@pome-sh/checks 0.1.0

package/dist/chunk-IVENH4KX.js

@@ -0,0 +1,814 @@
+import { oneOf, statePath, defineCheck, VACUITY_SENTINEL_NUMBER, VACUITY_SENTINEL, childStatePath } from './chunk-4WXX5VPA.js';
+import { z } from 'zod';
+
+// ../twin-stripe/dist/src/check-params.js
+var chargeId = {
+  name: "charge",
+  pattern: "[A-Za-z0-9_-]+",
+  example: "ch_test_200",
+  render: (value) => value,
+  parse: (raw) => raw
+};
+var minorUnitAmount = {
+  name: "amount",
+  pattern: "\\d+",
+  example: "10000",
+  render: (value) => value,
+  parse: (raw) => raw
+};
+var rowCount = {
+  name: "count",
+  pattern: "\\d+",
+  example: "1",
+  render: (value) => value,
+  parse: (raw) => raw
+};
+var PAYMENT_INTENT_STATUSES = [
+  "requires_payment_method",
+  "requires_confirmation",
+  "requires_action",
+  "processing",
+  "requires_capture",
+  "canceled",
+  "succeeded"
+];
+var paymentIntentStatus = oneOf("status", PAYMENT_INTENT_STATUSES, "succeeded");
+var CHARGE_STATUSES = [
+  "pending",
+  "succeeded",
+  "failed"
+];
+var chargeStatus = oneOf("status", CHARGE_STATUSES, "succeeded");
+var EVENT_TYPES = [
+  "payment_intent.created",
+  "payment_intent.requires_action",
+  "payment_intent.processing",
+  "payment_intent.succeeded",
+  "payment_intent.payment_failed",
+  "payment_intent.canceled",
+  "charge.succeeded",
+  "charge.failed",
+  "charge.refunded",
+  "refund.created",
+  "customer.created",
+  "customer.updated",
+  "customer.deleted",
+  "payment_method.attached",
+  "payment_method.detached"
+];
+var stripeEventType = oneOf("event_type", EVENT_TYPES, "payment_intent.succeeded");
+var ERROR_TYPES = [
+  "invalid_request_error",
+  "api_error",
+  "card_error",
+  "idempotency_error",
+  "rate_limit_error"
+];
+var stripeErrorType = oneOf("error_type", ERROR_TYPES, "invalid_request_error");
+
+// ../twin-stripe/dist/src/check-state.js
+var PAYMENT_INTENTS_PATH = statePath("payment_intents");
+var CHARGES_PATH = statePath("charges");
+var EVENTS_PATH = statePath("events");
+var REFUNDS_PATH = statePath("refunds");
+function missSkip(miss) {
+  const outcome = { passed: false, status: "skipped", reason: miss.missing };
+  if (miss.searched === void 0)
+    return outcome;
+  return { ...outcome, evidenceStatePaths: [miss.searched] };
+}
+function resolveCharge(state, chargeId2) {
+  if (state.charges == null)
+    return { missing: "state_incomplete" };
+  const index = state.charges.findIndex((charge2) => charge2.id === chargeId2);
+  if (index < 0)
+    return { missing: `charge_not_found ("${chargeId2}")`, searched: CHARGES_PATH };
+  return { found: state.charges[index], path: childStatePath(CHARGES_PATH, index) };
+}
+function refundsOnCharge(state, chargeId2) {
+  const charge2 = resolveCharge(state, chargeId2);
+  if ("missing" in charge2)
+    return charge2;
+  if (state.refunds == null)
+    return { missing: "state_incomplete" };
+  return {
+    found: state.refunds.filter((refund2) => refund2.charge === chargeId2),
+    path: REFUNDS_PATH
+  };
+}
+
+// ../twin-stripe/dist/src/check-worlds.js
+function stripeState(overrides = {}) {
+  return {
+    payment_intents: [],
+    charges: [],
+    balance_transactions: [],
+    events: [],
+    refunds: [],
+    ...overrides
+  };
+}
+function finalWorld(final) {
+  return { seed: null, final, tape: null };
+}
+function tapeWorld(tape) {
+  return { seed: null, final: stripeState(), tape };
+}
+function paymentIntent(overrides = {}) {
+  return {
+    id: "pi_test_200",
+    amount: 2e4,
+    currency: "usd",
+    status: "succeeded",
+    latest_charge: "ch_test_200",
+    ...overrides
+  };
+}
+function charge(overrides = {}) {
+  return {
+    id: "ch_test_200",
+    amount: 2e4,
+    amount_refunded: 0,
+    currency: "usd",
+    status: "succeeded",
+    refunded: false,
+    paid: true,
+    payment_intent: "pi_test_200",
+    balance_transaction: "txn_test_200",
+    ...overrides
+  };
+}
+function event(type, overrides = {}) {
+  return { id: `evt_${type.replace(/\W/g, "_")}`, type, data: { object: null }, created: 17e8, ...overrides };
+}
+function refund(overrides = {}) {
+  return {
+    id: "re_test_200",
+    amount: 7500,
+    currency: "usd",
+    status: "succeeded",
+    charge: "ch_test_200",
+    payment_intent: "pi_test_200",
+    ...overrides
+  };
+}
+function call(overrides = {}) {
+  return {
+    twin: "stripe",
+    method: "GET",
+    path: "/s/test-session/v1/refunds",
