@pome-sh/cli 0.20.0 → 0.21.1

package/node_modules/@pome-sh/sdk/dist/db.js

@@ -1,113 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//
-// Engine SQLite driver wrapper (F-681), backed by node:sqlite since F-703 —
-// zero native deps, no compiler toolchain at install. Twins never import a
-// sqlite driver directly — they call `openTwinDatabase()` and consume the
-// `TwinDatabase` interface below. The interface keeps better-sqlite3's shape
-// (prepare/exec/pragma/transaction/close) because twin domain code has dozens
-// of call sites relying on it; node:sqlite ships no pragma()/transaction()
-// equivalents, so this file emulates them: `pragma()` prepares a `PRAGMA …`
-// statement, `transaction(fn)` (+ `.immediate`) wraps fn in explicit
-// BEGIN [IMMEDIATE]/COMMIT/ROLLBACK at the outermost level and in a SAVEPOINT
-// when called inside an open transaction — better-sqlite3's nesting semantics,
-// which twin-github's seed() relies on (it wraps createIssue et al., each of
-// which opens its own transaction).
-import { mkdirSync } from "node:fs";
-import { dirname } from "node:path";
-import { DatabaseSync } from "node:sqlite";
-class NodeSqliteTwinDatabase {
-    #db;
-    #savepointId = 0;
-    constructor(path) {
-        this.#db = new DatabaseSync(path);
-    }
-    prepare(sql) {
-        const statement = this.#db.prepare(sql);
-        return {
-            run: (...params) => {
-                const result = statement.run(...params);
-                return { changes: Number(result.changes), lastInsertRowid: result.lastInsertRowid };
-            },
-            get: (...params) => statement.get(...params),
-            all: (...params) => statement.all(...params),
-        };
-    }
-    exec(sql) {
-        this.#db.exec(sql);
-    }
-    pragma(statement, options = {}) {
-        const rows = this.#db.prepare(`PRAGMA ${statement}`).all();
-        if (!options.simple)
-            return rows;
-        const row = rows[0];
-        if (row === undefined)
-            return undefined;
-        return row[Object.keys(row)[0]];
-    }
-    transaction(fn) {
-        const wrap = (begin) => ((...args) => {
-            if (this.#db.isTransaction)
-                return this.#nested(fn, args);
-            this.#db.exec(begin);
-            try {
-                const out = fn(...args);
-                this.#db.exec("COMMIT");
-                return out;
-            }
-            catch (error) {
-                // Certain failures (e.g. ON CONFLICT ROLLBACK) end the transaction
-                // themselves — only roll back when one is still open.
-                if (this.#db.isTransaction)
-                    this.#db.exec("ROLLBACK");
-                throw error;
-            }
-        });
-        const tx = wrap("BEGIN");
-        tx.immediate = wrap("BEGIN IMMEDIATE");
-        return tx;
-    }
-    /**
-     * A transaction function called inside an open transaction joins it under a
-     * SAVEPOINT (better-sqlite3's semantics): success releases the savepoint,
-     * failure rolls back only the inner work. The BEGIN variant is irrelevant
-     * here — the outermost transaction already holds the lock mode.
-     */
-    #nested(fn, args) {
-        const name = `_pome_tx_${this.#savepointId++}`;
-        this.#db.exec(`SAVEPOINT ${name}`);
-        try {
-            const out = fn(...args);
-            this.#db.exec(`RELEASE ${name}`);
-            return out;
-        }
-        catch (error) {
-            if (this.#db.isTransaction) {
-                this.#db.exec(`ROLLBACK TO ${name}`);
-                this.#db.exec(`RELEASE ${name}`);
-            }
-            throw error;
-        }
-    }
-    close() {
-        if (this.#db.isOpen)
-            this.#db.close();
-    }
-}
-/**
- * Open a twin database with the pome pragma set applied:
- * `busy_timeout = 5000`, `journal_mode = WAL` (file-backed), and
- * `foreign_keys = ON` — the exact pragmas every twin's hand-rolled db.ts
- * applied before F-681 centralized them.
- */
-export function openTwinDatabase(path = ":memory:", options = {}) {
-    if (path !== ":memory:") {
-        mkdirSync(dirname(path), { recursive: true });
-    }
-    const db = new NodeSqliteTwinDatabase(path);
-    db.exec("PRAGMA busy_timeout = 5000");
-    db.exec("PRAGMA journal_mode = WAL");
-    db.exec("PRAGMA foreign_keys = ON");
-    options.migrate?.(db);
-    return db;
-}
-//# sourceMappingURL=db.js.map

