@pome-sh/cli 0.8.0 → 0.10.0

package/dist/src/hosted/evalResultCache.d.ts

@@ -6,9 +6,9 @@ export interface VerdictArtifact {
     /** Provenance: the only writer is the /finalize response path. */
     source: "cloud-finalize";
     task_name: string;
-    /** The scenario path as the run invocation saw it (may move later —
-     *  readers must tolerate a dangling path). */
-    scenario_path: string;
+    /** The task path as the run invocation saw it (may move later — readers
+     *  must tolerate a dangling path). */
+    task_path: string;
     /** Shared trial-group id (`grp_` + nanoid21); null on single runs. */
     group_id: string | null;
     session_id: string;
@@ -37,7 +37,7 @@ export interface RunSet {
     /** null = a single run that never had a group. */
     groupId: string | null;
     taskName: string;
-    /** The scenario path recorded at run time (first trial's). */
+    /** The task path recorded at run time (first trial's). */
     taskPath: string;
     /** Trials sorted by finalized_at ascending. */
     trials: TrialVerdict[];

package/dist/src/hosted/evalResultCache.js

@@ -44,7 +44,7 @@ function isVerdictArtifact(parsed) {
         return false;
     if (typeof v.task_name !== "string")
         return false;
-    if (typeof v.scenario_path !== "string")
+    if (typeof v.task_path !== "string" && typeof v.scenario_path !== "string")
         return false;
     if (v.group_id !== null && typeof v.group_id !== "string")
         return false;
@@ -69,6 +69,13 @@ function isVerdictArtifact(parsed) {
             typeof result.skipped === "boolean");
     });
 }
+/** F-933 — collapse the legacy `scenario_path` onto `task_path` so callers
+ *  only ever deal with one spelling. Validation ran first, so at least one of
+ *  the two is a string. */
+function normalizeVerdictArtifact(parsed) {
+    const { scenario_path: legacyPath, task_path: taskPath, ...rest } = parsed;
+    return { ...rest, task_path: taskPath ?? legacyPath };
+}
 export async function readVerdictArtifact(runDir) {
     const path = join(runDir, VERDICT_FILENAME);
     let raw;
@@ -82,7 +89,7 @@ export async function readVerdictArtifact(runDir) {
         const parsed = JSON.parse(raw);
         if (!isVerdictArtifact(parsed))
             return null;
-        return { runDir, verdict: parsed };
+        return { runDir, verdict: normalizeVerdictArtifact(parsed) };
     }
     catch {
         return null;
@@ -136,7 +143,7 @@ export function groupRunSets(trials) {
         sets.push({
             groupId: bucket[0].verdict.group_id,
             taskName: bucket[0].verdict.task_name,
-            taskPath: bucket[0].verdict.scenario_path,
+            taskPath: bucket[0].verdict.task_path,
             trials: bucket,
             latestFinalizedAt: last.verdict.finalized_at,
             anyFailed: bucket.some((t) => !t.verdict.passed),

package/dist/src/recorder/artifacts.d.ts

@@ -22,7 +22,7 @@ export type RunArtifactCoreInput = {
 export declare function writeRunArtifactsCore(input: RunArtifactCoreInput): Promise<RunArtifacts>;
 export declare function readLatestRun(artifactsDir: string): Promise<{
     run_id: string;
-    scenario: string;
+    task: string;
     run_dir: string;
 } | undefined>;
 export type RunMetaSummary = {

package/dist/src/recorder/artifacts.js

@@ -78,9 +78,16 @@ export async function writeRunArtifactsCore(input) {
     await writeJson(join(runDir, "state_final.json"), input.stateFinal);
     await writeFile(join(runDir, "stdout.txt"), redactText(input.stdout));
     await writeFile(join(runDir, "stderr.log"), redactText(input.stderr));
+    // F-933 — `task`, not `scenario`. latest.json is a purely local pointer:
+    // every run overwrites it and its only readers are `pome eval` / `pome
+    // inspect`, which dereference `run_dir`/`run_id`. Nothing on the wire and
+    // nothing in the cloud parses it, so the rename needs no compat window.
+    // meta.json's `scenario` key is deliberately NOT renamed here — that one is
+    // uploaded to cloud finalize and read back out of older run dirs (see
+    // AGENTS.md's sanctioned-survivor list).
     await writeJson(join(input.artifactsDir, "latest.json"), {
         run_id: input.runId,
-        scenario: input.scenario.slug,
+        task: input.scenario.slug,
         run_dir: runDir
     });
     return { runId: input.runId, runDir };

