@outerlayer/cli 0.17.0 → 0.19.0

package/dist/chunk-XSZD4AZ6.js

@@ -0,0 +1,490 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { WorkCommandError, postJson } from './chunk-HPJNLETG.js';
+import { composeDelivery } from './chunk-LLM3I5YU.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-452TM7J4.js';
+import { signingFetchFor } from './chunk-FVMYKL6L.js';
+import { SHIM_SCRIPT } from './chunk-G2YNJIGF.js';
+import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
+import { signerFor } from './chunk-M2ZWWTWZ.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir } from './chunk-N2PXGQRL.js';
+import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, lstatSync } from 'fs';
+import { relative, join, dirname } from 'path';
+
+createRequire(import.meta.url);
+function logStamp(at) {
+  return at.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function sameDestination(stat = fstatSync) {
+  try {
+    const out = stat(1);
+    const err = stat(2);
+    return out.dev === err.dev && out.ino === err.ino;
+  } catch {
+    return false;
+  }
+}
+function createRunnerLog(now = () => /* @__PURE__ */ new Date(), io = { stdout: process.stdout, stderr: process.stderr, joined: () => sameDestination() }) {
+  const write = (stream, text) => {
+    stream.write(`${logStamp(now())} ${text}
+`);
+  };
+  return {
+    line: (text) => write(io.stdout, text),
+    error: (text) => {
+      write(io.stdout, text);
+      if (!io.joined()) write(io.stderr, text);
+    }
+  };
+}
+function formatDuration(ms) {
+  const total = Math.max(0, Math.round(ms / 1e3));
+  const hours = Math.floor(total / 3600);
+  const minutes = Math.floor(total % 3600 / 60);
+  const seconds = total % 60;
+  if (hours > 0) return `${hours}h ${minutes}m`;
+  if (minutes > 0) return `${minutes}m ${String(seconds).padStart(2, "0")}s`;
+  return `${seconds}s`;
+}
+function formatClock(at, today) {
+  const hhmm = `${String(at.getUTCHours()).padStart(2, "0")}:${String(at.getUTCMinutes()).padStart(2, "0")} UTC`;
+  const sameDay = at.getUTCFullYear() === today.getUTCFullYear() && at.getUTCMonth() === today.getUTCMonth() && at.getUTCDate() === today.getUTCDate();
+  if (sameDay) return hhmm;
+  const month = at.toLocaleString("en-US", { month: "short", timeZone: "UTC" });
+  return `${month} ${at.getUTCDate()} ${hhmm}`;
+}
+function shortClaim(claimId) {
+  return claimId.length <= 8 ? claimId : `${claimId.slice(0, 8)}\u2026`;
+}
+function relativeToRunner(runnerDirPath, path) {
+  const rel = relative(runnerDirPath, path);
+  return rel === "" || rel.startsWith("..") ? path : rel;
+}
+function describeCallFailure(err) {
+  if (err instanceof Error) {
+    const status = err.status;
+    return status === void 0 ? err.message : `${err.message} (${status})`;
+  }
+  return String(err);
+}
+
+// src/runner/retry.ts
+var RETRY_WINDOW_MS = 12e4;
+var FIRST_BACKOFF_MS = 1e3;
+var MAX_BACKOFF_MS = 15e3;
+function isRetryable(err) {
+  if (err instanceof WorkCommandError) return err.retryable;
+  return true;
+}
+async function retrySend(send, deps = {}) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const windowMs = deps.windowMs ?? RETRY_WINDOW_MS;
+  const startedMs = now().getTime();
+  let attempts = 0;
+  let backoffMs = FIRST_BACKOFF_MS;
+  for (; ; ) {
+    attempts++;
+    try {
+      return { ok: true, value: await send(), attempts };
+    } catch (err) {
+      const reason = describeCallFailure(err);
+      const code = err instanceof WorkCommandError ? err.code : void 0;
+      const status = err instanceof WorkCommandError ? err.status : void 0;
+      const message = err instanceof WorkCommandError ? err.message : void 0;
+      if (!isRetryable(err)) return { ok: false, attempts, reason, retryable: false, code, status, message };
+      const elapsedMs = now().getTime() - startedMs;
+      if (elapsedMs + backoffMs >= windowMs) return { ok: false, attempts, reason, retryable: true, code, status, message };
+      await sleep(backoffMs);
+      backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
+    }
+  }
+}
+
+// src/runner/build-tokens.ts
+var ISSUE_RETRY_WINDOW_MS = 3e4;
+var REVOKE_TIMEOUT_MS = 15e3;
