@pome-sh/cli 0.2.0 → 0.4.0

package/node_modules/@pome-sh/shared-types/manifest-schema.json

@@ -0,0 +1,68 @@
+{
+  "$id": "https://pome.sh/schemas/v1/pome.json",
+  "title": "Pome agent manifest (pome.json / pome.yaml)",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "agent": {
+      "type": "object",
+      "properties": {
+        "slug": {
+          "type": "string",
+          "maxLength": 64,
+          "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "description": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "framework": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "required": [
+        "slug"
+      ]
+    },
+    "command": {
+      "type": "string",
+      "minLength": 1
+    },
+    "twins": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "tasks": {
+      "type": "string",
+      "minLength": 1
+    },
+    "artifacts_dir": {
+      "default": "runs",
+      "type": "string",
+      "minLength": 1
+    },
+    "pass_threshold": {
+      "default": 100,
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 100
+    }
+  },
+  "required": [
+    "agent"
+  ]
+}

package/node_modules/@pome-sh/shared-types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/shared-types",
-  "version": "0.9.0",
+  "version": "0.12.1",
   "description": "Shared wire-format contract for Pome — Zod schemas for traces, recorder events, runs, OTel mapping, and secret redaction.",
   "private": false,
   "type": "module",
@@ -34,16 +34,17 @@
   },
   "files": [
     "dist",
+    "manifest-schema.json",
     "trace-contract.json"
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/pome-sh/pome-twins.git",
+    "url": "git+https://github.com/pome-sh/digital-twins.git",
     "directory": "packages/shared-types"
   },
-  "homepage": "https://github.com/pome-sh/pome-twins/tree/main/packages/shared-types",
+  "homepage": "https://github.com/pome-sh/digital-twins/tree/main/packages/shared-types",
   "bugs": {
-    "url": "https://github.com/pome-sh/pome-twins/issues"
+    "url": "https://github.com/pome-sh/digital-twins/issues"
   },
   "peerDependencies": {
     "zod": "^4.1.13"

package/node_modules/@pome-sh/shared-types/trace-contract.json

@@ -1,6 +1,6 @@
 {
   "package": "@pome-sh/shared-types",
-  "version": "0.9.0",
+  "version": "0.12.1",
   "zod": {
     "range": "^4.1.13",
     "major": 4

package/node_modules/@pome-sh/twin-github/README.md

@@ -1,6 +1,6 @@
 # Pome Twin: GitHub
 
-> One of three twins in this repository (GitHub, Stripe x402, Slack).
+> One of four twins in this repository (GitHub, Stripe x402, Slack, Gmail).
 
 `@pome-sh/twin-github` is a local, stateful GitHub twin for agent testing. It exposes GitHub-shaped REST routes plus a 65-tool MCP-style API backed by the same SQLite domain services.
 

package/node_modules/@pome-sh/twin-github/dist/src/access-control.d.ts

@@ -12,18 +12,18 @@ export declare function githubAccessControlPayload(): {
         tool: string;
         operation: string;
         method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-        category: "collaborators" | "labels" | "issues" | "pull_requests" | "milestones" | "issue_comments" | "branches_files" | "commits_diffs" | "status_checks" | "tags_releases";
+        category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
         default_allowed: boolean;
         v2: boolean;
     }[];
     categories: {
-        category: "collaborators" | "labels" | "issues" | "pull_requests" | "milestones" | "issue_comments" | "branches_files" | "commits_diffs" | "status_checks" | "tags_releases";
+        category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
         label: string;
         endpoints: {
             tool: string;
             operation: string;
             method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-            category: "collaborators" | "labels" | "issues" | "pull_requests" | "milestones" | "issue_comments" | "branches_files" | "commits_diffs" | "status_checks" | "tags_releases";
+            category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
             default_allowed: boolean;
             v2: boolean;
         }[];

