blindseal 0.5.0 → 0.5.1

package/dist/chunk-6EU4GH4P.js

@@ -0,0 +1,513 @@
+#!/usr/bin/env node
+import {
+  getNullifierStatus
+} from "./chunk-B44GZXDX.js";
+import {
+  discloseBundle,
+  hashEntry
+} from "./chunk-VSOUJM6X.js";
+import {
+  nearestFixturesDir,
+  packageRoot,
+  resolveDashboardToken,
+  shippedDashboardDir,
+  shippedFixturesDir
+} from "./chunk-CIUQ6WHJ.js";
+
+// src/cli/run.ts
+import { existsSync as existsSync2 } from "fs";
+import path2 from "path";
+
+// src/api/mock-server.ts
+import { createServer } from "http";
+import { createHash, randomBytes } from "crypto";
+import { readFileSync, existsSync } from "fs";
+import path from "path";
+import { createPrivateKey, createPublicKey } from "crypto";
+var MOCK_IDENTITY_PKCS8 = "302e020100300506032b657004220420b6c6aa0182de5f17678ed27e9515ed56b438c6bec2ca9d27d653feec4d13da1c";
+var MOCK_PRIVATE_KEY = createPrivateKey({ key: Buffer.from(MOCK_IDENTITY_PKCS8, "hex"), format: "der", type: "pkcs8" });
+var MOCK_PUBKEY_HEX = createPublicKey(MOCK_PRIVATE_KEY).export({ type: "spki", format: "der" }).toString("hex");
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".wasm": "application/wasm",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".woff2": "font/woff2",
+  ".woff": "font/woff",
+  ".ico": "image/x-icon",
+  ".map": "application/json",
+  ".txt": "text/plain"
+};
+var DASHBOARD_CSP = [
+  "default-src 'self'",
+  "script-src 'self' 'wasm-unsafe-eval'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self'",
+  "connect-src 'self' ws://127.0.0.1:* ws://localhost:* http://127.0.0.1:* http://localhost:*",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'"
+].join("; ");
+function serveDashboard(res, dist, pathname) {
+  const rel = pathname === "/" ? "/index.html" : decodeURIComponent(pathname);
+  let file = path.normalize(path.join(dist, rel));
+  if (!file.startsWith(path.normalize(dist + path.sep)) && file !== path.normalize(dist)) return false;
+  if (!existsSync(file)) file = path.join(dist, "index.html");
+  if (!existsSync(file)) return false;
+  const body = readFileSync(file);
+  const type = MIME[path.extname(file).toLowerCase()] ?? "application/octet-stream";
+  res.writeHead(200, {
+    "content-type": type,
+    "content-length": body.length,
+    "content-security-policy": DASHBOARD_CSP,
+    "x-content-type-options": "nosniff",
+    "referrer-policy": "no-referrer",
+    "cache-control": file.endsWith("index.html") ? "no-cache" : "public, max-age=31536000, immutable"
+  });
+  res.end(body);
+  return true;
+}
+function loadFixtures(dir) {
+  const read = (f) => JSON.parse(readFileSync(path.join(dir, f), "utf8"));
+  return {
+    decisions: read("decisions.json"),
+    policy: read("policy.json"),
+    audit: read("audit.json"),
+    attestations: read("attestations.json"),
+    sample: read("attestation-sample.json")
+  };
+}
+function resolveToken(explicit) {
+  return resolveDashboardToken(explicit);
+}
+var sha = (s) => "0x" + createHash("sha256").update(s).digest("hex");
+function sendJson(res, status, body) {
+  const buf = Buffer.from(JSON.stringify(body));
+  res.writeHead(status, { "content-type": "application/json", "content-length": buf.length });
+  res.end(buf);
+}
+function sendErr(res, status, code, message) {
+  sendJson(res, status, { error: { code, message } });
+}
+function bearerOk(req, token, url) {
+  const auth = req.headers["authorization"];
+  if (typeof auth === "string" && auth === `Bearer ${token}`) return true;
+  if (url.searchParams.get("token") === token) return true;
+  return false;
+}
+async function readBody(req) {
+  const chunks = [];
+  for await (const c of req) chunks.push(c);
+  if (chunks.length === 0) return {};
