@pome-sh/cli 0.1.0 → 0.2.0

package/dist/src/twin-github/app.d.ts

@@ -1,9 +0,0 @@
-import { Hono } from "hono";
-import type { GitHubCloneDatabase, GitHubStateSeed, Recorder } from "./types.js";
-export type GitHubCloneAppOptions = {
-    db?: GitHubCloneDatabase;
-    seed?: GitHubStateSeed;
-    recorder?: Recorder;
-    runId?: string;
-};
-export declare function createGitHubCloneApp(options?: GitHubCloneAppOptions): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;

package/dist/src/twin-github/app.js

@@ -1,327 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-import { Hono } from "hono";
-import { z } from "zod";
-import { bearerAuth, localhostOnly } from "./auth.js";
-import { openGitHubCloneDatabase } from "./db.js";
-import { GitHubDomain } from "./domain.js";
-import { githubError, TwinError, validationFailed } from "./errors.js";
-import { defaultSeedState, parseSeed } from "./seed.js";
-import { requestId } from "./util.js";
-import { executeTool, isMutatingTool, listTools } from "./tools.js";
-import { handleMcpRequest, mcpMethodNotAllowed } from "./mcp.js";
-import { twinBuildInfo } from "./build-info.js";
-import { unsupportedEnvelope } from "./unsupported-envelope.js";
-import { redactSecrets } from "../recorder/redaction.js";
-function captureDelta(fn) {
-    let delta = null;
-    const value = fn((d) => { delta = d; });
-    return { value, delta };
-}
-const jsonRecord = z.record(z.string(), z.unknown());
-const createRepoSchema = z.object({ name: z.string().min(1), owner: z.string().min(1).optional(), description: z.string().optional(), private: z.boolean().optional() });
-const contentSchema = z.object({ message: z.string().min(1), content: z.string(), branch: z.string().optional(), sha: z.string().optional(), encoding: z.enum(["utf-8", "base64"]).optional() });
-const createIssueSchema = z.object({ title: z.string().min(1), body: z.string().optional(), labels: z.array(z.string()).optional(), assignees: z.array(z.string()).optional() });
-const updateIssueSchema = z.object({ title: z.string().optional(), body: z.string().optional(), state: z.enum(["open", "closed"]).optional(), labels: z.array(z.string()).optional(), assignees: z.array(z.string()).optional() });
-const commentSchema = z.object({ body: z.string().min(1) });
-const labelSchema = z.object({ name: z.string().min(1), color: z.string().default("ededed"), description: z.string().default("") });
-const labelsSchema = z.object({ labels: z.array(z.string().min(1)).min(1) });
-const assigneesSchema = z.object({ assignees: z.array(z.string().min(1)).min(1) });
-const createPullSchema = z.object({ title: z.string().min(1), body: z.string().optional(), head: z.string().min(1), base: z.string().optional() });
-const reviewSchema = z.object({ event: z.enum(["APPROVE", "REQUEST_CHANGES", "COMMENT"]), body: z.string().optional() });
-const mergeSchema = z.object({ commit_title: z.string().optional(), commit_message: z.string().optional() });
-const updateBranchSchema = z.object({ expected_head_sha: z.string().optional() });
-export function createGitHubCloneApp(options = {}) {
-    const db = options.db ?? openGitHubCloneDatabase();
-    const domain = new GitHubDomain(db);
-    if (!options.db)
-        domain.seed(options.seed ?? defaultSeedState());
-    const recorder = options.recorder;
-    const runId = options.runId ?? "local";
-    const root = new Hono();
-    root.get("/healthz", (c) => c.json({
-        ok: true,
-        twin: "github",
-        implementation: "github_clone",
-        fidelity: "semantic",
-        tools: listTools().length,
-        runtime: twinBuildInfo()
-    }));
-    const adminApp = new Hono();
-    adminApp.use("*", localhostOnly());
-    adminApp.post("/reset", (c) => handle(c, recorder, runId, async () => {
-        const { delta } = captureDelta((onDelta) => {
-            domain.seed(defaultSeedState(), onDelta);
-        });
-        return { status: 200, body: { ok: true, message: "GitHub twin state reset to default seed." }, mutation: true, stateDelta: delta };
-    }));
-    adminApp.post("/seed", (c) => handle(c, recorder, runId, async () => {
-        const parsed = parseSeed(await c.req.json());
-        const { delta } = captureDelta((onDelta) => {
-            domain.seed(parsed, onDelta);
-        });
