+    };
+  };
+  return {
+    close: async () => {
+    },
+    seedSecret,
+    invokeForward,
+    registerContract: registerContract2,
+    releaseSecret,
+    me,
+    grantEgress,
+    setAgentGrant,
+    verifySecret,
+    getBalance,
+    isReal: true
+  };
+}
+function openMockClient() {
+  return {
+    close: async () => {
+    },
+    async seedSecret(name, value) {
+      if (!value || value.length === 0) throw new Error(`secret ${name} is empty`);
+      safeLog("info", { msg: "mock-seed (value dropped, length only)", name, length: value.length });
+    },
+    async registerContract(wasm) {
+      safeLog("info", { msg: "mock-register-contract", wasmBytes: wasm.byteLength });
+      return { contractId: "mock-contract-1" };
+    },
+    async invokeForward(req) {
+      safeLog("info", {
+        msg: "mock-forward",
+        method: req.method,
+        url: schemeAndHost(req.url),
+        secret_key: req.secret_key
+      });
+      const body = `{"mock":true,"note":"Blindfold mock mode \u2014 no real call made.","echo":{"url":${JSON.stringify(req.url)}}}`;
+      return { status: 200, headers: [["content-type", "application/json"]], body };
+    },
+    async releaseSecret(name) {
+      safeLog("info", { msg: "mock-release", name });
+      return `mock-released:${name}`;
+    },
+    async me() {
+      return { tenant: "did:t3n:mock", status: "active" };
+    },
+    async grantEgress(hosts) {
+      safeLog("info", { msg: "mock-grant-egress", hosts });
+      return hosts;
+    },
+    async setAgentGrant(agentDid, hosts, functions) {
+      safeLog("info", { msg: "mock-set-agent-grant", agentDid, hosts, functions });
+    },
+    async verifySecret(name) {
+      return { present: true, length: 0, fingerprint: `mock-${name}`.slice(0, 8) };
+    },
+    async getBalance() {
+      return { available: 1e9, reserved: 0, creditExhausted: false, mock: true };
+    },
+    isReal: false
+  };
+}
+function schemeAndHost(url) {
+  try {
+    const u = new URL(url);
+    return `${u.protocol}//${u.host}`;
+  } catch {
+    return "<bad-url>";
+  }
+}
+
+// src/register.ts
+async function registerSecret(opts) {
+  const env = loadBlindfoldEnv();
+  const t3 = await openT3Client(env);
+  try {
+    let source = "stdin";
+    let value;
+    if (opts.value !== void 0) {
+      value = opts.value;
+      source = "explicit";
+    } else if (opts.fromEnv) {
+      value = pluckSecret(opts.fromEnv);
+      source = `env:${opts.fromEnv}`;
+    } else {
+      value = await readSecretLine(`  Value for "${opts.name}" (input is hidden): `);
+      if (!value) throw new Error("empty value");
+    }
+    if (value.includes(SENTINEL)) {
+      throw new Error(`Secret value contains the Blindfold sentinel string "${SENTINEL}" \u2014 this would cause infinite substitution. Use a different value.`);
+    }
+    await t3.seedSecret(opts.name, value);
+    const length = value.length;
+    const mode = env.mock ? "mock" : "real";
+    recordSealed({
+      t: (/* @__PURE__ */ new Date()).toISOString(),
+      name: opts.name,
+      source,
+      length,
+      mode,
+      tenant_did: env.did,
+      map_name: env.did ? `z:${env.did.replace(/^did:t3n:/, "")}:secrets` : "(mock)"
+    });
+    safeLog("info", { msg: "registered", name: opts.name, source, length, mode });
+  } finally {
+    await t3.close();
+  }
+}
+async function registerContract(wasm) {
+  const env = loadBlindfoldEnv();
+  const t3 = await openT3Client(env);
+  try {
+    return await t3.registerContract(wasm);
+  } finally {
+    await t3.close();
+  }
+}
+export {
+  registerContract,
+  registerSecret
+};