@pome-sh/cli 0.5.0 → 0.7.0

package/node_modules/@pome-sh/twin-stripe/node_modules/@pome-sh/sdk/dist/server-helpers.js

@@ -1,181 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-//
-// Internal helpers for `@pome-sh/sdk/server` (`createApp`/`serve`). Split
-// out of server.ts (F-685) purely for module-size hygiene; everything a twin
-// may import (TwinBootError, isLoopbackHost) is re-exported from server.ts,
-// which stays the only public entry.
-import { randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { RESERVED_SESSION_PREFIXES } from "./index.js";
-import { UnknownToolError } from "./errors.js";
-export class TwinBootError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "TwinBootError";
-    }
-}
-/** Engine-owned `/_pome/*` route names a twin's `pomeRoutes` may not shadow. */
-export const POME_CORE_ROUTE_NAMES = new Set(["health", "state", "events"]);
-export function makeDeltaSink() {
-    let delta = null;
-    return {
-        report(d) {
-            delta = d;
-        },
-        value() {
-            return delta;
-        },
-    };
-}
-/** Hostnames the boot guard treats as loopback binds. */
-export function isLoopbackHost(value) {
-    return value === "127.0.0.1" || value === "::1" || value === "localhost";
-}
-/**
- * F-708: self-generate `TWIN_AUTH_SECRET` on first boot. An env-injected
- * secret always wins (pome-cloud injects per-tenant secrets — that contract
- * is untouched), and loopback binds keep the dev-fallback path. Otherwise
- * the secret persisted at the compose-era contract location
- * `.pome-data/<twin>/secret` (cwd-relative; `POME_TWIN_DATA_DIR` overrides
- * the directory) is reused, or a fresh 32-byte hex secret is generated,
- * persisted there, and printed once to stdout so the operator can mint JWTs.
- *
- * The resolved secret lands in `process.env.TWIN_AUTH_SECRET`, which is
- * process-global by design: the engine's auth (`resolveAuthSecret`) reads
- * the env, so one process serves one secret — the frozen boot contract is
- * one twin per process, and a multi-twin process shares the first secret.
- */
-export function ensureTwinAuthSecret(twin, host) {
-    if (process.env.TWIN_AUTH_SECRET)
-        return;
-    if (isLoopbackHost(host))
-        return;
-    const dataDir = process.env.POME_TWIN_DATA_DIR || join(".pome-data", twin);
-    const secretPath = join(dataDir, "secret");
-    try {
-        const persisted = readSecretFile(secretPath);
-        if (persisted) {
-            process.env.TWIN_AUTH_SECRET = persisted;
-            console.log(`[twin-${twin}] TWIN_AUTH_SECRET not set — using the persisted secret from ${secretPath}`);
-            return;
-        }
-        const secret = randomBytes(32).toString("hex");
-        mkdirSync(dataDir, { recursive: true });
-        try {
-            // Compose-era file format: hex secret + trailing newline, owner-only.
-            // "wx" never clobbers a secret written by a concurrent first boot.
-            writeFileSync(secretPath, `${secret}\n`, { mode: 0o600, flag: "wx" });
-        }
-        catch (err) {
-            if (err.code !== "EEXIST")
-                throw err;
-            const winner = readSecretFile(secretPath);
-            if (winner) {
-                process.env.TWIN_AUTH_SECRET = winner;
-                console.log(`[twin-${twin}] TWIN_AUTH_SECRET not set — using the persisted secret from ${secretPath}`);
-                return;
-            }
-            // A blank file is an aborted earlier write: remove it and retry the
-            // exclusive write, so a concurrent booter losing this second race
-            // adopts the winner's secret instead of overwriting it.
