@outerlayer/cli 0.17.0 → 0.19.0

package/dist/chunk-YZ5F4PIS.js

@@ -1,797 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, touchLastCheck, isLastCheckFresh, readDegraded, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WTE3MQML.js';
-import { removeRetiredSkills } from './chunk-C5Y5ZJJZ.js';
-import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { withTokenHeader } from './chunk-BYT5O5RV.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-POJMEEJJ.js';
-import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-OHVJA253.js';
-import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
-import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { execFileSync } from 'child_process';
-import { lstatSync, existsSync, mkdirSync, writeFileSync, chmodSync, unlinkSync, readdirSync, rmSync, readFileSync, copyFileSync } from 'fs';
-import { join, isAbsolute, dirname, relative } from 'path';
-
-createRequire(import.meta.url);
-var CONFIG_PATH = ".outerlayer/config.json";
-var CONTENT_KINDS = /* @__PURE__ */ new Set(["skill", "skill-reference"]);
-function overlayMaintainedSkills(repoRoot, unsafe) {
-  const sources = loadMaintainedFiles().filter((file) => !unsafe(file.path));
-  writeMaintainedFiles(repoRoot, sources);
-  const paths = sources.map((file) => file.path);
-  const configAbs = join(repoRoot, CONFIG_PATH);
-  if (!existsSync(configAbs)) return paths;
-  const config = parseOuterlayerConfig(readFileSync(configAbs, "utf8"));
-  if (!config.ok || !config.config) return paths;
-  const { entries } = classifyTree(sources.map((file) => file.path));
-  const input = {
-    entries,
-    contents: new Map(entries.filter((e) => CONTENT_KINDS.has(e.kind)).map((e) => [e.path, sources.find((f) => f.path === e.path).content])),
-    assetPaths: [],
-    targets: config.config.targets
-  };
-  const compiled = emitTree(input);
-  if (compiled.errors.length > 0) return paths;
-  for (const file of compiled.files) {
-    if (unsafe(file.path)) continue;
-    const abs = join(repoRoot, file.path);
-    mkdirSync(dirname(abs), { recursive: true });
-    if (!existsSync(abs) || readFileSync(abs, "utf8") !== file.content) writeFileSync(abs, file.content);
-    paths.push(file.path);
-  }
-  for (const copy of compiled.copies) {
-    if (unsafe(copy.toPath)) continue;
-    const abs = join(repoRoot, copy.toPath);
-    mkdirSync(dirname(abs), { recursive: true });
-    copyFileSync(join(repoRoot, copy.fromSourcePath), abs);
-    paths.push(copy.toPath);
-  }
-  return paths;
-}
-
-// src/context-materialize.ts
-var defaultGitRunner = (args, opts) => {
-  try {
-    const stdout = execFileSync("git", args, {
-      cwd: opts.cwd,
-      timeout: opts.timeoutMs,
-      input: opts.input,
-      // Control-plane trees are small config/doc surfaces (AGENTS.md,
-      // .claude/**, .outerlayer/**) — generous but bounded so a runaway
-      // cat-file stream can't exhaust memory.
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["pipe", "pipe", "pipe"],
-      env: (opts.env ?? ((base) => base))({
-        ...process.env,
-        // classifyGitFailure greps English stderr substrings
-        // ("Authentication failed", "Permission denied", …) — a git running
-        // under a non-English locale would translate those and silently
-        // misclassify every failure as "unreachable" instead of "no-access".
-        LC_ALL: "C",
-        // A bare https:// remote with no cached credential answer otherwise
-        // blocks on an interactive username/password prompt with no
-        // terminal to read from here, hanging until OUR OWN timeout instead
-        // of failing fast with a classifiable stderr message.