+function isDue(expiresAtMs, nowMs) {
+  return nowMs >= expiresAtMs - 10 * 6e4;
+}
+function classifyRefusal(err) {
+  if (!(err instanceof WorkCommandError)) return { kind: "retry" };
+  if (err.status === 401 || err.code === "claim_expired" || err.code === "claim_not_held") return { kind: "lease_lost" };
+  if (err.code === "github_unavailable") return { kind: "retry" };
+  if (err.code === "github_request_failed") return { kind: "failed", reason: refusalCode(err) };
+  if (err.retryable && err.code !== "repository_tokens_unavailable") return { kind: "retry" };
+  return { kind: "failed", reason: refusalCode(err) };
+}
+function refusalCode(err) {
+  if (!(err instanceof WorkCommandError)) return "unavailable";
+  return err.code ?? `http_${err.status ?? "unknown"}`;
+}
+function keyOf(kind, repository) {
+  return repository === void 0 ? kind : `${kind}:${repository}`;
+}
+var BuildTokens = class {
+  constructor(options) {
+    this.options = options;
+    this.held = /* @__PURE__ */ new Map();
+    this.asking = /* @__PURE__ */ new Map();
+    this.issued = [];
+    this.usedKinds = /* @__PURE__ */ new Set();
+    this.revoked = false;
+    this.controlPlaneRetry = false;
+  }
+  now() {
+    return (this.options.now ?? (() => /* @__PURE__ */ new Date()))();
+  }
+  /** `repository` as the holder keys it: `undefined` for the primary, which is the one a request names no repository for. */
+  secondary(repository) {
+    if (repository === void 0) return void 0;
+    const primary = this.options.primary;
+    return primary !== void 0 && primary.toLowerCase() === repository.toLowerCase() ? void 0 : repository;
+  }
+  /**
+   * The token of `kind` for `repository`, or for the primary when none is
+   * named, asking the gateway for a new one when the build holds none or its
+   * token is within ten minutes of expiry.
+   */
+  token(kind, repository) {
+    const other = this.secondary(repository);
+    const key = keyOf(kind, other);
+    const held = this.held.get(key);
+    if (held !== void 0 && !isDue(held.expiresAtMs, this.now().getTime())) return Promise.resolve(held.token);
+    let asking = this.asking.get(key);
+    if (asking === void 0) {
+      asking = this.issueOrKeep(kind, other).finally(() => this.asking.delete(key));
+      this.asking.set(key, asking);
+    }
+    return asking;
+  }
+  /** A due token that has not yet expired is kept when the gateway cannot issue a new one. */
+  async issueOrKeep(kind, repository) {
+    try {
+      return await this.issue(kind, repository);
+    } catch (err) {
+      const held = this.held.get(keyOf(kind, repository));
+      if (held !== void 0 && this.now().getTime() < held.expiresAtMs && classifyRefusal(err).kind === "retry") return held.token;
+      throw err;
+    }
+  }
+  /** Asks the gateway for a token with `body`, retrying a failure about the moment. */
+  ask(body) {
+    const { config, item, fetchImpl } = this.options;
+    return retrySend(
+      async () => {
+        try {
+          return await postJson(
+            config.url,
+            `/v1/work-items/${item}/claim/tokens`,
+            config.apiKey,
+            config.appId,
+            body,
+            fetchImpl,
+            void 0,
+            await signerFor(config.configPath)
+          );
+        } catch (err) {
+          if (err instanceof WorkCommandError && (err.code === "repository_tokens_unavailable" || err.code === "github_request_failed")) {
+            throw new WorkCommandError(err.message, false, err.status, err.code);
+          }
+          throw err;
+        }
+      },
+      { now: this.options.now, sleep: this.options.sleep, windowMs: ISSUE_RETRY_WINDOW_MS }
+    );
+  }
+  /**
+   * A read-only token for the repository that governs the item's, which the
+   * runner uses on the host to fetch its context. It is revoked with the
+   * others when the attempt ends. It is not held or renewed: nothing uses it
+   * after the fetch. A refusal is thrown with the gateway's code. A lost
+   * lease is kept for `refusal()`, and a failure about the moment for
+   * `controlPlaneUnavailable()`, as the read token's are.
