@outerlayer/cli 0.34.0-next.20261027121359 → 0.34.0-next.20261027162612

package/dist/{agent-setup-UPRMGVB7.js → agent-setup-THDNZ5ME.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-N752ZNZ5.js';
+export { keepHandWritten, runAgentSetup } from './chunk-FVVHQIZR.js';
 import './chunk-TWFBOZQ5.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-J7EJMIDR.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-LYCJQOO2.js';
-import './chunk-M6YTST7G.js';
+import './chunk-36M4KVBT.js';
 import './chunk-LMYRR5MO.js';
-import './chunk-T375XV3H.js';
+import './chunk-62URQYCB.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-KDSKFXPE.js';
+import './chunk-RJZZFAXS.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-OVNF4LLC.js';
@@ -24,8 +24,8 @@ import './chunk-TUSYOL2O.js';
 import './chunk-XFJ7YOPD.js';
 import './chunk-DINRXUQA.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-I2GHZ2VA.js';
-import './chunk-Z7THNFUU.js';
+import './chunk-3VJYDWFV.js';
+import './chunk-GMKDAF37.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{bridge-GVZUP3NU.js → bridge-MLB57JP6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-XZGURZHF.js';
-import './chunk-Z7THNFUU.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-GPO7F757.js';
+import './chunk-GMKDAF37.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-25GDCEZ7.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, baseLines, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-5FHBVV25.js';
+import './chunk-CMMEJJTL.js';
+import './chunk-FLHBUQ2W.js';
+export { RecipeError } from './chunk-X7M73LKT.js';
+import './chunk-WX2HW2G2.js';
+import './chunk-3FTIUB7I.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-RJZZFAXS.js';
+import './chunk-A6PJSNP6.js';
+import './chunk-DINRXUQA.js';
+import './chunk-3VJYDWFV.js';
+import './chunk-GMKDAF37.js';
+import './chunk-MESOOLF4.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{build-disk-WMIRA4RD.js → build-disk-NFMQCZM3.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-TS2YACAQ.js';
-import './chunk-UYWGR35C.js';
-import './chunk-HDLON3RJ.js';
-import './chunk-QUOITPN7.js';
-import './chunk-KDSKFXPE.js';
-import './chunk-OOD5NDQA.js';
+export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-LYX2RRSF.js';
+import './chunk-FLHBUQ2W.js';
+import './chunk-X7M73LKT.js';
+import './chunk-WX2HW2G2.js';
+import './chunk-RJZZFAXS.js';
+import './chunk-A6PJSNP6.js';
 import './chunk-DINRXUQA.js';
-import './chunk-I2GHZ2VA.js';
-import './chunk-Z7THNFUU.js';
+import './chunk-3VJYDWFV.js';
+import './chunk-GMKDAF37.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-27T12:15:21.059Z+364ef72","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-27T16:28:14.920Z+d66ae09","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-XTAHDFV5.js → builder-OWDGC3VQ.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-UYWGR35C.js';
-import './chunk-HDLON3RJ.js';
-import './chunk-QUOITPN7.js';
-import './chunk-KDSKFXPE.js';
-import './chunk-OOD5NDQA.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-FLHBUQ2W.js';
+import './chunk-X7M73LKT.js';
+import './chunk-WX2HW2G2.js';
+import './chunk-RJZZFAXS.js';
+import './chunk-A6PJSNP6.js';
 import './chunk-DINRXUQA.js';
-import './chunk-I2GHZ2VA.js';
-import './chunk-Z7THNFUU.js';
+import './chunk-3VJYDWFV.js';
+import './chunk-GMKDAF37.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{check-FAG4QKIX.js → check-QGM2SECF.js}

@@ -1,64 +1,64 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-LTMFHECB.js';
+import { probeCredentials } from './chunk-CKVJSOY3.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-4IB5WUY2.js';
+import './chunk-KVGK2JL3.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-MH6QLXUO.js';
-import './chunk-DUG3JXAT.js';
-import './chunk-W774NREK.js';
-import './chunk-PBZODW5X.js';
-import './chunk-SJY6A6EH.js';
+import './chunk-UZIAZXXO.js';
+import './chunk-MGF346ND.js';
+import './chunk-BS4CZMT6.js';
+import './chunk-BCIBSJZH.js';
 import './chunk-6CK2OC4Q.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-6SJ3DJDH.js';
+import './chunk-5ARXP3BP.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-YGX72FUQ.js';
-import './chunk-B7LPFCIN.js';
-import './chunk-QBBZGVZJ.js';
+import './chunk-QRIE4JZE.js';
+import './chunk-7SJNVGVC.js';
+import './chunk-RCAMBC3H.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-XZGURZHF.js';
-import { managedProblems, managedFactsOf } from './chunk-XEJ5USHY.js';
-import './chunk-J2X5CTYY.js';
+import './chunk-GPO7F757.js';
+import { managedProblems, managedFactsOf } from './chunk-QWSAZGH6.js';
+import './chunk-WR2GRWK3.js';
 import './chunk-TBT347UY.js';
-import { findServiceUnit } from './chunk-JKOONI3H.js';
+import { findServiceUnit } from './chunk-7TLGRE5F.js';
 import './chunk-TZMDRHWB.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ARPPH7VS.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-J3Q3QCOF.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-SGT7YU3X.js';
-import './chunk-UC4OSOQS.js';
+import './chunk-5FHBVV25.js';
+import './chunk-CMMEJJTL.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-ZV6GOXYA.js';
-import './chunk-RMJSYOSV.js';
-import './chunk-66TKWWTX.js';
-import './chunk-HO4XRLAZ.js';
+import './chunk-JVNQNKHV.js';
+import './chunk-BS3OYFAD.js';
+import './chunk-7Q7GQELE.js';
+import './chunk-CFJOONWM.js';
 import './chunk-TQMI335S.js';
-import './chunk-XSUM3E67.js';
-import './chunk-UXGWAAGQ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-RO2NZJHZ.js';
-import './chunk-TS2YACAQ.js';
-import './chunk-UYWGR35C.js';
-import './chunk-HDLON3RJ.js';
-import './chunk-QUOITPN7.js';
-import './chunk-W5EKMK37.js';
+import './chunk-OP2L7OXA.js';
+import './chunk-OHTMTMFX.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-JWMJMQRF.js';
+import './chunk-LYX2RRSF.js';
+import './chunk-FLHBUQ2W.js';
+import './chunk-X7M73LKT.js';
+import './chunk-WX2HW2G2.js';
+import './chunk-3FTIUB7I.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-J7EJMIDR.js';
-import './chunk-NGZBVN6F.js';
+import './chunk-6IMQXBTZ.js';
 import './chunk-IP7BIBXJ.js';
-import './chunk-YIBHQR3B.js';
-import './chunk-L7RPNSAA.js';
+import './chunk-EYJRVHBN.js';
+import './chunk-NO6E72RM.js';
 import './chunk-NWHU5G6R.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-IXPH4EXK.js';
 import './chunk-LYCJQOO2.js';
-import './chunk-M6YTST7G.js';
+import './chunk-36M4KVBT.js';
 import './chunk-LMYRR5MO.js';
-import './chunk-T375XV3H.js';
+import './chunk-62URQYCB.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-KDSKFXPE.js';
-import './chunk-CHDWAWQA.js';
+import './chunk-RJZZFAXS.js';
+import './chunk-4QQJTJUN.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
@@ -66,7 +66,7 @@ import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-OVNF4LLC.js';
-import './chunk-OOD5NDQA.js';
+import './chunk-A6PJSNP6.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -80,8 +80,8 @@ import './chunk-TUSYOL2O.js';
 import './chunk-XFJ7YOPD.js';
 import './chunk-DINRXUQA.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-I2GHZ2VA.js';
-import { claudeEnvPath, parseRunnerEnv } from './chunk-Z7THNFUU.js';
+import './chunk-3VJYDWFV.js';
+import { claudeEnvPath, parseRunnerEnv } from './chunk-GMKDAF37.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';

package/dist/{chunk-Q3ATWA2U.js → chunk-2YPOSVC7.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-LHUZVM3L.js';
-import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-J2X5CTYY.js';
+import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-AV5T7HV3.js';
+import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-WR2GRWK3.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { runnerDir, RUNNER_DIR_MODE } from './chunk-I2GHZ2VA.js';
+import { runnerDir, RUNNER_DIR_MODE } from './chunk-3VJYDWFV.js';
 import { lchownSync, lstatSync, realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync, readdirSync } from 'fs';
 import { dirname, sep, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-M6YTST7G.js → chunk-36M4KVBT.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-LMYRR5MO.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-T375XV3H.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-62URQYCB.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-OVNF4LLC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-XFJ7YOPD.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-Z7THNFUU.js';
+import { withTokenHeader } from './chunk-GMKDAF37.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-W5EKMK37.js → chunk-3FTIUB7I.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-L4DCIEVT.js → chunk-3RRYEZAC.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-B7LPFCIN.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-7SJNVGVC.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-YIBHQR3B.js';
+import { autoConnect } from './chunk-EYJRVHBN.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-IXPH4EXK.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-T375XV3H.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-DINRXUQA.js';

package/dist/{chunk-I2GHZ2VA.js → chunk-3VJYDWFV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-Z7THNFUU.js';
+import { BUILD_HOME } from './chunk-GMKDAF37.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-CHDWAWQA.js → chunk-4QQJTJUN.js}

@@ -684,7 +684,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-UM4IHOJQ.js');
+  const { governanceOf } = await import('./control-plane-launch-TS4DFJF4.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-6SJ3DJDH.js → chunk-5ARXP3BP.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-XZGURZHF.js';
-import { EXEC_PORT } from './chunk-RMJSYOSV.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-GPO7F757.js';
+import { EXEC_PORT } from './chunk-BS3OYFAD.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-Z7THNFUU.js';
+import { RELAY_PORT } from './chunk-GMKDAF37.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 

package/dist/{chunk-SGT7YU3X.js → chunk-5FHBVV25.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { defaultDockerfile, toolsDockerfile } from './chunk-UC4OSOQS.js';
-import { runnerLabelValue } from './chunk-UYWGR35C.js';
-import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-HDLON3RJ.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION } from './chunk-QUOITPN7.js';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-W5EKMK37.js';
+import { toolsDockerfile } from './chunk-CMMEJJTL.js';
+import { runnerLabelValue } from './chunk-FLHBUQ2W.js';
+import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-X7M73LKT.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, UNIVERSAL_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE } from './chunk-WX2HW2G2.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-3FTIUB7I.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-I2GHZ2VA.js';
-import { withGitConfig, tokenHeader } from './chunk-Z7THNFUU.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-3VJYDWFV.js';
+import { withGitConfig, tokenHeader } from './chunk-GMKDAF37.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';
@@ -167,8 +167,8 @@ function hashFile(root, rel) {
   const bytes = lstatSync(path).isSymbolicLink() ? Buffer.from(`-> ${readlinkSync(path)}`) : readFileSync(path);
   return [rel, "\0", bytes, "\0"];
 }
-function recipeKey(checkoutDir, location, defaultDockerfile2) {
-  if (location.kind === "default") return sha256(defaultDockerfile2);
+function recipeKey(checkoutDir, location, universalImage) {
+  if (location.kind === "default") return sha256("universal\0", universalImage);
   const files = [];
   if (existsSync(join(checkoutDir, ".devcontainer"))) files.push(...filesUnder(checkoutDir, ".devcontainer"));
   if (location.path === ".devcontainer.json") {
@@ -206,12 +206,20 @@ function selectPrunable(opts) {
 }
 
 // src/runner/image/build.ts
+function baseLines(report) {
+  return report.base === void 0 ? [] : [`  base:    ${report.base.reference}@${report.base.digest}
+`];
+}
 var KIND2 = "ai.outerlayer.kind";
 var RUNNER2 = "ai.outerlayer.runner";
 var REPOSITORY = "ai.outerlayer.repository";
 var RECIPE_KEY2 = "ai.outerlayer.recipe-key";
 var TOOLS_KEY = "ai.outerlayer.tools-key";
 var KEEP_BUILD_IMAGES = 3;
+var SHARED_OWNER = "_universal";
+var SHARED_NAME = "image";
+var SHARED_REPOSITORY = `${SHARED_OWNER}/${SHARED_NAME}`;
+var SHARED_TAG_NAME = "universal";
 var TAG_HOST = "outerlayer.invalid";
 var KEY_PREFIX = 12;
 var LOCK_NAME = "build.lock";
@@ -265,7 +273,6 @@ async function prepareImageBuild(opts) {
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const claudeCodeVersion = opts.claudeCodeVersion ?? CLAUDE_CODE_VERSION;
   const nodeImage = opts.nodeImage ?? NODE_IMAGE;
-  const baseImage = opts.defaultBaseImage ?? DEFAULT_BASE_IMAGE;
   const cacheDir = repoCacheDir(opts.configPath, owner, name);
   const repoRecords = join(imagesDir(opts.configPath), owner, name);
   const logPath = join(imageBuildLogsDir(opts.configPath, owner, name), `${attemptStamp(now())}.log`);
@@ -280,18 +287,54 @@ async function prepareImageBuild(opts) {
     }
     throw err;
   }
-  const release = () => releasePidFile(lockPath, self);
+  let releaseShared = () => void 0;
+  const release = () => {
+    releaseShared();
+    releasePidFile(lockPath, self);
+  };
   try {
     const remote = opts.remote ?? `https://github.com/${owner}/${name}.git`;
     const checkout = opts.pinned === void 0 ? await fetchDefaultBranch({ remote, dir: cacheDir, token: opts.readToken, repository }) : await fetchPinnedCommit({ remote, dir: cacheDir, token: opts.readToken, repository, ...opts.pinned });
     const location = locateRecipe(checkout.dir);
     const recipe = readRecipe(checkout.dir, location);
     assertBuildable(checkout.dir, location, recipe);
-    const defaultText = defaultDockerfile(baseImage, nodeImage);
-    const rKey = recipeKey(checkout.dir, location, defaultText);
+    const shared = location.kind === "default";
+    const imageRepository = shared ? SHARED_REPOSITORY : repository;
+    const records = shared ? join(imagesDir(opts.configPath), SHARED_OWNER, SHARED_NAME) : repoRecords;
+    if (shared) {
+      mkdirSync(records, { recursive: true, mode: RUNNER_DIR_MODE });
+      const sharedLock = join(records, LOCK_NAME);
+      try {
+        claimPidFile(sharedLock, self);
+      } catch (err) {
+        if (err instanceof RunnerAlreadyRunningError) {
+          throw new RecipeError("build_in_progress", `an image build on the universal image is already running (pid ${err.pid})`);
+        }
+        throw err;
+      }
+      releaseShared = () => releasePidFile(sharedLock, self);
+    }
+    const rKey = recipeKey(checkout.dir, location, UNIVERSAL_IMAGE);
     const tKey = toolsKey({ buildId: opts.cli.buildId, claudeCodeVersion, nodeImage, ghVersion: GH_VERSION, tiniVersion: TINI_VERSION, guestHelperSha256: opts.guestHelper?.sha256, mediaPins: MEDIA_PINS });
-    const recordDir = join(repoRecords, `${rKey.slice(0, KEY_PREFIX)}-${tKey.slice(0, KEY_PREFIX)}`);
-    return { repository, owner, name, repoRecords, recordDir, checkout, location, recipe, recipeKey: rKey, toolsKey: tKey, defaultText, claudeCodeVersion, nodeImage, logPath, release };
+    const recordDir = join(records, `${rKey.slice(0, KEY_PREFIX)}-${tKey.slice(0, KEY_PREFIX)}`);
+    return {
+      repository,
+      owner,
+      name,
+      repoRecords: records,
+      imageRepository,
+      tagName: shared ? SHARED_TAG_NAME : repository,
+      recordDir,
+      checkout,
+      location,
+      recipe,
+      recipeKey: rKey,
+      toolsKey: tKey,
+      claudeCodeVersion,
+      nodeImage,
+      logPath,
+      release
+    };
   } catch (err) {
     release();
     throw err;
@@ -302,12 +345,13 @@ async function buildRepositoryImage(opts, ports) {
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const scratchRoot = opts.tmpDir ?? tmpdir();
   const prepared = await prepareImageBuild(opts);
-  const { repository, repoRecords, checkout, location, recipe, recipeKey: rKey, toolsKey: tKey, defaultText, claudeCodeVersion, nodeImage, recordDir, logPath } = prepared;
+  const { repository, repoRecords, imageRepository, tagName, checkout, location, recipe, recipeKey: rKey, toolsKey: tKey, claudeCodeVersion, nodeImage, recordDir, logPath } = prepared;
+  const universal = location.kind === "default";
   const runnerLabel = runnerLabelValue(opts.configPath);
-  const buildTag = `${TAG_HOST}/build/${repository}:${rKey.slice(0, KEY_PREFIX)}-${tKey.slice(0, KEY_PREFIX)}`;
-  const recipeTag = `${TAG_HOST}/recipe/${repository}:${rKey.slice(0, KEY_PREFIX)}`;
+  const buildTag = `${TAG_HOST}/build/${tagName}:${rKey.slice(0, KEY_PREFIX)}-${tKey.slice(0, KEY_PREFIX)}`;
+  const recipeTag = `${TAG_HOST}/recipe/${tagName}:${rKey.slice(0, KEY_PREFIX)}`;
   try {
-    const existing = await host.list(repository);
+    const existing = await host.list(imageRepository);
     const labelled = existing.find((i) => i.labels[KIND2] === "recipe" && i.labels[RECIPE_KEY2] === rKey);
     const recipeImageBefore = labelled !== void 0 && (await host.inspect(recipeTag))?.id === labelled.id ? labelled : void 0;
     const buildImageBefore = existing.find(
@@ -325,46 +369,36 @@ async function buildRepositoryImage(opts, ports) {
     const layoutKept = () => existsSync(join(keptLayout, "index.json"));
     let recipeImage = recipeImageBefore;
     let recipeBuilt = false;
-    if (recipeImage === void 0 && buildImageBefore === void 0) {
+    if (!universal && recipeImage === void 0 && buildImageBefore === void 0) {
       await ensureBuilder();
       mkdirSync(join(repoRecords, LAYOUTS_DIR), { recursive: true, mode: RUNNER_DIR_MODE });
-      const labels = { [REPOSITORY]: repository, [KIND2]: "recipe", [RUNNER2]: runnerLabel, [RECIPE_KEY2]: rKey };
-      if (location.kind === "default") {
-        const context = mkdtempSync(join(scratchRoot, "ol-image-default-"));
-        try {
-          const status = await host.buildDockerfile({ dockerfile: defaultText, context, tag: recipeTag, labels, logPath, layoutOut: keptLayout });
-          if (status !== 0) throw failed("the docker build of the default image", status);
-        } finally {
-          rmSync(context, { recursive: true, force: true });
-        }
-      } else {
-        const config = writeSanitizedRecipe(checkout.dir, location, recipe);
-        const scratchLayouts = mkdtempSync(join(scratchRoot, "ol-image-layout-"));
-        const scratchLayout = join(scratchLayouts, "layout");
+      const labels = { [REPOSITORY]: imageRepository, [KIND2]: "recipe", [RUNNER2]: runnerLabel, [RECIPE_KEY2]: rKey };
+      const config = writeSanitizedRecipe(checkout.dir, location, recipe);
+      const scratchLayouts = mkdtempSync(join(scratchRoot, "ol-image-layout-"));
+      const scratchLayout = join(scratchLayouts, "layout");
+      try {
+        const status = await host.devcontainerBuild({ workspace: checkout.dir, config, imageName: recipeTag, labels, logPath, layoutOut: scratchLayout });
+        if (status !== 0) throw failed("devcontainer build", status);
+        if (!existsSync(join(scratchLayout, "index.json"))) throw failed("devcontainer build, which left no image to label,", 0);
+        const context = mkdtempSync(join(scratchRoot, "ol-image-label-"));
         try {
-          const status = await host.devcontainerBuild({ workspace: checkout.dir, config, imageName: recipeTag, labels, logPath, layoutOut: scratchLayout });
-          if (status !== 0) throw failed("devcontainer build", status);
-          if (!existsSync(join(scratchLayout, "index.json"))) throw failed("devcontainer build, which left no image to label,", 0);
-          const context = mkdtempSync(join(scratchRoot, "ol-image-label-"));
-          try {
-            const relabel = await host.buildDockerfile({
-              dockerfile: `FROM ${recipeTag}
+          const relabel = await host.buildDockerfile({
+            dockerfile: `FROM ${recipeTag}
 `,
-              context,
-              tag: recipeTag,
-              labels,
-              logPath,
-              base: { ref: recipeTag, layout: scratchLayout },
-              layoutOut: keptLayout
-            });
-            if (relabel !== 0) throw failed("labelling the recipe image", relabel);
-          } finally {
-            rmSync(context, { recursive: true, force: true });
-          }
+            context,
+            tag: recipeTag,
+            labels,
+            logPath,
+            base: { ref: recipeTag, layout: scratchLayout },
+            layoutOut: keptLayout
+          });
+          if (relabel !== 0) throw failed("labelling the recipe image", relabel);
         } finally {
-          rmSync(config, { force: true });
-          rmSync(scratchLayouts, { recursive: true, force: true });
+          rmSync(context, { recursive: true, force: true });
         }
+      } finally {
+        rmSync(config, { force: true });
+        rmSync(scratchLayouts, { recursive: true, force: true });
       }
       recipeImage = await host.inspect(recipeTag) ?? void 0;
       if (recipeImage === void 0) throw failed("finding the recipe image after devcontainer build", 0);
@@ -373,7 +407,7 @@ async function buildRepositoryImage(opts, ports) {
     let buildImage = buildImageBefore;
     if (buildImage === void 0) {
       await ensureBuilder();
-      if (!layoutKept()) await host.exportLayout(recipeTag, keptLayout);
+      if (!universal && !layoutKept()) await host.exportLayout(recipeTag, keptLayout);
       const context = mkdtempSync(join(scratchRoot, "ol-image-tools-"));
       try {
         cpSync(opts.cli.distDir, join(context, "dist"), { recursive: true });
@@ -383,9 +417,16 @@ async function buildRepositoryImage(opts, ports) {
           mkdirSync(join(context, "guest"));
           cpSync(opts.guestHelper.path, join(context, "guest", "outerlayer-guest"));
         }
-        const dockerfile = toolsDockerfile({ recipeImage: recipeTag, nodeImage, claudeCodeVersion, buildId: opts.cli.buildId, guestHelper: opts.guestHelper !== void 0 });
-        const labels = { [REPOSITORY]: repository, [KIND2]: "build", [RUNNER2]: runnerLabel, [RECIPE_KEY2]: rKey, [TOOLS_KEY]: tKey };
-        const status = await host.buildDockerfile({ dockerfile, context, tag: buildTag, labels, logPath, base: { ref: recipeTag, layout: keptLayout } });
+        const dockerfile = toolsDockerfile({
+          recipeImage: universal ? UNIVERSAL_IMAGE : recipeTag,
+          nodeImage,
+          claudeCodeVersion,
+          buildId: opts.cli.buildId,
+          guestHelper: opts.guestHelper !== void 0,
+          ...universal ? { universal: true } : {}
+        });
+        const labels = { [REPOSITORY]: imageRepository, [KIND2]: "build", [RUNNER2]: runnerLabel, [RECIPE_KEY2]: rKey, [TOOLS_KEY]: tKey };
+        const status = await host.buildDockerfile({ dockerfile, context, tag: buildTag, labels, logPath, ...universal ? {} : { base: { ref: recipeTag, layout: keptLayout } } });
         if (status !== 0) throw failed("the docker build of the tools layer", status);
       } finally {
         rmSync(context, { recursive: true, force: true });
@@ -401,6 +442,7 @@ async function buildRepositoryImage(opts, ports) {
         sourceCommit: checkout.commit,
         defaultBranch: checkout.defaultBranch,
         recipe: location.kind === "default" ? "default" : location.path,
+        ...universal ? { base: { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}`, digest: UNIVERSAL_IMAGE_DIGEST } } : {},
         recipeKey: rKey,
         toolsKey: tKey,
         imageId: buildImage.id,
@@ -409,9 +451,12 @@ async function buildRepositoryImage(opts, ports) {
         ...classifyProperties(recipe, metadataOf(recipeImage ?? buildImage))
       };
       writeRecord(recordDir, report, now().toISOString());
+    } else if (universal) {
+      report = { ...report, repository, sourceCommit: checkout.commit, defaultBranch: checkout.defaultBranch };
     }
     const removed = [];
-    if (toolsBuilt) removed.push(...await prune(host, repository, repoRecords, opts.keep ?? KEEP_BUILD_IMAGES, runnerDir(opts.configPath), runnerLabel));
+    if (toolsBuilt) removed.push(...await prune(host, imageRepository, repoRecords, opts.keep ?? KEEP_BUILD_IMAGES, runnerDir(opts.configPath), runnerLabel));
+    if (universal) removed.push(...await prune(host, repository, join(imagesDir(opts.configPath), prepared.owner, prepared.name), 0, runnerDir(opts.configPath), runnerLabel));
     return {
       reused: !recipeBuilt && !toolsBuilt,
       recipeBuilt,
@@ -448,4 +493,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath, runnerL
   return removed;
 }
 
-export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, writeRecord };
+export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, baseLines, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, writeRecord };

package/dist/{chunk-T375XV3H.js → chunk-62URQYCB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-KDSKFXPE.js';
+import { signRunnerRequest, signerFor } from './chunk-RJZZFAXS.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';