package/node_modules/@pome-sh/sdk/dist/db.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,qEAAqE;AACrE,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,oCAAoC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwC3C,MAAM,sBAAsB;IACjB,GAAG,CAAe;IAC3B,YAAY,GAAG,CAAC,CAAC;IAEjB,YAAY,IAAY;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAExC,OAAO;YACL,GAAG,EAAE,CAAC,GAAG,MAAiB,EAAiB,EAAE;gBAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAI,MAAiB,CAAC,CAAC;gBACpD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;YACtF,CAAC;YACD,GAAG,EAAE,CAAC,GAAG,MAAiB,EAAW,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAI,MAAiB,CAAC;YAC5E,GAAG,EAAE,CAAC,GAAG,MAAiB,EAAa,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAI,MAAiB,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAW;QACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,SAAiB,EAAE,UAAgC,EAAE;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC,GAAG,EAAoC,CAAC;QAC7F,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IAC5C,CAAC;IAED,WAAW,CAA0C,EAAK;QACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAK,EAAE,CAChC,CAAC,CAAC,GAAG,IAAa,EAAE,EAAE;YACpB,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACxB,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mEAAmE;gBACnE,sDAAsD;gBACtD,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAM,CAAC;QACV,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAuB,CAAC;QAC/C,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAA0C,EAAK,EAAE,IAAa;QACnE,MAAM,IAAI,GAAG,YAAY,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACjC,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAI,GAAG,UAAU,EACjB,UAAmC,EAAE;IAErC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC5C,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACtC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACpC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/node_modules/@pome-sh/sdk/dist/errors.d.ts

@@ -1,24 +0,0 @@
-export declare class TwinError extends Error {
-    readonly status: number;
-    readonly errors?: unknown[] | undefined;
-    constructor(message: string, status: number, errors?: unknown[] | undefined);
-}
-/**
- * Thrown by the SDK's tool dispatch routes (`/mcp/call`,
- * `/mcp/tools/:name`, JSON-RPC `tools/call`) when the named tool is not in
- * the registry. A distinct class so a twin's `errorEnvelope` hook can shape
- * the frozen per-twin wire format (slack 404 `unknown_tool`, stripe 400
- * `tool_unknown`, …) without string-matching messages.
- */
-export declare class UnknownToolError extends TwinError {
-    readonly tool: string;
-    constructor(tool: string, status?: number);
-}
-export interface ErrorEnvelope {
-    status: number;
-    body: {
-        message: string;
-        errors?: unknown[];
-    };
-}
-export declare function envelopeFor(error: unknown): ErrorEnvelope;

package/node_modules/@pome-sh/sdk/dist/errors.js

@@ -1,61 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//
-// Generic SDK error envelope. Twin authors can throw `TwinError` from
-// handlers to surface a non-200 response with a custom message; the
-// recorder middleware unwraps it into the standard envelope and records
-// the error string per recording-spec.md v1.0.
-import { z } from "zod";
-export class TwinError extends Error {
-    status;
-    errors;
-    constructor(message, status, errors) {
-        super(message);
-        this.status = status;
-        this.errors = errors;
-        this.name = "TwinError";
-    }
-}
-/**
- * Thrown by the SDK's tool dispatch routes (`/mcp/call`,
- * `/mcp/tools/:name`, JSON-RPC `tools/call`) when the named tool is not in
- * the registry. A distinct class so a twin's `errorEnvelope` hook can shape
- * the frozen per-twin wire format (slack 404 `unknown_tool`, stripe 400
- * `tool_unknown`, …) without string-matching messages.
- */
-export class UnknownToolError extends TwinError {
-    tool;
-    constructor(tool, status = 404) {
-        super(`Unknown tool: ${tool}`, status);
-        this.tool = tool;
-        this.name = "UnknownToolError";
-    }
-}
-export function envelopeFor(error) {
-    if (error instanceof TwinError) {
-        return {
-            status: error.status,
-            body: { message: error.message, ...(error.errors ? { errors: error.errors } : {}) },
-        };
-    }
-    if (error instanceof z.ZodError) {
-        return {
-            status: 422,
-            body: {
-                message: "Validation Failed",
-                errors: error.issues.map((issue) => ({
-                    field: issue.path.join("."),
-                    code: issue.code,
-                    message: issue.message,
-                })),
-            },
-        };
-    }
-    if (error instanceof SyntaxError) {
-        return { status: 400, body: { message: "Problems parsing JSON" } };
-    }
-    return {
-        status: 500,
-        body: { message: error instanceof Error ? error.message : "Internal Server Error" },
-    };
-}
-//# sourceMappingURL=errors.js.map

