pome-sh 0.6.6

package/node_modules/@pome-sh/twin-stripe/dist/src/idempotency.js

@@ -0,0 +1,193 @@
+// SPDX-License-Identifier: Apache-2.0
+// Per D-ENG-7 / E-7: `Idempotency-Key` middleware backed by the
+// `idempotency_keys` table. Behavior:
+//   - GET / HEAD → never cache.
+//   - Missing header → never cache.
+//   - Header present + cache hit + matching request hash → return cached
+//     response (status + body) untouched, do NOT invoke the handler.
+//   - Header present + cache hit + different hash → 400 with code
+//     `idempotency_key_in_use`.
+//   - Header present + miss → invoke handler; on response, store row.
+import { createHash } from "node:crypto";
+import { stripeError } from "./errors.js";
+import { nowIso, requestId } from "./util.js";
+const CACHEABLE_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function hashRequest(method, path, body) {
+    return createHash("sha256")
+        .update(method)
+        .update("\0")
+        .update(path)
+        .update("\0")
+        .update(body)
+        .digest("hex");
+}
+function getAccountId(c) {
+    const session = c.get("session");
+    // Admin/healthz routes have no session; bucket them by sid path param if
+    // present, otherwise the sentinel "_anon" (admin idempotency rarely matters).
+    if (session)
+        return session.account_id;
+    const sid = c.req.param("sid");
+    return sid ? `acct_${sid}` : "_anon";
+}
+export function idempotencyMiddleware(db, recorder, runId = "local") {
+    const select = db.prepare(`SELECT key, account_id, method, path, request_hash, response_status, response_body_json, created_at
+       FROM idempotency_keys
+      WHERE key = ? AND account_id = ? AND method = ? AND path = ?`);
+    const insert = db.prepare(`INSERT INTO idempotency_keys
+       (key, account_id, method, path, request_hash, response_status, response_body_json, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(key, account_id, method, path) DO NOTHING`);
+    const pending = new Map();
+    return async (c, next) => {
+        const method = c.req.method.toUpperCase();
+        if (!CACHEABLE_METHODS.has(method)) {
+            await next();
+            return;
+        }
+        const headerKey = c.req.header("Idempotency-Key") ?? c.req.header("idempotency-key");
+        if (!headerKey) {
+            await next();
+            return;
+        }
+        const startedAt = Date.now();
+        const account_id = getAccountId(c);
+        const path = new URL(c.req.url).pathname;
+        // Read raw body once; downstream handlers will re-parse via c.req.json().
+        // Hono buffers the body so re-reading is fine.
+        const rawBody = await c.req.raw
+            .clone()
+            .text()
+            .catch(() => "");
+        const requestHash = hashRequest(method, path, rawBody);
+        const pendingKey = [headerKey, account_id, method, path].join("\0");
+        const existing = select.get(headerKey, account_id, method, path);
+        if (existing) {
+            if (existing.request_hash !== requestHash) {
+                const env = stripeError("idempotency_error", "idempotency_key_in_use", `Keys for idempotent requests can only be used with the same parameters they were first used with. Try using a key other than '${headerKey}'.`, { statusCode: 400 });
+                return c.json(env.body, env.status);
+            }
+            let cachedBody;
+            try {
+                cachedBody = JSON.parse(existing.response_body_json);
+            }
+            catch {
+                cachedBody = null;
+            }
+            // Replay cached response untouched, but emit a dedupe RecorderEvent
+            // so the retry is visible to the dashboard / correlator. The original
+            // mutation is already in the recorder from the first call; this event
+            // carries idempotency_dedupe=true + state_mutation=false +
+            // state_delta=null so it can't be confused with a real mutation.
+            recordDedupeEvent(c, recorder, runId, startedAt, rawBody, {
+                status: existing.response_status,
+                body: cachedBody,
+            });
+            return c.json(cachedBody, existing.response_status);
+        }
+        const inFlight = pending.get(pendingKey);
+        if (inFlight) {
+            if (inFlight.requestHash !== requestHash) {
+                const env = stripeError("idempotency_error", "idempotency_key_in_use", `Keys for idempotent requests can only be used with the same parameters they were first used with. Try using a key other than '${headerKey}'.`, { statusCode: 400 });
+                return c.json(env.body, env.status);
+            }
+            const cached = await inFlight.promise;
+            if (cached.status < 400) {
+                const cachedBody = parseCachedBody(cached.bodyText);
+                recordDedupeEvent(c, recorder, runId, startedAt, rawBody, {
+                    status: cached.status,
+                    body: cachedBody,
+                });
+                return c.json(cachedBody, cached.status);
+            }
+            await next();
+            return;
+        }
+        let resolvePending;
+        let rejectPending;
+        const promise = new Promise((resolve, reject) => {
+            resolvePending = resolve;
+            rejectPending = reject;
+        });
+        pending.set(pendingKey, { requestHash, promise });
+        try {
+            await next();
+        }
+        catch (error) {
+            rejectPending(error);
+            pending.delete(pendingKey);
+            throw error;
+        }
+        // On the way out: capture response and persist the row. Only cache
+        // 2xx/3xx — 4xx and 5xx are not cached so a client with a typo in
+        // its first request can retry under the same key against a fresh
+        // handler invocation. Real Stripe re-executes on 4xx for client
+        // errors; mirroring that is F5.
+        try {
+            const status = c.res.status;
+            if (status >= 400) {
+                resolvePending({ status, bodyText: "null" });
+                return;
+            }
+            const cloned = c.res.clone();
+            let bodyText = "";
+            try {
+                bodyText = await cloned.text();
+            }
+            catch {
+                bodyText = "";
+            }
+            // Validate the body is JSON; fall back to "null" if not (still cacheable).
+            try {
+                JSON.parse(bodyText);
+            }
+            catch {
+                bodyText = "null";
+            }
+            insert.run(headerKey, account_id, method, path, requestHash, status, bodyText, nowIso());
+            resolvePending({ status, bodyText });
+        }
+        catch (error) {
+            rejectPending(error);
+            throw error;
+        }
+        finally {
+            pending.delete(pendingKey);
+        }
+    };
+}
+function recordDedupeEvent(c, recorder, runId, startedAt, rawBody, cached) {
+    if (!recorder)
+        return;
+    const reqId = requestId();
+    recorder.record({
+        ts: new Date().toISOString(),
+        run_id: runId,
+        twin: "stripe",
+        request_id: reqId,
+        correlation_id: reqId,
+        scenario_step_id: c.req.header("x-pome-scenario-step-id") ?? null,
+        step_id: null,
+        tool_call_id: null,
+        method: c.req.method,
+        path: new URL(c.req.url).pathname,
+        request_body: rawBody === "" ? null : rawBody,
+        status: cached.status,
+        response_body: cached.body,
+        latency_ms: Date.now() - startedAt,
+        fidelity: "semantic",
+        state_mutation: false,
+        state_delta: null,
+        idempotency_dedupe: true,
+        error: null,
+    });
+}
+function parseCachedBody(bodyText) {
+    try {
+        return JSON.parse(bodyText);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=idempotency.js.map