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+var WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+function wsAccept(key) {
+  return createHash("sha1").update(key + WS_GUID).digest("base64");
+}
+function wsFrame(text) {
+  const payload = Buffer.from(text);
+  const len = payload.length;
+  let header;
+  if (len < 126) {
+    header = Buffer.from([129, len]);
+  } else if (len < 65536) {
+    header = Buffer.from([129, 126, len >> 8 & 255, len & 255]);
+  } else {
+    header = Buffer.alloc(10);
+    header[0] = 129;
+    header[1] = 127;
+    header.writeBigUInt64BE(BigInt(len), 2);
+  }
+  return Buffer.concat([header, payload]);
+}
+function startMockApi(opts) {
+  const port = opts.port ?? 7777;
+  const host = opts.host ?? "127.0.0.1";
+  const token = resolveToken(opts.token);
+  const emitIntervalMs = opts.emitIntervalMs ?? 3e3;
+  const fx = loadFixtures(opts.fixturesDir);
+  const startedAt = Date.now();
+  const envState = process.env.BLINDSEAL_MOCK_STATE ?? "";
+  const stateOf = (url) => url.searchParams.get("state") ?? envState;
+  const TEE_QUOTE = { quote: sha("mock-tee-quote").slice(2), quoteHash: sha("mock-tee-quote-hash") };
+  const status = (st) => ({
+    version: "0.0.0-mock",
+    uptimeSec: Math.floor((Date.now() - startedAt) / 1e3),
+    connection: st === "offline" ? "offline" : st === "reconnecting" ? "reconnecting" : "live",
+    upstreams: [{ name: "mock-upstream", transport: "stdio", healthy: st !== "upstream-down" }],
+    policyRoot: fx.policy.root,
+    detectorVersion: fx.decisions[0]?.detectorVersion ?? "0x",
+    audit: st === "empty" ? { index: -1, hash: fx.audit.genesis, ts: new Date(startedAt).toISOString() } : fx.audit.head,
+    prover: { available: st === "prover-down" ? false : true },
+    l3: { mode: st === "tee" ? "tee" : "local" },
+    mock: true
+  });
+  const wsClients = /* @__PURE__ */ new Set();
+  const broadcast = (obj) => {
+    const frame = wsFrame(JSON.stringify(obj));
+    for (const s of wsClients) {
+      if (!s.destroyed) s.write(frame);
+    }
+  };
+  const createdAttestations = /* @__PURE__ */ new Map();
+  const liveDecisions = /* @__PURE__ */ new Map();
+  const server = createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+    const p = url.pathname;
+    const method = req.method ?? "GET";
+    const origin = req.headers["origin"];
+    if (typeof origin === "string" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Access-Control-Allow-Headers", "authorization, content-type, x-confirm");
+      res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS");
+      res.setHeader("Vary", "Origin");
+    }
+    if (method === "OPTIONS") {
+      res.writeHead(204);
+      return res.end();
+    }
+    if (!p.startsWith("/api/")) {
+      if (opts.dashboardDist && method === "GET" && serveDashboard(res, opts.dashboardDist, p)) return;
+      return sendErr(res, 404, "NOT_FOUND", "unknown path");
+    }
+    if (!bearerOk(req, token, url)) return sendErr(res, 401, "UNAUTHORIZED", "missing or invalid bearer token");
+    const seg = p.slice("/api/".length).split("/").filter(Boolean);
+    const st = stateOf(url);
+    if (st === "unauthorized") return sendErr(res, 401, "UNAUTHORIZED", "missing or invalid dashboard token");
+    if (st === "offline" && !(seg[0] === "status")) return sendErr(res, 503, "OFFLINE", "the proxy is unreachable");
+    try {
+      if (method === "GET" && seg[0] === "status" && seg.length === 1) return sendJson(res, 200, status(st));
+      if (method === "GET" && seg[0] === "decisions" && seg.length === 1) {
+        const q = url.searchParams;
+        let items = st === "empty" ? [] : fx.decisions.slice();
+        const vd = q.get("verdict");
+        if (vd) items = items.filter((d) => d.verdict === vd);
+        const sv = q.get("server");
