@patronage/factory-ci 1.0.0-alpha.26 → 1.0.0-alpha.28

package/dist/index.js

@@ -27,19 +27,28 @@ const ALCHEMY_BASELINE = {
 const BASELINE_PACKAGE_NAMES = Object.keys(ALCHEMY_BASELINE);
 /**
 * Fails when the consumer's `alchemy` or `effect` pin differs from
-* {@link ALCHEMY_BASELINE}. A package the consumer does not depend on at all
-* is not drift — both packages are optional peers of the `./alchemy`
-* subpath, so a consumer that never touches it carries neither.
+* {@link ALCHEMY_BASELINE}, or when only one of the pair is present.
+* Alchemy peers on Effect, so an unpinned auto-installed Effect can drift
+* outside the baseline while a lone `alchemy` pin would otherwise pass.
+* Both packages remaining absent is not drift — they are optional peers of
+* the `./alchemy` subpath, so a consumer that never touches it carries
+* neither.
 *
 * Reads only the `packageJson` object it is handed; it never walks the
 * filesystem.
 */
 const assertAlchemyBaseline = ({ packageJson }) => {
 	const drifted = [];
+	const pinOf = (name) => packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
+	const pairPresent = BASELINE_PACKAGE_NAMES.some((name) => pinOf(name) !== void 0);
 	for (const name of BASELINE_PACKAGE_NAMES) {
-		const pinned = packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
+		const pinned = pinOf(name);
 		const baseline = ALCHEMY_BASELINE[name];
-		if (pinned !== void 0 && pinned !== baseline) drifted.push(`${name}@${pinned} (baseline: ${name}@${baseline})`);
+		if (pinned === void 0) {
+			if (pairPresent) drifted.push(`missing ${name} (baseline: ${name}@${baseline})`);
+			continue;
+		}
+		if (pinned !== baseline) drifted.push(`${name}@${pinned} (baseline: ${name}@${baseline})`);
 	}
 	if (drifted.length > 0) throw new Error(`Alchemy fleet baseline drift: ${drifted.join(", ")}. Bump to match ALCHEMY_BASELINE in @patronage/factory-ci, or wait for the next lockstep release.`);
 };
@@ -433,6 +442,8 @@ var GitHubApiError = class extends Error {
 		this.status = status;
 	}
 };
+/** The Factory App broker's token: repo-scoped Checks write, nothing else. */
+const FACTORY_APP_BROKER_TOKEN_PERMISSIONS = { checks: "write" };
 const base64url = (value) => Buffer.from(value).toString("base64url");
 /**
 * The signed app JWT GitHub accepts as `Authorization: Bearer` for the App
@@ -461,6 +472,7 @@ const githubAppJwt = (credentials, options = {}) => {
 };
 const githubAppJson = (request, url, jwt, method, budget) => githubJson$1({
 	attempts: budget.attempts,
+	...budget.body === void 0 ? {} : { body: budget.body },
 	closeConnection: true,
 	fetch: request,
 	method,
@@ -493,7 +505,14 @@ const mintInstallationToken = async (input, options = {}) => {
 		if (typeof installation.id !== "number") throw new TypeError("GitHub App installation response omitted id");
 		installationId = installation.id;
 	}
-	const minted = await githubAppJson(request, `https://api.github.com/app/installations/${installationId}/access_tokens`, jwt, "POST", budget);
+	const restriction = input.permissions === void 0 && input.repositories === void 0 ? void 0 : JSON.stringify({
+		...input.permissions === void 0 ? {} : { permissions: input.permissions },
+		...input.repositories === void 0 ? {} : { repositories: [...input.repositories] }
+	});
+	const minted = await githubAppJson(request, `https://api.github.com/app/installations/${installationId}/access_tokens`, jwt, "POST", restriction === void 0 ? budget : {
+		...budget,
+		body: restriction
+	});
 	if (typeof minted.token !== "string") throw new TypeError("GitHub App token response omitted token");
 	return minted.token;
 };
@@ -504,13 +523,9 @@ const mintInstallationToken = async (input, options = {}) => {
 *
 * It answers one question, before checkout and before install: may this job
 * reuse the local verification the factory already published for *this exact
-* head*? By default it asks that only on a pull request, so every
-* default-branch push executes the full hosted suite (#863). A consumer may
-* opt into `reuse: "pull-request-and-default-branch"`, where one fallback
-* extends "this exact head" to "this exact tree": a squash merge whose result
-* tree is byte-identical to the producing pull request's proven head tree
-* reuses that head's proof (#611). Refusing runs hosted CI; it never fails
-* the candidate. Three
+* head*? It asks that only on a pull request, so every default-branch push
+* executes the full hosted suite (#863). Refusing runs hosted CI; it never
