@outerlayer/cli 0.16.1 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @outerlayer/cli
 
+## 0.17.0
+
+### Minor Changes
+
+- 420b0db: `outerlayer runner init` takes `--factory <org>/<factory>`, the same name `outerlayer init --factory` takes, so a runner host no longer needs the Factory Id copied from the dashboard. With no factory named, a login that can use exactly one factory uses it and says which. A login that can use several is refused with each `--factory` value listed. `--app-id` still works, and a `--factory` and `--app-id` that name different factories are refused.
+
+### Patch Changes
+
+- a3ac4ae: Count a test title such as `WC-01: counts words` as citing criterion WC-01. The starter `/build` skill's `criterion-citations.mjs` linked no test whose title put a colon straight after the id, so a build could report 0 of 4 criteria linked. A longer id such as `WC-010`, `WC-01a` or `WC-01:b` still does not cite WC-01.
+- a897c68: The README says to install the CLI globally with `npm install -g @outerlayer/cli`, because `/build` and the other skills run the `outerlayer` command.
+- 2a59794: Fix review results never being recorded on a new factory. The starter code-review and acceptance-criteria checks and the starter `/build` skill told agents to copy each report's link from the pull request's evidence comment, which a factory never posts until comments are turned on. They now take the link from the line `outerlayer sync` prints. A new `outerlayer sync --link <artifact id>` prints the link of an artifact an earlier sync already uploaded.
+- 8196dc9: `outerlayer runner init` names the factory once when it picks the only one the login can use. A refused pasted key no longer repeats the gateway's "Mint a fresh key" advice beside its own step to create a new key with the Runner preset.
+- 8196dc9: `outerlayer runner init` no longer tries to create the runner key with your login, which the gateway never allows. With no key in the config file, it prints the link to the factory's API keys page, asks you to paste a key made with the Runner preset (nothing is shown as you paste), checks it, and goes on. With no terminal it stops and prints the link and the config-file lines to use. `--key-name` is removed. Its output now marks warnings with `!` instead of a tick, no longer doubles ticks for lines from the VM, drops the PATH note about the VM's shell, and says whether capture on the Mac is affected when the runner key moves into the VM.
+- 3ba60cd: No change in behaviour: the runner's wait for a stopped session sender's exit is simplified, and its tests check that the wait ends when the exit is logged.
+- 0b7e87c: The starter skills run the CLI through `npx @outerlayer/cli` when `outerlayer` is not on PATH.
+- f7553df: `outerlayer context materialize` and a container build now fetch the control plane and commit that OuterLayer stores for a repository, and read no `governs` list for it. `outerlayer doctor` reports which control plane governs the repository, its ref and the stored commit. `outerlayer connect` picks the factory that owns a repository linked to two factories, the one with the oldest connection, without asking.
+
 ## 0.16.1
 
 ### Patch Changes

package/README.md

@@ -13,12 +13,13 @@ network, and when, is below.
 Launch a session naming the work it's for, then sync:
 
 ```
-npx @outerlayer/cli login                         # sign in, once per machine
-npx @outerlayer/cli init                          # connect this repository to a factory, install the capture hooks
-npx @outerlayer/cli work build --issue 42 --local # create the work item; prints its number
-OUTERLAYER_WORK=7 claude                     # launch a session naming that number
-npx @outerlayer/cli sync --dry-run                # see exactly what would leave your machine
-npx @outerlayer/cli sync                          # upload sessions launched that way
+npm install -g @outerlayer/cli                   # puts `outerlayer` on your PATH, once per machine
+outerlayer login                                 # sign in, once per machine
+outerlayer init                                  # connect this repository to a factory, install the capture hooks
+outerlayer work build --issue 42 --local         # create the work item; prints its number
+OUTERLAYER_WORK=7 claude                         # launch a session naming that number
+outerlayer sync --dry-run                        # see exactly what would leave your machine
+outerlayer sync                                  # upload sessions launched that way
 ```
 