+    status: 200,
+    request_body: null,
+    tool: null,
+    event_id: "evt_call",
+    ...overrides
+  };
+}
+function x402Leg(overrides = {}) {
+  return {
+    twin: "stripe",
+    method: "GET",
+    path: "/s/test-session/x402/protected-resource",
+    status: 402,
+    request_body: null,
+    request_headers: { accept: "application/json" },
+    tool: null,
+    event_id: "evt_x402",
+    ...overrides
+  };
+}
+
+// ../twin-stripe/dist/src/check-payments.js
+var STATE_INCOMPLETE = { passed: false, status: "skipped", reason: "state_incomplete" };
+function requireList(list) {
+  return list == null ? null : list;
+}
+var paymentIntentAmount = defineCheck({
+  id: "stripe.payment-intent-amount",
+  description: "Asserts SOME PaymentIntent in the account carries this exact amount, in the currency's minor unit (cents for USD) \u2014 the integer the `amount` field holds, never a formatted figure. It asserts nothing about that intent's status, its currency, or how many others exist. An absent `payment_intents` key is a SKIP: a positive criterion must not fail a correct agent over state nobody uploaded.",
+  template: "A PaymentIntent exists with amount {amount}",
+  params: { amount: minorUnitAmount },
+  substrate: "final",
+  polarity: () => "positive",
+  // The amount is COMPARED to a numeric field, not hunted for inside prose, so
+  // no redactor can silently delete it. `subject` is omitted rather than
+  // returning null for the same reason twin-github omits it on structural
+  // checks: absent means "nothing a redactor could reach", which is the truth.
+  vacuityMutant: (args) => ({ ...args, amount: String(VACUITY_SENTINEL_NUMBER) }),
+  discriminatingWorlds: ({ amount }) => ({
+    passing: finalWorld(stripeState({ payment_intents: [paymentIntent({ amount: Number(amount) })] })),
+    // A PaymentIntent that EXISTS and holds a different amount, not an empty
+    // list: the reason then names the amounts it scanned and cannot be confused
+    // with the one an absent collection produces.
+    failing: finalWorld(stripeState({ payment_intents: [paymentIntent({ amount: Number(amount) + 1 })] }))
+  }),
+  evaluate({ amount }, { final }) {
+    const pis = requireList(final.payment_intents);
+    if (pis === null)
+      return STATE_INCOMPLETE;
+    const wanted = Number(amount);
+    const found = pis.some((pi) => pi.amount === wanted);
+    return {
+      passed: found,
+      reason: found ? `a PaymentIntent exists with amount ${wanted}` : `no PaymentIntent has amount ${wanted} (amounts: [${pis.map((pi) => pi.amount ?? "?").join(", ")}])`,
+      // The COLLECTION, not the matching row. Every check in this file
+      // scans a whole collection and answers a question about the set — "does
+      // one exist with…" — so the set is what was read. Citing the hit on a pass
+      // and the collection on a fail would make the pointer's shape track the
+      // verdict, and a reader would learn to read it as one.
+      evidenceStatePaths: [PAYMENT_INTENTS_PATH]
+    };
+  }
+});
+var paymentIntentStatusIs = defineCheck({
+  id: "stripe.payment-intent-status",
+  description: "Asserts THE PaymentIntent \u2014 singular \u2014 is in this status. When the account holds more than one it returns `unmatched` rather than a verdict, because scanning all of them would let a wrong agent pass on an unrelated intent the seed left in the wanted state. Use `A PaymentIntent exists with status \u2026` when several are expected. An absent `payment_intents` key is a SKIP.",
+  template: "The PaymentIntent status is {status}",
+  params: { status: paymentIntentStatus },
+  substrate: "final",
+  polarity: () => "positive",
+  // Null, and admitted in `HONEST_NULL_MUTANTS`. The only slot is a closed set,
+  // so no member is guaranteed false — a mutant naming a different status
+  // asserts something that may also be true — and a value outside the set does
+  // not re-bind at all, which reads as "the verdict moved" and blesses the very
+  // criterion the probe exists to catch. Task 10 carries this criterion AND
+  // `payment-intent-amount`, whose numeric slot keeps a real mutant, so the twin
+  // does not go dark in the probe.
+  vacuityMutant: () => null,
+  discriminatingWorlds: ({ status }) => ({
+    // Exactly ONE intent in both worlds. Two would return `unmatched`, which is
+    // neither a real pass nor a real fail, and would break arms 1 and 2.
+    passing: finalWorld(stripeState({ payment_intents: [paymentIntent({ status })] })),
+    failing: finalWorld(stripeState({
+      payment_intents: [paymentIntent({ status: status === "canceled" ? "processing" : "canceled" })]
+    }))
+  }),
+  evaluate({ status }, { final }) {
+    const pis = requireList(final.payment_intents);
+    if (pis === null)
+      return STATE_INCOMPLETE;
+    if (pis.length > 1) {
+      return {
+        passed: false,
+        status: "unmatched",
+        reason: `ambiguous: ${pis.length} payment_intents and this sentence names one`,
+        // The ambiguity IS the finding, and the collection is where a reader
+        // sees it: several intents where the sentence says "the".
+        evidenceStatePaths: [PAYMENT_INTENTS_PATH]
+      };
+    }
+    const found = pis.some((pi) => pi.status === status);
+    return {
+      passed: found,
+      reason: found ? `the PaymentIntent has status "${status}"` : `the PaymentIntent does not have status "${status}" (statuses: [${pis.map((pi) => pi.status ?? "?").join(", ")}])`,
+      evidenceStatePaths: [PAYMENT_INTENTS_PATH]
+    };
+  }
+});
+var paymentIntentWithStatusExists = defineCheck({
+  id: "stripe.payment-intent-with-status-exists",
+  description: "Asserts AT LEAST ONE PaymentIntent in the account reached this status, whichever one and however many others exist. This is the check for a flow that mints intents the author cannot name in advance \u2014 x402 creates a fresh one per challenge leg \u2014 where naming `the` PaymentIntent would be ambiguous by construction. An absent `payment_intents` key is a SKIP.",
+  template: 'A PaymentIntent exists with status "{status}"',
+  params: { status: paymentIntentStatus },
+  substrate: "final",
+  polarity: () => "positive",
+  // Closed set — see `stripe.payment-intent-status` above, same argument.
+  vacuityMutant: () => null,
+  discriminatingWorlds: ({ status }) => {
+    const other = status === "canceled" ? "processing" : "canceled";
+    return {
+      // Two intents in each world, because that plurality is the whole reason
+      // this check exists beside the definite one: a fixture with a single
+      // intent would pass identically under both and prove nothing about the
+      // difference.
+      passing: finalWorld(stripeState({
+        payment_intents: [
+          paymentIntent({ id: "pi_a", status: other }),
+          paymentIntent({ id: "pi_b", status })
+        ]
+      })),
+      failing: finalWorld(stripeState({
+        payment_intents: [
+          paymentIntent({ id: "pi_a", status: other }),
+          paymentIntent({ id: "pi_b", status: other })
+        ]
+      }))
+    };
+  },
+  evaluate({ status }, { final }) {
+    const pis = requireList(final.payment_intents);
+    if (pis === null)
+      return STATE_INCOMPLETE;
+    const hits = pis.filter((pi) => pi.status === status);
+    return {
+      passed: hits.length > 0,
+      reason: hits.length > 0 ? `${hits.length} of ${pis.length} PaymentIntent(s) have status "${status}"` : `no PaymentIntent has status "${status}" (statuses: [${pis.map((pi) => pi.status ?? "?").join(", ")}])`,
+      evidenceStatePaths: [PAYMENT_INTENTS_PATH]
+    };
+  }
+});
+var chargeWithStatusExists = defineCheck({
+  id: "stripe.charge-exists-with-status",
+  description: "Asserts AT LEAST ONE charge in the account is in this status. A charge is created already settled or already declined, so `succeeded` here means money moved \u2014 the twin writes the charge and its balance transaction inside one SQLite transaction, on both the card and the x402 crypto rails, so a charge in this state always has its ledger entry and asserting the balance transaction separately would assert a twin invariant rather than anything an examinee did. An absent `charges` key is a SKIP.",
+  template: 'A charge exists with status "{status}"',
+  params: { status: chargeStatus },
+  substrate: "final",
+  polarity: () => "positive",
+  // Closed set of three — same argument as the PaymentIntent status slots.
+  vacuityMutant: () => null,
+  discriminatingWorlds: ({ status }) => {
+    const other = status === "failed" ? "succeeded" : "failed";
+    return {
+      passing: finalWorld(stripeState({ charges: [charge({ status })] })),
+      failing: finalWorld(stripeState({ charges: [charge({ status: other })] }))
+    };
+  },
+  evaluate({ status }, { final }) {
+    const charges = requireList(final.charges);
+    if (charges === null)
+      return STATE_INCOMPLETE;
+    const hits = charges.filter((row) => row.status === status);
+    return {
+      passed: hits.length > 0,
+      reason: hits.length > 0 ? `${hits.length} of ${charges.length} charge(s) have status "${status}"` : `no charge has status "${status}" (statuses: [${charges.map((row) => row.status ?? "?").join(", ")}])`,
+      evidenceStatePaths: [CHARGES_PATH]
+    };
+  }
+});
+var eventEmitted = defineCheck({
+  id: "stripe.event-emitted",
+  description: "Asserts the account's event log contains at least one event of this type. The twin delivers no webhooks in v1 \u2014 an examinee observes events by polling `GET /v1/events` \u2014 so this reads the log the twin appended, not anything the examinee received. It asserts nothing about WHICH resource the event names: `payment_intent.succeeded` is emitted by both the card confirm path and the x402 crypto-deposit settlement, and this check deliberately does not distinguish them, because the criterion asking for it is about the outcome rather than the rail. An absent `events` key is a SKIP.",
+  // No quotes, and that is load-bearing: the corpus already says
+  // `payment_intent.succeeded is emitted`, so this template re-renders that task's
+  // existing criterion byte-identically and the migration rewrites it not at
+  // all. The dot lives inside the closed set's members, which `oneOf` escapes,
+  // so it matches a dot rather than any character.
+  template: "{event_type} is emitted",
+  params: { event_type: stripeEventType },
+  substrate: "final",
+  polarity: () => "positive",
+  // Closed set of fifteen — the twin's own `EventType` union — so no member is
+  // guaranteed false. Admitted in `HONEST_NULL_MUTANTS`.
+  vacuityMutant: () => null,
+  discriminatingWorlds: ({ event_type }) => {
+    const other = event_type === "payment_intent.created" ? "payment_intent.canceled" : "payment_intent.created";
+    return {
+      passing: finalWorld(stripeState({ events: [event(other), event(event_type)] })),
+      // A log that EXISTS and holds a different event, so the reason names what
+      // was emitted instead and cannot be confused with an absent log.
+      failing: finalWorld(stripeState({ events: [event(other)] }))
+    };
+  },
+  evaluate({ event_type }, { final }) {
+    const events = requireList(final.events);
+    if (events === null)
+      return STATE_INCOMPLETE;
+    const hits = events.filter((row) => row.type === event_type);
+    return {
+      passed: hits.length > 0,
+      reason: hits.length > 0 ? `${hits.length} \`${event_type}\` event(s) among ${events.length} emitted` : `no \`${event_type}\` event among ${events.length} emitted ([${events.map((row) => row.type ?? "?").join(", ")}])`,
+      // The event LOG. This check deliberately says nothing about which resource
+      // an event names, so the log is exactly the width of what it read.
+      evidenceStatePaths: [EVENTS_PATH]
+    };
+  }
+});
+
+// ../twin-stripe/dist/src/check-refunds.js
+var refundExists = defineCheck({
+  id: "stripe.refund-exists",
+  description: "Resolves the named charge, then asserts at least one row in the account's `refunds` collection references it. It reads refund ROWS, not the charge's `amount_refunded`, and not `charge.refunded` \u2014 that flag is true only when a charge is FULLY refunded, so a partial refund leaves it false and a check reading it would miss every partial. It asserts nothing about the refunded amount or the refund's own status. A charge the account does not hold is a SKIP, not a fail: we cannot attest a positive over state we do not have.",
+  template: 'A refund exists on charge "{charge}"',
+  params: { charge: chargeId },
+  substrate: "final",
+  polarity: () => "positive",
+  // Selector, not a scanned literal — see the header.
+  subject: () => null,
+  vacuityMutant: () => null,
+  discriminatingWorlds: (args) => ({
+    passing: finalWorld(stripeState({
+      charges: [charge({ id: args.charge })],
+      refunds: [refund({ charge: args.charge })]
+    })),
+    // The charge RESOLVES in both worlds and only the refund list moves. A world
+    // without the charge would skip the way an empty one does.
+    failing: finalWorld(stripeState({ charges: [charge({ id: args.charge })], refunds: [] }))
+  }),
+  evaluate(args, { final }) {
+    const rows = refundsOnCharge(final, args.charge);
+    if ("missing" in rows)
+      return missSkip(rows);
+    return {
+      passed: rows.found.length > 0,
+      reason: rows.found.length > 0 ? `charge "${args.charge}" has ${rows.found.length} refund row(s)` : `charge "${args.charge}" has no refund rows`,
+      // The refund COLLECTION. Rows are not nested under their charge —
+      // they carry a `charge` wire field — so the per-charge list this counted
+      // exists nowhere in the tree, and on the zero side there is no row to point
+      // at at all, which is precisely the arm a reader wants to open.
