@yiaany/ghostapi 0.1.8 → 0.2.0

package/examples/openai-streaming/streaming-tool-call.mjs

@@ -1,31 +1,44 @@
-const baseUrl = process.env.GHOSTAPI_OPENAI_BASE_URL ?? "http://127.0.0.1:8080/v1";
-
-const response = await fetch(`${baseUrl}/chat/completions`, {
-  method: "POST",
-  headers: {
-    "content-type": "application/json",
-    authorization: `Bearer ${process.env.OPENAI_API_KEY ?? "sk-ghostapi"}`
-  },
-  body: JSON.stringify({
-    model: "gpt-4o-mini",
-    stream: true,
-    messages: [{ role: "user", content: "Return a local weather tool call for Berlin." }],
-    tools: [
-      {
-        type: "function",
-        function: {
-          name: "get_weather",
-          description: "Return local test weather.",
-          parameters: { type: "object", properties: { city: { type: "string" } }, required: ["city"] }
-        }
-      }
-    ]
-  })
-});
-
-if (!response.ok) throw new Error(`GhostAPI OpenAI request failed: ${response.status} ${await response.text()}`);
-
-const text = await response.text();
-if (!text.includes("[DONE]")) throw new Error("Expected a local streaming completion terminator.");
-
-console.log("OpenAI streaming/tool-call starter completed against local GhostAPI.");
+const baseUrl =
+  process.env.GHOSTAPI_OPENAI_BASE_URL ?? "http://127.0.0.1:8080/v1";
+
+const response = await fetch(`${baseUrl}/chat/completions`, {
+  method: "POST",
+  headers: {
+    "content-type": "application/json",
+    authorization: `Bearer ${process.env.OPENAI_API_KEY ?? "sk-ghostapi"}`,
+  },
+  body: JSON.stringify({
+    model: "gpt-4o-mini",
+    stream: true,
+    messages: [
+      { role: "user", content: "Return a local weather tool call for Berlin." },
+    ],
+    tools: [
+      {
+        type: "function",
+        function: {
+          name: "get_weather",
+          description: "Return local test weather.",
+          parameters: {
+            type: "object",
+            properties: { city: { type: "string" } },
+            required: ["city"],
+          },
+        },
+      },
+    ],
+  }),
+});
+
+if (!response.ok)
+  throw new Error(
+    `GhostAPI OpenAI request failed: ${response.status} ${await response.text()}`,
+  );
+
+const text = await response.text();
+if (!text.includes("[DONE]"))
+  throw new Error("Expected a local streaming completion terminator.");
+
+console.log(
+  "OpenAI streaming/tool-call starter completed against local GhostAPI.",
+);

package/examples/policy/ghostapi.policy.yaml

@@ -1,27 +1,27 @@
-version: 1
-network:
-  default: deny
-  allow:
-    - host: localhost
-    - host: 127.0.0.1
-  deny:
-    - host: api.stripe.com
-    - host: api.openai.com
-  productionHosts:
-    - '*.stripe.com'
-    - '*.openai.com'
-credentials:
-  forbid:
-    - sk_live_*
-    - rk_live_*
-    - ghp_*
-requiredScenarios:
-  - stripe-payment-intent-card-declined
-  - stripe-subscription-payment-failed
-enforcement:
-  allowedModes:
-    - linux-network-namespace
-reports:
-  maxProductionEgressAttempts: 0
-  maxForbiddenCredentialMatches: 0
-  maxBreakingContractChanges: 0
+version: 1
+network:
+  default: deny
+  allow:
+    - host: localhost
+    - host: 127.0.0.1
+  deny:
+    - host: api.stripe.com
+    - host: api.openai.com
+  productionHosts:
+    - "*.stripe.com"
+    - "*.openai.com"
+credentials:
+  forbid:
+    - sk_live_*
+    - rk_live_*
+    - ghp_*
+requiredScenarios:
+  - stripe-payment-intent-card-declined
+  - stripe-subscription-payment-failed
+enforcement:
+  allowedModes:
+    - linux-network-namespace
+reports:
+  maxProductionEgressAttempts: 0
+  maxForbiddenCredentialMatches: 0
+  maxBreakingContractChanges: 0

