@pome-sh/cli 0.9.0 → 0.10.0

package/dist/src/task/insertCriterion.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * F-1074 — append one rendered criterion to a task file's `## Success Criteria`,
+ * touching nothing else.
+ *
+ * It does NOT parse and re-serialize the markdown. Re-serializing is how the
+ * readable artifact drifts, and the north-star check on this ticket is that it
+ * does not: authoring a criterion changes exactly one line.
+ */
+const HEADING_RE = /^##\s+Success Criteria\s*$/;
+const NEXT_HEADING_RE = /^##\s+/;
+// Mirrors CRITERION_LINE_RE in ./parseTask.ts. Used ONLY to find where the last
+// existing criterion sits — never to validate one; that is the parser's job.
+const CRITERION_RE = /^[-*]\s+\[(?:code|model)(?::[a-z][a-z0-9_-]*)?\]\s+.+$/;
+export class MissingCriteriaSectionError extends Error {
+    constructor(path) {
+        super(`${path} has no \`## Success Criteria\` section. Add one and run this again — ` +
+            `pome will not invent a section in a file it did not write.`);
+        this.name = "MissingCriteriaSectionError";
+    }
+}
+// Found by driving the command: authoring a criterion a task already carries
+// adds it twice, and the grader scores both — the denominator inflates and the
+// task's percentage moves for a reason nobody wrote down. That is the exact
+// class of silent denominator change this milestone exists to remove, so it is
+// a refusal rather than a warning.
+export class DuplicateCriterionError extends Error {
+    constructor(path, line) {
+        super(`${path} already has this criterion:\n  ${line}\n` +
+            `Adding it again would score it twice and inflate the task's denominator.`);
+        this.name = "DuplicateCriterionError";
+    }
+}
+export function insertCriterion(source, line, path = "this task file") {
+    const lines = source.split("\n");
+    const start = lines.findIndex((l) => HEADING_RE.test(l));
+    if (start === -1)
+        throw new MissingCriteriaSectionError(path);
+    let end = lines.length;
+    for (let i = start + 1; i < lines.length; i += 1) {
+        if (NEXT_HEADING_RE.test(lines[i])) {
+            end = i;
+            break;
+        }
+    }
+    let insertAt = -1;
+    for (let i = start + 1; i < end; i += 1) {
+        const existing = lines[i].trim();
+        if (!CRITERION_RE.test(existing))
+            continue;
+        if (existing === line.trim())
+            throw new DuplicateCriterionError(path, line);
+        insertAt = i + 1;
+    }
+    if (insertAt === -1) {
+        // Empty section: land after the heading's blank line, so the result reads
+        // like every shipped task instead of butting against the heading.
+        insertAt = lines[start + 1]?.trim() === "" ? start + 2 : start + 1;
+    }
+    lines.splice(insertAt, 0, line);
+    return lines.join("\n");
+}

package/dist/src/task/parseTask.d.ts

@@ -1,5 +1,10 @@
 import { type Task } from "./taskSchema.js";
 export declare function parseTaskFile(path: string): Promise<Task>;
+/** The task's declared twins, read WITHOUT requiring criteria (F-1074).
+ *  `taskSchema` demands at least one criterion, and `pome checks add` needs the
+ *  twin list BEFORE it has written one. Reuses this module's own section
+ *  splitter and config schema, so it is not a second parser. */
+export declare function readConfigTwins(markdown: string): string[];
 export declare function parseTask(markdown: string, slug?: string, sidecarSeed?: unknown, taskPath?: string): Task;
 /** The flat seed a single twin boots from. Single-twin scenarios return the
  *  flat `seedState` as-is; multi-twin scenarios return that twin's slice of the

package/dist/src/task/parseTask.js

@@ -14,6 +14,17 @@ export async function parseTaskFile(path) {
     const sidecarSeed = await readSidecarSeed(path);
     return parseTask(markdown, slugFromPath(path), sidecarSeed, path);
 }
+/** The task's declared twins, read WITHOUT requiring criteria (F-1074).
+ *  `taskSchema` demands at least one criterion, and `pome checks add` needs the
+ *  twin list BEFORE it has written one. Reuses this module's own section
+ *  splitter and config schema, so it is not a second parser. */
+export function readConfigTwins(markdown) {
+    const configText = splitSections(markdown).get("config") ?? "";
+    const config = configText.trim()
+        ? taskConfigSchema.parse(parseFencedYaml(configText))
+        : taskConfigSchema.parse({});
+    return config.twins;
+}
 export function parseTask(markdown, slug = "scenario", sidecarSeed, taskPath) {
     const title = markdown.match(/^#\s+(.+)$/m)?.[1]?.trim() ?? slug;
     const sections = splitSections(markdown);