-            rmSync(secretPath, { force: true });
-            try {
-                writeFileSync(secretPath, `${secret}\n`, { mode: 0o600, flag: "wx" });
-            }
-            catch (err2) {
-                if (err2.code !== "EEXIST")
-                    throw err2;
-                const late = readSecretFile(secretPath);
-                if (!late)
-                    throw err2;
-                process.env.TWIN_AUTH_SECRET = late;
-                console.log(`[twin-${twin}] TWIN_AUTH_SECRET not set — using the persisted secret from ${secretPath}`);
-                return;
-            }
-        }
-        process.env.TWIN_AUTH_SECRET = secret;
-        console.log(`[twin-${twin}] TWIN_AUTH_SECRET not set — generated ${secret} (persisted to ${secretPath}; subsequent boots reuse it, an env-injected TWIN_AUTH_SECRET overrides it)`);
-    }
-    catch (err) {
-        if (err instanceof TwinBootError)
-            throw err;
-        throw new TwinBootError(`TWIN_AUTH_SECRET is not set and self-generating one at ${secretPath} failed: ${err.message}`);
-    }
-}
-/** The persisted secret, trimmed; undefined when absent or blank. */
-function readSecretFile(secretPath) {
-    let raw;
-    try {
-        raw = readFileSync(secretPath, "utf8");
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return undefined;
-        throw err;
-    }
-    const trimmed = raw.trim();
-    if (trimmed.length === 0)
-        return undefined;
-    // The compose-era contract documents >= 32 chars. A shorter file (hand
-    // edit, truncation) must fail the boot loudly — never silently serve a
-    // weak HS256 key, and never silently regenerate over operator content.
-    if (trimmed.length < 32) {
-        throw new TwinBootError(`TWIN_AUTH_SECRET is not set and the persisted secret at ${secretPath} is shorter than 32 chars — fix or delete the file, or inject TWIN_AUTH_SECRET.`);
-    }
-    return trimmed;
-}
-export function shadowedPrefix(routePath) {
-    for (const prefix of RESERVED_SESSION_PREFIXES) {
-        if (routePath === prefix || routePath.startsWith(`${prefix}/`))
-            return prefix;
-    }
-    return null;
-}
-export function assertUniqueToolNames(tools, twinId) {
-    const seen = new Set();
-    for (const tool of tools) {
-        if (seen.has(tool.name)) {
-            throw new TwinBootError(`Twin "${twinId}" has duplicate tool name: ${tool.name}`);
-        }
-        seen.add(tool.name);
-    }
-}
-export function findTool(definition, name) {
-    const tool = definition.tools.find((t) => t.name === name);
-    if (!tool) {
-        throw new UnknownToolError(name);
-    }
-    return tool;
-}
-export async function readJson(req) {
-    try {
-        const cloned = req.clone();
-        const text = await cloned.text();
-        if (!text)
-            return null;
-        return JSON.parse(text);
-    }
-    catch (err) {
-        if (err instanceof SyntaxError)
-            throw err;
-        return null;
-    }
-}
-/**
- * Convenience helper for `recorder.handle` inner functions. Returns a
- * 200 response with the supplied `mutation` flag (default: false). Mirrors
- * `packages/twin-github/src/app.ts:ok`.
- */
-export function ok(body, mutation = false) {
-    return { status: 200, body, mutation };
-}
-/**
- * Convenience helper for `recorder.handle` inner functions. Returns a
- * 201 response with `mutation: true`. Mirrors
- * `packages/twin-github/src/app.ts:created`.
