@outerlayer/cli 0.15.0 → 0.17.0

package/dist/{chunk-3NLOVYJQ.js → chunk-YZ5F4PIS.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-LCEXHCHD.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, touchLastCheck, isLastCheckFresh, readDegraded, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WTE3MQML.js';
+import { removeRetiredSkills } from './chunk-C5Y5ZJJZ.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { withTokenHeader } from './chunk-BYT5O5RV.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-ZA5CHAFY.js';
-import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-2M63GG56.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-POJMEEJJ.js';
+import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-OHVJA253.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -187,7 +188,7 @@ async function materializeContext(deps) {
   if (ownRepoName === void 0) {
     return selfOutcome();
   }
-  const designation = await resolveDesignation({ git, fetchImpl, home, cloud: deps.cloud, now, gitCommonDir, ownRepoName, repoRoot });
+  const designation = await resolveDesignation({ git, fetchImpl, home, cloud: deps.cloud, now, gitCommonDir, ownRepoName, repoRoot, lookup: deps.designationLookup ?? { timeoutMs: 2e3, attempts: 1 } });
   const answered = { designation: "answered" };
   if (designation.status === "self") {
     return { ...selfOutcome(), ...answered };
@@ -203,11 +204,12 @@ async function materializeContext(deps) {
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
     }
     writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_RETRY_MS });
-    return { status: "self", sha: null, verification: "none", designation: "unknown", ...designation.authRejected ? { authRejected: true } : {} };
+    return { status: "self", sha: null, verification: "none", designation: "unknown", ...designation.authRejected ? { authRejected: true } : {}, lookupFailure: designation.lookupFailure };
   }
   let repository;
   let ref;
   let unverifiedIdentity;
+  let storedSha;
   let preFetched;
   let unreadableCandidates = [];
   if (designation.status === "candidates") {
@@ -272,9 +274,10 @@ async function materializeContext(deps) {
     repository = designation.repository;
     ref = designation.ref;
     unverifiedIdentity = designation.unverifiedIdentity;
+    storedSha = designation.sha;
   }
   const manifest = readContextManifest(gitCommonDir);
-  const evidenced = hasGovernedEvidence(hasPin, manifest);
+  const evidenced = hasGovernedEvidence(hasPin, manifest) || storedSha !== void 0 && !unverifiedIdentity;
   const clearOrFlagIdentity = () => {
     if (unverifiedIdentity) {
       writeDegraded(gitCommonDir, {
@@ -294,7 +297,30 @@ async function materializeContext(deps) {
     sha = preFetched.sha;
     cacheRepoDir = preFetched.cacheRepoDir;
   } else {
-    if (isLastCheckFresh(gitCommonDir, now()) && manifest !== void 0 && pin?.sha === manifest.sha && manifestFilesPresent(repoRoot, manifest)) {
+    if (storedSha !== void 0 && manifest !== void 0 && manifest.sha === storedSha && pin?.sha === storedSha && manifestFilesPresent(repoRoot, manifest)) {
+      touchLastCheck(gitCommonDir, now());
+      clearOrFlagIdentity();
+      ensureContextExcludes(gitCommonDir);
+      recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
+      const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
+      writeSourceCache(gitCommonDir, {
+        checkedAt: new Date(now()).toISOString(),
+        status: "governed",
+        repository,
+        ref,
+        sha: storedSha,
+        ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+      });
+      const verification = unverifiedIdentity ? "unverified" : "verified";
+      record(storedSha, verification, repository, ref);
+      return {
+        status: "debounced",
+        sha: storedSha,
+        verification,
+        ...guardMessage2 ? { message: guardMessage2 } : {}
+      };
+    }
+    if (storedSha === void 0 && isLastCheckFresh(gitCommonDir, now()) && manifest !== void 0 && pin?.sha === manifest.sha && manifestFilesPresent(repoRoot, manifest)) {