+* fails the candidate. Three
 * repositories had independently grown their own answer to that question and
 * had already drifted apart, so the answer lives here once, with the App
 * identity, check name, step identity, output names, guard, and every trust
@@ -607,54 +622,24 @@ const FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT = "source-check-url";
 */
 const FACTORY_PROOF_GATE_GUARD = `steps.${FACTORY_PROOF_GATE_STEP_ID}.outputs.${FACTORY_PROOF_GATE_OUTPUT} != 'true'`;
 /**
-* Pull requests, plus pushes to the merge target (#611) — the **opt-out**
-* condition a consumer gets with `reuse: "pull-request-and-default-branch"`.
-*
-* It buys runner time on the merge target and pays for it in coverage. No
-* local proof is ever written for a merged SHA, so the direct read finds
-* nothing after a squash merge. The push path therefore exists only together
-* with the merge fallback below: when no generation exists at the merged SHA,
-* the gate may look up the producing pull request and reuse its head proof,
-* but only when the merge result's tree is exactly the proven head's tree.
-* Deploy gates keep waiting for a green required check at the merged SHA; a
-* reused proof turns that check green through the same guarded steps a pull
-* request uses.
-*
-* The trade this mode accepts: a candidate's proof may be impact-scoped, and
-* an impact-scoped proof is a sound gate for the candidate and an unsound
-* gate for the merge target. #931 is that defect observed — a `main` push
-* reused a candidate proof, executed no command, and left a red package
-* unnoticed for three days. Choose this mode only when the consumer accepts
-* that risk for speed.
-*
-* The push side is deliberately the merge target only — the repository's
-* default branch — not every pushed branch. Which branches trigger a
-* consumer's workflow at all stays repository-owned; this condition only
-* keeps the gate from consulting proof on pushes that are not merges into
-* the default branch.
-*/
-const FACTORY_PROOF_GATE_IF = "github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch))";
-/**
-* Pull requests only — the **default** condition, and the condition a
-* consumer gets with `reuse: "pull-request"` (#873, default since #863).
+* Pull requests only — the gate's single condition (#873, default since #863,
+* the only mode since the merge-target opt-out was deleted).
 *
 * A merge target's guarantee is about the whole tree, not the diff. A
 * candidate proof only ever binds the diff the candidate was scoped to, so
 * reusing it on the merged commit proves less than the merge target needs.
-* Every default-branch push therefore executes the full hosted suite,
-* whatever proof exists. The mode also skips the push-event merge fallback,
-* so no push path can reuse proof even if the workflow reaches the step
-* through some other trigger.
+* #931 is that defect observed — a `main` push reused a candidate proof,
+* executed no command, and left a red package unnoticed for three days. Every
+* default-branch push therefore executes the full hosted suite, whatever
+* proof exists.
 *
 * Which branches trigger the workflow at all stays repository-owned. This
 * condition only keeps the gate from consulting proof outside a pull request.
 */
-const FACTORY_PROOF_GATE_PULL_REQUEST_IF = "github.event_name == 'pull_request'";
+const FACTORY_PROOF_GATE_IF = "github.event_name == 'pull_request'";
 /**
 * The complete refusal vocabulary. Deliberately few, because these are the
 * only distinctions the gate can honestly make from its Checks API reads.
-* The merge fallback adds no words: a fallback that establishes nothing
-* leaves the direct read's refusal standing, with the specifics in `detail`.
 *
 * - `proven`     a covering, passing, unambiguous proof for this exact head
 * - `none`       no App-verified factory check run at this commit
@@ -948,100 +933,7 @@ const safeLabel$1 = (surface) => {
 	const cleaned = (typeof surface === "string" ? surface : "").replaceAll(/[^\w -]/gu, "").trim().slice(0, 60);
 	return cleaned.length > 0 ? cleaned : "verification";
 };
-/**
-* The push-event merge fallback (#611), emitted only for
-* `reuse: "pull-request-and-default-branch"`. The default `"pull-request"`
-* mode omits it: that mode's whole point is that a default-branch push
-* executes everything, so a push path that could still reuse proof would
-* contradict the condition above it.
-*/
-const MERGE_FALLBACK_BLOCK = String.raw`# Merge fallback (#611). A squash merge mints a new commit, so the direct