-        GIT_TERMINAL_PROMPT: "0"
-      })
-    });
-    return { ok: true, stdout: Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout), stderr: "" };
-  } catch (err) {
-    const e = err;
-    return {
-      ok: false,
-      stdout: e.stdout ? Buffer.from(e.stdout) : Buffer.alloc(0),
-      stderr: e.stderr ? Buffer.from(e.stderr).toString("utf8") : e.message ?? String(err)
-    };
-  }
-};
-function gitText(git, cwd, args, timeoutMs) {
-  const result = git(args, { cwd, timeoutMs });
-  return result.ok ? result.stdout.toString("utf8").trim() : void 0;
-}
-var NOT_GOVERNED_MESSAGE = "this repository's control plane no longer governs it";
-var ADOPTION_MESSAGE = "committed context files shadow the control plane \u2014 remove them in a commit";
-var CANNOT_IDENTIFY_MESSAGE = "this repository is governed, but the control plane cannot be identified \u2014 check OuterLayer connectivity/config";
-function designationAuthRejectedMessage(credential) {
-  return credential.startsWith("olu_") ? "the OuterLayer login was rejected (401/403) \u2014 run `outerlayer login` to sign in again" : "the OuterLayer API key was rejected (401/403) \u2014 check apiKey in ~/.outerlayer/config.json";
-}
-var PARTIAL_WRITE_MESSAGE = "control-plane content could not be fully written \u2014 running on previous context";
-var OVERLAY_FAILED_MESSAGE = "control-plane content was written but the maintained skills could not be refreshed \u2014 retrying next session";
-var COMMIT_GUARD_FOREIGN_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 a pre-commit hook this clone did not write occupies that slot \u2014 resolve the conflict or run `outerlayer hooks install-git`";
-var COMMIT_GUARD_HOOKSPATH_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 hooks are managed via core.hooksPath, which this clone never writes to automatically \u2014 adopt it yourself: `outerlayer hooks install-git --print`";
-function guardNotInstalledMessage(guard) {
-  if (guard.adopted) return void 0;
-  if (guard.status === "skipped-foreign") return COMMIT_GUARD_FOREIGN_NOT_INSTALLED_MESSAGE;
-  if (guard.status === "skipped-custom-hooks-path") return COMMIT_GUARD_HOOKSPATH_NOT_INSTALLED_MESSAGE;
-  return void 0;
-}
-var FAILURE_DEBOUNCE_MS = 2 * 60 * 1e3;
-function hasGovernedEvidence(hasPin, manifest) {
-  return hasPin || manifest !== void 0;
-}
-function hasSymlinkComponent(root, relPath) {
-  let current = root;
-  for (const segment of relPath.split("/")) {
-    current = join(current, segment);
-    let st;
-    try {
-      st = lstatSync(current);
-    } catch {
-      return false;
-    }
-    if (st.isSymbolicLink()) return true;
-  }
-  return false;
-}
-function unreachableMessage(lastGoodSha) {
-  return lastGoodSha ? `could not verify the control plane \u2014 running on previously materialized context at \`${lastGoodSha.slice(0, 7)}\` (it may have moved)` : "this repository is governed but its context has never been materialized and the control plane is unreachable \u2014 running without governed context";
-}
-function noAccessMessage(lastGoodSha) {
-  const base = "you do not have access to the control plane";
-  const remedy = " \u2014 check your git credentials (SSH key or token) and org/SSO access, then retry";
-  return lastGoodSha ? `${base}; running on previously materialized context at \`${lastGoodSha.slice(0, 7)}\`${remedy}` : `${base}; running with repository defaults${remedy}`;
-}
-function classifyGitFailure(stderr) {
-  if (/authentication failed|permission denied \(publickey\)|\b403\b|saml sso|access denied/i.test(stderr)) {
-    return "no-access";
-  }
-  return "unreachable";
-}
-async function materializeContext(deps) {
-  const home = deps.home ?? homeFromEnv();
-  const now = deps.now ?? Date.now;
-  const git = deps.git ?? defaultGitRunner;
-  const fetchImpl = deps.fetchImpl ?? defaultFetch;
-  const repoRoot = gitText(git, deps.cwd, ["rev-parse", "--show-toplevel"], 2e3);
-  if (repoRoot === void 0) {
-    return { status: "not-a-repo", sha: null, verification: "none" };
-  }
-  const gitCommonDir = resolveGitCommonDir(git, repoRoot);
-  if (gitCommonDir === void 0) {
-    return { status: "not-a-repo", sha: null, verification: "none" };
-  }
-  const pin = readPin(repoRoot);
-  const hasPin = pin !== void 0 || pinExists(repoRoot);
-  const record = (sha2, verification, repository2, ref2) => {
-    appendContextProvenance(
-      { t: new Date(now()).toISOString(), sessionId: deps.sessionId, repoRoot, repository: repository2, ref: ref2, sha: sha2, verification },
-      home
-    );
-  };
-  const selfOutcome = () => {
-    if (hasPin) {
-      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "not-governed", message: NOT_GOVERNED_MESSAGE });
