thevoidforge 21.0.0

package/dist/wizard/api/terminal.js

@@ -0,0 +1,241 @@
+/**
+ * Terminal API — WebSocket bridge between browser (xterm.js) and server (node-pty).
+ * Also REST endpoints for session management.
+ *
+ * WebSocket protocol:
+ *   Client → Server: raw keystrokes (text frames)
+ *   Server → Client: raw terminal output (text frames)
+ *   Client → Server: JSON control messages: { type: "resize", cols, rows }
+ *   Server → Client: JSON control messages: { type: "exit", code }
+ *
+ * Auth: vault password required in the WebSocket URL query string.
+ */
+import { createHmac, timingSafeEqual, randomBytes } from 'node:crypto';
+// SEC-R2-108: Per-boot random HMAC key — decoupled from vault password to prevent offline brute-force
+const TERMINAL_HMAC_KEY = randomBytes(32);
+import { WebSocketServer, WebSocket } from 'ws';
+import { access, realpath } from 'node:fs/promises';
+import { join } from 'node:path';
+import { addRoute } from '../router.js';
+import { getSessionPassword } from './credentials.js';
+import { getServerPort, getServerHost } from '../lib/server-config.js';
+import { parseJsonBody } from '../lib/body-parser.js';
+import { createSession, writeToSession, onSessionData, resizeSession, killSession, listSessions, } from '../lib/pty-manager.js';
+import { validateSession, parseSessionCookie, getClientIp, isRemoteMode } from '../lib/tower-auth.js';
+import { hasProjectAccess } from '../lib/user-manager.js';
+import { findByDirectory } from '../lib/project-registry.js';
+import { sendJson } from '../lib/http-helpers.js';
+// ── REST endpoints for session management ──────────────
+// GET /api/terminal/sessions — list active PTY sessions (filtered by project access)
+addRoute('GET', '/api/terminal/sessions', async (req, res) => {
+    const password = getSessionPassword();
+    if (!password) {
+        sendJson(res, 401, { error: 'Vault is locked.' });
+        return;
+    }
+    let allSessions = listSessions();
+    // In remote mode, filter sessions by user's project access
+    if (isRemoteMode()) {
+        const token = parseSessionCookie(req.headers.cookie);
+        const ip = getClientIp(req);
+        const userSession = token ? validateSession(token, ip) : null;
+        if (userSession && userSession.role !== 'admin') {
+            // Non-admins only see their own sessions
+            allSessions = allSessions.filter((s) => s.username === userSession.username);
+        }
+    }
+    sendJson(res, 200, { sessions: allSessions, count: allSessions.length });
+});
+// POST /api/terminal/sessions — create a new PTY session
+addRoute('POST', '/api/terminal/sessions', async (req, res) => {
+    const password = getSessionPassword();
+    if (!password) {
+        sendJson(res, 401, { error: 'Vault is locked.' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (!body.projectDir || !body.projectName) {
+        sendJson(res, 400, { error: 'projectDir and projectName are required' });
+        return;
+    }
+    // SEC-003/QA-002: Validate projectDir — absolute path, no traversal
+    if (!body.projectDir.startsWith('/') || body.projectDir.includes('..')) {
+        sendJson(res, 400, { error: 'projectDir must be an absolute path with no ".." segments' });
+        return;
+    }
+    // IG-R4: Resolve symlinks and use real path for all operations
+    try {
+        body.projectDir = await realpath(body.projectDir);
+    }
+    catch {