-# read at a pushed merge-target head finds nothing even when the factory
-# proved the producing pull request head. Only when the direct read found no
-# generation at all on a push event, look up the producing pull request and
-# reuse its head proof — and only when the merge commit's TREE id equals the
-# proven head's tree id, which makes the pushed content byte-identical to
-# what was verified (a clean squash of an unchanged tip). Patch identity was
-# considered and rejected as the comparator: git patch-id normalizes
-# whitespace and ignores base motion, so an identical patch can still
-# produce an integrated tree that was never tested. Everything else — no
-# unique merged producing PR, an unreadable commit, a proof that is anything
-# but proven, or tree drift from a dirty or stale merge — leaves the direct
-# "none" refusal standing, so the full suite runs (fail open).
-if [ "$reason" = 'none' ] && [ "${shellExpansion$1("GITHUB_EVENT_NAME:-")}" = 'push' ]; then
-  producing_head=''
-  merge_tree=''
-  head_tree=''
-  if ! producing_pulls=$(gh api --method GET --paginate \
-      "repos/$GITHUB_REPOSITORY/commits/$HEAD_SHA/pulls" \
-      -f per_page=100 2>&1); then
-    detail="producing pull request unreadable: $producing_pulls"
-  elif ! producing_head=$(printf '%s' "$producing_pulls" | jq -r -s \
-      --arg sha "$HEAD_SHA" \
-      '[ add[]?
-         | select((.merged_at // null) != null)
-         | select((.merge_commit_sha // "") == $sha)
-         | ((.head.sha // "") | tostring) ]
-       | if length == 1 then .[0] else "" end' 2>&1); then
-    detail="producing pull request unreadable: $producing_head"
-    producing_head=''
-  elif ! [[ "$producing_head" =~ ^[0-9a-f]{40}$ ]]; then
-    detail='no single merged producing pull request at this commit'
-    producing_head=''
-  elif ! merge_commit=$(gh api --method GET \
-      "repos/$GITHUB_REPOSITORY/commits/$HEAD_SHA" 2>&1); then
-    detail="merge commit unreadable: $merge_commit"
-  elif ! merge_tree=$(printf '%s' "$merge_commit" | jq -r \
-      '(.commit.tree.sha // "") | tostring' 2>&1); then
-    detail="merge commit unreadable: $merge_tree"
-    merge_tree=''
-  elif ! [[ "$merge_tree" =~ ^[0-9a-f]{40}$ ]]; then
-    detail='merge commit carries no readable tree id'
-    merge_tree=''
-  elif ! head_commit=$(gh api --method GET \
-      "repos/$GITHUB_REPOSITORY/commits/$producing_head" 2>&1); then
-    detail="producing head commit unreadable: $head_commit"
-  elif ! head_tree=$(printf '%s' "$head_commit" | jq -r \
-      '(.commit.tree.sha // "") | tostring' 2>&1); then
-    detail="producing head commit unreadable: $head_tree"
-    head_tree=''
-  elif ! [[ "$head_tree" =~ ^[0-9a-f]{40}$ ]]; then
-    detail='producing head commit carries no readable tree id'
-    head_tree=''
-  elif [ "$merge_tree" != "$head_tree" ]; then
-    detail='tree drift: the merge result is not the proven head tree'
-    merge_tree=''
-  fi
-  if [[ "$producing_head" =~ ^[0-9a-f]{40}$ ]] \
-      && [[ "$merge_tree" =~ ^[0-9a-f]{40}$ ]] \
-      && [ "$merge_tree" = "$head_tree" ]; then
-    gate_lookup "$producing_head"
-    if [ "$lookup_reason" = 'proven' ]; then
-      reason=proven
-      mode="$lookup_mode"
-      missing=''
-      source_url="$lookup_url"
-      proof_head="$producing_head"
-      merge_note="the merge result's tree is byte-identical to the tree proven at pull request head $producing_head"
-    else
-      detail="producing pull request proof not reusable ($lookup_reason)"
-    fi
-  fi
-fi`;
-/**
-* The fallback with the blank lines that surround it, or nothing at all. Kept
-* as one piece so `pull-request-and-default-branch` emits the exact script
-* that mode emitted before the option existed.
-*
-* Tests for the opt-out value, matching `factoryProofGateStep`'s condition
-* ternary. The polarity is the point: the condition and the script are two
-* halves of one decision, so an unrecognized value — an untyped JavaScript
-* consumer's typo — must resolve to the safe default at both sites. Testing
-* for `"pull-request"` here would pair the PR-only condition with a script
-* that still carries the fallback, a combination no mode means.
-*/
-const mergeFallbackSection = (reuse) => reuse === "pull-request-and-default-branch" ? `\n${MERGE_FALLBACK_BLOCK}\n\n` : "\n";
-const gateScript = (required, surface, reuse) => String.raw`
+const gateScript = (required, surface) => String.raw`
 set -uo pipefail
 