- */
-export function created(body) {
-    return { status: 201, body, mutation: true };
-}
-//# sourceMappingURL=server-helpers.js.map

package/node_modules/@pome-sh/twin-stripe/node_modules/@pome-sh/sdk/dist/server-helpers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"server-helpers.js","sourceRoot":"","sources":["../src/server-helpers.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,qCAAqC;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAsC,MAAM,YAAY,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE5E,MAAM,UAAU,aAAa;IAC3B,IAAI,KAAK,GAAiE,IAAI,CAAC;IAC/E,OAAO;QACL,MAAM,CAAC,CAA+D;YACpE,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;QACD,KAAK;YACH,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,WAAW,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAY;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAAE,OAAO;IACzC,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,SAAS,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,gEAAgE,UAAU,EAAE,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,sEAAsE;YACtE,mEAAmE;YACnE,aAAa,CAAC,UAAU,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAChE,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,gEAAgE,UAAU,EAAE,CAAC,CAAC;gBACvG,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,kEAAkE;YAClE,wDAAwD;YACxD,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,aAAa,CAAC,UAAU,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,IAAI,EAAE,CAAC;gBACd,IAAK,IAA8B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,IAAI,CAAC;gBAClE,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;gBACxC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,gEAAgE,UAAU,EAAE,CAAC,CAAC;gBACvG,OAAO;YACT,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC;QACtC,OAAO,CAAC,GAAG,CACT,SAAS,IAAI,0CAA0C,MAAM,kBAAkB,UAAU,6EAA6E,CACvK,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa;YAAE,MAAM,GAAG,CAAC;QAC5C,MAAM,IAAI,aAAa,CACrB,0DAA0D,UAAU,YAAa,GAAa,CAAC,OAAO,EAAE,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,cAAc,CAAC,UAAkB;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CACrB,2DAA2D,UAAU,iFAAiF,CACvJ,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,KAAK,MAAM,MAAM,IAAI,yBAAyB,EAAE,CAAC;QAC/C,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAuC,EACvC,MAAc;IAEd,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,aAAa,CAAC,SAAS,MAAM,8BAA8B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,UAA+C,EAC/C,IAAY;IAEZ,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAY;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW;YAAE,MAAM,GAAG,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,EAAE,CAAC,IAAa,EAAE,QAAQ,GAAG,KAAK;IAChD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,IAAa;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/C,CAAC"}

package/node_modules/@pome-sh/twin-stripe/node_modules/@pome-sh/sdk/dist/server.d.ts

@@ -1,46 +0,0 @@
-import { Hono } from "hono";
-import { type TwinDefinition } from "./index.js";
-import { type RecorderStore } from "./recorder.js";
-export { TwinBootError, ensureTwinAuthSecret, isLoopbackHost, created, ok } from "./server-helpers.js";
-export { createRecorderHandle, createRecorderStore, createFileBackedRecorderStore, resolveRecorderStore, toTwinHttpEventRow, POME_RECORDER_EVENTS_PATH, } from "./recorder.js";
-export type { RecorderStore, RecorderStoreOptions, FileBackedRecorderStoreOptions, ErrorEnvelopeFn, } from "./recorder.js";
-export { bearerAuth, requireAdminAuth, resolveAuthSecret } from "./auth.js";
-export { createAdminGate, setClientIp } from "./admin-gate.js";
-export type { AdminGateOptions } from "./admin-gate.js";
-export { TwinError, UnknownToolError } from "./errors.js";
-export { redactEvent, redactSecrets } from "./redaction.js";
-export { FAILURE_INJECTION_OVERRIDE_KEY, createFailureInjectionStore, failureInjectionMiddleware, failureInjectionRuleSchema, } from "./failure-injection.js";
-export type { FailureInjectionMiddlewareOptions, FailureInjectionMode, FailureInjectionOverride, FailureInjectionRule, FailureInjectionStore, } from "./failure-injection.js";
-export { PROVIDER_SHAPED_TEAM_ID, formTokenResolver, mintProviderToken, queryTokenResolver, verifyProviderToken, } from "./auth.js";
-export type { AuthEnvelope, BearerAuthOptions, MintProviderTokenOptions, ProviderTokenSpec, SessionClaims, SessionValue, TokenResolver, UnauthorizedKind, } from "./auth.js";
-export { twinBuildInfo } from "./build-info.js";
-export type { TwinBuildInfo } from "./build-info.js";
-export interface ServeOptions<TDb = unknown, TSeed = unknown> {
-    /** Optional. When set, `serve()` binds a Node HTTP server. */
-    port?: number;
-    /** Bind hostname. Defaults to "127.0.0.1". */
-    hostname?: string;
-    /** Opaque database handle forwarded to `definition.domain({ db })`. */
-    db?: TDb;
-    /** Initial seed forwarded to `definition.domain({ seed })`. Validated against `definition.seed` if provided. */
-    seed?: TSeed;
-    /** Custom recorder store. Defaults to `resolveRecorderStore()` (durable when `POME_RECORDER_EVENTS_PATH` is set). */
-    recorder?: RecorderStore;
-    /** Run identifier embedded in every recorder event. Defaults to "local". */
-    runId?: string;
-}
-export declare function createApp<TDb, TSeed, TDomain>(definition: TwinDefinition<TDb, TSeed, TDomain>, options?: ServeOptions<TDb, TSeed>): Hono;
-export interface ServeResult {
-    app: Hono;
-    /**
-     * Stop the bound HTTP server (if any), then flush+close the recorder store
-     * so durable tapes drain before process exit (F-698).
