@outerlayer/cli 0.1.1 → 0.4.0

package/dist/{emit-artifact-cmd-KPPD3YLO.js → emit-artifact-cmd-KTYW2TN2.js}

@@ -1,14 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, mediaTypeForArtifactPath, inferArtifactKind, resolveRepoIdentity, detectActiveSession, launchRefusalForSession, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, detectCi, appendArtifactTombstone, ARTIFACT_MAX_REPLACES_TARGETS } from './chunk-BQB3U2VD.js';
+import { staleBuildRefusal, staleBuildWarning } from './chunk-3YPKXE5L.js';
+import { detectCi } from './chunk-HE2D4EY5.js';
+import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import './chunk-TBT347UY.js';
+import './chunk-F7CU5ABH.js';
+import './chunk-BKO6JEZI.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, appendArtifactTombstone } from './chunk-6Y63SXFO.js';
+import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, resolveRepoIdentity, ARTIFACT_MAX_REPLACES_TARGETS } from './chunk-G7FSV7JX.js';
 import './chunk-YRYMNBGQ.js';
-import { parseTrackerNumber, trackerNumberError } from './chunk-RCQXYLMO.js';
+import './chunk-DVDEBNQJ.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import './chunk-5QRP3MVS.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-3VQ4XXQA.js';
-import './chunk-IWIUYLDR.js';
-import './chunk-YOOSBOKS.js';
-import './chunk-R5KBGVII.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-UFFXNXLQ.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { createHash, randomUUID } from 'crypto';
@@ -249,16 +262,9 @@ async function runEmitArtifact(opts) {
       "nothing to attach this to \u2014 no recorded session, no PR, and no git repo. Run inside a recorded Claude Code session, from a git checkout, in CI with PR context, or pass --pr <number>."
     );
   }
-  const fileConfig = readCloudConfig(home);
-  const url = opts.url ?? env.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? env.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
-    throw new EmitArtifactError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
-    );
-  }
+  const resolved = resolveGatewayCredentials({ ...opts, home, env });
+  if (!resolved.ok) throw new EmitArtifactError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
   const clientArtifactId = randomUUID();
   const singleTarget = replacesTargets !== void 0 && replacesTargets.length === 1 ? replacesTargets[0] : void 0;
   const targetPendingLocally = singleTarget !== void 0 && findPendingArtifactRecord(singleTarget, home) !== void 0;
@@ -285,7 +291,7 @@ async function runEmitArtifact(opts) {
     },
     blob: { data: bytes.toString("base64") }
   };
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const endpoint = new URL("/v1/artifacts", url).toString();
   let response;
   try {
@@ -303,7 +309,7 @@ async function runEmitArtifact(opts) {
   }
   if (response.status === 401) {
     throw new EmitArtifactError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+      unauthorizedMessage(apiKey)
     );
   }
   if (!response.ok) {

package/dist/emit-cmd-DCERAU27.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { EmitError, runEmit } from './chunk-H5NCNVDA.js';
+import './chunk-WO2BXCTQ.js';
+import './chunk-EMY4I27X.js';
+import './chunk-RA3O54FC.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/emit-criteria-cmd-VAUUSAYD.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { resolveRepoIdentity, CriteriaListSchema } from './chunk-G7FSV7JX.js';
+import { launchedItemForSession } from './chunk-DVDEBNQJ.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-BJ3KTMDH.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+import { readFileSync } from 'fs';
+
+createRequire(import.meta.url);
+var GREEN = "\x1B[32m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+var EmitCriteriaError = class extends Error {
+};
+var REPLACE_REFUSED_MESSAGE = "this item already has a recorded list, and a person must replace it. Run the command yourself, outside the session, with your own login. A repository's .outerlayer/policy.yaml can let sessions replace it with `criteria: { replace: anyone }`.";
+async function readAllStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf8");
+}
+function valueAt(raw, path) {
+  let current = raw;
+  for (const key of path) current = current?.[key];
+  return current;
+}
+function describeIssue(raw, issue) {
+  const where = issue.path.join(".");
+  if (issue.code === "custom") return `${where}: ${issue.message}`;
+  const value = valueAt(raw, issue.path);
+  const leaf = issue.path[issue.path.length - 1];
+  if ((leaf === "id" || leaf === "proof") && value !== void 0) {
+    return `${where}: ${JSON.stringify(value)} is not accepted (${issue.message})`;
+  }
+  return `${where}: ${issue.message}`;
+}
+function parseFile(raw) {
+  const parsed = CriteriaListSchema.safeParse(raw);
+  if (parsed.success) return parsed.data;
+  const issue = parsed.error.issues[0];
+  throw new EmitCriteriaError(
+    `invalid criteria list \u2014 ${issue ? describeIssue(raw, issue) : "malformed"}`
+  );
+}
+function resolveTarget(opts) {
+  let item;
+  if (opts.item !== void 0) {
+    const number = parseTrackerNumber(opts.item);
+    if (number === void 0) throw new EmitCriteriaError(trackerNumberError("--item", opts.item));
+    item = { number };
+  }
+  const { sessionId } = opts;
+  if (sessionId !== void 0) {
+    const refusal = launchRefusalForSession(sessionId, opts.home);
+    if (refusal !== void 0) throw new EmitCriteriaError(refusal);
+  }
+  if (item !== void 0) return sessionId !== void 0 ? { item, sessionId } : { item };
+  if (sessionId === void 0) {
+    throw new EmitCriteriaError(
+      "nothing to record this on \u2014 no work item. Pass --item <number>, or run inside a recorded session launched with OUTERLAYER_WORK \u2014 its own launch record names the item automatically."