+        sendJson(res, 400, { error: 'Could not resolve project directory path' });
+        return;
+    }
+    // Verify this is a VoidForge project (CLAUDE.md exists)
+    try {
+        await access(join(body.projectDir, 'CLAUDE.md'));
+    }
+    catch {
+        sendJson(res, 400, { error: 'Not a VoidForge project — no CLAUDE.md found' });
+        return;
+    }
+    // Extract user context and check per-project access
+    let sessionUsername = '';
+    if (isRemoteMode()) {
+        const token = parseSessionCookie(req.headers.cookie);
+        const ip = getClientIp(req);
+        const userSession = token ? validateSession(token, ip) : null;
+        if (!userSession) {
+            sendJson(res, 401, { error: 'Authentication required' });
+            return;
+        }
+        sessionUsername = userSession.username;
+        // Check per-project access — deployer minimum for terminal
+        const project = await findByDirectory(body.projectDir);
+        if (!project) {
+            // Project not in registry — deny access (cannot verify permissions)
+            sendJson(res, 404, { error: 'Project not found in registry' });
+            return;
+        }
+        const projectAccess = await hasProjectAccess(userSession, project.id, 'deployer');
+        if (!projectAccess) {
+            sendJson(res, 404, { error: 'Project not found' });
+            return;
+        }
+    }
+    try {
+        const session = await createSession(body.projectDir, body.projectName, body.label || 'Shell', body.initialCommand, body.cols || 120, body.rows || 30, sessionUsername);
+        // SEC-001/SEC-002: Generate per-session auth token for WebSocket upgrade
+        const authToken = createHmac('sha256', TERMINAL_HMAC_KEY).update(session.id).digest('hex');
+        sendJson(res, 200, { session, authToken });
+    }
+    catch (err) {
+        sendJson(res, 400, { error: err.message });
+    }
+});
+// POST /api/terminal/sessions/:id/kill — kill a session (ownership check in remote mode)
+addRoute('POST', '/api/terminal/kill', async (req, res) => {
+    const password = getSessionPassword();
+    if (!password) {
+        sendJson(res, 401, { error: 'Vault is locked.' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (!body.sessionId) {
+        sendJson(res, 400, { error: 'sessionId is required' });
+        return;
+    }
+    // In remote mode, non-admins can only kill their own sessions
+    if (isRemoteMode()) {
+        const token = parseSessionCookie(req.headers.cookie);
+        const ip = getClientIp(req);
+        const userSession = token ? validateSession(token, ip) : null;
+        if (userSession && userSession.role !== 'admin') {
+            const sessions = listSessions();
+            const target = sessions.find((s) => s.id === body.sessionId);
+            if (!target || target.username !== userSession.username) {
+                sendJson(res, 404, { error: 'Session not found' });
+                return;
+            }
+        }
+    }
+    killSession(body.sessionId);
+    sendJson(res, 200, { killed: true });
+});
+// ── WebSocket upgrade handler (using 'ws' library) ─────
+/** Shared WebSocketServer instance — noServer mode lets us handle upgrade manually. */
+const wss = new WebSocketServer({ noServer: true });
+/**
+ * Handle a WebSocket upgrade request for a terminal session.
+ * URL: /ws/terminal?session=<id>&token=<authToken>
+ *
+ * Auth flow: vault password → origin check → HMAC token → session existence.
+ * Then ws library handles the protocol handshake.
+ */
+export function handleTerminalUpgrade(req, socket, head, userSession) {
+    void userSession;
+    const password = getSessionPassword();
+    if (!password) {
+        socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+        socket.destroy();
+        return;
+    }
+    // SEC-001: Origin validation
+    const origin = req.headers.origin || '';
+    const port = getServerPort();
+    const allowedOrigins = [`http://127.0.0.1:${port}`, `http://localhost:${port}`];
+    const remoteHost = getServerHost();
+    if (remoteHost) {
+        allowedOrigins.push(`https://${remoteHost}`);
+    }
+    if (!origin || !allowedOrigins.includes(origin)) {
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+    }
+    const url = new URL(req.url || '', 'http://localhost');
+    const sessionId = url.searchParams.get('session');
+    if (!sessionId) {
+        socket.write('HTTP/1.1 400 Bad Request\r\n\r\n');
+        socket.destroy();
+        return;
+    }
+    // SEC-002: Validate per-session auth token
+    const token = url.searchParams.get('token');
+    const expectedToken = createHmac('sha256', TERMINAL_HMAC_KEY).update(sessionId).digest('hex');
+    if (!token || token.length !== expectedToken.length || !timingSafeEqual(Buffer.from(token), Buffer.from(expectedToken))) {
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+    }
+    // Verify session exists
+    const sessions = listSessions();
+    if (!sessions.find((s) => s.id === sessionId)) {
+        socket.write('HTTP/1.1 404 Not Found\r\n\r\n');
+        socket.destroy();
+        return;
+    }
+    // Let the ws library handle the WebSocket handshake
+    wss.handleUpgrade(req, socket, head, (ws) => {
+        // Subscribe to PTY output → send to browser
+        const unsubscribe = onSessionData(sessionId, (data) => {
+            if (ws.readyState === WebSocket.OPEN) {
+                try {
+                    ws.send(data);
+                }
+                catch { /* client gone */ }
+            }
+        });
+        // Browser → PTY: keystrokes and control messages
+        ws.on('message', (raw) => {
+            const msg = typeof raw === 'string' ? raw : raw.toString('utf-8');
+            // JSON control messages (resize)
+            if (msg.startsWith('{')) {
+                try {
+                    const parsed = JSON.parse(msg);
+                    // IG-R2: Validate numeric types to prevent NaN propagation to node-pty
+                    if (parsed.type === 'resize' && typeof parsed.cols === 'number' && typeof parsed.rows === 'number'
+                        && Number.isFinite(parsed.cols) && Number.isFinite(parsed.rows)) {
+                        resizeSession(sessionId, parsed.cols, parsed.rows);
+                        return;
+                    }
+                }
+                catch { /* not JSON — treat as keystroke input */ }
+            }
+            // Regular input → PTY
+            try {
+                writeToSession(sessionId, msg);
+            }
+            catch {
+                ws.close();
+            }
+        });
+        ws.on('close', () => {
+            unsubscribe();
+            // Don't kill session — allow reconnection. Idle timeout handles cleanup.
+        });
+        ws.on('error', () => {
+            unsubscribe();
+        });
+    });
+}