-        return { status: 200, body: { ok: true, repositories: parsed.repositories.length }, mutation: true, stateDelta: delta };
-    }));
-    root.route("/admin", adminApp);
-    const session = new Hono();
-    session.use("*", bearerAuth());
-    session.get("/healthz", (c) => c.json({ ok: true, sid: c.req.param("sid") }));
-    session.get("/_pome/health", (c) => c.json({
-        ok: true,
-        twin: "github",
-        implementation: "github_clone",
-        fidelity: "semantic",
-        runtime: twinBuildInfo()
-    }));
-    session.get("/_pome/state", (c) => c.json(redactSecrets(domain.exportState())));
-    session.get("/_pome/events", (c) => c.json(recorder?.events() ?? []));
-    // Real MCP JSON-RPC endpoint (Streamable HTTP, stateless). The bearerAuth
-    // middleware on `session` covers this — auth contract is unchanged. Legacy
-    // custom routes below (`/mcp/tools`, `/mcp/tools/:name`, `/mcp/call`) stay
-    // mounted at sub-paths; they do not collide with `POST /mcp`.
-    session.post("/mcp", (c) => handleMcpRequest(c, { domain, recorder, runId }));
-    session.get("/mcp", (c) => mcpMethodNotAllowed(c));
-    session.delete("/mcp", (c) => mcpMethodNotAllowed(c));
-    session.get("/mcp/tools", (c) => c.json({ tools: listTools() }));
-    session.post("/mcp/tools/:name", (c) => handle(c, recorder, runId, async () => {
-        const args = await readJson(c);
-        const name = requireParam(c, "name");
-        const { value, delta } = captureDelta((onDelta) => executeTool(domain, name, args, onDelta));
-        return { status: 200, body: value, mutation: isMutatingTool(name), stateDelta: delta };
-    }));
-    session.post("/mcp/call", (c) => handle(c, recorder, runId, async () => {
-        const call = z.object({ tool: z.string().min(1), arguments: jsonRecord.default({}) }).parse(await readJson(c));
-        const { value, delta } = captureDelta((onDelta) => executeTool(domain, call.tool, call.arguments, onDelta));
-        return { status: 200, body: value, mutation: isMutatingTool(call.tool), stateDelta: delta };
-    }));
-    session.get("/search/repositories", (c) => handle(c, recorder, runId, () => ok(domain.searchRepositories({ q: c.req.query("q"), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.get("/search/code", (c) => handle(c, recorder, runId, () => ok(domain.searchCode({ q: c.req.query("q"), owner: c.req.query("owner"), repo: c.req.query("repo"), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.get("/search/issues", (c) => handle(c, recorder, runId, () => ok(domain.searchIssues({ q: c.req.query("q"), owner: c.req.query("owner"), repo: c.req.query("repo"), state: stateQuery(c), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.get("/search/users", (c) => handle(c, recorder, runId, () => ok(domain.searchUsers({ q: c.req.query("q"), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.get("/repos/:owner/:repo", (c) => handle(c, recorder, runId, () => ok(domain.getRepository(params(c)))));
-    session.post("/user/repos", (c) => handle(c, recorder, runId, async () => {
-        const args = createRepoSchema.parse(await readJson(c));
-        const { value, delta } = captureDelta((onDelta) => domain.createRepository(args, onDelta));
-        return created(value, delta);
-    }));
-    session.post("/orgs/:owner/repos", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...createRepoSchema.parse(await readJson(c)), owner: c.req.param("owner") };
-        const { value, delta } = captureDelta((onDelta) => domain.createRepository(args, onDelta));
-        return created(value, delta);
-    }));
-    session.post("/repos/:owner/:repo/forks", (c) => handle(c, recorder, runId, async () => {
-        const organization = (await maybeJson(c)).organization;
-        const { value, delta } = captureDelta((onDelta) => domain.forkRepository({ ...params(c), organization }, onDelta));
-        return created(value, delta);
-    }));
-    session.get("/repos/:owner/:repo/contents", (c) => handle(c, recorder, runId, () => ok(domain.getFileContents({ ...params(c), path: "", ref: c.req.query("ref") }))));
-    session.get("/repos/:owner/:repo/contents/*", (c) => handle(c, recorder, runId, () => ok(domain.getFileContents({ ...params(c), path: contentPath(c), ref: c.req.query("ref") }))));