+        if (sv) items = items.filter((d) => d.server === sv);
+        const tl = q.get("tool");
+        if (tl) items = items.filter((d) => d.tool === tl);
+        const from = q.get("from");
+        if (from) items = items.filter((d) => d.ts >= from);
+        const to = q.get("to");
+        if (to) items = items.filter((d) => d.ts <= to);
+        const limit = Math.min(Math.max(Number.parseInt(q.get("limit") ?? "50", 10) || 50, 1), 200);
+        const cursor = Number.parseInt(q.get("cursor") ?? "0", 10) || 0;
+        const page = items.slice(cursor, cursor + limit);
+        const nextCursor = cursor + limit < items.length ? String(cursor + limit) : void 0;
+        return sendJson(res, 200, { items: page, ...nextCursor ? { nextCursor } : {} });
+      }
+      if (seg[0] === "decisions" && seg.length >= 2) {
+        const d = fx.decisions.find((x) => x.id === seg[1]) ?? liveDecisions.get(seg[1]);
+        if (!d) return sendErr(res, 404, "NOT_FOUND", "decision not found");
+        if (method === "GET" && seg.length === 2) {
+          return sendJson(res, 200, { ...d, payloadRedacted: `[mock redacted payload for ${d.id}]` });
+        }
+        if (method === "POST" && seg[2] === "reveal" && seg.length === 3) {
+          if (req.headers["x-confirm"] !== "reveal") return sendErr(res, 400, "VALIDATION", "X-Confirm: reveal required");
+          return sendJson(res, 200, { payload: `[mock raw payload for ${d.id} \u2014 synthetic]` });
+        }
+      }
+      if (seg[0] === "audit") {
+        if (method === "GET" && seg[1] === "head") {
+          if (st === "empty") return sendJson(res, 200, { index: -1, hash: fx.audit.genesis, ts: new Date(startedAt).toISOString() });
+          return sendJson(res, 200, fx.audit.head);
+        }
+        if (method === "GET" && seg[1] === "entries") {
+          if (st === "empty") return sendJson(res, 200, []);
+          const from = Number.parseInt(url.searchParams.get("from") ?? "0", 10) || 0;
+          const to = Number.parseInt(url.searchParams.get("to") ?? String(fx.audit.head.index), 10);
+          return sendJson(res, 200, fx.audit.entries.filter((e) => e.index >= from && e.index <= to));
+        }
+        if (method === "POST" && seg[1] === "verify") {
+          if (st === "chain-broken") return sendJson(res, 200, { ok: false, checkedFrom: 0, checkedTo: fx.audit.head.index, brokenAt: 143 });
+          let prev = fx.audit.genesis;
+          let brokenAt;
+          for (const e of fx.audit.entries) {
+            const h = hashEntry({ index: e.index, ts: e.ts, decisionId: e.decisionId, verdict: e.verdict, payloadHash: e.payloadHash, prevHash: prev });
+            if (h !== e.hash || e.prevHash !== prev) {
+              brokenAt = e.index;
+              break;
+            }
+            prev = e.hash;
+          }
+          return sendJson(res, 200, {
+            ok: brokenAt === void 0,
+            checkedFrom: 0,
+            checkedTo: fx.audit.head.index,
+            ...brokenAt !== void 0 ? { brokenAt } : {}
+          });
+        }
+        if (method === "POST" && seg[1] === "disclose") {
+          const body = await readBody(req);
+          if (!body || typeof body.from !== "number" || typeof body.to !== "number") return sendErr(res, 400, "VALIDATION", "from/to required");
+          if (st === "chain-broken" && body.from <= 143 && body.to >= 143)
+            return sendErr(res, 409, "CHAIN_BROKEN", "the chain is broken at #143; cannot disclose a range over it");
+          const entries = fx.audit.entries.filter((e) => e.index >= body.from && e.index <= body.to);
+          return sendJson(res, 200, discloseBundle({
+            from: body.from,
+            to: body.to,
+            head: fx.audit.head,