package/dist/wizard/api/users.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Users API — Multi-user management endpoints.
+ * All user management requires admin role.
+ * Invite completion is public (token-authenticated).
+ */
+export {};

package/dist/wizard/api/users.js

@@ -0,0 +1,244 @@
+/**
+ * Users API — Multi-user management endpoints.
+ * All user management requires admin role.
+ * Invite completion is public (token-authenticated).
+ */
+import { addRoute } from '../router.js';
+import { parseJsonBody } from '../lib/body-parser.js';
+import { validateSession, parseSessionCookie, isRemoteMode, getClientIp, checkRateLimit, isValidUsername, } from '../lib/tower-auth.js';
+import { createInvite, completeInvite, removeUser, updateUserRole, listUsers, hasRole, isValidRole, } from '../lib/user-manager.js';
+import { audit } from '../lib/audit-log.js';
+import { removeUserFromAllProjects } from '../lib/project-registry.js';
+import { sendJson } from '../lib/http-helpers.js';
+/** Extract and validate session from request. Returns null if not authenticated. */
+function getSession(req) {
+    const token = parseSessionCookie(req.headers.cookie);
+    const ip = getClientIp(req);
+    if (!token)
+        return null;
+    return validateSession(token, ip);
+}
+// GET /api/users — List all users (admin only)
+addRoute('GET', '/api/users', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    const session = getSession(req);
+    if (!session) {
+        sendJson(res, 401, { success: false, error: 'Authentication required' });
+        return;
+    }
+    if (!hasRole(session, 'admin')) {
+        const ip = getClientIp(req);
+        await audit('access_denied', ip, session.username, { action: 'list_users' });
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return;
+    }
+    const users = await listUsers();
+    sendJson(res, 200, { success: true, data: { users } });
+});
+// POST /api/users/invite — Create invitation (admin only)
+addRoute('POST', '/api/users/invite', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    const session = getSession(req);
+    if (!session) {
+        sendJson(res, 401, { success: false, error: 'Authentication required' });
+        return;
+    }
+    // Admin check at route level (defense-in-depth — createInvite also checks)
+    if (!hasRole(session, 'admin')) {
+        const ip = getClientIp(req);
+        await audit('access_denied', ip, session.username, { action: 'create_invite' });
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (typeof body !== 'object' || body === null) {
+        sendJson(res, 400, { success: false, error: 'Request body must be a JSON object' });
+        return;
+    }
+    const { role } = body;
+    if (typeof role !== 'string' || !isValidRole(role)) {
+        sendJson(res, 400, { success: false, error: 'role must be one of: admin, deployer, viewer' });
+        return;
+    }
+    const ip = getClientIp(req);
+    try {
+        const invite = await createInvite(role, session, ip);
+        sendJson(res, 201, { success: true, data: invite });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Failed to create invite';
+        if (message === 'Too many pending invites' || message === 'Invalid role') {
+            sendJson(res, 400, { success: false, error: message });
+        }
+        else {
+            sendJson(res, 400, { success: false, error: 'Failed to create invite' });
+        }
+    }
+});
+// POST /api/users/complete-invite — New user completes invitation setup
+addRoute('POST', '/api/users/complete-invite', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    // Rate limit — this is a public endpoint (auth-exempt)
+    const ip = getClientIp(req);
+    const rateCheck = checkRateLimit(ip);
+    if (!rateCheck.allowed) {
+        sendJson(res, 429, { success: false, error: 'Too many attempts. Try again later.' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (typeof body !== 'object' || body === null) {
+        sendJson(res, 400, { success: false, error: 'Request body must be a JSON object' });
+        return;
+    }
+    const { token, username, password } = body;
+    if (typeof token !== 'string' || token.length !== 64) {
+        sendJson(res, 400, { success: false, error: 'Invalid invite token' });
+        return;
+    }
+    if (typeof username !== 'string' || !isValidUsername(username.trim())) {
+        sendJson(res, 400, { success: false, error: 'Username must be 3-64 characters (letters, numbers, . _ -)' });
+        return;
+    }
+    if (typeof password !== 'string' || password.length < 12 || password.length > 256) {
+        sendJson(res, 400, { success: false, error: 'Password must be 12-256 characters' });
+        return;
+    }
+    try {
