@outerlayer/cli 0.2.0 → 0.4.1

package/dist/{emit-artifact-cmd-UQVT3OKW.js → emit-artifact-cmd-AKZP7TMF.js}

@@ -1,16 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, detectActiveSession, launchRefusalForSession, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, detectCi, appendArtifactTombstone } from './chunk-U32VSRLO.js';
-import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, resolveRepoIdentity, ARTIFACT_MAX_REPLACES_TARGETS } from './chunk-4TNZMO7V.js';
+import { staleBuildRefusal, staleBuildWarning } from './chunk-LT5TZHYH.js';
+import { detectCi } from './chunk-LYCDNMOH.js';
+import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import './chunk-TBT347UY.js';
+import './chunk-F7CU5ABH.js';
+import './chunk-BKO6JEZI.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, appendArtifactTombstone } from './chunk-WFJ65NUD.js';
+import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, resolveRepoIdentity, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-4C4THABW.js';
 import './chunk-YRYMNBGQ.js';
-import './chunk-65WXAANR.js';
+import './chunk-DVDEBNQJ.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import './chunk-5QRP3MVS.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-NXLLURA4.js';
-import './chunk-I3ETLSNE.js';
-import './chunk-YOOSBOKS.js';
-import './chunk-R5KBGVII.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-UFFXNXLQ.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { createHash, randomUUID } from 'crypto';
@@ -77,6 +88,52 @@ function prNumberFromCiEnv(env) {
   }
   return void 0;
 }
+function prHeadShaFromCiEnv(env) {
+  if (!env.GITHUB_EVENT_PATH) return void 0;
+  try {
+    const event = JSON.parse(readFileSync(env.GITHUB_EVENT_PATH, "utf8"));
+    const sha = event.pull_request?.head?.sha;
+    return typeof sha === "string" && /^[0-9a-f]{40,64}$/i.test(sha) ? sha.toLowerCase() : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function checkTestResults(params) {
+  const { file, bytes, mediaType, criterionId, rawTests, warn } = params;
+  const selection = [];
+  for (const raw of rawTests) {
+    const parsedSelector = parseTestSelector(raw);
+    if (!parsedSelector.ok) throw new EmitArtifactError(`invalid --test "${raw}" \u2014 ${parsedSelector.message}`);
+    if (selection.some((entry) => entry.name === parsedSelector.test.name)) {
+      throw new EmitArtifactError(`invalid --test \u2014 "${parsedSelector.test.name}" is named more than once`);
+    }
+    selection.push(parsedSelector.test);
+  }
+  if (selection.length > 0 && criterionId === void 0) {
+    throw new EmitArtifactError("--test names tests that prove a criterion \u2014 add --for <criterion-id>");
+  }
+  if (mediaType !== "application/xml") {
+    if (selection.length > 0) {
+      throw new EmitArtifactError(`--test needs a JUnit XML file, but ${file} is not an .xml file`);
+    }
+    return void 0;
+  }
+  if (criterionId === void 0) return void 0;
+  const parsed = parseJunit(bytes);
+  if (parsed.kind === "refused") throw new EmitArtifactError(`${file} cannot be read as test results \u2014 ${parsed.message}`);
+  if (parsed.kind === "other") {
+    if (selection.length > 0) {
+      throw new EmitArtifactError(`--test needs JUnit XML, but ${file} has no <testsuites> or <testsuite> root`);
+    }
+    return void 0;
+  }
+  const bound = bindTests(parsed, selection);
+  if (!bound.ok) throw new EmitArtifactError(`${file} has no test named "${bound.missing}"`);
+  for (const name of bound.duplicates) {
+    warn(`${file} has more than one test named "${name}"; all of them are bound, so each must pass`);
+  }
+  return selection.length > 0 ? selection : void 0;
+}
 async function runEmitArtifact(opts) {
   const env = opts.env ?? process.env;
   const refusal = staleBuildRefusal(env);
@@ -177,6 +234,17 @@ async function runEmitArtifact(opts) {
   }
   const mediaType = mediaTypeForArtifactPath(filePath);
   const kind = inferArtifactKind(mediaType);
+  const tests = checkTestResults({
+    file: opts.file,
+    bytes,
+    mediaType,
+    criterionId,
+    rawTests: opts.tests ?? [],
+    warn: (message) => {
+      if (!opts.quiet) process.stderr.write(`${YELLOW}!${RESET} ${message}
+`);
+    }
+  });
   const sha256 = createHash("sha256").update(bytes).digest("hex");
   const identity = resolveRepoIdentity(cwd);
   const sessionId = detectActiveSession({
@@ -213,7 +281,8 @@ async function runEmitArtifact(opts) {
       caption,
       ...criterionId !== void 0 ? { criterionId } : {},
       ...replacesTargets !== void 0 ? { replaces: replacesTargets[0] } : {},
-      ...replacesTargets !== void 0 && replacesTargets.length > 1 ? { replacesTargets } : {}
+      ...replacesTargets !== void 0 && replacesTargets.length > 1 ? { replacesTargets } : {},
+      ...tests !== void 0 ? { tests } : {}
     };
     try {
       appendArtifactRecord(record, home);
@@ -251,17 +320,11 @@ async function runEmitArtifact(opts) {
       "nothing to attach this to \u2014 no recorded session, no PR, and no git repo. Run inside a recorded Claude Code session, from a git checkout, in CI with PR context, or pass --pr <number>."
