@outerlayer/cli 0.2.0 → 0.4.0

package/dist/chunk-WO2BXCTQ.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { splitRawFile } from './chunk-EMY4I27X.js';
+import { resolvePackageVersion } from './chunk-RA3O54FC.js';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+
+createRequire(import.meta.url);
+var TEMPLATE_SKILLS = ["spec", "writing-specs", "build"];
+var MAINTAINED_SKILLS = ["emitting-evidence", "amend", "reporting-findings", "outerlayer"];
+var TEMPLATE_CLASS_LINE = "<!-- yours to edit. Copied once from the default template by outerlayer init; never overwritten. -->";
+function maintainedClassLine(version) {
+  return `<!-- maintained by OuterLayer ${version}. Edits are overwritten on the next outerlayer context emit. -->`;
+}
+function resolvePackRoot(entryPath = fileURLToPath(import.meta.url)) {
+  return join(dirname(dirname(entryPath)), "skill-pack");
+}
+function skillDir(skill) {
+  return `.outerlayer/skills/${skill}`;
+}
+function renderSkillFile(skillClass, content, version) {
+  const line = skillClass === "maintained" ? maintainedClassLine(version) : TEMPLATE_CLASS_LINE;
+  const { frontmatterInner, body } = splitRawFile(content);
+  if (frontmatterInner === null) return `${line}
+${content}`;
+  const block = content.slice(0, content.length - body.length);
+  return `${block}${block.endsWith("\n") ? "" : "\n"}${line}
+${body}`;
+}
+function filesUnder(dir, base = dir) {
+  const out = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const abs = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...filesUnder(abs, base));
+    else if (entry.isFile()) out.push(abs.slice(base.length + 1).split("\\").join("/"));
+  }
+  return out.sort();
+}
+function orderSkillFiles(relPaths) {
+  return [...relPaths.filter((p) => p === "SKILL.md"), ...relPaths.filter((p) => p !== "SKILL.md")];
+}
+function loadClass(packRoot, skillClass, names, version) {
+  const files = [];
+  for (const skill of names) {
+    const dir = join(packRoot, skillClass, skill);
+    if (!existsSync(dir)) throw new Error(`skill pack is missing ${skillClass}/${skill} under ${packRoot}`);
+    for (const rel of orderSkillFiles(filesUnder(dir))) {
+      const raw = readFileSync(join(dir, rel), "utf8");
+      files.push({
+        skill,
+        skillClass,
+        path: `${skillDir(skill)}/${rel}`,
+        content: rel === "SKILL.md" ? renderSkillFile(skillClass, raw, version) : raw
+      });
+    }
+  }
+  return files;
+}
+function loadTemplateFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion()) {
+  return loadClass(packRoot, "template", TEMPLATE_SKILLS, version);
+}
+function loadMaintainedFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion()) {
+  return loadClass(packRoot, "maintained", MAINTAINED_SKILLS, version);
+}
+function writeMaintainedFiles(repoRoot, files) {
+  const created = [];
+  const rewritten = [];
+  for (const file of files) {
+    const abs = join(repoRoot, file.path);
+    const exists = existsSync(abs);
+    if (exists && readFileSync(abs, "utf8") === file.content) continue;
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, file.content);
+    (exists ? rewritten : created).push(file.path);
+  }
+  return { created, rewritten };
+}
+function maintainedFilesForExistingSkills(repoRoot, files) {
+  return files.filter((file) => existsSync(join(repoRoot, skillDir(file.skill))));
+}
+
+export { MAINTAINED_SKILLS, TEMPLATE_SKILLS, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, resolvePackRoot, skillDir, writeMaintainedFiles };

package/dist/{chunk-I3ETLSNE.js → chunk-XCCLFVXM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { readFileSync, readdirSync, existsSync, mkdirSync, writeFileSync, unlinkSync, chmodSync } from 'fs';
+import { mkdirSync, chmodSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync } from 'fs';
 import { join, isAbsolute, dirname, basename, resolve } from 'path';
 import { execFileSync } from 'child_process';
 
@@ -74,8 +74,103 @@ function contextExcludesPresent(gitCommonDir) {
   if (beginIdx === -1) return false;
   return BLOCK_LINES.every((l, i) => lines[beginIdx + i] === l);
 }
-var JOURNAL_HOOK_MARKER = "# outerlayer post-rewrite journal";
+var HOOKS_DIR_NAME = "git-hooks";
+var CO_AUTHOR_FILE = "co-author";
+var HOOKS = [
+  "applypatch-msg",
+  "pre-applypatch",
+  "post-applypatch",
+  "pre-commit",
+  "pre-merge-commit",
+  "prepare-commit-msg",
+  "commit-msg",
+  "post-commit",
+  "pre-rebase",
+  "post-checkout",
+  "post-merge",
+  "pre-push",
+  "pre-receive",
+  "update",
+  "post-receive",
+  "post-update",
+  "reference-transaction",
+  "pre-auto-gc",
+  "post-rewrite",
+  "sendemail-validate",
+  "post-index-change"
+];
+var READS_STDIN = /* @__PURE__ */ new Set(["pre-push", "pre-receive", "post-receive", "reference-transaction", "post-rewrite"]);
 var PRE_COMMIT_GUARD_MARKER = "# outerlayer materialized-context commit guard";
+var RUN_GUARD = `common=$(git rev-parse --git-common-dir 2>/dev/null)
+guard=$common/hooks/pre-commit
+if [ "$guard" != "$hook" ] && [ -f "$guard" ] && [ -x "$guard" ] &&
+  sed -n 2p "$guard" | grep -q '^${PRE_COMMIT_GUARD_MARKER}'; then
+  "$guard" "$@" || exit $?
+fi
+`;
+var ADD_TRAILER = `
+# Every commit of the build names the requester once: a trailer already there is left alone.
+file=\${1-}
+if [ -n "$file" ] && [ -f "$file" ]; then
+  git interpret-trailers --in-place --if-exists addIfDifferent --trailer "Co-authored-by: $(cat "$here/${CO_AUTHOR_FILE}")" "$file" ||
+    echo "outerlayer: could not add the co-author line to the commit message" >&2
+fi
+`;
+var HOOK_WRAPPER_MARKER = "# Written by the OuterLayer runner.";
+function script(name) {
+  const adds = name === "prepare-commit-msg";
+  return `#!/bin/sh
+${HOOK_WRAPPER_MARKER} Runs the repository's own ${name} hook, then
+# ${adds ? "adds the co-author line to the commit message" : "hands its status on"}.
+here=$(dirname "$0")
+
+# The hooks path git would use without this directory: cut the list of configuration
+# entries the runner passes just before its own core.hooksPath entry, then ask git.
+n=\${GIT_CONFIG_COUNT-0}
+case $n in '' | *[!0-9]*) n=0 ;; esac
+cut=$n
+i=$n
+while [ "$i" -gt 0 ]; do
+  i=$((i - 1))
+  eval "key=\\\${GIT_CONFIG_KEY_$i-}"
+  eval "value=\\\${GIT_CONFIG_VALUE_$i-}"
+  if [ "$key" = core.hooksPath ] && { [ "$value" = "$here" ] || [ "$value" -ef "$here" ]; }; then
+    cut=$i
+    break
+  fi
+done
+path=$(GIT_CONFIG_COUNT=$cut git config --type=path core.hooksPath 2>/dev/null) || path=
+if [ -z "$path" ]; then
+  path=$(git rev-parse --git-common-dir 2>/dev/null)/hooks
+fi
+
+hook=$path/${name}
+${name === "pre-commit" ? RUN_GUARD : ""}status=0
+if [ "$path" -ef "$here" ] || [ ! -f "$hook" ] || [ ! -x "$hook" ]; then
+${READS_STDIN.has(name) ? "  cat >/dev/null\n" : ""}  :
+else
+${adds ? `  "$hook" "$@" || status=$?` : `  exec "$hook" "$@"`}
+fi
+${adds ? `[ "$status" -eq 0 ] || exit "$status"
+${ADD_TRAILER}` : ""}exit 0
+`;
+}
+function writeCommitHooks(buildDir, coAuthor) {
+  const dir = join(buildDir, HOOKS_DIR_NAME);
+  mkdirSync(dir, { recursive: true });
+  chmodSync(dir, 493);
+  for (const name of HOOKS) {
+    const path = join(dir, name);
+    writeFileSync(path, script(name));
+    chmodSync(path, 493);
+  }
+  const data = join(dir, CO_AUTHOR_FILE);
+  writeFileSync(data, `${coAuthor.name} <${coAuthor.email}>
+`);
+  chmodSync(data, 420);
+  return dir;
+}
+var JOURNAL_HOOK_MARKER = "# outerlayer post-rewrite journal";
 var PRE_COMMIT_GUARD_VERSION = `${PRE_COMMIT_GUARD_MARKER} v1`;
 var PRE_COMMIT_GUARD_BODY_SIGNATURE = "outerlayer: refusing to commit materialized control-plane context";
 var PRE_COMMIT_GUARD_SCRIPT = `#!/bin/sh
@@ -114,8 +209,8 @@ exit 1
 function managedHookScripts() {
   return [["pre-commit", printableHookScript(PRE_COMMIT_GUARD_SCRIPT)]];
 }
-function printableHookScript(script) {
-  const lines = script.split("\n");
+function printableHookScript(script2) {
+  const lines = script2.split("\n");
   return [lines[0], ...lines.slice(2)].join("\n");
 }
 function git(cwd, args) {
@@ -141,7 +236,7 @@ function commonHooksDir(cwd) {
   if (rel === void 0) return void 0;
   return join(isAbsolute(rel) ? rel : join(cwd, rel), "hooks");
 }
-function installHookFile(dir, name, script, marker) {
+function installHookFile(dir, name, script2, marker) {
   const path = join(dir, name);
   let existing;
   try {
@@ -151,7 +246,7 @@ function installHookFile(dir, name, script, marker) {
   }
   if (existing !== void 0) {
     if (!isOwnRecognitionLine(existing, marker)) return "skipped-foreign";
-    if (existing === script) {
+    if (existing === script2) {
       try {
         chmodSync(path, 493);
       } catch {
@@ -160,7 +255,7 @@ function installHookFile(dir, name, script, marker) {
     }
   }
   mkdirSync(dir, { recursive: true });
-  writeFileSync(path, script);
+  writeFileSync(path, script2);
   chmodSync(path, 493);
   return existing === void 0 ? "installed" : "updated";
 }
@@ -237,15 +332,29 @@ function expandHooksPathTilde(hooksPath) {
 }
 function ensurePreCommitGuardHook(repoRoot, gitCommonDir) {
   const hooksPath = git(repoRoot, ["config", "core.hooksPath"]) ?? "";
-  if (hooksPath !== "") {
+  if (hooksPath !== "" && !isRunnerHookWrapper(hooksPath, repoRoot)) {
     const expanded = expandHooksPathTilde(hooksPath);
     const effectivePath = isAbsolute(expanded) ? join(expanded, "pre-commit") : join(repoRoot, expanded, "pre-commit");
     return { status: "skipped-custom-hooks-path", adopted: guardAdoptedAtEffectiveHook(effectivePath) };
   }
+  return installPreCommitGuardInGitDir(gitCommonDir);
+}
+function installPreCommitGuardInGitDir(gitCommonDir) {
   const path = join(gitCommonDir, "hooks", "pre-commit");
   const status = installHookFile(join(gitCommonDir, "hooks"), "pre-commit", PRE_COMMIT_GUARD_SCRIPT, PRE_COMMIT_GUARD_MARKER);
   return { status, adopted: status === "skipped-foreign" ? guardBodyPresent(path) : true };
 }
+function isRunnerHookWrapper(hooksPath, repoRoot) {
+  const dir = resolve(repoRoot, expandHooksPathTilde(hooksPath));
+  if (basename(dir) !== HOOKS_DIR_NAME) return false;
+  try {
+    const script2 = readFileSync(join(dir, "pre-commit"), "utf8");
+    const secondLine = script2.indexOf("\n") + 1;
+    return secondLine > 0 && script2.startsWith(HOOK_WRAPPER_MARKER, secondLine);
+  } catch {
+    return false;
+  }
+}
 function deadHooksState(cwd) {
   const inRepo = git(cwd, ["rev-parse", "--is-inside-work-tree"]);
   if (inRepo !== "true") return { dead: false };
@@ -282,11 +391,11 @@ function preparePackageManagerCommand(repoRoot) {
 function huskyPrepareScript(repoRoot) {
   try {
     const pkg = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf8"));
-    const script = pkg.scripts?.prepare;
-    if (typeof script === "string" && /husky/i.test(script)) return script;
+    const script2 = pkg.scripts?.prepare;
+    if (typeof script2 === "string" && /husky/i.test(script2)) return script2;
   } catch {
   }
   return null;
 }
 
-export { contextExcludesPresent, deadHooksState, ensureContextExcludes, ensurePreCommitGuardHook, huskyPrepareScript, installPreCommitGuardHook, managedHookScripts, preparePackageManagerCommand, removeJournalHooks, removePreCommitGuardHook };
+export { HOOKS_DIR_NAME, contextExcludesPresent, deadHooksState, ensureContextExcludes, ensurePreCommitGuardHook, huskyPrepareScript, installPreCommitGuardHook, installPreCommitGuardInGitDir, managedHookScripts, preparePackageManagerCommand, removeJournalHooks, removePreCommitGuardHook, writeCommitHooks };

package/dist/{context-materialize-6WKT3RBQ.js → chunk-XDDW4FRS.js}

@@ -1,17 +1,55 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readPin, pinExists, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, readContextManifest, isLastCheckFresh, manifestFilesPresent, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-A3WLZX2F.js';
-import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH } from './chunk-KFYJV2ZG.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WIOZAJ2W.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-WO2BXCTQ.js';
+import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-EMY4I27X.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-I3ETLSNE.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import './chunk-Z5GEFMRW.js';
 import { execFileSync } from 'child_process';
-import { existsSync, mkdirSync, writeFileSync, chmodSync, unlinkSync, readdirSync, rmSync, lstatSync } from 'fs';
-import { isAbsolute, join, dirname, relative } from 'path';
+import { lstatSync, existsSync, mkdirSync, writeFileSync, chmodSync, unlinkSync, readdirSync, rmSync, readFileSync, copyFileSync } from 'fs';
+import { join, isAbsolute, dirname, relative } from 'path';
 
 createRequire(import.meta.url);
+var CONFIG_PATH = ".outerlayer/config.json";
+var CONTENT_KINDS = /* @__PURE__ */ new Set(["skill", "skill-reference"]);
+function overlayMaintainedSkills(repoRoot, unsafe) {
+  const sources = loadMaintainedFiles().filter((file) => !unsafe(file.path));
+  writeMaintainedFiles(repoRoot, sources);
+  const paths = sources.map((file) => file.path);
+  const configAbs = join(repoRoot, CONFIG_PATH);
+  if (!existsSync(configAbs)) return paths;
+  const config = parseOuterlayerConfig(readFileSync(configAbs, "utf8"));
+  if (!config.ok || !config.config) return paths;
+  const { entries } = classifyTree(sources.map((file) => file.path));
+  const input = {
+    entries,
+    contents: new Map(entries.filter((e) => CONTENT_KINDS.has(e.kind)).map((e) => [e.path, sources.find((f) => f.path === e.path).content])),
+    assetPaths: [],
+    targets: config.config.targets
+  };
+  const compiled = emitTree(input);
+  if (compiled.errors.length > 0) return paths;
+  for (const file of compiled.files) {
+    if (unsafe(file.path)) continue;
+    const abs = join(repoRoot, file.path);
+    mkdirSync(dirname(abs), { recursive: true });
+    if (!existsSync(abs) || readFileSync(abs, "utf8") !== file.content) writeFileSync(abs, file.content);
+    paths.push(file.path);
+  }
+  for (const copy of compiled.copies) {
+    if (unsafe(copy.toPath)) continue;
+    const abs = join(repoRoot, copy.toPath);
+    mkdirSync(dirname(abs), { recursive: true });
+    copyFileSync(join(repoRoot, copy.fromSourcePath), abs);
+    paths.push(copy.toPath);
+  }
+  return paths;
+}
+
+// src/context-materialize.ts
 var defaultGitRunner = (args, opts) => {
   try {
     const stdout = execFileSync("git", args, {
@@ -54,8 +92,11 @@ function gitText(git, cwd, args, timeoutMs) {
 var NOT_GOVERNED_MESSAGE = "this repository's control plane no longer governs it";
 var ADOPTION_MESSAGE = "committed context files shadow the control plane \u2014 remove them in a commit";
 var CANNOT_IDENTIFY_MESSAGE = "this repository is governed, but the control plane cannot be identified \u2014 check OuterLayer connectivity/config";
-var DESIGNATION_AUTH_REJECTED_MESSAGE = "the OuterLayer API key was rejected (401/403) \u2014 check apiKey in ~/.outerlayer/config.json";
+function designationAuthRejectedMessage(credential) {
+  return credential.startsWith("olu_") ? "the OuterLayer login was rejected (401/403) \u2014 run `outerlayer login` to sign in again" : "the OuterLayer API key was rejected (401/403) \u2014 check apiKey in ~/.outerlayer/config.json";
+}
 var PARTIAL_WRITE_MESSAGE = "control-plane content could not be fully written \u2014 running on previous context";
+var OVERLAY_FAILED_MESSAGE = "control-plane content was written but the maintained skills could not be refreshed \u2014 retrying next session";
 var COMMIT_GUARD_FOREIGN_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 a pre-commit hook this clone did not write occupies that slot \u2014 resolve the conflict or run `outerlayer hooks install-git`";
 var COMMIT_GUARD_HOOKSPATH_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 hooks are managed via core.hooksPath, which this clone never writes to automatically \u2014 adopt it yourself: `outerlayer hooks install-git --print`";
 function guardNotInstalledMessage(guard) {
@@ -100,7 +141,7 @@ async function materializeContext(deps) {
   const home = deps.home ?? homeFromEnv();
   const now = deps.now ?? Date.now;
   const git = deps.git ?? defaultGitRunner;
-  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fetchImpl = deps.fetchImpl ?? defaultFetch;
   const repoRoot = gitText(git, deps.cwd, ["rev-parse", "--show-toplevel"], 2e3);
   if (repoRoot === void 0) {
     return { status: "not-a-repo", sha: null, verification: "none" };
@@ -125,34 +166,53 @@ async function materializeContext(deps) {
     clearDegraded(gitCommonDir);
     return { status: "self", sha: null, verification: "none" };
   };
+  const hold = readBuildHold(gitCommonDir);
+  if (hold !== void 0) {
+    const heldManifest = readContextManifest(gitCommonDir);
+    if (heldManifest !== void 0 && heldManifest.sha === hold.sha && pin?.sha === hold.sha && manifestFilesPresent(repoRoot, heldManifest)) {
+      ensureContextExcludes(gitCommonDir);
+      recordMaintainedOverlay(repoRoot, gitCommonDir, heldManifest);
+      const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
+      record(hold.sha, "verified", hold.repository, hold.ref);
+      return {
+        status: "debounced",
+        sha: hold.sha,
+        verification: "verified",
+        ...guardMessage2 ? { message: guardMessage2 } : {}
+      };
+    }
+  }
   const ownRepoName = deriveOwnRepoName(git, repoRoot);
   if (ownRepoName === void 0) {
     return selfOutcome();
   }
-  const designation = await resolveDesignation({ git, fetchImpl, home, now, gitCommonDir, ownRepoName });
+  const designation = await resolveDesignation({ git, fetchImpl, home, cloud: deps.cloud, now, gitCommonDir, ownRepoName, repoRoot });
+  const answered = { designation: "answered" };
   if (designation.status === "self") {
-    return selfOutcome();
+    return { ...selfOutcome(), ...answered };
   }
   if (designation.status === "unknown") {
-    const message = designation.authRejected ? DESIGNATION_AUTH_REJECTED_MESSAGE : CANNOT_IDENTIFY_MESSAGE;
+    const message = designation.authRejected ?? CANNOT_IDENTIFY_MESSAGE;
     if (hasPin) {
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
       record(null, "none");
-      return { status: "designation-unverified", message, sha: null, verification: "none" };
+      return { status: "designation-unverified", message, sha: null, verification: "none", designation: "unknown" };
     }
     if (designation.authRejected) {
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
     }
     writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_RETRY_MS });
-    return { status: "self", sha: null, verification: "none" };
+    return { status: "self", sha: null, verification: "none", designation: "unknown", ...designation.authRejected ? { authRejected: true } : {} };
   }
   let repository;
   let ref;
   let unverifiedIdentity;
   let preFetched;
+  let unreadableCandidates = [];
   if (designation.status === "candidates") {
     const sortedCandidates = [...designation.candidates].sort((a, b) => a.repository.localeCompare(b.repository));
     const claimants = [];
+    const unfetched = [];
     for (const candidate of sortedCandidates) {
       const candidateUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(candidate.repository, candidate.ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, candidate.repository);
       const candidateHost = parseRemoteHost(candidateUrl).host || "unknown-host";
@@ -162,9 +222,15 @@ async function materializeContext(deps) {
         cwd: candidateCacheDir,
         timeoutMs: 1e4
       });
-      if (!candidateFetch.ok) continue;
+      if (!candidateFetch.ok) {
+        unfetched.push(candidate.repository);
+        continue;
+      }
       const candidateSha = gitText(git, candidateCacheDir, ["rev-parse", candidateLocalRef], 2e3);
-      if (candidateSha === void 0) continue;
+      if (candidateSha === void 0) {
+        unfetched.push(candidate.repository);
+        continue;
+      }
       const candidateConfig = readBlobAtPath(git, candidateCacheDir, candidateSha, CONTEXT_SOURCE_CONFIG_PATH);
       const candidateGoverns = candidateConfig === void 0 ? { governs: [] } : parseGoverns(candidateConfig);
       const candidateGovernsList = "error" in candidateGoverns ? [] : candidateGoverns.governs;
@@ -174,7 +240,7 @@ async function materializeContext(deps) {
     }
     if (claimants.length === 0) {
       writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
-      return selfOutcome();
+      return { ...selfOutcome(), ...answered, ...unfetched.length > 0 ? { unfetched } : {} };
     }
     if (claimants.length > 1) {
       const names = claimants.map((c) => c.repository).sort();
@@ -186,6 +252,7 @@ async function materializeContext(deps) {
       record(lastGood, verification);
       return { status: "conflict", message, sha: lastGood, verification };
     }
+    unreadableCandidates = unfetched;
     const winner = claimants[0];
     writeSourceCache(gitCommonDir, {
       checkedAt: new Date(now()).toISOString(),
@@ -227,6 +294,7 @@ async function materializeContext(deps) {
       const degraded = readDegraded(gitCommonDir);
       const verification = degraded ? "unverified" : "verified";
       ensureContextExcludes(gitCommonDir);
+      recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
       const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
       record(manifest.sha, verification, repository, ref);
       return {
@@ -255,6 +323,7 @@ async function materializeContext(deps) {
         touchLastCheck(gitCommonDir, now());
         clearOrFlagIdentity();
         ensureContextExcludes(gitCommonDir);
+        recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
         const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
         writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "governed", repository, ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
         record(remoteSha, "verified", repository, ref);
@@ -335,14 +404,36 @@ async function materializeContext(deps) {
   if (!writeResult.ok) {
     return partialWrite();
   }
-  const deleteResult = manifest ? deleteRemovedFiles(repoRoot, manifest.files, writeResult.writtenPaths) : { skipped: [] };
+  let overlayPaths = [];
+  let overlayFailed = false;
+  try {
+    overlayPaths = overlayMaintainedSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel));
+  } catch {
+    overlayFailed = true;
+  }
+  const writtenPaths = [.../* @__PURE__ */ new Set([...writeResult.writtenPaths, ...overlayPaths])];
+  const deleteResult = manifest ? deleteRemovedFiles(repoRoot, manifest.files, writtenPaths) : { skipped: [] };
+  if (overlayFailed && deleteResult.skipped.length === 0) {
+    writeContextManifest(gitCommonDir, { schemaVersion: 1, sha, files: writtenPaths, materializedAt: new Date(now()).toISOString() });
+    writeDegraded(gitCommonDir, {
+      at: new Date(now()).toISOString(),
+      kind: "unreachable",
+      message: OVERLAY_FAILED_MESSAGE,
+      repository,
+      ref,
+      lastGoodSha: sha
+    });
+    if (!evidenced) return { status: "unreachable", sha: null, verification: "none" };
+    record(sha, "unverified", repository, ref);
+    return { status: "unreachable", message: OVERLAY_FAILED_MESSAGE, sha, verification: "unverified" };
+  }
   if (deleteResult.skipped.length > 0) {
     return partialWrite();
   }
   const newManifest = {
     schemaVersion: 1,
     sha,
-    files: writeResult.writtenPaths,
+    files: writtenPaths,
     materializedAt: new Date(now()).toISOString()
   };
   writeContextManifest(gitCommonDir, newManifest);
@@ -357,23 +448,40 @@ async function materializeContext(deps) {
     status: "materialized",
     sha,
     verification: "verified",
-    ...guardMessage ? { message: guardMessage } : {}
+    ...guardMessage ? { message: guardMessage } : {},
+    ...unreadableCandidates.length > 0 ? { unfetched: unreadableCandidates } : {}
   };
 }
+function recordMaintainedOverlay(repoRoot, gitCommonDir, manifest) {
+  let overlayPaths;
+  try {
+    overlayPaths = overlayMaintainedSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel));
+  } catch {
+    return;
+  }
+  const known = new Set(manifest.files);
+  const added = overlayPaths.filter((path) => !known.has(path));
+  if (added.length > 0) writeContextManifest(gitCommonDir, { ...manifest, files: [...manifest.files, ...added] });
+}
 async function resolveDesignation(ctx) {
   const cache = readSourceCache(ctx.gitCommonDir);
   if (cache && isSourceCacheFresh(cache, ctx.now())) {
     return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref } : { status: "self" };
   }
-  let authRejected = false;
-  const config = readCloudConfig(ctx.home);
-  if (config.url && config.apiKey && config.appId) {
+  let authRejected;
+  const destination = resolveGatewayCredentials({
+    home: ctx.home,
+    env: {},
+    cwd: ctx.repoRoot,
+    ...ctx.cloud === void 0 ? {} : { url: ctx.cloud.url, apiKey: ctx.cloud.apiKey, appId: ctx.cloud.appId }
+  });
+  if (destination.ok) {
     const sources = await fetchContextSource(
-      config,
+      { url: destination.url, apiKey: destination.credential, appId: destination.appId },
       ctx.ownRepoName,
       ctx.fetchImpl,
       () => {
-        authRejected = true;
+        authRejected = designationAuthRejectedMessage(destination.credential);
       }
     );
     if (sources !== void 0) {
@@ -586,4 +694,4 @@ function pruneEmptyDirs(dir, stopAt) {
   }
 }
 
-export { defaultGitRunner, materializeContext, parseOwnerRepo, parseRemoteHost };
+export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir };

package/dist/chunk-YYYXRJUW.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
+import { join, basename, sep, resolve } from 'path';
+
+createRequire(import.meta.url);
+var PACKAGE_PATH = join("node_modules", "@outerlayer", "cli");
+var STAGING_PREFIX = ".staging-";
+function versionsDir(configPath) {
+  return join(runnerDir(configPath), "versions");
+}
+function versionDir(configPath, version) {
+  return join(versionsDir(configPath), version);
+}
+function stagingDir(configPath, version) {
+  return join(versionsDir(configPath), `${STAGING_PREFIX}${version}`);
+}
+function currentLink(configPath) {
+  return join(runnerDir(configPath), "current");
+}
+function markerPath(configPath) {
+  return join(runnerDir(configPath), "update-marker.json");
+}
+function packageRootIn(dir) {
+  return join(dir, PACKAGE_PATH);
+}
+function entryIn(dir) {
+  return join(packageRootIn(dir), "dist", "index.js");
+}
+function currentVersion(configPath) {
+  try {
+    return basename(readlinkSync(currentLink(configPath)));
+  } catch {
+    return void 0;
+  }
+}
+function isInLayout(configPath, entryPath) {
+  try {
+    const versions = realpathSync(versionsDir(configPath));
+    return realpathSync(entryPath).startsWith(`${versions}${sep}`);
+  } catch {
+    return false;
+  }
+}
+function startedThroughCurrent(configPath, entryPath) {
+  const parts = resolve(entryPath).split(sep);
+  const at = parts.lastIndexOf("current");
+  if (at <= 0 || parts.slice(at + 1).join(sep) !== join(PACKAGE_PATH, "dist", "index.js")) return false;
+  try {
+    return realpathSync(parts.slice(0, at).join(sep) || sep) === realpathSync(runnerDir(configPath));
+  } catch {
+    return false;
+  }
+}
+function switchCurrent(configPath, version) {
+  mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  const temporary = `${currentLink(configPath)}.new`;
+  try {
+    unlinkSync(temporary);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  symlinkSync(versionDir(configPath, version), temporary);
+  renameSync(temporary, currentLink(configPath));
+}
+function readMarker(configPath) {
+  try {
+    const parsed = JSON.parse(readFileSync(markerPath(configPath), "utf8"));
+    if (typeof parsed.from !== "string" || typeof parsed.to !== "string") return void 0;
+    return { from: parsed.from, to: parsed.to, starts: typeof parsed.starts === "number" && Number.isInteger(parsed.starts) ? parsed.starts : 0 };
+  } catch {
+    return void 0;
+  }
+}
+function writeMarker(configPath, marker) {
+  mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  const temporary = `${markerPath(configPath)}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(marker)}
+`, { mode: RUNNER_FILE_MODE });
+  renameSync(temporary, markerPath(configPath));
+}
+function removeMarker(configPath) {
+  rmSync(markerPath(configPath), { force: true });
+}
+function cleanVersions(configPath, keep) {
+  const dir = versionsDir(configPath);
+  if (!existsSync(dir)) return;
+  for (const name of readdirSync(dir)) {
+    if (keep.includes(name)) continue;
+    rmSync(join(dir, name), { recursive: true, force: true });
+  }
+}
+function execStartCommand(configPath, nodePath) {
+  return `${nodePath} ${join(currentLink(configPath), "node_modules", "@outerlayer", "cli", "dist", "index.js")} runner start --config ${configPath}`;
+}
+function execStartLine(configPath, nodePath) {
+  return `ExecStart=${execStartCommand(configPath, nodePath)}`;
+}
+
+export { cleanVersions, currentVersion, entryIn, execStartCommand, execStartLine, isInLayout, packageRootIn, readMarker, removeMarker, stagingDir, startedThroughCurrent, switchCurrent, versionDir, writeMarker };