-    session.put("/repos/:owner/:repo/contents/*", (c) => handle(c, recorder, runId, async () => {
-        const body = contentSchema.parse(await readJson(c));
-        const args = { ...params(c), path: contentPath(c), ...body };
-        const actor = sessionFrom(c).login;
-        const { value, delta } = captureDelta((onDelta) => domain.createOrUpdateFile(args, { actor }, onDelta));
-        // GitHub returns 201 Created for a new file, 200 OK for an update
-        // (FDRS-596). `before: null` delta = insert (see packages/twin-github).
-        const status = delta !== null && delta.before === null ? 201 : 200;
-        return { status, body: value, mutation: true, stateDelta: delta };
-    }));
-    session.get("/repos/:owner/:repo/commits", (c) => handle(c, recorder, runId, () => ok(domain.listCommits({ ...params(c), sha: c.req.query("sha"), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.post("/repos/:owner/:repo/git/refs", (c) => handle(c, recorder, runId, async () => {
-        const body = z.object({ ref: z.string().min(1), sha: z.string().optional() }).parse(await readJson(c));
-        const branch = body.ref.replace(/^refs\/heads\//, "");
-        const { value, delta } = captureDelta((onDelta) => domain.createBranch({ ...params(c), branch, sha: body.sha }, onDelta));
-        return created(value, delta);
-    }));
-    session.get("/repos/:owner/:repo/issues", (c) => handle(c, recorder, runId, () => ok(domain.listIssues({ ...params(c), state: stateQuery(c), labels: c.req.query("labels"), assignee: c.req.query("assignee"), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.post("/repos/:owner/:repo/issues", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...params(c), ...createIssueSchema.parse(await readJson(c)) };
-        const { value, delta } = captureDelta((onDelta) => domain.createIssue(args, onDelta));
-        return created(value, delta);
-    }));
-    session.get("/repos/:owner/:repo/issues/:number", (c) => handle(c, recorder, runId, () => ok(domain.getIssue({ ...params(c), issue_number: numberParam(c, "number") }))));
-    session.patch("/repos/:owner/:repo/issues/:number", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...params(c), issue_number: numberParam(c, "number"), ...updateIssueSchema.parse(await readJson(c)) };
-        const { value, delta } = captureDelta((onDelta) => domain.updateIssue(args, onDelta));
-        return ok(value, true, delta);
-    }));
-    session.get("/repos/:owner/:repo/issues/:number/comments", (c) => handle(c, recorder, runId, () => ok(domain.listIssueComments({ ...params(c), issue_number: numberParam(c, "number"), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.post("/repos/:owner/:repo/issues/:number/comments", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...params(c), issue_number: numberParam(c, "number"), ...commentSchema.parse(await readJson(c)) };
-        const { value, delta } = captureDelta((onDelta) => domain.addIssueComment(args, onDelta));
-        return created(value, delta);
-    }));
-    session.get("/repos/:owner/:repo/labels", (c) => handle(c, recorder, runId, () => ok(domain.listRepositoryLabels(params(c)))));
-    session.post("/repos/:owner/:repo/labels", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...params(c), ...labelSchema.parse(await readJson(c)) };
-        const { value, delta } = captureDelta((onDelta) => domain.createRepositoryLabel(args, onDelta));
-        return created(value, delta);
-    }));
-    session.get("/repos/:owner/:repo/issues/:number/labels", (c) => handle(c, recorder, runId, () => ok(domain.listIssueLabelsForIssue({ ...params(c), issue_number: numberParam(c, "number") }))));
-    session.post("/repos/:owner/:repo/issues/:number/labels", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...params(c), issue_number: numberParam(c, "number"), ...labelsSchema.parse(await readJson(c)) };
-        const { value, delta } = captureDelta((onDelta) => domain.addIssueLabels(args, onDelta));
-        return ok(value, true, delta);
-    }));
-    session.delete("/repos/:owner/:repo/issues/:number/labels/:name", (c) => handle(c, recorder, runId, () => {
-        const args = { ...params(c), issue_number: numberParam(c, "number"), label: requireParam(c, "name") };
-        const { value, delta } = captureDelta((onDelta) => domain.deleteIssueLabel(args, onDelta));
-        return ok(value, true, delta);
-    }));
-    session.get("/repos/:owner/:repo/collaborators", (c) => handle(c, recorder, runId, () => ok(domain.listCollaborators(params(c)))));
-    session.get("/repos/:owner/:repo/collaborators/:username", (c) => handle(c, recorder, runId, () => {
-        const found = domain.isCollaborator({ ...params(c), username: requireParam(c, "username") });
-        if (!found)
-            throw new TwinError("Not Found", 404);
-        return { status: 204, body: null, mutation: false };
-    }));
-    session.post("/repos/:owner/:repo/issues/:number/assignees", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...params(c), issue_number: numberParam(c, "number"), ...assigneesSchema.parse(await readJson(c)) };
-        const { value, delta } = captureDelta((onDelta) => domain.addAssignees(args, onDelta));
-        return created(value, delta);
-    }));
-    session.get("/repos/:owner/:repo/pulls", (c) => handle(c, recorder, runId, () => ok(domain.listPullRequests({ ...params(c), state: stateQuery(c), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.post("/repos/:owner/:repo/pulls", (c) => handle(c, recorder, runId, async () => {
-        const actor = sessionFrom(c).login;
-        const args = { ...params(c), ...createPullSchema.parse(await readJson(c)), actor };
-        const { value, delta } = captureDelta((onDelta) => domain.createPullRequest(args, onDelta));
-        return created(value, delta);
-    }));
-    session.get("/repos/:owner/:repo/pulls/:number", (c) => handle(c, recorder, runId, () => ok(domain.getPullRequest({ ...params(c), pull_number: numberParam(c, "number") }))));
-    session.get("/repos/:owner/:repo/pulls/:number/files", (c) => handle(c, recorder, runId, () => ok(domain.getPullRequestFiles({ ...params(c), pull_number: numberParam(c, "number"), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.get("/repos/:owner/:repo/pulls/:number/reviews", (c) => handle(c, recorder, runId, () => ok(domain.getPullRequestReviews({ ...params(c), pull_number: numberParam(c, "number"), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.post("/repos/:owner/:repo/pulls/:number/reviews", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...params(c), pull_number: numberParam(c, "number"), ...reviewSchema.parse(await readJson(c)) };
-        const { value, delta } = captureDelta((onDelta) => domain.createPullRequestReview(args, onDelta));
-        return created(value, delta);
-    }));
-    session.get("/repos/:owner/:repo/pulls/:number/comments", (c) => handle(c, recorder, runId, () => ok(domain.getPullRequestComments({ ...params(c), pull_number: numberParam(c, "number"), page: numberQuery(c, "page"), per_page: numberQuery(c, "per_page") }))));
-    session.get("/repos/:owner/:repo/pulls/:number/status", (c) => handle(c, recorder, runId, () => ok(domain.getPullRequestStatus({ ...params(c), pull_number: numberParam(c, "number") }))));
-    session.put("/repos/:owner/:repo/pulls/:number/merge", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...params(c), pull_number: numberParam(c, "number"), ...mergeSchema.parse(await maybeJson(c)) };
-        const actor = sessionFrom(c).login;
-        if (!actor || !domain.isCollaborator({ owner: args.owner, repo: args.repo, username: actor })) {
-            throw new TwinError("Must have push access to the repository to merge pull requests.", 403);
-        }
-        const { value, delta } = captureDelta((onDelta) => domain.mergePullRequest(args, onDelta));
-        return ok(value, true, delta);
-    }));
-    session.put("/repos/:owner/:repo/pulls/:number/update-branch", (c) => handle(c, recorder, runId, async () => {
-        const args = { ...params(c), pull_number: numberParam(c, "number"), ...updateBranchSchema.parse(await maybeJson(c)) };
-        const { value, delta } = captureDelta((onDelta) => domain.updatePullRequestBranch(args, onDelta));
-        return ok(value, true, delta);
-    }));
-    session.all("*", (c) => respond(c, recorder, runId, Date.now(), null, unsupportedEnvelope.status, unsupportedEnvelope.body, false, "unsupported"));
-    root.route("/s/:sid", session);
-    return root;
-}
-function ok(body, mutation = false, stateDelta = null) {
-    return { status: 200, body, mutation, stateDelta };
-}
-function created(body, stateDelta = null) {
-    return { status: 201, body, mutation: true, stateDelta };
-}
-async function handle(c, recorder, runId, fn) {
-    const started = Date.now();
-    let requestBody = null;
-    try {
-        requestBody = c.req.method === "GET" || c.req.method === "HEAD" ? null : await c.req.raw.clone().json().catch(() => null);
-        const result = await fn();
-        return respond(c, recorder, runId, started, requestBody, result.status, result.body, result.mutation, "semantic", result.stateDelta ?? null);
-    }
-    catch (error) {
-        if (error instanceof TwinError) {
-            return respond(c, recorder, runId, started, requestBody, error.status, githubError(error.message, error.status, error.errors), false);
-        }
-        if (error instanceof z.ZodError) {
-            return respond(c, recorder, runId, started, requestBody, 422, githubError("Validation Failed", 422, error.issues.map((issue) => ({
-                resource: "Request",
-                field: issue.path.join("."),
-                code: issue.code
-            }))), false);
-        }
-        if (error instanceof SyntaxError) {
-            return respond(c, recorder, runId, started, requestBody, 400, githubError("Problems parsing JSON", 400), false);
-        }
-        return respond(c, recorder, runId, started, requestBody, 500, githubError(error instanceof Error ? error.message : "Internal Server Error", 500), false);
-    }
-}
-function respond(c, recorder, runId, started, requestBody, status, responseBody, stateMutation, fidelity = "semantic", stateDelta = null) {
-    const reqId = requestId();
-    const correlationHeader = c.req.header("x-pome-correlation-id") ?? null;
-    recorder?.record({
-        ts: new Date().toISOString(),
-        run_id: runId,
-        twin: "github",
-        request_id: reqId,
-        // FDRS-402: persist the adapter's x-pome-correlation-id as `correlation_id`
-        // (legacy correlator path) and as `tool_call_id` (adapter-rich path).
-        // When the header is absent we keep the heuristic-path fallback: reqId for
-        // correlation_id, null for tool_call_id.
-        correlation_id: correlationHeader ?? reqId,
-        scenario_step_id: c.req.header("x-pome-scenario-step-id") ?? null,
-        step_id: null,
-        tool_call_id: correlationHeader,
-        method: c.req.method,
-        path: new URL(c.req.url).pathname,
-        request_body: requestBody,
-        status,
-        response_body: responseBody,
-        latency_ms: Date.now() - started,
-        fidelity,
-        state_mutation: stateMutation,
-        state_delta: stateDelta,
-        error: status >= 400 ? responseBody.message ?? "request failed" : null
-    });
-    if (status === 204)
-        return c.body(null, status);
-    return c.json(responseBody, status);
-}
-async function readJson(c) {
-    try {
-        return await c.req.json();
-    }
-    catch {
-        throw new SyntaxError("Problems parsing JSON");
-    }
-}
-async function maybeJson(c) {
-    try {
-        return await c.req.json();
-    }
-    catch {
-        return {};
-    }
-}
-function params(c) {
-    return { owner: requireParam(c, "owner"), repo: requireParam(c, "repo") };
-}
-function sessionFrom(c) {
-    return c.get("session") ?? { sid: "", team_id: "" };
-}
-function numberParam(c, name) {
-    const value = Number(c.req.param(name));
-    if (!Number.isInteger(value) || value < 1)
-        validationFailed(name, "invalid", c.req.param(name));
-    return value;
-}
-function requireParam(c, name) {
-    const value = c.req.param(name);
-    if (!value)
-        throw new TwinError(`Missing route parameter: ${name}`, 400);
-    return value;
-}
-function contentPath(c) {
-    const { owner, repo } = params(c);
-    const sid = c.req.param("sid");
-    const pathname = new URL(c.req.url).pathname;
-    const prefix = `/s/${sid}/repos/${owner}/${repo}/contents/`;
-    return decodeURIComponent(pathname.startsWith(prefix) ? pathname.slice(prefix.length) : "");
-}
-function numberQuery(c, name) {
-    const value = c.req.query(name);
-    return value ? Number(value) : undefined;
-}
-function stateQuery(c) {
-    const state = c.req.query("state");
-    return state === "open" || state === "closed" || state === "all" ? state : undefined;
-}

package/dist/src/twin-github/auth.d.ts

@@ -1,16 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-export interface SessionClaims {
-    sid: string;
-    team_id: string;
-    exp: number;
-    login?: string;
-}
-export interface Session {
-    sid: string;
-    team_id: string;
-    login?: string;
-}
-export declare function resolveAuthSecret(): string;
-export declare function bearerAuth(): MiddlewareHandler;
-export declare function requireAdminAuth(): MiddlewareHandler;
-export declare const localhostOnly: typeof requireAdminAuth;

package/dist/src/twin-github/auth.js

@@ -1,142 +0,0 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { verify } from "hono/jwt";
-export function resolveAuthSecret() {
-    const secret = process.env.TWIN_AUTH_SECRET;
-    if (!secret && process.env.NODE_ENV === "production") {
-        throw new Error("TWIN_AUTH_SECRET required in production");
-    }
-    return secret ?? "dev-only-insecure-secret";
-}
-function unauthorized(message) {
-    return Response.json({ message, documentation_url: "" }, { status: 401 });
-}
-function extractSidFromUrl(rawUrl) {
-    try {
-        const path = new URL(rawUrl).pathname;
-        const match = path.match(/^\/s\/([^/]+)/);
-        return match?.[1] ? decodeURIComponent(match[1]) : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function bearerAuth() {
-    return async (c, next) => {
-        const header = c.req.header("Authorization") ?? c.req.header("authorization");
-        if (!header || !header.startsWith("Bearer ")) {
-            return unauthorized("Bad credentials");
-        }
-        const token = header.slice("Bearer ".length).trim();
-        if (!token)
-            return unauthorized("Bad credentials");
-        const providerSid = verifyProviderToken("github", token);
-        if (providerSid) {
-            const pathSid = c.req.param("sid") ?? extractSidFromUrl(c.req.url);
-            if (providerSid !== pathSid) {
-                return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 401 });
-            }
-            c.set("session", { sid: providerSid, team_id: "provider-shaped" });
-            await next();
-            return;
-        }
-        let claims;
-        try {
-            claims = (await verify(token, resolveAuthSecret(), "HS256"));
-        }
-        catch {
-            return unauthorized("Bad credentials");
-        }
-        if (typeof claims.exp === "number" && claims.exp < Math.floor(Date.now() / 1000)) {
-            return unauthorized("Token expired");
-        }
-        const pathSid = c.req.param("sid") ?? extractSidFromUrl(c.req.url);
-        if (!claims.sid || claims.sid !== pathSid) {
-            return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 401 });
-        }
-        const session = { sid: claims.sid, team_id: claims.team_id };
-        if (typeof claims.login === "string" && claims.login.length > 0)
-            session.login = claims.login;
-        c.set("session", session);
-        await next();
-    };
-}
-function verifyProviderToken(provider, token) {
-    const match = token.match(/^(?:github_pat|ghp)_pome_([^_]+)_(?:(\d+)_)?(.+)$/);
-    if (!match)
-        return undefined;
-    const sid = decodeBase64Url(match[1]);
-    if (!sid)
-        return undefined;
-    const exp = match[2] ? Number(match[2]) : undefined;
-    if (exp !== undefined && (!Number.isSafeInteger(exp) || exp < Math.floor(Date.now() / 1000))) {
-        return undefined;
-    }
-    const expected = exp === undefined
-        ? signProvider(provider, sid, resolveAuthSecret())
-        : signProviderExp(provider, sid, exp, resolveAuthSecret());
-    const actual = match[3];
-    if (safeEqual(actual, expected))
-        return sid;
-    return undefined;
-}
-function signProvider(provider, sid, secret) {
-    return createHmac("sha256", secret)
-        .update(`${provider}:${sid}`)
-        .digest("base64url")
-        .slice(0, 22);
-}
-function signProviderExp(provider, sid, exp, secret) {
-    return createHmac("sha256", secret)
-        .update(`${provider}:${sid}:${exp}`)
-        .digest("base64url")
-        .slice(0, 22);
-}
-function decodeBase64Url(value) {
-    try {
-        return Buffer.from(value, "base64url").toString("utf8");
-    }
-    catch {
-        return undefined;
-    }
-}
-function safeEqual(a, b) {
-    const ab = Buffer.from(a);
-    const bb = Buffer.from(b);
-    return ab.length === bb.length && timingSafeEqual(ab, bb);
-}
-export function requireAdminAuth() {
-    return async (c, next) => {
-        const adminToken = process.env.TWIN_ADMIN_TOKEN;
-        if (adminToken && adminToken.length > 0) {
-            const provided = c.req.header("X-Admin-Token") ?? c.req.header("x-admin-token");
-            if (!provided) {
-                return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 403 });
-            }
-            const a = Buffer.from(provided);
-            const b = Buffer.from(adminToken);
-            if (a.length !== b.length || !timingSafeEqual(a, b)) {
-                return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 403 });
-            }
-            await next();
-            return;
-        }
-        const remote = c.env?.incoming?.socket
-            ?.remoteAddress;
-        if (!remote) {
-            if (process.env.NODE_ENV === "production") {
-                return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 403 });
-            }
-            await next();
-            return;
-        }
-        const isLocal = remote === "127.0.0.1" ||
-            remote === "::1" ||
-            remote === "::ffff:127.0.0.1" ||
-            remote === "localhost";
-        if (!isLocal) {
-            return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 403 });
-        }
-        await next();
-    };
-}
-export const localhostOnly = requireAdminAuth;

