@pome-sh/cli 0.9.0 → 0.11.0

package/node_modules/@pome-sh/twin-github/dist/src/check-issues.js

@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// What GitHub's declared checks can assert about an ISSUE (F-1075).
+//
+// Declarations only. The grammar rules they all obey are in `checks.ts`, which
+// assembles them; how the exported tree is read is in `check-state.ts`.
+import { defineCheck, VACUITY_SENTINEL, VACUITY_SENTINEL_NUMBER } from "@pome-sh/sdk/checks";
+import { repoRef } from "@pome-sh/sdk/checks";
+import { commentNeedle, issueNumber, issueState, labelName, login, } from "./check-params.js";
+import { appliedLabelNames, resolveIssue, sameLabel } from "./check-state.js";
+export const issueExists = defineCheck({
+    id: "github.issue-exists",
+    description: "Asserts an issue with this number is present in the repository's final state. It says " +
+        "NOTHING about the issue's content, state, labels or assignee — pair it with those " +
+        "checks when they matter. Its natural use is a task whose examinee must CREATE the " +
+        "issue; asserting the existence of a seeded issue is trivially true and grades nothing.",
+    template: "Issue #{issue} exists in `{repo}`",
+    params: { issue: issueNumber, repo: repoRef },
+    substrate: "final",
+    polarity: () => "positive",
+    // A number, not a string hunted for inside free text — no redactor can
+    // delete it out from under the lookup.
+    subject: () => null,
+    // The ONE check where the issue number is the SCANNED literal rather than a
+    // selector. Everywhere else `resolveIssue` early-returns "not found" before
+    // the real comparison runs, so falsifying the number would move the verdict
+    // for a reason that never reaches the assertion. Here the lookup IS the
+    // assertion, so falsifying it is exactly right.
+    vacuityMutant: (args) => ({ ...args, issue: String(VACUITY_SENTINEL_NUMBER) }),
+    evaluate({ issue, repo }, { final }) {
+        const found = resolveIssue(final, repo, issue);
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        return { passed: true, reason: `issue #${issue} exists in ${repo}` };
+    },
+});
+export const issueStateCheck = defineCheck({
+    id: "github.issue-state",
+    description: "Compares the issue row's `state` column against the named state. A missing issue FAILS; " +
+        "an issue whose export carries no state at all is SKIPPED rather than judged, because " +
+        "absent is not the same as open. The `open` form is a prohibition — it asks the examinee " +
+        "NOT to close the issue — which is why polarity is read from the state word.",
+    // "is in state X", not "is X", for two reasons. It borrows the idiom the
+    // Linear tasks already use (`Issue "…" is in state In Progress`), so one
+    // reading habit spans twins. And it keeps this template's literal tail from
+    // swallowing `… is assigned to \`{login}\``: near-miss patterns open every
+    // slot to `.+?`, so `Issue #{issue} in \`{repo}\` is {state}` would resemble
+    // the assignee sentence, and a corrupted assignee would be reported as a
+    // corrupted STATE check — pointing an author at a check they never picked.
+    // The contract test asserts this directly; it is the reason this wording is
+    // not "is {state}".
+    //
+    // `github.pr-state` keeps the shorter "is {state}" deliberately: half its set
+    // (`merged`/`not merged`) is a different column from `state`, so "is in
+    // state merged" would name the wrong field.
+    template: "Issue #{issue} in `{repo}` is in state {state}",
+    params: { issue: issueNumber, repo: repoRef, state: issueState },
+    substrate: "final",
+    // Per-arg. "is closed" asks the examinee to close it; "is open" is F-915's
+    // "the agent did not close issue #1" — a prohibition wearing a state word.
+    polarity: ({ state }) => (state === "open" ? "negative" : "positive"),
+    subject: () => null,
+    // No falsifiable trigger. The state word comes from a CLOSED SET, so there is
+    // no value guaranteed to be false — every member might legitimately be true
+    // of the state. The issue number only resolves: mutating it early-returns
+    // "not found", which moves the verdict on every seed for a reason unrelated
+    // to the trigger clause. A mutant guaranteed to move is a check that measures
+    // nothing, so this admits the blind spot as `no_trigger` instead of buying a
+    // false clean bill.
+    vacuityMutant: () => null,
+    evaluate({ issue, repo, state }, { final }) {
+        const found = resolveIssue(final, repo, issue);
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        // The issue row must carry a state to attest it; a snapshot that omitted it
+        // cannot be judged either way → safe-skip rather than false-fail.
+        if (found.found.state == null) {
+            return {
+                passed: false,
+                status: "skipped",
+                reason: `issue #${issue} has no state in state_final (state_incomplete)`,
+            };
+        }
+        const actual = found.found.state.toLowerCase();
+        return {
+            passed: actual === state,
+            reason: `issue #${issue} state is "${found.found.state}" (wanted "${state}")`,
+        };
+    },
+});
+export const issueHasLabel = defineCheck({
+    id: "github.issue-has-label",
+    description: "Asserts the label is among those APPLIED to the issue — it does not assert the issue " +
+        "carries only that one. An agent that applies the right label alongside three wrong ones " +
+        "passes this check; `github.issue-exactly-one-label` is the assertion that catches that. " +