 CHECK_NAME=${shellSingleQuote(FACTORY_PROOF_GATE_CHECK_NAME)}
@@ -1054,8 +946,6 @@ detail=''
 mode=''
 missing=''
 source_url=''
-proof_head="${shellExpansion$1("HEAD_SHA:-")}"
-merge_note=''
 
 # One proof lookup at one commit. Sets lookup_reason / lookup_mode /
 # lookup_missing / lookup_url, or lookup_detail when the read itself
@@ -1128,7 +1018,8 @@ else
   missing="$lookup_missing"
   source_url="$lookup_url"
 fi
-${mergeFallbackSection(reuse)}# The binding is App-verified, but it still reaches markdown. Only a plain
+
+# The binding is App-verified, but it still reaches markdown. Only a plain
 # lowercase token is quoted back; anything else is reported as unknown.
 case "$mode" in
   '') ;;
@@ -1156,7 +1047,7 @@ say ''
 
 case "$reason" in
   proven)
-    echo "Factory proof: reusing local verification of $proof_head; skipping the $SURFACE suite."
+    echo "Factory proof: reusing local verification of $HEAD_SHA; skipping the $SURFACE suite."
     say "Skipped. The factory already verified this exact content, so this job did not run the $SURFACE suite a second time."
     say ''
     if [ -n "$source_url" ]; then
@@ -1164,20 +1055,13 @@ case "$reason" in
     else
       say "- Reused proof: the \`$CHECK_NAME\` check run published by the pinned factory GitHub App."
     fi
-    say "- Covers head: \`$proof_head\`"
-    if [ -n "$merge_note" ]; then
-      say "- Merge-target reuse: $merge_note."
-    fi
+    say "- Covers head: \`$HEAD_SHA\`"
     say "- Recorded mode: \`$mode\` (diagnostic only), outcome \`passed\`."
     ;;
   none)
     say 'Ran the full suite. No trusted factory proof covers this commit.'
     say ''
     say "The factory GitHub App has published no \`$CHECK_NAME\` check run at head \`$HEAD_SHA\`. Proof is keyed to the commit, so proof written for any other commit is not visible here. A pull request opened by hand carries no factory proof at all, which is normal."
-    if [ -n "$detail" ]; then
-      say ''
-      say "- Merge fallback: $detail"
-    fi
     say ''
     say '${CORRECTIVE_LINE}'
     ;;
@@ -1251,22 +1135,16 @@ fi
 * `FACTORY_PROOF_GATE_SHELL` — so the script is also written to reach that
 * write under errexit, and the tests execute it both ways.
 */
-const factoryProofGateScript = ({ commands, reuse = "pull-request", surface }) => {
+const factoryProofGateScript = ({ commands, surface }) => {
 	const required = proofReuseRequiredCommands(commands);
-	return required ? gateScript(required, safeLabel$1(surface), reuse) : UNUSABLE_SELECTION_SCRIPT;
+	return required ? gateScript(required, safeLabel$1(surface)) : UNUSABLE_SELECTION_SCRIPT;
 };
 /**
 * The step itself, structurally accepted by gagen's `step()` without adding a
 * gagen runtime dependency. It belongs first in the job it guards: a few API
 * reads with the default `GITHUB_TOKEN`, no checkout, no install, so a proven
-* head costs a runner nothing beyond job startup. The default
-* `reuse: "pull-request"` emits neither the push clause nor the fallback, and
-* needs only `checks: read` (#873, #863). A consumer that opts into
-* `reuse: "pull-request-and-default-branch"` also runs the push-event merge
-* fallback, which reads the producing pull request (`pull-requests: read`)
-* and the two commit objects whose tree ids it compares (`contents: read`).
-* A job that grants less loses only the fallback — the failed read degrades
-* to the full suite.
+* head costs a runner nothing beyond job startup. The step runs on pull
+* requests only, so it needs only `checks: read` (#873, #863).
 *
 * A **step, not a job**, and that is not a style preference. A separate gate
 * job that errored would leave the guarded job `skipped`, and a summary job
@@ -1282,7 +1160,7 @@ const factoryProofGateStep = (options) => Object.freeze({
 		HEAD_SHA: githubExpression$1("github.event.pull_request.head.sha || github.sha")
 	}),
 	id: FACTORY_PROOF_GATE_STEP_ID,
-	if: options.reuse === "pull-request-and-default-branch" ? FACTORY_PROOF_GATE_IF : FACTORY_PROOF_GATE_PULL_REQUEST_IF,
+	if: FACTORY_PROOF_GATE_IF,
 	name: FACTORY_PROOF_GATE_STEP_NAME,
 	run: factoryProofGateScript(options),
 	shell: FACTORY_PROOF_GATE_SHELL
@@ -1908,6 +1786,35 @@ const factoryWorkflow = (options) => {
 	});
 };
 //#endregion
+//#region src/cursor-oidc.ts
+/**
+* Pinned Cursor OIDC trust predicates for the Factory App broker (#949).
+*
+* The broker verifies a Cursor-managed Cloud Agent JWT and mints a
+* repo-scoped Factory App installation token. Audience, issuer, and JWKS are
+* not consumer settings: a knob that pointed them elsewhere would be the
+* whole mechanism undone, the same reason {@link FACTORY_PROOF_GATE_APP_ID}
+* is pinned.
+*/
+/** Cursor's OIDC issuer. Tokens minted on the agent VM carry this `iss`. */
+const FACTORY_CURSOR_OIDC_ISSUER = "https://api.cursor.com";
+/** JWKS the broker uses to verify RS256 signatures. */
+const FACTORY_CURSOR_OIDC_JWKS_URL = "https://api.cursor.com/keys";
+/**
+* Audience a Cursor-managed VM must mint with. The CLI and the broker share
+* this string; Cursor does not allowlist audiences.
+*/
+const FACTORY_CURSOR_OIDC_AUDIENCE = "Factory";
+/**
+* Runtime claim a Cursor-managed Cloud Agent VM always presents. Self-hosted
+* workers are not this broker's callers.
+*/
+const FACTORY_CURSOR_OIDC_MANAGED_RUNTIME = "managed";
+/** HQ route that exchanges a verified Cursor OIDC JWT for an App token. */
+const FACTORY_APP_BROKER_PATH = "/api/factory-app/installation-token";
+/** Production broker origin. The CLI pins this; it is not profile-declared. */
+const FACTORY_APP_BROKER_ORIGIN = "https://hq.patronage.com";
+//#endregion
 //#region src/execute-alchemy-entry.ts
 /** Node's spawnSync default is 1 MiB; Alchemy plans routinely exceed that. */
 const EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER = 64 * 1024 * 1024;
@@ -1987,10 +1894,8 @@ say ''
 
 if [ "${shellExpansion("GITHUB_EVENT_NAME:-")}" = 'push' ] && [ -z "${shellExpansion("PROOF_REASON:-")}" ]; then
   # A push run with no recorded reason is one where the gate step's condition
-  # kept it off entirely, so the full suite ran with no reuse decision. Under
-  # the PR-only reuse default (#863) that is every push. A consumer on
-  # 'pull-request-and-default-branch' reaches it only on a ref outside its
-  # merge target.
+  # kept it off entirely, so the full suite ran with no reuse decision. The
+  # gate runs on pull requests only (#863), so that is every push.
   say '- Path: full execution, no proof consulted'
   say '- Proof-reuse gate: did not run on this ref; the full suite ran.'
   say "- Verified head: \`${shellExpansion("GITHUB_SHA:-unknown")}\`"
@@ -2050,6 +1955,24 @@ const impactDemandConditions = (options) => {
 	});
 };
 //#endregion
+//#region src/runnable-cli.ts
+/**
+* `@patronage/software-factory` publishes two dist entries. `dist/index.js` is
+* the package export: consumers import it, so it runs no command. `dist/cli.js`
+* is the bin, and it is the only entry that runs one (software-factory#386).
+*
+* A workflow step that invokes `dist/index.js` therefore loads a library and
+* exits 0 — a green step that did nothing. This guard makes a generator refuse
+* that `cli` at generation time, where the failure is loud, instead of letting
+* it reach CI where the failure is silent. Invoke the bin by name (`psf`,
+* `pnpm exec psf`, `pnpm dlx psf`) or by the `dist/cli.js` path.
+*/
+const INERT_ENTRY_PATTERN = /(?:^|[/\\])dist[/\\]index\.js(?:["'\s]|$)/u;
+/** Shared validator for every `cli` string a factory-ci generator emits. */
+const assertRunnableCli = (name, cli) => {
+	if (INERT_ENTRY_PATTERN.test(cli)) throw new Error(`${name} must invoke the software-factory bin, not the package entry dist/index.js, which imports as a library and exits 0 without running the command. Use the bin name (for example "pnpm exec psf") or dist/cli.js. Got "${cli}".`);
+};
+//#endregion
 //#region src/production-impact-workflow.ts
 const FACTORY_PRODUCTION_IMPACT_STEP_ID = "production_impact";
 const FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT = "decision";
@@ -2075,6 +1998,7 @@ const factoryProductionImpactWorkflow = (options) => {
 	const before = options.before ?? `\${{ github.event.before }}`;
 	const after = options.after ?? `\${{ github.sha }}`;
 	const cli = options.cli ?? "pnpm exec psf";
+	assertRunnableCli("cli", cli);
 	const profile = options.profilePath ? ` --profile ${shellQuote$1(options.profilePath)}` : "";
 	const decisionStep = {
 		continueOnError: true,
@@ -2133,6 +2057,7 @@ const factoryCandidateImpactWorkflow = (options) => {
 	const base = options.base ?? `\${{ github.event.pull_request.base.sha }}`;
 	const head = options.head ?? `\${{ github.event.pull_request.head.sha }}`;
 	const cli = options.cli ?? "pnpm exec psf";
+	assertRunnableCli("cli", cli);
 	const profile = options.profilePath ? ` --profile ${shellQuote(options.profilePath)}` : "";
 	const decisionStep = {
 		continueOnError: true,
@@ -2431,6 +2356,7 @@ const defaultCli = "psf";
 const factoryPrStatusHudWorkflow = (options) => {
 	assertPinnedAction("createGithubAppToken", options.createGithubAppToken, "actions/create-github-app-token");
 	const cli = options.cli || defaultCli;
+	assertRunnableCli("cli", cli);
 	const mintStep = Object.freeze({
 		id: FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID,
 		name: "Mint the factory App token",
@@ -3708,4 +3634,4 @@ const assertWorkflowShellParses = (yaml, options) => {
 	throw new Error(`${options.source} emits shell bash cannot parse; the runner would treat it as a no-op:\n${detail}`);
 };
 //#endregion
-export { ALCHEMY_BASELINE, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_PULL_REQUEST_IF, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, GitHubApiError, GitHubAppTokenTransportError, NODE_PNPM_ACTION_FAMILY_NODE24, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, PreviewProofTransportError, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, VitestProfileError, assertAlchemyBaseline, assertProofReuseCoverage, assertVerifyRunnerPolicy, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryVerifyRunner, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, verifyRunnerPolicy, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };
+export { ALCHEMY_BASELINE, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_APP_BROKER_TOKEN_PERMISSIONS, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_CURSOR_OIDC_AUDIENCE, FACTORY_CURSOR_OIDC_ISSUER, FACTORY_CURSOR_OIDC_JWKS_URL, FACTORY_CURSOR_OIDC_MANAGED_RUNTIME, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, GitHubApiError, GitHubAppTokenTransportError, NODE_PNPM_ACTION_FAMILY_NODE24, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, PreviewProofTransportError, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, VitestProfileError, assertAlchemyBaseline, assertProofReuseCoverage, assertVerifyRunnerPolicy, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryVerifyRunner, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, verifyRunnerPolicy, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/factory-ci",
-  "version": "1.0.0-alpha.26",
+  "version": "1.0.0-alpha.28",
   "description": "Deep CI and deploy building blocks for Patronage factory projects: workflow source artifacts, hosted diff classification, Alchemy entry execution, and disposable-stage semantics",
   "keywords": [
     "alchemy",

package/src/alchemy/credential-preflight.ts

@@ -324,8 +324,8 @@ const resolveResolvedCredential = async (
 };
 
 /**
- * Resolves the deploy's Cloudflare credential posture and proves the token
- * carries exactly the required permission groups.
+ * Resolves the deploy's Cloudflare credential posture and checks the token
+ * against the reviewed policy document.
  *
  * The check is: the environment matches the declared source, the credential
  * resolves, Cloudflare reports the token active, the reviewed policy names
@@ -333,6 +333,12 @@ const resolveResolvedCredential = async (
  * the project expects, and the permission groups match the required list with
  * no group missing, extra, or repeated.
  *
+ * The permission groups come from the reviewed policy document, not from
+ * Cloudflare. This function never reads live permissions from the Cloudflare
+ * API. A token whose permissions changed after the review still passes, as
+ * long as Cloudflare reports it active and the document still matches its id.
+ * See issue #1010.
+ *
  * Throws on any failure. {@link CloudflareCredentialUnavailableError} means
  * Cloudflare could not be asked; every other error means the credential is
  * wrong. Nothing it throws, and nothing it returns, carries a secret value.

package/src/alchemy/secret-name-policy.ts

@@ -42,6 +42,12 @@ export interface SecretNamePolicyOptions {
  * Longer values are replaced first, so a secret that contains another secret
  * leaves no fragment behind.
  *
+ * The policy replaces verbatim substrings of each named value only. A value
+ * that the output re-encodes passes through unredacted. URL-encoded,
+ * base64, and JSON-escaped forms are all such re-encodings. A project that
+ * prints a secret in one of those forms must not rely on this policy for it.
+ * See issue #1011.
+ *
  * An empty `names` list yields a pass-through function only when `values` is
  * also empty: a project with no secrets in its Alchemy output declares none,
  * and gets no redaction. Empty names beside a populated `values` map is

package/src/alchemy/stage-policy.ts

@@ -33,15 +33,16 @@ export const LOCAL_PREVIEW_STAGES: StageMatcher = (stage: string) =>
  *
  * A `RegExp` with `g` or `y` advances `lastIndex` on every match, so the same
  * pattern answers "yes" and then "no" for the same stage. A policy that
- * alternates is worse than one that always refuses, so the flagged pattern is
- * copied without those flags rather than tested as given. The copy is built
- * only for a pattern that carries them.
+ * alternates is worse than one that always refuses, so a flagged pattern is
+ * tested through a fresh copy whose `lastIndex` starts at zero. The copy
+ * carries the complete flags: `y` anchors the match at `lastIndex`, so
+ * dropping it would let `/prod/y` accept a stage named `pre-prod` that the
+ * project's own pattern rejects. The caller's own `RegExp` is never written
+ * to, so a frozen one still works.
  */
 const statelessTest = (pattern: RegExp, stage: string): boolean =>
   pattern.global || pattern.sticky
-    ? new RegExp(pattern.source, pattern.flags.replaceAll(/[gy]/gu, "")).test(
-        stage
-      )
+    ? new RegExp(pattern.source, pattern.flags).test(stage)
     : pattern.test(stage);
 
 const stageMatches = (matcher: StageMatcher, stage: string): boolean => {

package/src/alchemy/url-implies-auth.ts

@@ -129,10 +129,29 @@ const publiclyReachable = ({ props }: EvaluatedResource): boolean =>
   domainReachable(props.domain) ||
   routesReachable(props.routes);
 
+/**
+ * Test a pattern without carrying state between Workers.
+ *
+ * A `RegExp` with `g` or `y` advances `lastIndex` on every match, so the same
+ * pattern answers "yes" for the first Worker and "no" for the second Worker
+ * with the same binding name. A guard that alternates is worse than one that
+ * always refuses, so a flagged pattern is tested through a fresh copy whose
+ * `lastIndex` starts at zero. The copy carries the complete flags: `y`
+ * anchors the match at `lastIndex`, so dropping it would let `/TOKEN/y`
+ * credit a binding named `X_TOKEN` that the caller's pattern rejects. The
+ * caller's own `RegExp` is never written to, so a frozen one still works.
+ * Same isolation `stage-policy` already applies to stage names.
+ */
+const statelessTest = (pattern: RegExp, name: string): boolean =>
+  pattern.global || pattern.sticky
+    ? new RegExp(pattern.source, pattern.flags).test(name)
+    : pattern.test(name);
+
 const matchesAuthBindingName = (
   matcher: AuthBindingNameMatcher,
   name: string
-): boolean => (matcher instanceof RegExp ? matcher.test(name) : matcher(name));
+): boolean =>
+  matcher instanceof RegExp ? statelessTest(matcher, name) : matcher(name);
 
 /**
  * The Workers a Cloudflare Access application gates in production.

package/src/alchemy-baseline.ts

@@ -33,9 +33,12 @@ const BASELINE_PACKAGE_NAMES = Object.keys(
 
 /**
  * Fails when the consumer's `alchemy` or `effect` pin differs from
- * {@link ALCHEMY_BASELINE}. A package the consumer does not depend on at all
- * is not drift — both packages are optional peers of the `./alchemy`
- * subpath, so a consumer that never touches it carries neither.
+ * {@link ALCHEMY_BASELINE}, or when only one of the pair is present.
+ * Alchemy peers on Effect, so an unpinned auto-installed Effect can drift
+ * outside the baseline while a lone `alchemy` pin would otherwise pass.
+ * Both packages remaining absent is not drift — they are optional peers of
+ * the `./alchemy` subpath, so a consumer that never touches it carries
+ * neither.
  *
  * Reads only the `packageJson` object it is handed; it never walks the
  * filesystem.
@@ -44,12 +47,22 @@ export const assertAlchemyBaseline = ({
   packageJson,
 }: AssertAlchemyBaselineInput): void => {
   const drifted: string[] = [];
+  const pinOf = (name: keyof typeof ALCHEMY_BASELINE): string | undefined =>
+    packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
+  const pairPresent = BASELINE_PACKAGE_NAMES.some(
+    (name) => pinOf(name) !== undefined
+  );
 
   for (const name of BASELINE_PACKAGE_NAMES) {
-    const pinned =
-      packageJson.dependencies?.[name] ?? packageJson.devDependencies?.[name];
+    const pinned = pinOf(name);
     const baseline = ALCHEMY_BASELINE[name];
-    if (pinned !== undefined && pinned !== baseline) {
+    if (pinned === undefined) {
+      if (pairPresent) {
+        drifted.push(`missing ${name} (baseline: ${name}@${baseline})`);
+      }
+      continue;
+    }
+    if (pinned !== baseline) {
       drifted.push(`${name}@${pinned} (baseline: ${name}@${baseline})`);
     }
   }

package/src/candidate-impact-workflow.ts

@@ -1,6 +1,7 @@
 import type { WorkflowStep } from "./factory-workflow.ts";
 import { impactDemandConditions } from "./impact-demand-condition.ts";
 import { productionImpactTargetOutput } from "./production-impact-workflow.ts";
+import { assertRunnableCli } from "./runnable-cli.ts";
 
 export const FACTORY_CANDIDATE_IMPACT_STEP_ID = "candidate_impact";
 export const FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT = "decision";
@@ -66,6 +67,7 @@ export const factoryCandidateImpactWorkflow = (
   const base = options.base ?? `\${{ github.event.pull_request.base.sha }}`;
   const head = options.head ?? `\${{ github.event.pull_request.head.sha }}`;
   const cli = options.cli ?? "pnpm exec psf";
+  assertRunnableCli("cli", cli);
   const profile = options.profilePath
     ? ` --profile ${shellQuote(options.profilePath)}`
     : "";

package/src/cursor-oidc.ts

@@ -0,0 +1,33 @@
+/**
+ * Pinned Cursor OIDC trust predicates for the Factory App broker (#949).
+ *
+ * The broker verifies a Cursor-managed Cloud Agent JWT and mints a
+ * repo-scoped Factory App installation token. Audience, issuer, and JWKS are
+ * not consumer settings: a knob that pointed them elsewhere would be the
+ * whole mechanism undone, the same reason {@link FACTORY_PROOF_GATE_APP_ID}
+ * is pinned.
+ */
+
+/** Cursor's OIDC issuer. Tokens minted on the agent VM carry this `iss`. */
+export const FACTORY_CURSOR_OIDC_ISSUER = "https://api.cursor.com";
+
+/** JWKS the broker uses to verify RS256 signatures. */
+export const FACTORY_CURSOR_OIDC_JWKS_URL = "https://api.cursor.com/keys";
+
+/**
+ * Audience a Cursor-managed VM must mint with. The CLI and the broker share
+ * this string; Cursor does not allowlist audiences.
+ */
+export const FACTORY_CURSOR_OIDC_AUDIENCE = "Factory";
+
+/**
+ * Runtime claim a Cursor-managed Cloud Agent VM always presents. Self-hosted
+ * workers are not this broker's callers.
+ */
+export const FACTORY_CURSOR_OIDC_MANAGED_RUNTIME = "managed";
+
+/** HQ route that exchanges a verified Cursor OIDC JWT for an App token. */
+export const FACTORY_APP_BROKER_PATH = "/api/factory-app/installation-token";
+
+/** Production broker origin. The CLI pins this; it is not profile-declared. */
+export const FACTORY_APP_BROKER_ORIGIN = "https://hq.patronage.com";