@outerlayer/cli 0.1.0

package/dist/emit-artifact-cmd-23F4YKQ3.js

@@ -0,0 +1,339 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { staleBuildRefusal, staleBuildWarning, ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, mediaTypeForArtifactPath, inferArtifactKind, resolveRepoIdentity, detectActiveSession, launchRefusalForSession, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, detectCi, appendArtifactTombstone, ARTIFACT_MAX_REPLACES_TARGETS } from './chunk-DEDV5V4U.js';
+import './chunk-YRYMNBGQ.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-RCQXYLMO.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-A6NNKRJU.js';
+import './chunk-IWIUYLDR.js';
+import './chunk-YMTXR7PJ.js';
+import './chunk-ECSYRPCC.js';
+import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+import { createHash, randomUUID } from 'crypto';
+import { statSync, readFileSync, mkdirSync, existsSync, writeFileSync, renameSync, unlinkSync } from 'fs';
+import { resolve, basename, join } from 'path';
+
+createRequire(import.meta.url);
+var ARTIFACT_MAX_BYTES = 8 * 1024 * 1024;
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+var EmitArtifactError = class extends Error {
+};
+var ARTIFACT_ID_PATTERN = /^[A-Za-z0-9_.:-]{1,64}$/;
+function parseReplacesTargets(raw) {
+  const parts = raw.split(",");
+  const targets = [];
+  for (let i = 0; i < parts.length; i += 1) {
+    const id = parts[i];
+    if (id === "") {
+      throw new EmitArtifactError(`invalid --replaces "${raw}" \u2014 entry ${i + 1} is empty`);
+    }
+    if (!ARTIFACT_ID_PATTERN.test(id)) {
+      throw new EmitArtifactError(`invalid --replaces "${raw}" \u2014 "${id}" is not a valid artifact id`);
+    }
+    targets.push(id);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of targets) {
+    if (seen.has(id)) {
+      throw new EmitArtifactError(`invalid --replaces "${raw}" \u2014 "${id}" is named more than once`);
+    }
+    seen.add(id);
+  }
+  if (targets.length > ARTIFACT_MAX_REPLACES_TARGETS) {
+    throw new EmitArtifactError(
+      `invalid --replaces "${raw}" \u2014 names ${targets.length} targets, the cap is ${ARTIFACT_MAX_REPLACES_TARGETS}`
+    );
+  }
+  return targets;
+}
+function replacesSuffix(targets) {
+  if (targets === void 0 || targets.length === 0) return "";
+  if (targets.length === 1) return ` ${DIM}\xB7${RESET} replaces ${targets[0]}`;
+  return ` ${DIM}\xB7${RESET} replaces ${targets.length}: ${targets.join(", ")}`;
+}
+function prNumberFromCiEnv(env) {
+  const refMatch = env.GITHUB_REF?.match(/^refs\/pull\/(\d+)\//);
+  if (refMatch) {
+    const n = parseTrackerNumber(refMatch[1]);
+    if (n !== void 0) return n;
+  }
+  if (env.GITHUB_EVENT_PATH) {
+    try {
+      const event = JSON.parse(readFileSync(env.GITHUB_EVENT_PATH, "utf8"));
+      const n = event.pull_request?.number;
+      if (typeof n === "number") {
+        const parsed = parseTrackerNumber(n);
+        if (parsed !== void 0) return parsed;
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function runEmitArtifact(opts) {
+  const env = opts.env ?? process.env;
+  const refusal = staleBuildRefusal(env);
+  if (refusal) throw new EmitArtifactError(refusal);
+  const stale = staleBuildWarning();
+  if (stale && !opts.quiet) process.stderr.write(`${YELLOW}!${RESET} ${stale}
+`);
+  const cwd = opts.cwd ?? process.cwd();
+  const home = opts.home ?? homeFromEnv(env);
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const caption = opts.caption;
+  if (caption === void 0 || caption === "") {
+    throw new EmitArtifactError(
+      `missing --caption \u2014 say what this artifact proves, e.g. --caption "checkout flow passes"`