package/node_modules/@pome-sh/twin-github/dist/src/domain.d.ts

@@ -1586,7 +1586,7 @@ export declare class GitHubDomain {
         statuses: {
             id: number;
             node_id: string;
-            state: "error" | "failure" | "pending" | "success";
+            state: "error" | "success" | "failure" | "pending";
             description: string;
             target_url: string;
             context: string;
@@ -2397,7 +2397,7 @@ export declare class GitHubDomain {
     }, onDelta?: StateDeltaCallback): {
         id: number;
         node_id: string;
-        state: "error" | "failure" | "pending" | "success";
+        state: "error" | "success" | "failure" | "pending";
         description: string;
         target_url: string;
         context: string;
@@ -2416,7 +2416,7 @@ export declare class GitHubDomain {
         statuses: {
             id: number;
             node_id: string;
-            state: "error" | "failure" | "pending" | "success";
+            state: "error" | "success" | "failure" | "pending";
             description: string;
             target_url: string;
             context: string;
@@ -2481,7 +2481,7 @@ export declare class GitHubDomain {
         url: string;
         html_url: string;
         details_url: string;
-        status: "queued" | "in_progress" | "completed";
+        status: "queued" | "completed" | "in_progress";
         conclusion: import("./upstream-types.js").CheckRun["conclusion"];
         started_at: string;
         completed_at: string | null;
@@ -2511,7 +2511,7 @@ export declare class GitHubDomain {
             url: string;
             html_url: string;
             details_url: string;
-            status: "queued" | "in_progress" | "completed";
+            status: "queued" | "completed" | "in_progress";
             conclusion: import("./upstream-types.js").CheckRun["conclusion"];
             started_at: string;
             completed_at: string | null;

package/node_modules/@pome-sh/twin-github/dist/src/seed.d.ts

@@ -61,9 +61,9 @@ export declare const seedSchema: z.ZodObject<{
                 context: z.ZodDefault<z.ZodString>;
                 state: z.ZodDefault<z.ZodEnum<{
                     error: "error";
+                    success: "success";
                     failure: "failure";
                     pending: "pending";
-                    success: "success";
                 }>>;
                 description: z.ZodDefault<z.ZodString>;
             }, z.core.$strip>>>;

package/node_modules/@pome-sh/twin-github/dist/src/serializers.d.ts

@@ -492,7 +492,7 @@ export declare function reviewJson(review: PullRequestReviewRow, repo: RepoRow):
 export declare function statusJson(status: CommitStatusRow, repo: RepoRow): {
     id: number;
     node_id: string;
-    state: "error" | "failure" | "pending" | "success";
+    state: "error" | "success" | "failure" | "pending";
     description: string;
     target_url: string;
     context: string;
@@ -507,7 +507,7 @@ export declare function combinedStatusJson(repo: RepoRow, sha: string, statuses:
     statuses: {
         id: number;
         node_id: string;
-        state: "error" | "failure" | "pending" | "success";
+        state: "error" | "success" | "failure" | "pending";
         description: string;
         target_url: string;
         context: string;
@@ -622,7 +622,7 @@ export declare function checkRunJson(run: CheckRunRow, repo: RepoRow): {
     url: string;
     html_url: string;
     details_url: string;
-    status: "queued" | "in_progress" | "completed";
+    status: "queued" | "completed" | "in_progress";
     conclusion: CheckRun["conclusion"];
     started_at: string;
     completed_at: string | null;

package/node_modules/@pome-sh/twin-github/dist/src/tools.d.ts

@@ -596,9 +596,9 @@ export declare const toolDefinitions: readonly [{
         sha: z.ZodString;
         state: z.ZodEnum<{
             error: "error";
+            success: "success";
             failure: "failure";
             pending: "pending";
-            success: "success";
         }>;
         context: z.ZodOptional<z.ZodString>;
         description: z.ZodOptional<z.ZodString>;
@@ -624,17 +624,17 @@ export declare const toolDefinitions: readonly [{
         headSha: z.ZodOptional<z.ZodString>;
         status: z.ZodOptional<z.ZodEnum<{
             queued: "queued";
-            in_progress: "in_progress";
             completed: "completed";
+            in_progress: "in_progress";
         }>>;
         conclusion: z.ZodOptional<z.ZodEnum<{
-            failure: "failure";
             success: "success";
+            skipped: "skipped";
+            failure: "failure";
             neutral: "neutral";
             cancelled: "cancelled";
             timed_out: "timed_out";
             action_required: "action_required";
-            skipped: "skipped";
             stale: "stale";
         }>>;
         details_url: z.ZodOptional<z.ZodString>;
@@ -716,8 +716,8 @@ export declare const toolDefinitions: readonly [{
         username: z.ZodString;
         permission: z.ZodOptional<z.ZodEnum<{
             push: "push";
-            pull: "pull";
             admin: "admin";
+            pull: "pull";
             maintain: "maintain";
             triage: "triage";
         }>>;
@@ -755,7 +755,7 @@ export declare const toolDefinitions: readonly [{
 }];
 export type ToolName = (typeof toolDefinitions)[number]["name"];
 export declare function listTools(): {
-    name: "create_repository" | "fork_repository" | "create_or_update_file" | "push_files" | "create_branch" | "create_issue" | "update_issue" | "add_issue_comment" | "create_label" | "add_issue_labels" | "add_assignees" | "create_pull_request" | "create_pull_request_review" | "merge_pull_request" | "update_pull_request_branch" | "delete_branch" | "delete_file" | "update_pull_request" | "create_pull_request_review_comment" | "add_reply_to_pull_request_comment" | "update_issue_comment" | "delete_issue_comment" | "create_milestone" | "update_milestone" | "delete_milestone" | "create_commit_status" | "create_check_run" | "create_release" | "add_collaborator" | "search_repositories" | "get_repository" | "search_code" | "search_users" | "get_file_contents" | "list_commits" | "get_issue" | "search_issues" | "list_issues" | "list_issue_comments" | "list_repository_labels" | "list_issue_labels" | "remove_issue_label" | "list_collaborators" | "get_pull_request" | "get_pull_request_reviews" | "get_pull_request_comments" | "get_pull_request_files" | "get_pull_request_status" | "list_pull_requests" | "list_branches" | "get_branch" | "get_commit" | "compare_commits" | "get_pull_request_diff" | "get_pull_request_commits" | "list_milestones" | "get_combined_status_for_ref" | "list_check_runs_for_ref" | "list_tags" | "list_releases" | "get_latest_release" | "get_me" | "search_commits" | "get_release_by_tag" | "get_tag";
+    name: "list_issues" | "get_issue" | "create_issue" | "update_issue" | "add_assignees" | "add_issue_comment" | "update_issue_comment" | "delete_issue_comment" | "list_pull_requests" | "get_pull_request" | "create_pull_request" | "update_pull_request" | "merge_pull_request" | "create_pull_request_review" | "get_pull_request_reviews" | "get_pull_request_comments" | "get_pull_request_files" | "get_pull_request_status" | "update_pull_request_branch" | "get_pull_request_diff" | "get_pull_request_commits" | "create_pull_request_review_comment" | "add_reply_to_pull_request_comment" | "create_branch" | "list_branches" | "get_branch" | "delete_branch" | "get_file_contents" | "create_or_update_file" | "delete_file" | "push_files" | "list_commits" | "get_commit" | "compare_commits" | "list_milestones" | "create_milestone" | "update_milestone" | "delete_milestone" | "create_commit_status" | "get_combined_status_for_ref" | "create_check_run" | "list_check_runs_for_ref" | "list_tags" | "list_releases" | "get_latest_release" | "create_release" | "create_label" | "add_issue_labels" | "remove_issue_label" | "list_collaborators" | "get_me" | "add_collaborator" | "create_repository" | "fork_repository" | "search_repositories" | "get_repository" | "search_code" | "search_users" | "search_issues" | "list_issue_comments" | "list_repository_labels" | "list_issue_labels" | "search_commits" | "get_release_by_tag" | "get_tag";
     description: "Search local repositories by name or description." | "Create a repository with an initial README and main branch." | "Fork a repository into the current user or an organization." | "Get one repository." | "Search files in the local GitHub twin." | "Search seeded users and organizations." | "Read a file or directory from a repository branch." | "List commits for a repository." | "Create or update one file and advance the branch head atomically." | "Create a branch from an existing branch or SHA." | "Push multiple files in a single commit." | "Get one issue." | "Update an issue title, body, state, labels, or assignees." | "Search all local issues." | "List repository issues with common filters." | "Add an issue comment." | "List comments on an issue." | "Create an issue." | "List labels defined on a repository." | "Create a repository label." | "List labels applied to an issue." | "Apply one or more labels to an issue." | "Remove one label from an issue." | "List repository collaborators." | "Add assignees to an issue." | "Get one pull request." | "List pull request reviews." | "Create a pull request review." | "List review comments on a pull request." | "List files changed by a pull request." | "Get combined status for a pull request head commit." | "List repository pull requests." | "Merge a pull request using simplified local merge semantics." | "Update a PR branch from its base branch." | "Create a pull request from a head branch to a base branch." | "List branches for a repository." | "Get one branch by name." | "Delete a branch (cannot delete the default branch or a branch backing an open PR)." | "Delete one file and advance the branch head atomically." | "Get one commit with its file changes and stats." | "Compare two commits, branches, or tags. Returns ahead/behind/identical/diverged." | "Get a unified-diff-style text representation of a pull request." | "Update a pull request title, body, state, or base branch." | "List commits on a pull request, oldest first." | "Create an inline review comment on a pull request at a file path and line." | "Reply to an existing pull request review comment." | "Update the body of an existing issue comment." | "Delete an issue comment by ID." | "List milestones for a repository." | "Create a milestone." | "Update a milestone." | "Delete a milestone." | "Create a commit status (pending/success/failure/error) on a commit SHA." | "Get the combined status for a ref (SHA, branch, or tag)." | "Create a check run on a commit SHA." | "List check runs for a ref (SHA, branch, or tag)." | "List tags for a repository, most recent first." | "List releases for a repository, most recent first." | "Get the latest published (non-draft, non-prerelease) release." | "Create a release. Auto-creates the tag if it doesn't exist." | "Get the authenticated user." | "Add a collaborator to a repository. Returns 201 + invitation envelope for new users, 204 when already a collaborator." | "Search commits on repository default branches by message or author." | "Get a release by its tag name." | "Get a tag by name, including the commit it points at.";
     input_schema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
         page: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
@@ -1138,9 +1138,9 @@ export declare function listTools(): {
         sha: z.ZodString;
         state: z.ZodEnum<{
             error: "error";
+            success: "success";
             failure: "failure";
             pending: "pending";
-            success: "success";
         }>;
         context: z.ZodOptional<z.ZodString>;
         description: z.ZodOptional<z.ZodString>;
@@ -1158,17 +1158,17 @@ export declare function listTools(): {
         headSha: z.ZodOptional<z.ZodString>;
         status: z.ZodOptional<z.ZodEnum<{
             queued: "queued";
-            in_progress: "in_progress";
             completed: "completed";
+            in_progress: "in_progress";
         }>>;
         conclusion: z.ZodOptional<z.ZodEnum<{
-            failure: "failure";
             success: "success";
+            skipped: "skipped";
+            failure: "failure";
             neutral: "neutral";
             cancelled: "cancelled";
             timed_out: "timed_out";
             action_required: "action_required";
-            skipped: "skipped";
             stale: "stale";
         }>>;
         details_url: z.ZodOptional<z.ZodString>;
@@ -1222,8 +1222,8 @@ export declare function listTools(): {
         username: z.ZodString;
         permission: z.ZodOptional<z.ZodEnum<{
             push: "push";
-            pull: "pull";
             admin: "admin";
+            pull: "pull";
             maintain: "maintain";
             triage: "triage";
         }>>;
@@ -1248,7 +1248,7 @@ export declare function listTools(): {
     }, z.core.$strip>>;
 }[];
 export declare function listToolsForMcp(): {
-    name: "create_repository" | "fork_repository" | "create_or_update_file" | "push_files" | "create_branch" | "create_issue" | "update_issue" | "add_issue_comment" | "create_label" | "add_issue_labels" | "add_assignees" | "create_pull_request" | "create_pull_request_review" | "merge_pull_request" | "update_pull_request_branch" | "delete_branch" | "delete_file" | "update_pull_request" | "create_pull_request_review_comment" | "add_reply_to_pull_request_comment" | "update_issue_comment" | "delete_issue_comment" | "create_milestone" | "update_milestone" | "delete_milestone" | "create_commit_status" | "create_check_run" | "create_release" | "add_collaborator" | "search_repositories" | "get_repository" | "search_code" | "search_users" | "get_file_contents" | "list_commits" | "get_issue" | "search_issues" | "list_issues" | "list_issue_comments" | "list_repository_labels" | "list_issue_labels" | "remove_issue_label" | "list_collaborators" | "get_pull_request" | "get_pull_request_reviews" | "get_pull_request_comments" | "get_pull_request_files" | "get_pull_request_status" | "list_pull_requests" | "list_branches" | "get_branch" | "get_commit" | "compare_commits" | "get_pull_request_diff" | "get_pull_request_commits" | "list_milestones" | "get_combined_status_for_ref" | "list_check_runs_for_ref" | "list_tags" | "list_releases" | "get_latest_release" | "get_me" | "search_commits" | "get_release_by_tag" | "get_tag";
+    name: "list_issues" | "get_issue" | "create_issue" | "update_issue" | "add_assignees" | "add_issue_comment" | "update_issue_comment" | "delete_issue_comment" | "list_pull_requests" | "get_pull_request" | "create_pull_request" | "update_pull_request" | "merge_pull_request" | "create_pull_request_review" | "get_pull_request_reviews" | "get_pull_request_comments" | "get_pull_request_files" | "get_pull_request_status" | "update_pull_request_branch" | "get_pull_request_diff" | "get_pull_request_commits" | "create_pull_request_review_comment" | "add_reply_to_pull_request_comment" | "create_branch" | "list_branches" | "get_branch" | "delete_branch" | "get_file_contents" | "create_or_update_file" | "delete_file" | "push_files" | "list_commits" | "get_commit" | "compare_commits" | "list_milestones" | "create_milestone" | "update_milestone" | "delete_milestone" | "create_commit_status" | "get_combined_status_for_ref" | "create_check_run" | "list_check_runs_for_ref" | "list_tags" | "list_releases" | "get_latest_release" | "create_release" | "create_label" | "add_issue_labels" | "remove_issue_label" | "list_collaborators" | "get_me" | "add_collaborator" | "create_repository" | "fork_repository" | "search_repositories" | "get_repository" | "search_code" | "search_users" | "search_issues" | "list_issue_comments" | "list_repository_labels" | "list_issue_labels" | "search_commits" | "get_release_by_tag" | "get_tag";
     description: "Search local repositories by name or description." | "Create a repository with an initial README and main branch." | "Fork a repository into the current user or an organization." | "Get one repository." | "Search files in the local GitHub twin." | "Search seeded users and organizations." | "Read a file or directory from a repository branch." | "List commits for a repository." | "Create or update one file and advance the branch head atomically." | "Create a branch from an existing branch or SHA." | "Push multiple files in a single commit." | "Get one issue." | "Update an issue title, body, state, labels, or assignees." | "Search all local issues." | "List repository issues with common filters." | "Add an issue comment." | "List comments on an issue." | "Create an issue." | "List labels defined on a repository." | "Create a repository label." | "List labels applied to an issue." | "Apply one or more labels to an issue." | "Remove one label from an issue." | "List repository collaborators." | "Add assignees to an issue." | "Get one pull request." | "List pull request reviews." | "Create a pull request review." | "List review comments on a pull request." | "List files changed by a pull request." | "Get combined status for a pull request head commit." | "List repository pull requests." | "Merge a pull request using simplified local merge semantics." | "Update a PR branch from its base branch." | "Create a pull request from a head branch to a base branch." | "List branches for a repository." | "Get one branch by name." | "Delete a branch (cannot delete the default branch or a branch backing an open PR)." | "Delete one file and advance the branch head atomically." | "Get one commit with its file changes and stats." | "Compare two commits, branches, or tags. Returns ahead/behind/identical/diverged." | "Get a unified-diff-style text representation of a pull request." | "Update a pull request title, body, state, or base branch." | "List commits on a pull request, oldest first." | "Create an inline review comment on a pull request at a file path and line." | "Reply to an existing pull request review comment." | "Update the body of an existing issue comment." | "Delete an issue comment by ID." | "List milestones for a repository." | "Create a milestone." | "Update a milestone." | "Delete a milestone." | "Create a commit status (pending/success/failure/error) on a commit SHA." | "Get the combined status for a ref (SHA, branch, or tag)." | "Create a check run on a commit SHA." | "List check runs for a ref (SHA, branch, or tag)." | "List tags for a repository, most recent first." | "List releases for a repository, most recent first." | "Get the latest published (non-draft, non-prerelease) release." | "Create a release. Auto-creates the tag if it doesn't exist." | "Get the authenticated user." | "Add a collaborator to a repository. Returns 201 + invitation envelope for new users, 204 when already a collaborator." | "Search commits on repository default branches by message or author." | "Get a release by its tag name." | "Get a tag by name, including the commit it points at.";
     inputSchema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
         page: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
@@ -1631,9 +1631,9 @@ export declare function listToolsForMcp(): {
         sha: z.ZodString;
         state: z.ZodEnum<{
             error: "error";
+            success: "success";
             failure: "failure";
             pending: "pending";
-            success: "success";
         }>;
         context: z.ZodOptional<z.ZodString>;
         description: z.ZodOptional<z.ZodString>;
@@ -1651,17 +1651,17 @@ export declare function listToolsForMcp(): {
         headSha: z.ZodOptional<z.ZodString>;
         status: z.ZodOptional<z.ZodEnum<{
             queued: "queued";
-            in_progress: "in_progress";
             completed: "completed";
+            in_progress: "in_progress";
         }>>;
         conclusion: z.ZodOptional<z.ZodEnum<{
-            failure: "failure";
             success: "success";
+            skipped: "skipped";
+            failure: "failure";
             neutral: "neutral";
             cancelled: "cancelled";
             timed_out: "timed_out";
             action_required: "action_required";
-            skipped: "skipped";
             stale: "stale";
         }>>;
         details_url: z.ZodOptional<z.ZodString>;
@@ -1715,8 +1715,8 @@ export declare function listToolsForMcp(): {
         username: z.ZodString;
         permission: z.ZodOptional<z.ZodEnum<{
             push: "push";
-            pull: "pull";
             admin: "admin";
+            pull: "pull";
             maintain: "maintain";
             triage: "triage";
         }>>;
@@ -1892,7 +1892,7 @@ export declare function executeTool(domain: GitHubDomain, name: string, input: u
 } | {
     id: number;
     node_id: string;
-    state: "error" | "failure" | "pending" | "success";
+    state: "error" | "success" | "failure" | "pending";
     description: string;
     target_url: string;
     context: string;
@@ -1906,7 +1906,7 @@ export declare function executeTool(domain: GitHubDomain, name: string, input: u
     statuses: {
         id: number;
         node_id: string;
-        state: "error" | "failure" | "pending" | "success";
+        state: "error" | "success" | "failure" | "pending";
         description: string;
         target_url: string;
         context: string;
@@ -2015,7 +2015,7 @@ export declare function executeTool(domain: GitHubDomain, name: string, input: u
     url: string;
     html_url: string;
     details_url: string;
-    status: "queued" | "in_progress" | "completed";
+    status: "queued" | "completed" | "in_progress";
     conclusion: import("./upstream-types.js").CheckRun["conclusion"];
     started_at: string;
     completed_at: string | null;
@@ -2652,7 +2652,7 @@ export declare function executeTool(domain: GitHubDomain, name: string, input: u
         url: string;
         html_url: string;
         details_url: string;
-        status: "queued" | "in_progress" | "completed";
+        status: "queued" | "completed" | "in_progress";
         conclusion: import("./upstream-types.js").CheckRun["conclusion"];
         started_at: string;
         completed_at: string | null;

package/node_modules/@pome-sh/twin-github/node_modules/@pome-sh/sdk/dist/admin-gate.d.ts

@@ -0,0 +1,35 @@
+import type { Context, MiddlewareHandler } from "hono";
+/** Context variable consulted first by getClientIp(). */
+export declare const CLIENT_IP_VAR = "pomeClientIp";
+/**
+ * Explicitly record the peer address for this request. Alternate serving
+ * bridges (or tests) call this from an upstream middleware so the gate never
+ * reaches into runtime-private internals.
+ *
+ * SECURITY: the value passed here MUST be the transport-level peer address
+ * (the socket's remote address as reported by the serving bridge). It takes
+ * precedence over getConnInfo, so deriving it from any request-controlled
+ * input — X-Forwarded-For or any other client-supplied header — would make
+ * the loopback-only admin gate spoofable by whoever sets that header. If you
+ * are behind a reverse proxy, use TWIN_ADMIN_TOKEN instead of trying to
+ * recover the "real" client IP.
+ */
+export declare function setClientIp(c: Context, ip: string): void;
+/**
+ * Runtime-neutral client-IP accessor (FDRS-587). Resolution order:
+ *   1. Explicit override set via setClientIp() (alternate bridges / tests).
+ *   2. The node serving bridge's official getConnInfo helper.
+ *   3. undefined — no live socket (e.g. app.request() in-process tests).
+ */
+export declare function getClientIp(c: Context): Promise<string | undefined>;
+export declare function isLoopbackAddress(remote: string): boolean;
+export interface AdminGateOptions {
+    /** 403 response factory so each twin keeps its own error envelope. */
+    forbidden?: () => Response;
+}
+/**
+ * Admin endpoint protection shared by every twin (FDRS-616). Each twin's
+ * auth.ts wraps this with its own `forbidden` envelope. Semantics are
+ * identical to the per-twin requireAdminAuth() copies this replaces.
+ */
+export declare function createAdminGate(options?: AdminGateOptions): MiddlewareHandler;

package/node_modules/@pome-sh/twin-github/node_modules/@pome-sh/sdk/dist/admin-gate.js

@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: Apache-2.0
+// Shared admin-endpoint gate (FDRS-587 / FDRS-616). First-party twins import
+// this through `@pome-sh/sdk/server`; do not copy this file into a twin package.
+//
+// Tiered policy (semantics unchanged from the per-twin copies it replaces):
+//   1. TWIN_ADMIN_TOKEN set → require X-Admin-Token to match (timing-safe).
+//   2. TWIN_ADMIN_TOKEN unset + client IP known → allow only loopback.
+//   3. TWIN_ADMIN_TOKEN unset + client IP unknown → deny in production,
+//      allow otherwise (accepted fail-open for in-process test harnesses).
+import { timingSafeEqual } from "node:crypto";
+/** Context variable consulted first by getClientIp(). */
+export const CLIENT_IP_VAR = "pomeClientIp";
+let nodeGetConnInfo;
+// Lazily import the node bridge's official ConnInfo helper. Dynamic because
+// @pome-sh/sdk declares @hono/node-server as an *optional* peer dependency —
+// a static import would crash consumers that never bind a Node socket.
+// Works with both @hono/node-server v1 and v2 (same subpath + signature).
+function loadNodeGetConnInfo() {
+    nodeGetConnInfo ??= import("@hono/node-server/conninfo").then((mod) => mod.getConnInfo, () => undefined);
+    return nodeGetConnInfo;
+}
+/**
+ * Explicitly record the peer address for this request. Alternate serving
+ * bridges (or tests) call this from an upstream middleware so the gate never
+ * reaches into runtime-private internals.
+ *
+ * SECURITY: the value passed here MUST be the transport-level peer address
+ * (the socket's remote address as reported by the serving bridge). It takes
+ * precedence over getConnInfo, so deriving it from any request-controlled
+ * input — X-Forwarded-For or any other client-supplied header — would make
+ * the loopback-only admin gate spoofable by whoever sets that header. If you
+ * are behind a reverse proxy, use TWIN_ADMIN_TOKEN instead of trying to
+ * recover the "real" client IP.
+ */
+export function setClientIp(c, ip) {
+    c.set(CLIENT_IP_VAR, ip);
+}
+/**
+ * Runtime-neutral client-IP accessor (FDRS-587). Resolution order:
+ *   1. Explicit override set via setClientIp() (alternate bridges / tests).
+ *   2. The node serving bridge's official getConnInfo helper.
+ *   3. undefined — no live socket (e.g. app.request() in-process tests).
+ */
+export async function getClientIp(c) {
+    const override = c.get(CLIENT_IP_VAR);
+    if (typeof override === "string" && override.length > 0)
+        return override;
+    const getConnInfo = await loadNodeGetConnInfo();
+    if (!getConnInfo)
+        return undefined;
+    try {
+        const address = getConnInfo(c).remote?.address;
+        return typeof address === "string" && address.length > 0 ? address : undefined;
+    }
+    catch {
+        // The helper throws when the context has no node socket behind it.
+        return undefined;
+    }
+}
+export function isLoopbackAddress(remote) {
+    return (remote === "127.0.0.1" ||
+        remote === "::1" ||
+        remote === "::ffff:127.0.0.1" ||
+        remote === "localhost");
+}
+function defaultForbidden() {
+    return Response.json({ message: "Forbidden", documentation_url: "" }, { status: 403 });
+}
+/**
+ * Admin endpoint protection shared by every twin (FDRS-616). Each twin's
+ * auth.ts wraps this with its own `forbidden` envelope. Semantics are
+ * identical to the per-twin requireAdminAuth() copies this replaces.
+ */
+export function createAdminGate(options = {}) {
+    const forbidden = options.forbidden ?? defaultForbidden;
+    return async (c, next) => {
+        const adminToken = process.env.TWIN_ADMIN_TOKEN;
+        if (adminToken && adminToken.length > 0) {
+            // Web Headers lookups are case-insensitive, so one lookup covers every
+            // casing a client might send.
+            const provided = c.req.header("X-Admin-Token");
+            if (!provided)
+                return forbidden();
+            const a = Buffer.from(provided);
+            const b = Buffer.from(adminToken);
+            if (a.length !== b.length || !timingSafeEqual(a, b))
+                return forbidden();
+            await next();
+            return;
+        }
+        const remote = await getClientIp(c);
+        if (!remote) {
+            if (process.env.NODE_ENV === "production")
+                return forbidden();
+            await next();
+            return;
+        }
+        if (!isLoopbackAddress(remote))
+            return forbidden();
+        await next();
+    };
+}
+//# sourceMappingURL=admin-gate.js.map

package/node_modules/@pome-sh/twin-github/node_modules/@pome-sh/sdk/dist/admin-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-gate.js","sourceRoot":"","sources":["../src/admin-gate.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6EAA6E;AAC7E,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,2EAA2E;AAG3E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,yDAAyD;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAO5C,IAAI,eAA+D,CAAC;AAEpE,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,0EAA0E;AAC1E,SAAS,mBAAmB;IAC1B,eAAe,KAAK,MAAM,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAC3D,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAuC,EACpD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,CAAU,EAAE,EAAU;IAC/C,CAA0B,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAU;IAC1C,MAAM,QAAQ,GAAI,CAA0B,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzE,MAAM,WAAW,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAChD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/C,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,CACL,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,KAAK;QAChB,MAAM,KAAK,kBAAkB;QAC7B,MAAM,KAAK,WAAW,CACvB,CAAC;AACJ,CAAC;AAOD,SAAS,gBAAgB;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAChD,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,uEAAuE;YACvE,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAAE,OAAO,SAAS,EAAE,CAAC;YAC9D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}