       const degraded = readDegraded(gitCommonDir);
       const verification = degraded ? "unverified" : "verified";
       ensureContextExcludes(gitCommonDir);
@@ -320,8 +346,8 @@ async function materializeContext(deps) {
     }
     const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
     const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
-    const lsRemote = git(["ls-remote", remoteUrl, ref], { cwd: repoRoot, timeoutMs: 2e3 });
-    if (lsRemote.ok) {
+    const lsRemote = storedSha === void 0 ? git(["ls-remote", remoteUrl, ref], { cwd: repoRoot, timeoutMs: 2e3 }) : void 0;
+    if (lsRemote?.ok) {
       const remoteSha = parseLsRemoteSha(lsRemote.stdout.toString("utf8"));
       if (remoteSha && manifest !== void 0 && manifest.sha === remoteSha && pin?.sha === remoteSha && manifestFilesPresent(repoRoot, manifest)) {
         touchLastCheck(gitCommonDir, now());
@@ -340,13 +366,21 @@ async function materializeContext(deps) {
       }
     }
     cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
-    const localRef = `refs/outerlayer/${sanitizeRefName(ref)}`;
-    const fetchResult = git(["fetch", "--depth", "1", remoteUrl, `+${ref}:${localRef}`], { cwd: cacheRepoDir, timeoutMs: 1e4 });
+    const localRef = storedSha === void 0 ? `refs/outerlayer/${sanitizeRefName(ref)}` : `refs/outerlayer/sha-${sanitizeRefName(storedSha)}`;
+    const wanted = storedSha === void 0 ? `+${ref}:${localRef}` : `+${storedSha}:${localRef}`;
+    const access = storedSha === void 0 ? void 0 : await deps.controlPlaneAccess?.([{ repository, ref }]);
+    const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
+    const fetchResult = git(["fetch", "--depth", "1", remoteUrl, wanted], {
+      cwd: cacheRepoDir,
+      timeoutMs: 1e4,
+      ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+    });
+    const commitNote = (message) => storedSha === void 0 ? message : `could not fetch commit \`${storedSha.slice(0, 7)}\` of ${repository}; ${message}`;
     if (!fetchResult.ok) {
       const kind = classifyGitFailure(fetchResult.stderr);
       const lastGood = manifest?.sha ?? null;
       const verification = lastGood ? "unverified" : "none";
-      const doctorMessage = kind === "no-access" ? noAccessMessage(lastGood) : unreachableMessage(lastGood);
+      const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage(lastGood) : unreachableMessage(lastGood));
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
       if (evidenced) {
         record(lastGood, verification, repository, ref);
@@ -355,10 +389,10 @@ async function materializeContext(deps) {
       return { status: kind, sha: null, verification: "none" };
     }
     const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
-    if (fetchedSha === void 0) {
+    if (fetchedSha === void 0 || storedSha !== void 0 && fetchedSha !== storedSha) {
       const lastGood = manifest?.sha ?? null;
       const verification = lastGood ? "unverified" : "none";
-      const doctorMessage = unreachableMessage(lastGood);
+      const doctorMessage = commitNote(unreachableMessage(lastGood));
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "unreachable", message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
       if (evidenced) {
         record(lastGood, verification, repository, ref);
@@ -367,10 +401,12 @@ async function materializeContext(deps) {
       return { status: "unreachable", sha: null, verification: "none" };
     }
     sha = fetchedSha;
-    const configContent = readBlobAtPath(git, cacheRepoDir, sha, CONTEXT_SOURCE_CONFIG_PATH);
-    const parsedGoverns = configContent === void 0 ? { governs: [] } : parseGoverns(configContent);
-    const governsList = "error" in parsedGoverns ? [] : parsedGoverns.governs;
-    const governed = governsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName));
+    const governed = storedSha !== void 0 || (() => {
+      const configContent = readBlobAtPath(git, cacheRepoDir, sha, CONTEXT_SOURCE_CONFIG_PATH);
+      const parsedGoverns = configContent === void 0 ? { governs: [] } : parseGoverns(configContent);
+      const governsList = "error" in parsedGoverns ? [] : parsedGoverns.governs;
+      return governsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName));
+    })();
     if (!governed) {
       writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
       if (hasPin) {
@@ -409,13 +445,15 @@ async function materializeContext(deps) {
     return partialWrite();
   }
   let overlayPaths = [];
+  let retiredPaths = /* @__PURE__ */ new Set();
   let overlayFailed = false;
   try {
+    retiredPaths = new Set(removeRetiredSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel)));
     overlayPaths = overlayMaintainedSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel));
   } catch {
     overlayFailed = true;
   }
-  const writtenPaths = [.../* @__PURE__ */ new Set([...writeResult.writtenPaths, ...overlayPaths])];
+  const writtenPaths = [.../* @__PURE__ */ new Set([...writeResult.writtenPaths, ...overlayPaths])].filter((path) => !retiredPaths.has(path));
   const deleteResult = manifest ? deleteRemovedFiles(repoRoot, manifest.files, writtenPaths) : { skipped: [] };
   if (overlayFailed && deleteResult.skipped.length === 0) {
     writeContextManifest(gitCommonDir, { schemaVersion: 1, sha, files: writtenPaths, materializedAt: new Date(now()).toISOString() });
@@ -446,7 +484,14 @@ async function materializeContext(deps) {
   writePinIfChanged(repoRoot, sha);
   touchLastCheck(gitCommonDir, now());
   clearOrFlagIdentity();
-  writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "governed", repository, ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
+  writeSourceCache(gitCommonDir, {
+    checkedAt: new Date(now()).toISOString(),
+    status: "governed",
+    repository,
+    ref,
+    ...storedSha === void 0 ? {} : { sha: storedSha },
+    ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+  });
   record(sha, "verified", repository, ref);
   return {
     status: "materialized",
@@ -458,21 +503,26 @@ async function materializeContext(deps) {
 }
 function recordMaintainedOverlay(repoRoot, gitCommonDir, manifest) {
   let overlayPaths;
+  let retired;
   try {
+    retired = new Set(removeRetiredSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel)));
     overlayPaths = overlayMaintainedSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel));
   } catch {
     return;
   }
   const known = new Set(manifest.files);
   const added = overlayPaths.filter((path) => !known.has(path));
-  if (added.length > 0) writeContextManifest(gitCommonDir, { ...manifest, files: [...manifest.files, ...added] });
+  if (added.length > 0 || retired.size > 0) {
+    writeContextManifest(gitCommonDir, { ...manifest, files: [...manifest.files.filter((path) => !retired.has(path)), ...added] });
+  }
 }
 async function resolveDesignation(ctx) {
   const cache = readSourceCache(ctx.gitCommonDir);
-  if (cache && isSourceCacheFresh(cache, ctx.now())) {
+  if (cache && isSourceCacheFresh(cache, ctx.now()) && !(cache.status === "governed" && cache.sha !== void 0)) {
     return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref } : { status: "self" };
   }
   let authRejected;
+  let lookupFailure;
   const destination = resolveGatewayCredentials({
     home: ctx.home,
     env: {},
@@ -480,15 +530,27 @@ async function resolveDesignation(ctx) {
     ...ctx.cloud === void 0 ? {} : { url: ctx.cloud.url, apiKey: ctx.cloud.apiKey, appId: ctx.cloud.appId }
   });
   if (destination.ok) {
-    const sources = await fetchContextSource(
+    const lookup = await fetchContextSource(
       { url: destination.url, apiKey: destination.credential, appId: destination.appId },
       ctx.ownRepoName,
       ctx.fetchImpl,
-      () => {
-        authRejected = designationAuthRejectedMessage(destination.credential);
-      }
+      ctx.lookup
     );
-    if (sources !== void 0) {
+    if (lookup.kind === "rejected") authRejected = designationAuthRejectedMessage(destination.credential);
+    if (lookup.kind === "failed") lookupFailure = lookup.failure;
+    if (lookup.kind === "answered") {
+      if (lookup.source !== void 0) {
+        if (lookup.source === null) {
+          writeSourceCache(ctx.gitCommonDir, {
+            checkedAt: new Date(ctx.now()).toISOString(),
+            status: "self",
+            ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+          });
+          return { status: "self" };
+        }
+        return { status: "governed", repository: lookup.source.repository, ref: lookup.source.ref, sha: lookup.source.sha };
+      }
+      const sources = lookup.sources ?? [];
       if (sources.length === 0) {
         writeSourceCache(ctx.gitCommonDir, {
           checkedAt: new Date(ctx.now()).toISOString(),
@@ -501,32 +563,66 @@ async function resolveDesignation(ctx) {
     }
   }
   if (cache) {
-    return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref, unverifiedIdentity: true } : { status: "self" };
+    return cache.status === "governed" && cache.repository && cache.ref ? {
+      status: "governed",
+      repository: cache.repository,
+      ref: cache.ref,
+      unverifiedIdentity: true,
+      ...cache.sha === void 0 ? {} : { sha: cache.sha }
+    } : { status: "self" };
+  }
+  return { status: "unknown", authRejected, lookupFailure };
+}
+async function fetchContextSource(config, ownRepoName, fetchImpl, lookup) {
+  const url = `${config.url.replace(/\/$/, "")}/v1/context/source?repo=${encodeURIComponent(ownRepoName)}`;
+  for (let attempt = 1; ; attempt++) {
+    const outcome = await askContextSource(url, config, fetchImpl, lookup.timeoutMs);
+    if (outcome.kind !== "failed" || !isRetryable(outcome.failure) || attempt >= lookup.attempts) return outcome;
   }
-  return { status: "unknown", authRejected };
 }
-async function fetchContextSource(config, ownRepoName, fetchImpl, onAuthRejected) {
+function isRetryable(failure) {
+  return failure.kind !== "status" || failure.status >= 500;
+}
+async function askContextSource(url, config, fetchImpl, timeoutMs) {
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 2e3);
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
   try {
-    const url = `${config.url.replace(/\/$/, "")}/v1/context/source?repo=${encodeURIComponent(ownRepoName)}`;
     const res = await fetchImpl(url, {
       headers: { Authorization: `Bearer ${config.apiKey}`, "x-outerlayer-app-id": config.appId },
       signal: controller.signal
     });
     if (res.status === 401 || res.status === 403) {
-      onAuthRejected();
-      return void 0;
+      return { kind: "rejected" };
     }
-    if (!res.ok) return void 0;
+    if (!res.ok) return { kind: "failed", failure: { kind: "status", status: res.status } };
     const body = await res.json();
-    return body.data?.sources;
-  } catch {
-    return void 0;
+    const data = body.data;
+    const source = validSource(data?.source);
+    if (data === void 0 || data === null || source === void 0 && !Array.isArray(data.sources)) {
+      return { kind: "failed", failure: { kind: "network", message: "the answer named no sources" } };
+    }
+    return { kind: "answered", source, sources: data.sources };
+  } catch (err) {
+    return {
+      kind: "failed",
+      failure: timedOut ? { kind: "timeout", timeoutMs } : { kind: "network", message: err instanceof Error ? err.message : String(err) }
+    };
   } finally {
     clearTimeout(timer);
   }
 }
+function validSource(source) {
+  if (source === null) return null;
+  const candidate = source;
+  if (typeof candidate?.repository === "string" && typeof candidate.ref === "string" && typeof candidate.sha === "string") {
+    return { repository: candidate.repository, ref: candidate.ref, sha: candidate.sha };
+  }
+  return void 0;
+}
 function resolveGitCommonDir(git, repoRoot) {
   const abs = gitText(git, repoRoot, ["rev-parse", "--path-format=absolute", "--git-common-dir"], 2e3);
   if (abs !== void 0) return abs;