package/examples/record-replay/README.md

@@ -1,19 +1,19 @@
-# Record/Replay Starter
-
-This starter uses a tiny sanitized HAR fixture and a matching request file. It demonstrates the workflow without a live provider key.
-
-```bash
-npx @yiaany/ghostapi record \
-  --input examples/record-replay/stripe-checkout.har.json \
-  --allow-sandbox-host api.stripe.com \
-  --out .ghostapi/scenarios/stripe-checkout.bundle.json \
-  --title "Starter checkout" \
-  --approve
-
-npx @yiaany/ghostapi replay \
-  .ghostapi/scenarios/stripe-checkout.bundle.json \
-  --requests examples/record-replay/replay-requests.json \
-  --json
-```
-
-The fixture uses a fake `sk_test_...` key marker; do not record production traffic.
+# Record/Replay Starter
+
+This starter uses a tiny sanitized HAR fixture and a matching request file. It demonstrates the workflow without a live provider key.
+
+```bash
+npx @yiaany/ghostapi record \
+  --input examples/record-replay/stripe-checkout.har.json \
+  --allow-sandbox-host api.stripe.com \
+  --out .ghostapi/scenarios/stripe-checkout.bundle.json \
+  --title "Starter checkout" \
+  --approve
+
+npx @yiaany/ghostapi replay \
+  .ghostapi/scenarios/stripe-checkout.bundle.json \
+  --requests examples/record-replay/replay-requests.json \
+  --json
+```
+
+The fixture uses a fake `sk_test_...` key marker; do not record production traffic.

package/examples/record-replay/replay-requests.json

@@ -1,22 +1,22 @@
-[
-  {
-    "method": "POST",
-    "path": "/v1/checkout/sessions",
-    "headers": { "content-type": "application/json" },
-    "body": {
-      "mode": "payment",
-      "success_url": "https://sandbox.example/success",
-      "cancel_url": "https://sandbox.example/cancel",
-      "line_items": [
-        {
-          "quantity": 1,
-          "price_data": {
-            "currency": "usd",
-            "unit_amount": 2400,
-            "product_data": { "name": "Starter" }
-          }
-        }
-      ]
-    }
-  }
-]
+[
+  {
+    "method": "POST",
+    "path": "/v1/checkout/sessions",
+    "headers": { "content-type": "application/json" },
+    "body": {
+      "mode": "payment",
+      "success_url": "https://sandbox.example/success",
+      "cancel_url": "https://sandbox.example/cancel",
+      "line_items": [
+        {
+          "quantity": 1,
+          "price_data": {
+            "currency": "usd",
+            "unit_amount": 2400,
+            "product_data": { "name": "Starter" }
+          }
+        }
+      ]
+    }
+  }
+]

package/examples/record-replay/stripe-checkout.har.json

@@ -1,30 +1,30 @@
-{
-  "log": {
-    "version": "1.2",
-    "creator": { "name": "ghostapi-starter", "version": "1.0" },
-    "entries": [
-      {
-        "request": {
-          "method": "POST",
-          "url": "https://api.stripe.com/v1/checkout/sessions",
-          "headers": [
-            { "name": "authorization", "value": "Bearer sk_test_ghostapi" },
-            { "name": "content-type", "value": "application/json" }
-          ],
-          "postData": {
-            "mimeType": "application/json",
-            "text": "{\"mode\":\"payment\",\"success_url\":\"https://sandbox.example/success\",\"cancel_url\":\"https://sandbox.example/cancel\",\"line_items\":[{\"quantity\":1,\"price_data\":{\"currency\":\"usd\",\"unit_amount\":2400,\"product_data\":{\"name\":\"Starter\"}}}]}"
-          }
-        },
-        "response": {
-          "status": 200,
-          "headers": [{ "name": "content-type", "value": "application/json" }],
-          "content": {
-            "mimeType": "application/json",
-            "text": "{\"id\":\"cs_test_starter\",\"object\":\"checkout.session\",\"mode\":\"payment\",\"livemode\":false,\"url\":\"http://127.0.0.1:8080/checkout/cs_test_starter\"}"
-          }
-        }
-      }
-    ]
-  }
-}
+{
+  "log": {
+    "version": "1.2",
+    "creator": { "name": "ghostapi-starter", "version": "1.0" },
+    "entries": [
+      {
+        "request": {
+          "method": "POST",
+          "url": "https://api.stripe.com/v1/checkout/sessions",
+          "headers": [
+            { "name": "authorization", "value": "Bearer sk_test_ghostapi" },
+            { "name": "content-type", "value": "application/json" }
+          ],
+          "postData": {
+            "mimeType": "application/json",
+            "text": "{\"mode\":\"payment\",\"success_url\":\"https://sandbox.example/success\",\"cancel_url\":\"https://sandbox.example/cancel\",\"line_items\":[{\"quantity\":1,\"price_data\":{\"currency\":\"usd\",\"unit_amount\":2400,\"product_data\":{\"name\":\"Starter\"}}}]}"
+          }
+        },
+        "response": {
+          "status": 200,
+          "headers": [{ "name": "content-type", "value": "application/json" }],
+          "content": {
+            "mimeType": "application/json",
+            "text": "{\"id\":\"cs_test_starter\",\"object\":\"checkout.session\",\"mode\":\"payment\",\"livemode\":false,\"url\":\"http://127.0.0.1:8080/checkout/cs_test_starter\"}"
+          }
+        }
+      }
+    ]
+  }
+}