package/node_modules/@pome-sh/sdk/dist/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,+CAA+C;AAE/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,MAAkB;QAE3B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAY;QAG3B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IACxB;IAArB,YAAqB,IAAY,EAAE,MAAM,GAAG,GAAG;QAC7C,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QADpB,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAOD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACpF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACnC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;oBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;aACJ;SACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC;IACrE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE;KACpF,CAAC;AACJ,CAAC"}

package/node_modules/@pome-sh/sdk/dist/failure-injection.d.ts

@@ -1,43 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import { z } from "zod";
-import type { RecorderEvent } from "@pome-sh/shared-types";
-export declare const FAILURE_INJECTION_OVERRIDE_KEY = "failureInjectionOverride";
-export type FailureInjectionOverride = {
-    status: number;
-    body: unknown;
-};
-export type FailureInjectionMode = "before_handler" | "after_handler";
-export type FailureInjectionRule = {
-    method: string;
-    path: string;
-    attempt: number;
-    mode: FailureInjectionMode;
-    status: number;
-    body: unknown;
-};
-export declare const failureInjectionRuleSchema: z.ZodObject<{
-    method: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    path: z.ZodString;
-    attempt: z.ZodNumber;
-    mode: z.ZodDefault<z.ZodEnum<{
-        before_handler: "before_handler";
-        after_handler: "after_handler";
-    }>>;
-    status: z.ZodNumber;
-    body: z.ZodUnknown;
-}, z.core.$strip>;
-export type FailureInjectionStore = {
-    setRules(rules: FailureInjectionRule[]): void;
-    clear(): void;
-    matchAndConsume(accountId: string, method: string, path: string): FailureInjectionRule | null;
-};
-export declare function createFailureInjectionStore(): FailureInjectionStore;
-export interface FailureInjectionMiddlewareOptions {
-    /** Sink for before_handler events. Optional — a recorderless app still injects. */
-    recorder?: {
-        record(event: RecorderEvent): void;
-    };
-    runId: string;
-    twin: string;
-}
-export declare function failureInjectionMiddleware(store: FailureInjectionStore, options: FailureInjectionMiddlewareOptions): MiddlewareHandler;