+    );
+  }
+  if (caption.length > ARTIFACT_MAX_CAPTION_LENGTH) {
+    throw new EmitArtifactError(
+      `caption is ${caption.length} characters \u2014 the cap is ${ARTIFACT_MAX_CAPTION_LENGTH}`
+    );
+  }
+  if (opts.criterionId !== void 0 && !ArtifactCriterionIdSchema.safeParse(opts.criterionId).success) {
+    throw new EmitArtifactError(
+      `invalid --for "${opts.criterionId}" \u2014 a criterion id is 1-64 characters of letters, digits, "_", ".", ":" or "-" (e.g. LOGIN-01)`
+    );
+  }
+  const criterionId = opts.criterionId;
+  let prNumber;
+  if (opts.pr !== void 0) {
+    if (parseTrackerNumber(opts.pr) === void 0) {
+      throw new EmitArtifactError(trackerNumberError("--pr", opts.pr));
+    }
+    prNumber = opts.pr;
+  }
+  const replacesTargets = opts.replaces !== void 0 ? parseReplacesTargets(opts.replaces) : void 0;
+  const cancelReplacedTargetLocally = (targetId, correctionCarriesReplaces) => {
+    try {
+      appendArtifactTombstone(targetId, home, now);
+    } catch (err) {
+      if (!opts.quiet) {
+        const consequence = correctionCarriesReplaces ? "the correction still names it, so the server supersedes it once both upload" : "it is still queued locally and will upload on the next outerlayer sync \u2014 nothing on the wire links it to this correction";
+        process.stderr.write(
+          `${YELLOW}!${RESET} could not cancel replaced artifact ${targetId} locally: ${String(err)} \u2014 ${consequence}
+`
+        );
+      }
+    }
+  };
+  const filePath = resolve(cwd, opts.file);
+  let stat;
+  try {
+    stat = statSync(filePath);
+  } catch {
+    throw new EmitArtifactError(`no such file: ${opts.file}`);
+  }
+  if (!stat.isFile()) throw new EmitArtifactError(`not a regular file: ${opts.file}`);
+  const bytes = readFileSync(filePath);
+  if (bytes.length > ARTIFACT_MAX_BYTES) {
+    throw new EmitArtifactError(
+      `artifact exceeds 8 MiB (${(bytes.length / (1024 * 1024)).toFixed(1)} MiB) \u2014 the gateway refuses larger uploads`
+    );
+  }
+  const filename = basename(filePath);
+  if (filename.length > ARTIFACT_MAX_FILENAME_LENGTH) {
+    throw new EmitArtifactError(
+      `filename is ${filename.length} characters \u2014 the cap is ${ARTIFACT_MAX_FILENAME_LENGTH}`
+    );
+  }
+  if (replacesTargets !== void 0 && replacesTargets.length > 1) {
+    const { state } = readEffectiveArtifactSpoolState(home);
+    const localIds = localArtifactIds(home);
+    for (const target of replacesTargets) {
+      const entry = state.get(target);
+      if (entry === void 0) {
+        if (localIds.has(target)) {
+          throw new EmitArtifactError(
+            `--replaces "${target}" is still waiting in the local spool \u2014 run \`outerlayer sync\` first, then retry the correction.`
+          );
+        }
+        continue;
+      }
+      if (entry.state === "held" || entry.state === "pending") {
+        throw new EmitArtifactError(
+          `--replaces "${target}" is still waiting in the local spool \u2014 run \`outerlayer sync\` first, then retry the correction.`
+        );
+      }
+      if (entry.state === "dropped" && !entry.reachedServer) {
+        if (isArtifactTombstoned(target, home)) {
+          throw new EmitArtifactError(
+            `--replaces "${target}" has already been dropped locally, or its upload was never confirmed \u2014 run \`outerlayer sync\` first, then retry the correction.`
+          );
+        }
+        throw new EmitArtifactError(
+          `--replaces "${target}" was permanently dropped by an earlier sync and never reached the server \u2014 there is nothing left to sync, so it cannot be named in a correction; drop it from --replaces, or re-emit the original evidence fresh.`