+   */
+  async controlPlane() {
+    const asked = await this.ask({ access: "read", target: "control_plane" });
+    if (!asked.ok) {
+      const err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
+      const refusal = classifyRefusal(err);
+      if (refusal.kind === "lease_lost") this.failure = refusal;
+      if (refusal.kind === "retry") this.controlPlaneRetry = true;
+      throw err;
+    }
+    const { token, expiresAt, repository } = asked.value.data;
+    if (typeof token !== "string" || token === "" || typeof expiresAt !== "string" || typeof repository !== "string" || repository === "") {
+      throw new WorkCommandError("the gateway's token answer carried no token, expiry or repository", false, void 0, "malformed_token_response");
+    }
+    if (this.revoked) {
+      await this.revoke([token]);
+      throw new WorkCommandError("the build's tokens were already revoked", false, void 0, "tokens_revoked");
+    }
+    this.issued.push(token);
+    return { token, expiresAt, repository };
+  }
+  async issue(kind, repository) {
+    const asked = await this.ask({ access: kind, ...repository === void 0 ? {} : { repository } });
+    let err;
+    if (!asked.ok) {
+      err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
+    } else {
+      const { token, expiresAt } = asked.value.data;
+      const expiresAtMs = typeof expiresAt === "string" ? Date.parse(expiresAt) : Number.NaN;
+      if (typeof token === "string" && token !== "" && Number.isFinite(expiresAtMs)) {
+        if (this.revoked) {
+          await this.revoke([token]);
+          throw new WorkCommandError("the build's tokens were already revoked", false, void 0, "tokens_revoked");
+        }
+        this.held.set(keyOf(kind, repository), { token, expiresAtMs });
+        this.issued.push(token);
+        if (kind === "read" && repository === void 0) this.readSink?.(token);
+        return token;
+      }
+      err = new WorkCommandError("the gateway's token answer carried no token or no expiry", false, void 0, "malformed_token_response");
+    }
+    const refusal = classifyRefusal(err);
+    if (refusal.kind !== "retry") this.failure = refusal;
+    throw err;
+  }
+  /** Asks for a new read token when the build holds one within ten minutes of expiry. A refusal is kept for `refusal()`, not thrown. */
+  async renewReadIfDue() {
+    const held = this.held.get("read");
+    if (held === void 0 || !isDue(held.expiresAtMs, this.now().getTime())) return;
+    await this.token("read").catch(() => void 0);
+  }
+  /** Calls `sink` with the read token now, and again with each one that replaces it. */
+  onRead(sink) {
+    this.readSink = sink;
+    const held = this.held.get("read");
+    if (held !== void 0) sink(held.token);
+  }
+  markUsed(kind) {
+    if (this.usedKinds.has(kind)) return;
+    this.usedKinds.add(kind);
+    this.options.onUsed?.(this.used());
+  }
+  /** The kinds of token the build has used, read before push. */
+  used() {
+    return ["read", "push"].filter((kind) => this.usedKinds.has(kind));
+  }
+  /** The last refusal that ends the build, if a renewal or a push's token request met one. */
+  refusal() {
+    return this.failure;
+  }
+  /** Whether a control plane token request failed for a reason about the moment, which a later attempt may not meet. */
+  controlPlaneUnavailable() {
+    return this.controlPlaneRetry;
+  }
+  /** Revokes every token this holder was issued, the superseded ones too, at GitHub with the token itself. A failure is not an error: the token lapses within the hour. */
+  async revokeAll() {
+    this.revoked = true;
+    const tokens = this.issued.splice(0);
+    this.held.clear();
+    await this.revoke(tokens);
+  }
+  async revoke(tokens) {