+            entries,
+            privateKey: MOCK_PRIVATE_KEY,
+            pubkeyHex: MOCK_PUBKEY_HEX
+          }));
+        }
+      }
+      if (seg[0] === "policy") {
+        if (method === "GET" && seg.length === 1) return sendJson(res, 200, fx.policy);
+        if (method === "PUT" && seg.length === 1) {
+          const body = await readBody(req);
+          if (!body || !Array.isArray(body.rules)) return sendErr(res, 400, "VALIDATION", "rules[] required");
+          const root = sha("policy:" + JSON.stringify(body.rules));
+          return sendJson(res, 200, { ...fx.policy, rules: body.rules, root, version: (fx.policy.version ?? 1) + 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+        }
+        if (method === "POST" && seg[1] === "dry-run") {
+          const body = await readBody(req);
+          if (body === void 0) return sendErr(res, 400, "VALIDATION", "invalid JSON body");
+          const d = { ...fx.decisions[0], id: "dryrun_" + Date.now(), ts: (/* @__PURE__ */ new Date()).toISOString() };
+          return sendJson(res, 200, d);
+        }
+      }
+      if (seg[0] === "attestations") {
+        if (method === "GET" && seg.length === 1) {
+          if (st === "empty") return sendJson(res, 200, []);
+          const statusFilter = url.searchParams.get("status");
+          const items = statusFilter ? fx.attestations.filter((a) => a.status === statusFilter) : fx.attestations;
+          return sendJson(res, 200, items);
+        }
+        if (method === "POST" && seg.length === 1) {
+          if (st === "prover-down") return sendErr(res, 503, "PROVER_UNAVAILABLE", "the local prover is not running");
+          const body = await readBody(req);
+          if (!body || typeof body.decisionId !== "string") return sendErr(res, 400, "VALIDATION", "decisionId required");
+          const d = fx.decisions.find((x) => x.id === body.decisionId);
+          if (!d) return sendErr(res, 404, "NOT_FOUND", "decision not found");
+          if (!d.action) return sendErr(res, 422, "NO_ACTION_FIELDS", "decision has no on-chain action to attest");
+          const id = "att_" + randomBytes(5).toString("hex");
+          createdAttestations.set(id, {
+            ...fx.sample,
+            id,
+            decisionId: d.id,
+            status: "generating",
+            progressPct: 50,
+            createdAt: (/* @__PURE__ */ new Date()).toISOString()
+          });
+          setTimeout(() => broadcast({ type: "attestation", data: { id, status: "generating", progressPct: 50 } }), 50);
+          setTimeout(() => {
+            const a = createdAttestations.get(id);
+            if (a) {
+              a.status = "generated";
+              a.progressPct = 100;
+            }
+            broadcast({ type: "attestation", data: { id, status: "generated", progressPct: 100 } });
+          }, 150);
+          return sendJson(res, 202, { id });
+        }
+        if (seg.length >= 2) {
+          const a = fx.attestations.find((x) => x.id === seg[1]) ?? createdAttestations.get(seg[1]) ?? (seg[1] === "sample" ? fx.sample : void 0);
+          if (method === "GET" && seg.length === 2) {
+            if (!a) return sendErr(res, 404, "NOT_FOUND", "attestation not found");
+            return sendJson(res, 200, a);
+          }
+          if (method === "POST" && seg[2] === "submit") {
+            const body = await readBody(req);
+            if (!body || body.cluster !== "mainnet-beta") return sendErr(res, 400, "VALIDATION", "cluster must be mainnet-beta");
+            return sendJson(res, 200, { txSig: sha("mock-txsig:" + seg[1]).slice(2, 90) });
+          }
+          if (method === "GET" && seg[2] === "export") {
+            if (!a) return sendErr(res, 404, "NOT_FOUND", "attestation not found");
+            const buf = Buffer.from(JSON.stringify(a, null, 2));
+            res.writeHead(200, { "content-type": "application/json", "content-disposition": `attachment; filename="attestation-${seg[1]}.json"`, "content-length": buf.length });
+            return res.end(buf);
+          }
+        }
+      }
+      if (method === "GET" && seg[0] === "tee" && seg[1] === "quote") {
+        if (st === "tee") return sendJson(res, 200, { mode: "tee", quote: TEE_QUOTE.quote, quoteHash: TEE_QUOTE.quoteHash });
+        return sendJson(res, 200, { mode: "local" });
+      }
+      if (seg[0] === "nullifiers" && seg[1] && method === "GET") {
+        try {
+          return sendJson(res, 200, await getNullifierStatus(seg[1]));
+        } catch (e) {
+          return sendErr(res, 502, "RPC_UNAVAILABLE", e instanceof Error ? e.message : String(e));
+        }
+      }
+      return sendErr(res, 404, "NOT_FOUND", `no route for ${method} ${p}`);
+    } catch (e) {
+      return sendErr(res, 500, "VALIDATION", e.message);
+    }
+  });
+  server.on("upgrade", (req, socket) => {
+    const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+    const isEvents = url.pathname === "/api/events" || url.pathname === "/events";
+    if (!isEvents || !bearerOk(req, token, url)) {
+      socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+      socket.destroy();
+      return;
+    }
+    const key = req.headers["sec-websocket-key"];
+    if (typeof key !== "string") {
+      socket.destroy();
+      return;
+    }
+    socket.write(
+      `HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${wsAccept(key)}\r
+\r
+`
+    );
+    wsClients.add(socket);
+    socket.write(wsFrame(JSON.stringify({ type: "status", data: status(envState) })));
+    socket.on("close", () => wsClients.delete(socket));
+    socket.on("error", () => wsClients.delete(socket));
+  });
+  let idx = 0;
+  const timer = setInterval(() => {
+    if (wsClients.size === 0) return;
+    const base = fx.decisions[idx % fx.decisions.length];
+    idx++;
+    const live = { ...base, id: base.id + "_live" + idx, ts: (/* @__PURE__ */ new Date()).toISOString() };
+    liveDecisions.set(live.id, live);
+    if (liveDecisions.size > 100) liveDecisions.delete(liveDecisions.keys().next().value);
+    broadcast({ type: "decision", data: live });
+  }, emitIntervalMs);
+  timer.unref?.();
+  return new Promise((resolve) => {
+    server.listen(port, host, () => {
+      const addr = server.address();
+      const actualPort = typeof addr === "object" && addr ? addr.port : port;
+      resolve({
+        url: `http://${host}:${actualPort}/api`,
+        token,
+        port: actualPort,
+        close: () => new Promise((r) => {
+          clearInterval(timer);
+          for (const s of wsClients) s.destroy();
+          wsClients.clear();
+          server.close(() => r());
+        })
+      });
+    });
+  });
+}
+
+// src/cli/run.ts
+var HELP = `blindseal run \u2014 start the local API + WS and serve the dashboard
+
+Usage:
+  blindseal run --mock [flags]
+
+Flags
+  --mock              serve the bundled sample data with a fake decision stream
+  --port <n>          listen port (default 7777)
+  --host <addr>       listen host (default 127.0.0.1)
+  --fixtures <dir>    sample data directory (default: the fixtures/ shipped in the package,
+                      else the nearest fixtures/ above the current directory; $BLINDSEAL_FIXTURES)
+  --dashboard <dir>   built dashboard to serve at / (default: the dashboard/ shipped in the
+                      package; $BLINDSEAL_DASHBOARD_DIST)
+  --help, -h          this help
+
+Then open the dashboard: blindseal dashboard (or the http://127.0.0.1:7777/#token=\u2026 URL printed).
+`;
+function parseRunArgs(argv) {
+  const out = { mock: process.env.BLINDSEAL_MOCK === "1" };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--help" || a === "-h") out.help = true;
+    else if (a === "--mock") out.mock = true;
+    else if (a === "--port") out.port = Number.parseInt(argv[++i] ?? "", 10);
+    else if (a === "--host") out.host = argv[++i];
+    else if (a === "--fixtures") out.fixturesDir = argv[++i];
+    else if (a === "--dashboard") out.dashboard = argv[++i];
+    else if (a && a.startsWith("--")) throw new Error(`unknown flag: ${a}`);
+  }
+  return out;
+}
+function resolveFixturesDir(explicit) {
+  if (explicit) return explicit;
+  if (process.env.BLINDSEAL_FIXTURES) return process.env.BLINDSEAL_FIXTURES;
+  const found = shippedFixturesDir() ?? nearestFixturesDir();
+  if (found) return found;
+  throw new Error(
+    `sample data not found: this install has no ${path2.join(packageRoot(), "fixtures")} and no fixtures/ above ${process.cwd()}; pass --fixtures <dir> or set BLINDSEAL_FIXTURES`
+  );
+}
+function resolveDashboardDir(explicit) {
+  const picked = explicit ?? process.env.BLINDSEAL_DASHBOARD_DIST;
+  if (picked) return picked;
+  const shipped = shippedDashboardDir();
+  if (shipped) return shipped;
+  const sibling = path2.join(packageRoot(), "..", "dashboard", "dist");
+  return existsSync2(path2.join(sibling, "index.html")) ? sibling : void 0;
+}
+async function runRun(argv) {
+  let opts;
+  try {
+    opts = parseRunArgs(argv);
+  } catch (e) {
+    process.stderr.write(`blindseal run: ${e.message}
+`);
+    return 1;
+  }
+  if (opts.help) {
+    process.stdout.write(HELP);
+    return 0;
+  }
+  if (!opts.mock) {
+    process.stderr.write(
+      "blindseal run: the engine-backed local API is not available in this release.\nUse `blindseal run --mock` for the dashboard over sample data, or `blindseal -- <server>` to wrap an MCP server.\n"
+    );
+    return 1;
+  }
+  let fixturesDir;
+  try {
+    fixturesDir = resolveFixturesDir(opts.fixturesDir);
+  } catch (e) {
+    process.stderr.write(`blindseal run: ${e.message}
+`);
+    return 1;
+  }
+  const dashboardDist = resolveDashboardDir(opts.dashboard);
+  if (dashboardDist && !existsSync2(path2.join(dashboardDist, "index.html"))) {
+    process.stderr.write(`blindseal run: dashboard directory ${dashboardDist} has no index.html
+`);
+    return 1;
+  }
+  const handle = await startMockApi({ port: opts.port, host: opts.host, fixturesDir, dashboardDist });
+  const base = handle.url.replace(/\/api$/, "");
+  process.stdout.write(
+    `blindseal (MOCK): local API on ${handle.url}
+  token: ${handle.token}
+` + (dashboardDist ? `  dashboard: ${base}/#token=${handle.token}  (served from ${dashboardDist})
+` : `  dashboard: NOT SERVED \u2014 this install has no ${path2.join(packageRoot(), "dashboard")}; pass --dashboard <dir> or set BLINDSEAL_DASHBOARD_DIST
+`) + `  sample data: ${fixturesDir}
+  WS: ${base.replace(/^http/, "ws")}/api/events?token=${handle.token}
+Ctrl-C to stop.
+`
+  );
+  return new Promise((resolve) => {
+    const shutdown = () => {
+      void handle.close().then(() => resolve(0));
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+  });
+}
+
+export {
+  parseRunArgs,
+  resolveFixturesDir,
+  resolveDashboardDir,
+  runRun
+};

package/dist/chunk-B44GZXDX.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+
+// ../chain-reads/src/index.ts
+import { createHash } from "crypto";
+var VERIFY_PROGRAM_ID = "merZNYKpKwwX4CGgzvma3jPvLfrMTkZcb1cSXUKANcb";
+var PUBLIC_MAINNET_RPC = "https://api.mainnet-beta.solana.com";
+var warned = false;
+function rpcUrl() {
+  const u = process.env.BLINDSEAL_RPC_URL;
+  if (u === "off") return null;
+  if (u) return u;
+  if (!warned) {
+    warned = true;
+    process.stderr.write("blindseal: BLINDSEAL_RPC_URL unset \u2014 using the public mainnet RPC (rate-limited; ~100 req/10s per IP). Set your own endpoint for production.\n");
+  }
+  return PUBLIC_MAINNET_RPC;
+}
+async function rpc(method, params) {
+  const url = rpcUrl();
+  if (!url) throw new Error("rpc disabled (BLINDSEAL_RPC_URL=off)");
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (res.status === 429) throw new Error("rpc rate-limited (429) \u2014 set BLINDSEAL_RPC_URL");
+  const j = await res.json();
+  if (j.error) throw new Error(`rpc ${method}: ${j.error.message}`);
+  return j.result;
+}
+var disc = (name) => createHash("sha256").update(`account:${name}`).digest().subarray(0, 8);
+var b58 = (bytes) => bs58encode(bytes);
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function bs58encode(bytes) {
+  let zeros = 0;
+  while (zeros < bytes.length && bytes[zeros] === 0) zeros++;
+  const digits = [];
+  for (const byte of bytes) {
+    let carry = byte;
+    for (let j = 0; j < digits.length; j++) {
+      carry += digits[j] << 8;
+      digits[j] = carry % 58;
+      carry = carry / 58 | 0;
+    }
+    while (carry > 0) {
+      digits.push(carry % 58);
+      carry = carry / 58 | 0;
+    }
+  }
+  return "1".repeat(zeros) + digits.reverse().map((d) => ALPHABET[d]).join("");
+}
+function bs58decode(s) {
+  const bytes = [];
+  for (const ch of s) {
+    let carry = ALPHABET.indexOf(ch);
+    if (carry < 0) throw new Error("bad base58");
+    for (let j = 0; j < bytes.length; j++) {
+      carry += bytes[j] * 58;
+      bytes[j] = carry & 255;
+      carry >>= 8;
+    }
+    while (carry > 0) {
+      bytes.push(carry & 255);
+      carry >>= 8;
+    }
+  }
+  let zeros = 0;
+  while (zeros < s.length && s[zeros] === "1") zeros++;
+  return Uint8Array.from([...new Array(zeros).fill(0), ...bytes.reverse()]);
+}
+var P = (1n << 255n) - 19n;
+var D = 37095705934669439343138083508754565189542113879843219016388785533085940283555n;
+var SQRT_M1 = 19681161376707505956807079304988542015446066515923890162744021073123829784752n;
+function modPow(b, e, m) {
+  let r = 1n;
+  b %= m;
+  while (e > 0n) {
+    if (e & 1n) r = r * b % m;
+    b = b * b % m;
+    e >>= 1n;
+  }
+  return r;
+}
+function isOnCurve(pk) {
+  if (pk.length !== 32) return false;
+  let y = 0n;
+  for (let i = 31; i >= 0; i--) y = y << 8n | BigInt(pk[i]);
+  const sign = y >> 255n & 1n;
+  y &= (1n << 255n) - 1n;
+  if (y >= P) return false;
+  const y2 = y * y % P, u = (y2 - 1n + P) % P, v = (D * y2 + 1n) % P;
+  const v3 = v * v % P * v % P, v7 = v3 * v3 % P * v % P;
+  let x = u * v3 % P * modPow(u * v7 % P, (P - 5n) / 8n, P) % P;
+  const vx2 = v * (x * x % P) % P;
+  if (vx2 === u) {
+  } else if (vx2 === (P - u) % P) x = x * SQRT_M1 % P;
+  else return false;
+  if (x === 0n && sign === 1n) return false;
+  return true;
+}
+function findProgramAddress(seeds, programId) {
+  const prog = bs58decode(programId);
+  for (let bump = 255; bump >= 0; bump--) {
+    const h = createHash("sha256");
+    for (const s of seeds) h.update(s);
+    h.update(Uint8Array.of(bump));
+    h.update(prog);
+    h.update("ProgramDerivedAddress");
+    const cand = h.digest();
+    if (!isOnCurve(cand)) return b58(cand);
+  }
+  throw new Error("no PDA bump");
+}
+async function getNullifierStatus(nullifierHex) {
+  const nf = Buffer.from(nullifierHex.replace(/^0x/, ""), "hex");
+  if (nf.length !== 32) throw new Error("nullifier must be 32 bytes");
+  const pda = findProgramAddress([Buffer.from("nullifier"), nf], VERIFY_PROGRAM_ID);
+  const r = await rpc("getAccountInfo", [pda, { encoding: "base64", commitment: "confirmed" }]);
+  const base = { nullifier: nullifierHex, consumed: false, pda, cluster: "mainnet-beta", rpc: process.env.BLINDSEAL_RPC_URL ? "configured" : "public" };
+  if (!r.value) return base;
+  const data = Buffer.from(r.value.data[0], "base64");
+  if (data.length < 81 || !data.subarray(0, 8).equals(disc("Nullifier"))) return base;
+  return {
+    ...base,
+    consumed: true,
+    consumedAtSlot: Number(data.readBigUInt64LE(8)),
+    consumerProgram: b58(data.subarray(16, 48)),
+    actionHash: "0x" + data.subarray(48, 80).toString("hex")
+  };
+}
+
+export {
+  rpcUrl,
+  getNullifierStatus
+};