+    );
+  }
+  const launched = launchedItemForSession(sessionId, opts.home);
+  if (launched === void 0) {
+    throw new EmitCriteriaError(
+      "nothing to record this on \u2014 no work item. Pass --item <number>; this recorded session's own launch record names no item either."
+    );
+  }
+  return { item: { number: launched }, sessionId };
+}
+async function errorCode(response) {
+  let text = "";
+  try {
+    text = await response.text();
+  } catch {
+  }
+  let code = null;
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed.error?.code === "string") code = parsed.error.code;
+  } catch {
+  }
+  return { code, detail: text.replace(/\s+/g, " ").trim().slice(0, 160) };
+}
+async function runEmitCriteria(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const home = opts.home ?? homeFromEnv();
+  const env = opts.env ?? process.env;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  let text;
+  if (opts.file === "-") {
+    text = await (opts.readStdin ?? readAllStdin)();
+  } else {
+    try {
+      text = readFileSync(opts.file, "utf8");
+    } catch (err) {
+      throw new EmitCriteriaError(`cannot read "${opts.file}": ${String(err)}`);
+    }
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    throw new EmitCriteriaError(`"${opts.file}" is not valid JSON: ${String(err)}`);
+  }
+  const list = parseFile(raw);
+  const identity = resolveRepoIdentity(cwd);
+  const sessionId = detectActiveSession({
+    env,
+    home,
+    cwds: identity.repoRoot !== void 0 ? [identity.repoRoot, cwd] : [cwd],
+    nowMs: now().getTime()
+  });
+  const target = resolveTarget({ item: opts.item, sessionId, home });
+  const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, cwd, home, env });
+  if (!resolved.ok) throw new EmitCriteriaError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
+  const request = {
+    ...list,
+    item: target.item,
+    ...target.sessionId !== void 0 ? { sessionId: target.sessionId } : {}
+  };
+  const endpoint = new URL("/v1/criteria", url).toString();
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`,
+        "x-outerlayer-app-id": appId
+      },
+      body: JSON.stringify(request)
+    });
+  } catch (err) {
+    throw new EmitCriteriaError(`network error reaching ${endpoint}: ${String(err)}`);
+  }
+  if (response.status === 401) throw new EmitCriteriaError(unauthorizedMessage(apiKey));
+  if (!response.ok) {
+    const { code, detail } = await errorCode(response);
+    if (response.status === 409 && code === "criteria_replace_refused") {
+      throw new EmitCriteriaError(`refused (409): ${REPLACE_REFUSED_MESSAGE}`);
+    }
+    throw new EmitCriteriaError(`emit failed (${response.status})${detail ? `: ${detail}` : ""}`);
+  }
+  let data = {};
+  try {
+    data = (await response.json()).data ?? {};
+  } catch {
+  }
+  const count = typeof data.count === "number" ? data.count : list.criteria.length;
+  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} recorded ${count} ${count === 1 ? "criterion" : "criteria"} ${DIM}\xB7${RESET} item #${target.item.number}`;
+  if (!opts.quiet) process.stdout.write(output + "\n");
+  return { data, output, exitCode: 0 };
+}
+
+export { EmitCriteriaError, runEmitCriteria };

package/dist/{emit-finding-cmd-VR5VEGXJ.js → emit-finding-cmd-UR4ID45Z.js}

@@ -1,14 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { FindingBatchSchema, resolveRepoIdentity, detectActiveSession, launchRefusalForSession } from './chunk-BQB3U2VD.js';
-import './chunk-YRYMNBGQ.js';
-import { launchedItemForSession, parseTrackerNumber, trackerNumberError } from './chunk-RCQXYLMO.js';
+import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { FindingBatchSchema, resolveRepoIdentity } from './chunk-G7FSV7JX.js';
+import { launchedItemForSession } from './chunk-DVDEBNQJ.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
-import './chunk-3VQ4XXQA.js';
-import './chunk-IWIUYLDR.js';
-import './chunk-YOOSBOKS.js';
-import './chunk-R5KBGVII.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
@@ -19,6 +22,14 @@ var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
 var EmitFindingError = class extends Error {
 };
+var REMOVED_FINDING_FLAGS = ["subject", "kind", "severity", "verdict", "fixed", "source"];
+function refuseRemovedFindingFlags(opts) {
+  const used = REMOVED_FINDING_FLAGS.find((flag) => opts[flag] !== void 0);
+  if (used === void 0) return;
+  throw new EmitFindingError(
+    `--${used} is no longer accepted: findings record problems in the factory, not review verdicts. Pass --category <context|flaky-test|tooling|environment|defect|other> instead.`
+  );
+}
 function parseItemFlag(raw) {
   if (raw === void 0) return void 0;
   const number = parseTrackerNumber(raw);
@@ -48,23 +59,19 @@ function recordFromFlags(opts) {
   const ruleLine = parseIntFlag(opts.ruleLine, "--rule-line", { min: 1 });
   const turnIndex = parseIntFlag(opts.turn, "--turn", { min: 0 });
   const round = parseIntFlag(opts.round, "--round", { min: 0 });
+  const hasRule = opts.rulePath !== void 0 || opts.ruleQuote !== void 0 || opts.ruleRelation !== void 0 || ruleLine !== void 0;
   return {
     id: opts.id,
-    subject: opts.subject,
+    category: opts.category,
     title: opts.title,
     file: opts.file,
     line: line ?? null,
-    severity: opts.severity ?? null,
-    kind: opts.kind,
-    verdict: opts.verdict,
-    fixed: opts.fixed ?? false,
-    rule: opts.rulePath !== void 0 ? {
+    rule: hasRule ? {
       path: opts.rulePath,
       line: ruleLine ?? null,
-      quote: opts.ruleQuote ?? "",
+      ...opts.ruleQuote !== void 0 ? { quote: opts.ruleQuote } : {},
       relation: opts.ruleRelation
     } : null,
-    source: opts.source,
     where: {
       label: opts.where,
       ...opts.traceId !== void 0 ? { traceId: opts.traceId } : {},
@@ -110,22 +117,15 @@ function resolveUploadTarget(opts) {
   return { item: { number: launchedNumber }, sessionId };
 }
 async function upload(batch, target, opts) {
-  const fileConfig = readCloudConfig(opts.home);
-  const url = opts.url ?? opts.env.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? opts.env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? opts.env.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
-    throw new EmitFindingError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
-    );
-  }
+  const resolved = resolveGatewayCredentials(opts);
+  if (!resolved.ok) throw new EmitFindingError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
   const request = {
     ...batch,
     item: target.item,
     ...target.sessionId !== void 0 ? { sessionId: target.sessionId } : {}
   };
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const endpoint = new URL("/v1/findings", url).toString();
   let response;
   try {
@@ -143,7 +143,7 @@ async function upload(batch, target, opts) {
   }
   if (response.status === 401) {
     throw new EmitFindingError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+      unauthorizedMessage(apiKey)
     );
   }
   if (!response.ok) {
@@ -172,7 +172,7 @@ async function runEmitFinding(opts) {
   const sessionId = detectUploadSessionId({ cwd, home, env, now });
   const contextSourceSha = opts.contextSourceSha ?? (sessionId !== void 0 ? readLatestProvenanceForSession(sessionId, home)?.sha ?? void 0 : void 0);
   const rawBatch = {
-    schemaVersion: 1,
+    schemaVersion: 2,
     ...opts.headSha !== void 0 ? { headSha: opts.headSha } : {},
     ...contextSourceSha !== void 0 ? { contextSourceSha } : {},
     findings: [recordFromFlags(opts)]
@@ -214,6 +214,11 @@ async function runEmitFindings(opts) {
   } catch (err) {
     throw new EmitFindingError(`"${opts.file}" is not valid JSON: ${String(err)}`);
   }
+  if (typeof raw === "object" && raw !== null && raw.schemaVersion === 1) {
+    throw new EmitFindingError(
+      `"${opts.file}" uses schemaVersion 1, which is no longer accepted. Use schemaVersion 2: each finding takes a category (context, flaky-test, tooling, environment, defect or other) in place of subject, kind, severity, verdict, fixed and source.`
+    );
+  }
   const parsed = FindingBatchSchema.safeParse(raw);
   if (!parsed.success) {
     throw new EmitFindingError(`invalid finding batch \u2014 ${firstIssueMessage(parsed)}`);
@@ -232,4 +237,4 @@ async function runEmitFindings(opts) {
   });
 }
 