+        const result = await completeInvite(token, username.trim(), password, ip);
+        sendJson(res, 201, {
+            success: true,
+            data: {
+                totpSecret: result.totpSecret,
+                totpUri: result.totpUri,
+                role: result.role,
+                message: 'Scan the QR code with your authenticator app.',
+            },
+        }, true); // no-cache — TOTP secret must not be cached
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Failed to complete invite';
+        if (message === 'Invalid or expired invite') {
+            sendJson(res, 404, { success: false, error: 'Invalid or expired invite' });
+        }
+        else if (message === 'Username already taken') {
+            sendJson(res, 409, { success: false, error: 'Username already taken' });
+        }
+        else {
+            sendJson(res, 400, { success: false, error: 'Failed to complete setup' });
+        }
+    }
+});
+// POST /api/users/remove — Remove a user (admin only)
+addRoute('POST', '/api/users/remove', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    const session = getSession(req);
+    if (!session) {
+        sendJson(res, 401, { success: false, error: 'Authentication required' });
+        return;
+    }
+    if (!hasRole(session, 'admin')) {
+        const ip = getClientIp(req);
+        await audit('access_denied', ip, session.username, { action: 'remove_user' });
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (typeof body !== 'object' || body === null) {
+        sendJson(res, 400, { success: false, error: 'Request body must be a JSON object' });
+        return;
+    }
+    const { username } = body;
+    if (typeof username !== 'string' || username.trim().length === 0) {
+        sendJson(res, 400, { success: false, error: 'username is required' });
+        return;
+    }
+    // Prevent self-deletion
+    if (username.trim() === session.username) {
+        sendJson(res, 400, { success: false, error: 'Cannot remove yourself' });
+        return;
+    }
+    const ip = getClientIp(req);
+    try {
+        await removeUser(username.trim());
+        // Clean up project access entries for the removed user
+        const cleanedProjects = await removeUserFromAllProjects(username.trim());
+        await audit('user_remove', ip, session.username, { target: username.trim(), projectsCleanedUp: cleanedProjects });
+        sendJson(res, 200, { success: true });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Failed to remove user';
+        if (message === 'User not found' || message === 'Cannot remove the last admin') {
+            sendJson(res, 400, { success: false, error: message });
+        }
+        else {
+            sendJson(res, 400, { success: false, error: 'Failed to remove user' });
+        }
+    }
+});
+// POST /api/users/role — Change a user's role (admin only)
+addRoute('POST', '/api/users/role', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    const session = getSession(req);
+    if (!session) {
+        sendJson(res, 401, { success: false, error: 'Authentication required' });
+        return;
+    }
+    if (!hasRole(session, 'admin')) {
+        const ip = getClientIp(req);
+        await audit('access_denied', ip, session.username, { action: 'change_role' });
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (typeof body !== 'object' || body === null) {
+        sendJson(res, 400, { success: false, error: 'Request body must be a JSON object' });
+        return;
+    }
+    const { username, role } = body;
+    if (typeof username !== 'string' || username.trim().length === 0) {
+        sendJson(res, 400, { success: false, error: 'username is required' });
+        return;
+    }
+    if (typeof role !== 'string' || !isValidRole(role)) {
+        sendJson(res, 400, { success: false, error: 'role must be one of: admin, deployer, viewer' });
+        return;
+    }
+    // Prevent self-demotion (accidental lockout)
+    if (username.trim() === session.username && role !== session.role) {
+        sendJson(res, 400, { success: false, error: 'Cannot change your own role' });
+        return;
+    }
+    const ip = getClientIp(req);
+    try {
+        await updateUserRole(username.trim(), role);
+        await audit('role_change', ip, session.username, {
+            target: username.trim(),
+            newRole: role,
+        });
+        sendJson(res, 200, { success: true });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Failed to update role';
+        if (message === 'User not found' || message === 'Cannot demote the last admin') {
+            sendJson(res, 400, { success: false, error: message });
+        }
+        else {
+            sendJson(res, 400, { success: false, error: 'Failed to update role' });
+        }
+    }
+});

