@patronage/factory-ci 1.0.0-alpha.21 → 1.0.0-alpha.22

package/README.md

@@ -256,6 +256,42 @@ const jobs = [
 
 The audit job is `always()` so a failed destroy still runs the stage-wide check. It does not receive a stack name or path filter — per-stack audit filters are rejected because they trade away the whole-stage guarantee (paitronage#1143). `previewCleanupDestroyJobId(stack)` is the same id mapping callers can use when they assemble destroy jobs by hand.
 
+### Merge-freeze writer job
+
+```ts
+import { factoryMergeFreezeJob } from "@patronage/factory-ci";
+
+const freeze = factoryMergeFreezeJob({
+  createGithubAppToken: workflowArtifact.actions.createGithubAppToken,
+  needs: [changes, core, docs],
+});
+
+const jobs = [
+  changes,
+  core,
+  docs,
+  job(freeze.jobId, {
+    name: freeze.jobName,
+    needs: freeze.needs,
+    if: freeze.if,
+    runsOn: "ubuntu-latest",
+    permissions: freeze.permissions,
+    timeoutMinutes: 10,
+    steps: freeze.steps,
+  }),
+];
+```
+
+A consumer's generated merge-target-push Verify workflow is the only producer of `patronage-factory/merge-freeze` generations (#356, ADR 0016 as amended; #429, #872). A red merge-target Verify completes a generation active, a green one completes it inactive, and `pr:ready` reads the generation on the candidate's own base tip. No command, scheduled job, or second workflow writes that check run; the operator override (`demand:waive --demand merge-freeze`) waives the demand for one candidate and never writes here.
+
+`factoryMergeFreezeJob` owns everything a reader trusts: the check name (`FACTORY_MERGE_FREEZE_CHECK_NAME`), the pinned Patronage Factory App identity, the `actions/create-github-app-token` inputs, the `needs.*.result` fold (`FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION`), the merge-target condition (`FACTORY_MERGE_FREEZE_IF`, built from `FACTORY_MERGE_TARGET_REF_CONDITION`), and the job's least-privilege `permissions` (an empty block: the App installation token carries the check-run write, the job uses no `GITHUB_TOKEN` scope, and it never checks out the repository). The caller owns the runner, the timeout, and the `needs` list.
+
+That `needs` list is the whole trust input: it must name **every authoritative verification leaf**, because the fold is what decides active or inactive. An empty list is refused — a fold over no needed job always reports success, which would report a merge target nothing verified as green.
+
+`if` is `always() && github.event_name == 'push' && (main or epic/**)`. Each clause is load-bearing. `always()` keeps the red path running when a needed job failed. `push` keeps a `pull_request` run from writing a generation at its synthetic merge SHA. The namespace is literal by decision — `main` plus repository-owned `epic/**` integration branches — so a consumer's `push` trigger branch list names the same two things.
+
+The job needs no checkout and no install: it mints an App installation token, then makes two Checks API calls. The write is deliberately fail-closed, the opposite of the proof-reuse gate's fail-open shell. The step runs under the runner's default `bash -e {0}`, so any API refusal aborts it, the generation stays absent or `in_progress`, and every arming-time read of that tip refuses until a later push writes a green generation. `factoryMergeFreezeScript()` is that script alone, for a consumer test that executes it against a stubbed `gh` and parses the emitted payload with the factory package's `validateMergeFreezeState` — the round trip that keeps writer and reader from drifting.
+
 ### Generated shell
 
 ```ts
@@ -315,6 +351,8 @@ The **proof-reuse gate** decides whether a hosted job may reuse the local verifi
 
 The gate runs on pull requests and on pushes to the default branch (#611). A push run first reads proof at the pushed head. A squash merge mints a new commit, so when that direct read finds no generation at all, a **merge fallback** looks up the single merged pull request whose merge commit is the pushed head and reuses that PR head's proven check run — only when the merge commit's tree id equals the proven head's tree id, which makes the pushed content byte-identical to what was verified (a clean squash of an unchanged tip). Patch identity was considered and rejected as the comparator: `git patch-id` normalizes whitespace and ignores base motion, so an identical patch can still integrate into a tree nothing verified. No unique producing PR, an unreadable commit, a proof that is anything but proven, or tree drift from a dirty or stale merge all leave the direct refusal standing and run the full suite. The fallback needs `pull-requests: read` and `contents: read` on the job in addition to `checks: read`; a job that grants less loses only the fallback.