+        "The comparison is case-insensitive, because GitHub creates label names case-insensitively " +
+        "while preserving the caller's display casing.",
+    template: "Issue #{issue} in `{repo}` has the `{label}` label applied",
+    params: { issue: issueNumber, repo: repoRef, label: labelName },
+    substrate: "final",
+    polarity: () => "positive",
+    // The label is a caller-supplied literal compared against the state tree, so
+    // a redactor that destroys it makes this check unable to fire (F-1028).
+    subject: ({ label }) => label,
+    // The label is what the scan ranges over; the issue number only resolves.
+    vacuityMutant: (args) => ({ ...args, label: VACUITY_SENTINEL }),
+    evaluate({ issue, repo, label }, { final }) {
+        const found = resolveIssue(final, repo, issue);
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        const applied = appliedLabelNames(found.found);
+        const passed = applied.some((name) => sameLabel(name, label));
+        return {
+            passed,
+            reason: passed
+                ? `issue #${issue} has label "${label}"`
+                : `issue #${issue} labels are [${applied.join(", ")}], missing "${label}"`,
+        };
+    },
+});
+export const issueExactlyOneLabel = defineCheck({
+    id: "github.issue-exactly-one-label",
+    description: "Asserts the issue carries EXACTLY ONE applied label and that it is this one. Strictly " +
+        "stronger than `github.issue-has-label`: it fails an agent that piles a correct label on " +
+        "top of an incorrect one, which is the defect a triage task usually exists to catch. It " +
+        "counts every applied label, not only ones a human would call a classification.",
+    template: "Issue #{issue} in `{repo}` has exactly one classification label, and it is `{label}`",
+    params: { issue: issueNumber, repo: repoRef, label: labelName },
+    substrate: "final",
+    polarity: () => "positive",
+    subject: ({ label }) => label,
+    vacuityMutant: (args) => ({ ...args, label: VACUITY_SENTINEL }),
+    evaluate({ issue, repo, label }, { final }) {
+        const found = resolveIssue(final, repo, issue);
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        const applied = appliedLabelNames(found.found);
+        const passed = applied.length === 1 && sameLabel(applied[0], label);
+        return {
+            passed,
+            reason: passed
+                ? `issue #${issue} has exactly one label ("${label}")`
+                : `issue #${issue} has labels [${applied.join(", ")}], expected exactly one label "${label}"`,
+        };
+    },
+});
+export const issueAssignee = defineCheck({
+    id: "github.issue-assignee",
+    description: "Asserts this login is among the issue's assignees. GitHub issues can carry several, so " +
+        "this does not assert sole ownership. It compares LOGINS exactly and case-sensitively, " +
+        "not display names — `alice` matches the collaborator `alice`, and `Alice Smith` matches " +
+        "nothing.",
+    template: "Issue #{issue} in `{repo}` is assigned to `{login}`",
+    params: { issue: issueNumber, repo: repoRef, login },
+    substrate: "final",
+    polarity: () => "positive",
+    subject: (args) => args.login,
+    vacuityMutant: (args) => ({ ...args, login: VACUITY_SENTINEL }),
+    evaluate(args, { final }) {
+        const found = resolveIssue(final, args.repo, args.issue);
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        const assignees = found.found.assignees ?? [];
+        const passed = assignees.includes(args.login);
+        return {
+            passed,
+            reason: passed
+                ? `issue #${args.issue} is assigned to "${args.login}"`
+                : `issue #${args.issue} assignees are [${assignees.join(", ")}], missing "${args.login}"`,
+        };
+    },
+});
+export const issueCommentContains = defineCheck({
+    id: "github.issue-comment-contains",
+    description: "Scans the bodies of every comment on the issue for this text as a SUBSTRING, " +
+        "case-sensitively. It does not assert who commented, how many did, or where in the body " +
+        "the text sits. Because the text is hunted inside free prose rather than compared to a " +
+        "field, a redaction rule that destroys it makes this check unable to fire — the engine " +
+        "skips it as `subject_redacted` rather than passing it vacuously.",
+    template: 'A comment containing "{needle}" exists on issue #{issue} in `{repo}`',
+    params: { needle: commentNeedle, issue: issueNumber, repo: repoRef },
+    substrate: "final",
+    polarity: () => "positive",
+    subject: ({ needle }) => needle,
+    // The issue RESOLVES, the needle is SCANNED within it. Falsifying the issue
+    // number instead would early-return "not found" and move the verdict for
+    // every seed, for a reason that never reaches the comment scan.
+    vacuityMutant: (args) => ({ ...args, needle: VACUITY_SENTINEL }),
+    evaluate({ needle, issue, repo }, { final }) {
+        const found = resolveIssue(final, repo, issue);
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        const comments = found.found.comments ?? [];
+        const passed = comments.some((comment) => (comment.body ?? "").includes(needle));
+        return {
+            passed,
+            reason: passed
+                ? `issue #${issue} has a comment containing "${needle}"`
+                : `issue #${issue} has no comment containing "${needle}" (${comments.length} comment(s) scanned)`,
+        };
+    },
+});
+//# sourceMappingURL=check-issues.js.map

package/node_modules/@pome-sh/twin-github/dist/src/check-issues.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-issues.js","sourceRoot":"","sources":["../../src/check-issues.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,oEAAoE;AACpE,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AAExE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG9E,MAAM,CAAC,MAAM,WAAW,GAA2C,WAAW,CAAC;IAC7E,EAAE,EAAE,qBAAqB;IACzB,WAAW,EACT,wFAAwF;QACxF,oFAAoF;QACpF,oFAAoF;QACpF,wFAAwF;IAC1F,QAAQ,EAAE,mCAAmC;IAC7C,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;IAC7C,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;IAC1B,uEAAuE;IACvE,uCAAuC;IACvC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;IACnB,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,gDAAgD;IAChD,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,uBAAuB,CAAC,EAAE,CAAC;IAC9E,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE;QACjC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,KAAK,cAAc,IAAI,EAAE,EAAE,CAAC;IACvE,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAA0D,WAAW,CAAC;IAChG,EAAE,EAAE,oBAAoB;IACxB,WAAW,EACT,0FAA0F;QAC1F,uFAAuF;QACvF,0FAA0F;QAC1F,6EAA6E;IAC/E,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,oBAAoB;IACpB,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,4CAA4C;IAC5C,QAAQ,EAAE,gDAAgD;IAC1D,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;IAChE,SAAS,EAAE,OAAO;IAClB,2EAA2E;IAC3E,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;IACnB,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,oBAAoB;IACpB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI;IACzB,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACxE,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,UAAU,KAAK,iDAAiD;aACzE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO;YACL,MAAM,EAAE,MAAM,KAAK,KAAK;YACxB,MAAM,EAAE,UAAU,KAAK,cAAc,KAAK,CAAC,KAAK,CAAC,KAAK,cAAc,KAAK,IAAI;SAC9E,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAA0D,WAAW,CAAC;IAC9F,EAAE,EAAE,wBAAwB;IAC5B,WAAW,EACT,uFAAuF;QACvF,0FAA0F;QAC1F,0FAA0F;QAC1F,4FAA4F;QAC5F,+CAA+C;IACjD,QAAQ,EAAE,4DAA4D;IACtE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE;IAC/D,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;IAC1B,6EAA6E;IAC7E,wEAAwE;IACxE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK;IAC7B,0EAA0E;IAC1E,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC/D,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9D,OAAO;YACL,MAAM;YACN,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,UAAU,KAAK,eAAe,KAAK,GAAG;gBACxC,CAAC,CAAC,UAAU,KAAK,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,KAAK,GAAG;SAC7E,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAA0D,WAAW,CAAC;IACrG,EAAE,EAAE,gCAAgC;IACpC,WAAW,EACT,wFAAwF;QACxF,0FAA0F;QAC1F,yFAAyF;QACzF,gFAAgF;IAClF,QAAQ,EAAE,sFAAsF;IAChG,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE;IAC/D,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;IAC1B,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK;IAC7B,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC/D,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QACrE,OAAO;YACL,MAAM;YACN,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,UAAU,KAAK,4BAA4B,KAAK,IAAI;gBACtD,CAAC,CAAC,UAAU,KAAK,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,KAAK,GAAG;SAChG,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAA0D,WAAW,CAAC;IAC9F,EAAE,EAAE,uBAAuB;IAC3B,WAAW,EACT,yFAAyF;QACzF,wFAAwF;QACxF,0FAA0F;QAC1F,UAAU;IACZ,QAAQ,EAAE,qDAAqD;IAC/D,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;IACpD,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;IAC1B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;IAC7B,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC/D,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE;QACtB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO;YACL,MAAM;YACN,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,GAAG;gBACvD,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,mBAAmB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,GAAG;SAC5F,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAA2D,WAAW,CAAC;IACtG,EAAE,EAAE,+BAA+B;IACnC,WAAW,EACT,+EAA+E;QAC/E,yFAAyF;QACzF,wFAAwF;QACxF,wFAAwF;QACxF,kEAAkE;IACpE,QAAQ,EAAE,sEAAsE;IAChF,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;IACpE,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;IAC1B,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM;IAC/B,4EAA4E;IAC5E,yEAAyE;IACzE,gEAAgE;IAChE,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAChE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE;QACzC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,OAAO;YACL,MAAM;YACN,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,UAAU,KAAK,8BAA8B,MAAM,GAAG;gBACxD,CAAC,CAAC,UAAU,KAAK,+BAA+B,MAAM,MAAM,QAAQ,CAAC,MAAM,sBAAsB;SACpG,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/node_modules/@pome-sh/twin-github/dist/src/check-kind.d.ts