package/dist/wizard/api/war-room.d.ts

@@ -0,0 +1,14 @@
+/**
+ * War Room API — Alternative dashboard view using shared data parsers.
+ *
+ * Shares all parsers and WebSocket infra with Danger Room via wizard/lib/dashboard-*.ts.
+ * Routes are registered under /api/war-room/* for the war-room.html frontend.
+ */
+import type { IncomingMessage } from 'node:http';
+import type { Duplex } from 'node:stream';
+export declare const broadcastWarRoom: (data: {
+    type: string;
+    [key: string]: unknown;
+}) => void;
+export declare const closeWarRoom: () => void;
+export declare const handleWarRoomUpgrade: (req: IncomingMessage, socket: Duplex, head: Buffer) => void;

package/dist/wizard/api/war-room.js

@@ -0,0 +1,45 @@
+/**
+ * War Room API — Alternative dashboard view using shared data parsers.
+ *
+ * Shares all parsers and WebSocket infra with Danger Room via wizard/lib/dashboard-*.ts.
+ * Routes are registered under /api/war-room/* for the war-room.html frontend.
+ */
+import { addRoute } from '../router.js';
+import { sendJson } from '../lib/http-helpers.js';
+import { parseCampaignState, parseBuildState, parseFindings, readDeployLog, readVersion, readContextStats, } from '../lib/dashboard-data.js';
+import { createDashboardWs } from '../lib/dashboard-ws.js';
+// ── WebSocket ───────────────────────────────────
+const ws = createDashboardWs('War Room');
+export const broadcastWarRoom = ws.broadcast;
+export const closeWarRoom = ws.close;
+export const handleWarRoomUpgrade = (req, socket, head) => ws.handleUpgrade(req, socket, head);
+// ── REST endpoints ──────────────────────────────
+addRoute('GET', '/api/war-room/campaign', async (_req, res) => {
+    sendJson(res, 200, await parseCampaignState());
+});
+addRoute('GET', '/api/war-room/build', async (_req, res) => {
+    sendJson(res, 200, await parseBuildState());
+});
+addRoute('GET', '/api/war-room/findings', async (_req, res) => {
+    sendJson(res, 200, await parseFindings());
+});
+addRoute('GET', '/api/war-room/version', async (_req, res) => {
+    sendJson(res, 200, await readVersion());
+});
+addRoute('GET', '/api/war-room/deploy', async (_req, res) => {
+    sendJson(res, 200, await readDeployLog());
+});
+addRoute('GET', '/api/war-room/context', async (_req, res) => {
+    const stats = await readContextStats();
+    sendJson(res, 200, stats);
+});
+addRoute('GET', '/api/war-room/experiments', async (_req, res) => {
+    try {
+        const { listExperiments } = await import('../lib/experiment.js');
+        const experiments = await listExperiments();
+        sendJson(res, 200, { experiments, total: experiments.length });
+    }
+    catch {
+        sendJson(res, 200, { experiments: [], total: 0 });
+    }
+});

package/dist/wizard/lib/ad-platform-core.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Ad platform core — re-exports from the ad-platform-adapter pattern for wizard runtime use.
+ * ARCH-R2-012: Production code should not import from docs/patterns/ directly.
+ */
+export type { AdPlatformSetup, AdPlatformAdapter, ReadOnlyAdapter, CampaignConfig, CampaignResult, CampaignUpdate, CreativeConfig, SpendReport, PerformanceMetrics, InsightData, OAuthTokens, ConnectionStatus, PlatformError, Cents, Percentage, Ratio, AdPlatform, } from './patterns/ad-platform-adapter.js';
+export { toCents, toDollars } from './patterns/ad-platform-adapter.js';

package/dist/wizard/lib/ad-platform-core.js

@@ -0,0 +1 @@
+export { toCents, toDollars } from './patterns/ad-platform-adapter.js';

package/dist/wizard/lib/adapters/index.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Ad Platform Adapter Registry
+ *
+ * v17.0 No Stubs Doctrine: only fully-implemented adapters are exported.
+ * Stub files (meta, google, tiktok, linkedin, twitter, reddit, mercury, brex)
+ * were deleted — they contained 77 `throw new Error('Implement...')` calls.
+ * These adapters will be implemented when developer accounts are available (v17.1+).
+ * See ROADMAP.md for the planned adapter list.
+ *
+ * Available adapters:
+ * - SandboxSetup/SandboxAdapter — full implementation with realistic fake data
+ * - SandboxBankAdapter — full implementation for bank/revenue demo
+ * - StripeAdapter — real Stripe API via node:https (free test mode)
+ *
+ * PRD Reference: §9.5, §9.19.10, §9.20.4, §8.1 (Implementation Completeness Policy)
+ */
+export { SandboxSetup, SandboxAdapter } from './sandbox.js';
+export { SandboxBankAdapter } from './sandbox-bank.js';
+export { StripeAdapter } from './stripe.js';
+export type { AdPlatform } from './types.js';
+import type { AdPlatform } from './types.js';
+type PlatformInfo = {
+    name: string;
+    minBudgetCents: number;
+    sandbox?: boolean;
+    implemented: boolean;
+};
+/** Platform registry — tracks both available and planned adapters. */
+export declare const PLATFORM_REGISTRY: Record<AdPlatform | 'sandbox', PlatformInfo>;
+/** Revenue adapters — only those with real implementations. */
+export declare const REVENUE_ADAPTERS: {
+    readonly sandbox: {
+        readonly name: "Sandbox Bank (Demo)";
+        readonly implemented: true;
+    };
+    readonly stripe: {
+        readonly name: "Stripe";
+        readonly implemented: true;
+    };
+    readonly paddle: {
+        readonly name: "Paddle";
+        readonly implemented: false;
+    };
+    readonly mercury: {
+        readonly name: "Mercury";
+        readonly implemented: false;
+    };
+    readonly brex: {
+        readonly name: "Brex";
+        readonly implemented: false;
+    };
+};

package/dist/wizard/lib/adapters/index.js

@@ -0,0 +1,38 @@
+/**
+ * Ad Platform Adapter Registry
+ *
+ * v17.0 No Stubs Doctrine: only fully-implemented adapters are exported.
+ * Stub files (meta, google, tiktok, linkedin, twitter, reddit, mercury, brex)
+ * were deleted — they contained 77 `throw new Error('Implement...')` calls.
+ * These adapters will be implemented when developer accounts are available (v17.1+).
+ * See ROADMAP.md for the planned adapter list.
+ *
+ * Available adapters:
+ * - SandboxSetup/SandboxAdapter — full implementation with realistic fake data
+ * - SandboxBankAdapter — full implementation for bank/revenue demo
+ * - StripeAdapter — real Stripe API via node:https (free test mode)
+ *
+ * PRD Reference: §9.5, §9.19.10, §9.20.4, §8.1 (Implementation Completeness Policy)
+ */
+export { SandboxSetup, SandboxAdapter } from './sandbox.js';
+export { SandboxBankAdapter } from './sandbox-bank.js';
+export { StripeAdapter } from './stripe.js';
+/** Platform registry — tracks both available and planned adapters. */
+export const PLATFORM_REGISTRY = {
+    sandbox: { name: 'Sandbox (Demo)', minBudgetCents: 0, sandbox: true, implemented: true },
+    meta: { name: 'Meta (Facebook/Instagram)', minBudgetCents: 100, implemented: false },
+    google: { name: 'Google Ads', minBudgetCents: 100, implemented: false },
+    tiktok: { name: 'TikTok', minBudgetCents: 2000, implemented: false },
+    linkedin: { name: 'LinkedIn', minBudgetCents: 1000, implemented: false },
+    twitter: { name: 'Twitter/X', minBudgetCents: 100, implemented: false },
+    reddit: { name: 'Reddit', minBudgetCents: 500, implemented: false },
+    snap: { name: 'Snapchat', minBudgetCents: 500, implemented: false },
+};
+/** Revenue adapters — only those with real implementations. */
+export const REVENUE_ADAPTERS = {
+    sandbox: { name: 'Sandbox Bank (Demo)', implemented: true },
+    stripe: { name: 'Stripe', implemented: true },
+    paddle: { name: 'Paddle', implemented: false },
+    mercury: { name: 'Mercury', implemented: false },
+    brex: { name: 'Brex', implemented: false },
+};

package/dist/wizard/lib/adapters/sandbox-bank.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Sandbox Bank Adapter — full implementation for development/demo.
+ *
+ * Implements RevenueSourceAdapter with realistic fake financial data.
+ * Every method returns valid-shaped data. No throws.
+ * This IS a full implementation for a sandbox bank (No Stubs Doctrine, v17.0).
+ */
+import type { RevenueSourceAdapter, RevenueCredentials, ConnectionResult, TransactionPage, BalanceResult, DateRange } from '../revenue-types.js';
+export declare class SandboxBankAdapter implements RevenueSourceAdapter {
+    private accountName;
+    private balanceCents;
+    constructor(label?: string, initialBalanceCents?: number);
+    connect(credentials: RevenueCredentials): Promise<ConnectionResult>;
+    getTransactions(dateRange: DateRange, cursor?: string): Promise<TransactionPage>;
+    getBalance(): Promise<BalanceResult>;
+    detectCurrency(_credentials: RevenueCredentials): Promise<string>;
+}