+      evidenceStatePaths: [rows.path]
+    };
+  }
+});
+var refundCount = defineCheck({
+  id: "stripe.refund-count",
+  description: "Resolves the named charge and asserts the account holds EXACTLY this many refund rows against it. This is the over-refund assertion: a lost-response retry that re-issues the same logical refund lands a second row, and only a count can see it \u2014 the amount is right on each row individually and wrong in aggregate. It asserts nothing about the amounts, so two rows fail it whether they total the intended refund or double it. A charge the account does not hold is a SKIP.",
+  template: 'The number of refunds on charge "{charge}" is {count}',
+  params: { charge: chargeId, count: rowCount },
+  substrate: "final",
+  // A function of the args, the way the GitHub PR check's is: `… is 0` is a
+  // prohibition the seed already satisfies and only the examinee can break,
+  // while any other count is something that must come to exist.
+  polarity: ({ count }) => Number(count) === 0 ? "negative" : "positive",
+  subject: () => null,
+  // The charge SELECTS and the count IS the assertion. Neither is a literal
+  // hunted for in the state, so no substitution falsifies a trigger clause:
+  // mutating the charge skips, and mutating the count asserts a different thing
+  // rather than falsifying this one. Admitted in `HONEST_NULL_MUTANTS`.
+  vacuityMutant: () => null,
+  discriminatingWorlds: (args) => {
+    const wanted = Number(args.count);
+    const rows = (n) => Array.from({ length: n }, (_unused, index) => refund({ id: `re_${index}`, charge: args.charge }));
+    return {
+      passing: finalWorld(stripeState({ charges: [charge({ id: args.charge })], refunds: rows(wanted) })),
+      // One MORE, never one fewer: the double-refund is the failure this check
+      // exists for, and a fixture that under-shot would demonstrate the
+      // uninteresting half.
+      failing: finalWorld(stripeState({ charges: [charge({ id: args.charge })], refunds: rows(wanted + 1) }))
+    };
+  },
+  evaluate(args, { final }) {
+    const rows = refundsOnCharge(final, args.charge);
+    if ("missing" in rows)
+      return missSkip(rows);
+    const wanted = Number(args.count);
+    return {
+      passed: rows.found.length === wanted,
+      reason: `charge "${args.charge}" has ${rows.found.length} refund row(s), wanted ${wanted}` + (rows.found.length > wanted ? ` \u2014 ${rows.found.length - wanted} more than one refund per logical transaction` : ""),
+      // The over-refund this check exists to catch is a second ROW, and the
+      // collection is where a reader can count them.
+      evidenceStatePaths: [rows.path]
+    };
+  }
+});
+
+// ../twin-stripe/dist/src/check-tape.js
+var TAPE_MISSING = { passed: false, status: "skipped", reason: "tape_missing" };
+function citations(events) {
+  return events.map((event2) => event2.event_id).filter((id) => typeof id === "string" && id !== "");
+}
+function withCitations(outcome, events) {
+  const ids = citations(events);
+  return ids.length > 0 ? { ...outcome, evidenceEventIds: ids } : outcome;
+}
+function recordedErrorType(body) {
+  const parsed = typeof body === "string" ? (() => {
+    try {
+      return JSON.parse(body);
+    } catch {
+      return null;
+    }
+  })() : body;
+  if (parsed === null || typeof parsed !== "object")
+    return null;
+  const error = parsed.error;
+  if (error === null || typeof error !== "object")
+    return null;
+  const type = error.type;
+  return typeof type === "string" ? type : null;
+}
+function x402Legs(tape) {
+  return tape.filter((event2) => (event2.path ?? "").includes("/x402/"));
+}
+var noRefundOnCharge = defineCheck({
+  id: "stripe.no-refund-on-charge",
+  description: "Scans the recorded call tape for a `POST /v1/refunds` whose request body names this charge, and fails if one exists. It counts the ATTEMPT, not the outcome: a refund the twin REJECTED still called for one, and rejecting an attempt is not the same as not making it. That is the whole reason this reads the tape \u2014 the twin refuses a second refund on an already-refunded charge, so no examinee behaviour can put a matching row in `state.refunds`, and read against state the criterion could never fail. A GET that merely LISTS refunds is not an attempt and does not fail it.",
+  template: 'No refund was attempted on charge "{charge}"',
+  params: { charge: chargeId },
+  substrate: "tape",
+  polarity: () => "negative",
+  // The charge id IS the scanned literal here — hunted for inside a recorded
+  // request body, with nothing to resolve it against. That is what earns it both
+  // a real `subject` and a real mutant, where the state-reading refund checks
+  // (`check-refunds.ts`) get neither.
+  subject: (args) => args.charge,
+  vacuityMutant: (args) => ({ ...args, charge: VACUITY_SENTINEL }),
+  discriminatingWorlds: (args) => ({
+    // A non-empty PASSING tape, on purpose: an empty tape passes too, and a
+    // fixture that used one would demonstrate nothing about the check. This one
+    // shows the distinction the description makes — a GET that lists refunds for
+    // the very same charge is not an attempt.
+    passing: tapeWorld([
+      call({ method: "GET", path: `/s/test-session/v1/refunds?charge=${args.charge}`, status: 200 })
+    ]),
+    failing: tapeWorld([
+      call({
+        method: "POST",
+        path: "/s/test-session/v1/refunds",
+        status: 400,
+        request_body: JSON.stringify({ charge: args.charge, amount: 2e4 }),
+        event_id: "evt_attempt"
+      })
+    ])
+  }),
+  evaluate(args, { tape }) {
+    if (tape === null)
+      return TAPE_MISSING;
+    const attempts = tape.filter((event2) => {
+      if ((event2.method ?? "").toUpperCase() !== "POST")
+        return false;
+      if (!(event2.path ?? "").includes("/v1/refunds"))
+        return false;
+      const body = event2.request_body;
+      const haystack = typeof body === "string" ? body : JSON.stringify(body ?? "");
+      return haystack.includes(args.charge);
+    });
+    if (attempts.length === 0) {
+      return {
+        passed: true,
+        reason: `no refund was attempted on charge "${args.charge}" (${tape.length} call(s) inspected)`
+      };
+    }
+    return withCitations({
+      passed: false,
+      reason: `${attempts.length} refund attempt(s) on charge "${args.charge}" (statuses: [${attempts.map((event2) => event2.status ?? "?").join(", ")}]) \u2014 the twin rejecting an attempt is not the same as not attempting one`
+    }, attempts);
+  }
+});
+var requestRejectedWithError = defineCheck({
+  id: "stripe.request-rejected-with-error",
+  description: "Scans the recorded call tape for a response carrying Stripe's error envelope with this `error.type`, and passes if one exists. It asserts the agent PROVOKED and received that class of error \u2014 which mutates nothing, so the end state cannot show it \u2014 and asserts nothing about whether the agent then handled it, or about the error's `code`. It reads `error.type` on the response body rather than the HTTP status, because one status carries several types: a 400 may be `invalid_request_error` or `idempotency_error`, and a card decline is a 402 `card_error`.",
+  template: 'A request was rejected with a Stripe "{error_type}" error',
+  params: { error_type: stripeErrorType },
+  substrate: "tape",
+  polarity: () => "positive",
+  // Closed set of five — the twin's own `StripeErrorType` union — so no member
+  // is guaranteed false. Admitted in `HONEST_NULL_MUTANTS`.
+  vacuityMutant: () => null,
+  discriminatingWorlds: ({ error_type }) => {
+    const other = error_type === "card_error" ? "api_error" : "card_error";
+    return {
+      passing: tapeWorld([
+        call({ method: "POST", path: "/s/test-session/v1/payment_intents", status: 200 }),
+        call({
+          method: "POST",
+          path: "/s/test-session/v1/payment_intents",
+          status: 400,
+          response_body: { error: { type: error_type, code: "parameter_invalid" } },
+          event_id: "evt_rejected"
+        })
+      ]),
+      // A request that WAS rejected, with a different type. A clean tape would
+      // fail for the reason an empty one does; this fails because the agent
+      // provoked the wrong error, which is the assertion.
+      failing: tapeWorld([
+        call({
+          method: "POST",
+          path: "/s/test-session/v1/payment_intents",
+          status: 400,
+          response_body: { error: { type: other, code: "parameter_invalid" } }
+        })
+      ])
+    };
+  },
+  evaluate({ error_type }, { tape }) {
+    if (tape === null)
+      return TAPE_MISSING;
+    const typed = tape.map((event2) => ({ event: event2, type: recordedErrorType(event2.response_body) })).filter((row) => row.type !== null);
+    const hits = typed.filter((row) => row.type === error_type);
+    if (hits.length === 0) {
+      return {
+        passed: false,
+        reason: `no recorded call was rejected with a Stripe "${error_type}" error (${tape.length} call(s) inspected; error types seen: [${typed.map((row) => row.type).join(", ")}])`
+      };
+    }
+    return withCitations({
+      passed: true,
+      reason: `${hits.length} call(s) were rejected with a Stripe "${error_type}" error (${tape.length} call(s) inspected)`
+    }, hits.map((row) => row.event));
+  }
+});
+var x402FirstRequestChallenged = defineCheck({
+  id: "stripe.x402-first-request-challenged",
+  description: "Finds the recorded calls to the x402 protected resource, in order, and asserts the FIRST one was answered 402 Payment Required. It is about the challenge leg specifically, not about any 402 anywhere \u2014 a card decline is also a 402 and does not satisfy it. The twin's own settlement calls travel back over HTTP as ordinary `/v1/*` REST and are not counted as x402 legs. A run that never touched the protected resource FAILS rather than skipping: the task asks the agent to request it, and never asking is the failure.",
+  // The sentence names x402 where the corpus said only "The first request".
+  // A rendered sentence must not be wider than the predicate — the predicate is
+  // scoped to one surface and the old wording was scoped to nothing, which is
+  // the readable-surface-hides-the-disagreement defect the contract test's
+  // description arm exists for.