     );
   }
-  const fileConfig = readCloudConfig(home);
-  const url = opts.url ?? env.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? env.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
-    throw new EmitArtifactError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
-    );
-  }
+  const resolved = resolveGatewayCredentials({ ...opts, home, env });
+  if (!resolved.ok) throw new EmitArtifactError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
   const clientArtifactId = randomUUID();
+  const commitSha = prHeadShaFromCiEnv(env) ?? identity.commitSha;
   const singleTarget = replacesTargets !== void 0 && replacesTargets.length === 1 ? replacesTargets[0] : void 0;
   const targetPendingLocally = singleTarget !== void 0 && findPendingArtifactRecord(singleTarget, home) !== void 0;
   const directTargets = targetPendingLocally ? void 0 : replacesTargets;
@@ -281,13 +344,14 @@ async function runEmitArtifact(opts) {
       ...repository !== void 0 ? { repository } : {},
       ...identity.gitRepo !== void 0 ? { gitRepo: identity.gitRepo } : {},
       ...identity.gitBranch !== void 0 ? { gitBranch: identity.gitBranch } : {},
-      ...identity.commitSha !== void 0 ? { commitSha: identity.commitSha } : {},
+      ...commitSha !== void 0 ? { commitSha } : {},
       ...directTargets !== void 0 && directTargets.length > 0 ? { replaces: directTargets[0] } : {},
-      ...directTargets !== void 0 && directTargets.length > 1 ? { replacesTargets: directTargets } : {}
+      ...directTargets !== void 0 && directTargets.length > 1 ? { replacesTargets: directTargets } : {},
+      ...tests !== void 0 ? { tests } : {}
     },
     blob: { data: bytes.toString("base64") }
   };
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const endpoint = new URL("/v1/artifacts", url).toString();
   let response;
   try {
@@ -305,7 +369,7 @@ async function runEmitArtifact(opts) {
   }
   if (response.status === 401) {
     throw new EmitArtifactError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+      unauthorizedMessage(apiKey)
     );
   }
   if (!response.ok) {

package/dist/emit-cmd-DCERAU27.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { EmitError, runEmit } from './chunk-H5NCNVDA.js';
+import './chunk-WO2BXCTQ.js';
+import './chunk-EMY4I27X.js';
+import './chunk-RA3O54FC.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/emit-criteria-cmd-7MXQVCKD.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { resolveRepoIdentity, CriteriaListSchema } from './chunk-4C4THABW.js';
+import { launchedItemForSession } from './chunk-DVDEBNQJ.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-BJ3KTMDH.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+import { readFileSync } from 'fs';
+
+createRequire(import.meta.url);
+var GREEN = "\x1B[32m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+var EmitCriteriaError = class extends Error {
+};
+var REPLACE_REFUSED_MESSAGE = "this item already has a recorded list, and a person must replace it. Run the command yourself, outside the session, with your own login. A repository's .outerlayer/policy.yaml can let sessions replace it with `criteria: { replace: anyone }`.";
+async function readAllStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf8");
+}
+function valueAt(raw, path) {
+  let current = raw;
+  for (const key of path) current = current?.[key];
+  return current;
+}
+function describeIssue(raw, issue) {
+  const where = issue.path.join(".");
+  if (issue.code === "custom") return `${where}: ${issue.message}`;
+  const value = valueAt(raw, issue.path);
+  const leaf = issue.path[issue.path.length - 1];
+  if ((leaf === "id" || leaf === "proof") && value !== void 0) {
+    return `${where}: ${JSON.stringify(value)} is not accepted (${issue.message})`;
+  }
+  return `${where}: ${issue.message}`;
+}
+function parseFile(raw) {
+  const parsed = CriteriaListSchema.safeParse(raw);
+  if (parsed.success) return parsed.data;
+  const issue = parsed.error.issues[0];
+  throw new EmitCriteriaError(
+    `invalid criteria list \u2014 ${issue ? describeIssue(raw, issue) : "malformed"}`
+  );
+}
+function resolveTarget(opts) {
+  let item;
+  if (opts.item !== void 0) {
+    const number = parseTrackerNumber(opts.item);
+    if (number === void 0) throw new EmitCriteriaError(trackerNumberError("--item", opts.item));
+    item = { number };
+  }
+  const { sessionId } = opts;
+  if (sessionId !== void 0) {
+    const refusal = launchRefusalForSession(sessionId, opts.home);
+    if (refusal !== void 0) throw new EmitCriteriaError(refusal);
+  }
+  if (item !== void 0) return sessionId !== void 0 ? { item, sessionId } : { item };
+  if (sessionId === void 0) {
+    throw new EmitCriteriaError(
+      "nothing to record this on \u2014 no work item. Pass --item <number>, or run inside a recorded session launched with OUTERLAYER_WORK \u2014 its own launch record names the item automatically."
+    );
+  }
+  const launched = launchedItemForSession(sessionId, opts.home);
+  if (launched === void 0) {
+    throw new EmitCriteriaError(
+      "nothing to record this on \u2014 no work item. Pass --item <number>; this recorded session's own launch record names no item either."
+    );
+  }
+  return { item: { number: launched }, sessionId };
+}
+async function errorCode(response) {
+  let text = "";
+  try {
+    text = await response.text();
+  } catch {
+  }
+  let code = null;
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed.error?.code === "string") code = parsed.error.code;
+  } catch {
+  }
+  return { code, detail: text.replace(/\s+/g, " ").trim().slice(0, 160) };
+}
+async function runEmitCriteria(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const home = opts.home ?? homeFromEnv();
+  const env = opts.env ?? process.env;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  let text;
+  if (opts.file === "-") {
+    text = await (opts.readStdin ?? readAllStdin)();
+  } else {
+    try {
+      text = readFileSync(opts.file, "utf8");
+    } catch (err) {
+      throw new EmitCriteriaError(`cannot read "${opts.file}": ${String(err)}`);
+    }
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    throw new EmitCriteriaError(`"${opts.file}" is not valid JSON: ${String(err)}`);
+  }
+  const list = parseFile(raw);
+  const identity = resolveRepoIdentity(cwd);
+  const sessionId = detectActiveSession({
+    env,
+    home,
+    cwds: identity.repoRoot !== void 0 ? [identity.repoRoot, cwd] : [cwd],
+    nowMs: now().getTime()
+  });
+  const target = resolveTarget({ item: opts.item, sessionId, home });
+  const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, cwd, home, env });
+  if (!resolved.ok) throw new EmitCriteriaError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
+  const request = {
+    ...list,
+    item: target.item,
+    ...target.sessionId !== void 0 ? { sessionId: target.sessionId } : {}
+  };
+  const endpoint = new URL("/v1/criteria", url).toString();
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`,
+        "x-outerlayer-app-id": appId
+      },
+      body: JSON.stringify(request)
+    });
+  } catch (err) {
+    throw new EmitCriteriaError(`network error reaching ${endpoint}: ${String(err)}`);
+  }
+  if (response.status === 401) throw new EmitCriteriaError(unauthorizedMessage(apiKey));
+  if (!response.ok) {
+    const { code, detail } = await errorCode(response);
+    if (response.status === 409 && code === "criteria_replace_refused") {
+      throw new EmitCriteriaError(`refused (409): ${REPLACE_REFUSED_MESSAGE}`);
+    }
+    throw new EmitCriteriaError(`emit failed (${response.status})${detail ? `: ${detail}` : ""}`);
+  }
+  let data = {};
+  try {
+    data = (await response.json()).data ?? {};
+  } catch {
+  }
+  const count = typeof data.count === "number" ? data.count : list.criteria.length;
+  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} recorded ${count} ${count === 1 ? "criterion" : "criteria"} ${DIM}\xB7${RESET} item #${target.item.number}`;
+  if (!opts.quiet) process.stdout.write(output + "\n");
+  return { data, output, exitCode: 0 };
+}
+
+export { EmitCriteriaError, runEmitCriteria };

package/dist/{emit-finding-cmd-FDOU2OPD.js → emit-finding-cmd-N2FTGCVC.js}

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, launchRefusalForSession } from './chunk-U32VSRLO.js';
-import { FindingBatchSchema, resolveRepoIdentity } from './chunk-4TNZMO7V.js';
-import './chunk-YRYMNBGQ.js';
-import { launchedItemForSession } from './chunk-65WXAANR.js';
+import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { FindingBatchSchema, resolveRepoIdentity } from './chunk-4C4THABW.js';
+import { launchedItemForSession } from './chunk-DVDEBNQJ.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
-import './chunk-NXLLURA4.js';
-import './chunk-I3ETLSNE.js';
-import './chunk-YOOSBOKS.js';
-import './chunk-R5KBGVII.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
@@ -21,6 +22,14 @@ var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
 var EmitFindingError = class extends Error {
 };
+var REMOVED_FINDING_FLAGS = ["subject", "kind", "severity", "verdict", "fixed", "source"];
+function refuseRemovedFindingFlags(opts) {
+  const used = REMOVED_FINDING_FLAGS.find((flag) => opts[flag] !== void 0);
+  if (used === void 0) return;
+  throw new EmitFindingError(
+    `--${used} is no longer accepted: findings record problems in the factory, not review verdicts. Pass --category <context|flaky-test|tooling|environment|defect|other> instead.`
+  );
+}
 function parseItemFlag(raw) {
   if (raw === void 0) return void 0;
   const number = parseTrackerNumber(raw);
@@ -50,23 +59,19 @@ function recordFromFlags(opts) {
   const ruleLine = parseIntFlag(opts.ruleLine, "--rule-line", { min: 1 });
   const turnIndex = parseIntFlag(opts.turn, "--turn", { min: 0 });
   const round = parseIntFlag(opts.round, "--round", { min: 0 });
+  const hasRule = opts.rulePath !== void 0 || opts.ruleQuote !== void 0 || opts.ruleRelation !== void 0 || ruleLine !== void 0;
   return {
     id: opts.id,
-    subject: opts.subject,
+    category: opts.category,
     title: opts.title,
     file: opts.file,
     line: line ?? null,
-    severity: opts.severity ?? null,
-    kind: opts.kind,
-    verdict: opts.verdict,
-    fixed: opts.fixed ?? false,
-    rule: opts.rulePath !== void 0 ? {
+    rule: hasRule ? {
       path: opts.rulePath,
       line: ruleLine ?? null,
-      quote: opts.ruleQuote ?? "",
+      ...opts.ruleQuote !== void 0 ? { quote: opts.ruleQuote } : {},
       relation: opts.ruleRelation
     } : null,
-    source: opts.source,
     where: {
       label: opts.where,
       ...opts.traceId !== void 0 ? { traceId: opts.traceId } : {},
@@ -112,22 +117,15 @@ function resolveUploadTarget(opts) {
   return { item: { number: launchedNumber }, sessionId };
 }
 async function upload(batch, target, opts) {
-  const fileConfig = readCloudConfig(opts.home);
-  const url = opts.url ?? opts.env.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? opts.env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? opts.env.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
-    throw new EmitFindingError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
-    );
-  }
+  const resolved = resolveGatewayCredentials(opts);
+  if (!resolved.ok) throw new EmitFindingError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
   const request = {
     ...batch,
     item: target.item,
     ...target.sessionId !== void 0 ? { sessionId: target.sessionId } : {}
   };
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const endpoint = new URL("/v1/findings", url).toString();
   let response;
   try {
@@ -145,7 +143,7 @@ async function upload(batch, target, opts) {
   }
   if (response.status === 401) {
     throw new EmitFindingError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+      unauthorizedMessage(apiKey)
     );
   }
   if (!response.ok) {
@@ -174,7 +172,7 @@ async function runEmitFinding(opts) {
   const sessionId = detectUploadSessionId({ cwd, home, env, now });
   const contextSourceSha = opts.contextSourceSha ?? (sessionId !== void 0 ? readLatestProvenanceForSession(sessionId, home)?.sha ?? void 0 : void 0);
   const rawBatch = {
-    schemaVersion: 1,
+    schemaVersion: 2,
     ...opts.headSha !== void 0 ? { headSha: opts.headSha } : {},
     ...contextSourceSha !== void 0 ? { contextSourceSha } : {},
     findings: [recordFromFlags(opts)]
@@ -216,6 +214,11 @@ async function runEmitFindings(opts) {
   } catch (err) {
     throw new EmitFindingError(`"${opts.file}" is not valid JSON: ${String(err)}`);
   }
+  if (typeof raw === "object" && raw !== null && raw.schemaVersion === 1) {
+    throw new EmitFindingError(
+      `"${opts.file}" uses schemaVersion 1, which is no longer accepted. Use schemaVersion 2: each finding takes a category (context, flaky-test, tooling, environment, defect or other) in place of subject, kind, severity, verdict, fixed and source.`
+    );
+  }
   const parsed = FindingBatchSchema.safeParse(raw);
   if (!parsed.success) {
     throw new EmitFindingError(`invalid finding batch \u2014 ${firstIssueMessage(parsed)}`);
@@ -234,4 +237,4 @@ async function runEmitFindings(opts) {
   });
 }
 
-export { EmitFindingError, runEmitFinding, runEmitFindings };
+export { EmitFindingError, refuseRemovedFindingFlags, runEmitFinding, runEmitFindings };

package/dist/{emit-result-cmd-H2T4C2K3.js → emit-result-cmd-4CPDBMN2.js}

@@ -1,16 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, launchRefusalForSession, detectCi } from './chunk-U32VSRLO.js';
-import { EmittedNameSchema, ARTIFACT_REVIEW_CHECK_NAME, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, resolveRepoIdentity } from './chunk-4TNZMO7V.js';
+import './chunk-LT5TZHYH.js';
+import { detectCi } from './chunk-LYCDNMOH.js';
+import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import './chunk-TBT347UY.js';
+import './chunk-F7CU5ABH.js';
+import './chunk-BKO6JEZI.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import './chunk-WFJ65NUD.js';
+import { EmittedNameSchema, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, resolveRepoIdentity } from './chunk-4C4THABW.js';
 import './chunk-YRYMNBGQ.js';
-import './chunk-65WXAANR.js';
+import './chunk-DVDEBNQJ.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import './chunk-5QRP3MVS.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-NXLLURA4.js';
-import './chunk-I3ETLSNE.js';
-import './chunk-YOOSBOKS.js';
-import './chunk-R5KBGVII.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-UFFXNXLQ.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { randomUUID } from 'crypto';
@@ -53,23 +64,7 @@ async function runEmitResult(opts) {
       `invalid name "${opts.name}" \u2014 an emit name is 1-64 characters: a lowercase letter followed by lowercase letters, digits, ".", "_" or "-" (e.g. smoke.pass)`
     );
   }
-  const isArtifactReview = opts.name === ARTIFACT_REVIEW_CHECK_NAME;
-  const artifactId = opts.artifact === "" ? void 0 : opts.artifact;
-  if (isArtifactReview) {
-    if (artifactId === void 0) {
-      throw new EmitResultError(
-        `--artifact <id> is required for ${ARTIFACT_REVIEW_CHECK_NAME} \u2014 it names which artifact this verdict is on`
-      );
-    }
-  } else if (artifactId !== void 0) {
-    throw new EmitResultError(`--artifact is only accepted with ${ARTIFACT_REVIEW_CHECK_NAME}`);
-  }
   const link = opts.link === "" ? void 0 : opts.link;
-  if (isArtifactReview && link !== void 0) {
-    throw new EmitResultError(
-      `--link is refused for ${ARTIFACT_REVIEW_CHECK_NAME} \u2014 an artifact verdict is a judgment on evidence already on file, never a run to point at; pass --body / --body-file instead`
-    );
-  }
   if (link !== void 0) {
     if (!link.startsWith("http://") && !link.startsWith("https://")) {
       throw new EmitResultError(`invalid --link "${link}" \u2014 expected an http:// or https:// URL`);
@@ -100,8 +95,6 @@ async function runEmitResult(opts) {
     body = opts.body;
   } else if (opts.bodyFile !== void 0) {
     body = await readBodyFile(opts.bodyFile, opts.readStdin);
-  } else if (isArtifactReview && result === "fail") {
-    body = await (opts.readStdin ?? readAllStdin)();
   }
   if (body !== void 0) {
     body = body.trim();
@@ -116,13 +109,7 @@ async function runEmitResult(opts) {
       );
     }
   }
-  if (isArtifactReview) {
-    if (result === "fail" && body === void 0) {
-      throw new EmitResultError(
-        `a failing artifact verdict needs a sentence \u2014 pass --body or --body-file with one sentence saying what is wrong`
-      );
-    }
-  } else if (result === "fail" && link === void 0 && body === void 0) {
+  if (result === "fail" && link === void 0 && body === void 0) {
     throw new EmitResultError(
       `a failing check needs something to act on \u2014 pass --link with the run URL, or --body / --body-file with one sentence saying what is wrong`
     );
@@ -135,37 +122,23 @@ async function runEmitResult(opts) {
     cwds: identity.repoRoot !== void 0 ? [identity.repoRoot, cwd] : [cwd],
     nowMs: now().getTime()
   });
-  if (isArtifactReview && sessionId !== void 0) {
+  if (item === void 0 && sessionId === void 0) {
     throw new EmitResultError(
-      "an artifact verdict is a person's act \u2014 record it with a person's API key, outside a recorded session."
+      "nothing to attach this to \u2014 no work item. Pass --item <number>; a recorded session alone does not name one."
     );
   }
-  if (!isArtifactReview) {
-    if (item === void 0 && sessionId === void 0) {
-      throw new EmitResultError(
-        "nothing to attach this to \u2014 no work item. Pass --item <number>; a recorded session alone does not name one, and a session with no --item is always refused as self-judgment."
-      );
-    }
-    if (sessionId !== void 0) {
-      const refusal = launchRefusalForSession(sessionId, home);
-      if (refusal !== void 0) throw new EmitResultError(refusal);
-    }
-    if (item === void 0 && sessionId !== void 0) {
-      throw new EmitResultError(
-        "a session records a check only on a work item it was not launched for, named with --item \u2014 the item this session was launched for needs a machine key (an API key run outside the recorded session) or CI."
-      );
-    }
+  if (sessionId !== void 0) {
+    const refusal = launchRefusalForSession(sessionId, home);
+    if (refusal !== void 0) throw new EmitResultError(refusal);
   }
-  const fileConfig = readCloudConfig(home);
-  const url = opts.url ?? env.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? env.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
+  if (item === void 0) {
     throw new EmitResultError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
+      "nothing to attach this to \u2014 no work item. Pass --item <number>; a recorded session alone does not name one."
     );
   }
+  const resolved = resolveGatewayCredentials({ ...opts, home, env });
+  if (!resolved.ok) throw new EmitResultError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
   const ci = detectCi(env);
   const request = {
     schemaVersion: 1,
@@ -178,11 +151,10 @@ async function runEmitResult(opts) {
       emittedAt: now().toISOString(),
       ...ci ? { ci: true } : {},
       ...sessionId !== void 0 ? { sessionId } : {},
-      ...item !== void 0 ? { item } : {},
-      ...isArtifactReview ? { artifactId } : {}
+      ...item !== void 0 ? { item } : {}
     }
   };
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const endpoint = new URL("/v1/emitted-results", url).toString();
   let response;
   try {
@@ -200,7 +172,7 @@ async function runEmitResult(opts) {
   }
   if (response.status === 401) {
     throw new EmitResultError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+      unauthorizedMessage(apiKey)
     );
   }
   if (!response.ok) {
@@ -216,7 +188,7 @@ async function runEmitResult(opts) {
     data = (await response.json()).data ?? {};
   } catch {
   }
-  const anchorLabel = isArtifactReview ? `artifact ${artifactId}` : `item #${item.number}`;
+  const anchorLabel = `item #${item.number}`;
   const recordedId = typeof data.id === "string" ? data.id : "";
   const idSuffix = recordedId ? ` ${DIM}\xB7${RESET} ${recordedId}` : "";
   const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} emitted ${opts.name} (${result}) ${DIM}\xB7${RESET} ${anchorLabel}${idSuffix}`;

package/dist/exec-client-4XGXV3XN.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { CAPTURE_LIMIT_BYTES, ExecConnectionError, HANDSHAKE_TIMEOUT_MS, execCapture, runExec, runVmExec, vmExecArgs, waitForAgent } from './chunk-W4SQCOZU.js';
+import './chunk-B2G7JHHB.js';
+import './chunk-AUFG23AA.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/guest-init-GENRHNP7.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit } from './chunk-CBPPJSAR.js';
+import './chunk-B2G7JHHB.js';
+import './chunk-AUFG23AA.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);