-      return { status: "not-governed", message: NOT_GOVERNED_MESSAGE, sha: null, verification: "none" };
-    }
-    clearDegraded(gitCommonDir);
-    return { status: "self", sha: null, verification: "none" };
-  };
-  const hold = readBuildHold(gitCommonDir);
-  if (hold !== void 0) {
-    const heldManifest = readContextManifest(gitCommonDir);
-    if (heldManifest !== void 0 && heldManifest.sha === hold.sha && pin?.sha === hold.sha && manifestFilesPresent(repoRoot, heldManifest)) {
-      ensureContextExcludes(gitCommonDir);
-      recordMaintainedOverlay(repoRoot, gitCommonDir, heldManifest);
-      const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
-      record(hold.sha, "verified", hold.repository, hold.ref);
-      return {
-        status: "debounced",
-        sha: hold.sha,
-        verification: "verified",
-        ...guardMessage2 ? { message: guardMessage2 } : {}
-      };
-    }
-  }
-  const ownRepoName = deriveOwnRepoName(git, repoRoot);
-  if (ownRepoName === void 0) {
-    return selfOutcome();
-  }
-  const designation = await resolveDesignation({ git, fetchImpl, home, cloud: deps.cloud, now, gitCommonDir, ownRepoName, repoRoot, lookup: deps.designationLookup ?? { timeoutMs: 2e3, attempts: 1 } });
-  const answered = { designation: "answered" };
-  if (designation.status === "self") {
-    return { ...selfOutcome(), ...answered };
-  }
-  if (designation.status === "unknown") {
-    const message = designation.authRejected ?? CANNOT_IDENTIFY_MESSAGE;
-    if (hasPin) {
-      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
-      record(null, "none");
-      return { status: "designation-unverified", message, sha: null, verification: "none", designation: "unknown" };
-    }
-    if (designation.authRejected) {
-      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
-    }
-    writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_RETRY_MS });
-    return { status: "self", sha: null, verification: "none", designation: "unknown", ...designation.authRejected ? { authRejected: true } : {}, lookupFailure: designation.lookupFailure };
-  }
-  let repository;
-  let ref;
-  let unverifiedIdentity;
-  let storedSha;
-  let preFetched;
-  let unreadableCandidates = [];
-  if (designation.status === "candidates") {
-    const sortedCandidates = [...designation.candidates].sort((a, b) => a.repository.localeCompare(b.repository));
-    const claimants = [];
-    const unfetched = [];
-    const access = await deps.controlPlaneAccess?.(sortedCandidates);
-    for (const candidate of sortedCandidates) {
-      const candidateUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(candidate.repository, candidate.ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, candidate.repository);
-      const candidateHost = parseRemoteHost(candidateUrl).host || "unknown-host";
-      const candidateCacheDir = ensureBareCache(git, home, candidate.repository, candidateHost);
-      const candidateLocalRef = `refs/outerlayer/${sanitizeRefName(candidate.ref)}`;
-      const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(candidate.repository) ? access.token : void 0;
-      const candidateFetch = git(["fetch", "--depth", "1", candidateUrl, `+${candidate.ref}:${candidateLocalRef}`], {
-        cwd: candidateCacheDir,
-        timeoutMs: 1e4,
-        ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, candidateUrl, token) }
-      });
-      if (!candidateFetch.ok) {
-        unfetched.push(candidate.repository);
-        continue;
-      }
-      const candidateSha = gitText(git, candidateCacheDir, ["rev-parse", candidateLocalRef], 2e3);
-      if (candidateSha === void 0) {
-        unfetched.push(candidate.repository);
-        continue;
-      }
-      const candidateConfig = readBlobAtPath(git, candidateCacheDir, candidateSha, CONTEXT_SOURCE_CONFIG_PATH);
-      const candidateGoverns = candidateConfig === void 0 ? { governs: [] } : parseGoverns(candidateConfig);
-      const candidateGovernsList = "error" in candidateGoverns ? [] : candidateGoverns.governs;
-      if (candidateGovernsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName))) {
-        claimants.push({ repository: candidate.repository, ref: candidate.ref, sha: candidateSha, cacheRepoDir: candidateCacheDir });
-      }
-    }
-    if (claimants.length === 0) {
-      writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
-      return { ...selfOutcome(), ...answered, ...unfetched.length > 0 ? { unfetched } : {} };
-    }
-    if (claimants.length > 1) {
-      const names = claimants.map((c) => c.repository).sort();
-      const message = `${names.join(" and ")} both claim to govern this repository \u2014 resolve the designation before context can materialize`;
-      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "conflict", message });
-      const manifestForConflict = readContextManifest(gitCommonDir);
-      const lastGood = manifestForConflict?.sha ?? null;
-      const verification = manifestForConflict ? "unverified" : "none";
-      record(lastGood, verification);
-      return { status: "conflict", message, sha: lastGood, verification };
-    }
-    unreadableCandidates = unfetched;
-    const winner = claimants[0];
-    writeSourceCache(gitCommonDir, {
-      checkedAt: new Date(now()).toISOString(),
-      status: "governed",
-      repository: winner.repository,
-      ref: winner.ref,
-      ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
-    });
-    repository = winner.repository;
-    ref = winner.ref;
-    preFetched = { sha: winner.sha, cacheRepoDir: winner.cacheRepoDir };
-  } else {
-    repository = designation.repository;
-    ref = designation.ref;
-    unverifiedIdentity = designation.unverifiedIdentity;
-    storedSha = designation.sha;
-  }
-  const manifest = readContextManifest(gitCommonDir);
-  const evidenced = hasGovernedEvidence(hasPin, manifest) || storedSha !== void 0 && !unverifiedIdentity;
-  const clearOrFlagIdentity = () => {
-    if (unverifiedIdentity) {
-      writeDegraded(gitCommonDir, {
-        at: new Date(now()).toISOString(),
-        kind: "designation-unverified",
-        message: CANNOT_IDENTIFY_MESSAGE,
-        repository,
-        ref
-      });
-    } else {
-      clearDegraded(gitCommonDir);
-    }
-  };
-  let sha;
-  let cacheRepoDir;
-  if (preFetched) {
-    sha = preFetched.sha;
-    cacheRepoDir = preFetched.cacheRepoDir;
-  } else {
-    if (storedSha !== void 0 && manifest !== void 0 && manifest.sha === storedSha && pin?.sha === storedSha && manifestFilesPresent(repoRoot, manifest)) {
-      touchLastCheck(gitCommonDir, now());
-      clearOrFlagIdentity();
-      ensureContextExcludes(gitCommonDir);
-      recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
-      const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
-      writeSourceCache(gitCommonDir, {
-        checkedAt: new Date(now()).toISOString(),
-        status: "governed",
-        repository,
-        ref,
-        sha: storedSha,
-        ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
-      });
-      const verification = unverifiedIdentity ? "unverified" : "verified";
-      record(storedSha, verification, repository, ref);
-      return {
-        status: "debounced",
-        sha: storedSha,
-        verification,
-        ...guardMessage2 ? { message: guardMessage2 } : {}
-      };
-    }
-    if (storedSha === void 0 && isLastCheckFresh(gitCommonDir, now()) && manifest !== void 0 && pin?.sha === manifest.sha && manifestFilesPresent(repoRoot, manifest)) {
-      const degraded = readDegraded(gitCommonDir);
-      const verification = degraded ? "unverified" : "verified";
-      ensureContextExcludes(gitCommonDir);
-      recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
-      const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
-      record(manifest.sha, verification, repository, ref);
-      return {
-        status: "debounced",
-        sha: manifest.sha,
-        verification,
-        ...guardMessage2 ? { message: guardMessage2 } : {}
-      };
-    }
-    const recentFailure = readDegraded(gitCommonDir);
-    if (recentFailure && (recentFailure.kind === "unreachable" || recentFailure.kind === "no-access") && recentFailure.repository === repository && recentFailure.ref === ref && now() - Date.parse(recentFailure.at) < FAILURE_DEBOUNCE_MS) {
-      const lastGood = manifest?.sha ?? null;
-      const verification = lastGood ? "unverified" : "none";
-      if (evidenced) {
-        record(lastGood, verification, repository, ref);
-        return { status: recentFailure.kind, message: recentFailure.message, sha: lastGood, verification };
-      }
-      return { status: recentFailure.kind, sha: null, verification: "none" };
-    }
-    const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
-    const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
-    const lsRemote = storedSha === void 0 ? git(["ls-remote", remoteUrl, ref], { cwd: repoRoot, timeoutMs: 2e3 }) : void 0;
-    if (lsRemote?.ok) {
-      const remoteSha = parseLsRemoteSha(lsRemote.stdout.toString("utf8"));
-      if (remoteSha && manifest !== void 0 && manifest.sha === remoteSha && pin?.sha === remoteSha && manifestFilesPresent(repoRoot, manifest)) {
-        touchLastCheck(gitCommonDir, now());
-        clearOrFlagIdentity();
-        ensureContextExcludes(gitCommonDir);
-        recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