-     */
-    close(): Promise<void>;
-}
-/**
- * Build the app and bind a Node HTTP server. If `port` is omitted, no
- * server is bound — `close()` still flushes the recorder store.
- */
-export declare function serve<TDb, TSeed, TDomain>(definition: TwinDefinition<TDb, TSeed, TDomain>, options?: ServeOptions<TDb, TSeed>): Promise<ServeResult>;
-/** Engine-owned `/_pome/*` route names a twin's `pomeRoutes` may not shadow. */

package/node_modules/@pome-sh/twin-stripe/node_modules/@pome-sh/sdk/dist/server.js

@@ -1,394 +0,0 @@
-// file-size: server engine intentionally centralizes TwinDefinition boot, reserved routes, recorder shutdown, and auth wiring.
-// SPDX-License-Identifier: Apache-2.0
-//
-// `@pome-sh/sdk/server` — boot a `TwinDefinition` into a Hono app and
-// optionally bind a Node HTTP server. `createApp()` returns the bare app
-// (no port binding) for tests; `serve()` wraps it with `@hono/node-server`.
-//
-// Auto-mounted routes:
-//   GET  /healthz                          (root, no auth)
-//   POST /admin/reset                      (localhost-only)
-//   POST /admin/seed                       (localhost-only)
-//   GET  /s/:sid/healthz                   (bearer)
-//   GET  /s/:sid/_pome/health              (bearer)
-//   GET  /s/:sid/_pome/state               (bearer)
-//   GET  /s/:sid/_pome/events              (bearer)
-//   GET  /s/:sid/mcp/tools                 (bearer)
-//   POST /s/:sid/mcp/tools/:name           (bearer)
-//   POST /s/:sid/mcp/call                  (bearer)
-//
-// User routes registered via `definition.routes(app, ctx)` are mounted under
-// `/s/:sid/*`. The SDK refuses to boot if any user route shadows the
-// `/_pome/*` or `/mcp/*` prefixes (OQ-B6 invariant).
-import { Hono } from "hono";
-import { z } from "zod";
-import { toolInputSchema, toolListExtras, } from "./index.js";
-import { bearerAuth, requireAdminAuth } from "./auth.js";
-import { createAdminGate } from "./admin-gate.js";
-import { makeToolCallContext } from "./tool-context.js";
-import { twinBuildInfo } from "./build-info.js";
-import { handleMcpJsonRpc, mcpMethodNotAllowed } from "./mcp-jsonrpc.js";
-import { createRecorderHandle, resolveRecorderStore } from "./recorder.js";
-import { redactSecrets } from "./redaction.js";
-import { TwinError, envelopeFor } from "./errors.js";
-import { POME_CORE_ROUTE_NAMES, TwinBootError, assertUniqueToolNames, ensureTwinAuthSecret, findTool, isLoopbackHost, makeDeltaSink, readJson, shadowedPrefix, } from "./server-helpers.js";
-// Public boot surface consumed by twin entrypoints
-// (`import { ensureTwinAuthSecret, serve } from "@pome-sh/sdk/server"`).
-export { TwinBootError, ensureTwinAuthSecret, isLoopbackHost, created, ok } from "./server-helpers.js";
-export { createRecorderHandle, createRecorderStore, createFileBackedRecorderStore, resolveRecorderStore, toTwinHttpEventRow, POME_RECORDER_EVENTS_PATH, } from "./recorder.js";
-export { bearerAuth, requireAdminAuth, resolveAuthSecret } from "./auth.js";
-// Alternate serving bridges (anything that isn't @hono/node-server) must feed
-// the gate the transport-level peer address via setClientIp from an upstream
-// middleware; createAdminGate lets custom twins mount the gate with their own
-// 403 envelope. See the SECURITY note on setClientIp — never derive the value
-// from request headers.
