@pome-sh/cli 0.2.0 → 0.4.0

package/node_modules/@pome-sh/twin-slack/node_modules/@pome-sh/shared-types/dist/task.js

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// shared-types §3 — TASKS. Task config, the parsed task markdown shape, and the
+// persisted task row, plus their deprecated `scenario*` aliases. The provider
+// seed-state schemas consumed by `taskSchema.seedState` live in `./seed-state.ts`.
+// Re-exported through the `@pome-sh/shared-types` barrel (index.ts).
+import { z } from "zod";
+import { criterionSchema, judgeModelSchema } from "./run.js";
+import { seedStateSchema } from "./seed-state.js";
+// ─────────────────────────────────────────────────────────────────────────────
+// 3. TASKS (formerly "scenarios") — originally adopted verbatim from
+//    oslo/pome/src/scenario/scenarioSchema.ts
+//
+// W3 vocab (FDRS-653): "task" is the canonical name; the `scenario*` exports
+// below are deprecated aliases kept for the 0.3.0 window (FDRS-654 swaps the
+// consumers).
+//
+// `criterionSchema` and `judgeModelSchema` were moved to `./run.ts` (2026-05-11
+// split) because CriterionResult depends on them; imported here from `./run.js`
+// and re-exported to consumers via the index.ts barrel.
+// ─────────────────────────────────────────────────────────────────────────────
+export const taskConfigSchema = z.object({
+    twins: z.array(z.string()).default(["github"]),
+    timeout: z.number().int().positive().default(60), // seconds
+    runs: z.number().int().positive().default(1),
+    passThreshold: z.number().min(0).max(100).default(100),
+    judge: judgeModelSchema.default("claude-haiku-4-5"), // CLI's BYOK config decides which endpoint serves this
+});
+/** @deprecated FDRS-653 — use `taskConfigSchema`. Removed after the 0.3.0 window. */
+export const scenarioConfigSchema = taskConfigSchema;
+// The parsed task (formerly "scenario") markdown shape. Criterion kinds inside
+// `criteria` normalize D→code, P→model (tolerant reader, FDRS-653).
+export const taskSchema = z.object({
+    slug: z.string().min(1),
+    title: z.string().min(1),
+    setup: z.string().default(""), // human-readable prose; ignored at runtime
+    prompt: z.string().min(1),
+    expectedBehavior: z.string().default(""), // evaluator-only, NEVER sent to agent
+    criteria: z.array(criterionSchema).min(1),
+    config: taskConfigSchema,
+    seedState: seedStateSchema,
+});
+/** @deprecated FDRS-653 — use `taskSchema`. Removed after the 0.3.0 window. */
+export const scenarioSchema = taskSchema;
+// Persisted Task row (dashboard upload path; cloud DB `tasks` table). Per
+// 04-data-model.md. Row ids keep the historical `scn_` prefix (persisted data;
+// renaming ids is a data migration, deliberately NOT part of FDRS-653).
+export const persistedTaskSchema = z.object({
+    id: z.string(), // scn_<nanoid>
+    team_id: z.string(),
+    name: z.string(),
+    source: z.string(), // raw markdown
+    source_hash: z.string(), // sha256(source)
+    uploaded_by: z.string(), // user_id
+    created_at: z.string().datetime(),
+    archived_at: z.string().datetime().nullable(),
+});
+/** @deprecated FDRS-653 — use `persistedTaskSchema`. Removed after the 0.3.0 window. */
+export const persistedScenarioSchema = persistedTaskSchema;
+//# sourceMappingURL=task.js.map

package/node_modules/@pome-sh/twin-slack/node_modules/@pome-sh/shared-types/dist/task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task.js","sourceRoot":"","sources":["../src/task.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,mFAAmF;AACnF,qEAAqE;AAErE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,gFAAgF;AAChF,qEAAqE;AACrE,8CAA8C;AAC9C,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,cAAc;AACd,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,wDAAwD;AACxD,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAU,UAAU;IACpE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACtD,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAQ,uDAAuD;CACnH,CAAC,CAAC;AAGH,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAIrD,+EAA+E;AAC/E,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAgB,2CAA2C;IACxF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAK,sCAAsC;IACnF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAIzC,0EAA0E;AAC1E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAA+B,eAAe;IAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAA2B,eAAe;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAsB,iBAAiB;IAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAsB,UAAU;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAGH,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC"}