 ## Privacy, stated plainly
@@ -144,10 +145,9 @@ content:
   to it.
 - **`outerlayer runner init`** makes no network call when the config file
   already holds a runner key. With no key there and a saved login, it
-  creates one: `POST /v1/api-keys` with your login's token, sending the key's
-  name (this machine's name, or `--key-name`), the Runner preset's
-  permissions and the factory id. It then checks the new key, unsigned, with
-  `GET /v1/runner/host-key`. `runner init --vm` on a Mac also runs `limactl`,
+  asks the gateway which factories the login can use (`GET /v1/me/factories`)
+  and prints the factory's API keys page. You create the key there and paste
+  it. It checks the pasted key, unsigned, with `GET /v1/runner/host-key`. `runner init --vm` on a Mac also runs `limactl`,
   and Lima downloads a Linux VM image. Inside the VM, `apt` downloads Node and
   `npm` downloads this CLI. Your runner key goes to the VM on the standard
   input of a `limactl shell` command and is never a file or an argument on the
@@ -391,7 +391,7 @@ before it gives up.
 | `outerlayer work claim --item <n>\|--issue <n> --kind implement\|amend [--repo] [--host] [--seconds]` | Records a lease for this host (default: its own hostname), so two hosts never build the same item at once. The lease belongs to the runner key that claimed it: a live lease held by a different key is refused, even under the same host name, and claiming again with the same key extends it. The first claim creates the host key (`host-key.pem` beside the config file) and binds the runner key to it; from then on every request made with that key is signed. Lease length defaults to 900 seconds, the server's own cap. |
 | `outerlayer work renew --item <n>\|--issue <n> [--repo] [--host] [--seconds]` | Extends this host's own live lease. Refused if the lease has expired, or if a different runner key holds it (403 `claim_not_held`). |
 | `outerlayer work release --item <n>\|--issue <n> [--repo] [--host] [--session-id] [--outcome]` | Marks the lease this API key holds released, optionally recording how the attempt ended. Releasing an already-released lease is a no-op that returns the recorded release time and outcome. Run inside a session with no `--host`, it releases that session's own lease instead (`--session-id` names the session when it cannot be detected), so the item's review opens without ending the session. |
-| `outerlayer runner init [--vm\|--no-vm] [--app-id <id>] [--key-name <name>] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. With no `apiKey` in the config and a saved login, it first creates a runner key from the login with the Runner preset, named after the machine or `--key-name`, on the factory `--app-id` names, and checks it before anything else changes. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
+| `outerlayer runner init [--vm\|--no-vm] [--factory <org>/<factory>] [--app-id <id>] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. With no `apiKey` in the config and a saved login, it prints the API keys page of the factory `--factory` or `--app-id` names (the only factory the login can use, when neither is given), asks you to paste a runner key made with the Runner preset, and checks it before anything else changes. With no terminal it stops and says what to put in the config. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
 | `outerlayer runner check [--config <path>]` | Validates the config, the hooks and the key, prints the settings the runner would use, and exits non-zero on a problem. Takes no work and writes no pid file. |
 | `outerlayer runner start [--config <path>]` | Runs the loop: claim work, run it, sync, clean up, report, release with an outcome. Repeat. Reads the `runner` block from the config file (default `~/.outerlayer/config.json`). Refuses to start on a bad config, an unrunnable hook, or a refused key. |
 | `outerlayer runner image --repository <owner/name> [--remote <url>] [--config <path>] [--json]` | Builds the image a repository's builds run in. Fetches the head of the default branch into the runner's cache, builds its `.devcontainer/devcontainer.json` with the devcontainer CLI, ignores every setting that reaches the host or widens the container's privileges, and adds this CLI and a pinned Claude Code. Reuses the image until the recipe or the tools change, keeps the newest three, and writes `recipe.json` beside the image record. Refuses a Compose recipe (`recipe_needs_docker`) and a repository with only named configurations (`recipe_ambiguous`). |

package/dist/{agent-setup-K3ABU5NL.js → agent-setup-T624CWPD.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-5FEK6PNE.js';
+export { keepHandWritten, runAgentSetup } from './chunk-KG5ECZGJ.js';
 import './chunk-2MNPHL23.js';
 import './chunk-XCK2YAY5.js';
 import './chunk-42ZI52JW.js';
 import './chunk-YRYMNBGQ.js';
-import './chunk-JEHRUE3F.js';
+import './chunk-YZ5F4PIS.js';
 import './chunk-WTE3MQML.js';
 import './chunk-C5Y5ZJJZ.js';
 import './chunk-ZJSNLVCE.js';

package/dist/artifact-link-cmd-2F47LT7F.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-WUYTWNMA.js';
+import './chunk-J5M7BSJQ.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);
+
+// src/artifact-link-cmd.ts
+function lookupArtifactLink(artifactId, home = homeFromEnv()) {
+  const shown = sanitizeTerminal(artifactId);
+  const entry = readEffectiveArtifactSpoolState(home).state.get(artifactId);
+  if (entry === void 0) return { ok: false, reason: `no artifact ${shown} is queued or uploaded on this machine` };
+  if (entry.state !== "uploaded") {
+    return { ok: false, reason: `artifact ${shown} is ${entry.state}, not uploaded yet \u2014 run \`outerlayer sync\` first` };
+  }
+  if (entry.url === void 0) {
+    return { ok: false, reason: `artifact ${shown} uploaded, but the gateway returned no link for it` };
+  }
+  return { ok: true, url: entry.url };
+}
+
+export { lookupArtifactLink };

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-09T18:11:10.939Z+a3c670b","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-09T21:24:47.045Z+8773e8e","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-CNTMSGOG.js → check-5XE7XMC4.js}

@@ -1,33 +1,33 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-EHAAPRWY.js';
-import './chunk-R4ZQQ7U2.js';
+import { probeCredentials } from './chunk-WVUIRTWA.js';
+import './chunk-G5NPRL2K.js';
+import './chunk-RMWLBUCJ.js';
 import './chunk-O765JR4W.js';
 import './chunk-UGP76IZ5.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
-import './chunk-RMWLBUCJ.js';
 import './chunk-I2UOAV7X.js';
+import './chunk-NNRTPG7X.js';
 import './chunk-HYZRY4KZ.js';
 import './chunk-ADJRGVZC.js';
-import './chunk-ONRCEE6D.js';
-import './chunk-U3HXXRTY.js';
+import './chunk-NWQTTSBB.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-FWX735W7.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-LWSJQJC6.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-TBT347UY.js';
-import './chunk-CA3XMYFN.js';
-import './chunk-RSPXEVDX.js';
-import './chunk-EWORLJMO.js';
+import './chunk-VQYBXPI7.js';
+import './chunk-ONKJUM6R.js';
+import './chunk-MAK5LYRF.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import './chunk-OZGHL5Y5.js';
 import './chunk-RLYZLUQ7.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-6QRMLNH3.js';
-import './chunk-NPQWKGUA.js';
+import './chunk-S3NYLI2P.js';
+import './chunk-6Y5RUTHO.js';
 import './chunk-IP7BIBXJ.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-22RMZBGW.js';
 import './chunk-UXYLWVTQ.js';
@@ -41,7 +41,7 @@ import './chunk-4Q7OMKAT.js';
 import './chunk-CX22S5BA.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-YDSMROTB.js';
+import './chunk-3NSNIIBE.js';
 import './chunk-WUYTWNMA.js';
 import './chunk-JXYVA45C.js';
 import './chunk-4KSQKQXE.js';
@@ -50,7 +50,7 @@ import './chunk-YRYMNBGQ.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-JEHRUE3F.js';
+import './chunk-YZ5F4PIS.js';
 import './chunk-WTE3MQML.js';
 import './chunk-C5Y5ZJJZ.js';
 import './chunk-ZJSNLVCE.js';
@@ -64,7 +64,7 @@ import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-6JNURGOA.js';
+import './chunk-BWQ66M6N.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/{chunk-YDSMROTB.js → chunk-3NSNIIBE.js}

@@ -78,6 +78,7 @@ var REASON_TEXT = {
   flag: "you passed --factory",
   saved: "already connected",
   linked: "the repository is linked to it",
+  owner: "it owns this repository",
   only: "the only factory you can use",
   prompt: "you chose it"
 };
@@ -128,18 +129,19 @@ function parseFactories(body) {
         name: sanitizeTerminal(org.name),
         displayName: sanitizeTerminal(typeof org.displayName === "string" ? org.displayName : org.name)
       },
-      linked: typeof row.linked === "boolean" ? row.linked : null
+      linked: typeof row.linked === "boolean" ? row.linked : null,
+      owner: row.owner === true
     });
   }
   return out;
 }
 function listText(factories, repository) {
-  return factories.map((f) => `  ${slug(f)}  ${f.displayName}${f.linked === true ? ` (linked to ${repository})` : ""}`).join("\n");
+  return factories.map((f) => `  ${slug(f)}  ${f.displayName}${f.linked === true && repository !== void 0 ? ` (linked to ${repository})` : ""}`).join("\n");
 }
 async function fetchFactories(fetchImpl, url, token, repository) {
   let res;
   try {
-    res = await fetchImpl(`${url.replace(/\/+$/, "")}/v1/me/factories?${new URLSearchParams({ repository }).toString()}`, {
+    res = await fetchImpl(`${url.replace(/\/+$/, "")}/v1/me/factories${repository === void 0 ? "" : `?${new URLSearchParams({ repository }).toString()}`}`, {
       method: "GET",
       headers: { authorization: `Bearer ${token}` },
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
@@ -168,6 +170,8 @@ function selectFactory(factories, saved, repository) {
   if (remembered) return { factory: remembered, reason: "saved" };
   const linked = factories.filter((f) => f.linked === true);
   if (linked.length === 1) return { factory: linked[0], reason: "linked" };
+  const owners = factories.filter((f) => f.owner);
+  if (owners.length === 1) return { factory: owners[0], reason: "owner" };
   if (factories.length === 1) return { factory: factories[0], reason: "only" };
   return { factory: void 0, values: factories.map(slug), text: listText(factories, repository) };
 }
@@ -310,4 +314,4 @@ ${COMMIT_LINE}
   return r.code;
 }
 
-export { COMMIT_LINE, autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, workPageUrl };
+export { COMMIT_LINE, autoConnectedLine, dashboardBase, fetchFactories, isLinkedRepository, listText, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, slug, workPageUrl };

package/dist/{chunk-NPQWKGUA.js → chunk-6Y5RUTHO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-YDSMROTB.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-3NSNIIBE.js';
 import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';

package/dist/{chunk-6JNURGOA.js → chunk-BWQ66M6N.js}

@@ -634,7 +634,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-2WXTS4CW.js');
+          const { materializeContext: materialize } = await import('./context-materialize-IV2TUUFO.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-R4ZQQ7U2.js → chunk-G5NPRL2K.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-RMWLBUCJ.js';
+import { senderPidfile } from './chunk-NNRTPG7X.js';
 import { DOCKERD_LOG } from './chunk-HYZRY4KZ.js';
-import { senderPidfile } from './chunk-ONRCEE6D.js';
-import { installScrubContext } from './chunk-U3HXXRTY.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-EWORLJMO.js';
+import { installScrubContext } from './chunk-NWQTTSBB.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-MAK5LYRF.js';
 import { childEnvironment } from './chunk-KMDLFI4P.js';
 import { waitForAgent, vmExecArgs } from './chunk-QKFB4K7X.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6QRMLNH3.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-S3NYLI2P.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-22RMZBGW.js';
 import { readBranchHead, diffBetween, fetchCommit } from './chunk-R7PF5OOU.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
@@ -2074,19 +2074,18 @@ async function startSender(input) {
     const launch = launchFor(config, job, jobDir, deps);
     const fd = openSync(join(jobDir, "sender.log"), "a", RUNNER_FILE_MODE);
     let pid;
+    let exitLogged;
     try {
       const child = spawnFn(launch.command, launch.args, { env: launch.env, cwd: launch.cwd, detached: true, stdio: ["ignore", fd, fd] });
       child.on("error", (err) => deps.log.error(`${tag} session sender failed: ${describeCallFailure(err)}`));
-      const exitLogged = new Promise((resolve) => {
+      exitLogged = new Promise((resolve) => {
         child.on("exit", (code, signal) => {
           deps.log.line(`${tag} session sender exited \xB7 ${signal ?? `code ${code}`} \xB7 see sender.log`);
-          if (pid !== void 0) exitsLogged.delete(pid);
           resolve();
         });
       });
       child.unref?.();
       pid = child.pid;
-      if (pid !== void 0) exitsLogged.set(pid, exitLogged);
     } finally {
       closeSync(fd);
     }
@@ -2094,6 +2093,7 @@ async function startSender(input) {
       deps.log.line(`${tag} session sender did not start: no pid`);
       return void 0;
     }
+    exitsLogged.set(pid, exitLogged);
     deps.log.line(`${tag} session sender started \xB7 pid ${pid}`);
     return { pid, start: startTimeOf(pid) ?? void 0 };
   } catch (err) {
@@ -2148,7 +2148,6 @@ async function signalInGuest(runtime, state, pidfile, signal) {
 }
 async function exitReported(pid) {
   const logged = exitsLogged.get(pid);
-  if (logged === void 0) return;
   let timer;
   const bound = new Promise((resolve) => {
     timer = setTimeout(resolve, EXIT_REPORT_WAIT_MS);

package/dist/{chunk-W3EKCZSQ.js → chunk-HGECYFEI.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-NBGDBTO2.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-6QRMLNH3.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-S3NYLI2P.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { isLinkedRepository } from './chunk-YDSMROTB.js';
+import { isLinkedRepository } from './chunk-3NSNIIBE.js';
 import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-JXYVA45C.js';
 import { C } from './chunk-YRYMNBGQ.js';
@@ -13,7 +13,7 @@ import { checkFormerSkillNames } from './chunk-C5Y5ZJJZ.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-6JNURGOA.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-BWQ66M6N.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -1084,6 +1084,56 @@ async function credentialChecks(options = {}) {
   const source = env.OUTERLAYER_API_KEY ? "OUTERLAYER_API_KEY" : "~/.outerlayer/config.json";
   return factoryKeyChecks(fetchImpl, resolved.url, resolved.credential, resolved.appId, source, local);
 }
+function governedDetail(source) {
+  return `governed by ${sanitizeTerminal(source.repository)} (ref ${sanitizeTerminal(source.ref)}, stored commit ${sanitizeTerminal(source.sha.slice(0, 7))})`;
+}
+async function governanceChecks(options = {}) {
+  const name = "Governance";
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const resolved = resolveGatewayCredentials({ home: options.home, env, cwd });
+  if (resolved.credential === void 0 || resolved.url === void 0) {
+    return [skippedCheck(name, "there is no credential to ask with", "Run `outerlayer login` to sign in.")];
+  }
+  const local = resolveRepoIdentity(cwd).gitRepo;
+  if (local === void 0) return [skippedCheck(name, "not inside a git repository with a remote")];
+  if (resolved.appId === void 0) return [skippedCheck(name, "no factory is chosen for this repository", CONNECT_FIX)];
+  const fetchImpl = options.fetchImpl ?? defaultFetch;
+  const reply = await askGateway(fetchImpl, resolved.url, `/v1/context/source?${new URLSearchParams({ repo: local.split("/").slice(-2).join("/") }).toString()}`, resolved.credential, resolved.appId);
+  const unanswered = unansweredDetail(reply);
+  if (unanswered !== void 0 && !("failure" in reply) && reply.status === 503) {
+    const message = refusalMessage(reply.body);
+    return [{ name, status: "warn", detail: message === "" ? unanswered : `governed, but ${message}`, fix: "Check that the GitHub App can read the control plane, then run `outerlayer doctor` again." }];
+  }
+  if (unanswered !== void 0) return [{ name, status: "warn", detail: unanswered, fix: NETWORK_FIX }];
+  const { status, body } = reply;
+  if (status === 401 || status === 403) {
+    return [{ name, status: "warn", detail: `the gateway refused to say what governs ${sanitizeTerminal(local)} (HTTP ${status})`, fix: LOGIN_FIX }];
+  }
+  if (status < 200 || status >= 300) {
+    return [{ name, status: "warn", detail: `the gateway did not answer which control plane governs ${sanitizeTerminal(local)} (HTTP ${status})`, fix: UPDATE_FIX }];
+  }
+  const data = body?.data;
+  const source = data?.source;
+  if (source === void 0) {
+    return [
+      {
+        name,
+        status: "warn",
+        detail: "the gateway is too old to say which control plane governs this repository: its answer has no source",
+        fix: UPDATE_FIX
+      }
+    ];
+  }
+  if (source === null) {
+    return [{ name, status: "pass", detail: `${sanitizeTerminal(local)} is self-governed: it supplies its own context` }];
+  }
+  const named = source;
+  if (typeof named.repository !== "string" || typeof named.ref !== "string" || typeof named.sha !== "string") {
+    return [{ name, status: "warn", detail: "the gateway named a control plane without its repository, ref and commit", fix: UPDATE_FIX }];
+  }
+  return [{ name, status: "pass", detail: governedDetail({ repository: named.repository, ref: named.ref, sha: named.sha }) }];
+}
 function doctorExitCode(checks) {
   return checks.some((c) => c.status === "fail") ? 1 : 0;
 }
@@ -1095,14 +1145,14 @@ async function gatherDoctorChecks() {
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
   checks.push(...credential);
-  if (credential[0]?.status === "pass") checks.push(...await githubAppChecks());
+  if (credential[0]?.status === "pass") checks.push(...await githubAppChecks(), ...await governanceChecks());
   const runnerVm = runnerVmOf(configPath);
   if (runnerVm !== void 0) {
     const { realLima } = await import('./lima-7NPCNGWT.js');
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-N6Y7HKK3.js');
+    const { runnerHostChecks } = await import('./doctor-4TAIARIG.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/{chunk-5FEK6PNE.js → chunk-KG5ECZGJ.js}

@@ -4,7 +4,7 @@ import { runEmit } from './chunk-2MNPHL23.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-XCK2YAY5.js';
 import { installStarterPack } from './chunk-42ZI52JW.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-JEHRUE3F.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-YZ5F4PIS.js';
 import { pinExists, readContextManifest } from './chunk-WTE3MQML.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-POJMEEJJ.js';
 import { generatedHeaderSource } from './chunk-OHVJA253.js';

package/dist/{chunk-FWX735W7.js → chunk-LWSJQJC6.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-CA3XMYFN.js';
-import { describeCallFailure } from './chunk-EWORLJMO.js';
-import { WorkCommandError, getJson } from './chunk-6QRMLNH3.js';
+import { isPlaceholderCommand } from './chunk-VQYBXPI7.js';
+import { describeCallFailure } from './chunk-MAK5LYRF.js';
+import { WorkCommandError, getJson } from './chunk-S3NYLI2P.js';
 import { builtinKind } from './chunk-22RMZBGW.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { sanitizeTerminal } from './chunk-WUYTWNMA.js';

package/dist/{chunk-EWORLJMO.js → chunk-MAK5LYRF.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { createDockerHost, childEnvironment, spawnRun } from './chunk-KMDLFI4P.js';
 import { execCapture } from './chunk-QKFB4K7X.js';
 import { GUEST_CID } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson } from './chunk-6QRMLNH3.js';
+import { WorkCommandError, postJson } from './chunk-S3NYLI2P.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-R7PF5OOU.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
@@ -14,15 +14,15 @@ import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath } from './chunk-4Q7OMKAT.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-JXYVA45C.js';
-import { defaultGitRunner, materializeContext } from './chunk-JEHRUE3F.js';
+import { defaultGitRunner, materializeContext } from './chunk-YZ5F4PIS.js';
 import { readContextManifest, readSourceCache } from './chunk-WTE3MQML.js';
 import { signingFetchFor } from './chunk-YO4PSLVB.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-OHVJA253.js';
 import { downconvertSession } from './chunk-J5M7BSJQ.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
+import { fstatSync, readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { relative, join, dirname, basename } from 'path';
-import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { spawnSync, spawn } from 'child_process';
 import { availableParallelism, networkInterfaces } from 'os';
 import { randomBytes, createHash } from 'crypto';
@@ -38,16 +38,25 @@ createRequire(import.meta.url);
 function logStamp(at) {
   return at.toISOString().replace(/\.\d{3}Z$/, "Z");
 }
-function createRunnerLog(now = () => /* @__PURE__ */ new Date()) {
+function sameDestination(stat = fstatSync) {
+  try {
+    const out = stat(1);
+    const err = stat(2);
+    return out.dev === err.dev && out.ino === err.ino;
+  } catch {
+    return false;
+  }
+}
+function createRunnerLog(now = () => /* @__PURE__ */ new Date(), io = { stdout: process.stdout, stderr: process.stderr, joined: () => sameDestination() }) {
   const write = (stream, text) => {
     stream.write(`${logStamp(now())} ${text}
 `);
   };
   return {
-    line: (text) => write(process.stdout, text),
+    line: (text) => write(io.stdout, text),
     error: (text) => {
-      write(process.stdout, text);
-      write(process.stderr, text);
+      write(io.stdout, text);
+      if (!io.joined()) write(io.stderr, text);
     }
   };
 }

package/dist/{chunk-ONRCEE6D.js → chunk-NNRTPG7X.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-U3HXXRTY.js';
+import { LiveUploader } from './chunk-NWQTTSBB.js';
 import { CaptureDaemon } from './chunk-JXYVA45C.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-6JNURGOA.js';
+import { spoolDir } from './chunk-BWQ66M6N.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-U3HXXRTY.js → chunk-NWQTTSBB.js}

@@ -14,7 +14,7 @@ import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-J5M7BSJQ.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { signerFor, signRunnerRequest } from './chunk-V7NIVOFD.js';
-import { writeSyncStatus, spoolDir } from './chunk-6JNURGOA.js';
+import { writeSyncStatus, spoolDir } from './chunk-BWQ66M6N.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-RSPXEVDX.js → chunk-ONKJUM6R.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-EWORLJMO.js';
+import { MIN_ENGINE_MAJOR } from './chunk-MAK5LYRF.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-6QRMLNH3.js → chunk-S3NYLI2P.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-NPQWKGUA.js';
+import { autoConnect } from './chunk-6Y5RUTHO.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { workPageUrl } from './chunk-YDSMROTB.js';
+import { workPageUrl } from './chunk-3NSNIIBE.js';
 import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
 import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
 import { C } from './chunk-YRYMNBGQ.js';
@@ -360,7 +360,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-D7HV4IXG.js');
+      const { logHookError } = await import('./hook-fast-R4FVSZ2H.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-CA3XMYFN.js → chunk-VQYBXPI7.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RSPXEVDX.js';
-import { MIN_ENGINE_MAJOR } from './chunk-EWORLJMO.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-ONKJUM6R.js';
+import { MIN_ENGINE_MAJOR } from './chunk-MAK5LYRF.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-OZGHL5Y5.js';
 import { runnerCredentialProblem } from './chunk-22RMZBGW.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
@@ -112,7 +112,7 @@ function prepareRunnerInit(configPath, opts = {}) {
 function writeRunnerInit(prepared, runnerKey) {
   const { configPath, config, carried, credential, agent, machine, hooks } = prepared;
   if (prepared.needsKey && runnerKey === void 0) {
-    throw new RunnerInitError(`${configPath}: apiKey is missing, and no runner key was created from the login.`);
+    throw new RunnerInitError(`${configPath}: apiKey is missing, and no runner key was pasted.`);
   }
   if (runnerKey !== void 0) Object.assign(config, { url: runnerKey.url, apiKey: runnerKey.apiKey, appId: runnerKey.appId });
   mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });

package/dist/{chunk-EHAAPRWY.js → chunk-WVUIRTWA.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-R4ZQQ7U2.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-G5NPRL2K.js';
+import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-RMWLBUCJ.js';
 import { writePendingUpdate } from './chunk-O765JR4W.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
-import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-RMWLBUCJ.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { RUNNER_PROTOCOL } from './chunk-ADJRGVZC.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-FWX735W7.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-LWSJQJC6.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-EWORLJMO.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-MAK5LYRF.js';
 import { spawnRun } from './chunk-KMDLFI4P.js';
 import { checkFit } from './chunk-RLYZLUQ7.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6QRMLNH3.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-S3NYLI2P.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-22RMZBGW.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
 import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-4NPZVMJU.js';
@@ -1315,7 +1315,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-DJQJEZVB.js');
+  const { postJson: postJson2 } = await import('./work-cmd-Z2WXLZPH.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2074,7 +2074,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-CNTMSGOG.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-5XE7XMC4.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });