@alphafox/cli 0.3.16 → 0.3.18

package/dist/catalog/allowlist.d.ts

@@ -1,7 +1,7 @@
 /**
- * Raw API allowlist from the generated Operation Registry.
- * Finite set: infra catalog paths + CLI-included operation facade paths.
- * Unknown `/api/v1/*` paths are denied — raw API cannot bypass the catalog.
+ * Finite set: infrastructure catalog paths, CLI-included operation facade paths,
+ * and explicitly documented direct admin paths.
+ * Unknown paths are denied — raw API cannot bypass the catalog or admin allowlist.
  */
 /**
  * Infra paths always allowed (exact, except `/api/v1/operations/*`).
@@ -17,9 +17,9 @@ export declare function normalizeApiPath(path: string): string;
 export declare function isInternalDisallowedPath(path: string): boolean;
 /** Match OpenAPI-style templates: /api/v1/engine-backtest/experiments/{experimentId}. */
 export declare function pathTemplateMatches(template: string, actual: string, catchAll?: boolean): boolean;
+export declare function isDirectAdminAllowlistedPath(path: string): boolean;
 /**
- * Finite allow set: infra catalog paths + generated operation facade paths.
- * Unknown `/api/v1/*` paths are denied.
- * Matching always uses the segment-resolved path (no `..` prefix smuggling).
+ * Finite allow set: infrastructure paths, generated facade paths, and exact
+ * direct admin paths. Matching always uses the segment-resolved path.
  */
 export declare function isFacadeAllowlistedPath(path: string, extraAllow?: readonly string[]): boolean;

package/dist/catalog/allowlist.js

@@ -1,14 +1,15 @@
 "use strict";
 /**
- * Raw API allowlist from the generated Operation Registry.
- * Finite set: infra catalog paths + CLI-included operation facade paths.
- * Unknown `/api/v1/*` paths are denied — raw API cannot bypass the catalog.
+ * Finite set: infrastructure catalog paths, CLI-included operation facade paths,
+ * and explicitly documented direct admin paths.
+ * Unknown paths are denied — raw API cannot bypass the catalog or admin allowlist.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FACILITY_ALWAYS_ALLOW = void 0;
 exports.normalizeApiPath = normalizeApiPath;
 exports.isInternalDisallowedPath = isInternalDisallowedPath;
 exports.pathTemplateMatches = pathTemplateMatches;
+exports.isDirectAdminAllowlistedPath = isDirectAdminAllowlistedPath;
 exports.isFacadeAllowlistedPath = isFacadeAllowlistedPath;
 const operations_1 = require("./operations");
 const INTERNAL_PREFIXES = [
@@ -29,6 +30,9 @@ exports.FACILITY_ALWAYS_ALLOW = [
     "/api/v1/openapi",
     "/api/v1/operations",
 ];
+const DIRECT_ADMIN_ALLOW = {
+    "/api/admin/passivbot-paper-acceptance-traders": true,
+};
 /**
  * Decode percent-encoded path segments (up to twice for double-encoding)
  * without turning encoded slashes into separators mid-segment incorrectly:
@@ -128,6 +132,9 @@ function isInfraAllowlisted(n) {
     }
     return false;
 }
+function isDirectAdminAllowlistedPath(path) {
+    return DIRECT_ADMIN_ALLOW[normalizeApiPath(path)] === true;
+}
 function isCatalogPathMatch(n) {
     for (const op of operations_1.CATALOG_OPERATIONS) {
         if (pathTemplateMatches(op.path, n, Boolean(op.catchAll))) {
@@ -145,15 +152,17 @@ function isExtraAllowMatch(n, extraAllow) {
     return false;
 }
 /**
- * Finite allow set: infra catalog paths + generated operation facade paths.
- * Unknown `/api/v1/*` paths are denied.
- * Matching always uses the segment-resolved path (no `..` prefix smuggling).
+ * Finite allow set: infrastructure paths, generated facade paths, and exact
+ * direct admin paths. Matching always uses the segment-resolved path.
  */
 function isFacadeAllowlistedPath(path, extraAllow = []) {
     const n = normalizeApiPath(path);
     if (isInternalDisallowedPath(n)) {
         return false;
     }
+    if (isDirectAdminAllowlistedPath(n)) {
+        return true;
+    }
     if (n !== "/api/v1" && !n.startsWith("/api/v1/")) {
         return false;
     }

package/dist/catalog/generated/registry.json

@@ -2,16 +2,16 @@
     "source": {
         "package": "@alphafoxai/contracts",
         "export": "public-api",
-        "contractsSha": "3833cb49c0406ee7c9ee59caa2f266b2f6cd99f2",
-        "registryVersion": "2.0.1",
-        "contractVersion": "2026-08-29",
-        "scannedAt": "2026-08-29",
-        "totalOperations": 276,
-        "cliOperations": 257
+        "contractsSha": "c2b17780baea3236ab1b7c0ec982f3f93f1ae08d",
+        "registryVersion": "3.0.0",
+        "contractVersion": "2026-08-31",
+        "scannedAt": "2026-08-31",
+        "totalOperations": 277,
+        "cliOperations": 258
     },
     "compatibility": {
-        "contractVersion": "2026-08-29",
-        "registryVersion": "2.0.1",
+        "contractVersion": "2026-08-31",
+        "registryVersion": "3.0.0",
         "minCliVersion": "0.0.0",
         "maxCliVersion": "0.99.99",
         "openapi": "3.1.0"
@@ -4469,6 +4469,30 @@
             "responseSchema": "JsonValue",
             "errorSchema": "ProblemDetails"
         },
+        {
+            "operationId": "signal_sources.byId.trade_events.list",
+            "method": "GET",
+            "path": "/api/v1/signal-sources/{id}/trade-events",
+            "role": "user",
+            "risk": "read",
+            "auth": "bearer",
+            "scopes": [
+                "openid",
+                "profile",
+                "signal-sources:read"
+            ],
+            "stream": false,
+            "file": false,
+            "pagination": true,
+            "idempotent": true,
+            "mvp": false,
+            "catchAll": false,
+            "contractStatus": "envelope",
+            "requestBodySchema": null,
+            "querySchema": "JsonObject",
+            "responseSchema": "JsonValue",
+            "errorSchema": "ProblemDetails"
+        },
         {
             "operationId": "spread_radar.episodes.list",
             "method": "GET",