package/dist/src/task/taskSchema.d.ts

@@ -491,9 +491,9 @@ export declare const seedStateSchema: z.ZodUnion<readonly [z.ZodObject<{
                 context: z.ZodDefault<z.ZodString>;
                 state: z.ZodDefault<z.ZodEnum<{
                     error: "error";
-                    success: "success";
                     failure: "failure";
                     pending: "pending";
+                    success: "success";
                 }>>;
                 description: z.ZodDefault<z.ZodString>;
             }, z.core.$strip>>>;
@@ -964,9 +964,9 @@ export declare const seedEnvelopeSchema: z.ZodRecord<z.ZodString, z.ZodUnion<rea
                 context: z.ZodDefault<z.ZodString>;
                 state: z.ZodDefault<z.ZodEnum<{
                     error: "error";
-                    success: "success";
                     failure: "failure";
                     pending: "pending";
+                    success: "success";
                 }>>;
                 description: z.ZodDefault<z.ZodString>;
             }, z.core.$strip>>>;
@@ -1459,9 +1459,9 @@ export declare const taskSchema: z.ZodObject<{
                     context: z.ZodDefault<z.ZodString>;
                     state: z.ZodDefault<z.ZodEnum<{
                         error: "error";
-                        success: "success";
                         failure: "failure";
                         pending: "pending";
+                        success: "success";
                     }>>;
                     description: z.ZodDefault<z.ZodString>;
                 }, z.core.$strip>>>;
@@ -1931,9 +1931,9 @@ export declare const taskSchema: z.ZodObject<{
                     context: z.ZodDefault<z.ZodString>;
                     state: z.ZodDefault<z.ZodEnum<{
                         error: "error";
-                        success: "success";
                         failure: "failure";
                         pending: "pending";
+                        success: "success";
                     }>>;
                     description: z.ZodDefault<z.ZodString>;
                 }, z.core.$strip>>>;

package/node_modules/@pome-sh/sdk/dist/checks.d.ts

@@ -0,0 +1,54 @@
+export type CheckPolarity = "positive" | "negative";
+export type CheckSubstrateKind = "final" | "seed+final" | "tape";
+export interface CheckParamType {
+    readonly name: string;
+    readonly pattern: string;
+    readonly example: string;
+    render(value: string): string;
+    parse(raw: string): string;
+}
+export declare const repoRef: CheckParamType;
+export interface CheckOutcome {
+    passed: boolean;
+    reason: string;
+    status?: "passed" | "failed" | "unmatched" | "skipped";
+}
+export interface CheckSubstrate<TState> {
+    seed: TState | null;
+    final: TState;
+}
+export interface CheckDefinition<TState, TArgs extends Record<string, string>> {
+    id: string;
+    description: string;
+    template: string;
+    params: {
+        [K in keyof TArgs]: CheckParamType;
+    };
+    substrate: CheckSubstrateKind;
+    polarity(args: TArgs): CheckPolarity;
+    subject?(args: TArgs): string | null;
+    vacuityMutant(args: TArgs): TArgs | null;
+    evaluate(args: TArgs, substrate: CheckSubstrate<TState>): CheckOutcome;
+}
+export declare function templateSlots(template: string): {
+    literals: string[];
+    params: string[];
+};
+type ArgsOfParams<TParams extends Record<string, CheckParamType>> = {
+    [K in keyof TParams]: string;
+};
+export declare function defineCheck<TState, TParams extends Record<string, CheckParamType>>(def: Omit<CheckDefinition<TState, ArgsOfParams<TParams>>, "params"> & {
+    params: TParams;
+}): CheckDefinition<TState, ArgsOfParams<TParams>>;
+export declare function renderCheck<TState, TArgs extends Record<string, string>>(def: CheckDefinition<TState, TArgs>, args: TArgs): string;
+export interface CheckBindingShape {
+    readonly id: string;
+    readonly template: string;
+    readonly substrate: CheckSubstrateKind;
+    readonly params: Readonly<Record<string, CheckParamType>>;
+}
+export declare function checkPattern(def: CheckBindingShape): RegExp;
+export declare function checksDigest(defs: readonly CheckBindingShape[]): string;
+export declare function checkNearMissPattern(def: CheckBindingShape): RegExp;
+export declare function parseCheck<TState, TArgs extends Record<string, string>>(def: CheckDefinition<TState, TArgs>, text: string): TArgs | null;
+export {};