-export { createAdminGate, setClientIp } from "./admin-gate.js";
-export { TwinError, UnknownToolError } from "./errors.js";
-export { redactEvent, redactSecrets } from "./redaction.js";
-export { FAILURE_INJECTION_OVERRIDE_KEY, createFailureInjectionStore, failureInjectionMiddleware, failureInjectionRuleSchema, } from "./failure-injection.js";
-export { PROVIDER_SHAPED_TEAM_ID, formTokenResolver, mintProviderToken, queryTokenResolver, verifyProviderToken, } from "./auth.js";
-export { twinBuildInfo } from "./build-info.js";
-const jsonRecord = z.record(z.string(), z.unknown());
-export function createApp(definition, options = {}) {
-    // 1. Validate + build seed
-    let seed;
-    if (options.seed !== undefined) {
-        if (definition.seed) {
-            seed = definition.seed.parse(options.seed);
-        }
-        else {
-            seed = options.seed;
-        }
-    }
-    // 2. Build domain
-    const domain = definition.domain({ db: options.db, seed });
-    // 3. Build recorder. The manifest's `errorEnvelope` (if set) is forwarded
-    //    here so API-mirroring twins control their error shape without
-    //    bypassing the recorder middleware.
-    const runId = options.runId ?? "local";
-    const recorder = createRecorderHandle({
-        runId,
-        twin: definition.id,
-        store: options.recorder ?? resolveRecorderStore(),
-        errorEnvelope: definition.errorEnvelope,
-        stampToolCallId: definition.stampToolCallId,
-        recordingProjection: definition.recordingProjection,
-    });
-    // 4. Boot-time invariant: user routes must not shadow reserved prefixes.
-    const userApp = new Hono();
-    if (definition.routes) {
-        definition.routes(userApp, { domain, recorder, runId, twin: definition.id });
-        for (const route of userApp.routes) {
-            const shadowed = shadowedPrefix(route.path);
-            if (shadowed) {
-                throw new TwinBootError(`Twin "${definition.id}" route ${route.method} ${route.path} shadows reserved SDK prefix ${shadowed}/*`);
-            }
-        }
-    }
-    // 5. Tool name uniqueness sanity (defineTwin already enforces, but a
-    //    test that hand-builds a TwinDefinition could bypass it).
-    assertUniqueToolNames(definition.tools, definition.id);
-    // 6. Build root app
-    const root = new Hono();
-    // Contract core: {ok, twin, implementation, tools, runtime}. Extras
-    // default to the pre-F-681 fields; a twin with a frozen healthz shape
-    // supplies its own (possibly empty) extras via `definition.healthz`.
-    const healthzExtras = definition.healthz ??
-        (() => ({ version: definition.version, fidelity: definition.fidelity.default }));
-    root.get("/healthz", (c) => c.json({
-        ok: true,
-        twin: definition.id,
-        implementation: definition.implementation ?? `${definition.id}_clone`,
-        tools: definition.tools.length,
-        runtime: twinBuildInfo(definition.packageName ?? `@pome-sh/twin-${definition.id}`),
-        ...healthzExtras(),
-    }));
-    // Per-twin body reader for the engine-owned JSON surfaces. Default is
-    // strict JSON (malformed → SyntaxError into the twin's errorEnvelope);
-    // twins with frozen tolerant/form parsing (slack, stripe) declare theirs.
-    const readBody = definition.bodyReader ?? ((c) => readJson(c.req.raw));
-    // 7. Admin sub-app. Gate mechanism is the engine's; a twin with a frozen
-    //    403 body declares it via `admin.forbidden` (F-683).
-    const adminForbidden = definition.admin?.forbidden;
-    const adminApp = new Hono();
-    adminApp.use("*", adminForbidden
-        ? createAdminGate({
-            forbidden: () => {
-                const envelope = adminForbidden();
-                return Response.json(envelope.body, { status: envelope.status });
-            },
-        })
-        : requireAdminAuth());
-    const adminEnvelope = definition.admin?.errorEnvelope;
-    // stripe pin: its pre-port recorder never saw admin traffic, so
-    // admin.recorded=false serves the same handlers without emitting events.