package/dist/src/twin-github/build-info.d.ts

@@ -1,7 +0,0 @@
-export type TwinBuildInfo = {
-    package: string;
-    version: string;
-    git_sha: string;
-    build_time: string;
-};
-export declare function twinBuildInfo(): TwinBuildInfo;

package/dist/src/twin-github/build-info.js

@@ -1,52 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-// F6 — read the CI-baked `dist/build-info.json` written by
-// `scripts/copy-prompts.mjs`. The published tarball ships this file under
-// `dist/`, so a `pome health` from `npm install -g pome-sh` resolves the real
-// commit SHA and ISO build timestamp instead of the previous "dev"
-// placeholder. Runtime env vars (POME_TWIN_GIT_SHA / POME_TWIN_VERSION /
-// POME_TWIN_BUILD_TIME) still override — useful for hosted twins that bake
-// versioning in via process env. Final fallback is "dev" so a contributor
-// install without CI baking still produces a working response.
-let cachedBakedInfo = null;
-function loadBakedInfo() {
-    if (cachedBakedInfo)
-        return cachedBakedInfo;
-    try {
-        const here = dirname(fileURLToPath(import.meta.url));
-        // From `dist/src/twin-github/build-info.js`, dist/build-info.json is
-        // three levels up. From the unbuilt source file the lookup misses and
-        // we cleanly fall back. Walk both shapes so tests / direct tsx runs
-        // also pick up a sibling-of-source generated file if one exists.
-        const candidates = [
-            resolve(here, "..", "..", "..", "build-info.json"),
-            resolve(here, "..", "..", "build-info.json"),
-        ];
-        for (const candidate of candidates) {
-            if (existsSync(candidate)) {
-                const raw = readFileSync(candidate, "utf8");
-                cachedBakedInfo = JSON.parse(raw);
-                return cachedBakedInfo;
-            }
-        }
-    }
-    catch {
-        /* fall through */
-    }
-    cachedBakedInfo = {};
-    return cachedBakedInfo;
-}
-export function twinBuildInfo() {
-    const baked = loadBakedInfo();
-    return {
-        package: "@pome-sh/twin-github",
-        version: process.env.POME_TWIN_VERSION ?? baked.version ?? "0.1.0",
-        git_sha: process.env.POME_TWIN_GIT_SHA ??
-            process.env.VERCEL_GIT_COMMIT_SHA ??
-            baked.git_sha ??
-            "dev",
-        build_time: process.env.POME_TWIN_BUILD_TIME ?? baked.build_time ?? "dev",
-    };
-}

package/dist/src/twin-github/db.d.ts

@@ -1,4 +0,0 @@
-import type { GitHubCloneDatabase } from "./types.js";
-export declare function openGitHubCloneDatabase(path?: string): GitHubCloneDatabase;
-export declare function migrate(db: GitHubCloneDatabase): void;
-export declare function resetDatabase(db: GitHubCloneDatabase): void;