@alphafox/cli 0.3.17 → 0.3.19

package/dist/catalog/allowlist.d.ts

@@ -1,7 +1,7 @@
 /**
- * Raw API allowlist from the generated Operation Registry.
- * Finite set: infra catalog paths + CLI-included operation facade paths.
- * Unknown `/api/v1/*` paths are denied — raw API cannot bypass the catalog.
+ * Finite set: infrastructure catalog paths, CLI-included operation facade paths,
+ * and explicitly documented direct admin paths.
+ * Unknown paths are denied — raw API cannot bypass the catalog or admin allowlist.
  */
 /**
  * Infra paths always allowed (exact, except `/api/v1/operations/*`).
@@ -17,9 +17,9 @@ export declare function normalizeApiPath(path: string): string;
 export declare function isInternalDisallowedPath(path: string): boolean;
 /** Match OpenAPI-style templates: /api/v1/engine-backtest/experiments/{experimentId}. */
 export declare function pathTemplateMatches(template: string, actual: string, catchAll?: boolean): boolean;
+export declare function isDirectAdminAllowlistedPath(path: string): boolean;
 /**
- * Finite allow set: infra catalog paths + generated operation facade paths.
- * Unknown `/api/v1/*` paths are denied.
- * Matching always uses the segment-resolved path (no `..` prefix smuggling).
+ * Finite allow set: infrastructure paths, generated facade paths, and exact
+ * direct admin paths. Matching always uses the segment-resolved path.
  */
 export declare function isFacadeAllowlistedPath(path: string, extraAllow?: readonly string[]): boolean;

package/dist/catalog/allowlist.js

@@ -1,14 +1,15 @@
 "use strict";
 /**
- * Raw API allowlist from the generated Operation Registry.
- * Finite set: infra catalog paths + CLI-included operation facade paths.
- * Unknown `/api/v1/*` paths are denied — raw API cannot bypass the catalog.
+ * Finite set: infrastructure catalog paths, CLI-included operation facade paths,
+ * and explicitly documented direct admin paths.
+ * Unknown paths are denied — raw API cannot bypass the catalog or admin allowlist.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FACILITY_ALWAYS_ALLOW = void 0;
 exports.normalizeApiPath = normalizeApiPath;
 exports.isInternalDisallowedPath = isInternalDisallowedPath;
 exports.pathTemplateMatches = pathTemplateMatches;
+exports.isDirectAdminAllowlistedPath = isDirectAdminAllowlistedPath;
 exports.isFacadeAllowlistedPath = isFacadeAllowlistedPath;
 const operations_1 = require("./operations");
 const INTERNAL_PREFIXES = [
@@ -29,6 +30,9 @@ exports.FACILITY_ALWAYS_ALLOW = [
     "/api/v1/openapi",
     "/api/v1/operations",
 ];
+const DIRECT_ADMIN_ALLOW = {
+    "/api/admin/passivbot-paper-acceptance-traders": true,
+};
 /**
  * Decode percent-encoded path segments (up to twice for double-encoding)
  * without turning encoded slashes into separators mid-segment incorrectly:
@@ -128,6 +132,9 @@ function isInfraAllowlisted(n) {
     }
     return false;
 }
+function isDirectAdminAllowlistedPath(path) {
+    return DIRECT_ADMIN_ALLOW[normalizeApiPath(path)] === true;
+}
 function isCatalogPathMatch(n) {
     for (const op of operations_1.CATALOG_OPERATIONS) {
         if (pathTemplateMatches(op.path, n, Boolean(op.catchAll))) {
@@ -145,15 +152,17 @@ function isExtraAllowMatch(n, extraAllow) {
     return false;
 }
 /**
- * Finite allow set: infra catalog paths + generated operation facade paths.
- * Unknown `/api/v1/*` paths are denied.
- * Matching always uses the segment-resolved path (no `..` prefix smuggling).
+ * Finite allow set: infrastructure paths, generated facade paths, and exact
+ * direct admin paths. Matching always uses the segment-resolved path.
  */
 function isFacadeAllowlistedPath(path, extraAllow = []) {
     const n = normalizeApiPath(path);
     if (isInternalDisallowedPath(n)) {
         return false;
     }
+    if (isDirectAdminAllowlistedPath(n)) {
+        return true;
+    }
     if (n !== "/api/v1" && !n.startsWith("/api/v1/")) {
         return false;
     }

package/dist/catalog/generated/registry.json

@@ -2,16 +2,16 @@
     "source": {
         "package": "@alphafoxai/contracts",
         "export": "public-api",
-        "contractsSha": "3325449547f129a185a854ee6b81ba3efb447e5e",
-        "registryVersion": "2.1.0",
-        "contractVersion": "2026-08-30",
-        "scannedAt": "2026-08-30",
-        "totalOperations": 278,
-        "cliOperations": 259
+        "contractsSha": "c2b17780baea3236ab1b7c0ec982f3f93f1ae08d",
+        "registryVersion": "3.0.0",
+        "contractVersion": "2026-08-31",
+        "scannedAt": "2026-08-31",
+        "totalOperations": 277,
+        "cliOperations": 258
     },
     "compatibility": {
-        "contractVersion": "2026-08-30",
-        "registryVersion": "2.1.0",
+        "contractVersion": "2026-08-31",
+        "registryVersion": "3.0.0",
         "minCliVersion": "0.0.0",
         "maxCliVersion": "0.99.99",
         "openapi": "3.1.0"
@@ -5262,30 +5262,6 @@
             "responseSchema": "JsonValue",
             "errorSchema": "ProblemDetails"
         },
-        {
-            "operationId": "trading.passivbot_paper_acceptance_traders.create",
-            "method": "POST",
-            "path": "/api/v1/trading/passivbot-paper-acceptance-traders",
-            "role": "user",
-            "risk": "write",
-            "auth": "bearer",
-            "scopes": [
-                "openid",
-                "profile",
-                "trading:write"
-            ],
-            "stream": false,
-            "file": false,
-            "pagination": false,
-            "idempotent": false,
-            "mvp": false,
-            "catchAll": false,
-            "contractStatus": "shared",
-            "requestBodySchema": "createPassivbotPaperAcceptanceTraderRequestSchema",
-            "querySchema": null,
-            "responseSchema": "createTraderResponseSchema",
-            "errorSchema": "ProblemDetails"
-        },
         {
             "operationId": "trading.rebate_copy_traders.create",
             "method": "POST",