-    const wrapAdmin = definition.admin?.recorded !== false
-        ? (fn) => recorder.handle({ mutation: true, errorEnvelope: adminEnvelope }, fn)
-        : (fn) => async (c) => {
-            try {
-                const result = await fn(c);
-                return c.json(result.body, result.status);
-            }
-            catch (err) {
-                const envelope = (adminEnvelope ?? definition.errorEnvelope ?? envelopeFor)(err);
-                return c.json(envelope.body, envelope.status);
-            }
-        };
-    adminApp.post("/reset", wrapAdmin(async () => {
-        if (!definition.admin?.reset) {
-            throw new TwinError("admin.reset is not configured for this twin", 501);
-        }
-        const delta = makeDeltaSink();
-        const body = (await definition.admin.reset({ domain, reportDelta: delta.report })) ?? { ok: true };
-        return { status: 200, body, delta: delta.value() };
-    }));
-    adminApp.post("/seed", wrapAdmin(async (c) => {
-        if (!definition.admin?.seed) {
-            throw new TwinError("admin.seed is not configured for this twin", 501);
-        }
-        if (!definition.seed) {
-            throw new TwinError("Twin manifest has no `seed` schema; cannot accept POST /admin/seed", 501);
-        }
-        const raw = await readBody(c);
-        const parsed = definition.seed.parse(raw);
-        const delta = makeDeltaSink();
-        const body = (await definition.admin.seed({ domain, seed: parsed, reportDelta: delta.report })) ?? { ok: true };
-        return { status: 200, body, delta: delta.value() };
-    }));
-    root.route("/admin", adminApp);
-    // 8. Session sub-app. Auth mechanism is the engine's; the twin's declared
-    //    shape (F-712) rides in via `definition.auth`.
-    const session = new Hono();
-    session.use("*", bearerAuth(definition.auth));
-    // Session-wide middleware slot — the pre-port `session.use("*")` position,
-    // mounted BEFORE the engine's MCP / `/_pome/*` routes so twin middleware
-    // (stripe failure-injection, idempotency) covers MCP dispatch too.
-    if (definition.middleware) {
-        definition.middleware(session, { domain, recorder, runId, twin: definition.id });
-    }
-    // Per-session healthz is contract-frozen per twin: github/slack answer
-    // 200 {ok, sid}; stripe has NO such route (falls to the 501 catch-all).
-    if (definition.sessionHealthz !== false) {
-        session.get("/healthz", (c) => c.json({ ok: true, sid: c.req.param("sid") }));
-    }
-    // `pomeHealth` extras replace the default {version, fidelity} for twins
-    // with a frozen per-session health shape (slack: bare {ok, twin};
-    // github: no version; stripe adds recorder counters).
-    const pomeHealthExtras = definition.pomeHealth ??
-        (() => ({ version: definition.version, fidelity: definition.fidelity.default }));
-    session.get("/_pome/health", (c) => c.json({
-        ok: true,
-        twin: definition.id,
-        ...pomeHealthExtras({ recorder }),
-    }));
-    // NOT recorder-wrapped: no pre-port twin recorded /_pome/state fetches on
-    // the tape (F-683 review pin) — the export is a read-side probe, and
-    // recording it would embed the full state as an event response_body.
-    session.get("/_pome/state", async (c) => {
-        try {
-            if (!definition.state) {
-                throw new TwinError("state introspection is not configured for this twin", 501);
-            }
-            const session = c.get("session");
-            const state = await definition.state({ domain, session });
-            // Central redaction: the state export feeds cloud-side scoring and the
-            // CLI trace; a twin must not be able to leak secrets by omission.
-            return c.json(redactSecrets(state));
-        }
-        catch (err) {
-            const envelope = (definition.errorEnvelope ?? envelopeFor)(err);
-            return c.json(envelope.body, envelope.status);
-        }
-    });
-    session.get("/_pome/events", (c) => c.json(recorder.events()));
-    // 8b. Extra per-twin `/_pome/*` routes (github's frozen
-    //     GET /s/:sid/_pome/access-control, F-682). Registered after the core
-    //     routes so the platform surface can never be shadowed; core names are
-    //     rejected outright at boot.