-        const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
-        writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "governed", repository, ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
-        record(remoteSha, "verified", repository, ref);
-        return {
-          status: "debounced",
-          sha: remoteSha,
-          verification: "verified",
-          ...guardMessage2 ? { message: guardMessage2 } : {}
-        };
-      }
-    }
-    cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
-    const localRef = storedSha === void 0 ? `refs/outerlayer/${sanitizeRefName(ref)}` : `refs/outerlayer/sha-${sanitizeRefName(storedSha)}`;
-    const wanted = storedSha === void 0 ? `+${ref}:${localRef}` : `+${storedSha}:${localRef}`;
-    const access = storedSha === void 0 ? void 0 : await deps.controlPlaneAccess?.([{ repository, ref }]);
-    const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
-    const fetchResult = git(["fetch", "--depth", "1", remoteUrl, wanted], {
-      cwd: cacheRepoDir,
-      timeoutMs: 1e4,
-      ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
-    });
-    const commitNote = (message) => storedSha === void 0 ? message : `could not fetch commit \`${storedSha.slice(0, 7)}\` of ${repository}; ${message}`;
-    if (!fetchResult.ok) {
-      const kind = classifyGitFailure(fetchResult.stderr);
-      const lastGood = manifest?.sha ?? null;
-      const verification = lastGood ? "unverified" : "none";
-      const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage(lastGood) : unreachableMessage(lastGood));
-      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
-      if (evidenced) {
-        record(lastGood, verification, repository, ref);
-        return { status: kind, message: doctorMessage, sha: lastGood, verification };
-      }
-      return { status: kind, sha: null, verification: "none" };
-    }
-    const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
-    if (fetchedSha === void 0 || storedSha !== void 0 && fetchedSha !== storedSha) {
-      const lastGood = manifest?.sha ?? null;
-      const verification = lastGood ? "unverified" : "none";
-      const doctorMessage = commitNote(unreachableMessage(lastGood));
-      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "unreachable", message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
-      if (evidenced) {
-        record(lastGood, verification, repository, ref);
-        return { status: "unreachable", message: doctorMessage, sha: lastGood, verification };
-      }
-      return { status: "unreachable", sha: null, verification: "none" };
-    }
-    sha = fetchedSha;
-    const governed = storedSha !== void 0 || (() => {
-      const configContent = readBlobAtPath(git, cacheRepoDir, sha, CONTEXT_SOURCE_CONFIG_PATH);
-      const parsedGoverns = configContent === void 0 ? { governs: [] } : parseGoverns(configContent);
-      const governsList = "error" in parsedGoverns ? [] : parsedGoverns.governs;
-      return governsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName));
-    })();
-    if (!governed) {
-      writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
-      if (hasPin) {
-        writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "not-governed", message: NOT_GOVERNED_MESSAGE });
-        return { status: "not-governed", message: NOT_GOVERNED_MESSAGE, sha: pin?.sha ?? null, verification: "none" };
-      }
-      clearDegraded(gitCommonDir);
-      return { status: "self", sha: null, verification: "none" };
-    }
-  }
-  const tracked = git(["ls-files", "-z", "--", "AGENTS.md", ".claude", ".outerlayer"], { cwd: repoRoot, timeoutMs: 2e3 });
-  if (tracked.ok && tracked.stdout.length > 0) {
-    writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "adoption-conflict", message: ADOPTION_MESSAGE, repository, ref });
-    const lastGood = manifest?.sha ?? null;
-    record(lastGood, lastGood ? "unverified" : "none", repository, ref);
-    return { status: "adoption-conflict", message: ADOPTION_MESSAGE, sha: lastGood, verification: lastGood ? "unverified" : "none" };
-  }
-  const files = listMaterializedFiles(git, cacheRepoDir, sha);
-  const writeResult = writeFilesVerbatim(git, cacheRepoDir, files, repoRoot);
-  const partialWrite = () => {
-    const lastGood = manifest?.sha ?? null;
-    const verification = lastGood ? "unverified" : "none";
-    writeDegraded(gitCommonDir, {
-      at: new Date(now()).toISOString(),
-      kind: "unreachable",
-      message: PARTIAL_WRITE_MESSAGE,
-      repository,
-      ref,
-      lastGoodSha: lastGood ?? void 0
-    });
-    if (!evidenced) return { status: "unreachable", sha: null, verification: "none" };
-    record(lastGood, verification, repository, ref);
-    return { status: "unreachable", message: PARTIAL_WRITE_MESSAGE, sha: lastGood, verification };
-  };
-  if (!writeResult.ok) {
-    return partialWrite();
-  }
-  let overlayPaths = [];
-  let retiredPaths = /* @__PURE__ */ new Set();
-  let overlayFailed = false;
-  try {
-    retiredPaths = new Set(removeRetiredSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel)));
-    overlayPaths = overlayMaintainedSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel));
-  } catch {
-    overlayFailed = true;
-  }
-  const writtenPaths = [.../* @__PURE__ */ new Set([...writeResult.writtenPaths, ...overlayPaths])].filter((path) => !retiredPaths.has(path));
-  const deleteResult = manifest ? deleteRemovedFiles(repoRoot, manifest.files, writtenPaths) : { skipped: [] };
-  if (overlayFailed && deleteResult.skipped.length === 0) {
-    writeContextManifest(gitCommonDir, { schemaVersion: 1, sha, files: writtenPaths, materializedAt: new Date(now()).toISOString() });
-    writeDegraded(gitCommonDir, {
-      at: new Date(now()).toISOString(),
-      kind: "unreachable",
-      message: OVERLAY_FAILED_MESSAGE,
-      repository,
-      ref,
-      lastGoodSha: sha
-    });
-    if (!evidenced) return { status: "unreachable", sha: null, verification: "none" };
-    record(sha, "unverified", repository, ref);
-    return { status: "unreachable", message: OVERLAY_FAILED_MESSAGE, sha, verification: "unverified" };
-  }
-  if (deleteResult.skipped.length > 0) {
-    return partialWrite();
-  }
-  const newManifest = {
-    schemaVersion: 1,
-    sha,
-    files: writtenPaths,
-    materializedAt: new Date(now()).toISOString()
-  };
-  writeContextManifest(gitCommonDir, newManifest);
-  ensureContextExcludes(gitCommonDir);
-  const guardMessage = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
-  writePinIfChanged(repoRoot, sha);
-  touchLastCheck(gitCommonDir, now());
-  clearOrFlagIdentity();
-  writeSourceCache(gitCommonDir, {
-    checkedAt: new Date(now()).toISOString(),
-    status: "governed",
-    repository,
-    ref,
-    ...storedSha === void 0 ? {} : { sha: storedSha },
-    ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
-  });
-  record(sha, "verified", repository, ref);
-  return {
-    status: "materialized",
-    sha,
-    verification: "verified",
-    ...guardMessage ? { message: guardMessage } : {},
-    ...unreadableCandidates.length > 0 ? { unfetched: unreadableCandidates } : {}
-  };
-}
-function recordMaintainedOverlay(repoRoot, gitCommonDir, manifest) {
-  let overlayPaths;
-  let retired;
-  try {
-    retired = new Set(removeRetiredSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel)));
-    overlayPaths = overlayMaintainedSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel));
-  } catch {
-    return;
-  }
-  const known = new Set(manifest.files);
-  const added = overlayPaths.filter((path) => !known.has(path));
-  if (added.length > 0 || retired.size > 0) {
-    writeContextManifest(gitCommonDir, { ...manifest, files: [...manifest.files.filter((path) => !retired.has(path)), ...added] });
-  }
-}
-async function resolveDesignation(ctx) {
-  const cache = readSourceCache(ctx.gitCommonDir);
-  if (cache && isSourceCacheFresh(cache, ctx.now()) && !(cache.status === "governed" && cache.sha !== void 0)) {
-    return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref } : { status: "self" };
-  }
-  let authRejected;
-  let lookupFailure;
-  const destination = resolveGatewayCredentials({
-    home: ctx.home,
-    env: {},
-    cwd: ctx.repoRoot,
-    ...ctx.cloud === void 0 ? {} : { url: ctx.cloud.url, apiKey: ctx.cloud.apiKey, appId: ctx.cloud.appId }
-  });
-  if (destination.ok) {
-    const lookup = await fetchContextSource(
-      { url: destination.url, apiKey: destination.credential, appId: destination.appId },
-      ctx.ownRepoName,
-      ctx.fetchImpl,
-      ctx.lookup
-    );
-    if (lookup.kind === "rejected") authRejected = designationAuthRejectedMessage(destination.credential);
-    if (lookup.kind === "failed") lookupFailure = lookup.failure;
-    if (lookup.kind === "answered") {
-      if (lookup.source !== void 0) {
-        if (lookup.source === null) {
-          writeSourceCache(ctx.gitCommonDir, {
-            checkedAt: new Date(ctx.now()).toISOString(),
-            status: "self",
-            ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
-          });
-          return { status: "self" };
-        }
-        return { status: "governed", repository: lookup.source.repository, ref: lookup.source.ref, sha: lookup.source.sha };
-      }
-      const sources = lookup.sources ?? [];
-      if (sources.length === 0) {
-        writeSourceCache(ctx.gitCommonDir, {
-          checkedAt: new Date(ctx.now()).toISOString(),
-          status: "self",
-          ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
-        });
-        return { status: "self" };
-      }
-      return { status: "candidates", candidates: sources };
-    }
-  }
-  if (cache) {
-    return cache.status === "governed" && cache.repository && cache.ref ? {
-      status: "governed",
-      repository: cache.repository,
-      ref: cache.ref,
-      unverifiedIdentity: true,
-      ...cache.sha === void 0 ? {} : { sha: cache.sha }
-    } : { status: "self" };
-  }
-  return { status: "unknown", authRejected, lookupFailure };
-}
-async function fetchContextSource(config, ownRepoName, fetchImpl, lookup) {
-  const url = `${config.url.replace(/\/$/, "")}/v1/context/source?repo=${encodeURIComponent(ownRepoName)}`;
-  for (let attempt = 1; ; attempt++) {
-    const outcome = await askContextSource(url, config, fetchImpl, lookup.timeoutMs);
-    if (outcome.kind !== "failed" || !isRetryable(outcome.failure) || attempt >= lookup.attempts) return outcome;
-  }
-}
-function isRetryable(failure) {
-  return failure.kind !== "status" || failure.status >= 500;
-}
-async function askContextSource(url, config, fetchImpl, timeoutMs) {
-  const controller = new AbortController();
-  let timedOut = false;
-  const timer = setTimeout(() => {
-    timedOut = true;
-    controller.abort();
-  }, timeoutMs);
-  try {
-    const res = await fetchImpl(url, {
-      headers: { Authorization: `Bearer ${config.apiKey}`, "x-outerlayer-app-id": config.appId },
-      signal: controller.signal
-    });
-    if (res.status === 401 || res.status === 403) {
-      return { kind: "rejected" };
-    }
-    if (!res.ok) return { kind: "failed", failure: { kind: "status", status: res.status } };
-    const body = await res.json();
-    const data = body.data;
-    const source = validSource(data?.source);
-    if (data === void 0 || data === null || source === void 0 && !Array.isArray(data.sources)) {
-      return { kind: "failed", failure: { kind: "network", message: "the answer named no sources" } };
-    }
-    return { kind: "answered", source, sources: data.sources };
-  } catch (err) {
-    return {
-      kind: "failed",
-      failure: timedOut ? { kind: "timeout", timeoutMs } : { kind: "network", message: err instanceof Error ? err.message : String(err) }
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function validSource(source) {
-  if (source === null) return null;
-  const candidate = source;
-  if (typeof candidate?.repository === "string" && typeof candidate.ref === "string" && typeof candidate.sha === "string") {
-    return { repository: candidate.repository, ref: candidate.ref, sha: candidate.sha };
-  }
-  return void 0;
-}
-function resolveGitCommonDir(git, repoRoot) {
-  const abs = gitText(git, repoRoot, ["rev-parse", "--path-format=absolute", "--git-common-dir"], 2e3);
-  if (abs !== void 0) return abs;
-  const rel = gitText(git, repoRoot, ["rev-parse", "--git-common-dir"], 2e3);
-  if (rel === void 0) return void 0;
-  return isAbsolute(rel) ? rel : join(repoRoot, rel);
-}
-function deriveOwnRepoName(git, repoRoot) {
-  const url = gitText(git, repoRoot, ["config", "--get", "remote.origin.url"], 2e3);
-  if (url === void 0) return void 0;
-  return parseOwnerRepo(url);
-}
-function parseOwnerRepo(url) {
-  const stripped = url.replace(/\.git$/, "");
-  const scpMatch = stripped.match(/^[\w.-]+@[\w.-]+:(.+)$/);
-  if (scpMatch) return scpMatch[1];
-  try {
-    const parsed = new URL(stripped);
-    return parsed.pathname.replace(/^\//, "");
-  } catch {
-    return void 0;
-  }
-}
-function parseRemoteHost(url) {
-  const scpMatch = url.match(/^([\w.-]+)@([\w.-]+):/);
-  if (scpMatch) return { scheme: "ssh", host: scpMatch[2] };
-  try {
-    const parsed = new URL(url);
-    return { scheme: parsed.protocol === "https:" ? "https" : "ssh", host: parsed.host };
-  } catch {
-    return { scheme: "https", host: "github.com" };
-  }
-}
-function buildControlPlaneUrl(git, repoRoot, repository) {
-  const ownUrl = gitText(git, repoRoot, ["config", "--get", "remote.origin.url"], 2e3);
-  const { scheme, host } = ownUrl ? parseRemoteHost(ownUrl) : { scheme: "https", host: "github.com" };
-  return scheme === "ssh" ? `git@${host}:${repository}.git` : `https://${host}/${repository}.git`;
-}
-function cacheDirName(repository, host) {
-  const parts = repository.split("/");
-  return [host, ...parts].join("__").replace(/[^a-zA-Z0-9._-]/g, "-");
-}
-function sanitizeRefName(ref) {
-  return ref.replace(/[^a-zA-Z0-9._-]/g, "-");
-}
-function ensureBareCache(git, home, repository, host) {
-  const dir = join(home, ".outerlayer", "control-planes", `${cacheDirName(repository, host)}.git`);
