blindseal 0.5.0 → 0.5.1

package/dist/chunk-CIUQ6WHJ.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+
+// src/paths.ts
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import os from "os";
+import path from "path";
+import { fileURLToPath } from "url";
+var cachedRoot;
+function packageRoot() {
+  if (cachedRoot) return cachedRoot;
+  let dir = path.dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 6; i++) {
+    const pkg = path.join(dir, "package.json");
+    if (existsSync(pkg)) {
+      try {
+        const name = JSON.parse(readFileSync(pkg, "utf8")).name;
+        if (name === "blindseal") {
+          cachedRoot = dir;
+          return dir;
+        }
+      } catch {
+      }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  cachedRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+  return cachedRoot;
+}
+function packageVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(path.join(packageRoot(), "package.json"), "utf8"));
+    return pkg.version ? String(pkg.version) : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function blindsealHome() {
+  return path.join(os.homedir(), ".blindseal");
+}
+function shippedDashboardDir() {
+  const dir = path.join(packageRoot(), "dashboard");
+  return existsSync(path.join(dir, "index.html")) ? dir : void 0;
+}
+function shippedFixturesDir() {
+  const dir = path.join(packageRoot(), "fixtures");
+  return existsSync(path.join(dir, "decisions.json")) ? dir : void 0;
+}
+function nearestFixturesDir(from = process.cwd()) {
+  let dir = from;
+  for (let i = 0; i < 7; i++) {
+    const candidate = path.join(dir, "fixtures");
+    if (existsSync(path.join(candidate, "decisions.json"))) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return void 0;
+}
+function dashboardTokenPath() {
+  return path.join(blindsealHome(), "dashboard.token");
+}
+function resolveDashboardToken(explicit) {
+  if (explicit) return explicit;
+  const file = dashboardTokenPath();
+  try {
+    if (existsSync(file)) return readFileSync(file, "utf8").trim();
+    mkdirSync(path.dirname(file), { recursive: true, mode: 448 });
+    const tok = randomBytes(24).toString("base64url");
+    writeFileSync(file, tok + "\n", { mode: 384 });
+    return tok;
+  } catch {
+    return randomBytes(24).toString("base64url");
+  }
+}
+
+export {
+  packageRoot,
+  packageVersion,
+  blindsealHome,
+  shippedDashboardDir,
+  shippedFixturesDir,
+  nearestFixturesDir,
+  dashboardTokenPath,
+  resolveDashboardToken
+};

package/dist/{chunk-BTIXDNTV.js → chunk-DJL2E6RF.js}

@@ -36,9 +36,28 @@ var u64le = (n) => {
   b.writeBigUInt64LE(n);
   return b;
 };
+var PUBLIC_INPUTS_LEN = 168;
 function decodePublicInputs(blob) {
-  if (blob.length !== 168)
-    throw new Error(`publicInputs must be 168 bytes, got ${blob.length}`);
+  if (typeof blob === "string") {
+    const h = blob.trim().replace(/^0x/i, "").toLowerCase();
+    if (!/^[0-9a-f]*$/.test(h) || h.length % 2 !== 0)
+      throw new Error("publicInputs is not a hex string");
+    const b = decodeBytes(Buffer.from(h, "hex"));
+    const hx = (x) => "0x" + x.toString("hex");
+    return {
+      payloadHash: hx(b.payloadHash),
+      policyRoot: hx(b.policyRoot),
+      detectorVersion: hx(b.detectorVersion),
+      actionHash: hx(b.actionHash),
+      nullifier: hx(b.nullifier),
+      expirySlot: b.expirySlot.toString()
+    };
+  }
+  return decodeBytes(blob);
+}
+function decodeBytes(blob) {
+  if (blob.length !== PUBLIC_INPUTS_LEN)
+    throw new Error(`publicInputs must be ${PUBLIC_INPUTS_LEN} bytes, got ${blob.length}`);
   const b = Buffer.from(blob);
   return {
     payloadHash: b.subarray(0, 32),
@@ -122,17 +141,61 @@ async function isConsumed(att, conn, programId = PROGRAM_ID) {
   const info = await conn.getAccountInfo(nullifierPda(nullifier, programId), "confirmed");
   return info !== null;
 }
-async function verifyOffchain(att) {
+var LABELED_FIELDS = ["payloadHash", "policyRoot", "detectorVersion", "actionHash", "nullifier", "expirySlot"];
+var normHex = (v) => "0x" + String(v ?? "").trim().replace(/^0x/i, "").toLowerCase();
+var normSlot = (v) => {
+  if (typeof v === "bigint")
+    return v.toString();
+  if (typeof v === "number")
+    return Number.isInteger(v) && v >= 0 ? String(v) : null;
+  if (typeof v === "string" && /^\d+$/.test(v.trim()))
+    return BigInt(v.trim()).toString();
+  return null;
+};
+function labelMismatches(att, decoded) {
+  const out = [];
+  for (const k of LABELED_FIELDS) {
+    const same = k === "expirySlot" ? normSlot(att.expirySlot) === decoded.expirySlot : normHex(att[k]) === decoded[k];
+    if (!same)
+      out.push(k);
+  }
+  return out;
+}
+var wasmReady = null;
+var loadWasm = () => wasmReady ??= (async () => {
   const wasm = await import("blindseal-verifier-wasm");
   const { readFileSync } = await import("fs");
   const req = createRequire(import.meta.url);
-  const bytes = readFileSync(req.resolve("blindseal-verifier-wasm/bg.wasm"));
-  wasm.initSync({ module: bytes });
-  return JSON.parse(wasm.verify_attestation_json(JSON.stringify(att)));
+  wasm.initSync({ module: readFileSync(req.resolve("blindseal-verifier-wasm/bg.wasm")) });
+  return wasm;
+})().catch((e) => {
+  wasmReady = null;
+  throw e;
+});
+async function verifyOffchain(att) {
+  const wasm = await loadWasm();
+  let decoded;
+  let decodeError;
+  try {
+    decoded = decodePublicInputs(String(att.publicInputs?.[0] ?? ""));
+  } catch (e) {
+    decodeError = e instanceof Error ? e.message : String(e);
+  }
+  const forWasm = decoded ? { ...att, detectorVersion: decoded.detectorVersion } : att;
+  const proof = JSON.parse(wasm.verify_attestation_json(JSON.stringify(forWasm)));
+  const mismatches = decoded ? labelMismatches(att, decoded) : [];
+  if (!proof.ok)
+    return { ok: false, reason: proof.reason ?? "proof did not verify", decoded, mismatches };
+  if (!decoded)
+    return { ok: false, reason: decodeError ?? "publicInputs did not decode", mismatches };
+  if (mismatches.length)
+    return { ok: false, reason: `label mismatch: ${mismatches.join(", ")}`, decoded, mismatches };
+  return { ok: true, decoded, mismatches };
 }
 
 export {
   DEFAULT_RPC_URL,
+  decodePublicInputs,
   WrongClusterError,
   submit,
   isConsumed,

package/dist/{chunk-PQ457W6T.js → chunk-VSOUJM6X.js}

@@ -255,6 +255,7 @@ function openAudit(baseDir = path4.join(os.homedir(), ".blindseal")) {
 
 export {
   hashEntry,
+  loadIdentity,
   discloseBundle,
   verifyDisclosure,
   isCleanWindow,

package/dist/{chunk-JJY62YXJ.js → chunk-ZZTWGFH2.js}

@@ -275,7 +275,6 @@ function loadConfig() {
     capability: loadCapabilityConfig(),
     tradePolicy: loadTradePolicyConfig(),
     manifest: loadManifestConfig(),
-    telemetry: loadTelemetryConfig(),
     audit: loadAuditConfig(),
     persistence: loadScanStoreConfig()
   };
@@ -284,25 +283,6 @@ function loadAuditConfig() {
   const filepath = process.env.BLINDSEAL_AUDIT_LOG;
   return { enabled: !!filepath, filepath };
 }
-function loadTelemetryConfig() {
-  const flag = process.env.BLINDSEAL_TELEMETRY?.toLowerCase();
-  const explicitlyOff = flag === "0" || flag === "false" || flag === "off" || flag === "no";
-  const explicitlyOn = flag === "1" || flag === "true" || flag === "on";
-  const url = process.env.BLINDSEAL_TELEMETRY_URL;
-  const enabled = !explicitlyOff && !!url;
-  const secret = process.env.BLINDSEAL_TELEMETRY_SECRET;
-  const batchSize = positiveInt(process.env.BLINDSEAL_TELEMETRY_BATCH, 100);
-  const flushIntervalMs = positiveInt(process.env.BLINDSEAL_TELEMETRY_FLUSH_MS, 5e3);
-  return {
-    enabled,
-    url,
-    secret,
-    batchSize,
-    flushIntervalMs,
-    bannerOnStart: enabled && !explicitlyOn
-    // implicit-on path
-  };
-}
 function loadManifestConfig() {
   const raw = process.env.BLINDSEAL_MANIFEST_CHECK?.toLowerCase();
   let mode;

package/dist/dashboard-J6BA7OBL.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import {
+  runRun
+} from "./chunk-6EU4GH4P.js";
+import "./chunk-B44GZXDX.js";
+import "./chunk-VSOUJM6X.js";
+import {
+  dashboardTokenPath,
+  resolveDashboardToken
+} from "./chunk-CIUQ6WHJ.js";
+import "./chunk-PDX44BCA.js";
+
+// src/cli/dashboard.ts
+import { spawn } from "child_process";
+var HELP = `blindseal dashboard \u2014 open the local dashboard in your browser
+
+Usage:
+  blindseal dashboard [flags]
+
+Flags
+  --port <n>          local API port (default 7777)
+  --host <addr>       local API host (default 127.0.0.1)
+  --no-open           print the URL only, do not launch a browser
+  --help, -h          this help
+
+If nothing is listening, \`blindseal run --mock\` is started for you (Ctrl-C to stop it).
+The URL carries the token from ${"~/.blindseal/dashboard.token"} in its fragment; it never leaves this machine.
+`;
+function parseDashboardArgs(argv) {
+  const out = { port: 7777, host: "127.0.0.1", open: true };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--help" || a === "-h") out.help = true;
+    else if (a === "--port") out.port = Number.parseInt(argv[++i] ?? "", 10);
+    else if (a === "--host") out.host = argv[++i] ?? out.host;
+    else if (a === "--no-open") out.open = false;
+    else if (a && a.startsWith("--")) throw new Error(`unknown flag: ${a}`);
+  }
+  if (!Number.isFinite(out.port) || out.port <= 0) throw new Error("--port must be a positive integer");
+  return out;
+}
+function dashboardUrl(host, port, token) {
+  return `http://${host}:${port}/#token=${token}`;
+}
+async function isListening(host, port, timeoutMs = 1500) {
+  try {
+    await fetch(`http://${host}:${port}/api/status`, { signal: AbortSignal.timeout(timeoutMs) });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function openBrowser(url) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function runDashboardCli(argv) {
+  let o;
+  try {
+    o = parseDashboardArgs(argv);
+  } catch (e) {
+    process.stderr.write(`blindseal dashboard: ${e.message}
+${HELP}`);
+    return 2;
+  }
+  if (o.help) {
+    process.stdout.write(HELP);
+    return 0;
+  }
+  const token = resolveDashboardToken();
+  const url = dashboardUrl(o.host, o.port, token);
+  if (await isListening(o.host, o.port)) {
+    process.stdout.write(`blindseal dashboard: ${url}
+  (token from ${dashboardTokenPath()})
+`);
+    if (o.open) openBrowser(url);
+    return 0;
+  }
+  process.stdout.write(`blindseal dashboard: nothing listening on ${o.host}:${o.port} \u2014 starting \`blindseal run --mock\`
+`);
+  const running = runRun(["--mock", "--port", String(o.port), "--host", o.host]);
+  for (let i = 0; i < 20; i++) {
+    if (await isListening(o.host, o.port, 500)) {
+      process.stdout.write(`blindseal dashboard: ${url}
+`);
+      if (o.open) openBrowser(url);
+      break;
+    }
+    await new Promise((r) => setTimeout(r, 250));
+  }
+  return running;
+}
+export {
+  dashboardUrl,
+  isListening,
+  openBrowser,
+  parseDashboardArgs,
+  runDashboardCli
+};

package/dist/decide.js

@@ -6,7 +6,7 @@ import {
   decideTradePolicy,
   loadConfig,
   mergeDecisions
-} from "./chunk-JJY62YXJ.js";
+} from "./chunk-ZZTWGFH2.js";
 import "./chunk-PDX44BCA.js";
 
 // src/cli/decide.ts