@outerlayer/cli 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @outerlayer/cli
 
+## 0.10.1
+
+### Patch Changes
+
+- 92fa05e: `outerlayer sync` no longer drops freshly emitted artifacts as "blob missing from the spool" when another sync runs at the same time. Syncs now take turns on the artifact spool and re-read it before uploading, so a record another sync already handled is left alone. When a blob really is missing, the warning names the artifact id and the file it looked for.
+
+## 0.10.0
+
+### Minor Changes
+
+- 60067bc: `outerlayer work pr` and `outerlayer work open-pr` now declare a pull request onto the work item named by `OUTERLAYER_WORK`, and refuse when the session is not on that item. The message names both item numbers and `--session-id`. A successful declaration prints the item's number and title. `outerlayer work pr <n> --withdraw --item <number>` removes a wrong declaration.
+
 ## 0.9.0
 
 ### Minor Changes

package/README.md

@@ -74,8 +74,10 @@ content:
   hook spawns `outerlayer work link-session` when you launch a session with
   `OUTERLAYER_WORK`, naming the item and the session id — the item itself
   must already exist, created ahead of time with `outerlayer work build --local`.
-  `outerlayer work pr` sends the session id and the pull request number and
-  repository — never the session's own content. `outerlayer work open-pr`
+  `outerlayer work pr` sends the session id, the `OUTERLAYER_WORK` item
+  number and the pull request number and repository — never the session's
+  own content. With `--withdraw` it sends a DELETE naming the item, the
+  repository and the pull request number. `outerlayer work open-pr`
   sends the pull request's title and the text of the body file you name. In a
   host build, which holds an item key, it goes to the gateway, which opens or
   edits the pull request as the factory's GitHub App on the branch the claim
@@ -375,7 +377,7 @@ before it gives up.
 | `outerlayer work remove --issue <n>\|--pr <n> --reason <text> [--repo]` | Withdraws the caller's own addition, recording the reason. Never deletes anything; the item leaves the Work page only once no live addition remains on it. Removing again is a no-op that still succeeds. |
 | `outerlayer work status --issue <n>\|--pr <n> [--repo]` | Shows one item's stage, section, gate ledger, linked pull requests and sessions, and its additions. |
 | `outerlayer work list [--stage] [--section] [--repo] [--claimed] [--unclaimed] [--startable] [--needs amend]` | Lists live work items for the current factory, filterable by stage, section, claim state, startability and whether a comment thread is waiting on an agent. |
-| `outerlayer work pr <n> [--repo] [--session-id]` | Run inside a session on a work item: declares that pull request `<n>` in the checkout's repository belongs to that item. Idempotent — declaring the same pull request twice is a no-op. Refuses when the session is on no item, or the repository is not connected. |
+| `outerlayer work pr <n> [--repo] [--session-id] [--withdraw --item <number>]` | Run inside a session on a work item: declares that pull request `<n>` in the checkout's repository belongs to the `OUTERLAYER_WORK` item. Idempotent — declaring the same pull request twice is a no-op. Refuses when the session is not on that item, or the repository is not connected. `--withdraw --item <number>` removes that item's declaration; it needs your own login. |
 | `outerlayer work open-pr --title <text> --body-file <path> [--repo] [--session-id] [--json]` | Opens the pull request for the work item this session is on, or edits the one already open on its branch. A host build, which holds an item key, sends it to the gateway, which opens it as the factory's GitHub App from the branch the claim named; no `gh` command runs. Your own session runs `gh pr create` or `gh pr edit` under your login and then declares the pull request on the item. Run it again after changing the title or description. |
 | `outerlayer work claim --item <n>\|--issue <n> --kind implement\|amend [--repo] [--host] [--seconds]` | Records a lease for this host (default: its own hostname), so two hosts never build the same item at once. The lease belongs to the runner key that claimed it: a live lease held by a different key is refused, even under the same host name, and claiming again with the same key extends it. The first claim creates the host key (`host-key.pem` beside the config file) and binds the runner key to it; from then on every request made with that key is signed. Lease length defaults to 900 seconds, the server's own cap. |
 | `outerlayer work renew --item <n>\|--issue <n> [--repo] [--host] [--seconds]` | Extends this host's own live lease. Refused if the lease has expired, or if a different runner key holds it (403 `claim_not_held`). |

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-07T00:34:36.863Z+f427d9c","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-07T13:16:15.617Z+e27c8d7","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-5DKTBWT3.js → builder-EVO6F2NO.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-TV36SKEN.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-JSUUXA5W.js';
 import './chunk-CX22S5BA.js';
-import './chunk-LTJPX7TX.js';
+import './chunk-IU4NZROR.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-M6G7TJVF.js';
 import './chunk-YT35WGIP.js';

package/dist/{check-VJRJ2KQ4.js → check-RBRRI77E.js}

@@ -1,43 +1,43 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-YCPV7FN6.js';
+import { probeCredentials } from './chunk-4AVAETSU.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-I2UOAV7X.js';
 import './chunk-ABIWDUMS.js';
-import './chunk-OSKO3PAL.js';
+import './chunk-KZ5M4QOB.js';
 import './chunk-T6OIJQRT.js';
 import './chunk-PDTSUOVT.js';
 import './chunk-UGP76IZ5.js';
-import './chunk-VMK7I3TB.js';
+import './chunk-HKUH5AR2.js';
 import './chunk-V42JY4F6.js';
-import './chunk-543OT6V5.js';
+import './chunk-Y6P5XX2B.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-XGCJNSI7.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-ESZJ5QIC.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-WJBJY5DQ.js';
-import './chunk-QPPPUKQJ.js';
-import './chunk-LBU4CLK5.js';
+import './chunk-MC6J453K.js';
+import './chunk-472KC6JV.js';
+import './chunk-BREEX2Z7.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
 import './chunk-JKIWMRFH.js';
 import './chunk-3FMPZPJQ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-FKFGQJNN.js';
+import './chunk-VVIRHTH4.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-TV36SKEN.js';
+import './chunk-JSUUXA5W.js';
 import './chunk-CX22S5BA.js';
 import './chunk-6CXYORUS.js';
 import './chunk-S6IUUNCD.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-KWCJLAHQ.js';
-import './chunk-KPUJGBA4.js';
+import './chunk-DTDZXDQ3.js';
+import './chunk-ZQ5JGHUO.js';
 import './chunk-BFESLKPP.js';
-import './chunk-LYESSQUA.js';
-import './chunk-ZEQMTBRD.js';
-import './chunk-LTJPX7TX.js';
+import './chunk-UES67HLJ.js';
+import './chunk-VDI5POCC.js';
+import './chunk-IU4NZROR.js';
 import './chunk-USO2DKBD.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';

package/dist/{chunk-QPPPUKQJ.js → chunk-472KC6JV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-LBU4CLK5.js';
+import { MIN_ENGINE_MAJOR } from './chunk-BREEX2Z7.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-YCPV7FN6.js → chunk-4AVAETSU.js}

@@ -3,20 +3,20 @@ import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-OSKO3PAL.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-KZ5M4QOB.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
 import { RUNNER_PROTOCOL } from './chunk-PDTSUOVT.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-XGCJNSI7.js';
+import { placeholderQueues, placeholderProblem } from './chunk-ESZJ5QIC.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-LBU4CLK5.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-BREEX2Z7.js';
 import { checkFit } from './chunk-JKIWMRFH.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-FKFGQJNN.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-TV36SKEN.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KWCJLAHQ.js';
+import { spawnRun } from './chunk-VVIRHTH4.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-JSUUXA5W.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-DTDZXDQ3.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-M2PBLRB7.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-M6G7TJVF.js';
@@ -1236,7 +1236,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-TK4VOOHL.js');
+  const { postJson: postJson2 } = await import('./work-cmd-ZJY3NA2G.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1972,7 +1972,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-VJRJ2KQ4.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-RBRRI77E.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-LBU4CLK5.js → chunk-BREEX2Z7.js}

@@ -3,14 +3,14 @@ import { createRequire } from 'node:module';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3FMPZPJQ.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-FKFGQJNN.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-VVIRHTH4.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-TV36SKEN.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-JSUUXA5W.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { execCapture } from './chunk-6CXYORUS.js';
 import { GUEST_CID } from './chunk-S6IUUNCD.js';
-import { WorkCommandError, postJson } from './chunk-KWCJLAHQ.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-LTJPX7TX.js';
+import { WorkCommandError, postJson } from './chunk-DTDZXDQ3.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-IU4NZROR.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-M6G7TJVF.js';

package/dist/{chunk-KWCJLAHQ.js → chunk-DTDZXDQ3.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-KPUJGBA4.js';
+import { autoConnect } from './chunk-ZQ5JGHUO.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { sanitizeTerminal } from './chunk-ZEQMTBRD.js';
-import { resolveRepoIdentity } from './chunk-LTJPX7TX.js';
+import { sanitizeTerminal } from './chunk-VDI5POCC.js';
+import { resolveRepoIdentity } from './chunk-IU4NZROR.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';

package/dist/{chunk-XGCJNSI7.js → chunk-ESZJ5QIC.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-WJBJY5DQ.js';
-import { describeCallFailure } from './chunk-LBU4CLK5.js';
-import { WorkCommandError, getJson } from './chunk-KWCJLAHQ.js';
-import { sanitizeTerminal } from './chunk-ZEQMTBRD.js';
+import { isPlaceholderCommand } from './chunk-MC6J453K.js';
+import { describeCallFailure } from './chunk-BREEX2Z7.js';
+import { WorkCommandError, getJson } from './chunk-DTDZXDQ3.js';
+import { sanitizeTerminal } from './chunk-VDI5POCC.js';
 import { builtinKind } from './chunk-M2PBLRB7.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-M6G7TJVF.js';
 import { signerFor } from './chunk-V7NIVOFD.js';

package/dist/{chunk-VMK7I3TB.js → chunk-HKUH5AR2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-543OT6V5.js';
-import { CaptureDaemon } from './chunk-LTJPX7TX.js';
+import { LiveUploader } from './chunk-Y6P5XX2B.js';
+import { CaptureDaemon } from './chunk-IU4NZROR.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
 import { spoolDir } from './chunk-4HMXH2OA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/chunk-I263FZ3A.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { autoConnect } from './chunk-ZQ5JGHUO.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { resolveRepoIdentity } from './chunk-IU4NZROR.js';
+import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
+import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+
+createRequire(import.meta.url);
+
+// src/work-pr-cmd.ts
+var GREEN = "\x1B[32m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+var WorkPrCommandError = class extends Error {
+};
+function resolveCredentials(opts) {
+  const resolved = resolveGatewayCredentials(opts);
+  if (!resolved.ok) throw new WorkPrCommandError(resolved.message);
+  return { url: resolved.url, apiKey: resolved.credential, appId: resolved.appId };
+}
+function resolveRepository(repoFlag, cwd) {
+  if (repoFlag) return repoFlag;
+  const identity = resolveRepoIdentity(cwd);
+  if (identity.gitRepo) return identity.gitRepo;
+  throw new WorkPrCommandError(
+    "no repository. Pass --repo <owner/name>, or run from a git checkout with a remote."
+  );
+}
+function resolvePrNumber(raw) {
+  const n = parseTrackerNumber(raw);
+  if (n === void 0) throw new WorkPrCommandError(trackerNumberError("<n>", raw ?? ""));
+  return n;
+}
+var SESSION_ID_HINT = "pass --session-id <id> to name the session that was launched on the item";
+function sessionNotOnItemMessage(error, sessionId) {
+  const on = error.sessionItems;
+  const onText = on === void 0 ? "" : `; it is on ${on.length === 0 ? "no work item" : on.map((n) => `item ${n}`).join(", ")}`;
+  return `session ${sessionId} is not on item ${error.workItem ?? "?"} (OUTERLAYER_WORK)${onText}. Nothing was declared. If another session was launched for item ${error.workItem ?? "?"}, ${SESSION_ID_HINT}.`;
+}
+function itemLabel(data) {
+  if (data.workItemNumber == null) return data.workItemId;
+  return data.workItemTitle ? `item ${data.workItemNumber} ${DIM}\xB7${RESET} ${data.workItemTitle}` : `item ${data.workItemNumber}`;
+}
+async function runWorkPrWithdraw(opts, ctx) {
+  const itemNumber = parseTrackerNumber(opts.item);
+  if (itemNumber === void 0) {
+    throw new WorkPrCommandError("--withdraw needs --item <number>, the item to remove the declaration from.");
+  }
+  const { creds, prNumber, repository, sessionId } = ctx;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
+  const query = sessionId === void 0 ? "" : `?sessionId=${encodeURIComponent(sessionId)}`;
+  const endpoint = new URL(
+    `/v1/work-items/${itemNumber}/pull-requests/${encodeURIComponent(repository)}/${prNumber}${query}`,
+    creds.url
+  ).toString();
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "DELETE",
+      headers: { authorization: `Bearer ${creds.apiKey}`, "x-outerlayer-app-id": creds.appId }
+    });
+  } catch (err) {
+    throw new WorkPrCommandError(`network error reaching ${endpoint}: ${String(err)}`);
+  }
+  if (response.status === 401) throw new WorkPrCommandError(unauthorizedMessage(creds.apiKey));
+  let json;
+  try {
+    json = await response.json();
+  } catch {
+    throw new WorkPrCommandError(
+      `${endpoint} answered ${response.status} with a body that is not JSON \u2014 the request may not have reached the gateway`
+    );
+  }
+  if (!response.ok || !json.data) {
+    if (json.error?.code === "withdraw_needs_person") {
+      throw new WorkPrCommandError("only a person can withdraw a declaration; run this from your own login, not an agent session or a factory key.");
+    }
+    if (json.error?.code === "declaration_not_found") {
+      throw new WorkPrCommandError(`item ${itemNumber} has no declaration of ${repository}#${prNumber}.`);
+    }
+    if (json.error?.code === "work_item_not_found") {
+      throw new WorkPrCommandError(`item ${itemNumber} does not exist in this factory.`);
+    }
+    throw new WorkPrCommandError(json.error?.message ?? `request failed (${response.status})`);
+  }
+  const data = json.data;
+  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} withdrawn ${DIM}\xB7${RESET} ${data.repository}#${data.prNumber} ${DIM}from${RESET} item ${itemNumber}`;
+  if (!opts.quiet) process.stdout.write(output + "\n");
+  return { data, output };
+}
+async function runWorkPr(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homeFromEnv(env);
+  const refusal = await autoConnect({ ...opts, repository: opts.repo });
+  if (refusal !== void 0) throw new WorkPrCommandError(refusal);
+  const creds = resolveCredentials(opts);
+  const prNumber = resolvePrNumber(opts.number);
+  const repository = resolveRepository(opts.repo, cwd);
+  const identity = resolveRepoIdentity(cwd);
+  const sessionId = opts.sessionId ?? detectActiveSession({
+    env,
+    home,
+    cwds: identity.repoRoot !== void 0 ? [identity.repoRoot, cwd] : [cwd],
+    nowMs: Date.now()
+  });
+  if (opts.withdraw) return runWorkPrWithdraw(opts, { creds, prNumber, repository, sessionId });
+  let workItem;
+  if (env.OUTERLAYER_WORK !== void 0) {
+    const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
+    if (!("number" in parsed)) throw new WorkPrCommandError(parsed.reason);
+    workItem = parsed.number;
+  }
+  if (sessionId === void 0) {
+    throw new WorkPrCommandError(
+      `no active session detected. \`work pr\` declares a pull request from inside the session that opened it, or ${SESSION_ID_HINT}.`
+    );
+  }
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
+  const headers = {
+    "content-type": "application/json",
+    authorization: `Bearer ${creds.apiKey}`,
+    "x-outerlayer-app-id": creds.appId
+  };
+  const endpoint = new URL("/v1/work-items/pull-requests", creds.url).toString();
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        sessionId,
+        workItem,
+        // JSON.stringify omits it when undefined
+        pullRequest: { repository, number: prNumber }
+      })
+    });
+  } catch (err) {
+    throw new WorkPrCommandError(`network error reaching ${endpoint}: ${String(err)}`);
+  }
+  if (response.status === 401) {
+    throw new WorkPrCommandError(
+      unauthorizedMessage(creds.apiKey)
+    );
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch {
+    throw new WorkPrCommandError(
+      `${endpoint} answered ${response.status} with a body that is not JSON \u2014 the request may not have reached the gateway`
+    );
+  }
+  if (!response.ok || !json.data) {
+    if (json.error?.code === "session_not_on_item") {
+      if (response.status === 409) throw new WorkPrCommandError(sessionNotOnItemMessage(json.error, sessionId));
+      throw new WorkPrCommandError("this session is not launched on a work item.");
+    }
+    if (json.error?.code === "work_item_not_found" && workItem !== void 0) {
+      throw new WorkPrCommandError(`OUTERLAYER_WORK names item ${workItem}, which does not exist in this factory.`);
+    }
+    if (json.error?.code === "repository_not_connected") {
+      throw new WorkPrCommandError(`${repository} is not a workpiece of this factory.`);
+    }
+    throw new WorkPrCommandError(json.error?.message ?? `request failed (${response.status})`);
+  }
+  const data = json.data;
+  const verb = data.created ? "declared" : "already declared";
+  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} ${verb} ${DIM}\xB7${RESET} ${data.repository}#${data.prNumber} ${DIM}\u2192${RESET} ${itemLabel(data)}`;
+  if (!opts.quiet) process.stdout.write(output + "\n");
+  return { data, output };
+}
+
+export { WorkPrCommandError, itemLabel, runWorkPr };