package/node_modules/@pome-sh/twin-slack/node_modules/@pome-sh/shared-types/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@pome-sh/shared-types",
+  "version": "0.11.0",
+  "description": "Shared wire-format contract for Pome — Zod schemas for traces, recorder events, runs, OTel mapping, and secret redaction.",
+  "private": false,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./recorder-events": {
+      "types": "./dist/recorder-events.d.ts",
+      "default": "./dist/recorder-events.js"
+    },
+    "./run": {
+      "types": "./dist/run.d.ts",
+      "default": "./dist/run.js"
+    },
+    "./otel": {
+      "types": "./dist/otel/index.d.ts",
+      "default": "./dist/otel/index.js"
+    },
+    "./otel/fixtures": {
+      "types": "./dist/otel/fixtures/index.d.ts",
+      "default": "./dist/otel/fixtures/index.js"
+    },
+    "./redaction": {
+      "types": "./dist/redaction.d.ts",
+      "default": "./dist/redaction.js"
+    }
+  },
+  "files": [
+    "dist",
+    "trace-contract.json"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pome-sh/digital-twins.git",
+    "directory": "packages/shared-types"
+  },
+  "homepage": "https://github.com/pome-sh/digital-twins/tree/main/packages/shared-types",
+  "bugs": {
+    "url": "https://github.com/pome-sh/digital-twins/issues"
+  },
+  "peerDependencies": {
+    "zod": "^4.1.13"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/node_modules/@pome-sh/twin-slack/node_modules/@pome-sh/shared-types/trace-contract.json

@@ -0,0 +1,41 @@
+{
+  "package": "@pome-sh/shared-types",
+  "version": "0.11.0",
+  "zod": {
+    "range": "^4.1.13",
+    "major": 4
+  },
+  "exports": {
+    "root": "@pome-sh/shared-types",
+    "recorderEvents": "@pome-sh/shared-types/recorder-events",
+    "run": "@pome-sh/shared-types/run",
+    "otel": "@pome-sh/shared-types/otel",
+    "redaction": "@pome-sh/shared-types/redaction"
+  },
+  "canonicalSchemas": [
+    "recorderEventSchema",
+    "eventSchema",
+    "otelEventSchema",
+    "runSchema"
+  ],
+  "fixtures": [
+    "test/fixtures/v1/createSessionRequest/multi-twin-permissive-seed-idempotency.json",
+    "test/fixtures/v1/createSessionRequest/scenario-source-github.json",
+    "test/fixtures/v1/createSessionRequest/stored-scenario.json",
+    "test/fixtures/v1/createSessionRequestTaskVocab/stored-task.json",
+    "test/fixtures/v1/createSessionRequestTaskVocab/task-source-github.json",
+    "test/fixtures/v1/createSessionResponse/full-multi-twin.json",
+    "test/fixtures/v1/createSessionResponse/legacy-single-twin.json",
+    "test/fixtures/v1/planTier/enterprise.json",
+    "test/fixtures/v1/planTier/free.json",
+    "test/fixtures/v1/planTier/hobby.json",
+    "test/fixtures/v1/planTier/pro.json",
+    "test/fixtures/v1/planTier/self_host_annual.json",
+    "test/fixtures/v1/planTier/team.json",
+    "test/fixtures/v1/run/full-production.json",
+    "test/fixtures/v1/run/legacy-minimal.json",
+    "test/fixtures/v1/runTaskVocab/full-production-task-vocab.json",
+    "test/fixtures/v1/usage/free-tier.json",
+    "test/fixtures/v1/usage/team-tier-exhausted.json"
+  ]
+}

package/node_modules/@pome-sh/twin-slack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/twin-slack",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Deterministic Slack Web API twin for agent testing — REST + MCP, SQLite-backed state.",
   "private": false,
   "type": "module",
@@ -33,9 +33,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@hono/node-server": "^2.0.8",
-    "@pome-sh/sdk": "0.4.0",
-    "@pome-sh/shared-types": "0.9.0",
+    "@hono/node-server": "^2.0.10",
+    "@pome-sh/sdk": "0.5.0",
+    "@pome-sh/shared-types": "0.11.0",
     "hono": "^4.12.27",
     "zod": "^4.1.13"
   },
@@ -49,12 +49,12 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/pome-sh/pome-twins.git",
+    "url": "git+https://github.com/pome-sh/digital-twins.git",
     "directory": "packages/twin-slack"
   },
-  "homepage": "https://github.com/pome-sh/pome-twins/tree/main/packages/twin-slack",
+  "homepage": "https://github.com/pome-sh/digital-twins/tree/main/packages/twin-slack",
   "bugs": {
-    "url": "https://github.com/pome-sh/pome-twins/issues"
+    "url": "https://github.com/pome-sh/digital-twins/issues"
   },
   "license": "Apache-2.0",
   "engines": {