package/examples/resend-node/README.md

@@ -1,22 +1,22 @@
-# Resend Node Example
-
-Send a Resend-like email through GhostAPI. This does not send a real email.
-
-## Run
-
-Start GhostAPI:
-
-```bash
-ghostapi start
-```
-
-Send an email:
-
-```bash
-curl -X POST http://localhost:8080/emails \
-  -H "content-type: application/json" \
-  -H "authorization: Bearer re_local_only" \
-  -d '{"from":"onboarding@example.com","to":"ada@example.com","subject":"Welcome","html":"<p>Hello from GhostAPI</p>"}'
-```
-
-GhostAPI detects Resend from `/emails` and returns a local mock email response.
+# Resend Node Example
+
+Send a Resend-like email through GhostAPI. This does not send a real email.
+
+## Run
+
+Start GhostAPI:
+
+```bash
+ghostapi start
+```
+
+Send an email:
+
+```bash
+curl -X POST http://localhost:8080/emails \
+  -H "content-type: application/json" \
+  -H "authorization: Bearer re_local_only" \
+  -d '{"from":"onboarding@example.com","to":"ada@example.com","subject":"Welcome","html":"<p>Hello from GhostAPI</p>"}'
+```
+
+GhostAPI detects Resend from `/emails` and returns a local mock email response.

package/examples/stripe-node/README.md

@@ -1,35 +1,35 @@
-# Stripe Node Subscription Flow
-
-Run the official Stripe Node SDK against GhostAPI without patching SDK source. This example only talks to `127.0.0.1`; it does not call Stripe.
-
-## Run
-
-Start GhostAPI:
-
-```bash
-ghostapi start
-```
-
-Install the SDK once in this example directory:
-
-```bash
-npm install stripe
-```
-
-Run the subscription flow:
-
-```bash
-node checkout-flow.mjs
-```
-
-The script creates a customer, product, recurring price, and trial subscription; activates the local renewal control; then verifies the signed `invoice.payment_succeeded` payload with the official Stripe SDK. `delivery_mode=duplicate` deliberately returns the same event again so application-level de-duplication can be tested.
-
-The pack accepts SDK-style `application/x-www-form-urlencoded` requests and JSON requests used by direct HTTP clients. It uses Stripe API version `2026-02-25.clover`. Webhook deliveries are pull-based local test endpoints, so this example never asks GhostAPI to send an outbound request.
-
-To inspect the generated state:
-
-```bash
-curl http://127.0.0.1:8080/v1/payment_intents?limit=10
-```
-
-See [`docs/providers/stripe-core-pack.md`](../../docs/providers/stripe-core-pack.md) for supported operations and deliberate limits.
+# Stripe Node Subscription Flow
+
+Run the official Stripe Node SDK against GhostAPI without patching SDK source. This example only talks to `127.0.0.1`; it does not call Stripe.
+
+## Run
+
+Start GhostAPI:
+
+```bash
+ghostapi start
+```
+
+Install the SDK once in this example directory:
+
+```bash
+npm install stripe
+```
+
+Run the subscription flow:
+
+```bash
+node checkout-flow.mjs
+```
+
+The script creates a customer, product, recurring price, and trial subscription; activates the local renewal control; then verifies the signed `invoice.payment_succeeded` payload with the official Stripe SDK. `delivery_mode=duplicate` deliberately returns the same event again so application-level de-duplication can be tested.
+
+The pack accepts SDK-style `application/x-www-form-urlencoded` requests and JSON requests used by direct HTTP clients. It uses Stripe API version `2026-02-25.clover`. Webhook deliveries are pull-based local test endpoints, so this example never asks GhostAPI to send an outbound request.
+
+To inspect the generated state:
+
+```bash
+curl http://127.0.0.1:8080/v1/payment_intents?limit=10
+```
+
+See [`docs/providers/stripe-core-pack.md`](../../docs/providers/stripe-core-pack.md) for supported operations and deliberate limits.

package/examples/stripe-node/checkout-flow.mjs

@@ -1,61 +1,87 @@
-import Stripe from "stripe";
-
-const host = process.env.GHOSTAPI_HOST ?? "127.0.0.1";
-const port = Number(process.env.GHOSTAPI_PORT ?? "8080");
-const protocol = process.env.GHOSTAPI_PROTOCOL ?? "http";
-const baseUrl = `${protocol}://${host}:${port}`;
-const webhookSecret = process.env.GHOSTAPI_STRIPE_WEBHOOK_SECRET ?? "whsec_ghostapi_local_test_secret";
-
-const stripe = new Stripe(process.env.STRIPE_SECRET_KEY ?? "sk_test_ghostapi_local_only", {
-  host,
-  port,
-  protocol,
-  apiVersion: "2026-02-25.clover"
-});
-
-const customer = await stripe.customers.create({
-  email: "ada@example.com",
-  name: "Ada Lovelace",
-  metadata: { example: "ghostapi-subscription-flow" }
-});
-
-const product = await stripe.products.create({ name: "GhostAPI Pro" });
-const price = await stripe.prices.create({
-  product: product.id,
-  currency: "usd",
-  unit_amount: 2500,
-  recurring: { interval: "month" }
-});
-
-const subscription = await stripe.subscriptions.create({
-  customer: customer.id,
-  items: [{ price: price.id }],
-  trial_period_days: 7
-});
-
-// The renewal action is a GhostAPI local test control, not a live Stripe endpoint.
-const renewalResponse = await fetch(`${baseUrl}/v1/subscriptions/${subscription.id}/renew`, {
-  method: "POST",
-  headers: { "content-type": "application/json" },
-  body: JSON.stringify({})
-});
-const renewed = await renewalResponse.json();
-
-const events = await stripe.events.list({ limit: 20 });
-const event = events.data.find((candidate) => candidate.type === "invoice.payment_succeeded");
-if (event === undefined) throw new Error("Expected a local invoice.payment_succeeded webhook event.");
-
-const delivery = await fetch(`${baseUrl}/v1/events/${event.id}/deliver?delivery_mode=duplicate`);
-const payload = await delivery.text();
-const signature = delivery.headers.get("stripe-signature");
-if (signature === null) throw new Error("GhostAPI webhook delivery did not include stripe-signature.");
-const verifiedEvent = stripe.webhooks.constructEvent(payload, signature, webhookSecret);
-
-console.log(JSON.stringify({
-  customer: customer.id,
-  product: product.id,
-  price: price.id,
-  trialSubscription: subscription.id,
-  renewedSubscription: renewed.id,
-  verifiedWebhook: { id: verifiedEvent.id, type: verifiedEvent.type }
-}, null, 2));
+import Stripe from "stripe";
+
+const host = process.env.GHOSTAPI_HOST ?? "127.0.0.1";
+const port = Number(process.env.GHOSTAPI_PORT ?? "8080");
+const protocol = process.env.GHOSTAPI_PROTOCOL ?? "http";
+const baseUrl = `${protocol}://${host}:${port}`;
+const webhookSecret =
+  process.env.GHOSTAPI_STRIPE_WEBHOOK_SECRET ??
+  "whsec_ghostapi_local_test_secret";
+
+const stripe = new Stripe(
+  process.env.STRIPE_SECRET_KEY ?? "sk_test_ghostapi_local_only",
+  {
+    host,
+    port,
+    protocol,
+    apiVersion: "2026-02-25.clover",
+  },
+);
+
+const customer = await stripe.customers.create({
+  email: "ada@example.com",
+  name: "Ada Lovelace",
+  metadata: { example: "ghostapi-subscription-flow" },
+});
+
+const product = await stripe.products.create({ name: "GhostAPI Pro" });
+const price = await stripe.prices.create({
+  product: product.id,
+  currency: "usd",
+  unit_amount: 2500,
+  recurring: { interval: "month" },
+});
+
+const subscription = await stripe.subscriptions.create({
+  customer: customer.id,
+  items: [{ price: price.id }],
+  trial_period_days: 7,
+});
+
+// The renewal action is a GhostAPI local test control, not a live Stripe endpoint.
+const renewalResponse = await fetch(
+  `${baseUrl}/v1/subscriptions/${subscription.id}/renew`,
+  {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({}),
+  },
+);
+const renewed = await renewalResponse.json();
+
+const events = await stripe.events.list({ limit: 20 });
+const event = events.data.find(
+  (candidate) => candidate.type === "invoice.payment_succeeded",
+);
+if (event === undefined)
+  throw new Error("Expected a local invoice.payment_succeeded webhook event.");
+
+const delivery = await fetch(
+  `${baseUrl}/v1/events/${event.id}/deliver?delivery_mode=duplicate`,
+);
+const payload = await delivery.text();
+const signature = delivery.headers.get("stripe-signature");
+if (signature === null)
+  throw new Error(
+    "GhostAPI webhook delivery did not include stripe-signature.",
+  );
+const verifiedEvent = stripe.webhooks.constructEvent(
+  payload,
+  signature,
+  webhookSecret,
+);
+
+console.log(
+  JSON.stringify(
+    {
+      customer: customer.id,
+      product: product.id,
+      price: price.id,
+      trialSubscription: subscription.id,
+      renewedSubscription: renewed.id,
+      verifiedWebhook: { id: verifiedEvent.id, type: verifiedEvent.type },
+    },
+    null,
+    2,
+  ),
+);

package/examples/twilio-node/README.md

@@ -1,21 +1,21 @@
-# Twilio Node Example
-
-Send a Twilio-like SMS through GhostAPI. This does not send a real SMS.
-
-## Run
-
-Start GhostAPI:
-
-```bash
-ghostapi start
-```
-
-Send a message:
-
-```bash
-curl -X POST http://localhost:8080/2010-04-01/Accounts/AC_mock/Messages.json \
-  -H "content-type: application/x-www-form-urlencoded" \
-  -d "To=+15551234567&From=+15557654321&Body=Hello%20from%20GhostAPI"
-```
-
-GhostAPI detects Twilio from the `/2010-04-01/Accounts/...` path and returns a local message SID.
+# Twilio Node Example
+
+Send a Twilio-like SMS through GhostAPI. This does not send a real SMS.
+
+## Run
+
+Start GhostAPI:
+
+```bash
+ghostapi start
+```
+
+Send a message:
+
+```bash
+curl -X POST http://localhost:8080/2010-04-01/Accounts/AC_mock/Messages.json \
+  -H "content-type: application/x-www-form-urlencoded" \
+  -d "To=%2B15551234567&From=%2B15557654321&Body=Hello%20from%20GhostAPI"
+```
+
+GhostAPI detects Twilio from the `/2010-04-01/Accounts/...` path and returns a local message SID.

package/examples/worlds/README.md

@@ -1,19 +1,19 @@
-# Stateful Synthetic World Example
-
-This local-only workflow keeps one synthetic persona and organization consistent across Stripe, GitHub, email, and generic REST state.
-
-```bash
-ghostapi world create --id subscription-recovery --seed demo-seed
-npm run build
-node examples/worlds/subscription-recovery.mjs
-ghostapi world inspect subscription-recovery --json
-```
-
-The workflow atomically creates a Stripe customer and past-due subscription, records a generic REST payment failure, sends a synthetic email to a `ghostapi.invalid` inbox, and opens a synthetic GitHub recovery issue. Re-running the same action is idempotent. Reset and fork remain local:
-
-```bash
-ghostapi world reset subscription-recovery
-ghostapi world fork subscription-recovery --id subscription-recovery-investigation
-```
-
-Worlds are local JSON under `.ghostapi/worlds/`. They are bounded to 512 KiB and 100 workflow receipts, use one file lock plus atomic replacement for each transition, and intentionally do not call provider APIs or contain real credentials, inboxes, or PII.
+# Stateful Synthetic World Example
+
+This local-only workflow keeps one synthetic persona and organization consistent across Stripe, GitHub, email, and generic REST state.
+
+```bash
+ghostapi world create --id subscription-recovery --seed demo-seed
+npm run build
+node examples/worlds/subscription-recovery.mjs
+ghostapi world inspect subscription-recovery --json
+```
+
+The workflow atomically creates a Stripe customer and past-due subscription, records a generic REST payment failure, sends a synthetic email to a `ghostapi.invalid` inbox, and opens a synthetic GitHub recovery issue. Re-running the same action is idempotent. Reset and fork remain local:
+
+```bash
+ghostapi world reset subscription-recovery
+ghostapi world fork subscription-recovery --id subscription-recovery-investigation
+```
+
+Worlds are local JSON under `.ghostapi/worlds/`. They are bounded to 512 KiB and 100 workflow receipts, use one file lock plus atomic replacement for each transition, and intentionally do not call provider APIs or contain real credentials, inboxes, or PII.