-    if (definition.pomeRoutes) {
-        for (const [name, handler] of Object.entries(definition.pomeRoutes)) {
-            if (POME_CORE_ROUTE_NAMES.has(name)) {
-                throw new TwinBootError(`Twin "${definition.id}" pome route "/_pome/${name}" shadows a reserved engine route`);
-            }
-            session.get(`/_pome/${name}`, async (c) => c.json((await handler({ domain }))));
-        }
-    }
-    // 9. MCP routes from tool registry. `/mcp` is the streamable-HTTP
-    //    JSON-RPC endpoint (stateless — GET/DELETE answer 405); `/mcp/tools`,
-    //    `/mcp/tools/:name`, `/mcp/call` are the legacy dispatch surface.
-    session.post("/mcp", (c) => handleMcpJsonRpc(c, { definition, domain, recorder, runId }));
-    session.get("/mcp", (c) => mcpMethodNotAllowed(c));
-    session.delete("/mcp", (c) => mcpMethodNotAllowed(c));
-    session.get("/mcp/tools", (c) => c.json({
-        tools: definition.tools.map((tool) => ({
-            name: tool.name,
-            description: tool.description,
-            input_schema: toolInputSchema(tool),
-            ...toolListExtras(tool),
-        })),
-    }));
-    session.post("/mcp/tools/:name", recorder.handle({ mutation: false }, async (c) => {
-        const name = c.req.param("name") ?? "";
-        const tool = findTool(definition, name);
-        const args = await readBody(c);
-        const parsed = tool.schema.parse(args ?? {});
-        const call = makeToolCallContext(c);
-        const result = await tool.handler(domain, parsed, call.ctx);
-        const delta = call.delta();
-        const mutation = tool.mutation && (!call.reportedDelta() || delta !== null);
-        return { status: 200, body: result, mutation, delta };
-    }));
-    session.post("/mcp/call", recorder.handle({ mutation: false }, async (c) => {
-        const raw = await readBody(c);
-        let call;
-        if (definition.legacyMcp?.aliases) {
-            // Frozen slack surface: {name}/{params} alias {tool}/{arguments};
-            // a body naming no tool answers the twin's own envelope (400
-            // invalid_arguments) instead of the strict-parse error.
-            const rec = (raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {});
-            const name = rec.tool ?? rec.name;
-            if (typeof name !== "string" || name.length === 0) {
-                const missing = definition.legacyMcp.missingTool;
-                if (missing) {
-                    const envelope = missing();
-                    return { status: envelope.status, body: envelope.body };
-                }
-                z.object({ tool: z.string().min(1) }).parse(rec); // throws the strict-parse error
-            }
-            call = {
-                tool: name,
-                arguments: (rec.arguments ?? rec.params ?? {}),
-            };
-        }
-        else {
-            call = z
-                .object({ tool: z.string().min(1), arguments: jsonRecord.default({}) })
-                .parse(raw);
-        }
-        const tool = findTool(definition, call.tool);
-        const parsed = tool.schema.parse(call.arguments);
-        const toolCall = makeToolCallContext(c);
-        const result = await tool.handler(domain, parsed, toolCall.ctx);
-        const delta = toolCall.delta();
-        const mutation = tool.mutation && (!toolCall.reportedDelta() || delta !== null);
-        return { status: 200, body: result, mutation, delta };
-    }));
-    // 10. User routes
-    if (definition.routes) {
-        session.route("/", userApp);
-    }
-    // 11. Catch-all for unsupported surfaces. Recorder records
-    //     fidelity:"unsupported" and returns 501 so unmatched routes surface
-    //     as a fidelity-gap signal in the trace instead of silently 404'ing.
-    //     Not opt-out per OQ-B6: every community twin auto-surfaces fidelity
-    //     gaps in the trace.
-    session.all("*", recorder.handle({ mutation: false, fidelity: "unsupported" }, async (c) => {
-        const ctx = { method: c.req.method, path: new URL(c.req.url).pathname };
-        if (definition.unsupported)
-            return definition.unsupported(ctx);
-        return {
-            status: 501,
-            body: {
-                message: `Endpoint not modeled by twin "${definition.id}".`,
-                fidelity: "unsupported",
-                method: ctx.method,
-                path: ctx.path,
-            },
-        };
-    }));
-    root.route("/s/:sid", session);
-    // 11b. SDK-compat root mount (stripe F3, F-684): the same session router
-    //      answers at the root path. Root /healthz + /admin/* were registered
-    //      first and stay first-match; unknown root paths hit the twin's auth
-    //      wall (bearerAuth answers 401 before the 501 catch-all). Pair with
-    //      `auth.requirePathSid: false` so the bearer alone resolves the sid.