package/node_modules/@pome-sh/twin-stripe/README.md

@@ -1,6 +1,6 @@
 # Pome Twin: Stripe x402
 
-> One of three twins in this repository (GitHub, Stripe x402, Slack).
+> One of four twins in this repository (GitHub, Stripe x402, Slack, Gmail).
 
 `@pome-sh/twin-stripe` is the only deterministic test double for **Stripe
 x402 machine payments**. Real Stripe sandbox doesn't auto-settle crypto

package/node_modules/@pome-sh/twin-stripe/dist/src/domain/stripe-domain.d.ts

@@ -414,7 +414,7 @@ export declare class StripeDomain {
         source_transfer: null;
         statement_descriptor: null;
         statement_descriptor_suffix: null;
-        status: "succeeded" | "pending" | "failed";
+        status: "failed" | "pending" | "succeeded";
         transfer_data: null;
         transfer_group: null;
     };
@@ -478,7 +478,7 @@ export declare class StripeDomain {
             source_transfer: null;
             statement_descriptor: null;
             statement_descriptor_suffix: null;
-            status: "succeeded" | "pending" | "failed";
+            status: "failed" | "pending" | "succeeded";
             transfer_data: null;
             transfer_group: null;
         }[];

package/node_modules/@pome-sh/twin-stripe/dist/src/seed.d.ts

@@ -39,9 +39,9 @@ declare const chargeSeedSchema: z.ZodObject<{
     amount_captured: z.ZodDefault<z.ZodNumber>;
     amount_refunded: z.ZodDefault<z.ZodNumber>;
     status: z.ZodEnum<{
-        succeeded: "succeeded";
-        pending: "pending";
         failed: "failed";
+        pending: "pending";
+        succeeded: "succeeded";
     }>;
     balance_transaction_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     captured: z.ZodDefault<z.ZodBoolean>;
@@ -56,10 +56,10 @@ declare const refundSeedSchema: z.ZodObject<{
     amount: z.ZodNumber;
     currency: z.ZodString;
     status: z.ZodEnum<{
+        failed: "failed";
+        pending: "pending";
         canceled: "canceled";
         succeeded: "succeeded";
-        pending: "pending";
-        failed: "failed";
     }>;
     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     balance_transaction_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -140,9 +140,9 @@ export declare const seedSchema: z.ZodObject<{
         amount_captured: z.ZodDefault<z.ZodNumber>;
         amount_refunded: z.ZodDefault<z.ZodNumber>;
         status: z.ZodEnum<{
-            succeeded: "succeeded";
-            pending: "pending";
             failed: "failed";
+            pending: "pending";
+            succeeded: "succeeded";
         }>;
         balance_transaction_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         captured: z.ZodDefault<z.ZodBoolean>;
@@ -157,10 +157,10 @@ export declare const seedSchema: z.ZodObject<{
         amount: z.ZodNumber;
         currency: z.ZodString;
         status: z.ZodEnum<{
+            failed: "failed";
+            pending: "pending";
             canceled: "canceled";
             succeeded: "succeeded";
-            pending: "pending";
-            failed: "failed";
         }>;
         reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         balance_transaction_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;

package/node_modules/@pome-sh/twin-stripe/dist/src/serializers.d.ts

@@ -102,7 +102,7 @@ export declare function chargeJson(row: ChargeRow): {
     source_transfer: null;
     statement_descriptor: null;
     statement_descriptor_suffix: null;
-    status: "succeeded" | "pending" | "failed";
+    status: "failed" | "pending" | "succeeded";
     transfer_data: null;
     transfer_group: null;
 };

package/node_modules/@pome-sh/twin-stripe/node_modules/@pome-sh/sdk/dist/admin-gate.d.ts

@@ -0,0 +1,35 @@
+import type { Context, MiddlewareHandler } from "hono";
+/** Context variable consulted first by getClientIp(). */
+export declare const CLIENT_IP_VAR = "pomeClientIp";
+/**
+ * Explicitly record the peer address for this request. Alternate serving
+ * bridges (or tests) call this from an upstream middleware so the gate never
+ * reaches into runtime-private internals.
+ *
+ * SECURITY: the value passed here MUST be the transport-level peer address
+ * (the socket's remote address as reported by the serving bridge). It takes
+ * precedence over getConnInfo, so deriving it from any request-controlled
+ * input — X-Forwarded-For or any other client-supplied header — would make
+ * the loopback-only admin gate spoofable by whoever sets that header. If you
+ * are behind a reverse proxy, use TWIN_ADMIN_TOKEN instead of trying to
+ * recover the "real" client IP.
+ */
+export declare function setClientIp(c: Context, ip: string): void;
+/**
+ * Runtime-neutral client-IP accessor (FDRS-587). Resolution order:
+ *   1. Explicit override set via setClientIp() (alternate bridges / tests).
+ *   2. The node serving bridge's official getConnInfo helper.
+ *   3. undefined — no live socket (e.g. app.request() in-process tests).
+ */
+export declare function getClientIp(c: Context): Promise<string | undefined>;
+export declare function isLoopbackAddress(remote: string): boolean;
+export interface AdminGateOptions {
+    /** 403 response factory so each twin keeps its own error envelope. */
+    forbidden?: () => Response;
+}
+/**
+ * Admin endpoint protection shared by every twin (FDRS-616). Each twin's
+ * auth.ts wraps this with its own `forbidden` envelope. Semantics are
+ * identical to the per-twin requireAdminAuth() copies this replaces.
+ */
+export declare function createAdminGate(options?: AdminGateOptions): MiddlewareHandler;

package/node_modules/@pome-sh/twin-stripe/node_modules/@pome-sh/sdk/dist/admin-gate.js

@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: Apache-2.0
+// Shared admin-endpoint gate (FDRS-587 / FDRS-616). First-party twins import
+// this through `@pome-sh/sdk/server`; do not copy this file into a twin package.
+//
+// Tiered policy (semantics unchanged from the per-twin copies it replaces):
+//   1. TWIN_ADMIN_TOKEN set → require X-Admin-Token to match (timing-safe).
+//   2. TWIN_ADMIN_TOKEN unset + client IP known → allow only loopback.
+//   3. TWIN_ADMIN_TOKEN unset + client IP unknown → deny in production,
+//      allow otherwise (accepted fail-open for in-process test harnesses).
+import { timingSafeEqual } from "node:crypto";
+/** Context variable consulted first by getClientIp(). */
+export const CLIENT_IP_VAR = "pomeClientIp";
+let nodeGetConnInfo;
+// Lazily import the node bridge's official ConnInfo helper. Dynamic because
+// @pome-sh/sdk declares @hono/node-server as an *optional* peer dependency —
+// a static import would crash consumers that never bind a Node socket.
+// Works with both @hono/node-server v1 and v2 (same subpath + signature).
+function loadNodeGetConnInfo() {
+    nodeGetConnInfo ??= import("@hono/node-server/conninfo").then((mod) => mod.getConnInfo, () => undefined);
+    return nodeGetConnInfo;
+}
+/**
+ * Explicitly record the peer address for this request. Alternate serving
+ * bridges (or tests) call this from an upstream middleware so the gate never
+ * reaches into runtime-private internals.
+ *
+ * SECURITY: the value passed here MUST be the transport-level peer address
+ * (the socket's remote address as reported by the serving bridge). It takes
+ * precedence over getConnInfo, so deriving it from any request-controlled
+ * input — X-Forwarded-For or any other client-supplied header — would make
+ * the loopback-only admin gate spoofable by whoever sets that header. If you
+ * are behind a reverse proxy, use TWIN_ADMIN_TOKEN instead of trying to
+ * recover the "real" client IP.
+ */
+export function setClientIp(c, ip) {
+    c.set(CLIENT_IP_VAR, ip);
+}
+/**
+ * Runtime-neutral client-IP accessor (FDRS-587). Resolution order:
+ *   1. Explicit override set via setClientIp() (alternate bridges / tests).
+ *   2. The node serving bridge's official getConnInfo helper.
+ *   3. undefined — no live socket (e.g. app.request() in-process tests).
+ */
+export async function getClientIp(c) {
+    const override = c.get(CLIENT_IP_VAR);
+    if (typeof override === "string" && override.length > 0)
+        return override;
+    const getConnInfo = await loadNodeGetConnInfo();
+    if (!getConnInfo)
+        return undefined;
+    try {
+        const address = getConnInfo(c).remote?.address;
+        return typeof address === "string" && address.length > 0 ? address : undefined;
+    }
+    catch {
+        // The helper throws when the context has no node socket behind it.
+        return undefined;
+    }
+}
+export function isLoopbackAddress(remote) {
+    return (remote === "127.0.0.1" ||
+        remote === "::1" ||
+        remote === "::ffff:127.0.0.1" ||
+        remote === "localhost");
+}
+function defaultForbidden() {
+    return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 403 });
+}
+/**
+ * Admin endpoint protection shared by every twin (FDRS-616). Each twin's
+ * auth.ts wraps this with its own `forbidden` envelope. Semantics are
+ * identical to the per-twin requireAdminAuth() copies this replaces.
+ */
+export function createAdminGate(options = {}) {
+    const forbidden = options.forbidden ?? defaultForbidden;
+    return async (c, next) => {
+        const adminToken = process.env.TWIN_ADMIN_TOKEN;
+        if (adminToken && adminToken.length > 0) {
+            // Web Headers lookups are case-insensitive, so one lookup covers every
+            // casing a client might send.
+            const provided = c.req.header("X-Admin-Token");
+            if (!provided)
+                return forbidden();
+            const a = Buffer.from(provided);
+            const b = Buffer.from(adminToken);
+            if (a.length !== b.length || !timingSafeEqual(a, b))
+                return forbidden();
+            await next();
+            return;
+        }
+        const remote = await getClientIp(c);
+        if (!remote) {
+            if (process.env.NODE_ENV === "production")
+                return forbidden();
+            await next();
+            return;
+        }
+        if (!isLoopbackAddress(remote))
+            return forbidden();
+        await next();
+    };
+}
+//# sourceMappingURL=admin-gate.js.map

package/node_modules/@pome-sh/twin-stripe/node_modules/@pome-sh/sdk/dist/admin-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-gate.js","sourceRoot":"","sources":["../src/admin-gate.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6EAA6E;AAC7E,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,2EAA2E;AAG3E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,yDAAyD;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAO5C,IAAI,eAA+D,CAAC;AAEpE,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,0EAA0E;AAC1E,SAAS,mBAAmB;IAC1B,eAAe,KAAK,MAAM,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAC3D,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAuC,EACpD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,CAAU,EAAE,EAAU;IAC/C,CAA0B,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAU;IAC1C,MAAM,QAAQ,GAAI,CAA0B,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzE,MAAM,WAAW,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAChD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/C,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,CACL,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,KAAK;QAChB,MAAM,KAAK,kBAAkB;QAC7B,MAAM,KAAK,WAAW,CACvB,CAAC;AACJ,CAAC;AAOD,SAAS,gBAAgB;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAChD,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,uEAAuE;YACvE,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAAE,OAAO,SAAS,EAAE,CAAC;YAC9D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/@pome-sh/twin-stripe/node_modules/@pome-sh/sdk/dist/auth.d.ts

@@ -0,0 +1,100 @@
+import type { Context, MiddlewareHandler } from "hono";
+/** `team_id` stamped on sessions authenticated by a provider-shaped token. */
+export declare const PROVIDER_SHAPED_TEAM_ID = "provider-shaped";
+export interface SessionClaims {
+    sid: string;
+    team_id: string;
+    exp: number;
+    [claim: string]: unknown;
+}
+/** Minimum session value; twins extend it via hooks (login, account_id, …). */
+export type SessionValue = {
+    sid: string;
+} & Record<string, unknown>;
+export declare function resolveAuthSecret(): string;
+export interface ProviderTokenSpec {
+    /** HMAC domain separator ("github" | "slack" | "stripe" | …). */
+    provider: string;
+    /** Declared token prefixes, e.g. ["xoxb-pome-", "xoxp-pome-"]. */
+    prefixes: readonly string[];
+}
+export interface MintProviderTokenOptions {
+    sid: string;
+    /** Unix-seconds expiry. Omit for the legacy non-expiring shape. */
+    exp?: number;
+    /** Defaults to the spec's first declared prefix. */
+    prefix?: string;
+    secret?: string;
+}
+/**
+ * Mint a provider-shaped token (F-712 row 10: minting lives in the engine;
+ * CLI + cloud mint through it, parameterized by the twin's declared shape).
+ */
+export declare function mintProviderToken(spec: ProviderTokenSpec, options: MintProviderTokenOptions): string;
+/**
+ * Verify a provider-shaped token; returns the sid on success.
+ *
+ * The parse is right-anchored — the signature is always the trailing 22
+ * base64url chars, the optional exp is a trailing all-digit segment of the
+ * remainder — and the HMAC disambiguates the exp-vs-sid split. This fixes
+ * the F-712 appendix bug once: the old per-twin `([^_]+)` regexes broke for
+ * any sid whose base64url encoding contains `_` (the alphabet includes it).
+ */
+export declare function verifyProviderToken(spec: ProviderTokenSpec, token: string, secret?: string): string | undefined;
+/** Why a request failed auth; rendered by the twin's `unauthorized` hook. */
+export type UnauthorizedKind = "no_token" | "invalid" | "expired";
+export interface AuthEnvelope {
+    status: number;
+    body: unknown;
+}
+/** Extra token location (F-712 row 3). Returns the token or undefined. */
+export type TokenResolver = (c: Context) => string | undefined | Promise<string | undefined>;
+/** Accept `?<param>=<token>` in the query string (real Slack behavior). */
+export declare function queryTokenResolver(param?: string): TokenResolver;
+/**
+ * Accept `<param>=<token>` in a form-encoded POST body (real Slack
+ * behavior). Only parses when the content type is form-encoded, so JSON
+ * streaming reads downstream are never consumed here; `parseBody()` caches
+ * on the Hono context, so downstream handlers see the same object.
+ */
+export declare function formTokenResolver(param?: string): TokenResolver;
+export interface BearerAuthOptions {
+    /** Row 1: the twin's provider-shaped token declaration. */
+    providerToken?: ProviderTokenSpec;
+    /** Row 7: extra session fields for provider-shaped sessions. */
+    providerSession?: (sid: string) => Record<string, unknown>;
+    /** Row 3: extra token locations tried after the Authorization header. */
+    tokenResolvers?: readonly TokenResolver[];
+    /**
+     * Row 4 pin: accept a prefix-less bearer and case-insensitive "bearer".
+     * Default false (github/slack); stripe pins true. Flipping a twin is a
+     * contract change (CONTRACT.md + suite, then a cloud consumer PR).
+     */
+    allowRawBearer?: boolean;
+    /**
+     * Row 9: when false, a request with no `:sid` path segment trusts the
+     * bearer alone (stripe's root `/v1/*` SDK-compat mount). Default true.
+     */
+    requirePathSid?: boolean;
+    /** Row 8: DB-backed credential lookup, consulted before provider/JWT. */
+    resolveCredential?: (token: string, c: Context) => SessionValue | undefined | Promise<SessionValue | undefined>;
+    /**
+     * Rows 2 + 6: the twin's 401 envelope, keyed by failure classification.
+     * `info.token` carries the presented credential so a twin can render
+     * shape-dependent messages (stripe: api-key-shaped tokens answer
+     * "Invalid API Key provided.", JWTs answer "Bad credentials").
+     */
+    unauthorized?: (kind: UnauthorizedKind, info?: {
+        token?: string;
+    }) => AuthEnvelope;
+    /** Row 5 pin: the twin's sid-mismatch envelope (github/slack 401, stripe 403). */
+    sidMismatch?: () => AuthEnvelope;
+    /** Row 7: extra session fields derived from verified JWT claims. */
+    sessionExtras?: (claims: SessionClaims) => Record<string, unknown>;
+}
+export declare function bearerAuth(options?: BearerAuthOptions): MiddlewareHandler;
+/**
+ * Admin endpoint protection. Thin wrapper over the shared admin-gate module
+ * (FDRS-587 / FDRS-616) using the default error envelope.
+ */
+export declare function requireAdminAuth(): MiddlewareHandler;