package/node_modules/@pome-sh/sdk/dist/checks.js

@@ -0,0 +1,143 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The assertable check vocabulary (F-1073, milestone A2b).
+//
+// Position 2: the author selects a typed check and the system RENDERS the
+// English. Binding cannot fail, because the sentence is what the check
+// produced. That is why there is no `pattern` field here — the matcher is
+// GENERATED from `template`, so a declaration and its regex cannot drift
+// apart, and an author can neither write nor break one.
+//
+// This module is twin-agnostic. Each twin declares its own checks next to the
+// state they read (`packages/twin-<x>/src/checks.ts`), because the twin owns
+// that state's shape; pome-cloud imports those declarations from npm and
+// adapts them onto its existing predicate engine. There is no second copy to
+// reconcile — the drift gate's job is catching a pin that fell behind, not
+// reconciling two hand-maintained vocabularies.
+import { createHash } from "node:crypto";
+// `owner/name`. Deliberately narrow, and it must NOT accept a bare repo name:
+// a sentence with a malformed repo has to be reported as the corrupted
+// template instance it is, rather than quietly parsing into a lookup that then
+// fails for an unrelated-looking reason.
+export const repoRef = {
+    name: "repo",
+    pattern: "[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+",
+    example: "acme/api",
+    render: (value) => value,
+    parse: (raw) => raw,
+};
+const SLOT_RE = /\{([a-z][a-z0-9_]*)\}/g;
+// Splits "a {x} b" into { literals: ["a ", " b"], params: ["x"] }.
+// `literals.length` is always `params.length + 1`, which is what lets the
+// pattern builder interleave them without a special case for either end.
+export function templateSlots(template) {
+    const literals = [];
+    const params = [];
+    let cursor = 0;
+    for (const match of template.matchAll(SLOT_RE)) {
+        literals.push(template.slice(cursor, match.index));
+        params.push(match[1]);
+        cursor = match.index + match[0].length;
+    }
+    literals.push(template.slice(cursor));
+    return { literals, params };
+}
+function escapeLiteral(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+// Validates a declaration at module load, so a broken check cannot ship: a
+// slot with no type, a type no slot uses, or a repeated slot are all authoring
+// mistakes that would otherwise surface as a check that silently binds nothing.
+export function defineCheck(def) {
+    const { params } = templateSlots(def.template);
+    const seen = new Set();
+    for (const param of params) {
+        if (seen.has(param)) {
+            throw new Error(`check ${def.id}: duplicate template slot {${param}}`);
+        }
+        seen.add(param);
+        if (!def.params[param]) {
+            throw new Error(`check ${def.id}: template slot {${param}} has no declared param type`);
+        }
+    }
+    for (const declared of Object.keys(def.params)) {
+        if (!seen.has(declared)) {
+            throw new Error(`check ${def.id}: declared param \`${declared}\` is not used by the template`);
+        }
+    }
+    // F-1074 — a param type whose own example violates its own pattern would put
+    // an invalid value in front of an author as the suggested one.
+    for (const [name, type] of Object.entries(def.params)) {
+        const paramType = type;
+        if (!new RegExp(`^${paramType.pattern}$`).test(paramType.example)) {
+            throw new Error(`check ${def.id}: param \`${name}\` example ${JSON.stringify(paramType.example)} ` +
+                `does not match its own pattern /${paramType.pattern}/`);
+        }
+    }
+    return def;
+}
+export function renderCheck(def, args) {
+    const { literals, params } = templateSlots(def.template);
+    let rendered = literals[0];
+    params.forEach((param, index) => {
+        const type = def.params[param];
+        rendered += type.render(args[param]) + literals[index + 1];
+    });
+    return rendered;
+}
+function buildPattern(template, slotSource) {
+    const { literals, params } = templateSlots(template);
+    let source = `^${escapeLiteral(literals[0])}`;
+    params.forEach((_param, index) => {
+        source += `(${slotSource(index)})${escapeLiteral(literals[index + 1])}`;
+    });
+    // Case-SENSITIVE and anchored on purpose. Any text this matches must
+    // re-render byte-identically, which makes the render→parse→render round trip
+    // a property of the generator rather than a condition to re-test at run time.
+    return new RegExp(`${source}$`);
+}
+export function checkPattern(def) {
+    const { params } = templateSlots(def.template);
+    return buildPattern(def.template, (index) => def.params[params[index]].pattern);
+}
+// One implementation, called by BOTH the control plane and the CLI (F-1074).
+// They resolve declarations from independent npm pins and must be able to prove
+// they agree before an author writes a sentence; two implementations of "hash
+// the binding surface" would be the same two-representations-of-one-fact defect
+// this vocabulary exists to remove, one level down — a sort or key-order
+// difference would make every pin look skewed, or a real skew look equal.
+//
+// `description` and `example` are deliberately NOT hashed. This digest gates an
+// author's write, and a prose edit changes no sentence.
+export function checksDigest(defs) {
+    const rows = defs
+        .map((def) => ({
+        id: def.id,
+        substrate: def.substrate,
+        // The compiled source, not the template: this also catches a change in
+        // `buildPattern` itself, which comparing templates would miss.
+        pattern: checkPattern(def).source,
+    }))
+        .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    return `sha256:${createHash("sha256").update(JSON.stringify(rows), "utf8").digest("hex")}`;
+}
+// The literal segments intact, every slot wide open. A text matching THIS and
+// not `checkPattern` is a corrupted instance of this check: it says the
+// check's sentence but fills a slot with something the slot's type rejects.
+// A text that fails this too is a stranger, and stays on the unmatched path —
+// which is what keeps this gate off the legacy phrases that resemble nothing.
+export function checkNearMissPattern(def) {
+    return buildPattern(def.template, () => ".+?");
+}
+export function parseCheck(def, text) {
+    const matched = text.trim().match(checkPattern(def));
+    if (!matched)
+        return null;
+    const { params } = templateSlots(def.template);
+    const args = {};
+    params.forEach((param, index) => {
+        args[param] = def.params[param].parse(matched[index + 1]);
+    });
+    return args;
+}
+//# sourceMappingURL=checks.js.map

package/node_modules/@pome-sh/sdk/dist/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,wDAAwD;AACxD,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,gDAAgD;AAEhD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2BzC,8EAA8E;AAC9E,uEAAuE;AACvE,+EAA+E;AAC/E,yCAAyC;AACzC,MAAM,CAAC,MAAM,OAAO,GAAmB;IACrC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,iCAAiC;IAC1C,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;CACpB,CAAC;AAoEF,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAEzC,mEAAmE;AACnE,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACvB,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAWD,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,UAAU,WAAW,CACzB,GAAyF;IAEzF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,8BAA8B,KAAK,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAsB,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,oBAAoB,KAAK,8BAA8B,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,sBAAsB,QAAQ,gCAAgC,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,IAAsB,CAAC;QACzC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,SAAS,GAAG,CAAC,EAAE,aAAa,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG;gBAChF,mCAAmC,SAAS,CAAC,OAAO,GAAG,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAqD,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAmC,EACnC,IAAW;IAEX,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IAC5B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAoB,CAAE,CAAC;QAC/C,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAoB,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,UAAqC;IAC3E,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC/B,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,qEAAqE;IACrE,6EAA6E;IAC7E,8EAA8E;IAC9E,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAClC,CAAC;AAaD,MAAM,UAAU,YAAY,CAAC,GAAsB;IACjD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAE,CAAE,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,0EAA0E;AAC1E,EAAE;AACF,gFAAgF;AAChF,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,IAAkC;IAC7D,MAAM,IAAI,GAAG,IAAI;SACd,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,uEAAuE;QACvE,+DAA+D;QAC/D,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM;KAClC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,GAAmC,EACnC,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAoB,CAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,OAAO,IAAa,CAAC;AACvB,CAAC"}