 
+`reuse` chooses which events may reuse proof (#873). It takes two values and nothing else, because the emitted condition is a trust predicate: a free-text override lets a consumer reuse proof on a ref nothing proved. `"pull-request-and-default-branch"` is the default and the behaviour above. `"pull-request"` emits `github.event_name == 'pull_request'` alone and omits the merge fallback, so every default-branch push executes the full hosted suite and the job needs only `checks: read`. Choose it when the merged commit must be verified in its own right; the consumer then owns that unconditional default-branch cost.
+
 A proof is reusable only when the complete Checks API result (`filter=all`, every page) establishes one unambiguous newest generation by greatest `started_at`, produced by the pinned App for the exact repository and head, completed successfully with `outcome: passed`, and covering every command identity the guarded surface requires. Coverage is the union of `executedCommands` and commands released by `notRequiredCommands` only after the gate validates each release against that same proof binding's command-to-target map and identity-bound impact stamp. Missing, malformed, duplicated, affected, unknown, or differently bound release data refuses reuse and runs the hosted surface. `mode` is reported as diagnostic metadata, never authorized on: a reduced-mode proof whose executed and stamp-authorized released commands cover a surface is reusable.
 
 The only thing a consumer chooses is **what its surface requires**, expressed as the plain profile command objects that surface selects — a repository with distinct core and docs jobs selects distinct sets and gets distinct required coverage. `proofReuseRequiredCommands()` is the single derivation both the gate and the assertion go through. Identities are baked into the emitted script, so they are held to a plain `[A-Za-z0-9_][\w.:@/-]*` allow-list and shell-quoted at the interpolation site; a selection carrying anything else is unusable and degrades to a gate that always refuses.
@@ -391,7 +429,7 @@ Registration is a consumer-readable read model. Cleanup outcomes are recorded by
 
 Persistence is an injectable GitHub transport in the same style as `mintInstallationToken`: the caller passes `fetch` and a token. This package does not read operator config or hold secrets. Records bind to the Patronage Factory GitHub App (`FACTORY_PROOF_GATE_APP_ID`) and the disposable-stage grammar. Check-runs named `patronage-factory/preview-proof` (`PREVIEW_PROOF_INVENTORY_CHECK_NAME`) carry the registration JSON. This API does not POST or PATCH issue comments.
 
-`list({ owner, repo, pr }, { token })` works with a workflow `GITHUB_TOKEN` (read). `persist` and `recordCleanup` write App-owned check-runs, which GitHub only allows the producing App to update. Pass an installation token the caller minted (`mintInstallationToken`); a job `GITHUB_TOKEN` cannot write those records. There is no `psf` command for this surface.
+`list({ owner, repo, pr }, { token })` works with a workflow `GITHUB_TOKEN` (read). Give that job `permissions: PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS` (also `previewProofInventory.listPermissions`): `checks: read`, `contents: read`, `pull-requests: read`. A job that omits `pull-requests: read` gets 403 on the PR commit listing for a same-repository PR and discovers nothing (#859). `persist` and `recordCleanup` write App-owned check-runs, which GitHub only allows the producing App to update. Pass an installation token the caller minted (`mintInstallationToken`); a job `GITHUB_TOKEN` cannot write those records. There is no `psf` command for this surface.
 
 `recordCleanup` loads the PR's registrations, applies `previewProofLifecycle.transition(..., { type: "cleanup" })`, then persists. Failed then passed uses that same event; in-memory re-entry from a failed outcome is `previewProofLifecycle.recover`, which calls that transition. Unknown stack or stage, and an identity mismatch on the disposable stage or head SHA, fail closed. Check-runs from another App, including `github-actions`, are ignored.