@@ -0,0 +1,3 @@
+import type { CheckDefinition } from "@pome-sh/sdk/checks";
+import type { GitHubCheckState } from "./check-state.js";
+export type Check<TArgs extends Record<string, string>> = CheckDefinition<GitHubCheckState, TArgs>;

package/node_modules/@pome-sh/twin-github/dist/src/check-kind.js

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The one type every GitHub check declaration is written against (F-1075).
+//
+// It exists so `check-issues.ts`, `check-pulls.ts` and `check-repos.ts` can be
+// separate files without each re-deriving the binding between a declaration and
+// the state tree it reads — and so a declaration that forgets to name
+// `GitHubCheckState` cannot compile.
+export {};
+//# sourceMappingURL=check-kind.js.map

package/node_modules/@pome-sh/twin-github/dist/src/check-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-kind.js","sourceRoot":"","sources":["../../src/check-kind.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,2EAA2E;AAC3E,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,qCAAqC"}

package/node_modules/@pome-sh/twin-github/dist/src/check-params.d.ts

@@ -0,0 +1,12 @@
+import { type CheckParamType } from "@pome-sh/sdk/checks";
+export declare const issueNumber: CheckParamType;
+export declare const prNumber: CheckParamType;
+export declare const labelName: CheckParamType;
+export declare const login: CheckParamType;
+export declare const filePath: CheckParamType;
+export declare const commentNeedle: CheckParamType;
+export declare const statusContext: CheckParamType;
+export declare const issueState: CheckParamType;
+export declare const pullRequestState: CheckParamType;
+export declare const reviewState: CheckParamType;
+export declare const commitStatusState: CheckParamType;