-export { EmitFindingError, runEmitFinding, runEmitFindings };
+export { EmitFindingError, refuseRemovedFindingFlags, runEmitFinding, runEmitFindings };

package/dist/{emit-result-cmd-YOA5BJKL.js → emit-result-cmd-FDTUKGKE.js}

@@ -1,14 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EmittedNameSchema, ARTIFACT_REVIEW_CHECK_NAME, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, resolveRepoIdentity, detectActiveSession, launchRefusalForSession, detectCi } from './chunk-BQB3U2VD.js';
+import './chunk-3YPKXE5L.js';
+import { detectCi } from './chunk-HE2D4EY5.js';
+import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import './chunk-TBT347UY.js';
+import './chunk-F7CU5ABH.js';
+import './chunk-BKO6JEZI.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import './chunk-6Y63SXFO.js';
+import { EmittedNameSchema, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, resolveRepoIdentity } from './chunk-G7FSV7JX.js';
 import './chunk-YRYMNBGQ.js';
-import { parseTrackerNumber, trackerNumberError } from './chunk-RCQXYLMO.js';
+import './chunk-DVDEBNQJ.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import './chunk-5QRP3MVS.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-3VQ4XXQA.js';
-import './chunk-IWIUYLDR.js';
-import './chunk-YOOSBOKS.js';
-import './chunk-R5KBGVII.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-UFFXNXLQ.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { randomUUID } from 'crypto';
@@ -51,23 +64,7 @@ async function runEmitResult(opts) {
       `invalid name "${opts.name}" \u2014 an emit name is 1-64 characters: a lowercase letter followed by lowercase letters, digits, ".", "_" or "-" (e.g. smoke.pass)`
     );
   }
-  const isArtifactReview = opts.name === ARTIFACT_REVIEW_CHECK_NAME;
-  const artifactId = opts.artifact === "" ? void 0 : opts.artifact;
-  if (isArtifactReview) {
-    if (artifactId === void 0) {
-      throw new EmitResultError(
-        `--artifact <id> is required for ${ARTIFACT_REVIEW_CHECK_NAME} \u2014 it names which artifact this verdict is on`
-      );
-    }
-  } else if (artifactId !== void 0) {
-    throw new EmitResultError(`--artifact is only accepted with ${ARTIFACT_REVIEW_CHECK_NAME}`);
-  }
   const link = opts.link === "" ? void 0 : opts.link;
-  if (isArtifactReview && link !== void 0) {
-    throw new EmitResultError(
-      `--link is refused for ${ARTIFACT_REVIEW_CHECK_NAME} \u2014 an artifact verdict is a judgment on evidence already on file, never a run to point at; pass --body / --body-file instead`
-    );
-  }
   if (link !== void 0) {
     if (!link.startsWith("http://") && !link.startsWith("https://")) {
       throw new EmitResultError(`invalid --link "${link}" \u2014 expected an http:// or https:// URL`);
@@ -98,8 +95,6 @@ async function runEmitResult(opts) {
     body = opts.body;
   } else if (opts.bodyFile !== void 0) {
     body = await readBodyFile(opts.bodyFile, opts.readStdin);
-  } else if (isArtifactReview && result === "fail") {
-    body = await (opts.readStdin ?? readAllStdin)();
   }
   if (body !== void 0) {
     body = body.trim();
@@ -114,13 +109,7 @@ async function runEmitResult(opts) {
       );
     }
   }
-  if (isArtifactReview) {
-    if (result === "fail" && body === void 0) {
-      throw new EmitResultError(
-        `a failing artifact verdict needs a sentence \u2014 pass --body or --body-file with one sentence saying what is wrong`
-      );
-    }
-  } else if (result === "fail" && link === void 0 && body === void 0) {
+  if (result === "fail" && link === void 0 && body === void 0) {
     throw new EmitResultError(
       `a failing check needs something to act on \u2014 pass --link with the run URL, or --body / --body-file with one sentence saying what is wrong`
     );
@@ -133,37 +122,23 @@ async function runEmitResult(opts) {
     cwds: identity.repoRoot !== void 0 ? [identity.repoRoot, cwd] : [cwd],
     nowMs: now().getTime()
   });
-  if (isArtifactReview && sessionId !== void 0) {
+  if (item === void 0 && sessionId === void 0) {
     throw new EmitResultError(
-      "an artifact verdict is a person's act \u2014 record it with a person's API key, outside a recorded session."
+      "nothing to attach this to \u2014 no work item. Pass --item <number>; a recorded session alone does not name one."
     );
   }
-  if (!isArtifactReview) {
-    if (item === void 0 && sessionId === void 0) {
-      throw new EmitResultError(
-        "nothing to attach this to \u2014 no work item. Pass --item <number>; a recorded session alone does not name one, and a session with no --item is always refused as self-judgment."
-      );
-    }
-    if (sessionId !== void 0) {
-      const refusal = launchRefusalForSession(sessionId, home);
-      if (refusal !== void 0) throw new EmitResultError(refusal);
-    }
-    if (item === void 0 && sessionId !== void 0) {
-      throw new EmitResultError(
-        "a session records a check only on a work item it was not launched for, named with --item \u2014 the item this session was launched for needs a machine key (an API key run outside the recorded session) or CI."
-      );
-    }
+  if (sessionId !== void 0) {
+    const refusal = launchRefusalForSession(sessionId, home);
+    if (refusal !== void 0) throw new EmitResultError(refusal);
   }
-  const fileConfig = readCloudConfig(home);
-  const url = opts.url ?? env.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? env.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
+  if (item === void 0) {
     throw new EmitResultError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
+      "nothing to attach this to \u2014 no work item. Pass --item <number>; a recorded session alone does not name one."
     );
   }
+  const resolved = resolveGatewayCredentials({ ...opts, home, env });
+  if (!resolved.ok) throw new EmitResultError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
   const ci = detectCi(env);
   const request = {
     schemaVersion: 1,
@@ -176,11 +151,10 @@ async function runEmitResult(opts) {
       emittedAt: now().toISOString(),
       ...ci ? { ci: true } : {},
       ...sessionId !== void 0 ? { sessionId } : {},
-      ...item !== void 0 ? { item } : {},
-      ...isArtifactReview ? { artifactId } : {}
+      ...item !== void 0 ? { item } : {}
     }
   };
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const endpoint = new URL("/v1/emitted-results", url).toString();
   let response;
   try {
@@ -198,7 +172,7 @@ async function runEmitResult(opts) {
   }
   if (response.status === 401) {
     throw new EmitResultError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+      unauthorizedMessage(apiKey)
     );
   }
   if (!response.ok) {
@@ -214,7 +188,7 @@ async function runEmitResult(opts) {
     data = (await response.json()).data ?? {};
   } catch {
   }
-  const anchorLabel = isArtifactReview ? `artifact ${artifactId}` : `item #${item.number}`;
+  const anchorLabel = `item #${item.number}`;
   const recordedId = typeof data.id === "string" ? data.id : "";
   const idSuffix = recordedId ? ` ${DIM}\xB7${RESET} ${recordedId}` : "";
   const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} emitted ${opts.name} (${result}) ${DIM}\xB7${RESET} ${anchorLabel}${idSuffix}`;

package/dist/exec-client-4XGXV3XN.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { CAPTURE_LIMIT_BYTES, ExecConnectionError, HANDSHAKE_TIMEOUT_MS, execCapture, runExec, runVmExec, vmExecArgs, waitForAgent } from './chunk-W4SQCOZU.js';
+import './chunk-B2G7JHHB.js';
+import './chunk-AUFG23AA.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/guest-init-GENRHNP7.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit } from './chunk-CBPPJSAR.js';
+import './chunk-B2G7JHHB.js';
+import './chunk-AUFG23AA.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/hook-fast-EYENPK6F.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { AUTO_SYNC_DEBOUNCE_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, contextPossiblyGoverned, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, maybeAutoSync, maybeRenewWorkLease, runHookFast, spoolDir } from './chunk-UFFXNXLQ.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{hook-wrap-fast-KXYNX3AD.js → hook-wrap-fast-NPLHJXFK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { hookExecSpoolPath, hookWrapStdio, installAbortForwarding, makeTailCollector, parseHookWrapArgs, runHookWrapFast, spoolDir } from './chunk-YOOSBOKS.js';
-import './chunk-R5KBGVII.js';
+export { hookExecSpoolPath, hookWrapStdio, installAbortForwarding, makeTailCollector, parseHookWrapArgs, runHookWrapFast, spoolDir } from './chunk-F7CU5ABH.js';
+import './chunk-5QRP3MVS.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/host-key-KDYZ5ECC.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { ensureHostKey, loadHostKey, signerFor } from './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/import-capture-cmd-AVZ4VIVJ.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-WO2BXCTQ.js';
+import './chunk-EMY4I27X.js';
+import './chunk-RA3O54FC.js';
+import './chunk-Z5GEFMRW.js';
+import { statSync, existsSync, readFileSync, writeFileSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var GREEN = "\x1B[32m";
+var DIM = "\x1B[2m";
+var YELLOW = "\x1B[33m";
+var RESET = "\x1B[0m";
+var ImportCaptureError = class extends Error {
+};
+var SNIPPET_PATH = ".outerlayer/skills/emitting-evidence/references/agents-snippet.md";
+var AGENTS_MD_PATH = ".outerlayer/AGENTS.md";
+var AGENTS_MD_MARKER = "<!-- outerlayer:capture-pack -->";
+function runImportCapture(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  let cwdStat;
+  try {
+    cwdStat = statSync(cwd);
+  } catch {
+    throw new ImportCaptureError(`no such directory: ${cwd}`);
+  }
+  if (!cwdStat.isDirectory()) throw new ImportCaptureError(`not a directory: ${cwd}`);
+  const bundle = loadMaintainedFiles();
+  const { created: files, rewritten } = writeMaintainedFiles(cwd, bundle);
+  const snippet = bundle.find((f) => f.path === SNIPPET_PATH)?.content ?? "";
+  let appendedAgentsMd = false;
+  const agentsMdAbs = join(cwd, AGENTS_MD_PATH);
+  if (existsSync(agentsMdAbs)) {
+    const existing = readFileSync(agentsMdAbs, "utf8");
+    if (!existing.includes(AGENTS_MD_MARKER)) {
+      writeFileSync(agentsMdAbs, existing + "\n" + snippet);
+      appendedAgentsMd = true;
+    }
+  }
+  let output;
+  if (opts.json) {
+    output = JSON.stringify({ files, rewritten, appendedAgentsMd });
+  } else {
+    const lines = [
+      ...files.map((f) => `${GREEN}\u2713${RESET} wrote ${f}`),
+      ...rewritten.map((f) => `${YELLOW}!${RESET} rewrote ${f} to match this CLI's bundle (local edits were overwritten)`)
+    ];
+    if (appendedAgentsMd) lines.push(`${GREEN}\u2713${RESET} appended the evidence snippet to ${AGENTS_MD_PATH}`);
+    if (files.length === 0 && rewritten.length === 0 && !appendedAgentsMd) {
+      lines.push(`${DIM}capture pack already installed \u2014 nothing to write${RESET}`);
+    }
+    lines.push(`Run ${YELLOW}\`outerlayer emit\`${RESET} to compile the pack into your agent's native files.`);
+    output = lines.join("\n");
+  }
+  if (!opts.quiet) {
+    process.stdout.write(output + "\n");
+    if (!opts.json && !appendedAgentsMd && !existsSync(agentsMdAbs)) {
+      process.stdout.write(
+        `${DIM}  no ${AGENTS_MD_PATH} to append to \u2014 paste ${SNIPPET_PATH} into your instructions file if your harness reads no skills${RESET}
+`
+      );
+    }
+  }
+  return { files, rewritten, appendedAgentsMd, output };
+}
+
+export { ImportCaptureError, runImportCapture };