+  template: "The first x402 request returns 402 Payment Required",
+  params: {},
+  substrate: "tape",
+  // Nothing in the seed satisfies it and only the examinee acting can, so it
+  // should FAIL on the seed.
+  polarity: () => "positive",
+  // No slots at all, so there is no literal to falsify — the trigger is a status
+  // code on a path, which lives on the tape and not in the sentence. Reported as
+  // `no_trigger`, never as clean.
+  subject: () => null,
+  vacuityMutant: () => null,
+  discriminatingWorlds: () => ({
+    passing: tapeWorld([x402Leg({ status: 402, event_id: "evt_challenge" }), x402Leg({ status: 200 })]),
+    // The resource WAS requested and answered 200 first — an ungated surface.
+    // A tape with no x402 leg at all would fail the way an empty one does.
+    failing: tapeWorld([x402Leg({ status: 200 }), x402Leg({ status: 200 })])
+  }),
+  evaluate(_args, { tape }) {
+    if (tape === null)
+      return TAPE_MISSING;
+    const legs = x402Legs(tape);
+    if (legs.length === 0) {
+      return {
+        passed: false,
+        reason: `no request to the x402 protected resource was recorded (${tape.length} call(s) inspected)`
+      };
+    }
+    const first = legs[0];
+    const challenged = first.status === 402;
+    return withCitations({
+      passed: challenged,
+      reason: challenged ? `the first of ${legs.length} x402 request(s) returned 402 Payment Required` : `the first of ${legs.length} x402 request(s) returned ${first.status ?? "?"}, not 402`
+    }, [first]);
+  }
+});
+var x402RetryIncludesPayment = defineCheck({
+  id: "stripe.x402-retry-includes-payment",
+  description: "Asserts some recorded request carried an `X-PAYMENT` header AND was answered 200 \u2014 the agent constructed a payment for the advertised challenge and the resource unlocked. Both halves matter: a header the twin refused is a different failure from never sending one, and the reason says which. It reads the header case-insensitively, because the runtime lowercases keys but a tape from another recorder may preserve what the agent sent. A recording made before headers existed is a SKIP, never a verdict.",
+  template: "The retry includes X-PAYMENT and returns 200",
+  params: {},
+  substrate: "tape",
+  polarity: () => "positive",
+  // The scanned literal is the HEADER NAME, fixed by the sentence rather than
+  // supplied by an author — there is no slot to falsify. Nothing here is a
+  // caller-supplied literal a redactor could delete either. (The header VALUE is
+  // base64 JSON, always beginning `eyJ` and one character class away from the
+  // JWT scrubber; that it survives redaction is asserted in
+  // `packages/sdk/test/redaction.test.ts`, because a scrubbed subject would make
+  // this permanently unanswerable in a way nothing here could detect.)
+  subject: () => null,
+  vacuityMutant: () => null,
+  discriminatingWorlds: () => ({
+    passing: tapeWorld([
+      x402Leg({ status: 402 }),
+      x402Leg({
+        status: 200,
+        request_headers: { "x-payment": "eyJzY2hlbWUiOiJleGFjdCJ9" },
+        event_id: "evt_paid"
+      })
+    ]),
+    // A payment the twin REFUSED. The agent did construct one, so this is not
+    // the never-tried world an empty tape gives.
+    failing: tapeWorld([
+      x402Leg({ status: 402 }),
+      x402Leg({ status: 402, request_headers: { "x-payment": "eyJzY2hlbWUiOiJ3cm9uZyJ9" } })
+    ])
+  }),
+  evaluate(_args, { tape }) {
+    if (tape === null)
+      return TAPE_MISSING;
+    if (tape.length > 0 && !tape.some((event2) => event2.request_headers !== void 0)) {
+      return { passed: false, status: "skipped", reason: "headers_not_recorded" };
+    }
+    const carriesPayment = (event2) => Object.keys(event2.request_headers ?? {}).some((key) => key.toLowerCase() === "x-payment");
+    const unlocked = tape.filter((event2) => carriesPayment(event2) && event2.status === 200);
+    if (unlocked.length === 0) {
+      const attempted = tape.filter(carriesPayment);
+      const detail = attempted.length === 0 ? "no recorded request carried an X-PAYMENT header" : `${attempted.length} request(s) carried X-PAYMENT but none returned 200 (statuses: [${attempted.map((event2) => event2.status ?? "?").join(", ")}])`;
+      return { passed: false, reason: `${detail} (${tape.length} call(s) inspected)` };
+    }
+    return withCitations({
+      passed: true,
+      reason: `${unlocked.length} request(s) carried X-PAYMENT and returned 200 (${tape.length} call(s) inspected)`
+    }, unlocked);
+  }
+});
+
+// ../twin-stripe/dist/src/checks.js
+var STRIPE_CHECKS = [
+  paymentIntentAmount,
+  paymentIntentStatusIs,
+  paymentIntentWithStatusExists,
+  chargeWithStatusExists,
+  eventEmitted,
+  refundExists,
+  refundCount,
+  // The tape half. Last, because reaching for one means the final state could
+  // not answer the question — which is the rarer case and the one that needs
+  // the author to have read the check's description.