-    if (definition.mountSessionAtRoot) {
-        root.route("/", session);
-    }
-    // 12. Footgun warning: clean-state-per-test workflows rely on
-    //     /admin/reset. Warn loudly if a twin ships without it so authors
-    //     don't discover the gap mid-CI-debug.
-    if (!definition.admin?.reset) {
-        console.warn(`[@pome-sh/sdk] twin "${definition.id}" has no admin.reset configured — POST /admin/reset returns 501. Most CI workflows rely on this for clean-state-per-test.`);
-    }
-    return root;
-}
-/**
- * Build the app and bind a Node HTTP server. If `port` is omitted, no
- * server is bound — `close()` still flushes the recorder store.
- */
-export async function serve(definition, options = {}) {
-    const hostname = options.hostname ?? "127.0.0.1";
-    // Contract boot guard: a twin must never serve real traffic with the dev
-    // fallback secret. Since F-708 a non-loopback bind with no env-injected
-    // secret self-generates + persists one instead of refusing to boot; a
-    // failed generation still throws before the app is built, so the process
-    // exits non-zero without ever listening.
-    if (options.port !== undefined && !isLoopbackHost(hostname)) {
-        ensureTwinAuthSecret(definition.id, hostname);
-    }
-    // Resolve the store once so `close()` can flush the same instance the app
-    // records into (durable when POME_RECORDER_EVENTS_PATH is set).
-    const store = options.recorder ?? resolveRecorderStore();
-    const app = createApp(definition, { ...options, recorder: store });
-    const closeRecorder = async () => {
-        await store.flush?.();
-        await store.close?.();
-    };
-    if (options.port === undefined) {
-        return { app, close: closeRecorder };
-    }
-    const { serve: nodeServe } = await import("@hono/node-server");
-    const server = await new Promise((resolve) => {
-        const bound = nodeServe({
-            fetch: app.fetch,
-            port: options.port,
-            hostname,
-        }, () => resolve(bound));
-    });
-    let closed = false;
-    const close = async () => {
-        if (closed) {
-            await closeRecorder();
-            return;
-        }
-        closed = true;
-        unregisterServeShutdown(close);
-        await new Promise((resolve, reject) => {
-            server.close((err) => (err ? reject(err) : resolve()));
-        });
-        await closeRecorder();
-    };
-    // Twin boot scripts (`await serve(...)`) never call close() themselves.
-    // Drain the durable recorder on graceful process signals so hosted twins
-    // with POME_RECORDER_EVENTS_PATH set do not lose the last accepted events.
-    // Shared registry: every served twin flushes before a single process.exit,
-    // so multi-twin processes cannot lose sibling recorder tapes.
-    registerServeShutdown(close);
-    return { app, close };
-}
-/** Active `serve({ port })` close hooks — drained together on SIGINT/SIGTERM. */
-const serveShutdownHooks = new Set();
-let serveSignalHandlersInstalled = false;
-function registerServeShutdown(close) {
-    serveShutdownHooks.add(close);
-    if (serveSignalHandlersInstalled)
-        return;
-    serveSignalHandlersInstalled = true;
-    const onSignal = () => {
-        void (async () => {
-            const hooks = [...serveShutdownHooks];
-            serveShutdownHooks.clear();
-            await Promise.allSettled(hooks.map((hook) => hook()));
-            process.exit(0);
-        })();
-    };
-    process.once("SIGINT", onSignal);
-    process.once("SIGTERM", onSignal);
-}
-function unregisterServeShutdown(close) {
-    serveShutdownHooks.delete(close);
-}
-// ─── Helpers ────────────────────────────────────────────────────────────────
-/** Engine-owned `/_pome/*` route names a twin's `pomeRoutes` may not shadow. */
-//# sourceMappingURL=server.js.map