package/node_modules/@pome-sh/sdk/dist/failure-injection.js

@@ -1,167 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//
-// Scenario-level failure injection (FDRS-339), graduated from twin-stripe
-// into the engine by the F-684 port ruling: making a twin fail on attempt N
-// of a (method, path) tuple is a generic twin capability — any provider
-// double needs "the server processed it but the client never saw the
-// response" to reproduce lost-response retry bugs. Only the rule *payloads*
-// (status + error envelope) are twin-domain; they ride in via the seed.
-//
-// Two modes:
-//
-//   - `before_handler` → the matched request never reaches the route
-//     handler; the middleware returns the configured envelope directly and
-//     records a `state_mutation: false`, `state_delta: null` event.
-//   - `after_handler` → the handler is invoked normally (state mutation
-//     and `state_delta` capture proceed). The middleware parks the override
-//     on the context under `FAILURE_INJECTION_OVERRIDE_KEY`; the twin's
-//     response path substitutes status + body on the way out, so the
-//     recorded event and the wire agree. This models a "server processed
-//     but response delivery failed" failure — required to reproduce the
-//     FDRS-316 hero scenario.
-//
-// Counters live per `(account_id, method, path)` so successive POSTs from
-// the same account to the same path resolve to `attempt: 1`, `attempt: 2`,
-// …, deterministically. Other routes don't influence the counter — only
-// requests to a tuple that has at least one registered rule are counted.
-import { randomUUID } from "node:crypto";
-import { z } from "zod";
-import { recordedRequestHeaders } from "./request-capture.js";
-export const FAILURE_INJECTION_OVERRIDE_KEY = "failureInjectionOverride";
-export const failureInjectionRuleSchema = z.object({
-    method: z.string().min(1).transform((s) => s.toUpperCase()),
-    path: z.string().min(1),
-    attempt: z.number().int().positive(),
-    mode: z
-        .enum(["before_handler", "after_handler"])
-        .default("after_handler"),
-    status: z.number().int().min(100).max(599),
-    body: z.unknown(),
-});
-export function createFailureInjectionStore() {
-    // The store is intentionally global across accounts. The (account_id,
-    // method, path) counter keys keep accounts independent for matching;
-    // rules themselves apply to whichever account issues the matching
-    // request. Single-account scenarios (the common case, including the
-    // FDRS-316 hero) don't need to express scope per rule.
-    let rules = [];
-    const counters = new Map();
-    const tuplesWithRules = new Set();
-    function tupleKey(method, path) {
-        return `${method.toUpperCase()}\0${path}`;
-    }
-    function counterKey(accountId, method, path) {
-        return `${accountId}\0${method.toUpperCase()}\0${path}`;
-    }
-    function rebuildIndex() {
-        tuplesWithRules.clear();
-        for (const r of rules)
-            tuplesWithRules.add(tupleKey(r.method, r.path));
-    }
-    return {
-        setRules(next) {
-            rules = next.slice();
-            counters.clear();
-            rebuildIndex();
-        },
-        clear() {
-            rules = [];
-            counters.clear();
-            tuplesWithRules.clear();
-        },
-        matchAndConsume(accountId, method, path) {
-            const tk = tupleKey(method, path);
-            if (!tuplesWithRules.has(tk))
-                return null;
-            const ck = counterKey(accountId, method, path);
-            const count = (counters.get(ck) ?? 0) + 1;
-            counters.set(ck, count);
-            return (rules.find((r) => r.method.toUpperCase() === method.toUpperCase() &&
-                r.path === path &&
-                r.attempt === count) ?? null);
-        },
-    };
-}
-export function failureInjectionMiddleware(store, options) {
-    return async (c, next) => {
-        const session = c.get("session");
-        // Auth runs first; if it failed there's no session and we shouldn't
-        // shadow that with a manufactured failure.
-        if (!session) {
-            await next();
-            return;
-        }
-        const accountId = typeof session.account_id === "string" ? session.account_id : String(session.sid ?? "_anon");
-        const method = c.req.method.toUpperCase();
-        const rawPath = new URL(c.req.url).pathname;
-        // Rules are written against the canonical provider path
-        // (e.g., "/v1/refunds"). Strip the session prefix when present so
-        // path-mounted (`/s/:sid/v1/refunds`) and root-mounted (`/v1/refunds`,
-        // stripe F3 SDK compat) requests both match.
-        const path = stripSessionPrefix(rawPath);
-        const rule = store.matchAndConsume(accountId, method, path);
-        if (!rule) {
-            await next();
-            return;
-        }
-        if (rule.mode === "before_handler") {
-            const started = Date.now();
-            let requestBody = null;
-            try {
-                requestBody = await c.req.raw.clone().text();
-            }
-            catch {
-                requestBody = null;
-            }
-            const requestId = `req_${randomUUID()}`;
-            const stepId = c.req.header("x-pome-scenario-step-id") ?? null;
-            options.recorder?.record({
-                ts: new Date().toISOString(),
-                run_id: options.runId,
-                twin: options.twin,
-                request_id: requestId,
-                correlation_id: c.req.header("x-pome-correlation-id") ?? requestId,
-                task_step_id: stepId,
-                scenario_step_id: stepId,
-                step_id: null,
-                tool_call_id: null,
-                method,
-                path: rawPath,
-                request_body: requestBody,
-                // F-1125 — same capture policy as the engine's emit(); an injected
-                // fault must not be the one row a header-reading check cannot see.
-                request_headers: recordedRequestHeaders(c),
-                // Injection is transport-level: it intercepts a (method, path) tuple,
-                // never a declared twin action.
-                tool: null,
-                status: rule.status,
-                response_body: rule.body,
-                latency_ms: Date.now() - started,
-                fidelity: "semantic",
-                state_mutation: false,
-                state_delta: null,
-                error: rule.status >= 400 ? errorMessage(rule.body) : null,
-            });
-            return c.json(rule.body, rule.status);
-        }
-        // after_handler: let the handler run, but stash the override so the
-        // twin's response path can substitute status + body on the way out.
-        // state_mutation + state_delta keep the real-handler truth.
-        const override = { status: rule.status, body: rule.body };
-        c.set(FAILURE_INJECTION_OVERRIDE_KEY, override);
-        await next();
-    };
-}
-function stripSessionPrefix(path) {
-    const match = path.match(/^\/s\/[^/]+(\/.*)$/);
-    return match?.[1] ?? path;
-}
-function errorMessage(body) {
-    if (body && typeof body === "object" && "error" in body) {
-        const err = body.error;
-        if (err && typeof err.message === "string")
-            return err.message;
-    }
-    return "request failed";
-}
-//# sourceMappingURL=failure-injection.js.map

package/node_modules/@pome-sh/sdk/dist/failure-injection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"failure-injection.js","sourceRoot":"","sources":["../src/failure-injection.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,qEAAqE;AACrE,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,aAAa;AACb,EAAE;AACF,qEAAqE;AACrE,2EAA2E;AAC3E,oEAAoE;AACpE,wEAAwE;AACxE,4EAA4E;AAC5E,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,8BAA8B;AAC9B,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AAkBzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAoD,CAAC;SAC5F,OAAO,CAAC,eAAe,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CAClB,CAAC,CAAC;AAYH,MAAM,UAAU,2BAA2B;IACzC,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,KAAK,GAA2B,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;QAC5C,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,SAAS,UAAU,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAY;QACjE,OAAO,GAAG,SAAS,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;IAC1D,CAAC;IACD,SAAS,YAAY;QACnB,eAAe,CAAC,KAAK,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,QAAQ,CAAC,IAAI;YACX,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,YAAY,EAAE,CAAC;QACjB,CAAC;QACD,KAAK;YACH,KAAK,GAAG,EAAE,CAAC;YACX,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI;YACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxB,OAAO,CACL,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE;gBAC/C,CAAC,CAAC,IAAI,KAAK,IAAI;gBACf,CAAC,CAAC,OAAO,KAAK,KAAK,CACtB,IAAI,IAAI,CACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,0BAA0B,CACxC,KAA4B,EAC5B,OAA0C;IAE1C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAwD,CAAC;QACxF,oEAAoE;QACpE,2CAA2C;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GACb,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;QAE/F,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC5C,wDAAwD;QACxD,kEAAkE;QAClE,uEAAuE;QACvE,6CAA6C;QAC7C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEzC,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,WAAW,GAAY,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,UAAU,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC;YAC/D,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACvB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,MAAM,EAAE,OAAO,CAAC,KAAK;gBACrB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,SAAS;gBACrB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,IAAI,SAAS;gBAClE,YAAY,EAAE,MAAM;gBACpB,gBAAgB,EAAE,MAAM;gBACxB,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,IAAI;gBAClB,MAAM;gBACN,IAAI,EAAE,OAAO;gBACb,YAAY,EAAE,WAAW;gBACzB,mEAAmE;gBACnE,mEAAmE;gBACnE,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;gBAC1C,sEAAsE;gBACtE,gCAAgC;gBAChC,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa,EAAE,IAAI,CAAC,IAAI;gBACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,QAAQ,EAAE,UAAU;gBACpB,cAAc,EAAE,KAAK;gBACrB,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;aAC3D,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAa,EAAE,IAAI,CAAC,MAAe,CAAC,CAAC;QAC1D,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,4DAA4D;QAC5D,MAAM,QAAQ,GAA6B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACpF,CAAC,CAAC,GAAG,CAAC,8BAAuC,EAAE,QAAiB,CAAC,CAAC;QAClE,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACxD,MAAM,GAAG,GAAI,IAAyC,CAAC,KAAK,CAAC;QAC7D,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACjE,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