package/node_modules/@pome-sh/twin-stripe/dist/src/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/idempotency.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,gEAAgE;AAChE,sCAAsC;AACtC,gCAAgC;AAChC,oCAAoC;AACpC,yEAAyE;AACzE,qEAAqE;AACrE,kEAAkE;AAClE,gCAAgC;AAChC,sEAAsE;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAItE,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY;IAC7D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAgC,CAAC;IAChE,yEAAyE;IACzE,8EAA8E;IAC9E,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,EAAsB,EACtB,QAAmB,EACnB,QAAgB,OAAO;IAEvB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;;mEAE+D,CAChE,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;;;2DAGuD,CACxD,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqE,CAAC;IAE7F,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACrF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAEzC,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG;aAC5B,KAAK,EAAE;aACP,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnB,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEpE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAElD,CAAC;QAEd,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,WAAW,CACrB,mBAAmB,EACnB,wBAAwB,EACxB,iIAAiI,SAAS,IAAI,EAC9I,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAe,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,UAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,2DAA2D;YAC3D,iEAAiE;YACjE,iBAAiB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE;gBACxD,MAAM,EAAE,QAAQ,CAAC,eAAe;gBAChC,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,eAAwB,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBACzC,MAAM,GAAG,GAAG,WAAW,CACrB,mBAAmB,EACnB,wBAAwB,EACxB,iIAAiI,SAAS,IAAI,EAC9I,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAe,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;YACtC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACpD,iBAAiB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE;oBACxD,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,UAAU;iBACjB,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAe,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,cAAgD,CAAC;QACrD,IAAI,aAA0C,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9D,cAAc,GAAG,OAAO,CAAC;YACzB,aAAa,GAAG,MAAM,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,gEAAgE;QAChE,gCAAgC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC5B,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBAClB,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC;YACD,2EAA2E;YAC3E,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;YAED,MAAM,CAAC,GAAG,CACR,SAAS,EACT,UAAU,EACV,MAAM,EACN,IAAI,EACJ,WAAW,EACX,MAAM,EACN,QAAQ,EACR,MAAM,EAAE,CACT,CAAC;YACF,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,CAAU,EACV,QAA8B,EAC9B,KAAa,EACb,SAAiB,EACjB,OAAe,EACf,MAAyC;IAEzC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC;QACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,KAAK;QACjB,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,IAAI;QACjE,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;QACpB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;QACjC,YAAY,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,IAAI;QAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,KAAK;QACrB,WAAW,EAAE,IAAI;QACjB,kBAAkB,EAAE,IAAI;QACxB,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/node_modules/@pome-sh/twin-stripe/dist/src/ids.d.ts

@@ -0,0 +1,28 @@
+export declare const ID_PREFIXES: {
+    readonly customer: "cus_";
+    readonly payment_method: "pm_";
+    readonly payment_intent: "pi_";
+    readonly charge: "ch_";
+    readonly refund: "re_";
+    readonly product: "prod_";
+    readonly price: "price_";
+    readonly setup_intent: "seti_";
+    readonly checkout_session: "cs_test_";
+    readonly webhook_endpoint: "we_";
+    readonly event: "evt_";
+    readonly shared_payment_issued: "spt_";
+    readonly shared_payment_granted: "spt_";
+    readonly profile: "profile_";
+    readonly balance_transaction: "txn_";
+    readonly api_key: "sk_test_pome_";
+    readonly api_key_restricted: "rk_test_pome_";
+};
+export type IdKind = keyof typeof ID_PREFIXES;
+/** Generate `count` characters of base62 randomness. */
+export declare function randomBase62(count: number): string;
+/** Generate a Stripe-shaped id like `pi_3PqK...` (24 chars random suffix). */
+export declare function newId(kind: IdKind): string;
+/** Stripe-shaped client secret: `<piId>_secret_<24chars>`. */
+export declare function newClientSecret(piId: string): string;
+/** Generate an api key for a given session. `sk_test_pome_<24chars>`. */
+export declare function newApiKey(): string;

package/node_modules/@pome-sh/twin-stripe/dist/src/ids.js

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: Apache-2.0
+// Stripe ID generator — prefix-typed, base62 random suffix.
+import { randomBytes } from "node:crypto";
+const BASE62 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+export const ID_PREFIXES = {
+    customer: "cus_",
+    payment_method: "pm_",
+    payment_intent: "pi_",
+    charge: "ch_",
+    refund: "re_",
+    product: "prod_",
+    price: "price_",
+    setup_intent: "seti_",
+    checkout_session: "cs_test_",
+    webhook_endpoint: "we_",
+    event: "evt_",
+    shared_payment_issued: "spt_",
+    shared_payment_granted: "spt_",
+    profile: "profile_",
+    balance_transaction: "txn_",
+    // API keys are minted via api-keys.ts but the prefix lives here for parity.
+    api_key: "sk_test_pome_",
+    api_key_restricted: "rk_test_pome_"
+};
+/** Generate `count` characters of base62 randomness. */
+export function randomBase62(count) {
+    // 1 byte = 256 values; 62 fits in 6 bits. Pull extra to mask cheaply.
+    const buf = randomBytes(count * 2);
+    let out = "";
+    let i = 0;
+    while (out.length < count && i < buf.length) {
+        const byte = buf[i++];
+        if (byte < 248) {
+            // 248 = 4 * 62, modulo skew is uniform.
+            out += BASE62[byte % 62];
+        }
+    }
+    if (out.length < count) {
+        // extremely unlikely fallback; recurse to fill.
+        out += randomBase62(count - out.length);
+    }
+    return out;
+}
+/** Generate a Stripe-shaped id like `pi_3PqK...` (24 chars random suffix). */
+export function newId(kind) {
+    return `${ID_PREFIXES[kind]}${randomBase62(24)}`;
+}
+/** Stripe-shaped client secret: `<piId>_secret_<24chars>`. */
+export function newClientSecret(piId) {
+    return `${piId}_secret_${randomBase62(24)}`;
+}
+/** Generate an api key for a given session. `sk_test_pome_<24chars>`. */
+export function newApiKey() {
+    return newId("api_key");
+}
+//# sourceMappingURL=ids.js.map

package/node_modules/@pome-sh/twin-stripe/dist/src/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/ids.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,MAAM,GAAG,gEAAgE,CAAC;AAEhF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,OAAO;IACrB,gBAAgB,EAAE,UAAU;IAC5B,gBAAgB,EAAE,KAAK;IACvB,KAAK,EAAE,MAAM;IACb,qBAAqB,EAAE,MAAM;IAC7B,sBAAsB,EAAE,MAAM;IAC9B,OAAO,EAAE,UAAU;IACnB,mBAAmB,EAAE,MAAM;IAC3B,4EAA4E;IAC5E,OAAO,EAAE,eAAe;IACxB,kBAAkB,EAAE,eAAe;CAC3B,CAAC;AAIX,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,sEAAsE;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,GAAG,CAAC,MAAM,GAAG,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAE,CAAC;QACvB,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;YACf,wCAAwC;YACxC,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACvB,gDAAgD;QAChD,GAAG,IAAI,YAAY,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,GAAG,IAAI,WAAW,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;AAC1B,CAAC"}

package/node_modules/@pome-sh/twin-stripe/dist/src/index.d.ts

@@ -0,0 +1,13 @@
+export { createTwinStripeApp } from "./app.js";
+export type { TwinStripeAppOptions, TwinStripeContext } from "./app.js";
+export { openTwinStripeDatabase } from "./db.js";
+export { StripeDomain } from "./domain/index.js";
+export { applySeed, defaultSeed, parseSeed, loadSeedFromEnv } from "./seed.js";
+export { createFailureInjectionStore } from "./failure-injection.js";
+export { registerStripeRoutes } from "./routes/index.js";
+export { registerStripeSessionRoutes } from "./session.js";
+export type { RegisterStripeSessionRoutesOptions } from "./session.js";
+export { listTools, executeTool, isMutatingTool, toolDefinitions } from "./tools.js";
+export { handleMcpRequest, mcpMethodNotAllowed } from "./mcp.js";
+export { createRecorder } from "./recorder.js";
+export type { Recorder, ResolvedSession, TwinStripeDatabase } from "./types.js";

package/node_modules/@pome-sh/twin-stripe/dist/src/index.js

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// Embeddable surface for the vendored Stripe twin (FDRS-528). Mirrors
+// cli/src/twin-github/index.ts: just the pieces the in-process runner needs to
+// boot, seed, drive (REST + JSON-RPC MCP), and export state — not the standalone
+// server entrypoint.
+export { createTwinStripeApp } from "./app.js";
+export { openTwinStripeDatabase } from "./db.js";
+export { StripeDomain } from "./domain/index.js";
+export { applySeed, defaultSeed, parseSeed, loadSeedFromEnv } from "./seed.js";
+export { createFailureInjectionStore } from "./failure-injection.js";
+export { registerStripeRoutes } from "./routes/index.js";
+export { registerStripeSessionRoutes } from "./session.js";
+export { listTools, executeTool, isMutatingTool, toolDefinitions } from "./tools.js";
+export { handleMcpRequest, mcpMethodNotAllowed } from "./mcp.js";
+export { createRecorder } from "./recorder.js";
+//# sourceMappingURL=index.js.map

package/node_modules/@pome-sh/twin-stripe/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,sEAAsE;AACtE,+EAA+E;AAC/E,iFAAiF;AACjF,qBAAqB;AACrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/node_modules/@pome-sh/twin-stripe/dist/src/mcp.d.ts

@@ -0,0 +1,17 @@
+import type { Context } from "hono";
+import type { StripeDomain } from "./domain/index.js";
+import type { Recorder } from "./types.js";
+export type McpDeps = {
+    domain: StripeDomain;
+    recorder?: Recorder;
+    runId: string;
+};
+export declare function mcpMethodNotAllowed(c: Context): Response & import("hono").TypedResponse<{
+    jsonrpc: string;
+    id: null;
+    error: {
+        code: number;
+        message: string;
+    };
+}, 405, "json">;
+export declare function handleMcpRequest(c: Context, deps: McpDeps): Promise<Response>;

package/node_modules/@pome-sh/twin-stripe/dist/src/mcp.js

@@ -0,0 +1,200 @@
+import { z } from "zod";
+import { twinBuildInfo } from "./build-info.js";
+import { TwinError } from "./errors.js";
+import { executeTool, isMutatingTool, listTools } from "./tools.js";
+import { requestId } from "./util.js";
+const PARSE_ERROR = -32700;
+const INVALID_REQUEST = -32600;
+const METHOD_NOT_FOUND = -32601;
+const INVALID_PARAMS = -32602;
+const INTERNAL_ERROR = -32603;
+const DEFAULT_PROTOCOL_VERSION = "2025-06-18";
+const SUPPORTED_PROTOCOL_VERSIONS = new Set(["2024-11-05", "2025-03-26", "2025-06-18"]);
+export function mcpMethodNotAllowed(c) {
+    return c.json({ jsonrpc: "2.0", id: null, error: { code: METHOD_NOT_FOUND, message: "Method not allowed in stateless mode" } }, 405, { Allow: "POST" });
+}
+export async function handleMcpRequest(c, deps) {
+    let body;
+    try {
+        body = await c.req.json();
+    }
+    catch {
+        return jsonRpcErrorResponse(null, PARSE_ERROR, "Problems parsing JSON");
+    }
+    if (Array.isArray(body)) {
+        if (body.length === 0)
+            return jsonRpcErrorResponse(null, INVALID_REQUEST, "Invalid Request");
+        const out = [];
+        for (const message of body) {
+            const response = await dispatch(message, deps, c);
+            if (response)
+                out.push(response);
+        }
+        if (out.length === 0)
+            return new Response(null, { status: 202 });
+        return Response.json(out, { status: 200, headers: { "content-type": "application/json" } });
+    }
+    const response = await dispatch(body, deps, c);
+    if (!response)
+        return new Response(null, { status: 202 });
+    return Response.json(response, { status: 200, headers: { "content-type": "application/json" } });
+}
+async function dispatch(message, deps, c) {
+    if (!isObject(message))
+        return errorEnvelope(null, INVALID_REQUEST, "Invalid Request");
+    if (message.jsonrpc !== "2.0" || typeof message.method !== "string") {
+        return errorEnvelope(idOf(message), INVALID_REQUEST, "Invalid Request");
+    }
+    const method = message.method;
+    const params = isObject(message.params) ? message.params : {};
+    const rawId = message.id;
+    if (rawId === undefined || rawId === null)
+        return null; // notification
+    if (typeof rawId !== "string" && typeof rawId !== "number") {
+        return errorEnvelope(null, INVALID_REQUEST, "Invalid Request: id must be string or number");
+    }
+    const id = rawId;
+    try {
+        switch (method) {
+            case "initialize":
+                return { jsonrpc: "2.0", id, result: buildInitializeResult(params) };
+            case "ping":
+                return { jsonrpc: "2.0", id, result: {} };
+            case "tools/list":
+                return { jsonrpc: "2.0", id, result: { tools: toolsForMcp() } };
+            case "tools/call":
+                return await handleToolsCall(id, params, deps, c);
+            default:
+                return errorEnvelope(id, METHOD_NOT_FOUND, `Method not found: ${method}`);
+        }
+    }
+    catch (err) {
+        return errorEnvelope(id, INTERNAL_ERROR, err instanceof Error ? err.message : "Internal error");
+    }
+}
+function buildInitializeResult(params) {
+    const requested = typeof params.protocolVersion === "string" ? params.protocolVersion : undefined;
+    const protocolVersion = requested && SUPPORTED_PROTOCOL_VERSIONS.has(requested) ? requested : DEFAULT_PROTOCOL_VERSION;
+    return {
+        protocolVersion,
+        capabilities: { tools: { listChanged: false } },
+        serverInfo: { name: "twin-stripe", version: twinBuildInfo().version },
+    };
+}
+// twin-stripe `listTools()` returns `{name, description, input_schema}`; MCP
+// tools/list expects `inputSchema`.
+function toolsForMcp() {
+    return listTools().map((t) => ({
+        name: t.name,
+        description: t.description,
+        inputSchema: t.input_schema ?? { type: "object" },
+    }));
+}
+async function handleToolsCall(id, params, deps, c) {
+    const name = params.name;
+    const args = params.arguments === undefined || params.arguments === null
+        ? {}
+        : isObject(params.arguments)
+            ? params.arguments
+            : undefined;
+    if (typeof name !== "string" || name.length === 0 || args === undefined) {
+        return errorEnvelope(id, INVALID_PARAMS, "Invalid params: expected { name: string, arguments?: object }");
+    }
+    const session = c.get("session");
+    const accountId = session?.account_id ?? "acct_default";
+    const started = Date.now();
+    const recordedRequestBody = { tool: name, arguments: args };
+    let status = 200;
+    let responseBody = null;
+    let toolError = null;
+    let mcpResult;
+    try {
+        const value = executeTool(deps.domain, accountId, name, args);
+        responseBody = value;
+        mcpResult = { content: [{ type: "text", text: jsonText(value) }] };
+    }
+    catch (err) {
+        if (err instanceof TwinError) {
+            status = err.status;
+            const errBody = { error: { type: err.type, code: err.code, message: err.message } };
+            responseBody = errBody;
+            toolError = err.code;
+            mcpResult = { content: [{ type: "text", text: jsonText(errBody) }], isError: true };
+        }
+        else if (err instanceof z.ZodError) {
+            status = 400;
+            const errBody = {
+                error: {
+                    type: "invalid_request_error",
+                    message: err.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; "),
+                },
+            };
+            responseBody = errBody;
+            toolError = "invalid_request_error";
+            mcpResult = { content: [{ type: "text", text: jsonText(errBody) }], isError: true };
+        }
+        else {
+            status = 500;
+            const message = err instanceof Error ? err.message : "Internal Server Error";
+            responseBody = { error: { type: "api_error", message } };
+            toolError = message;
+            mcpResult = { content: [{ type: "text", text: jsonText(responseBody) }], isError: true };
+        }
+    }
+    recordToolCall(c, deps, {
+        started,
+        status,
+        requestBody: recordedRequestBody,
+        responseBody,
+        mutation: status < 400 && isMutatingTool(name),
+        error: toolError,
+    });
+    return { jsonrpc: "2.0", id, result: mcpResult };
+}
+function recordToolCall(c, deps, fields) {
+    if (!deps.recorder)
+        return;
+    const reqId = requestId();
+    deps.recorder.record({
+        ts: new Date().toISOString(),
+        run_id: deps.runId,
+        twin: "stripe",
+        request_id: reqId,
+        correlation_id: reqId,
+        scenario_step_id: c.req.header("x-pome-scenario-step-id") ?? null,
+        step_id: null,
+        tool_call_id: null,
+        method: c.req.method,
+        path: new URL(c.req.url).pathname,
+        request_body: fields.requestBody,
+        status: fields.status,
+        response_body: fields.responseBody,
+        latency_ms: Date.now() - fields.started,
+        fidelity: "semantic",
+        state_mutation: fields.mutation,
+        state_delta: null,
+        error: fields.error,
+    });
+}
+function errorEnvelope(id, code, message) {
+    return { jsonrpc: "2.0", id, error: { code, message } };
+}
+function jsonRpcErrorResponse(id, code, message) {
+    return Response.json(errorEnvelope(id, code, message), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+    });
+}
+function idOf(message) {
+    const id = message.id;
+    if (typeof id === "string" || typeof id === "number")
+        return id;
+    return null;
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function jsonText(value) {
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=mcp.js.map

package/node_modules/@pome-sh/twin-stripe/dist/src/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/mcp.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC;AAC3B,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAChC,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC;AAC9B,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC;AAE9B,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAC9C,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AAaxF,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,EAChH,GAAG,EACH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,CAAU,EAAE,IAAa;IAC9D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,IAAI,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,IAAa,EAAE,CAAU;IACjE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3F,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,EAAE,GAAc,KAAK,CAAC;IAE5B,IAAI,CAAC;QACH,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,YAAY;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACvE,KAAK,MAAM;gBACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC5C,KAAK,YAAY;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAClE,KAAK,YAAY;gBACf,OAAO,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACpD;gBACE,OAAO,aAAa,CAAC,EAAE,EAAE,gBAAgB,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA+B;IAC5D,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,eAAe,GACnB,SAAS,IAAI,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC;IACjG,OAAO;QACL,eAAe;QACf,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;QAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE;KACtE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,oCAAoC;AACpC,SAAS,WAAW;IAClB,OAAO,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;KAClD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,EAAa,EACb,MAA+B,EAC/B,IAAa,EACb,CAAU;IAEV,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GACR,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QACzD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,+DAA+D,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAgC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,IAAI,cAAc,CAAC;IAExD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,mBAAmB,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,YAAY,GAAY,IAAI,CAAC;IACjC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,SAA2E,CAAC;IAEhF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9D,YAAY,GAAG,KAAK,CAAC;QACrB,SAAS,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACpB,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACpF,YAAY,GAAG,OAAO,CAAC;YACvB,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC;YACrB,SAAS,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtF,CAAC;aAAM,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,CAAC;YACb,MAAM,OAAO,GAAG;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBAC3F;aACF,CAAC;YACF,YAAY,GAAG,OAAO,CAAC;YACvB,SAAS,GAAG,uBAAuB,CAAC;YACpC,SAAS,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAC7E,YAAY,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACzD,SAAS,GAAG,OAAO,CAAC;YACpB,SAAS,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE;QACtB,OAAO;QACP,MAAM;QACN,WAAW,EAAE,mBAAmB;QAChC,YAAY;QACZ,QAAQ,EAAE,MAAM,GAAG,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC;QAC9C,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CACrB,CAAU,EACV,IAAa,EACb,MAOC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO;IAC3B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,KAAK;QACjB,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,IAAI;QACjE,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;QACpB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;QACjC,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO;QACvC,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,WAAW,EAAE,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,EAAoB,EAAE,IAAY,EAAE,OAAe;IACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAAC,EAAoB,EAAE,IAAY,EAAE,OAAe;IAC/E,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;QACrD,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,OAAgC;IAC5C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;IACtB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/node_modules/@pome-sh/twin-stripe/dist/src/pome-routes.d.ts

@@ -0,0 +1,43 @@
+import type { Context } from "hono";
+import { Hono } from "hono";
+import type { FailureInjectionStore } from "./failure-injection.js";
+import type { Recorder, ResolvedSession, TwinStripeDatabase } from "./types.js";
+export type PomeRoutesOptions = {
+    db: TwinStripeDatabase;
+    recorder: Recorder;
+    toolCount: number;
+    /** Process start time in ms (Date.now() at module load). */
+    startedAtMs: number;
+    /** Inject ms-since-start so tests can stub the clock. */
+    nowMs?: () => number;
+    /** FDRS-339: in-memory rule store for scenario-level failure injection. */
+    failureInjection?: FailureInjectionStore;
+};
+/**
+ * Optional callback used by `mountSessionPomeRoutes` to render the
+ * `/_pome/state` payload. AGENT-B's `extendSession` passes a real one
+ * that calls `domain.exportState(accountId)`. The chassis-only default
+ * surfaces only what the chassis owns.
+ *
+ * F4: registering the route with an explicit provider — instead of
+ * mounting a stub that the domain agent has to shadow — avoids the
+ * Hono first-match-wins gotcha that hid real domain state.
+ */
+export type StateProvider = (c: Context, session: ResolvedSession | undefined) => unknown;
+export declare function tthwSeconds(startedAtMs: number, nowMs?: () => number): number;
+/**
+ * Mount the root-level pome surfaces (healthz + admin) onto an existing
+ * root Hono app. Returns the app for chaining.
+ */
+export declare function mountRootPomeRoutes(root: Hono, opts: PomeRoutesOptions): Hono;
+/**
+ * Mount the per-session pome surfaces (`_pome/*`) onto the session router
+ * BEFORE the catch-all 501. The session router already has `bearerAuth()`
+ * applied at the parent level.
+ *
+ * `stateProvider` (optional) lets AGENT-B inject a domain-aware payload
+ * for `/_pome/state`. If omitted, a chassis-only default is mounted that
+ * surfaces nothing twin-domain-specific. AGENT-B's `extendSession`
+ * passes a closure over `domain.exportState(accountId)`.
+ */
+export declare function mountSessionPomeRoutes(session: Hono, opts: PomeRoutesOptions, stateProvider?: StateProvider): Hono;