-  if (!existsSync(join(dir, "HEAD"))) {
-    mkdirSync(dirname(dir), { recursive: true });
-    git(["init", "--bare", "-q", dir], { cwd: dirname(dir), timeoutMs: 5e3 });
-  }
-  return dir;
-}
-function parseLsRemoteSha(output) {
-  const lines = output.split("\n").filter((l) => l.trim().length > 0);
-  const peeled = lines.find((l) => l.split(/\s+/)[1]?.endsWith("^{}"));
-  const line = peeled ?? lines[0];
-  return line?.split(/\s+/)[0];
-}
-var MATERIALIZED_ROOTS = ["AGENTS.md", ".claude", ".outerlayer"];
-function listMaterializedFiles(git, cacheRepoDir, sha) {
-  const result = git(["ls-tree", "-r", "-z", sha, "--", ...MATERIALIZED_ROOTS], { cwd: cacheRepoDir, timeoutMs: 1e4 });
-  if (!result.ok) return [];
-  const entries = [];
-  for (const raw of result.stdout.toString("utf8").split("\0")) {
-    if (!raw) continue;
-    const tabIdx = raw.indexOf("	");
-    if (tabIdx === -1) continue;
-    const meta = raw.slice(0, tabIdx).split(" ");
-    const [mode, type, objSha] = meta;
-    const path = raw.slice(tabIdx + 1);
-    if (mode === void 0 || objSha === void 0 || path === void 0) continue;
-    if (mode === "120000") continue;
-    if (type !== "blob") continue;
-    if (path.includes("..") || isAbsolute(path)) continue;
-    entries.push({ mode, type: "blob", sha: objSha, path });
-  }
-  return entries;
-}
-function readBlobAtPath(git, cacheRepoDir, sha, path) {
-  const result = git(["show", `${sha}:${path}`], { cwd: cacheRepoDir, timeoutMs: 5e3 });
-  return result.ok ? result.stdout.toString("utf8") : void 0;
-}
-function parseBatchReply(files, stdout) {
-  const parsed = [];
-  let pos = 0;
-  for (const file of files) {
-    const headerEnd = stdout.indexOf(10, pos);
-    if (headerEnd === -1) return void 0;
-    const header = stdout.subarray(pos, headerEnd).toString("utf8");
-    const parts = header.split(" ");
-    if (parts[0] !== file.sha) return void 0;
-    if (parts[1] === "missing") return void 0;
-    const size = parts[1] === "blob" && parts[2] !== void 0 ? Number(parts[2]) : NaN;
-    if (!Number.isFinite(size) || stdout.length < headerEnd + 1 + size + 1) return void 0;
-    const contentStart = headerEnd + 1;
-    parsed.push({ path: file.path, content: stdout.subarray(contentStart, contentStart + size), mode: file.mode });
-    pos = contentStart + size + 1;
-  }
-  return parsed;
-}
-function writeFilesVerbatim(git, cacheRepoDir, files, workpieceRoot) {
-  if (files.length === 0) return { writtenPaths: [], ok: true };
-  const input = files.map((f) => f.sha).join("\n") + "\n";
-  const result = git(["cat-file", "--batch"], { cwd: cacheRepoDir, timeoutMs: 15e3, input });
-  if (!result.ok) return { writtenPaths: [], ok: false };
-  const parsed = parseBatchReply(files, result.stdout);
-  if (parsed === void 0) return { writtenPaths: [], ok: false };
-  const writtenPaths = [];
-  let anySkipped = false;
-  for (const file of parsed) {
-    if (hasSymlinkComponent(workpieceRoot, file.path)) {
-      anySkipped = true;
-      continue;
-    }
-    const dest = join(workpieceRoot, file.path);
-    mkdirSync(dirname(dest), { recursive: true });
-    const mode = file.mode === "100755" ? 493 : 420;
-    writeFileSync(dest, file.content, { mode });
-    chmodSync(dest, mode);
-    writtenPaths.push(file.path);
-  }
-  return { writtenPaths, ok: !anySkipped };
-}
-function isDeletableManifestPath(rel) {
-  if (isAbsolute(rel)) return false;
-  if (rel.split("/").some((segment) => segment === "..")) return false;
-  return rel === "AGENTS.md" || rel.startsWith(".claude/") || rel.startsWith(".outerlayer/");
-}
-function deleteRemovedFiles(workpieceRoot, oldFiles, newFiles) {
-  const keep = new Set(newFiles);
-  const dirsToPrune = /* @__PURE__ */ new Set();
-  const skipped = [];
-  for (const rel of oldFiles) {
-    if (keep.has(rel)) continue;
-    if (!isDeletableManifestPath(rel)) continue;
-    if (hasSymlinkComponent(workpieceRoot, rel)) {
-      skipped.push(rel);
-      continue;
-    }
-    const abs = join(workpieceRoot, rel);
-    try {
-      unlinkSync(abs);
-      dirsToPrune.add(dirname(abs));
-    } catch {
-    }
-  }
-  for (const dir of dirsToPrune) {
-    pruneEmptyDirs(dir, workpieceRoot);
-  }
-  return { skipped };
-}
-function pruneEmptyDirs(dir, stopAt) {
-  let current = dir;
-  while (current !== stopAt && current.startsWith(stopAt) && relative(stopAt, current) !== "") {
-    let entries;
-    try {
-      entries = readdirSync(current);
-    } catch {
-      return;
-    }
-    if (entries.length > 0) return;
-    try {
-      rmSync(current, { recursive: false });
-    } catch {
-      return;
-    }
-    current = dirname(current);
-  }
-}
-
-export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir };