@outerlayer/cli 0.22.0 → 0.22.2

package/skill-pack/maintained/outerlayer-amend/SKILL.md

@@ -3,9 +3,10 @@ name: outerlayer-amend
 description: >
   Answer the review threads waiting on an agent on an open pull request: read each
   thread a person handed to an agent, fix what it says on the pull request's branch,
-  reply on the thread with a replacement artifact or a sentence, and push. Use when a
-  work item has threads waiting on an agent, or when asked to "answer the review" or
-  "fix what the reviewer failed". Invoke with /outerlayer-amend.
+  reply on the thread with a replacement artifact or a sentence, and push. Also resolve a
+  merge conflict with the base branch. Use when a work item has threads waiting on an
+  agent or a conflicting pull request, or when asked to "answer the review" or "fix what
+  the reviewer failed". Invoke with /outerlayer-amend.
 ---
 
 Run the CLI as `outerlayer`. If that command is not on PATH, run `npx -y @outerlayer/cli` with the same arguments. Every `outerlayer ...` command below follows this rule.
@@ -13,11 +14,10 @@ Run the CLI as `outerlayer`. If that command is not on PATH, run `npx -y @outerl
 Answer every thread waiting on an agent on one work item's pull request, then
 stop. A work item has one general thread and one thread per acceptance
 criterion. A person's fail on the general thread leaves it waiting on an agent.
-A note a reviewer sent with Request changes (a sent note) leaves its criterion
-thread waiting on an agent. A plain comment from a person does not hand a
-thread to an agent. The person's newest comment says what they want. This
-skill never records a verdict. Only a person passes or fails a thread. A
-session can only reply.
+A note a reviewer sent with Request changes (a sent note) does the same to its
+criterion thread. A plain comment from a person does not hand a thread to an
+agent. The person's newest comment says what they want. Only a person passes
+or fails a thread. A session can only reply.
 
 A session never records a pass or fail on an artifact.
 
@@ -26,118 +26,130 @@ request's branch first if the working tree is not already on it.
 
 ## Arguments
 
-- `--unattended`: no person is watching. Never ask a question. Anything that
-  needs a person becomes a hand-off (step 5), never a stop that leaves a thread
-  silently waiting on an agent.
+- `--unattended`: no person is watching. Never ask a question. A need for a
+  person becomes a hand-off (step 7), never a silent stop.
 
 ## Builds and local sessions
 
 A session a runner started for the item is a build. `OUTERLAYER_JOB_DIR` is
-set in a build and nowhere else. The GitHub token a runner gives a build can
-read the issue and the pull request but cannot comment on either. In the
-runner's own build environments, git pushes go through the runner, not
-straight to the git host. A local session uses the person's own git remote and
-`gh` login.
+set in a build and nowhere else. A build's GitHub token cannot comment on the
+issue or the pull request, and its git pushes go through the runner. A local
+session uses the person's own git remote and `gh` login.
 
 ## Several repositories
 
-A build can hold several repositories. `OUTERLAYER_REPOSITORIES` lists them,
-each with its `path`, `branch` and whether it is `primary`. The item can have a
-pull request in more than one of them. Make each fix in the checkout of the
-repository whose pull request the thread is about, and commit and push in each
-checkout you change. A push goes only to that checkout's own branch.
+`OUTERLAYER_REPOSITORIES` lists the repositories of a build, each with its
+`path`, `branch` and whether it is `primary`. The item can have a pull request
+in more than one. Make each fix in the checkout of the repository whose pull
+request the thread is about. Commit and push in each checkout you change, to
+its own branch only.
 
 ## Steps
 
-1. **Read the threads.**
+1. **Resolve a merge conflict.** Run
+   `outerlayer work status --item "$OUTERLAYER_WORK" --json`. For each
+   `pullRequests` entry, compare `conflict.headSha` with `git rev-parse HEAD`
+   in that repository's checkout. Skip an entry whose `conflict` is `null` or
+   differs: a push has moved the head. Do this before any thread, and go on
+   even when none waits.
+   For a matching entry, merge the base branch into the pull request's branch.
+   Never rebase and never force-push. Follow
+   `.outerlayer/skills/outerlayer-cli/references/merge-base-branch.md`. Run the
+   pre-push gate in the foreground. Name the base sha in the merge commit.
+   Push, then answer the threads.
+   **Hand off a conflict you cannot resolve.** If the resolution needs a
+   product decision, or the gate stays red after one fix, abort the merge.
+   Push nothing. Post on the general thread with `--ready`. Name the
+   conflicting files, the base commits behind them and the decision needed.
+   Tell the person to fail the general thread with their answer.
+2. **Read the threads.**
    `outerlayer work threads --item "$OUTERLAYER_WORK" --json` prints
    `{ "general": <thread>, "criteria": [<thread>, ...] }`. Each thread carries
    `criterion` (null for the general thread), `waitingOn` (`agent`, `person` or
    null), `verdict`, `proof` and `comments`. Each comment carries `author`
    (`kind` is `person` or `agent`), `body`, `action` and `artifact`. Keep the
-   threads whose `waitingOn` is `agent`. One send of notes starts one run, so
-   expect several criterion threads and the general thread together. If none is
-   waiting, say so and stop: there is nothing to answer. Then read
-   `outerlayer work status --item "$OUTERLAYER_WORK" --json` for the pull
-   request in `pullRequests` (`repository`, `prNumber`).
-2. **Re-orient.** Read the issue the item names from the status JSON's
-   `issue`, OuterLayer's copy of it, which needs no tracker credential:
-   `issue.body` is its description in Markdown. Read the pull request,
-   including its evidence comment, through the git host. The
-   issue body is the spec. Find each thread's criterion there. Read every
-   person's comment since the last agent comment on the thread. Read them
-   literally: they are the reviewer's instruction.
-3. **Decide each thread.** Reply on every criterion thread waiting on an
+   threads whose `waitingOn` is `agent`: one send of notes can leave several.
+   If none is waiting and step 1 resolved no conflict, say so and stop: there
+   is nothing to answer. Take the pull request (`repository`, `prNumber`) from
+   the `pullRequests` of the status JSON you read in step 1.
+3. **Re-orient.** The status JSON's `issue.body` is OuterLayer's copy of the
+   issue. It is the spec: find each thread's criterion there. Read the pull
+   request, with its evidence comment, through the git host. Read every person's comment since the last agent
+   comment on the thread. Read them literally.
+4. **Decide each thread.** Reply on every criterion thread waiting on an
    agent, with `--criterion`, so each note gets its answer under it. Read each
    note and pick one:
    - **Answer it.** A question gets an answer. Reply with the answer and
      change nothing. Say which file or test you looked at.
-   - **Fix it.** A requested change gets a fix. The comment names something the
-     change got wrong or did not show. Change the code, tests, docs or evidence
-     so the criterion is met as written, and attach new proof when the
+   - **Fix it.** A requested change gets a fix. Change the code, tests, docs or
+     evidence so the criterion is met as written, and attach new proof when the
      criterion declares one.
-   - **The spec is wrong.** The comment shows the criterion cannot be met as
-     written, for example because it names a path a repository rule forbids. A
-     session never rewrites a criterion on its own. Hand it off (step 5), naming
-     the exact wording change the owner should make.
+   - **The spec is wrong.** The criterion cannot be met as written, for
+     example because it names a path a repository rule forbids. A session never
+     rewrites a criterion. Hand it off (step 7), naming the wording change the
+     owner should make.
    - **Cannot tell.** The comment is ambiguous. Hand it off with `--ready`:
-     quote it and ask one question back.
-4. **Fix, prove, reply.** An answer needs no commit: reply on its criterion
+     quote it and ask one question.
+5. **Fix, prove, reply.** An answer needs no commit: reply on its criterion
    thread with the answer and `--ready`. For each thread you fix:
-   - Make the change on the pull request's branch. Keep it to what the comment
-     asks. Do not refactor around it.
-   - Run the tests that cover the criterion, then the repository's full
-     pre-push checks through a normal `git push`. Never bypass a hook.
-   - A runner accepts a build's push only to the pull request's branch. If it
-     refuses one, read the reason git prints, fix it and push again.
-   - In a local session over SSH, the git host can drop the connection during
-     a long gate. Push again with
+   - Change only what the comment asks, on the pull request's branch.
+   - Run the tests that cover the criterion, then the repository's pre-push
+     checks through a normal `git push`. Never bypass a hook.
+   - If the runner refuses a push, read the reason git prints, fix it and push
+     again.
+   - Over SSH, a long gate can drop the connection. Push again with
      `GIT_SSH_COMMAND="ssh -o ServerAliveInterval=20 -o ServerAliveCountMax=60"`.
-   - **When the thread asks for new proof** (a criterion thread whose proof the
-     person failed), capture it after the fixed state exists, in the form the
-     criterion declares (`proof: screenshot` and so on) or the form of the
-     current proof. Emit it bound to that criterion, without `--replaces`.
-     Attaching it on the thread supersedes the old proof.
+   - **When the thread asks for new proof** (a person failed its proof),
+     capture it after the fixed state exists, in the form the criterion
+     declares or the form of the current proof. Emit it bound to that
+     criterion, without `--replaces`:
      `outerlayer emit artifact <file> --caption "<what it shows>" --for <criterion>`.
-     Note the id it prints. Run `outerlayer sync` so the artifact reaches the
-     server. The attach looks it up there and refuses an artifact it cannot
-     find. Then reply:
+     Note the id it prints. Run `outerlayer sync`, so the attach can find the
+     artifact. Then reply, which supersedes the old proof:
      `outerlayer work comment --item "$OUTERLAYER_WORK" --criterion <criterion> --body "<what changed>" --artifact <uuid> --attach`.
-     A replacement whose bytes match the current proof is flagged `unchanged`
-     and keeps the turn where the person's comment left it, so the thread
-     still waits on you.
+     A replacement whose bytes match the current proof is flagged `unchanged`,
+     so the thread still waits on you.
    - **Otherwise** (the general thread, or a fix that needs no new proof),
      reply with a sentence naming what changed and the commit:
      `outerlayer work comment --item "$OUTERLAYER_WORK" [--criterion <criterion>] --body "<what changed>" --ready`.
      Omit `--criterion` on the general thread.
-5. **Hand off what you cannot fix.** Reply on the thread with `--ready` and a
-   body of one sentence of fact, then the decision a person must make. For a
-   spec problem, quote the criterion and give the replacement wording.
-   `--ready` hands the thread back to a person.
-6. **Check nothing is left waiting.** Read the threads again. No thread you
-   started with may still be waiting on an agent. If one is, the reply did not
-   land or was flagged `unchanged`. Find out why and fix it, or report it.
-7. **Report.** Write one line per thread, naming the criterion (or the general
+6. **Watch CI.** Skip this step when you pushed nothing. Run
+   `gh pr checks <prNumber> --repo <repository> --watch` on each pull request
+   you pushed. Leave out any check that waits on results recorded after the
+   session ends. "No checks reported" is not green: query again.
+   - For a failed check, read `gh run view <run-id> --log-failed`, fix it, push
+     again.
+   - If it also fails on the base branch, or failed outside the code,
+     change nothing.
+   - Stop after two fixes for one check.
+7. **Hand off what you cannot fix.** Reply on the thread with `--ready`: one
+   sentence of fact, then the decision a person must make. For a spec problem,
+   quote the criterion and give the replacement wording. `--ready` hands the
+   thread back to a person.
+8. **Check nothing is left waiting.** Read the threads again. None you started
+   with may still wait on an agent. If one does, the reply did not land or was
+   flagged `unchanged`. Fix that, or report it.
+9. **Report.** Write one line per thread, naming the criterion (or the general
    thread) and saying fixed (with the replacement) or handed off (with the
-   reason). Plain language. No session labels, no raw command output. Post the
+   reason). Add one line for a merge conflict: merged, with the base sha, or
+   handed off, with the reason. Add a CI line when you pushed: green, or each
+   red check and why. Use plain language. Post the
    lines once on the general thread, in a build and in a local session alike:
    `outerlayer work comment --item "$OUTERLAYER_WORK" --body "<the lines>"`.
    A plain comment from an agent leaves the general thread waiting on a person.
-   A local session also posts the lines once as a pull request comment. A build
-   does not try: its token cannot comment. End the session with the same lines.
+   A local session also posts them on the pull request. A build does not:
+   its token cannot comment. End with the same lines.
 
 ## Rules
 
 - **Answer only threads waiting on an agent.** A thread waiting on a person, or
   on no one, is not yours to reply on.
 - **One thread, one proof.** Never attach an artifact that does not prove that
-  thread's criterion. The attach refuses an artifact bound to a different
-  criterion.
+  thread's criterion.
 - **A person decides.** Never pass `--pass` or `--fail`, never mark a check as
   a person, and never edit the issue's criteria.
 - **Stay on the branch.** Push to the pull request's own branch. Never open a
   second pull request in a repository that has one, and never force-push over
   someone else's commits.
 - **Write for a reader who was not here.** Every comment, commit and reply
-  follows the repository's writing rule: outcome first, short sentences, plain
-  words.
+  follows the repository's writing rule: outcome first, short plain sentences.

package/skill-pack/maintained/outerlayer-build/SKILL.md

@@ -89,7 +89,9 @@ Given a request instead of a work item, stop and say:
 Optional flag: `--unattended` means no person is present and nothing wakes
 the session after a turn ends. Spawn every agent in the foreground and wait
 for it in the same turn. Run the gate in the foreground with the maximum
-timeout. End the turn only at the final report.
+timeout. A command that outlives that timeout continues in the background:
+wait for it in the foreground before you use its result. End the turn only at
+the final report.
 
 ## State rules
 
@@ -305,7 +307,7 @@ Run them in order.
 
 5. **Pull request.** Run `outerlayer emit step "Pull request" --item "$OUTERLAYER_WORK"`,
    then apply the team's changes for this phase. Read [references/release.md](references/release.md)
-   on entry and run it. A release agent rebases, gates and pushes. Open the
+   on entry and run it. A release agent merges the base branch in, gates and pushes. Open the
    pull request as release.md says: a runner build with `outerlayer work open-pr`,
    which links it, and a local session with `gh pr create` and then
    `outerlayer work pr <number>`. When the build recorded criteria, from the issue or drafted, a fresh agent judges them with

package/skill-pack/maintained/outerlayer-build/references/agent-briefs.md

@@ -45,6 +45,13 @@ Run every long command, such as the full gate, the mutation tool or the
 integration suite, in the foreground with the maximum timeout. Never
 background one, and never end a turn waiting on a notification.
 
+A command that runs past the maximum timeout moves to the background and
+continues. It has not finished. Wait for it in the foreground before you use
+or report its result. For a command named `run-checks`, wait with
+`while pgrep -f '[r]un-checks' >/dev/null; do sleep 15; done`. Keep the
+brackets around the first letter of the name. Without them, `pgrep` on Linux
+finds the waiting shell, and the loop does not stop.
+
 Every agent in a run shares one memory cap. Run only the test files for the
 code you change or check, one at a time. Run a whole package's suite, a
 coverage run, a repository-wide typecheck or the full gate only where this
@@ -181,9 +188,9 @@ The shared rules apply. Your inputs are the state file path, the branch and
 the instructions-file pointer. You run no write command against the tracker
 or the git host beyond the push.
 
-Fetch the base branch, then rebase the branch onto it. Merge instead once the
-branch is pushed and someone else may hold it. Resolve every conflict on the
-branch, never in a web editor.
+Bring the base branch into the branch as
+`.outerlayer/skills/outerlayer-cli/references/merge-base-branch.md` says.
+Resolve every conflict on the branch, never in a web editor.
 
 A migration this branch adds whose version is at or below the newest one on
 the base branch is renamed to the current UTC time, with every reference to

package/skill-pack/maintained/outerlayer-build/references/release.md

@@ -9,10 +9,13 @@ file, not from the transcript.
 
 The orchestrator does not sync, run the gate, push or watch CI itself. Spawn
 one release agent in a fresh context on the "sync and push" brief, with the
-state file path, the branch and the instructions-file pointer. A check that
-fails there has the standing of a red gate and returns to the review phase's
-remaining budget. If its report names files the sync moved that the review had
-already cleared, run one check round on the rebased diff before going on.
+state file path, the branch and the instructions-file pointer. The agent
+brings the base branch in as
+`.outerlayer/skills/outerlayer-cli/references/merge-base-branch.md` says. A
+check that fails there has the standing of a red gate and returns to the
+review phase's remaining budget. If its report names files the sync moved that
+the review had already cleared, run one check round on the merged diff before
+going on.
 
 ## Open the pull request
 

package/skill-pack/maintained/outerlayer-build/references/review-briefs.md

@@ -259,9 +259,12 @@ shared tree while you run, so no mutation may touch it.
 
 1. Run the repository's changed-lines mutation tool once over the whole diff.
    Every survivor it reports is a finding. Never rerun it per file, never
-   lower its budget, and never run a whole suite or a coverage run. A run
-   that ends over budget is reported as over budget with the mutants it
-   scored. One rerun is allowed, and only when the tool reports no result
+   lower its budget, and never run a whole suite or a coverage run. The
+   tool can run longer than your shell's maximum timeout. Then your shell
+   moves it to the background. Wait for it to exit before you write your
+   report. Only the tool's own output can say that a run went over budget.
+   A run that ends over budget is reported as over budget with the mutants
+   it scored. One rerun is allowed, and only when the tool reports no result
    because a workspace dependency could not be resolved: build the
    dependencies, then run once more.
 2. Read the tool's report. For each criterion whose production lines were

package/skill-pack/maintained/outerlayer-cli/SKILL.md

@@ -38,7 +38,7 @@ from the output of `outerlayer work build`.
 4. `outerlayer emit artifact <file> --caption "<what it shows>"` attaches a
    screenshot, recording, report or log as evidence. The `outerlayer-evidence`
    skill says what to capture.
-5. `/outerlayer-amend` answers the review threads a person handed to an agent.
+5. `/outerlayer-amend` answers the review threads a person handed to an agent. It also resolves a merge conflict on a pull request a host built.
 
 ## Several repositories
 
@@ -76,6 +76,13 @@ ended, which session ran in it, and what the runner did around the agent. The
 steps, and what each outcome and reason means, are in
 [references/find-out-why-a-build-ended.md](references/find-out-why-a-build-ended.md).
 
+## Merging the base branch
+
+A build merges the base branch into its branch before the pull request opens.
+A run that resolves a merge conflict does the same on an open pull request.
+Both follow one procedure in
+[references/merge-base-branch.md](references/merge-base-branch.md).
+
 ## Reading work items
 
 When the OuterLayer MCP server is configured in this repository, its

package/skill-pack/maintained/outerlayer-cli/references/merge-base-branch.md

@@ -0,0 +1,54 @@
+# Merge the base branch into a branch
+
+Use this procedure when a branch must take in its base branch: a build's
+last sync before the pull request opens, and a run that resolves a merge
+conflict on a pull request already open. It is the one written procedure
+for both.
+
+Merge the base branch. Never rebase, and never force-push. A merge keeps the
+commits a reviewer already read and keeps review comments on their lines.
+
+1. Fetch the base branch. Use the pull request's base, which the item's
+   `outerlayer work status --item "$OUTERLAYER_WORK" --json` names in
+   `pullRequests[].conflict.baseBranch`, or the repository's default branch
+   when the pull request has no conflict record.
+
+       git fetch origin <base>
+
+2. Record the base commit you merge. Read it after the fetch.
+
+       git rev-parse origin/<base>
+
+3. Merge it into the checked-out branch, and stop before git commits.
+
+       git merge origin/<base> --no-commit --no-ff
+
+   If git reports `Already up to date`, the branch holds the base already.
+   Stop: there is nothing to push. If the merge has no conflict, go to step 5.
+
+4. Resolve each conflict so that the result keeps the intent of both sides.
+   List the conflicting files with `git diff --name-only --diff-filter=U`.
+   For each file, read the base commits that changed it
+   (`git log --oneline HEAD..origin/<base> -- <file>`) and the work item's
+   spec. Do not pick one side to make the conflict go away. Mark a file
+   resolved with `git add <file>` only when its code and its tests agree
+   with both sides.
+
+5. Run the repository's pre-push gate in the foreground, with the maximum
+   timeout. It names its own command in the repository's instructions file.
+   Wait for it to end. If the gate fails, fix the cause and run it again once.
+   A second failure is a hand-off, not a third try.
+
+6. Commit the merge. Name the base sha from step 2 in the message, so a reader
+   can find the exact base commit.
+
+       git commit -m "Merge <base> at <base sha> into <branch>"
+
+7. Push the branch. The hooks run, and you never bypass them. A push goes to
+   the pull request's own branch only.
+
+## When you cannot resolve it
+
+Abort the merge with `git merge --abort`. The branch returns to the state it
+had before step 3. Push nothing. Hand the item to a person in the way the
+calling skill says.

package/dist/chunk-NTRCK4NH.js

@@ -1,38 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { cliInvocation } from './chunk-CRB3POP4.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
-
-createRequire(import.meta.url);
-
-// src/credentials.ts
-var MISSING_HELP = `Run \`${cliInvocation()} login\` to sign in, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`;
-var NO_FACTORY_MESSAGE = `you are logged in, but no factory is chosen for this repository. Run \`${cliInvocation()} connect\` to choose one, or pass --app-id / set OUTERLAYER_APP_ID.`;
-var NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE = "you are logged in, but this directory is not in a git repository, so no factory is chosen. Pass --app-id / set OUTERLAYER_APP_ID, or run this from inside a connected repository.";
-var LOGIN_TOKEN_PREFIX = "olu_";
-function unauthorizedMessage(credential) {
-  return credential.startsWith(LOGIN_TOKEN_PREFIX) ? `not authorized \u2014 the login is expired or was revoked. Run \`${cliInvocation()} login\` to sign in again.` : "not authorized \u2014 the API key is unknown, expired, or bound to a different factory. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.";
-}
-function resolveGatewayCredentials(sources = {}) {
-  const env = sources.env ?? process.env;
-  const config = readCloudConfig(sources.home ?? homeFromEnv(env));
-  const url = sources.url ?? env.OUTERLAYER_URL ?? config.url;
-  const key = sources.apiKey ?? (env.OUTERLAYER_API_KEY || void 0) ?? config.apiKey;
-  const kind = key ? "key" : "login";
-  const credential = key ?? config.accountToken;
-  const cwd = sources.cwd ?? process.cwd();
-  const appId = sources.appId ?? (env.OUTERLAYER_APP_ID || void 0) ?? (kind === "key" ? config.appId : readRepoConnection(cwd)?.appId);
-  if (credential && url && !appId && kind === "login") {
-    const message = findGitDirs(cwd) === void 0 ? NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE : NO_FACTORY_MESSAGE;
-    return { ok: false, message, url, credential, appId, kind };
-  }
-  if (!url || !credential || !appId) {
-    const missing = [!url && "--url", !credential && "a login or OUTERLAYER_API_KEY", !appId && "--app-id"].filter(Boolean).join(", ");
-    return { ok: false, message: `missing ${missing}. ${MISSING_HELP}`, url, credential, appId, kind };
-  }
-  return { ok: true, url, credential, appId, kind };
-}
-
-export { resolveGatewayCredentials, unauthorizedMessage };

package/dist/chunk-VWLOQ6FI.js

@@ -1,56 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signRunnerRequest, signerFor } from './chunk-KDHYLBRR.js';
-
-createRequire(import.meta.url);
-
-// src/signing-fetch.ts
-function bodyBytes(body) {
-  if (body === void 0 || body === null) return new Uint8Array(0);
-  if (typeof body === "string") return new TextEncoder().encode(body);
-  if (body instanceof Uint8Array) return body;
-  if (body instanceof ArrayBuffer) return new Uint8Array(body);
-  return void 0;
-}
-async function savedKeySigner(headers, home) {
-  const authorization = headers.get("authorization");
-  if (authorization === null || !authorization.startsWith("Bearer ")) return void 0;
-  if (headers.has("signature")) return void 0;
-  if (readCloudConfig(home).apiKey !== authorization.slice("Bearer ".length)) return void 0;
-  try {
-    return await signerFor(cloudConfigPath(home));
-  } catch {
-    return void 0;
-  }
-}
-function signedBy(base, signerOf) {
-  return (async (input, init) => {
-    if (input instanceof Request) return base(input, init);
-    const headers = new Headers(init?.headers);
-    const signer = await signerOf(headers);
-    const body = bodyBytes(init?.body);
-    if (signer === void 0 || body === void 0) return base(input, init);
-    const signature = await signRunnerRequest({ method: init?.method ?? "GET", url: input.toString(), body, signer });
-    for (const [name, value] of Object.entries(signature)) headers.set(name, value);
-    return base(input, { ...init, headers });
-  });
-}
-function signingFetch(base, home = () => homeFromEnv()) {
-  return signedBy(base, (headers) => savedKeySigner(headers, home()));
-}
-function signingFetchFor(base, configPath, apiKey) {
-  return signedBy(base, async (headers) => {
-    const authorization = headers.get("authorization");
-    if (authorization !== `Bearer ${apiKey}` || headers.has("signature")) return void 0;
-    try {
-      return await signerFor(configPath);
-    } catch {
-      return void 0;
-    }
-  });
-}
-var defaultFetch = signingFetch((input, init) => globalThis.fetch(input, init));
-
-export { defaultFetch, signingFetchFor };