+    const apiUrl = this.options.apiUrl ?? "https://api.github.com";
+    await Promise.allSettled(
+      tokens.map(
+        (token) => this.options.fetchImpl(`${apiUrl}/installation/token`, {
+          method: "DELETE",
+          headers: {
+            authorization: `Bearer ${token}`,
+            accept: "application/vnd.github+json",
+            "x-github-api-version": "2022-11-28",
+            "user-agent": "outerlayer-runner"
+          },
+          signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+        })
+      )
+    );
+  }
+};
+
+// src/runner/control-plane-delivery.ts
+function shimScript() {
+  return SHIM_SCRIPT;
+}
+function commandWithShim(job, cmdline) {
+  return job.environment?.controlPlane === void 0 ? cmdline : `PATH=${SHIM_DIR}:"$PATH"; export PATH; ${cmdline}`;
+}
+
+// src/runner/container/context.ts
+var TokenRefused = class extends Error {
+  constructor(code, detail) {
+    super(code);
+    this.code = code;
+    this.detail = detail;
+  }
+};
+var NoControlPlane = class extends Error {
+};
+var GatewayConflict = class extends Error {
+};
+var unavailable = (why) => ({ kind: "refused", reason: `context_unavailable: ${why}` });
+var DESIGNATION_LOOKUP = { timeoutMs: 1e4, attempts: 2 };
+function lookupFailureReason(failure, repository) {
+  switch (failure?.kind) {
+    case "timeout":
+      return `the gateway did not answer which repository governs ${repository} within ${failure.timeoutMs / 1e3} seconds, twice`;
+    case "status":
+      return `the gateway answered ${failure.status} when asked which repository governs ${repository}`;
+    case "network":
+      return `the request asking which repository governs ${repository} failed: ${failure.message}`;
+    default:
+      return `the gateway did not say which repository governs ${repository}`;
+  }
+}
+function controlPlaneTokenFailure(err, repository) {
+  const code = refusalCode(err);
+  const detail = err instanceof WorkCommandError && err.code === void 0 && err.status === void 0 ? describeCallFailure(err) : void 0;
+  return detail === void 0 ? `context_unavailable: the gateway refused a token for the control plane named for ${repository} (${code})` : `context_unavailable: the token request for the control plane named for ${repository} failed: ${detail}`;
+}
+function makeReadable(tree, dir, files) {
+  chmodSync(dir, 493);
+  chmodSync(tree, 493);
+  const directories = /* @__PURE__ */ new Set();
+  for (const rel of files) {
+    for (let current = dirname(join(tree, rel)); current !== tree; current = dirname(current)) directories.add(current);
+    chmodSync(join(tree, rel), (lstatSync(join(tree, rel)).mode & 73) !== 0 ? 493 : 420);
+  }
+  for (const directory of directories) chmodSync(directory, 493);
+}
+async function stageGovernedContext(input) {
+  const git = input.git ?? defaultGitRunner;
+  const dir = stagedContextDir(input.buildDir);
+  const tree = join(dir, "tree");
+  const finish = (outcome) => {
+    removeStagedContext(input.buildDir);
+    return outcome;
+  };
+  try {
+    mkdirSync(tree, { recursive: true });
+    for (const args of [
+      ["init", "-q", "--initial-branch=main", tree],
+      ["-C", tree, "remote", "add", "origin", `https://github.com/${input.repository}.git`]
+    ]) {
+      const done = git(args, { cwd: dir, timeoutMs: 1e4 });
+      if (!done.ok) return finish(unavailable(`the staging directory could not be prepared: ${done.stderr.trim().split("\n")[0] ?? ""}`));
+    }
+    const { url, apiKey, appId, configPath } = input.config;
+    let tokenRepository;
+    const result = await materializeContext({
+      cwd: tree,
+      sessionId: `build-${input.buildId}`,
+      home: contextHomeDir(configPath),
+      cloud: { url, apiKey, appId },