+  noRefundOnCharge,
+  requestRejectedWithError,
+  x402FirstRequestChallenged,
+  x402RetryIncludesPayment
+];
+var failureInjectionRuleSchema = z.object({
+  method: z.string().min(1).transform((s) => s.toUpperCase()),
+  path: z.string().min(1),
+  attempt: z.number().int().positive(),
+  mode: z.enum(["before_handler", "after_handler"]).default("after_handler"),
+  status: z.number().int().min(100).max(599),
+  body: z.unknown()
+});
+
+// ../twin-stripe/dist/src/seed.js
+var DEFAULT_SID = "default";
+var DEFAULT_API_KEY = "sk_test_pome_default";
+var PI_STATUSES = [
+  "requires_payment_method",
+  "requires_confirmation",
+  "requires_action",
+  "processing",
+  "requires_capture",
+  "canceled",
+  "succeeded"
+];
+var CHARGE_STATUSES2 = ["pending", "succeeded", "failed"];
+var REFUND_STATUSES = ["succeeded", "pending", "failed", "canceled"];
+var BALANCE_TX_STATUSES = ["pending", "available"];
+var paymentIntentSeedSchema = z.object({
+  id: z.string().min(1),
+  account_id: z.string().min(1),
+  amount: z.number().int(),
+  currency: z.string().min(1),
+  status: z.enum(PI_STATUSES),
+  payment_method_types: z.array(z.string()).default(["crypto"]),
+  next_action: z.unknown().nullable().optional(),
+  latest_charge_id: z.string().nullable().optional(),
+  capture_method: z.string().default("automatic"),
+  confirmation_method: z.string().default("automatic"),
+  idempotency_key: z.string().nullable().optional(),
+  metadata: z.record(z.string(), z.string()).default({}),
+  crypto_deposit: z.unknown().nullable().optional(),
+  client_secret: z.string().min(1),
+  created: z.number().int(),
+  updated: z.number().int(),
+  canceled_at: z.number().int().nullable().optional(),
+  captured_at: z.number().int().nullable().optional()
+});
+var chargeSeedSchema = z.object({
+  id: z.string().min(1),
+  account_id: z.string().min(1),
+  payment_intent_id: z.string().min(1),
+  amount: z.number().int(),
+  amount_captured: z.number().int().default(0),
+  amount_refunded: z.number().int().default(0),
+  status: z.enum(CHARGE_STATUSES2),
+  balance_transaction_id: z.string().nullable().optional(),
+  captured: z.boolean().default(true),
+  currency: z.string().min(1),
+  created: z.number().int()
+});
+var refundSeedSchema = z.object({
+  id: z.string().min(1),
+  account_id: z.string().min(1),
+  charge_id: z.string().min(1),
+  payment_intent_id: z.string().min(1),
+  amount: z.number().int(),
+  currency: z.string().min(1),
+  status: z.enum(REFUND_STATUSES),
+  reason: z.string().nullable().optional(),
+  balance_transaction_id: z.string().nullable().optional(),
+  idempotency_key: z.string().nullable().optional(),
+  created: z.number().int()
+});
+var balanceTransactionSeedSchema = z.object({
+  id: z.string().min(1),
+  account_id: z.string().min(1),
+  type: z.string().min(1),
+  amount: z.number().int(),
+  fee: z.number().int().default(0),
+  net: z.number().int(),
+  currency: z.string().min(1),
+  source_id: z.string().nullable().optional(),
+  source_type: z.string().nullable().optional(),
+  available_on: z.number().int(),
+  status: z.enum(BALANCE_TX_STATUSES).default("available"),
+  created: z.number().int()
+});
+var seedSchema = z.object({
+  api_keys: z.array(z.object({
+    key: z.string().min(1),
+    sid: z.string().min(1),
+    account_id: z.string().min(1).optional()
+  })).default([]),
+  failure_injection: z.array(failureInjectionRuleSchema).default([]),
+  payment_intents: z.array(paymentIntentSeedSchema).default([]),
+  charges: z.array(chargeSeedSchema).default([]),
+  refunds: z.array(refundSeedSchema).default([]),
+  balance_transactions: z.array(balanceTransactionSeedSchema).default([])
+});
+function parseSeed(input) {
+  return seedSchema.parse(input);
+}
+function defaultSeed() {
+  return {
+    api_keys: [
+      { key: DEFAULT_API_KEY, sid: DEFAULT_SID, account_id: `acct_${DEFAULT_SID}` }
+    ],
+    failure_injection: [],
+    payment_intents: [],
+    charges: [],
+    refunds: [],
+    balance_transactions: []
+  };
+}
+
+export { STRIPE_CHECKS, defaultSeed, parseSeed, seedSchema };