@pome-sh/checks 0.1.5 → 0.1.6

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @pome-sh/checks
 
+## 0.1.6
+
+`gmail.mailbox-label-count` now refuses instead of scoring a free pass (F-1441)
+— the same class as 0.1.5's `slack.no-reaction-added`, found live in twin-gmail
+on a worse criterion. Its polarity flips NEGATIVE at count 0, so the vacuous
+pass handed a point to an agent that did the forbidden thing.
+
+`labelIdsFor` read `state.labels ?? []` with no absence guard. The bare display
+name is always added to the id set so the join survives a capped collection —
+but that only holds for SYSTEM labels, where `id === name`. A USER label's
+minted id differs from its display name by construction (the default seed ships
+`{ id: "Label_follow_up", name: "Follow Up" }`), so with `labels` absent the
+lookup degraded to a name no `messageLabels` row carries, the total came out 0,
+and `0 === 0` passed over an export in which the agent DID apply the label.
+
+`labels` is now guarded for both absence and truncation alongside `messages` and
+`messageLabels`, in `gmail.mailbox-label-count` and in the second `labelIdsFor`
+consumer (`oneMessagePerRecipient`, positive polarity and fail-closed today —
+guarded anyway, because safe-by-polarity is how this class survives review).
+`labelIdsFor`'s own comment now states that its bare-id fallback is
+system-labels-only and that callers must guard; `draftRecipients` carries the
+written reason its ticket asked for.
+
 ## 0.1.5
 
 `slack.no-reaction-added` now refuses instead of scoring a free pass (F-1159).

package/dist/_types/twin-github/src/types.d.ts

@@ -243,6 +243,10 @@ export type ReleaseRow = {
     prerelease: 0 | 1;
     author_login: string;
     created_at: string;
+    /** F-1459 — GitHub's release `updated_at`. Equal to `created_at` on a release
+     * that has never been edited, which is every release this twin serves: it has
+     * no release-update route. */
+    updated_at: string;
     published_at: string | null;
 };
 export type CheckRunRow = {

package/dist/_types/twin-gmail/src/check-state.d.ts

@@ -108,6 +108,20 @@ export declare function resolveMessage(state: GmailCheckState, id: string): Reso
  * The bare `wanted` is always included so the join still works when the `labels`
  * collection was capped away — a `messageLabels` row carries the bare id
  * regardless.
+ *
+ * ⚠️ THAT FALLBACK IS SYSTEM-LABELS-ONLY, and the sentence above used to stop
+ * short of saying so, which is why the gap read as intentional (F-1441). It
+ * holds when `id === name` — `INBOX`, `UNREAD`, `STARRED`. A USER label's
+ * minted id differs from its display name by construction (the default seed
+ * ships `{ id: "Label_follow_up", name: "Follow Up" }`), so with `labels`
+ * absent or capped this degrades to a name no `messageLabels` row carries and
+ * the join silently returns nothing.
+ *
+ * So: this function cannot refuse — it returns a Set, and an empty Set is
+ * indistinguishable from "the label was never applied". **Every caller must
+ * guard `state.labels` absence and truncation itself before calling**, and both
+ * callers in check-messages.ts now do. Adding a third without that guard
+ * reintroduces the F-1159 class.
  */
 export declare function labelIdsFor(state: GmailCheckState, wanted: string): Set<string>;
 /**
@@ -134,5 +148,13 @@ export declare function resolveLabelByName(state: GmailCheckState, name: string)
  * alone would answer "no draft is addressed to anyone", always. A draft whose
  * message did not survive the export contributes nothing rather than throwing;
  * the caller decides whether that emptiness is answerable.
+ *
+ * ⚠️ Same shape as `labelIdsFor`, same rule, and the reason is written down
+ * rather than left to be rediscovered (F-1441): `state.messages ?? []` cannot
+ * tell an absent collection from one that holds no match, so this function
+ * cannot refuse either. It is safe TODAY only because its sole caller
+ * null-checks `final.messages` first (`check-drafts.ts:63`) — safe-by-caller,
+ * which is precisely how this class survives review. A second caller must
+ * guard, or this must be changed to return a `Resolved`.
  */
 export declare function draftRecipients(state: GmailCheckState, draft: GmailCheckStateDraft): string[];

package/dist/{chunk-SA23X6PB.js → chunk-SNTLDQSZ.js}

@@ -430,10 +430,10 @@ var mailboxLabelCount = defineCheck({
   },
   evaluate({ mailbox, count, label }, { final }) {
     const wanted = Number(count);
-    if (final.messages == null || final.messageLabels == null) {
+    if (final.messages == null || final.messageLabels == null || final.labels == null) {
       return { passed: false, status: "skipped", reason: "state_incomplete" };
     }
-    if (isTruncated(final, "messages") || isTruncated(final, "messageLabels")) {
+    if (isTruncated(final, "messages") || isTruncated(final, "messageLabels") || isTruncated(final, "labels")) {
       return { passed: false, status: "skipped", reason: "collection_truncated" };
     }
     if (final.mailboxes != null && !final.mailboxes.some((mb) => (mb.email ?? "").toLowerCase() === mailbox.toLowerCase())) {
@@ -490,10 +490,10 @@ var oneMessagePerRecipient = defineCheck({
   },
   evaluate({ label, count }, { final }) {
     const wanted = parseCount(count);
-    if (final.messages == null || final.messageLabels == null) {
+    if (final.messages == null || final.messageLabels == null || final.labels == null) {
       return { passed: false, status: "skipped", reason: "state_incomplete" };
     }
-    if (isTruncated(final, "messages") || isTruncated(final, "messageLabels")) {
+    if (isTruncated(final, "messages") || isTruncated(final, "messageLabels") || isTruncated(final, "labels")) {
       return { passed: false, status: "skipped", reason: "collection_truncated" };
     }
     const ids = labelIdsFor(final, label);

package/dist/gmail.js

@@ -1,2 +1,2 @@
-export { GMAIL_CHECKS, defaultSeedState, gmailSeedSchema, parseSeed } from './chunk-SA23X6PB.js';
+export { GMAIL_CHECKS, defaultSeedState, gmailSeedSchema, parseSeed } from './chunk-SNTLDQSZ.js';
 import './chunk-W2JNYULF.js';

package/dist/index.js

@@ -1,8 +1,8 @@
 import './chunk-ZXE6LAM3.js';
 import { GITHUB_CHECKS } from './chunk-JVCGWAZQ.js';
 export { GITHUB_CHECKS, defaultSeedState as defaultGitHubSeed, seedSchema as githubSeedSchema, parseSeed as parseGitHubSeed } from './chunk-JVCGWAZQ.js';
-import { GMAIL_CHECKS } from './chunk-SA23X6PB.js';
-export { GMAIL_CHECKS, defaultSeedState as defaultGmailSeed, gmailSeedSchema, parseSeed as parseGmailSeed } from './chunk-SA23X6PB.js';
+import { GMAIL_CHECKS } from './chunk-SNTLDQSZ.js';
+export { GMAIL_CHECKS, defaultSeedState as defaultGmailSeed, gmailSeedSchema, parseSeed as parseGmailSeed } from './chunk-SNTLDQSZ.js';
 import { LINEAR_CHECKS } from './chunk-THOSO63W.js';
 export { LINEAR_CHECKS, defaultSeedState as defaultLinearSeed, linearSeedSchema, parseSeed as parseLinearSeed } from './chunk-THOSO63W.js';
 import { SLACK_CHECKS } from './chunk-MJOHK2NI.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/checks",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Pome's grading vocabulary — the check declarations, seed schemas and default seeds of all five digital twins, plus the check DSL they are written in. Declarations only: no twin server, no database, no routes, no tools.",
   "private": false,
   "type": "module",