package/node_modules/@pome-sh/sdk/dist/fidelity-inventory.d.ts

@@ -1,121 +0,0 @@
-import { z } from "zod";
-export declare const heatTierSchema: z.ZodEnum<{
-    hot: "hot";
-    warm: "warm";
-    cold: "cold";
-    unclassified: "unclassified";
-}>;
-export type HeatTier = z.infer<typeof heatTierSchema>;
-export declare const fidelitySurfaceSchema: z.ZodObject<{
-    name: z.ZodString;
-    heat: z.ZodEnum<{
-        hot: "hot";
-        warm: "warm";
-        cold: "cold";
-        unclassified: "unclassified";
-    }>;
-    fidelity: z.ZodEnum<{
-        semantic: "semantic";
-        unsupported: "unsupported";
-        shape: "shape";
-    }>;
-    justification: z.ZodString;
-}, z.core.$strict>;
-export type FidelitySurface = z.infer<typeof fidelitySurfaceSchema>;
-export declare const fidelityDocDriftSchema: z.ZodObject<{
-    kind: z.ZodEnum<{
-        tool: "tool";
-        rest: "rest";
-    }>;
-    name: z.ZodString;
-    reason: z.ZodString;
-    ticket: z.ZodString;
-}, z.core.$strict>;
-export type FidelityDocDrift = z.infer<typeof fidelityDocDriftSchema>;
-export declare const fidelityInventorySchema: z.ZodObject<{
-    twin: z.ZodString;
-    package: z.ZodString;
-    updated: z.ZodString;
-    notes: z.ZodOptional<z.ZodString>;
-    tools: z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        heat: z.ZodEnum<{
-            hot: "hot";
-            warm: "warm";
-            cold: "cold";
-            unclassified: "unclassified";
-        }>;
-        fidelity: z.ZodEnum<{
-            semantic: "semantic";
-            unsupported: "unsupported";
-            shape: "shape";
-        }>;
-        justification: z.ZodString;
-    }, z.core.$strict>>;
-    rest: z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        heat: z.ZodEnum<{
-            hot: "hot";
-            warm: "warm";
-            cold: "cold";
-            unclassified: "unclassified";
-        }>;
-        fidelity: z.ZodEnum<{
-            semantic: "semantic";
-            unsupported: "unsupported";
-            shape: "shape";
-        }>;
-        justification: z.ZodString;
-    }, z.core.$strict>>;
-    doc_drift: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        kind: z.ZodEnum<{
-            tool: "tool";
-            rest: "rest";
-        }>;
-        name: z.ZodString;
-        reason: z.ZodString;
-        ticket: z.ZodString;
-    }, z.core.$strict>>>;
-}, z.core.$strict>;
-export type FidelityInventory = z.infer<typeof fidelityInventorySchema>;
-export declare function loadFidelityInventory(path: string): FidelityInventory;
-export interface FidelityDocRow {
-    name: string;
-    fidelity: string;
-    /** Present only when the table carries the optional Heat column. */
-    heat?: string;
-}
-export interface FidelityDocSource {
-    /** Shown in lint problems, e.g. "FIDELITY.md". */
-    label: string;
-    kind: "tool" | "rest";
-    markdown: string;
-}
-/**
- * Expand one name cell into surface names. Backticked spans are the names;
- * a span with no `.`, `/`, or space is shorthand for a sibling of the first
- * span (Slack-style `` `reactions.add` / `remove` / `get` ``) and inherits
- * its dotted prefix. Cells with no backticks name the surface verbatim
- * (e.g. "Any unsupported path").
- */
-export declare function expandSurfaceCell(cell: string): string[];
-/**
- * Parse every markdown table whose header names surfaces of `kind` + Tier.
- * The Heat column (ENDPOINT-TIERS.md) is optional: parsed when the header
- * names it, omitted otherwise, so pre-heat tables stay legal.
- */
-export declare function parseFidelityDocRows(markdown: string, kind: "tool" | "rest"): FidelityDocRow[];
-/**
- * 1:1-lint the inventory against the FIDELITY doc tables. Returns human-
- * readable problems (empty = clean). Directions checked per kind:
- * every doc row must be in the inventory with the same fidelity tier, and
- * every inventory entry must be documented unless a `doc_drift` entry
- * (with its owning ticket) declares the gap. A drift declaration whose
- * name IS documented is stale and reported, so drift entries self-expire.
- */
-export declare function lintFidelityInventory(inventory: FidelityInventory, docs: FidelityDocSource[]): string[];
-/** Set-compare tool names: inventory vs the live `listTools()` surface. */
-export declare function compareToolNames(inventoryNames: string[], liveNames: string[]): {
-    missing: string[];
-    extra: string[];
-};