package/dist/src/runner/runTask.d.ts

@@ -75,7 +75,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
                     }[];
                     statuses: {
                         context: string;
-                        state: "error" | "success" | "failure" | "pending";
+                        state: "error" | "failure" | "pending" | "success";
                         description: string;
                     }[];
                     number?: number | undefined;
@@ -321,7 +321,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
                 states?: {
                     name: string;
                     id?: string | undefined;
-                    type?: "completed" | "backlog" | "unstarted" | "started" | "canceled" | undefined;
+                    type?: "backlog" | "unstarted" | "started" | "completed" | "canceled" | undefined;
                     position?: number | undefined;
                 }[] | undefined;
             }[];
@@ -334,7 +334,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
             }[];
             projects: {
                 name: string;
-                state: "completed" | "started" | "canceled" | "planned";
+                state: "started" | "completed" | "canceled" | "planned";
                 id?: string | undefined;
                 description?: string | null | undefined;
                 team?: string | undefined;
@@ -394,7 +394,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
                 clientSecret: string;
                 name: string;
                 redirectUris: string[];
-                actor: "user" | "app";
+                actor: "app" | "user";
                 assignable: boolean;
                 mentionable: boolean;
                 id?: string | undefined;
@@ -407,7 +407,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
                 user?: string | undefined;
                 app?: string | undefined;
                 scopes?: string | string[] | undefined;
-                actor?: "user" | "app" | undefined;
+                actor?: "app" | "user" | undefined;
                 sid?: string | undefined;
                 expiresAt?: string | null | undefined;
             }[];
@@ -470,7 +470,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
                     }[];
                     statuses: {
                         context: string;
-                        state: "error" | "success" | "failure" | "pending";
+                        state: "error" | "failure" | "pending" | "success";
                         description: string;
                     }[];
                     number?: number | undefined;
@@ -716,7 +716,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
                 states?: {
                     name: string;
                     id?: string | undefined;
-                    type?: "completed" | "backlog" | "unstarted" | "started" | "canceled" | undefined;
+                    type?: "backlog" | "unstarted" | "started" | "completed" | "canceled" | undefined;
                     position?: number | undefined;
                 }[] | undefined;
             }[];
@@ -729,7 +729,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
             }[];
             projects: {
                 name: string;
-                state: "completed" | "started" | "canceled" | "planned";
+                state: "started" | "completed" | "canceled" | "planned";
                 id?: string | undefined;
                 description?: string | null | undefined;
                 team?: string | undefined;
@@ -789,7 +789,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
                 clientSecret: string;
                 name: string;
                 redirectUris: string[];
-                actor: "user" | "app";
+                actor: "app" | "user";
                 assignable: boolean;
                 mentionable: boolean;
                 id?: string | undefined;
@@ -802,7 +802,7 @@ export declare function runTask(options: RunTaskOptions): Promise<{
                 user?: string | undefined;
                 app?: string | undefined;
                 scopes?: string | string[] | undefined;
-                actor?: "user" | "app" | undefined;
+                actor?: "app" | "user" | undefined;
                 sid?: string | undefined;
                 expiresAt?: string | null | undefined;
             }[];

package/dist/src/runner/runTaskHosted.js

@@ -504,7 +504,7 @@ export async function runTaskHosted(options) {
                 version: VERDICT_ARTIFACT_VERSION,
                 source: "cloud-finalize",
                 task_name: scenario.slug,
-                scenario_path: options.taskPath,
+                task_path: options.taskPath,
                 group_id: options.groupId ?? null,
                 session_id: session.session_id,
                 cloud_run_id: finalized.run_id,
@@ -548,7 +548,14 @@ export async function runTaskHosted(options) {
     finally {
         // Best-effort teardown. TTL would reap anyway; explicit delete keeps
         // the dashboard sessions list tidy.
-        await client.deleteSession(session.session_id).catch(() => undefined);
+        // F-983: this teardown deliberately discards. On the success path the
+        // session is already `done` (finalize closed it) and the DELETE is a
+        // no-op; on the failure path we accept losing an ungraded tape rather
+        // than leaving open sessions to linger to TTL and pollute the
+        // reliability view. Flagged as known residue in the F-983 spec.
+        await client
+            .deleteSession(session.session_id, true, { discard: true })
+            .catch(() => undefined);
         await rm(signalsDir, { recursive: true, force: true }).catch(() => undefined);
     }
 }

package/dist/src/runner/runTrialGroup.js

@@ -115,7 +115,10 @@ export async function runTrialGroup(options) {
         // Roll the half-group back so abandoned mints never linger as open
         // sessions polluting the reliability view; then let the caller map the
         // error to the documented exit code.
-        await Promise.all(sessions.map((s) => client.deleteSession(s.session_id).catch(() => undefined)));
+        await Promise.all(
+        // F-983: these sessions were minted and never launched, so there is no
+        // tape to lose — an explicit discard is honest here.
+        sessions.map((s) => client.deleteSession(s.session_id, true, { discard: true }).catch(() => undefined)));
         throw err;
     }
     const concurrency = sessions.length;

package/dist/src/task/insertCriterion.d.ts

@@ -0,0 +1,15 @@
+/**
+ * F-1074 — append one rendered criterion to a task file's `## Success Criteria`,
+ * touching nothing else.
+ *
+ * It does NOT parse and re-serialize the markdown. Re-serializing is how the
+ * readable artifact drifts, and the north-star check on this ticket is that it
+ * does not: authoring a criterion changes exactly one line.
+ */
+export declare class MissingCriteriaSectionError extends Error {
+    constructor(path: string);
+}
+export declare class DuplicateCriterionError extends Error {
+    constructor(path: string, line: string);
+}
+export declare function insertCriterion(source: string, line: string, path?: string): string;

package/dist/src/task/insertCriterion.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * F-1074 — append one rendered criterion to a task file's `## Success Criteria`,
+ * touching nothing else.
+ *
+ * It does NOT parse and re-serialize the markdown. Re-serializing is how the
+ * readable artifact drifts, and the north-star check on this ticket is that it
+ * does not: authoring a criterion changes exactly one line.
+ */
+const HEADING_RE = /^##\s+Success Criteria\s*$/;
+const NEXT_HEADING_RE = /^##\s+/;
+// Mirrors CRITERION_LINE_RE in ./parseTask.ts. Used ONLY to find where the last
+// existing criterion sits — never to validate one; that is the parser's job.
+const CRITERION_RE = /^[-*]\s+\[(?:code|model)(?::[a-z][a-z0-9_-]*)?\]\s+.+$/;
+export class MissingCriteriaSectionError extends Error {
+    constructor(path) {
+        super(`${path} has no \`## Success Criteria\` section. Add one and run this again — ` +
+            `pome will not invent a section in a file it did not write.`);
+        this.name = "MissingCriteriaSectionError";
+    }
+}
+// Found by driving the command: authoring a criterion a task already carries
+// adds it twice, and the grader scores both — the denominator inflates and the
+// task's percentage moves for a reason nobody wrote down. That is the exact
+// class of silent denominator change this milestone exists to remove, so it is
+// a refusal rather than a warning.
+export class DuplicateCriterionError extends Error {
+    constructor(path, line) {
+        super(`${path} already has this criterion:\n  ${line}\n` +
+            `Adding it again would score it twice and inflate the task's denominator.`);
+        this.name = "DuplicateCriterionError";
+    }
+}
+export function insertCriterion(source, line, path = "this task file") {
+    const lines = source.split("\n");
+    const start = lines.findIndex((l) => HEADING_RE.test(l));
+    if (start === -1)
+        throw new MissingCriteriaSectionError(path);
+    let end = lines.length;
+    for (let i = start + 1; i < lines.length; i += 1) {
+        if (NEXT_HEADING_RE.test(lines[i])) {
+            end = i;
+            break;
+        }
+    }
+    let insertAt = -1;
+    for (let i = start + 1; i < end; i += 1) {
+        const existing = lines[i].trim();
+        if (!CRITERION_RE.test(existing))
+            continue;
+        if (existing === line.trim())
+            throw new DuplicateCriterionError(path, line);
+        insertAt = i + 1;
+    }
+    if (insertAt === -1) {
+        // Empty section: land after the heading's blank line, so the result reads
+        // like every shipped task instead of butting against the heading.
+        insertAt = lines[start + 1]?.trim() === "" ? start + 2 : start + 1;
+    }
+    lines.splice(insertAt, 0, line);
+    return lines.join("\n");
+}

package/dist/src/task/parseTask.d.ts

@@ -1,5 +1,10 @@
 import { type Task } from "./taskSchema.js";
 export declare function parseTaskFile(path: string): Promise<Task>;
+/** The task's declared twins, read WITHOUT requiring criteria (F-1074).
+ *  `taskSchema` demands at least one criterion, and `pome checks add` needs the
+ *  twin list BEFORE it has written one. Reuses this module's own section
+ *  splitter and config schema, so it is not a second parser. */
+export declare function readConfigTwins(markdown: string): string[];
 export declare function parseTask(markdown: string, slug?: string, sidecarSeed?: unknown, taskPath?: string): Task;
 /** The flat seed a single twin boots from. Single-twin scenarios return the
  *  flat `seedState` as-is; multi-twin scenarios return that twin's slice of the

package/dist/src/task/parseTask.js

@@ -14,6 +14,17 @@ export async function parseTaskFile(path) {
     const sidecarSeed = await readSidecarSeed(path);
     return parseTask(markdown, slugFromPath(path), sidecarSeed, path);
 }
+/** The task's declared twins, read WITHOUT requiring criteria (F-1074).
+ *  `taskSchema` demands at least one criterion, and `pome checks add` needs the
+ *  twin list BEFORE it has written one. Reuses this module's own section
+ *  splitter and config schema, so it is not a second parser. */
+export function readConfigTwins(markdown) {
+    const configText = splitSections(markdown).get("config") ?? "";
+    const config = configText.trim()
+        ? taskConfigSchema.parse(parseFencedYaml(configText))
+        : taskConfigSchema.parse({});
+    return config.twins;
+}
 export function parseTask(markdown, slug = "scenario", sidecarSeed, taskPath) {
     const title = markdown.match(/^#\s+(.+)$/m)?.[1]?.trim() ?? slug;
     const sections = splitSections(markdown);

package/dist/src/task/taskSchema.d.ts

@@ -491,9 +491,9 @@ export declare const seedStateSchema: z.ZodUnion<readonly [z.ZodObject<{
                 context: z.ZodDefault<z.ZodString>;
                 state: z.ZodDefault<z.ZodEnum<{
                     error: "error";
-                    success: "success";
                     failure: "failure";
                     pending: "pending";
+                    success: "success";
                 }>>;
                 description: z.ZodDefault<z.ZodString>;
             }, z.core.$strip>>>;
@@ -964,9 +964,9 @@ export declare const seedEnvelopeSchema: z.ZodRecord<z.ZodString, z.ZodUnion<rea
                 context: z.ZodDefault<z.ZodString>;
                 state: z.ZodDefault<z.ZodEnum<{
                     error: "error";
-                    success: "success";
                     failure: "failure";
                     pending: "pending";
+                    success: "success";
                 }>>;
                 description: z.ZodDefault<z.ZodString>;
             }, z.core.$strip>>>;
@@ -1459,9 +1459,9 @@ export declare const taskSchema: z.ZodObject<{
                     context: z.ZodDefault<z.ZodString>;
                     state: z.ZodDefault<z.ZodEnum<{
                         error: "error";
-                        success: "success";
                         failure: "failure";
                         pending: "pending";
+                        success: "success";
                     }>>;
                     description: z.ZodDefault<z.ZodString>;
                 }, z.core.$strip>>>;
@@ -1931,9 +1931,9 @@ export declare const taskSchema: z.ZodObject<{
                     context: z.ZodDefault<z.ZodString>;
                     state: z.ZodDefault<z.ZodEnum<{
                         error: "error";
-                        success: "success";
                         failure: "failure";
                         pending: "pending";
+                        success: "success";
                     }>>;
                     description: z.ZodDefault<z.ZodString>;
                 }, z.core.$strip>>>;

package/node_modules/@pome-sh/sdk/dist/checks.d.ts

@@ -0,0 +1,54 @@
+export type CheckPolarity = "positive" | "negative";
+export type CheckSubstrateKind = "final" | "seed+final" | "tape";
+export interface CheckParamType {
+    readonly name: string;
+    readonly pattern: string;
+    readonly example: string;
+    render(value: string): string;
+    parse(raw: string): string;
+}
+export declare const repoRef: CheckParamType;
+export interface CheckOutcome {
+    passed: boolean;
+    reason: string;
+    status?: "passed" | "failed" | "unmatched" | "skipped";
+}
+export interface CheckSubstrate<TState> {
+    seed: TState | null;
+    final: TState;
+}
+export interface CheckDefinition<TState, TArgs extends Record<string, string>> {
+    id: string;
+    description: string;
+    template: string;
+    params: {
+        [K in keyof TArgs]: CheckParamType;
+    };
+    substrate: CheckSubstrateKind;
+    polarity(args: TArgs): CheckPolarity;
+    subject?(args: TArgs): string | null;
+    vacuityMutant(args: TArgs): TArgs | null;
+    evaluate(args: TArgs, substrate: CheckSubstrate<TState>): CheckOutcome;
+}
+export declare function templateSlots(template: string): {
+    literals: string[];
+    params: string[];
+};
+type ArgsOfParams<TParams extends Record<string, CheckParamType>> = {
+    [K in keyof TParams]: string;
+};
+export declare function defineCheck<TState, TParams extends Record<string, CheckParamType>>(def: Omit<CheckDefinition<TState, ArgsOfParams<TParams>>, "params"> & {
+    params: TParams;
+}): CheckDefinition<TState, ArgsOfParams<TParams>>;
+export declare function renderCheck<TState, TArgs extends Record<string, string>>(def: CheckDefinition<TState, TArgs>, args: TArgs): string;
+export interface CheckBindingShape {
+    readonly id: string;
+    readonly template: string;
+    readonly substrate: CheckSubstrateKind;
+    readonly params: Readonly<Record<string, CheckParamType>>;
+}
+export declare function checkPattern(def: CheckBindingShape): RegExp;
+export declare function checksDigest(defs: readonly CheckBindingShape[]): string;
+export declare function checkNearMissPattern(def: CheckBindingShape): RegExp;
+export declare function parseCheck<TState, TArgs extends Record<string, string>>(def: CheckDefinition<TState, TArgs>, text: string): TArgs | null;
+export {};

package/node_modules/@pome-sh/sdk/dist/checks.js

@@ -0,0 +1,143 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The assertable check vocabulary (F-1073, milestone A2b).
+//
+// Position 2: the author selects a typed check and the system RENDERS the
+// English. Binding cannot fail, because the sentence is what the check
+// produced. That is why there is no `pattern` field here — the matcher is
+// GENERATED from `template`, so a declaration and its regex cannot drift
+// apart, and an author can neither write nor break one.
+//
+// This module is twin-agnostic. Each twin declares its own checks next to the
+// state they read (`packages/twin-<x>/src/checks.ts`), because the twin owns
+// that state's shape; pome-cloud imports those declarations from npm and
+// adapts them onto its existing predicate engine. There is no second copy to
+// reconcile — the drift gate's job is catching a pin that fell behind, not
+// reconciling two hand-maintained vocabularies.
+import { createHash } from "node:crypto";
+// `owner/name`. Deliberately narrow, and it must NOT accept a bare repo name:
+// a sentence with a malformed repo has to be reported as the corrupted
+// template instance it is, rather than quietly parsing into a lookup that then
+// fails for an unrelated-looking reason.
+export const repoRef = {
+    name: "repo",
+    pattern: "[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+",
+    example: "acme/api",
+    render: (value) => value,
+    parse: (raw) => raw,
+};
+const SLOT_RE = /\{([a-z][a-z0-9_]*)\}/g;
+// Splits "a {x} b" into { literals: ["a ", " b"], params: ["x"] }.
+// `literals.length` is always `params.length + 1`, which is what lets the
+// pattern builder interleave them without a special case for either end.
+export function templateSlots(template) {
+    const literals = [];
+    const params = [];
+    let cursor = 0;
+    for (const match of template.matchAll(SLOT_RE)) {
+        literals.push(template.slice(cursor, match.index));
+        params.push(match[1]);
+        cursor = match.index + match[0].length;
+    }
+    literals.push(template.slice(cursor));
+    return { literals, params };
+}
+function escapeLiteral(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+// Validates a declaration at module load, so a broken check cannot ship: a
+// slot with no type, a type no slot uses, or a repeated slot are all authoring
+// mistakes that would otherwise surface as a check that silently binds nothing.
+export function defineCheck(def) {
+    const { params } = templateSlots(def.template);
+    const seen = new Set();
+    for (const param of params) {
+        if (seen.has(param)) {
+            throw new Error(`check ${def.id}: duplicate template slot {${param}}`);
+        }
+        seen.add(param);
+        if (!def.params[param]) {
+            throw new Error(`check ${def.id}: template slot {${param}} has no declared param type`);
+        }
+    }
+    for (const declared of Object.keys(def.params)) {
+        if (!seen.has(declared)) {
+            throw new Error(`check ${def.id}: declared param \`${declared}\` is not used by the template`);
+        }
+    }
+    // F-1074 — a param type whose own example violates its own pattern would put
+    // an invalid value in front of an author as the suggested one.
+    for (const [name, type] of Object.entries(def.params)) {
+        const paramType = type;
+        if (!new RegExp(`^${paramType.pattern}$`).test(paramType.example)) {
+            throw new Error(`check ${def.id}: param \`${name}\` example ${JSON.stringify(paramType.example)} ` +
+                `does not match its own pattern /${paramType.pattern}/`);
+        }
+    }
+    return def;
+}
+export function renderCheck(def, args) {
+    const { literals, params } = templateSlots(def.template);
+    let rendered = literals[0];
+    params.forEach((param, index) => {
+        const type = def.params[param];
+        rendered += type.render(args[param]) + literals[index + 1];
+    });
+    return rendered;
+}
+function buildPattern(template, slotSource) {
+    const { literals, params } = templateSlots(template);
+    let source = `^${escapeLiteral(literals[0])}`;
+    params.forEach((_param, index) => {
+        source += `(${slotSource(index)})${escapeLiteral(literals[index + 1])}`;
+    });
+    // Case-SENSITIVE and anchored on purpose. Any text this matches must
+    // re-render byte-identically, which makes the render→parse→render round trip
+    // a property of the generator rather than a condition to re-test at run time.
+    return new RegExp(`${source}$`);
+}
+export function checkPattern(def) {
+    const { params } = templateSlots(def.template);
+    return buildPattern(def.template, (index) => def.params[params[index]].pattern);
+}
+// One implementation, called by BOTH the control plane and the CLI (F-1074).
+// They resolve declarations from independent npm pins and must be able to prove
+// they agree before an author writes a sentence; two implementations of "hash
+// the binding surface" would be the same two-representations-of-one-fact defect
+// this vocabulary exists to remove, one level down — a sort or key-order
+// difference would make every pin look skewed, or a real skew look equal.
+//
+// `description` and `example` are deliberately NOT hashed. This digest gates an
+// author's write, and a prose edit changes no sentence.
+export function checksDigest(defs) {
+    const rows = defs
+        .map((def) => ({
+        id: def.id,
+        substrate: def.substrate,
+        // The compiled source, not the template: this also catches a change in
+        // `buildPattern` itself, which comparing templates would miss.
+        pattern: checkPattern(def).source,
+    }))
+        .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    return `sha256:${createHash("sha256").update(JSON.stringify(rows), "utf8").digest("hex")}`;
+}
+// The literal segments intact, every slot wide open. A text matching THIS and
+// not `checkPattern` is a corrupted instance of this check: it says the
+// check's sentence but fills a slot with something the slot's type rejects.
+// A text that fails this too is a stranger, and stays on the unmatched path —
+// which is what keeps this gate off the legacy phrases that resemble nothing.
+export function checkNearMissPattern(def) {
+    return buildPattern(def.template, () => ".+?");
+}
+export function parseCheck(def, text) {
+    const matched = text.trim().match(checkPattern(def));
+    if (!matched)
+        return null;
+    const { params } = templateSlots(def.template);
+    const args = {};
+    params.forEach((param, index) => {
+        args[param] = def.params[param].parse(matched[index + 1]);
+    });
+    return args;
+}
+//# sourceMappingURL=checks.js.map

package/node_modules/@pome-sh/sdk/dist/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,wDAAwD;AACxD,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,gDAAgD;AAEhD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2BzC,8EAA8E;AAC9E,uEAAuE;AACvE,+EAA+E;AAC/E,yCAAyC;AACzC,MAAM,CAAC,MAAM,OAAO,GAAmB;IACrC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,iCAAiC;IAC1C,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;CACpB,CAAC;AAoEF,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAEzC,mEAAmE;AACnE,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACvB,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAWD,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,UAAU,WAAW,CACzB,GAAyF;IAEzF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,8BAA8B,KAAK,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAsB,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,oBAAoB,KAAK,8BAA8B,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,sBAAsB,QAAQ,gCAAgC,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,IAAsB,CAAC;QACzC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,SAAS,GAAG,CAAC,EAAE,aAAa,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG;gBAChF,mCAAmC,SAAS,CAAC,OAAO,GAAG,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAqD,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAmC,EACnC,IAAW;IAEX,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IAC5B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAoB,CAAE,CAAC;QAC/C,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAoB,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,UAAqC;IAC3E,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC/B,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,qEAAqE;IACrE,6EAA6E;IAC7E,8EAA8E;IAC9E,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAClC,CAAC;AAaD,MAAM,UAAU,YAAY,CAAC,GAAsB;IACjD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAE,CAAE,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,0EAA0E;AAC1E,EAAE;AACF,gFAAgF;AAChF,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,IAAkC;IAC7D,MAAM,IAAI,GAAG,IAAI;SACd,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,uEAAuE;QACvE,+DAA+D;QAC/D,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM;KAClC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,GAAmC,EACnC,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAoB,CAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,OAAO,IAAa,CAAC;AACvB,CAAC"}

package/node_modules/@pome-sh/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/sdk",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Twin engine for Pome digital twins — defineTwin() + serve(): HTTP mounting, bearer auth, trace recorder, MCP dispatch, SQLite-backed state.",
   "private": false,
   "type": "module",
@@ -18,6 +18,10 @@
     "./parity": {
       "types": "./dist/parity.d.ts",
       "default": "./dist/parity.js"
+    },
+    "./checks": {
+      "types": "./dist/checks.d.ts",
+      "default": "./dist/checks.js"
     }
   },
   "publishConfig": {
@@ -36,8 +40,8 @@
     "dist"
   ],
   "dependencies": {
-    "@pome-sh/shared-types": "0.12.0",
-    "hono": "^4.12.27",
+    "@pome-sh/shared-types": "0.12.2",
+    "hono": "^4.12.31",
     "zod": "^4.1.13"
   },
   "peerDependencies": {

package/node_modules/@pome-sh/twin-github/dist/src/access-control.d.ts

@@ -12,18 +12,18 @@ export declare function githubAccessControlPayload(): {
         tool: string;
         operation: string;
         method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-        category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
+        category: "collaborators" | "labels" | "issues" | "pull_requests" | "milestones" | "issue_comments" | "branches_files" | "commits_diffs" | "status_checks" | "tags_releases";
         default_allowed: boolean;
         v2: boolean;
     }[];
     categories: {
-        category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
+        category: "collaborators" | "labels" | "issues" | "pull_requests" | "milestones" | "issue_comments" | "branches_files" | "commits_diffs" | "status_checks" | "tags_releases";
         label: string;
         endpoints: {
             tool: string;
             operation: string;
             method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-            category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
+            category: "collaborators" | "labels" | "issues" | "pull_requests" | "milestones" | "issue_comments" | "branches_files" | "commits_diffs" | "status_checks" | "tags_releases";
             default_allowed: boolean;
             v2: boolean;
         }[];