@pome-sh/cli 0.21.13 → 0.21.15

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.21.13",
-  "git_sha": "703150e1dcc8c14087b2eee0fb4e74d00794b85c",
-  "build_time": "2026-08-07T23:11:06.928Z"
+  "version": "0.21.15",
+  "git_sha": "38acaf971b6be8d5cdffaa62a9e077dbc0e54ff7",
+  "build_time": "2026-08-08T01:16:03.754Z"
 }

package/dist/{checks-MM2OJJES.js → checks-OFV75GDL.js}

@@ -183,7 +183,7 @@ async function checkTwinReachable(_configDir) {
   });
   let harness;
   try {
-    const { bootTwin } = await import('./twinHarness-BHSSYAEG.js');
+    const { bootTwin } = await import('./twinHarness-QGMYTU5N.js');
     harness = await bootTwin({
       twin: "github",
       seedState: void 0,

package/dist/chunk-4MQULI7E.js

@@ -0,0 +1,427 @@
+import { z } from 'zod';
+
+// ../packages/sdk/dist/route-inputs.js
+var INPUT_LOCATIONS = [
+  "path",
+  "query",
+  "header",
+  "body",
+  "argument"
+];
+var ROUTE_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "ALL"];
+var BRACKETED = /* @__PURE__ */ Symbol.for("pome.routeInputs.bracketed");
+function bracketedQuery(schema) {
+  const wrapper = { [BRACKETED]: true, schema };
+  return wrapper;
+}
+function isBracketed(value) {
+  return typeof value === "object" && value !== null && BRACKETED in value;
+}
+function unwrapBracketed(value) {
+  return isBracketed(value) ? value.schema : value;
+}
+function mountDeclaredRoute(router, declaration, handler) {
+  const verb = declaration.method.toLowerCase();
+  router[verb](declaration.path, handler);
+}
+var UndeclaredInputError = class extends Error {
+  location;
+  names;
+  surface;
+  constructor(location, names, surface) {
+    super(`${surface} does not declare ${location} parameter${names.length > 1 ? "s" : ""}: ` + names.map((name) => `\`${name}\``).join(", "));
+    this.location = location;
+    this.names = names;
+    this.surface = surface;
+    this.name = "UndeclaredInputError";
+  }
+  /** The first offending name — what a vendor envelope usually reports. */
+  get first() {
+    return this.names[0] ?? "";
+  }
+};
+var MalformedBodyError = class extends Error {
+  surface;
+  constructor(surface) {
+    super(`${surface} could not parse the request body as JSON`);
+    this.surface = surface;
+    this.name = "MalformedBodyError";
+  }
+};
+function declareRouteInputs(spec) {
+  if (!ROUTE_METHODS.includes(spec.method)) {
+    throw new Error(`route-inputs: unknown method '${spec.method}' for ${spec.path}`);
+  }
+  if (!spec.path.startsWith("/")) {
+    throw new Error(`route-inputs: path must start with '/' (got '${spec.path}')`);
+  }
+  const surface = `${spec.method} ${spec.path}`;
+  const pathShape = spec.pathParams ?? {};
+  const queryShape = spec.query ?? {};
+  const headerShape = spec.headers ?? {};
+  const bodyShape = spec.body ?? {};
+  const bodyEncoding = spec.bodyEncoding ?? (Object.keys(bodyShape).length > 0 ? "json" : "none");
+  if (bodyEncoding === "none" && Object.keys(bodyShape).length > 0) {
+    throw new Error(`route-inputs: ${surface} declares body inputs with bodyEncoding 'none'`);
+  }
+  if (bodyEncoding === "media" && !spec.mediaField) {
+    throw new Error(`route-inputs: ${surface} uses bodyEncoding 'media' without mediaField`);
+  }
+  const { named, wildcard } = splitPathParams(surface, spec.path, Object.keys(pathShape));
+  const inputs = [];
+  for (const [location, shape] of [
+    ["path", pathShape],
+    ["query", queryShape],
+    ["header", headerShape],
+    ["body", bodyShape]
+  ]) {
+    for (const [name, rawSchema] of Object.entries(shape)) {
+      const schema = unwrapBracketed(rawSchema);
+      inputs.push({
+        name,
+        location,
+        // Requiredness is asked of the validator rather than read off the
+        // schema's internals: "would this parse with the input absent" is the
+        // question the declaration answers, so the answer comes from the same
+        // code path that answers it at request time.
+        required: !schema.safeParse(void 0).success,
+        type: jsonSchemaTypeOf(schema)
+      });
+      if (isBracketed(rawSchema) && location !== "query") {
+        throw new Error(`route-inputs: bracketedQuery() is only valid for query inputs (${surface} '${name}')`);
+      }
+    }
+  }
+  inputs.sort((a, b) => INPUT_LOCATIONS.indexOf(a.location) - INPUT_LOCATIONS.indexOf(b.location) || a.name.localeCompare(b.name));
+  const declaredQuery = new Set(Object.keys(queryShape));
+  const bracketedQueryNames = new Set(Object.entries(queryShape).filter(([, schema]) => isBracketed(schema)).map(([name]) => name));
+  const declaredBody = new Set(Object.keys(bodyShape));
+  const arrayQuery = new Set(Object.entries(queryShape).filter(([, schema]) => jsonSchemaTypeOf(unwrapBracketed(schema)) === "array").map(([name]) => name));
+  const pathSchema = z.object(mapShape(pathShape));
+  const querySchema = z.object(mapShape(queryShape));
+  const headerSchema = z.object(mapShape(headerShape));
+  const bodySchema = z.object(mapShape(bodyShape));
+  return {
+    method: spec.method,
+    path: spec.path,
+    surface,
+    bodyEncoding,
+    inputs,
+    // Deduplicated: pome-cloud's comparator diffs NAME sets, and a name that
+    // arrives in two locations is still one name to it.
+    names: [...new Set(inputs.map((input) => input.name))],
+    async parse(request) {
+      const path = pathSchema.parse(readPathParams(request, named, wildcard, spec.path));
+      const searchParams = new URL(request.url, "http://twin.invalid").searchParams;
+      refuseUndeclared("query", surface, [...searchParams.keys()], declaredQuery, bracketedQueryNames);
+      const query = querySchema.parse(readQuery(searchParams, declaredQuery, bracketedQueryNames, arrayQuery));
+      const header = headerSchema.parse(Object.fromEntries(Object.keys(headerShape).map((name) => [name, request.header(name)])));
+      const raw = await decodeBody(request, bodyEncoding, surface, spec.mediaField);
+      refuseUndeclared("body", surface, Object.keys(raw), declaredBody, /* @__PURE__ */ new Set());
+      const body = bodySchema.parse(raw);
+      return { path, query, header, body };
+    }
+  };
+}
+function mapShape(shape) {
+  return Object.fromEntries(Object.entries(shape).map(([name, schema]) => [name, unwrapBracketed(schema)]));
+}
+function splitPathParams(surface, pattern, declared) {
+  const patternNames = [...pattern.matchAll(/:([A-Za-z0-9_]+)/g)].map((match) => match[1]);
+  const wildcards = pattern.split("/").filter((segment) => segment === "*" || segment.endsWith("*"));
+  if (wildcards.length > 1) {
+    throw new Error(`route-inputs: ${surface} has more than one wildcard segment`);
+  }
+  const missing = patternNames.filter((name) => !declared.includes(name));
+  if (missing.length > 0) {
+    throw new Error(`route-inputs: ${surface} does not declare path param${missing.length > 1 ? "s" : ""} ` + missing.map((name) => `'${name}'`).join(", "));
+  }
+  const extra = declared.filter((name) => !patternNames.includes(name));
+  if (wildcards.length === 0) {
+    if (extra.length > 0) {
+      throw new Error(`route-inputs: ${surface} declares path param${extra.length > 1 ? "s" : ""} ${extra.map((name) => `'${name}'`).join(", ")} its pattern does not contain`);
+    }
+    return { named: patternNames, wildcard: null };
+  }
+  if (extra.length !== 1) {
+    throw new Error(`route-inputs: ${surface} has a wildcard segment, so exactly one declared path param must name it (found ${extra.length}: ${extra.map((name) => `'${name}'`).join(", ") || "none"})`);
+  }
+  return { named: patternNames, wildcard: extra[0] };
+}
+function readPathParams(request, named, wildcard, pattern) {
+  const out = {};
+  for (const name of named)
+    out[name] = request.param(name);
+  if (wildcard)
+    out[wildcard] = readWildcard(request, pattern, named, out);
+  return out;
+}
+function readWildcard(request, pattern, named, resolved) {
+  const pathname = new URL(request.url, "http://twin.invalid").pathname;
+  const prefix = pattern.slice(0, pattern.lastIndexOf("*")).replace(/:([A-Za-z0-9_]+)(?:\{[^}]*\})?/g, (whole, name) => named.includes(name) ? encodeURIComponent(resolved[name] ?? "") : whole);
+  const at = pathname.indexOf(prefix);
+  if (at < 0)
+    return void 0;
+  const tail = pathname.slice(at + prefix.length);
+  return tail.length > 0 ? safeDecode(tail) : void 0;
+}
+function safeDecode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function refuseUndeclared(location, surface, present, declared, bracketed) {
+  const offenders = [];
+  for (const key of present) {
+    if (declared.has(key))
+      continue;
+    const base = key.slice(0, key.indexOf("["));
+    if (key.includes("[") && bracketed.has(base))
+      continue;
+    if (!offenders.includes(key))
+      offenders.push(key);
+  }
+  if (offenders.length > 0)
+    throw new UndeclaredInputError(location, offenders, surface);
+}
+function readQuery(searchParams, declared, bracketed, arrays) {
+  const out = {};
+  for (const name of declared) {
+    if (arrays.has(name)) {
+      out[name] = searchParams.getAll(name);
+      continue;
+    }
+    if (bracketed.has(name)) {
+      const nested = readBracketed(searchParams, name);
+      if (nested !== void 0)
+        out[name] = nested;
+      continue;
+    }
+    if (searchParams.has(name))
+      out[name] = searchParams.get(name);
+  }
+  return out;
+}
+function readBracketed(searchParams, name) {
+  const flat = searchParams.get(name);
+  const nested = {};
+  for (const [key, value] of searchParams.entries()) {
+    if (!key.startsWith(`${name}[`) || !key.endsWith("]"))
+      continue;
+    const inner = key.slice(name.length + 1, -1);
+    if (inner.length > 0)
+      nested[inner] = value;
+  }
+  if (Object.keys(nested).length > 0)
+    return flat === null ? nested : { ...nested, value: flat };
+  return flat === null ? void 0 : flat;
+}
+async function decodeBody(request, encoding, surface, mediaField) {
+  if (encoding === "none")
+    return {};
+  const contentType = request.header("content-type") ?? "";
+  if (encoding === "json" || encoding === "json-optional") {
+    const value = await request.json().catch(() => void 0);
+    if (isPlainObject(value))
+      return value;
+    if (encoding === "json-optional")
+      return {};
+    throw new MalformedBodyError(surface);
+  }
+  if (encoding === "form") {
+    if (contentType.includes("application/json") || contentType === "") {
+      const value = await request.json().catch(() => void 0);
+      if (isPlainObject(value))
+        return value;
+      if (contentType.includes("application/json"))
+        return {};
+    }
+    const form = await request.parseBody({ all: true }).catch(() => void 0);
+    return form ? expandBrackets(form) : {};
+  }
+  return decodeMedia(request, contentType, surface, mediaField);
+}
+async function decodeMedia(request, contentType, surface, mediaField) {
+  if (/^application\/json\b/i.test(contentType) || /^text\/json\b/i.test(contentType)) {
+    const value = await request.json().catch(() => void 0);
+    if (isPlainObject(value))
+      return value;
+    throw new MalformedBodyError(surface);
+  }
+  if (/^multipart\/related\b/i.test(contentType)) {
+    const boundary = contentType.match(/boundary=(?:"([^"]+)"|([^;\s]+))/i)?.slice(1).find(Boolean);
+    if (!boundary)
+      throw new MalformedBodyError(surface);
+    const parts = splitRelated(Buffer.from(await request.arrayBuffer()), boundary);
+    if (parts.length !== 2)
+      throw new MalformedBodyError(surface);
+    let metadata;
+    try {
+      metadata = JSON.parse(parts[0].toString("utf8"));
+    } catch {
+      throw new MalformedBodyError(surface);
+    }
+    if (!isPlainObject(metadata))
+      throw new MalformedBodyError(surface);
+    return setPath({ ...metadata }, mediaField, parts[1]);
+  }
+  return setPath({}, mediaField, Buffer.from(await request.arrayBuffer()));
+}
+function splitRelated(bytes, boundary) {
+  const marker = Buffer.from(`--${boundary}`);
+  const end = Buffer.from(`--${boundary}--`);
+  const parts = [];
+  let cursor = 0;
+  while (cursor < bytes.length) {
+    const start = bytes.indexOf(marker, cursor);
+    if (start < 0 || bytes.subarray(start, start + end.length).equals(end))
+      break;
+    const lineEnd = bytes.indexOf(10, start + marker.length);
+    if (lineEnd < 0)
+      break;
+    const next = bytes.indexOf(marker, lineEnd + 1);
+    if (next < 0)
+      break;
+    let chunk = bytes.subarray(lineEnd + 1, next);
+    while (chunk.length > 0 && (chunk.at(-1) === 10 || chunk.at(-1) === 13)) {
+      chunk = chunk.subarray(0, -1);
+    }
+    const crlf = chunk.indexOf(Buffer.from("\r\n\r\n"));
+    const lf = chunk.indexOf(Buffer.from("\n\n"));
+    const separator = crlf >= 0 ? { index: crlf, length: 4 } : { index: lf, length: 2 };
+    if (separator.index < 0)
+      break;
+    parts.push(Buffer.from(chunk.subarray(separator.index + separator.length)));
+    cursor = next;
+  }
+  return parts;
+}
+function setPath(target, dotted, value) {
+  const keys = dotted.split(".");
+  let cursor = target;
+  for (const key of keys.slice(0, -1)) {
+    const next = cursor[key];
+    cursor[key] = isPlainObject(next) ? { ...next } : {};
+    cursor = cursor[key];
+  }
+  cursor[keys.at(-1)] = value;
+  return target;
+}
+var POLLUTION_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function expandBrackets(form) {
+  const out = {};
+  for (const [rawKey, value] of Object.entries(form)) {
+    const segments = [];
+    for (const match of rawKey.matchAll(/([^[\]]+)|\[([^[\]]*)\]/g)) {
+      const piece = match[1] ?? match[2] ?? "";
+      segments.push(/^\d+$/.test(piece) ? Number(piece) : piece);
+    }
+    if (segments.some((segment) => typeof segment === "string" && POLLUTION_KEYS.has(segment))) {
+      continue;
+    }
+    let cursor = out;
+    for (let index = 0; index < segments.length; index += 1) {
+      const key = segments[index];
+      if (index === segments.length - 1) {
+        cursor[key] = Array.isArray(value) && value.length === 1 ? value[0] : value;
+        break;
+      }
+      const nextKey = segments[index + 1];
+      if (cursor[key] === void 0)
+        cursor[key] = typeof nextKey === "number" ? [] : {};
+      cursor = cursor[key];
+    }
+  }
+  return out;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function integerInput(options = {}) {
+  let schema = z.coerce.number().int();
+  if (options.min !== void 0)
+    schema = schema.min(options.min);
+  if (options.max !== void 0)
+    schema = schema.max(options.max);
+  return schema;
+}
+var booleanInput = z.union([
+  z.boolean(),
+  z.literal("true").transform(() => true),
+  z.literal("false").transform(() => false)
+]);
+function repeatedInput(options = {}) {
+  const items = options.max === void 0 ? z.array(z.string()) : z.array(z.string()).max(options.max);
+  return items.default([]);
+}
+function jsonSchemaTypeOf(schema) {
+  let json;
+  try {
+    json = z.toJSONSchema(schema, { io: "input", unrepresentable: "any" });
+  } catch {
+    return null;
+  }
+  return typeNameFromJsonSchema(json);
+}
+function typeNameFromJsonSchema(json) {
+  if (!isPlainObject(json))
+    return null;
+  if (typeof json.type === "string")
+    return json.type;
+  if (Array.isArray(json.type)) {
+    const names2 = json.type.filter((name) => typeof name === "string" && name !== "null");
+    return names2.length === 1 ? names2[0] : names2.length > 1 ? [...new Set(names2)].sort().join("|") : null;
+  }
+  const branches = Array.isArray(json.anyOf) ? json.anyOf : Array.isArray(json.oneOf) ? json.oneOf : null;
+  if (!branches)
+    return null;
+  const names = /* @__PURE__ */ new Set();
+  for (const branch of branches) {
+    const name = typeNameFromJsonSchema(branch);
+    if (name && name !== "null")
+      names.add(name);
+  }
+  if (names.size === 0)
+    return null;
+  return [...names].sort().join("|");
+}
+var declaredInputSchema = z.strictObject({
+  name: z.string().min(1),
+  location: z.enum(["path", "query", "header", "body", "argument"]),
+  required: z.boolean(),
+  type: z.string().min(1).nullable()
+});
+var routeInputSurfaceSchema = z.strictObject({
+  method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "ALL"]),
+  path: z.string().min(1),
+  surface: z.string().min(1),
+  inputs: z.array(declaredInputSchema).min(1)
+});
+var graphqlArgumentSurfaceSchema = z.strictObject({
+  surface: z.string().min(1),
+  root: z.enum(["query", "mutation"]),
+  inputs: z.array(declaredInputSchema).min(1)
+});
+z.strictObject({
+  twin: z.string().min(1),
+  package: z.string().min(1),
+  artifact_version: z.literal(1),
+  generated_by: z.string().min(1),
+  source: z.array(z.string().min(1)).min(1),
+  /** Surfaces with at least one declared input; a zero-input surface is
+   *  omitted, because an empty declaration compares empty against empty and
+   *  reports a match nobody measured. */
+  surface_count: z.number().int().nonnegative(),
+  input_count: z.number().int().nonnegative(),
+  surfaces: z.array(routeInputSurfaceSchema),
+  /**
+   * Present only for a twin whose non-MCP API layer is GraphQL. Same
+   * omit-when-empty rule as `surfaces`: a root field with no arguments is left
+   * out rather than published with `[]`.
+   */
+  graphql_surfaces: z.array(graphqlArgumentSurfaceSchema).optional()
+});
+
+export { MalformedBodyError, UndeclaredInputError, booleanInput, bracketedQuery, declareRouteInputs, integerInput, mountDeclaredRoute, repeatedInput };

package/dist/{chunk-LH4EGGQW.js → chunk-6OT4IW25.js}

@@ -1,4 +1,4 @@
-import { oneOf, statePath, defineCheck, VACUITY_SENTINEL, childStatePath } from './chunk-NY55QTVQ.js';
+import { oneOf, statePath, defineCheck, VACUITY_SENTINEL, childStatePath } from './chunk-JWJYNAWI.js';
 
 // ../packages/twin-slack/dist/src/check-params.js
 var channelName = {
@@ -177,7 +177,23 @@ var noReactionAdded = defineCheck({
   params: { reaction: emojiName, channel: channelName },
   substrate: "final",
   polarity: () => "negative",
-  subject: () => null,
+  // The reaction name, because that is the literal this predicate compares
+  // against `reactions[].name` — the line below has said so since the check
+  // shipped, and this field said `null` anyway (F-1157).
+  //
+  // It is the sharpest case in the vocabulary for why that mattered. A NEGATIVE
+  // criterion asserting a scanned literal is absent reads a redactor's work as
+  // its own verdict: mask `reactions[].name` and the filter matches nothing, so
+  // `No "white_check_mark" reaction was added` passes — over an export where the
+  // agent added exactly that reaction. `probeRedactionSurvival` found it by
+  // destroying this literal in the FAILING world declared below and watching
+  // that world start to pass; it was the one `vacuous_pass` across all five
+  // twins' 45 declarations.
+  //
+  // Contrast `slack.no-message-posted` above, whose null is deliberate: its only
+  // literal RESOLVES a channel and the count it asserts on is derived. This one
+  // scans.
+  subject: ({ reaction }) => reaction,
   // The channel RESOLVES (a miss already skips); the reaction name is SCANNED.
   // D10: falsify the scanned one.
   vacuityMutant: (args) => ({ ...args, reaction: VACUITY_SENTINEL }),

package/dist/{chunk-BV35ZSB6.js → chunk-BA4N7AOZ.js}

@@ -4,7 +4,7 @@ var package_default = {
 
 // ../packages/twin-slack/package.json
 var package_default2 = {
-  version: "0.3.5"};
+  version: "0.3.6"};
 
 // ../packages/twin-stripe/package.json
 var package_default3 = {
@@ -12,7 +12,7 @@ var package_default3 = {
 
 // ../packages/twin-gmail/package.json
 var package_default4 = {
-  version: "0.3.5"};
+  version: "0.3.6"};
 
 // ../packages/twin-linear/package.json
 var package_default5 = {
@@ -39,7 +39,7 @@ var TWIN_REGISTRY = {
         defaultSeedState,
         GitHubDomain,
         openGitHubCloneDatabase
-      } = await import('./src-5RPY72NF.js');
+      } = await import('./src-GIKWIJM2.js');
       const db = openGitHubCloneDatabase();
       const domain = new GitHubDomain(db);
       domain.seed(seedState === void 0 ? defaultSeedState() : seedState);
@@ -59,9 +59,9 @@ var TWIN_REGISTRY = {
     envName: "SLACK",
     defaultPort: 3333,
     version: package_default2.version,
-    defaultSeed: async () => (await import('./src-RUUCDQU4.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-V5JLDT6T.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-RUUCDQU4.js');
+      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-V5JLDT6T.js');
       const db = openSlackTwinDatabase(":memory:");
       const domain = new SlackDomain(db);
       domain.applySeed(seedState);
@@ -84,9 +84,9 @@ var TWIN_REGISTRY = {
     envName: "STRIPE",
     defaultPort: 3333,
     version: package_default3.version,
-    defaultSeed: async () => (await import('./src-YH33B2LP.js')).defaultSeed(),
+    defaultSeed: async () => (await import('./src-566DJYOC.js')).defaultSeed(),
     async boot({ seedState, runId, recorder, twinBaseUrl }) {
-      const stripeTwin = await import('./src-YH33B2LP.js');
+      const stripeTwin = await import('./src-566DJYOC.js');
       const { createApp } = await import('./server-DR56XIGP.js');
       const {
         applySeed: applyStripeSeed,
@@ -128,9 +128,9 @@ var TWIN_REGISTRY = {
     portEnvName: "GMAIL_TWIN_PORT",
     tokenEnvName: "POME_GMAIL_TOKEN",
     version: package_default4.version,
-    defaultSeed: async () => (await import('./src-B63VPRRZ.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-PUE6CMDF.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-B63VPRRZ.js');
+      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-PUE6CMDF.js');
       const db = openGmailTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new GmailDomain(db);
@@ -149,7 +149,7 @@ var TWIN_REGISTRY = {
     portEnvName: "LINEAR_TWIN_PORT",
     tokenEnvName: "POME_LINEAR_TOKEN",
     version: package_default5.version,
-    defaultSeed: async () => (await import('./src-JWB5RQSN.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-ECRGORXR.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
       const {
         createLinearTwinApp,
@@ -157,7 +157,7 @@ var TWIN_REGISTRY = {
         LinearDomain,
         openLinearTwinDatabase,
         parseSeed
-      } = await import('./src-JWB5RQSN.js');
+      } = await import('./src-ECRGORXR.js');
       const db = openLinearTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new LinearDomain(db);
@@ -173,7 +173,7 @@ var TWIN_REGISTRY = {
   }
 };
 async function createGitHubSmokeApp() {
-  const { createGitHubCloneApp } = await import('./src-5RPY72NF.js');
+  const { createGitHubCloneApp } = await import('./src-GIKWIJM2.js');
   return createGitHubCloneApp();
 }
 function defaultPortFor(twin, env = process.env) {

package/dist/{chunk-M7HRXBVU.js → chunk-F4RV373I.js}

@@ -1,7 +1,7 @@
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist, readBlockedEgress } from './chunk-CBFKZZBR.js';
-import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-2TSYKRER.js';
-import { createRecorder, bootTwin } from './chunk-CC27LWIA.js';
+import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-OQWXMHRG.js';
+import { createRecorder, bootTwin } from './chunk-IYDTDANH.js';
 import { eventSchema } from './chunk-VBATFCWR.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { serve } from '@hono/node-server';

package/dist/{chunk-UCLRWEKB.js → chunk-GDZ6Z3B2.js}

@@ -1,5 +1,5 @@
 import { readManifest, normalizeManifestTwins } from './chunk-KUVTL4NZ.js';
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus } from './chunk-2TSYKRER.js';
+import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus } from './chunk-OQWXMHRG.js';
 import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-PQYIAA6K.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { existsSync } from 'node:fs';

package/dist/{chunk-CC27LWIA.js → chunk-IYDTDANH.js}

@@ -1,4 +1,4 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-BV35ZSB6.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-BA4N7AOZ.js';
 import { createFileBackedRecorderStore, createRecorderStore } from './chunk-TV5S6WQV.js';
 
 // src/recorder/recorder.ts

package/dist/{chunk-NY55QTVQ.js → chunk-JWJYNAWI.js}

@@ -13,6 +13,12 @@ function childStatePath(base, ...segments) {
   return `${base}${statePath(...segments)}`;
 }
 
+// ../packages/sdk/dist/check-redaction.js
+var REDACTION_PLACEHOLDER = "[REDACTED]";
+function isRedacted(value) {
+  return value === REDACTION_PLACEHOLDER;
+}
+
 // ../packages/sdk/dist/checks.js
 var VACUITY_SENTINEL = "pome-vacuity-never";
 var VACUITY_SENTINEL_NUMBER = 987654321;
@@ -117,4 +123,4 @@ function checkNearMissPattern(def) {
   return buildPattern(def.template, () => ".+?");
 }
 
-export { VACUITY_SENTINEL, VACUITY_SENTINEL_NUMBER, checkNearMissPattern, checkPattern, checksDigest, childStatePath, defineCheck, oneOf, renderCheck, repoRef, statePath, templateSlots };
+export { VACUITY_SENTINEL, VACUITY_SENTINEL_NUMBER, checkNearMissPattern, checkPattern, checksDigest, childStatePath, defineCheck, isRedacted, oneOf, renderCheck, repoRef, statePath, templateSlots };

package/dist/{chunk-2TSYKRER.js → chunk-OQWXMHRG.js}

@@ -2,7 +2,7 @@ import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, Hos
 import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-SGDUD7KK.js';
 import { gmailSeedSchema, defaultSeedState } from './chunk-NJ246QPJ.js';
 import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-ZKID2HS3.js';
-import { isTwinName, TWIN_REGISTRY } from './chunk-BV35ZSB6.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-BA4N7AOZ.js';
 import { toTwinHttpEventRow } from './chunk-TV5S6WQV.js';
 import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 import { mkdir, appendFile, writeFile, readFile } from 'node:fs/promises';

package/dist/{chunk-EU6SGN7A.js → chunk-SE44FKWH.js}

@@ -1,4 +1,4 @@
-import { statePath, defineCheck, VACUITY_SENTINEL, childStatePath, VACUITY_SENTINEL_NUMBER } from './chunk-NY55QTVQ.js';
+import { statePath, defineCheck, VACUITY_SENTINEL, childStatePath, VACUITY_SENTINEL_NUMBER, isRedacted } from './chunk-JWJYNAWI.js';
 
 // ../packages/twin-gmail/dist/src/check-params.js
 var messageId = {
@@ -436,7 +436,12 @@ var mailboxLabelCount = defineCheck({
       return { passed: false, status: "skipped", reason: "collection_truncated" };
     }
     if (final.mailboxes != null && !final.mailboxes.some((mb) => (mb.email ?? "").toLowerCase() === mailbox.toLowerCase())) {
-      return { passed: false, status: "skipped", reason: `mailbox_not_found ("${mailbox}")` };
+      const eaten = final.mailboxes.some((mb) => isRedacted(mb.email));
+      return {
+        passed: false,
+        status: "skipped",
+        reason: eaten ? `mailbox_redacted ("${mailbox}")` : `mailbox_not_found ("${mailbox}")`
+      };
     }
     const ids = labelIdsFor(final, label);
     const labeled = new Set(final.messageLabels.filter((row) => ids.has((row.labelId ?? "").toLowerCase())).map((row) => (row.messageId ?? "").toLowerCase()));

package/dist/{chunk-3QVSXFJI.js → chunk-XBT6ZLBG.js}

@@ -1,4 +1,4 @@
-import { statePath, defineCheck, VACUITY_SENTINEL, VACUITY_SENTINEL_NUMBER, childStatePath } from './chunk-NY55QTVQ.js';
+import { statePath, defineCheck, VACUITY_SENTINEL, VACUITY_SENTINEL_NUMBER, childStatePath } from './chunk-JWJYNAWI.js';
 
 // ../packages/twin-linear/dist/src/check-params.js
 var issueTitle = {