+        );
+      }
+    }
+  }
+  const mediaType = mediaTypeForArtifactPath(filePath);
+  const kind = inferArtifactKind(mediaType);
+  const sha256 = createHash("sha256").update(bytes).digest("hex");
+  const identity = resolveRepoIdentity(cwd);
+  const sessionId = detectActiveSession({
+    env,
+    home,
+    cwds: identity.repoRoot !== void 0 ? [identity.repoRoot, cwd] : [cwd],
+    nowMs: now().getTime()
+  });
+  if (sessionId !== void 0) {
+    const refusal2 = launchRefusalForSession(sessionId, home);
+    if (refusal2 !== void 0) throw new EmitArtifactError(refusal2);
+    mkdirSync(artifactBlobsDir(home), { recursive: true });
+    const blobPath = join(artifactBlobsDir(home), sha256);
+    const blobExisted = existsSync(blobPath);
+    if (!blobExisted) {
+      const tmpPath = join(artifactBlobsDir(home), `.tmp-${randomUUID()}`);
+      writeFileSync(tmpPath, bytes);
+      renameSync(tmpPath, blobPath);
+    }
+    const record = {
+      rec: "artifact",
+      artifactId: randomUUID(),
+      t: now().toISOString(),
+      sessionId,
+      cwd,
+      ...identity.gitRepo !== void 0 ? { gitRepo: identity.gitRepo } : {},
+      ...identity.gitBranch !== void 0 ? { gitBranch: identity.gitBranch } : {},
+      ...identity.commitSha !== void 0 ? { commitSha: identity.commitSha } : {},
+      ...prNumber !== void 0 ? { prNumber } : {},
+      filename,
+      mediaType,
+      bytes: bytes.length,
+      sha256,
+      caption,
+      ...criterionId !== void 0 ? { criterionId } : {},
+      ...replacesTargets !== void 0 ? { replaces: replacesTargets[0] } : {},
+      ...replacesTargets !== void 0 && replacesTargets.length > 1 ? { replacesTargets } : {}
+    };
+    try {
+      appendArtifactRecord(record, home);
+    } catch (err) {
+      if (!blobExisted) {
+        try {
+          unlinkSync(blobPath);
+        } catch {
+        }
+      }
+      throw new EmitArtifactError(
+        `failed to record the artifact in the spool (${artifactsSpoolPath(home)}): ${String(err)} \u2014 the artifact was NOT captured; fix the spool path and re-run`
+      );
+    }
+    if (replacesTargets !== void 0 && replacesTargets.length === 1) {
+      const target = replacesTargets[0];
+      if (findPendingArtifactRecord(target, home) !== void 0) {
+        cancelReplacedTargetLocally(target, true);
+      }
+    }
+    const output2 = opts.json ? JSON.stringify({ spooled: true, record }) : `${GREEN}\u2713${RESET} artifact spooled ${DIM}\xB7${RESET} id ${record.artifactId} ${DIM}\xB7${RESET} ${kind} ${filename} ${DIM}\xB7${RESET} session ${sessionId.slice(0, 8)}${replacesSuffix(replacesTargets)} ${DIM}\xB7${RESET} uploads on the next ${YELLOW}outerlayer sync${RESET}`;
+    if (!opts.quiet) process.stdout.write(output2 + "\n");
+    return { spooled: true, record, output: output2 };
+  }
+  const ci = detectCi(env);
+  const repository = env.GITHUB_REPOSITORY;
+  prNumber ??= prNumberFromCiEnv(env);
+  if (prNumber === void 0 && identity.gitRepo === void 0) {
+    if (identity.repoRoot !== void 0) {
+      throw new EmitArtifactError(
+        "nothing to attach this to \u2014 this checkout has no git remote to identify the repo (and no recorded session or PR). Add a remote (git remote add origin <url>), pass --pr <number>, or run inside a recorded Claude Code session."
+      );
+    }
+    throw new EmitArtifactError(
+      "nothing to attach this to \u2014 no recorded session, no PR, and no git repo. Run inside a recorded Claude Code session, from a git checkout, in CI with PR context, or pass --pr <number>."
+    );
+  }
+  const fileConfig = readCloudConfig(home);
+  const url = opts.url ?? env.OUTERLAYER_URL ?? fileConfig.url;
+  const apiKey = opts.apiKey ?? env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
+  const appId = opts.appId ?? env.OUTERLAYER_APP_ID ?? fileConfig.appId;
+  if (!url || !apiKey || !appId) {
+    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
+    throw new EmitArtifactError(
+      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
+    );
+  }
+  const clientArtifactId = randomUUID();
+  const singleTarget = replacesTargets !== void 0 && replacesTargets.length === 1 ? replacesTargets[0] : void 0;
+  const targetPendingLocally = singleTarget !== void 0 && findPendingArtifactRecord(singleTarget, home) !== void 0;
+  const directTargets = targetPendingLocally ? void 0 : replacesTargets;
+  const request = {
+    schemaVersion: 1,
+    artifact: {
+      clientArtifactId,
+      filename,
+      mediaType,
+      bytes: bytes.length,
+      sha256,
+      caption,
+      ...criterionId !== void 0 ? { criterionId } : {},
+      emittedAt: now().toISOString(),
+      ci,
+      ...prNumber !== void 0 ? { prNumber } : {},
+      ...repository !== void 0 ? { repository } : {},
+      ...identity.gitRepo !== void 0 ? { gitRepo: identity.gitRepo } : {},
+      ...identity.gitBranch !== void 0 ? { gitBranch: identity.gitBranch } : {},
+      ...identity.commitSha !== void 0 ? { commitSha: identity.commitSha } : {},
+      ...directTargets !== void 0 && directTargets.length > 0 ? { replaces: directTargets[0] } : {},
+      ...directTargets !== void 0 && directTargets.length > 1 ? { replacesTargets: directTargets } : {}
+    },
+    blob: { data: bytes.toString("base64") }
+  };
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const endpoint = new URL("/v1/artifacts", url).toString();
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`,
+        "x-outerlayer-app-id": appId
+      },
+      body: JSON.stringify(request)
+    });
+  } catch (err) {
+    throw new EmitArtifactError(`network error reaching ${endpoint}: ${String(err)}`);
+  }
+  if (response.status === 401) {
+    throw new EmitArtifactError(
+      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+    );
+  }
+  if (!response.ok) {
+    let detail = "";
+    try {
+      detail = (await response.text()).replace(/\s+/g, " ").trim().slice(0, 160);
+    } catch {
+    }
+    throw new EmitArtifactError(`artifact upload failed (${response.status})${detail ? `: ${detail}` : ""}`);
+  }
+  if (targetPendingLocally && singleTarget !== void 0) {
+    cancelReplacedTargetLocally(singleTarget, false);
+  }
+  let data = {};
+  try {
+    data = (await response.json()).data ?? {};
+  } catch {
+  }
+  const provenance = typeof data.provenance === "string" ? data.provenance : "unknown";
+  const output = opts.json ? JSON.stringify({
+    ...data,
+    clientArtifactId,
+    // Gated on > 1, matching the wire/spool shape rule (AC-120-03): a
+    // one-element replacesTargets is a shape every schema in this
+    // system rejects (min 2) — `--json` must not hand a consumer a
+    // value that 400s if fed back onto any of those surfaces.
+    ...directTargets !== void 0 && directTargets.length > 1 ? { replacesTargets: directTargets } : {}
+  }) : `${GREEN}\u2713${RESET} artifact accepted ${DIM}\xB7${RESET} id ${clientArtifactId} ${DIM}\xB7${RESET} ${kind} ${filename} ${DIM}\xB7${RESET} provenance ${provenance}` + (prNumber !== void 0 ? ` ${DIM}\xB7${RESET} pr #${prNumber}` : "") + replacesSuffix(directTargets);
+  if (!opts.quiet) process.stdout.write(output + "\n");
+  return { spooled: false, data: { ...data, clientArtifactId }, output };
+}
+
+export { EmitArtifactError, runEmitArtifact };

package/dist/emit-cmd-TWSYYEZI.js

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-KFYJV2ZG.js';
+import './chunk-Z5GEFMRW.js';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
+import { join, dirname, relative, sep } from 'path';
+
+createRequire(import.meta.url);
+var CONTENT_KINDS = /* @__PURE__ */ new Set(["instructions", "skill", "skill-reference", "command", "mcp"]);
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+var NO_CONFIG_MESSAGE = 'no .outerlayer/config.json with a non-empty targets array \u2014 create one, e.g. {"targets": ["claude-code"]}';
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var RED = "\x1B[31m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+var EmitError = class extends Error {
+};
+function resolveTargetsFromConfig(repoRoot) {
+  const configPath = join(repoRoot, ".outerlayer", "config.json");
+  if (!existsSync(configPath)) throw new EmitError(NO_CONFIG_MESSAGE);
+  const raw = readFileSync(configPath, "utf8");
+  const result = parseOuterlayerConfig(raw);
+  if (result.ok) return result.config.targets;
+  if (result.errors.some((e) => e.code === "no_targets")) throw new EmitError(NO_CONFIG_MESSAGE);
+  const detail = result.errors.map((e) => `${e.path}: ${e.message}`).join("; ");
+  throw new EmitError(`invalid .outerlayer/config.json \u2014 ${detail}`);
+}
+function toRepoRelative(repoRoot, absPath) {
+  return normalizePath(relative(repoRoot, absPath).split(sep).join("/"));
+}
+function discoverOuterlayerPaths(repoRoot) {
+  const out = [];
+  walk(repoRoot, repoRoot, false, out);
+  return out.sort();
+}
+function walk(dir, repoRoot, insideOuterlayer, out) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!insideOuterlayer && SKIP_DIRS.has(entry.name)) continue;
+      if (!insideOuterlayer && existsSync(join(full, CONTEXT_PIN_FILENAME))) continue;
+      walk(full, repoRoot, insideOuterlayer || entry.name === ".outerlayer", out);
+    } else if (entry.isFile() && insideOuterlayer) {
+      out.push(toRepoRelative(repoRoot, full));
+    }
+  }
+}
+function buildEmitInput(repoRoot, targets) {
+  const discovered = discoverOuterlayerPaths(repoRoot);
+  const { entries } = classifyTree(discovered);
+  const classified = new Set(entries.map((e) => e.path));
+  const contents = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (!CONTENT_KINDS.has(entry.kind)) continue;
+    contents.set(entry.path, readFileSync(join(repoRoot, entry.path), "utf8"));
+  }
+  const assetPaths = discovered.filter((p) => !classified.has(p));
+  return { input: { entries, contents, assetPaths, targets }, sourcePaths: classified };
+}
+function writeOutputs(repoRoot, result) {
+  const files = [];
+  for (const file of result.files) {
+    const abs = join(repoRoot, file.path);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, file.content);
+    files.push(file.path);
+  }
+  const copies = [];
+  for (const copy of result.copies) {
+    const abs = join(repoRoot, copy.toPath);
+    mkdirSync(dirname(abs), { recursive: true });
+    copyFileSync(join(repoRoot, copy.fromSourcePath), abs);
+    copies.push(copy.toPath);
+  }
+  return { files, copies };
+}
+function renderSuccess(targets, files, copies) {
+  const copySuffix = copies.length > 0 ? `, ${copies.length} ${copies.length === 1 ? "copy" : "copies"}` : "";
+  return `${GREEN}\u2713${RESET} emitted ${files.length} file${files.length === 1 ? "" : "s"}${copySuffix} for ${DIM}${targets.join(", ")}${RESET}`;
+}
+function renderFailure(errors) {
+  const lines = [`${RED}\u2717${RESET} emit failed \u2014 nothing written`];
+  for (const e of errors) lines.push(`  ${RED}\u2717${RESET} ${e.path}: ${e.message}`);
+  return lines.join("\n");
+}
+function renderCheck(targets, drift) {
+  if (drift.length === 0) return `${GREEN}\u2713${RESET} up to date for ${DIM}${targets.join(", ")}${RESET}`;
+  const lines = [`${RED}\u2717${RESET} drift detected (${drift.length}) \u2014 run \`outerlayer emit\` to update`];
+  for (const d of drift) lines.push(`  ${RED}\u2717${RESET} ${d.kind.padEnd(8)} ${d.path}`);
+  return lines.join("\n");
+}
+function compareFile(repoRoot, path, expectedContent) {
+  const abs = join(repoRoot, path);
+  if (!existsSync(abs)) return { kind: "missing", path };
+  if (readFileSync(abs, "utf8") !== expectedContent) return { kind: "content", path };
+  return void 0;
+}
+function compareCopy(repoRoot, copy) {
+  const abs = join(repoRoot, copy.toPath);
+  if (!existsSync(abs)) return { kind: "missing", path: copy.toPath };
+  if (!readFileSync(abs).equals(readFileSync(join(repoRoot, copy.fromSourcePath)))) {
+    return { kind: "content", path: copy.toPath };
+  }
+  return void 0;
+}
+function discoverAllFiles(repoRoot) {
+  const out = [];
+  walkAll(repoRoot, repoRoot, out);
+  return out;
+}
+function walkAll(dir, repoRoot, out) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name) || entry.name === ".outerlayer") continue;
+      walkAll(full, repoRoot, out);
+    } else if (entry.isFile()) {
+      out.push(toRepoRelative(repoRoot, full));
+    }
+  }
+}
+function findOrphans(repoRoot, computedFiles, sourcePaths) {
+  const orphans = [];
+  for (const path of discoverAllFiles(repoRoot)) {
+    if (computedFiles.has(path)) continue;
+    let content;
+    try {
+      content = readFileSync(join(repoRoot, path), "utf8");
+    } catch {
+      continue;
+    }
+    const sourcePath = generatedHeaderSource(content);
+    if (sourcePath === null) continue;
+    if (!sourcePaths.has(sourcePath)) orphans.push({ kind: "orphaned", path });
+  }
+  return orphans;
+}
+function runEmit(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (!existsSync(cwd)) throw new EmitError(`no such directory: ${cwd}`);
+  const targets = resolveTargetsFromConfig(cwd);
+  const built = buildEmitInput(cwd, targets);
+  const result = emitTree(built.input);
+  const hasErrors = result.errors.length > 0;
+  if (opts.check) return runCheck(cwd, opts, targets, result, hasErrors, built.sourcePaths);
+  const written = hasErrors ? { files: [], copies: [] } : writeOutputs(cwd, result);
+  const exitCode = hasErrors ? 1 : 0;
+  const output = opts.json ? JSON.stringify({ targets, files: written.files, copies: written.copies, warnings: result.warnings, errors: result.errors }) : hasErrors ? renderFailure(result.errors) : renderSuccess(targets, written.files, written.copies);
+  if (!opts.quiet) {
+    if (opts.json) {
+      process.stdout.write(output + "\n");
+    } else if (hasErrors) {
+      process.stderr.write(output + "\n");
+    } else {
+      process.stdout.write(output + "\n");
+      for (const w of result.warnings) process.stderr.write(`  ${YELLOW}!${RESET} ${w.path}: ${w.message}
+`);
+    }
+  }
+  return { targets, files: written.files, copies: written.copies, warnings: result.warnings, errors: result.errors, output, exitCode };
+}
+function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths) {
+  const drift = [];
+  if (!hasErrors) {
+    const computedFiles = new Set(result.files.map((f) => f.path));
+    for (const file of result.files) {
+      const d = compareFile(cwd, file.path, file.content);
+      if (d) drift.push(d);
+    }
+    for (const copy of result.copies) {
+      const d = compareCopy(cwd, copy);
+      if (d) drift.push(d);
+    }
+    drift.push(...findOrphans(cwd, computedFiles, sourcePaths));
+    drift.sort((a, b) => a.path.localeCompare(b.path) || a.kind.localeCompare(b.kind));
+  }
+  const exitCode = hasErrors || drift.length > 0 ? 1 : 0;
+  const output = opts.json ? JSON.stringify({ targets, drift, warnings: result.warnings, errors: result.errors }) : hasErrors ? renderFailure(result.errors) : renderCheck(targets, drift);
+  if (!opts.quiet) {
+    if (opts.json) {
+      process.stdout.write(output + "\n");
+    } else if (hasErrors || drift.length > 0) {
+      process.stderr.write(output + "\n");
+    } else {
+      process.stdout.write(output + "\n");
+      for (const w of result.warnings) process.stderr.write(`  ${YELLOW}!${RESET} ${w.path}: ${w.message}
+`);
+    }
+  }
+  return { targets, files: [], copies: [], warnings: result.warnings, errors: result.errors, drift, output, exitCode };
+}
+
+export { EmitError, runEmit };

package/dist/emit-commit-credit-cmd-2GX5M2BR.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { resolveRepoIdentity, emitLaunchRefusal } from './chunk-DEDV5V4U.js';
+import './chunk-YRYMNBGQ.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-RCQXYLMO.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-A6NNKRJU.js';
+import './chunk-IWIUYLDR.js';
+import './chunk-YMTXR7PJ.js';
+import './chunk-ECSYRPCC.js';
+import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);
+
+// src/emit-commit-credit-cmd.ts
+var GREEN = "\x1B[32m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+var FULL_SHA = /^[0-9a-f]{40}$/i;
+var EmitCommitCreditError = class extends Error {
+};
+async function runEmitCommitCredit(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const home = opts.home ?? homeFromEnv();
+  const env = opts.env ?? process.env;
+  const shaInput = opts.sha ?? "";
+  if (!FULL_SHA.test(shaInput)) {
+    throw new EmitCommitCreditError(
+      `invalid --sha "${opts.sha ?? ""}" \u2014 expected a full 40-character hex SHA (git's abbreviated form isn't enough)`
+    );
+  }
+  const sha = shaInput.toLowerCase();
+  if (opts.pr === void 0) {
+    throw new EmitCommitCreditError("--pr is required \u2014 an attestation carries its PR anchor at emit time");
+  }
+  const prNumber = parseTrackerNumber(opts.pr);
+  if (prNumber === void 0) {
+    throw new EmitCommitCreditError(trackerNumberError("--pr", opts.pr));
+  }
+  const identity = resolveRepoIdentity(cwd);
+  const repository = env.GITHUB_REPOSITORY;
+  const gitRepo = repository === void 0 ? identity.gitRepo : void 0;
+  if (repository === void 0 && gitRepo === void 0) {
+    throw new EmitCommitCreditError(
+      "nothing to attach this to \u2014 no repository. Run in CI (GITHUB_REPOSITORY) or from a git checkout with a remote."
+    );
+  }
+  const refusal = emitLaunchRefusal({
+    env,
+    home,
+    cwds: identity.repoRoot !== void 0 ? [identity.repoRoot, cwd] : [cwd],
+    nowMs: Date.now()
+  });
+  if (refusal !== void 0) throw new EmitCommitCreditError(refusal);
+  const fileConfig = readCloudConfig(home);
+  const url = opts.url ?? env.OUTERLAYER_URL ?? fileConfig.url;
+  const apiKey = opts.apiKey ?? env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
+  const appId = opts.appId ?? env.OUTERLAYER_APP_ID ?? fileConfig.appId;
+  if (!url || !apiKey || !appId) {
+    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
+    throw new EmitCommitCreditError(
+      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
+    );
+  }
+  const request = {
+    schemaVersion: 1,
+    commitCredit: {
+      sha,
+      prNumber,
+      ...repository !== void 0 ? { repository } : {},
+      ...gitRepo !== void 0 ? { gitRepo } : {}
+    }
+  };
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  let endpoint;
+  try {
+    endpoint = new URL("/v1/commit-credit", url).toString();
+  } catch {
+    throw new EmitCommitCreditError(`invalid --url "${url}" \u2014 not a URL`);
+  }
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`,
+        "x-outerlayer-app-id": appId
+      },
+      body: JSON.stringify(request)
+    });
+  } catch (err) {
+    throw new EmitCommitCreditError(`network error reaching ${endpoint}: ${String(err)}`);
+  }
+  if (response.status === 401) {
+    throw new EmitCommitCreditError(
+      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+    );
+  }
+  if (!response.ok) {
+    let detail = "";
+    try {
+      detail = (await response.text()).replace(/\s+/g, " ").trim().slice(0, 160);
+    } catch {
+    }
+    throw new EmitCommitCreditError(`commit-credit emit failed (${response.status})${detail ? `: ${detail}` : ""}`);
+  }
+  let data = {};
+  try {
+    data = (await response.json()).data ?? {};
+  } catch {
+  }
+  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} attested ${sha.slice(0, 7)} ${DIM}\xB7${RESET} PR #${prNumber}
+${DIM}(if this PR was decided more than a few hours ago, its comment is frozen and won't re-render)${RESET}`;
+  if (!opts.quiet) process.stdout.write(output + "\n");
+  return { data, output, exitCode: 0 };
+}
+
+export { EmitCommitCreditError, runEmitCommitCredit };