+      fetchImpl: signingFetchFor(input.fetchImpl, configPath, apiKey),
+      designationLookup: DESIGNATION_LOOKUP,
+      ...input.source === void 0 ? {} : { pinnedSource: input.source },
+      git,
+      now: input.now,
+      resolveControlPlaneUrl: (repository) => input.controlPlaneUrl(repository),
+      controlPlaneAccess: input.controlPlaneToken === void 0 ? void 0 : async (candidates) => {
+        const access = await controlPlaneAccess(input.controlPlaneToken, candidates, input.repository, input.log, input.tag);
+        tokenRepository = access?.repository;
+        return access;
+      }
+    });
+    switch (result.status) {
+      case "materialized": {
+        const manifest = readContextManifest(join(tree, ".git"));
+        const source = readSourceCache(join(tree, ".git"));
+        if (result.sha === null || manifest === void 0 || source?.status !== "governed" || source.repository === void 0 || source.ref === void 0) {
+          return finish(unavailable(`the context of ${input.repository} was materialized without a record of it`));
+        }
+        const composed = composeDelivery({ tree, dir: deliveryDir(source.repository, result.sha) });
+        writeFileSync(
+          join(dir, "staged.json"),
+          JSON.stringify({ schemaVersion: 1, sha: result.sha, repository: source.repository, ref: source.ref, files: manifest.files }) + "\n"
+        );
+        makeReadable(tree, dir, [.../* @__PURE__ */ new Set([...manifest.files, ...composed])]);
+        chmodSync(join(dir, "staged.json"), 420);
+        return { kind: "staged", dir, sha: result.sha, repository: source.repository, ref: source.ref, files: manifest.files };
+      }
+      case "self":
+        if (result.designation === "answered") return finish({ kind: "none" });
+        if (result.authRejected === true) {
+          return finish(unavailable(`the gateway rejected the runner's API key (401/403) when asked which repository governs ${input.repository}`));
+        }
+        if (result.message !== void 0) return finish(unavailable(result.message));
+        return finish(unavailable(lookupFailureReason(result.lookupFailure, input.repository)));
+      case "unreachable":
+      case "no-access": {
+        const plane = isStagingWriteFault(result.message) ? void 0 : readDegraded(join(tree, ".git"))?.repository;
+        if (plane !== void 0) {
+          const credential = tokenRepository !== void 0 && tokenRepository.toLowerCase() === plane.toLowerCase() ? "the token the gateway issued" : "the host's git login";
+          return finish(unavailable(`${credential} cannot read ${plane}, the control plane named for ${input.repository}`));
+        }
+        return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
+      }
+      default:
+        return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
+    }
+  } catch (err) {
+    if (err instanceof NoControlPlane) return finish({ kind: "none" });
+    if (err instanceof GatewayConflict) return finish({ kind: "refused", reason: `context_conflict: ${err.message}` });
+    if (err instanceof TokenRefused) {
+      return finish(
+        unavailable(
+          err.detail === void 0 ? `the gateway refused a token for the control plane named for ${input.repository} (${err.code})` : `the token request for the control plane named for ${input.repository} failed: ${err.detail}`
+        )
+      );
+    }
+    return finish(unavailable(`the context of ${input.repository} could not be staged: ${err instanceof Error ? err.message : String(err)}`));
+  }
+}
+async function controlPlaneAccess(ask, candidates, repository, log, tag) {
+  let answer;
+  try {
+    answer = await ask();
+  } catch (err) {
+    const code = refusalCode(err);
+    if (code === "repository_tokens_unavailable") return void 0;
+    if (code === "no_control_plane") throw new NoControlPlane(code);
+    if (code === "context_conflict") throw new GatewayConflict(err instanceof Error ? err.message : code);
+    throw new TokenRefused(code, err instanceof WorkCommandError && err.code === void 0 && err.status === void 0 ? describeCallFailure(err) : void 0);
+  }
+  const named = candidates.some((candidate) => candidate.repository.toLowerCase() === answer.repository.toLowerCase());
+  if (!named) {
+    log?.line(
+      `${tag === void 0 ? "" : `${tag} `}the gateway issued a control plane token for ${answer.repository}, which is none of the repositories named for ${repository} (${candidates.map((candidate) => candidate.repository).join(", ")}) \xB7 fetching with the host's git login`
+    );
+    return void 0;
+  }
+  return answer;
+}
+function removeStagedContext(buildDir) {
+  rmSync(stagedContextDir(buildDir), { recursive: true, force: true });
+}
+
+// src/runner/governing-source.ts
+var unavailable2 = (why) => ({ ok: false, reason: `context_unavailable: ${why}` });
+function pinnedSourceOf(source) {
+  return source.kind === "self" ? null : { repository: source.repository, ref: source.ref, sha: source.sha };
+}
+async function resolveGoverningSource(input) {
+  const { url, apiKey, appId, configPath } = input.config;
+  const lookup = await lookupGoverningSource({ url, apiKey, appId }, input.repository, signingFetchFor(input.fetchImpl, configPath, apiKey), DESIGNATION_LOOKUP);
+  switch (lookup.kind) {
+    case "rejected":
+      return unavailable2(`the gateway rejected the runner's API key (401/403) when asked which repository governs ${input.repository}`);
+    case "failed":
+      return unavailable2(lookupFailureReason(lookup.failure, input.repository));
+    case "answered":
+      if (lookup.source === null) return { ok: true, source: { kind: "self" } };
+      if (lookup.source === void 0) {
+        return unavailable2("the OuterLayer this machine talks to is too old to name the control plane \u2014 ask whoever runs it to upgrade");
+      }
+      return { ok: true, source: { kind: "governed", ...lookup.source } };
+  }
+}
+async function imageTargetFor(input) {
+  if (input.config === void 0) return { ok: true, repository: input.repository };
+  const resolved = await resolveGoverningSource({ config: input.config, repository: input.repository, fetchImpl: input.fetchImpl });
+  if (!resolved.ok) return resolved;
+  if (resolved.source.kind === "self") return { ok: true, repository: input.repository };
+  return { ok: true, repository: resolved.source.repository, pinned: { commit: resolved.source.sha, ref: resolved.source.ref } };
+}
+
+export { BuildTokens, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, logStamp, pinnedSourceOf, refusalCode, relativeToRunner, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };

package/dist/chunk-YQR6E6OV.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { unlinkSync, readFileSync, mkdirSync, writeFileSync, existsSync } from 'fs';
+import { isAbsolute, join, dirname } from 'path';
+
+createRequire(import.meta.url);
+function stateDir(gitCommonDir) {
+  return join(gitCommonDir, "outerlayer");
+}
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeJson(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(value, null, 2) + "\n");
+}
+function manifestPath(gitCommonDir) {
+  return join(stateDir(gitCommonDir), "materialized.json");
+}
+function readContextManifest(gitCommonDir) {
+  const parsed = readJson(manifestPath(gitCommonDir));
+  if (parsed && typeof parsed.sha === "string" && Array.isArray(parsed.files) && parsed.files.every((f) => typeof f === "string") && typeof parsed.materializedAt === "string") {
+    return parsed;
+  }
+  return void 0;
+}
+function writeContextManifest(gitCommonDir, manifest) {
+  writeJson(manifestPath(gitCommonDir), manifest);
+}
+function removeContextManifest(gitCommonDir) {
+  try {
+    unlinkSync(manifestPath(gitCommonDir));
+  } catch {
+  }
+}
+function degradedPath(gitCommonDir) {
+  return join(stateDir(gitCommonDir), "degraded.json");
+}
+function readDegraded(gitCommonDir) {
+  const parsed = readJson(degradedPath(gitCommonDir));
+  if (parsed && typeof parsed.kind === "string" && typeof parsed.message === "string") return parsed;
+  return void 0;
+}
+function writeDegraded(gitCommonDir, state) {
+  writeJson(degradedPath(gitCommonDir), state);
+}
+function clearDegraded(gitCommonDir) {
+  try {
+    unlinkSync(degradedPath(gitCommonDir));
+  } catch {
+  }
+}
+var SOURCE_CACHE_TTL_SUCCESS_MS = 24 * 60 * 60 * 1e3;
+var SOURCE_CACHE_TTL_RETRY_MS = 15 * 60 * 1e3;
+function sourceCachePath(gitCommonDir) {
+  return join(stateDir(gitCommonDir), "source.json");
+}
+function readSourceCache(gitCommonDir) {
+  const parsed = readJson(sourceCachePath(gitCommonDir));
+  if (parsed && (parsed.status === "self" || parsed.status === "governed") && typeof parsed.checkedAt === "string" && typeof parsed.ttlMs === "number") {
+    return parsed;
+  }
+  return void 0;
+}
+function writeSourceCache(gitCommonDir, cache) {
+  writeJson(sourceCachePath(gitCommonDir), cache);
+}
+function isSourceCacheFresh(cache, now) {
+  return now - Date.parse(cache.checkedAt) < cache.ttlMs;
+}
+function deliveryRecordPath(gitCommonDir) {
+  return join(stateDir(gitCommonDir), "delivery.json");
+}
+function readDeliveryRecord(gitCommonDir) {
+  const parsed = readJson(deliveryRecordPath(gitCommonDir));
+  if (typeof parsed?.dir === "string" && isAbsolute(parsed.dir) && typeof parsed.repository === "string" && typeof parsed.sha === "string") {
+    return {
+      ...typeof parsed.schemaVersion === "number" ? { schemaVersion: parsed.schemaVersion } : {},
+      repository: parsed.repository,
+      ...typeof parsed.ref === "string" ? { ref: parsed.ref } : {},
+      sha: parsed.sha,
+      dir: parsed.dir,
+      ...parsed.launcher === true ? { launcher: true } : {}
+    };
+  }
+  return void 0;
+}
+function removeLauncherDeliveryRecord(gitCommonDir) {
+  if (readDeliveryRecord(gitCommonDir)?.launcher !== true) return;
+  try {
+    unlinkSync(deliveryRecordPath(gitCommonDir));
+  } catch {
+  }
+}
+function deliveryRecordExists(gitCommonDir) {
+  return existsSync(deliveryRecordPath(gitCommonDir));
+}
+function writeDeliveryRecord(gitCommonDir, record) {
+  writeJson(deliveryRecordPath(gitCommonDir), record);
+}
+function cloneIsGoverned(gitCommonDir) {
+  return readSourceCache(gitCommonDir)?.status === "governed" || deliveryRecordExists(gitCommonDir);
+}
+
+export { SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, clearDegraded, cloneIsGoverned, isSourceCacheFresh, readContextManifest, readDegraded, readDeliveryRecord, readSourceCache, removeContextManifest, removeLauncherDeliveryRecord, writeContextManifest, writeDegraded, writeDeliveryRecord, writeSourceCache };

package/dist/{chunk-XCK2YAY5.js → chunk-YVZJ6GKF.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { C } from './chunk-YRYMNBGQ.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { existsSync, writeFileSync, readFileSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';
 
@@ -12,7 +13,7 @@ function defaultMcpUrl(home) {
   const origin = readCloudConfig(home).url;
   if (!origin) {
     throw new McpInstallError(
-      "no gateway URL: pass --url <your gateway>, or run `outerlayer login` first."
+      `no gateway URL: pass --url <your gateway>, or run \`${cliInvocation()} login\` first.`
     );
   }
   return `${origin.replace(/\/+$/, "")}/v1/mcp`;