 

package/dist/index.d.ts

@@ -298,6 +298,20 @@ declare const previewProofLifecycle: {
  */
 /** Check-run name that carries one registration JSON payload. Not a gate. */
 declare const PREVIEW_PROOF_INVENTORY_CHECK_NAME = "patronage-factory/preview-proof";
+/**
+ * Least privilege for a job whose `GITHUB_TOKEN` calls `list`. A
+ * `permissions` block zeroes every unlisted scope, and `list` reads five
+ * endpoints: `pulls/{pr}`, `pulls/{pr}/commits`, and the GraphQL force-push
+ * timeline (`pull-requests`), `compare` (`contents`), and
+ * `commits/{sha}/check-runs` (`checks`). A job
+ * that omits `pull-requests: read` fails with 403 on a same-repository PR
+ * and skips every destroy matrix (#859). Give the discovery job this object.
+ */
+declare const PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS: Readonly<{
+  readonly checks: "read";
+  readonly contents: "read";
+  readonly "pull-requests": "read";
+}>;
 interface PreviewProofInventoryStore {
   list: (input: {
     owner: string;
@@ -371,6 +385,11 @@ declare class PreviewProofTransportError extends Error {
 declare const previewProofInventory: {
   readonly githubStore: (transport: PreviewProofInventoryTransport) => PreviewProofInventoryStore;
   readonly list: (input: PreviewProofInventoryListInput, access: PreviewProofInventoryAccess) => Promise<readonly PreviewProofRegistration[]>;
+  readonly listPermissions: Readonly<{
+    readonly checks: "read";
+    readonly contents: "read";
+    readonly "pull-requests": "read";
+  }>;
   readonly memoryStore: () => PreviewProofInventoryStore;
   readonly persist: (input: PreviewProofInventoryPersistInput, access: PreviewProofInventoryAccess) => Promise<void>;
   readonly recordCleanup: (input: PreviewProofInventoryCleanupInput, access: PreviewProofInventoryAccess) => Promise<PreviewProofRegistration>;
@@ -663,6 +682,36 @@ declare const FACTORY_PROOF_GATE_GUARD = "steps.factory-proof.outputs.reuse-proo
  * the default branch.
  */
 declare const FACTORY_PROOF_GATE_IF = "github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch))";
+/**
+ * Pull requests only — the condition a consumer gets with
+ * `reuse: "pull-request"` (#873).
+ *
+ * A repository may want its default-branch pushes to always execute the full
+ * hosted suite, whatever proof exists: the merged commit is what the fleet
+ * deploys, so a periodic unconditional run of every command is a deliberate
+ * cost some consumers choose to pay. This condition is that choice, expressed
+ * once here rather than as a consumer-written override string. The mode also
+ * skips the push-event merge fallback, so no push path can reuse proof even if
+ * the workflow reaches the step through some other trigger.
+ *
+ * Which branches trigger the workflow at all stays repository-owned. This
+ * condition only keeps the gate from consulting proof outside a pull request.
+ */
+declare const FACTORY_PROOF_GATE_PULL_REQUEST_IF = "github.event_name == 'pull_request'";
+/**
+ * Which events may reuse proof.
+ *
+ * A two-value enum, not a free-text condition: a string lets a consumer write
+ * a condition this package cannot reason about — one that reuses proof on an
+ * unproven ref — and the emitted condition is a trust predicate. The consumer
+ * chooses the mode; `factory-ci` owns what each mode emits.
+ *
+ * - `pull-request-and-default-branch` (default) pull requests plus pushes to
+ *   the merge target, with the merge fallback. Today's behaviour.
+ * - `pull-request` pull requests only. Default-branch pushes execute the full
+ *   hosted suite, and the merge fallback is not emitted.
+ */
+type FactoryProofGateReuse = "pull-request" | "pull-request-and-default-branch";
 /**
  * The complete refusal vocabulary. Deliberately few, because these are the
  * only distinctions the gate can honestly make from its Checks API reads.
@@ -746,6 +795,13 @@ interface FactoryProofGateOptions {
    * therefore requires a different coverage.