package/node_modules/@pome-sh/twin-github/dist/src/check-params.js

@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The typed slots GitHub's declared checks fill (F-1075).
+//
+// These live in the twin, not the sdk, for the same reason the declarations do:
+// the twin owns what a GitHub label name or a GitHub login may look like. The
+// sdk owns only the grammar — `oneOf`, `repoRef`, and the generator.
+//
+// Every pattern here is NARROW on purpose. A slot type is what turns "the
+// author typed something wrong" into a corrupted instance reported by name,
+// instead of a lookup that quietly finds nothing and fails for an unrelated
+// reason. Widening one to make a sentence bind is almost always the wrong
+// repair — the sentence should be re-rendered from the check instead.
+import { oneOf } from "@pome-sh/sdk/checks";
+// Issue and pull-request numbers. `[1-9][0-9]*` rather than `\d+`: GitHub
+// numbers entities from 1, so `#0` names nothing and `#01` is a different
+// string from the `#1` this check would re-render. Both are corrupted instances
+// worth reporting rather than lookups that silently miss.
+const entityNumber = (name) => ({
+    name,
+    pattern: "[1-9][0-9]*",
+    example: "1",
+    render: (value) => value,
+    parse: (raw) => raw,
+});
+export const issueNumber = entityNumber("issue");
+export const prNumber = entityNumber("pr");
+// Backtick-delimited in every template that uses one, so the only hard
+// exclusion is the backtick itself — a label may legitimately carry spaces,
+// slashes, colons and emoji (`good first issue`, `area/api`, `P0: urgent`).
+// Newline is excluded because a criterion is one line by construction; letting
+// it through would make a malformed multi-line sentence bind.
+export const labelName = {
+    name: "label",
+    pattern: "[^`\\n]+",
+    example: "bug",
+    render: (value) => value,
+    parse: (raw) => raw,
+};
+// A GitHub login: alphanumerics and single hyphens, never leading or trailing.
+// Narrower than `labelName` on purpose — an assignee that fails to parse is
+// almost always a display name where a login was meant, and saying so beats
+// reporting "issue #1 has no such assignee".
+export const login = {
+    name: "login",
+    pattern: "[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?",
+    example: "alice",
+    render: (value) => value,
+    parse: (raw) => raw,
+};
+export const filePath = {
+    name: "path",
+    pattern: "[^`\\n]+",
+    example: "src/index.ts",
+    render: (value) => value,
+    parse: (raw) => raw,
+};
+// Double-quote delimited in its template, so the quote is the exclusion. This
+// is the one slot whose value is SCANNED inside free text rather than compared
+// to a field, which is why its checks declare it as their `subject`.
+export const commentNeedle = {
+    name: "needle",
+    pattern: '[^"\\n]+',
+    example: "Deploy blocked",
+    render: (value) => value,
+    parse: (raw) => raw,
+};
+// A commit status's `context` — GitHub's name for the reporting check
+// ("ci/build", "codecov/patch").
+export const statusContext = {
+    name: "context",
+    pattern: '[^"\\n]+',
+    example: "ci/build",
+    render: (value) => value,
+    parse: (raw) => raw,
+};
+// ── Closed sets ──────────────────────────────────────────────────────────────
+//
+// Each of these was an inline alternation inside a legacy regex, where no
+// authoring surface could read it. As declared param types the set travels with
+// the check: `pome checks github` prints it, the picker offers it, and a value
+// outside it is reported as a corrupted instance.
+//
+// They also cost something, and it is named here rather than discovered later:
+// a closed set has NO value guaranteed to be false, so a check whose only
+// scanned slot is an enum cannot declare a vacuity mutant. See
+// `HONEST_NULL_MUTANTS` in the contract test.
+export const issueState = oneOf("state", ["open", "closed"]);
+// "not merged" first so the set reads in the order an author thinks about it;
+// the generated pattern is anchored, so ordering cannot change what binds.
+export const pullRequestState = oneOf("state", ["merged", "not merged", "open", "closed"]);
+// The API's own review states, and only those. The legacy regex also accepted
+// `REQUEST_CHANGES` (the review *event* verb) and folded it onto
+// `CHANGES_REQUESTED`, because an author typing English could reasonably reach
+// for either. Under a picked check there is nothing to fold: the author selects
+// from this set and the system writes the sentence.
+export const reviewState = oneOf("review", ["APPROVED", "CHANGES_REQUESTED", "COMMENTED"], "APPROVED");
+export const commitStatusState = oneOf("state", ["success", "failure", "pending", "error"], "success");
+//# sourceMappingURL=check-params.js.map

package/node_modules/@pome-sh/twin-github/dist/src/check-params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-params.js","sourceRoot":"","sources":["../../src/check-params.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,sEAAsE;AAEtE,OAAO,EAAE,KAAK,EAAuB,MAAM,qBAAqB,CAAC;AAEjE,0EAA0E;AAC1E,0EAA0E;AAC1E,gFAAgF;AAChF,0DAA0D;AAC1D,MAAM,YAAY,GAAG,CAAC,IAAY,EAAkB,EAAE,CAAC,CAAC;IACtD,IAAI;IACJ,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,GAAG;IACZ,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;AAE3C,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAmB;IACvC,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;CACpB,CAAC;AAEF,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,6CAA6C;AAC7C,MAAM,CAAC,MAAM,KAAK,GAAmB;IACnC,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,+CAA+C;IACxD,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAmB;IACtC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;CACpB,CAAC;AAEF,8EAA8E;AAC9E,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,gBAAgB;IACzB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;CACpB,CAAC;AAEF,sEAAsE;AACtE,iCAAiC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;CACpB,CAAC;AAEF,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,kDAAkD;AAClD,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,+DAA+D;AAC/D,8CAA8C;AAE9C,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE7D,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3F,8EAA8E;AAC9E,iEAAiE;AACjE,+EAA+E;AAC/E,gFAAgF;AAChF,oDAAoD;AACpD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAC9B,QAAQ,EACR,CAAC,UAAU,EAAE,mBAAmB,EAAE,WAAW,CAAC,EAC9C,UAAU,CACX,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CACpC,OAAO,EACP,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAC1C,SAAS,CACV,CAAC"}

package/node_modules/@pome-sh/twin-github/dist/src/check-pulls.d.ts

@@ -0,0 +1,11 @@
+import type { Check } from "./check-kind.js";
+export declare const pullRequestStateCheck: Check<{
+    pr: string;
+    repo: string;
+    state: string;
+}>;
+export declare const pullRequestReviewExists: Check<{
+    review: string;
+    pr: string;
+    repo: string;
+}>;

package/node_modules/@pome-sh/twin-github/dist/src/check-pulls.js

@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// What GitHub's declared checks can assert about a PULL REQUEST (F-1075).
+//
+// Declarations only. The grammar rules they all obey are in `checks.ts`, which
+// assembles them; how the exported tree is read is in `check-state.ts`.
+import { defineCheck, repoRef } from "@pome-sh/sdk/checks";
+import { prNumber, pullRequestState, reviewState } from "./check-params.js";
+import { isMerged, resolvePullRequest } from "./check-state.js";
+export const pullRequestStateCheck = defineCheck({
+    id: "github.pr-state",
+    description: "Reads the pull request's `merged` flag for `merged`/`not merged`, and its `state` column " +
+        "for `open`/`closed`. These are DIFFERENT fields and a PR can be closed without being " +
+        "merged, so the two pairs do not imply each other. Whichever field the sentence turns on " +
+        "must be present: an export missing it is SKIPPED, because defaulting it to false would " +
+        "let `is not merged` pass against a world we cannot see.",
+    template: "Pull request #{pr} in `{repo}` is {state}",
+    params: { pr: prNumber, repo: repoRef, state: pullRequestState },
+    substrate: "final",
+    // Per-arg, and the reason polarity takes the args at all: task 05 asserts
+    // "PR #1 is merged" and "PR #2 is not merged" through this one template.
+    // "open" is the same prohibition as the issue check's.
+    polarity: ({ state }) => (state === "not merged" || state === "open" ? "negative" : "positive"),
+    subject: () => null,
+    // No falsifiable trigger, same shape as issue-state: a closed set with no
+    // guaranteed-false member, and a PR number that only resolves.
+    vacuityMutant: () => null,
+    evaluate({ pr, repo, state }, { final }) {
+        const found = resolvePullRequest(final, repo, pr);
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        const pull = found.found;
+        const onMergeFlag = state === "merged" || state === "not merged";
+        // The field this assertion turns on must be PRESENT. Absent, the safe
+        // default is not `false` — `merged == null` would make "is not merged" pass
+        // against a world we cannot see, which is how a merged impostor PR scores
+        // green. Skip instead, so the criterion leaves the denominator rather than
+        // fabricating a verdict.
+        const turnsOn = onMergeFlag ? pull.merged : pull.state;
+        if (turnsOn == null) {
+            return {
+                passed: false,
+                status: "skipped",
+                reason: `pull request #${pr} has no ${onMergeFlag ? "merged" : "state"} field in state_final (state_incomplete)`,
+            };
+        }
+        // Cite only the field the assertion actually turned on. Printing both
+        // (`state="undefined" merged=false`) presents an absent field as evidence
+        // for a verdict that never read it.
+        if (onMergeFlag) {
+            const merged = isMerged(pull);
+            return {
+                passed: state === "merged" ? merged : !merged,
+                reason: `pull request #${pr}: merged=${merged} (wanted "${state}")`,
+            };
+        }
+        return {
+            passed: pull.state === state,
+            reason: `pull request #${pr}: state="${pull.state}" (wanted "${state}")`,
+        };
+    },
+});
+export const pullRequestReviewExists = defineCheck({
+    id: "github.pr-review-exists",
+    description: "Asserts at least one submitted review on the pull request carries this state. It does " +
+        "not assert who reviewed, how recently, or that no other review disagrees — an APPROVED " +
+        "review alongside a CHANGES_REQUESTED one satisfies both. A pull request whose export " +
+        "carries no reviews section at all is SKIPPED, because absent is not the same as none.",
+    template: "A {review} review exists on pull request #{pr} in `{repo}`",
+    params: { review: reviewState, pr: prNumber, repo: repoRef },
+    substrate: "final",
+    polarity: () => "positive",
+    subject: () => null,
+    // A closed set with no guaranteed-false member, and a PR number that only
+    // resolves. Same reasoning as issue-state.
+    vacuityMutant: () => null,
+    evaluate({ review, pr, repo }, { final }) {
+        const found = resolvePullRequest(final, repo, pr);
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        // Reviews section absent (an older twin snapshot predating review export):
+        // we cannot distinguish "no review" from "not captured", so safe-skip
+        // rather than vacuously failing a correct agent. An empty array is a real
+        // "no reviews" and falls through to failed.
+        if (found.found.reviews == null) {
+            return {
+                passed: false,
+                status: "skipped",
+                reason: `pull request #${pr} has no reviews section in state_final (state_incomplete)`,
+            };
+        }
+        const states = found.found.reviews.map((row) => row.state ?? "");
+        const passed = states.includes(review);
+        return {
+            passed,
+            reason: passed
+                ? `pull request #${pr} has a ${review} review`
+                : `pull request #${pr} reviews are [${states.join(", ")}], missing a ${review} review`,
+        };
+    },
+});
+//# sourceMappingURL=check-pulls.js.map

package/node_modules/@pome-sh/twin-github/dist/src/check-pulls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-pulls.js","sourceRoot":"","sources":["../../src/check-pulls.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AAExE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGhE,MAAM,CAAC,MAAM,qBAAqB,GAAuD,WAAW,CAAC;IACnG,EAAE,EAAE,iBAAiB;IACrB,WAAW,EACT,2FAA2F;QAC3F,uFAAuF;QACvF,0FAA0F;QAC1F,yFAAyF;QACzF,yDAAyD;IAC3D,QAAQ,EAAE,2CAA2C;IACrD,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAChE,SAAS,EAAE,OAAO;IAClB,0EAA0E;IAC1E,yEAAyE;IACzE,uDAAuD;IACvD,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/F,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;IACnB,0EAA0E;IAC1E,+DAA+D;IAC/D,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI;IACzB,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE;QACrC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,MAAM,WAAW,GAAG,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,YAAY,CAAC;QACjE,sEAAsE;QACtE,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yBAAyB;QACzB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QACvD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,iBAAiB,EAAE,WACzB,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAC3B,0CAA0C;aAC3C,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,oCAAoC;QACpC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;gBAC7C,MAAM,EAAE,iBAAiB,EAAE,YAAY,MAAM,aAAa,KAAK,IAAI;aACpE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK,KAAK;YAC5B,MAAM,EAAE,iBAAiB,EAAE,YAAY,IAAI,CAAC,KAAK,cAAc,KAAK,IAAI;SACzE,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAwD,WAAW,CAAC;IACtG,EAAE,EAAE,yBAAyB;IAC7B,WAAW,EACT,wFAAwF;QACxF,yFAAyF;QACzF,uFAAuF;QACvF,uFAAuF;IACzF,QAAQ,EAAE,4DAA4D;IACtE,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE;IAC5D,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;IAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;IACnB,0EAA0E;IAC1E,2CAA2C;IAC3C,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI;IACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE;QACtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,0EAA0E;QAC1E,4CAA4C;QAC5C,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,iBAAiB,EAAE,2DAA2D;aACvF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO;YACL,MAAM;YACN,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,iBAAiB,EAAE,UAAU,MAAM,SAAS;gBAC9C,CAAC,CAAC,iBAAiB,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,MAAM,SAAS;SACzF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/node_modules/@pome-sh/twin-github/dist/src/check-repos.d.ts

@@ -0,0 +1,13 @@
+import type { Check } from "./check-kind.js";
+export declare const noNewLabels: Check<{
+    repo: string;
+}>;
+export declare const fileExists: Check<{
+    path: string;
+    repo: string;
+}>;
+export declare const commitStatus: Check<{
+    context: string;
+    repo: string;
+    state: string;
+}>;

package/node_modules/@pome-sh/twin-github/dist/src/check-repos.js

@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// What GitHub's declared checks can assert about a REPOSITORY (F-1075) —
+// its label set, its files, and the statuses reported against its commits.
+//
+// Declarations only. The grammar rules they all obey are in `checks.ts`, which
+// assembles them; how the exported tree is read is in `check-state.ts`.
+import { defineCheck, repoRef, VACUITY_SENTINEL } from "@pome-sh/sdk/checks";
+import { commitStatusState, filePath, statusContext } from "./check-params.js";
+import { labelNames, resolveRepo } from "./check-state.js";
+export const noNewLabels = defineCheck({
+    id: "github.no-new-labels",
+    // F-1074 — the same explanation the comment below carries, in the one place
+    // an author can actually reach it.
+    description: "Compares the repository's label DEFINITIONS in the seed against the final state. " +
+        "Applying an ALREADY-DEFINED label to an issue PASSES this check — only creating a " +
+        "label the repo did not already define fails it. `addIssueLabels` rejects an undefined " +
+        "label, so an examinee cannot apply a new one without creating it first, which is what " +
+        "makes this tight. Needs the seed: it is a delta, not a state assertion.",
+    // The repo is named on purpose. Without it the sentence reads as an
+    // issue-level claim — "the agent did not add labels to the issue" — which is
+    // WIDER than what this predicate compares. `create_label` is repo-scoped in
+    // GitHub's own vocabulary and `add_issue_labels` is the issue-scoped one, so
+    // naming the repo is what tells a reader which of the two is being asserted.
+    //
+    // An agent that applies an ALREADY-DEFINED label to an issue passes this
+    // check, correctly. The assertion that catches that is
+    // `Issue #N … has exactly one classification label`.
+    template: "No new labels were created in `{repo}`",
+    params: { repo: repoRef },
+    // The whole point: this is a delta, and it is unanswerable without the seed.
+    substrate: "seed+final",
+    // It should PASS on the untouched seed and can only be broken by the
+    // examinee acting.
+    polarity: () => "negative",
+    // Nothing here is a caller-supplied literal hunted for inside the state, so
+    // there is nothing a redactor could silently delete out from under it.
+    subject: () => null,
+    // The repo is a SELECTOR, not a scanned value. Falsifying it would move the
+    // verdict ("repo not found") for a reason that never reaches the assertion —
+    // a clean bill this check did not earn. Reported as `no_trigger`.
+    vacuityMutant: () => null,
+    evaluate({ repo }, { seed, final }) {
+        // The engine guards this before calling; the check guards too, so a
+        // consumer that forgets gets a named skip rather than a vacuous pass.
+        if (seed === null)
+            return { passed: false, reason: "seed_missing", status: "skipped" };
+        const seedRepo = resolveRepo(seed, repo, "the seed state");
+        if ("missing" in seedRepo)
+            return { passed: false, reason: seedRepo.missing };
+        const finalRepo = resolveRepo(final, repo, "state_final");
+        if ("missing" in finalRepo)
+            return { passed: false, reason: finalRepo.missing };
+        const before = labelNames(seedRepo.found);
+        const created = [...labelNames(finalRepo.found)].filter((name) => !before.has(name)).sort();
+        if (created.length === 0) {
+            return {
+                passed: true,
+                reason: `no labels were created in ${repo} (${before.size} defined at seed, unchanged at finish)`,
+            };
+        }
+        return {
+            passed: false,
+            reason: `labels created in ${repo}: ${created.map((name) => `\`${name}\``).join(", ")}`,
+        };
+    },
+});
+export const fileExists = defineCheck({
+    id: "github.file-exists",
+    description: "Asserts a file with this exact path exists in the repository on ANY branch — the twin " +
+        "exports files per branch and this check does not distinguish them, so a file committed " +
+        "only to a side branch satisfies it. The path is compared exactly and case-sensitively; " +
+        "it asserts nothing about the file's contents.",
+    template: "File `{path}` exists in `{repo}`",
+    params: { path: filePath, repo: repoRef },
+    substrate: "final",
+    polarity: () => "positive",
+    subject: ({ path }) => path,
+    // The path IS the scanned literal.
+    vacuityMutant: (args) => ({ ...args, path: `${VACUITY_SENTINEL}.txt` }),
+    evaluate({ path, repo }, { final }) {
+        const found = resolveRepo(final, repo, "state_final");
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        const files = found.found.files ?? [];
+        const passed = files.some((file) => file.path === path);
+        return {
+            passed,
+            reason: passed
+                ? `file exists at "${path}" in ${repo}`
+                : `no file found at "${path}" in ${repo} (${files.length} file(s) exported)`,
+        };
+    },
+});
+export const commitStatus = defineCheck({
+    id: "github.commit-status",
+    description: "Asserts at least one commit status reported under this context carries this state. It " +
+        "does not say WHICH commit: the twin exports every status row for the repo and this " +
+        "check scans them all, so a green status on an old commit satisfies it. Nor does it " +
+        "assert the status is the latest one for that context.",
+    template: 'Commit status "{context}" in `{repo}` is {state}',
+    params: { context: statusContext, repo: repoRef, state: commitStatusState },
+    substrate: "final",
+    polarity: () => "positive",
+    subject: ({ context }) => context,
+    // No falsifiable trigger, and this one is a DELIBERATE loss against the regex
+    // it replaces. The legacy rule mutated the state word, which worked only
+    // because `(\w+)` would accept an invented sentinel. Typing the state as a
+    // closed set is the right call — an author picks from four real values — but
+    // a closed set has no guaranteed-false member, so a mutant could assert a
+    // different state that happens to also be true and report a clean bill this
+    // check did not earn. Mutating the context instead would empty the candidate
+    // set and move the verdict without the state comparison ranging over
+    // anything, which is the same false clean bill one step earlier. `no_trigger`
+    // is the honest answer.
+    vacuityMutant: () => null,
+    evaluate({ context, repo, state }, { final }) {
+        const found = resolveRepo(final, repo, "state_final");
+        if ("missing" in found)
+            return { passed: false, reason: found.missing };
+        const candidates = (found.found.commit_statuses ?? []).filter((row) => row.context === context);
+        const passed = candidates.some((row) => (row.state ?? "").toLowerCase() === state);
+        return {
+            passed,
+            reason: passed
+                ? `commit status "${context}" is "${state}" in ${repo}`
+                : `no commit status "${context}" with state "${state}" in ${repo} ` +
+                    `(found: [${candidates.map((row) => row.state).join(", ")}])`,
+        };
+    },
+});
+//# sourceMappingURL=check-repos.js.map