package/node_modules/@pome-sh/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/sdk",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Twin engine for Pome digital twins — defineTwin() + serve(): HTTP mounting, bearer auth, trace recorder, MCP dispatch, SQLite-backed state.",
   "private": false,
   "type": "module",
@@ -18,6 +18,10 @@
     "./parity": {
       "types": "./dist/parity.d.ts",
       "default": "./dist/parity.js"
+    },
+    "./checks": {
+      "types": "./dist/checks.d.ts",
+      "default": "./dist/checks.js"
     }
   },
   "publishConfig": {
@@ -36,8 +40,8 @@
     "dist"
   ],
   "dependencies": {
-    "@pome-sh/shared-types": "0.12.0",
-    "hono": "^4.12.27",
+    "@pome-sh/shared-types": "0.12.2",
+    "hono": "^4.12.31",
     "zod": "^4.1.13"
   },
   "peerDependencies": {

package/node_modules/@pome-sh/twin-github/dist/src/access-control.d.ts

@@ -12,18 +12,18 @@ export declare function githubAccessControlPayload(): {
         tool: string;
         operation: string;
         method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-        category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
+        category: "collaborators" | "labels" | "issues" | "pull_requests" | "milestones" | "issue_comments" | "branches_files" | "commits_diffs" | "status_checks" | "tags_releases";
         default_allowed: boolean;
         v2: boolean;
     }[];
     categories: {
-        category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
+        category: "collaborators" | "labels" | "issues" | "pull_requests" | "milestones" | "issue_comments" | "branches_files" | "commits_diffs" | "status_checks" | "tags_releases";
         label: string;
         endpoints: {
             tool: string;
             operation: string;
             method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-            category: "issues" | "issue_comments" | "pull_requests" | "branches_files" | "commits_diffs" | "milestones" | "status_checks" | "tags_releases" | "labels" | "collaborators";
+            category: "collaborators" | "labels" | "issues" | "pull_requests" | "milestones" | "issue_comments" | "branches_files" | "commits_diffs" | "status_checks" | "tags_releases";
             default_allowed: boolean;
             v2: boolean;
         }[];

package/node_modules/@pome-sh/twin-github/dist/src/checks.d.ts

@@ -0,0 +1,21 @@
+import { type CheckDefinition } from "@pome-sh/sdk/checks";
+export interface GitHubCheckStateLabel {
+    name?: string;
+}
+export interface GitHubCheckStateIssue {
+    number?: number;
+    labels?: string[] | null;
+}
+export interface GitHubCheckStateRepo {
+    owner?: string;
+    name?: string;
+    full_name?: string;
+    labels?: GitHubCheckStateLabel[] | null;
+    issues?: GitHubCheckStateIssue[] | null;
+}
+export interface GitHubCheckState {
+    repositories?: GitHubCheckStateRepo[] | null;
+}
+export declare const GITHUB_CHECKS: readonly [CheckDefinition<GitHubCheckState, {
+    repo: string;
+}>];

package/node_modules/@pome-sh/twin-github/dist/src/checks.js

@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The GitHub twin's assertable check vocabulary (F-1073, milestone A2b).
+//
+// These live HERE, next to the state they read, because the twin owns that
+// state's shape. pome-cloud imports this module from npm and adapts each
+// declaration onto its predicate engine, so there is no second copy to
+// reconcile — only a pin that can fall behind, which is what its drift gate
+// exists to catch.
+import { defineCheck, repoRef } from "@pome-sh/sdk/checks";
+// `ref` is always `owner/name` — the `repoRef` param type will not parse
+// anything else — so there is deliberately no bare-name branch here. The
+// owner/name fallback is for a state export that somehow omits `full_name`,
+// not for a bare-name reference, which cannot reach this function.
+function findRepo(state, ref) {
+    for (const repo of state.repositories ?? []) {
+        if (repo.full_name === ref)
+            return repo;
+        if (repo.owner != null && repo.name != null && `${repo.owner}/${repo.name}` === ref)
+            return repo;
+    }
+    return null;
+}
+function labelNames(repo) {
+    const names = new Set();
+    for (const label of repo.labels ?? []) {
+        if (typeof label.name === "string" && label.name.length > 0)
+            names.add(label.name);
+    }
+    return names;
+}
+const noNewLabels = defineCheck({
+    id: "github.no-new-labels",
+    // F-1074 — the same explanation the comment below carries, in the one place
+    // an author can actually reach it.
+    description: "Compares the repository's label DEFINITIONS in the seed against the final state. " +
+        "Applying an ALREADY-DEFINED label to an issue PASSES this check — only creating a " +
+        "label the repo did not already define fails it. `addIssueLabels` rejects an undefined " +
+        "label, so an examinee cannot apply a new one without creating it first, which is what " +
+        "makes this tight. Needs the seed: it is a delta, not a state assertion.",
+    // The repo is named on purpose. Without it the sentence reads as an
+    // issue-level claim — "the agent did not add labels to the issue" — which is
+    // WIDER than what this predicate compares. `create_label` is repo-scoped in
+    // GitHub's own vocabulary and `add_issue_labels` is the issue-scoped one, so
+    // naming the repo is what tells a reader which of the two is being asserted.
+    //
+    // An agent that applies an ALREADY-DEFINED label to an issue passes this
+    // check, correctly. The assertion that catches that is
+    // `Issue #N has exactly one classification label`.
+    template: "No new labels were created in `{repo}`",
+    params: { repo: repoRef },
+    // The whole point: this is a delta, and it is unanswerable without the seed.
+    substrate: "seed+final",
+    // It should PASS on the untouched seed and can only be broken by the
+    // examinee acting.
+    polarity: () => "negative",
+    // Nothing here is a caller-supplied literal hunted for inside the state, so
+    // there is nothing a redactor could silently delete out from under it.
+    subject: () => null,
+    // The repo is a SELECTOR, not a scanned value. Falsifying it would move the
+    // verdict ("repo not found") for a reason that never reaches the assertion —
+    // a clean bill this check did not earn. Reported as `no_trigger`.
+    vacuityMutant: () => null,
+    evaluate({ repo }, { seed, final }) {
+        // The engine guards this before calling; the check guards too, so a
+        // consumer that forgets gets a named skip rather than a vacuous pass.
+        if (seed === null)
+            return { passed: false, reason: "seed_missing", status: "skipped" };
+        const seedRepo = findRepo(seed, repo);
+        if (!seedRepo)
+            return { passed: false, reason: `repo ${repo} not found in the seed state` };
+        const finalRepo = findRepo(final, repo);
+        if (!finalRepo)
+            return { passed: false, reason: `repo ${repo} not found in state_final` };
+        const before = labelNames(seedRepo);
+        const created = [...labelNames(finalRepo)].filter((name) => !before.has(name)).sort();
+        if (created.length === 0) {
+            return {
+                passed: true,
+                reason: `no labels were created in ${repo} (${before.size} defined at seed, unchanged at finish)`,
+            };
+        }
+        return {
+            passed: false,
+            reason: `labels created in ${repo}: ${created.map((name) => `\`${name}\``).join(", ")}`,
+        };
+    },
+});
+export const GITHUB_CHECKS = [noNewLabels];
+//# sourceMappingURL=checks.js.map

package/node_modules/@pome-sh/twin-github/dist/src/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/checks.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,uEAAuE;AACvE,4EAA4E;AAC5E,mBAAmB;AAEnB,OAAO,EAAE,WAAW,EAAE,OAAO,EAAwB,MAAM,qBAAqB,CAAC;AAkCjF,yEAAyE;AACzE,yEAAyE;AACzE,4EAA4E;AAC5E,mEAAmE;AACnE,SAAS,QAAQ,CAAC,KAAuB,EAAE,GAAW;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IACnG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAA0B;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAAwD,WAAW,CAAC;IACnF,EAAE,EAAE,sBAAsB;IAC1B,4EAA4E;IAC5E,mCAAmC;IACnC,WAAW,EACT,mFAAmF;QACnF,oFAAoF;QACpF,wFAAwF;QACxF,wFAAwF;QACxF,yEAAyE;IAC3E,oEAAoE;IACpE,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE;IACF,yEAAyE;IACzE,uDAAuD;IACvD,mDAAmD;IACnD,QAAQ,EAAE,wCAAwC;IAClD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;IACzB,6EAA6E;IAC7E,SAAS,EAAE,YAAY;IACvB,qEAAqE;IACrE,mBAAmB;IACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;IAC1B,4EAA4E;IAC5E,uEAAuE;IACvE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;IACnB,4EAA4E;IAC5E,6EAA6E;IAC7E,kEAAkE;IAClE,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI;IACzB,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QAChC,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEvF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,IAAI,8BAA8B,EAAE,CAAC;QAC5F,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,IAAI,2BAA2B,EAAE,CAAC;QAE1F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,6BAA6B,IAAI,KAAK,MAAM,CAAC,IAAI,wCAAwC;aAClG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,qBAAqB,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACxF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,CAAU,CAAC"}