    */
   readonly commands: readonly ProofReuseCommand[];
+  /**
+   * Which events may reuse proof. Defaults to
+   * `"pull-request-and-default-branch"`, the behaviour every consumer has
+   * today. `"pull-request"` makes default-branch pushes execute the full
+   * hosted suite (#873).
+   */
+  readonly reuse?: FactoryProofGateReuse;
   /** Names the suite in the job summary. Changes no trust decision. */
   readonly surface: string;
 }
@@ -763,6 +819,7 @@ interface FactoryProofGateOptions {
  */
 declare const factoryProofGateScript: ({
   commands,
+  reuse,
   surface
 }: FactoryProofGateOptions) => string;
 interface FactoryProofGateStep {
@@ -772,7 +829,7 @@ interface FactoryProofGateStep {
     HEAD_SHA: string;
   }>;
   readonly id: typeof FACTORY_PROOF_GATE_STEP_ID;
-  readonly if: typeof FACTORY_PROOF_GATE_IF;
+  readonly if: typeof FACTORY_PROOF_GATE_IF | typeof FACTORY_PROOF_GATE_PULL_REQUEST_IF;
   readonly name: string;
   readonly run: string;
   readonly shell: typeof FACTORY_PROOF_GATE_SHELL;
@@ -785,7 +842,9 @@ interface FactoryProofGateStep {
  * `checks: read`; the push-event merge fallback additionally reads the
  * producing pull request (`pull-requests: read`) and the two commit objects
  * whose tree ids it compares (`contents: read`). A job that grants less
- * loses only the fallback — the failed read degrades to the full suite.
+ * loses only the fallback — the failed read degrades to the full suite. A
+ * consumer that passes `reuse: "pull-request"` emits neither the push clause
+ * nor the fallback, and needs only `checks: read` (#873).
  *
  * A **step, not a job**, and that is not a style preference. A separate gate
  * job that errored would leave the guarded job `skipped`, and a summary job
@@ -930,6 +989,137 @@ interface FactoryLifecycleContractLane {
  */
 declare const factoryLifecycleContractLane: (declaration?: FactoryLifecycleContractLaneOptions) => FactoryLifecycleContractLane | undefined;
 //#endregion
+//#region src/merge-freeze-job.d.ts
+/**
+ * The merge-freeze writer job (#356, ADR 0016 as amended; #429 for the
+ * merge-target namespace; #872 for this package).
+ *
+ * A consumer's generated merge-target-push Verify workflow is the ONLY
+ * producer of `patronage-factory/merge-freeze` generations: a red
+ * push-triggered Verify completes a generation active, a green one completes
+ * it inactive, and no command, scheduled job, or second workflow writes this
+ * check run. The operator override (`demand:waive --demand merge-freeze`)
+ * waives the demand for one candidate during a fix-forward; it never writes
+ * here.
+ *
+ * The write mirrors what the factory package's merge-freeze reader parses:
+ * create the run `in_progress` with no `started_at` (GitHub stamps the
+ * generation clock — the ordering rule itself is owned by the reader), then
+ * PATCH it completed with the reader-shaped state payload in `output.text`.
+ * The consumer's workflow test executes this exact script against a stubbed
+ * `gh` and parses the emitted payload with `validateMergeFreezeState`, so
+ * writer and reader cannot drift silently.
+ *
+ * Failure posture is deliberately fail-closed and the opposite of the
+ * proof-reuse gate's fail-open shell: this step runs under the runner's
+ * default `bash -e {0}`, so any API refusal aborts the step, the generation
+ * stays absent or `in_progress`, and every `pr:ready` arming-time read of
+ * that tip (#477) refuses until a later push writes a green generation.
+ *
+ * **Ownership line.** This package owns the check name, the App identity, the
+ * `create-github-app-token` inputs, the result fold, the merge-target `if`,
+ * and the job's `permissions`. The caller owns the runner, the `needs` list
+ * of every authoritative verification leaf, the timeout, and any extra env.
+ */
+/** The one check-run name every merge-freeze reader pins. */
+declare const FACTORY_MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
+declare const FACTORY_MERGE_FREEZE_JOB_ID = "freeze";
+declare const FACTORY_MERGE_FREEZE_JOB_NAME = "Report the merge freeze";
+/** Step id the token step exposes its installation token under. */
+declare const FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID = "factory-app-token";
+/**
+ * The GitHub Actions expression that folds the needed jobs' results into the
+ * one word the script branches on. It mirrors the `verify` summary job's
+ * failure condition exactly: any failed or cancelled needed job is a red
+ * merge target.
+ */
+declare const FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION = "${{ (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) && 'failure' || 'success' }}";
+/**
+ * The literal factory merge-target namespace, as a `github.ref` predicate
+ * (#429).
+ *
+ * `main` plus the repository-owned `epic/**` integration branches, and
+ * nothing else. Deliberately literal rather than profile-declared: one
+ * implementation per contract, no configuration machinery for a two-element
+ * namespace whose second element is a namespace prefix the repository itself
+ * owns. `epic/` needs the trailing slash — `startsWith` would otherwise admit
+ * `epicness/…`, which is not a merge target.
+ *
+ * A caller's `push` trigger branch list names the same namespace. That list
+ * decides which events produce a run at all; this predicate decides which of
+ * those runs may write a generation.
+ */
+declare const FACTORY_MERGE_TARGET_REF_CONDITION: string;
+/**
+ * `always()` is load-bearing: the red path is the whole point, so the job must
+ * run when a needed verification job failed. `github.event_name == 'push'` is
+ * load-bearing twice over: a `pull_request` run must never write a generation
+ * (its `github.sha` is a synthetic merge commit that no base tip is ever read
+ * at), and a `pull_request` trigger with an `epic/**` base list would
+ * otherwise reach this job.
+ */
+declare const FACTORY_MERGE_FREEZE_IF: string;
+/**
+ * Least privilege for the writer job: no `GITHUB_TOKEN` scope at all.
+ *
+ * Both Checks API calls run under the App installation token minted in the
+ * first step (`GH_TOKEN: steps.factory-app-token.outputs.token`), and the job
+ * never checks out the repository. So the job uses no `GITHUB_TOKEN` scope,
+ * and an empty block is the honest declaration. A `checks: write` here would
+ * hand every adopter an unused write scope (#884).
+ */
+declare const FACTORY_MERGE_FREEZE_PERMISSIONS: Readonly<{}>;
+/**
+ * The script the freeze step runs. Environment contract:
+ * - `GH_TOKEN`: an installation token for the pinned Patronage Factory App —
+ *   the check run must carry that App's identity or every reader rejects it.
+ * - `VERIFY_RESULT`: `success` or `failure` (see the fold expression above).
+ * - `GITHUB_SHA` / `GITHUB_REPOSITORY` / `GITHUB_SERVER_URL` /
+ *   `GITHUB_RUN_ID` / `GITHUB_REF_NAME`: runner-provided.
+ *
+ * `GITHUB_REF_NAME` is the merge target this run pushed to — `main` or an
+ * `epic/**` integration branch (#429). The job is gated to `push` events on
+ * exactly those refs, so the branch name is always the short name of a
+ * repository-owned merge target and never a pull-request merge ref. It
+ * appears in both recovery sentences because a reader of an epic-targeting
+ * candidate must be told which branch to fix forward on: the generation lives
+ * on that branch's tip, and only a later green push to THAT branch clears it.
+ */
+declare const factoryMergeFreezeScript: () => string;
+interface FactoryMergeFreezeJobOptions<TNeed> {
+  /** The pinned `actions/create-github-app-token` the caller declared. */
+  readonly createGithubAppToken: PinnedAction;
+  /**
+   * Every authoritative verification leaf this generation folds. The elements
+   * are whatever the caller's workflow generator uses for `needs:`; they are
+   * returned unchanged.
+   */
+  readonly needs: readonly TNeed[];
+  /**
+   * Override the result fold. Defaults to
+   * `FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION`, which is what a caller
+   * whose summary job folds `needs.*.result` wants. Supply one only when the
+   * caller's red condition is genuinely different.
+   */
+  readonly verifyResultExpression?: string;
+}
+interface FactoryMergeFreezeJob<TNeed> {
+  readonly if: typeof FACTORY_MERGE_FREEZE_IF;
+  readonly jobId: typeof FACTORY_MERGE_FREEZE_JOB_ID;
+  readonly jobName: typeof FACTORY_MERGE_FREEZE_JOB_NAME;
+  readonly needs: readonly TNeed[];
+  readonly permissions: typeof FACTORY_MERGE_FREEZE_PERMISSIONS;
+  readonly steps: readonly WorkflowStep[];
+}
+/**
+ * Build the merge-freeze writer job.
+ *
+ * An empty `needs` list is refused: a fold over no verification leaf is
+ * always `success`, so such a job would write a green generation for a merge
+ * target nothing verified — the exact failure the freeze exists to prevent.
+ */
+declare const factoryMergeFreezeJob: <TNeed>(options: FactoryMergeFreezeJobOptions<TNeed>) => FactoryMergeFreezeJob<TNeed>;
+//#endregion
 //#region src/pr-status-hud-workflow.d.ts
 declare const FACTORY_PR_STATUS_HUD_JOB_ID = "status-hud";
 declare const FACTORY_PR_STATUS_HUD_JOB_NAME = "Present PR status HUD";
@@ -946,9 +1136,9 @@ interface FactoryPrStatusHudWorkflowOptions {
   readonly createGithubAppToken: PinnedAction;
 }
 /**
- * Least privilege for the job that runs the present step. A `permissions`
- * block zeroes every unlisted GITHUB_TOKEN scope, and the inventory list
- * reads pull requests, commits, and check-runs with that token (#825).
+ * Least privilege for the job that runs the present step. The present step
+ * is an inventory `list`, so the job needs exactly the inventory's read
+ * permissions (#825, #859).
  */
 declare const FACTORY_PR_STATUS_HUD_PERMISSIONS: Readonly<{
   readonly checks: "read";
@@ -1366,4 +1556,4 @@ declare const assertWorkflowShellParses: (yaml: string, options: {
   readonly source: string;
 }) => void;
 //#endregion
-export { type BundleAlchemyEntryOptions, type CheckoutStepOptions, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, type ExecuteAlchemyEntryOptions, type ExecuteAlchemyEntryResult, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, type FactoryCandidateImpactWorkflow, type FactoryCandidateImpactWorkflowOptions, type FactoryLifecycleContractLane, type FactoryLifecycleContractLaneOptions, type FactoryPrStatusHudWorkflow, type FactoryPrStatusHudWorkflowOptions, type FactoryPreviewCleanupAuditJob, type FactoryPreviewCleanupDestroyJob, type FactoryPreviewCleanupTopology, type FactoryPreviewCleanupTopologyOptions, type FactoryProductionImpactWorkflow, type FactoryProductionImpactWorkflowOptions, type FactoryProofGateOptions, type FactoryProofGateReason, type FactoryProofGateStep, type FactoryProofReusePresentationOptions, type FactoryProofReuseSummaryStep, type FactoryProofTimingStartStep, type FactoryPushIdentityConsumer, type FactoryPushIdentityConsumerOptions, type FactoryPushIdentityDisposition, type FactoryPushIdentityEnvelope, type FactoryPushIdentityProducer, type FactoryPushIdentityProducerOptions, type FactoryWorkflowArtifact, type FactoryWorkflowOptions, type FactoryWorkflowSetupOptions, GitHubApiError, type GithubAppCredentials, type GithubAppTokenOptions, type InstallStepOptions, type LocalPreviewStage, type LocalPreviewStageOptions, NODE_PNPM_ACTION_FAMILY_NODE24, type NodePnpmActionFamily, PREVIEW_PROOF_INVENTORY_CHECK_NAME, type ParseLocalPreviewStageExpected, type ParsedLocalPreviewStage, type PinnedAction, type PreviewProofCandidate, type PreviewProofCleanupOutcome, type PreviewProofCleanupStatus, type PreviewProofEnvelopeEvidence, type PreviewProofInventoryAccess, type PreviewProofInventoryCleanupInput, type PreviewProofInventoryListInput, type PreviewProofInventoryPersistInput, type PreviewProofInventoryStore, type PreviewProofInventoryTransport, type PreviewProofLifecycleEvent, type PreviewProofLifecycleState, type PreviewProofRegistration, type PreviewProofResolveQuery, PreviewProofTransportError, type ProofReuseCommand, type ProofReuseCoverageInput, type ProofReuseCoverageReport, type SetupNodeStepOptions, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, type VitestJsonReport, type VitestProfile, type VitestProfileDependencies, type VitestProfileDurationSummary, type VitestProfileEnvironment, VitestProfileError, type VitestProfileOptions, type VitestProfileReadResult, type VitestProfileSample, type VitestProfileSampleExecution, type VitestTestStatus, type WorkflowShellParseFailure, type WorkflowStep, assertProofReuseCoverage, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };
+export { type BundleAlchemyEntryOptions, type CheckoutStepOptions, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, type ExecuteAlchemyEntryOptions, type ExecuteAlchemyEntryResult, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_PULL_REQUEST_IF, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, type FactoryCandidateImpactWorkflow, type FactoryCandidateImpactWorkflowOptions, type FactoryLifecycleContractLane, type FactoryLifecycleContractLaneOptions, type FactoryMergeFreezeJob, type FactoryMergeFreezeJobOptions, type FactoryPrStatusHudWorkflow, type FactoryPrStatusHudWorkflowOptions, type FactoryPreviewCleanupAuditJob, type FactoryPreviewCleanupDestroyJob, type FactoryPreviewCleanupTopology, type FactoryPreviewCleanupTopologyOptions, type FactoryProductionImpactWorkflow, type FactoryProductionImpactWorkflowOptions, type FactoryProofGateOptions, type FactoryProofGateReason, type FactoryProofGateReuse, type FactoryProofGateStep, type FactoryProofReusePresentationOptions, type FactoryProofReuseSummaryStep, type FactoryProofTimingStartStep, type FactoryPushIdentityConsumer, type FactoryPushIdentityConsumerOptions, type FactoryPushIdentityDisposition, type FactoryPushIdentityEnvelope, type FactoryPushIdentityProducer, type FactoryPushIdentityProducerOptions, type FactoryWorkflowArtifact, type FactoryWorkflowOptions, type FactoryWorkflowSetupOptions, GitHubApiError, type GithubAppCredentials, type GithubAppTokenOptions, type InstallStepOptions, type LocalPreviewStage, type LocalPreviewStageOptions, NODE_PNPM_ACTION_FAMILY_NODE24, type NodePnpmActionFamily, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, type ParseLocalPreviewStageExpected, type ParsedLocalPreviewStage, type PinnedAction, type PreviewProofCandidate, type PreviewProofCleanupOutcome, type PreviewProofCleanupStatus, type PreviewProofEnvelopeEvidence, type PreviewProofInventoryAccess, type PreviewProofInventoryCleanupInput, type PreviewProofInventoryListInput, type PreviewProofInventoryPersistInput, type PreviewProofInventoryStore, type PreviewProofInventoryTransport, type PreviewProofLifecycleEvent, type PreviewProofLifecycleState, type PreviewProofRegistration, type PreviewProofResolveQuery, PreviewProofTransportError, type ProofReuseCommand, type ProofReuseCoverageInput, type ProofReuseCoverageReport, type SetupNodeStepOptions, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, type VitestJsonReport, type VitestProfile, type VitestProfileDependencies, type VitestProfileDurationSummary, type VitestProfileEnvironment, VitestProfileError, type VitestProfileOptions, type VitestProfileReadResult, type VitestProfileSample, type VitestProfileSampleExecution, type VitestTestStatus, type WorkflowShellParseFailure, type WorkflowStep, assertProofReuseCoverage, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };