@patronage/factory-ci 1.0.0-alpha.34 → 1.0.0-alpha.36

package/dist/alchemy/index.js

@@ -1,8 +1,8 @@
-import { i as isLocalPreviewStage, n as executeAlchemyEntry, r as resolveAlchemyChildCwd, s as ALCHEMY_BASELINE } from "../execute-alchemy-entry-BZpk0eOQ.js";
+import { i as isLocalPreviewStage, n as executeAlchemyEntry, r as resolveAlchemyChildCwd, s as ALCHEMY_BASELINE } from "../execute-alchemy-entry-CZ7Knz4q.js";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { appendFileSync, closeSync, openSync, readFileSync } from "node:fs";
 import * as Alchemy from "alchemy";
 import * as Output from "alchemy/Output";
 import { tryFindProviderByType } from "alchemy/Provider";
@@ -176,10 +176,11 @@ const assertRetainedIdentities = ({ after, before, markers }) => {
 * repeat is the account, the permission list, the resource scope, and where
 * the credential comes from, so every one of those is an input.
 *
-* **No credential value is ever printed.** Errors name environment variables,
-* permission groups, and resource identifiers. They never carry a token, a
-* policy document, or any part of one. The result carries the token id, which
-* Cloudflare's own verification endpoint returns and which is not a secret.
+* **No credential value is ever printed.** Errors name environment variables and
+* missing groups from the caller-owned permission requirements. Untrusted API
+* status, receipt group names, and resource identifiers are never reflected.
+* The result carries the token id, which Cloudflare's own verification endpoint
+* returns and which is not a secret.
 */
 const CLOUDFLARE_API = "https://api.cloudflare.com/client/v4";
 /**
@@ -246,6 +247,7 @@ const permissionGroupsFromPolicies = (policies, resourcesFor) => {
 	const found = [];
 	for (const policy of policies) {
 		if (!isPolicyShaped(policy)) throw new Error("Cloudflare token policy has an invalid shape.");
+		if (policy.permission_groups.length === 0) throw new Error("Cloudflare token policy has no permission groups.");
 		if (policy.effect !== "allow") throw new Error("Cloudflare token must carry allow policies only.");
 		if (Object.values(policy.resources).some((selection) => selection !== "*")) throw new Error("Cloudflare token policy has an invalid resource value.");
 		const scope = new Set(Object.keys(policy.resources));
@@ -253,8 +255,8 @@ const permissionGroupsFromPolicies = (policies, resourcesFor) => {
 			if (!permission?.name) throw new Error("Cloudflare token has an unnamed permission group.");
 			found.push(permission.name);
 			const expected = new Set(resourcesFor(permission.name));
-			if (expected.size === 0) throw new Error(`Cloudflare ${permission.name} policy has no expected resource scope.`);
-			if (scope.size !== expected.size || [...scope].some((resource) => !expected.has(resource))) throw new Error(`Cloudflare ${permission.name} policy has an unexpected resource scope.`);
+			if (expected.size === 0) throw new Error("Cloudflare token policy has no expected resource scope.");
+			if (scope.size !== expected.size || [...scope].some((resource) => !expected.has(resource))) throw new Error("Cloudflare token policy has an unexpected resource scope.");
 		}
 	}
 	return found;
@@ -265,7 +267,7 @@ const assertExactPermissionGroups = (found, required) => {
 	const missing = [...expected].filter((name) => !received.has(name));
 	const extra = [...received].filter((name) => !expected.has(name));
 	const duplicates = found.filter((name, index) => found.indexOf(name) !== index);
-	if (missing.length > 0 || extra.length > 0 || duplicates.length > 0) throw new Error(`Cloudflare permission mismatch; missing: ${missing.join(", ") || "none"}; extra: ${extra.join(", ") || "none"}; duplicates: ${duplicates.join(", ") || "none"}`);
+	if (missing.length > 0 || extra.length > 0 || duplicates.length > 0) throw new Error(`Cloudflare permission mismatch; missing: ${missing.join(", ") || "none"}; extra count: ${extra.length}; duplicate count: ${duplicates.length}`);
 };
 const assertRequiredPermissionGroups = (required) => {
 	if (required.some((name) => !name.trim())) throw new Error("Credential preflight requires named permission groups; a blank name matches nothing.");
@@ -307,7 +309,8 @@ const resolveResolvedCredential = async (resolveCredential, environment) => {
 * Cloudflare could not be asked; every other error means the credential is
 * wrong. Nothing it throws, and nothing it returns, carries a secret value.
 */
-const credentialPreflight = async ({ accountId, environment, fetchImplementation = fetch, requiredPermissionGroups, resolveCredential, resourcesFor, source }) => {
+const credentialPreflight = async ({ accountId, environment, fetchImplementation = fetch, requiredPermissionGroups, resolveCredential, resourcesFor, source, tokenKind = "account" }) => {
+	if (tokenKind !== "account" && tokenKind !== "user") throw new Error("Credential preflight has an unknown token kind.");
 	if (!accountId.trim()) throw new Error("Credential preflight requires a Cloudflare account id.");
 	if (requiredPermissionGroups.length === 0) throw new Error("Credential preflight requires at least one permission group; an empty list would admit any token.");
 	assertRequiredPermissionGroups(requiredPermissionGroups);
@@ -317,8 +320,8 @@ const credentialPreflight = async ({ accountId, environment, fetchImplementation
 	const credential = await resolveResolvedCredential(resolveCredential, environment);
 	if (!(credential.token.trim() && credential.policyJson.trim())) throw new Error("Credential preflight resolved an empty credential.");
 	if (source === "hosted" && credential.token.trim() !== environment.CLOUDFLARE_API_TOKEN?.trim()) throw new Error("Hosted credential preflight resolved a token that is not the environment token.");
-	const verification = await cloudflareJson(`${CLOUDFLARE_API}/accounts/${accountId}/tokens/verify`, credential.token, fetchImplementation);
-	if (verification.status !== "active") throw new Error(`Cloudflare token is ${verification.status}, not active.`);
+	const verification = await cloudflareJson(tokenKind === "user" ? `${CLOUDFLARE_API}/user/tokens/verify` : `${CLOUDFLARE_API}/accounts/${accountId}/tokens/verify`, credential.token, fetchImplementation);
+	if (verification.status !== "active") throw new Error("Cloudflare token is not active.");
 	const reviewed = parseReviewedTokenPolicy(credential.policyJson);
 	if (reviewed.tokenId !== verification.id) throw new Error("Cloudflare token policy metadata does not describe the live token.");
 	const found = permissionGroupsFromPolicies(reviewed.policies, scopeFor);
@@ -1211,6 +1214,7 @@ const secretNamePolicy = ({ names, values }) => {
 const LIFECYCLE_FAILURE_MESSAGES = {
 	AMBIGUOUS_RESOURCE: "The plan prints one resource id for more than one resource.",
 	AMBIGUOUS_STAGE: "The stage table declares the stage both protected and disposable.",
+	CHILD_DIAGNOSTICS_UNWRITABLE: "The requested child diagnostics file could not be written.",
 	CHILD_FAILED: "The Alchemy child did not exit successfully.",
 	DEPLOY_INCOMPLETE: "The deploy completed without the persisted state its plan described.",
 	DESTROY_RESIDUE: "The destroy left persisted state registered for the stage.",
@@ -1236,6 +1240,7 @@ const LIFECYCLE_FAILURE_MESSAGES = {
 };
 /** A sanitized lifecycle failure. See the module comment. */
 var AlchemyLifecycleError = class extends Error {
+	childDiagnosticsPath;
 	code;
 	mutation;
 	operation;
@@ -1248,11 +1253,13 @@ var AlchemyLifecycleError = class extends Error {
 		this.mutation = fields.mutation;
 		this.operation = fields.operation;
 		this.phase = fields.phase;
+		if (fields.childDiagnosticsPath !== void 0) this.childDiagnosticsPath = fields.childDiagnosticsPath;
 		if (fields.planHash !== void 0) this.planHash = fields.planHash;
 	}
 	/** The fields an evidence sink prints. Fixed shape, fixed words. */
 	toJSON() {
 		return {
+			...this.childDiagnosticsPath === void 0 ? {} : { childDiagnosticsPath: this.childDiagnosticsPath },
 			code: this.code,
 			message: this.message,
 			mutation: this.mutation,
@@ -1368,6 +1375,81 @@ const deleteStageRows = async (state, target) => {
 	}));
 };
 //#endregion
+//#region src/alchemy/child-diagnostics.ts
+/**
+* The optional record of what an Alchemy child printed (#1260).
+*
+* `runAlchemyLifecycle` reports a failed child as `CHILD_FAILED` and nothing
+* else: the child's output is parsed and dropped, so no secret in it can
+* reach a job log or an evidence file through the operation. That is the
+* right default and it stays the default. It also leaves an operator with a
+* failure code and no record of what failed, which twice cost a paitronage
+* investigation its evidence.
+*
+* This is the opt-in other half: a consumer that names a file gets every
+* child's streams appended to it, each stream passed whole through the
+* consumer's own redactor, under a header naming the child. The consumer chooses the path
+* and owns the redactor; this module never picks either, and nothing here
+* changes what the lifecycle decides.
+*
+* The file is opened, and the header written, **before** the child starts,
+* so an unwritable path is known before anything runs and a parent that dies
+* mid-child still leaves the marker for the child that was in flight. The
+* streams themselves arrive after the child exits, because the child is
+* captured (`spawnSync`), not streamed.
+*
+* Nothing here throws into the lifecycle's control flow once the handle is
+* open. A write failure is retained and reported by the caller under its own
+* failure code, because a record that could not be written is a different
+* fact from a child that failed, and reporting it as the second one would
+* put a false cause in front of the operator this file exists for. When the
+* caller reports it — up front, or only after the operation has run to the
+* end — is the caller's rule, not this module's; see `runAlchemyLifecycle`.
+*/
+const streamSection = (label, text, redact) => {
+	if (text === null || text === "") return `--- ${label}: empty ---\n`;
+	const body = redact(text);
+	return `--- ${label} ---\n${body.endsWith("\n") ? body : `${body}\n`}`;
+};
+/**
+* Open the record for one child and write its header.
+*
+* Throws when the file cannot be opened or the header cannot be written.
+* That throw happens before the child is launched, so a caller that has not
+* yet mutated anything can refuse the run with the stage still untouched.
+*/
+const openChildDiagnostics = ({ child, diagnostics, operation, stack, stage }) => {
+	const handle = openSync(diagnostics.path, "a");
+	let retained;
+	const guard = (write) => {
+		try {
+			write();
+		} catch (error) {
+			retained ??= error instanceof Error ? error : new Error(String(error));
+		}
+	};
+	try {
+		appendFileSync(handle, `\n===== ${operation} ${child} child — ${stack}/${stage} — ${(/* @__PURE__ */ new Date()).toISOString()} =====\n`);
+	} catch (error) {
+		closeSync(handle);
+		throw error;
+	}
+	return {
+		append: ({ stderr, stdout }) => {
+			guard(() => {
+				appendFileSync(handle, streamSection("stdout", stdout, diagnostics.redact));
+				appendFileSync(handle, streamSection("stderr", stderr, diagnostics.redact));
+			});
+		},
+		close: () => {
+			guard(() => {
+				closeSync(handle);
+			});
+		},
+		failure: () => retained
+	};
+};
+//#endregion
 //#region src/alchemy/lifecycle.ts
 /**
 * The shared Alchemy lifecycle operation (#1077).
@@ -1480,6 +1562,12 @@ var LifecycleRun = class {
 	policy;
 	state;
 	entry;
+	childDiagnostics;
+	/**
+	* A diagnostics write that failed after a mutating child had started, held
+	* until the operation has run to its end. See `noteDiagnosticsFailure`.
+	*/
+	diagnosticsUnwritable = false;
 	bundledEntry;
 	/** What the run has done to the stage so far. Only children advance it. */
 	certainty = "not-started";
@@ -1488,9 +1576,13 @@ var LifecycleRun = class {
 		this.policy = options.policy;
 		this.state = options.state;
 		this.entry = options.entry;
+		this.childDiagnostics = options.childDiagnostics;
 	}
-	fail(code, phase, planHash) {
+	fail(code, phase, extra = {}) {
+		const { namesDiagnostics, planHash } = extra;
+		const diagnosticsPath = namesDiagnostics === true ? this.childDiagnostics?.path : void 0;
 		return new AlchemyLifecycleError({
+			...diagnosticsPath === void 0 ? {} : { childDiagnosticsPath: diagnosticsPath },
 			code,
 			mutation: this.certainty,
 			operation: this.request.operation,
@@ -1661,22 +1753,75 @@ var LifecycleRun = class {
 		return ["--stage", this.request.stage];
 	}
 	/**
-	* Run one child under `lease` and return its stdout for parsing. The output
-	* is written nowhere else. The child's environment carries the lease, so
-	* the adapter in the child adopts it rather than taking its own: there is
-	* no child without a lease, and a child that writes outside this lease is
-	* refused by the store, not by this module. A `plan` child leaves the
-	* certainty where it is unless it is the first child; a mutating child
-	* advances it before it starts.
+	* Where a diagnostics write failure is reported.
+	*
+	* Before any mutating child has started, it is reported here and now: the
+	* operator asked for a record, the record cannot be kept, and nothing has
+	* been changed yet, so refusing costs nothing.
+	*
+	* Once a deploy or destroy child has started, it is **retained** and
+	* reported only after the operation has run to its end, the way a failed
+	* lease release is. The apply succeeded; failing here would abandon the
+	* convergence check on a good deploy and invite an operator to destroy and
+	* retry a stage that is fine. A missing record is not a reason to treat a
+	* successful mutation as a failed one, and the run still ends in
+	* `CHILD_DIAGNOSTICS_UNWRITABLE` — after the postconditions have run, with
+	* the mutation certainty the operation actually reached.
+	*/
+	noteDiagnosticsFailure(failed) {
+		if (!failed) return;
+		this.diagnosticsUnwritable = true;
+		if (this.certainty !== "mutation-may-have-occurred") throw this.fail("CHILD_DIAGNOSTICS_UNWRITABLE", "execution", { namesDiagnostics: true });
+	}
+	/**
+	* The retained record failure, once the operation itself is complete. The
+	* operation's own failures are reported ahead of it, as they are for a
+	* failed lease release.
+	*/
+	assertDiagnosticsWritten() {
+		if (this.diagnosticsUnwritable) throw this.fail("CHILD_DIAGNOSTICS_UNWRITABLE", "execution", { namesDiagnostics: true });
+	}
+	/**
+	* The diagnostics section for one child, opened and headed before the
+	* child starts. A path that cannot be opened refuses the run while nothing
+	* has been mutated; after that it is retained and the child runs without a
+	* record rather than a good apply being abandoned over one.
+	*/
+	openDiagnostics(child) {
+		if (this.childDiagnostics === void 0) return;
+		try {
+			return openChildDiagnostics({
+				child,
+				diagnostics: this.childDiagnostics,
+				operation: this.request.operation,
+				stack: this.request.stack,
+				stage: this.request.stage
+			});
+		} catch {
+			this.noteDiagnosticsFailure(true);
+			return;
+		}
+	}
+	/**
+	* Run one child under `lease` and return its stdout for parsing. Its output
+	* goes nowhere else unless the consumer asked for `childDiagnostics`, which
+	* writes a redacted copy and never touches what is returned here. The
+	* child's environment carries the lease, so the adapter in the child adopts
+	* it rather than taking its own: there is no child without a lease, and a
+	* child that writes outside this lease is refused by the store, not by this
+	* module. A `plan` child leaves the certainty where it is unless it is the
+	* first child; a mutating child advances it before it starts.
 	*/
 	async runChild(child, args, lease) {
 		if (this.bundledEntry === void 0) throw this.fail("PREPARATION_FAILED", "admission");
+		const record = this.openDiagnostics(child);
 		if (child !== "plan") this.certainty = "mutation-may-have-occurred";
 		else if (this.certainty === "not-started") this.certainty = "read-only-started";
 		const { env, from } = this.entry;
+		let stdout;
 		try {
-			return (await executeAlchemyEntry({
-				args,
+			stdout = (await executeAlchemyEntry({
+				args: [...args, ...this.entry.envFile === void 0 ? [] : ["--env-file", this.entry.envFile]],
 				bundledEntry: this.bundledEntry,
 				cwd: resolveAlchemyChildCwd(this.entry),
 				env: {
@@ -1685,11 +1830,16 @@ var LifecycleRun = class {
 				},
 				from,
 				maxBuffer: 67108864,
+				...record === void 0 ? {} : { onCaptured: record.append },
 				stdio: "pipe"
 			})).stdout ?? "";
 		} catch {
-			throw this.fail("CHILD_FAILED", "execution");
+			stdout = void 0;
 		}
+		record?.close();
+		if (stdout === void 0) throw this.fail("CHILD_FAILED", "execution", { namesDiagnostics: true });
+		this.noteDiagnosticsFailure(record?.failure() !== void 0);
+		return stdout;
 	}
 	effectsOf(output, phase) {
 		let effects;
@@ -1782,7 +1932,7 @@ var LifecycleRun = class {
 				stage: this.request.stage
 			});
 		} catch {
-			throw this.fail("FIRST_DEPLOY_UNAUTHORIZED", "admission", planHash);
+			throw this.fail("FIRST_DEPLOY_UNAUTHORIZED", "admission", { planHash });
 		}
 	}
 	retainedMarkers() {
@@ -1942,6 +2092,15 @@ var LifecycleRun = class {
 *
 * Every failure is an `AlchemyLifecycleError`. After a deploy or destroy
 * child was started, no failure reports `not-started`.
+*
+* `childDiagnostics` is the one opt-in that keeps what the children printed:
+* both streams of every child, each passed whole through the consumer's own
+* redactor, are appended to the consumer's own file under a per-child
+* header, and a `CHILD_FAILED` then names that path so an operator knows
+* where to look. Nothing about the operation changes otherwise: a record
+* that cannot be written refuses the run only while nothing has been
+* mutated, and after that is reported as `CHILD_DIAGNOSTICS_UNWRITABLE` once
+* the operation has finished, never in place of its postconditions.
 */
 const runAlchemyLifecycle = async (options) => {
 	const run = new LifecycleRun(options);
@@ -1949,11 +2108,15 @@ const runAlchemyLifecycle = async (options) => {
 	const { isProtected } = run.admitStage();
 	const alchemyVersion = run.installedAlchemyVersion();
 	await run.prepareEntry();
-	switch (options.request.operation) {
-		case "plan": return await run.plan(alchemyVersion, isProtected);
-		case "deploy": return await run.deploy(alchemyVersion, isProtected);
-		default: return await run.destroy(alchemyVersion);
-	}
+	const result = await (async () => {
+		switch (options.request.operation) {
+			case "plan": return await run.plan(alchemyVersion, isProtected);
+			case "deploy": return await run.deploy(alchemyVersion, isProtected);
+			default: return await run.destroy(alchemyVersion);
+		}
+	})();
+	run.assertDiagnosticsWritten();
+	return result;
 };
 //#endregion
 //#region src/alchemy/index.ts

package/dist/{execute-alchemy-entry-DB8fFZTu.d.ts → execute-alchemy-entry-B397GSk5.d.ts}

@@ -70,6 +70,23 @@ interface ExecuteAlchemyEntryCommon {
    * pass `EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER` or another explicit value.
    */
   readonly maxBuffer?: number;
+  /**
+   * Called once with the child's captured streams, after the child exits and
+   * **before its exit status is judged**, so a caller keeping a diagnostic
+   * record still receives the output of a child that failed. Unused when
+   * stdio is `"inherit"`.
+   *
+   * The text handed over is the raw capture: `redact` is not applied to it,
+   * because `redact` shapes what this function returns and a record is not a
+   * return value. A caller that writes this anywhere owns its own redaction.
+   *
+   * It must not throw. Its work is a side record, and a throw from it would
+   * be indistinguishable here from the child's own failure.
+   */
+  readonly onCaptured?: (captured: {
+    readonly stdout: string | null;
+    readonly stderr: string | null;
+  }) => void;
   /**
    * Applied to captured stdout and stderr before they are returned. Unused
    * when stdio is `"inherit"`. This package does not supply a secret-name
@@ -106,7 +123,8 @@ interface ExecuteAlchemyEntryResult {
  * Options carry exactly one entry source: `bundle` to bundle now, or
  * `bundledEntry` to reuse an already-bundled path. Captured stdout and stderr (`stdio: "pipe"`) can be redacted through
  * `redact` before they are returned; `stdio: "inherit"` still streams the
- * child unredacted.
+ * child unredacted. `onCaptured` receives the raw streams of every piped
+ * child, including one that then fails.
  *
  * Deploy/destroy/plan selection, stage admission, credentials, and every
  * convergence or destructive-change policy remain the caller's responsibility.

package/dist/{execute-alchemy-entry-BZpk0eOQ.js → execute-alchemy-entry-CZ7Knz4q.js}

@@ -123,7 +123,8 @@ const captured = (text, redact) => {
 * Options carry exactly one entry source: `bundle` to bundle now, or
 * `bundledEntry` to reuse an already-bundled path. Captured stdout and stderr (`stdio: "pipe"`) can be redacted through
 * `redact` before they are returned; `stdio: "inherit"` still streams the
-* child unredacted.
+* child unredacted. `onCaptured` receives the raw streams of every piped
+* child, including one that then fails.
 *
 * Deploy/destroy/plan selection, stage admission, credentials, and every
 * convergence or destructive-change policy remain the caller's responsibility.
@@ -142,6 +143,10 @@ const executeAlchemyEntry = async (options) => {
 		...options.maxBuffer === void 0 ? {} : { maxBuffer: options.maxBuffer },
 		stdio: options.stdio ?? "inherit"
 	});
+	options.onCaptured?.({
+		stderr: result.stderr,
+		stdout: result.stdout
+	});
 	if (result.error) throw new Error("Failed to start the Alchemy CLI.");
 	if (result.signal) throw new Error(`Alchemy CLI terminated by signal ${result.signal}.`);
 	if (result.status !== 0) throw new Error(result.status === null ? "Alchemy CLI exited without reporting a status." : `Alchemy CLI exited with status ${result.status}.`);

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { a as BundleAlchemyEntryOptions, i as executeAlchemyEntry, n as ExecuteAlchemyEntryOptions, o as bundleAlchemyEntry, r as ExecuteAlchemyEntryResult, t as EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER } from "./execute-alchemy-entry-DB8fFZTu.js";
+import { a as BundleAlchemyEntryOptions, i as executeAlchemyEntry, n as ExecuteAlchemyEntryOptions, o as bundleAlchemyEntry, r as ExecuteAlchemyEntryResult, t as EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER } from "./execute-alchemy-entry-B397GSk5.js";
 import { StdioOptions } from "node:child_process";
 
 //#region src/alchemy-baseline.d.ts
@@ -1203,6 +1203,30 @@ declare const previewCleanupDestroyJobId: (stack: string) => string;
  */
 declare const factoryPreviewCleanupTopology: (options: FactoryPreviewCleanupTopologyOptions) => FactoryPreviewCleanupTopology;
 //#endregion
+//#region src/preview-receipt-workflow.d.ts
+interface FactoryPreviewReceiptWorkflowOptions {
+  readonly target: string;
+  readonly cli?: string;
+  /** Caller-owned PR number expression, passed through the environment. */
+  readonly pr?: string;
+}
+interface FactoryPreviewReceiptWorkflow {
+  /** Place before the selected target's first mutation, under its selection guard. */
+  readonly beginStep: WorkflowStep;
+  /** Append after consumer deploy and required smoke steps. Never rename the bind step. */
+  readonly completionSteps: readonly WorkflowStep[];
+  /** Place before cleanup, including cleanup of a failed/unregistered deployment. */
+  readonly invalidateStep: WorkflowStep;
+  readonly permissions: Readonly<{
+    actions: "read";
+    contents: "read";
+    deployments: "write";
+    "pull-requests": "read";
+  }>;
+}
+/** Receipt transport only. The consumer owns selection, lifecycle, smoke, and freshness. */
+declare const factoryPreviewReceiptWorkflow: (options: FactoryPreviewReceiptWorkflowOptions) => FactoryPreviewReceiptWorkflow;
+//#endregion
 //#region src/production-impact-workflow.d.ts
 declare const FACTORY_PRODUCTION_IMPACT_STEP_ID = "production_impact";
 declare const FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT = "decision";
@@ -1645,4 +1669,4 @@ declare const assertWorkflowShellParses: (yaml: string, options: {
   readonly source: string;
 }) => void;
 //#endregion
-export { ALCHEMY_BASELINE, type AlchemyBaselinePackageJson, type AssertAlchemyBaselineInput, type BundleAlchemyEntryOptions, type CheckoutStepOptions, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, type ExecuteAlchemyEntryOptions, type ExecuteAlchemyEntryResult, FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_APP_BROKER_TOKEN_PERMISSIONS, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_CURSOR_OIDC_AUDIENCE, FACTORY_CURSOR_OIDC_ISSUER, FACTORY_CURSOR_OIDC_JWKS_URL, FACTORY_CURSOR_OIDC_MANAGED_RUNTIME, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, type FactoryCandidateImpactWorkflow, type FactoryCandidateImpactWorkflowOptions, type FactoryLifecycleContractLane, type FactoryLifecycleContractLaneOptions, type FactoryMergeFreezeJob, type FactoryMergeFreezeJobOptions, type FactoryPrStatusHudWorkflow, type FactoryPrStatusHudWorkflowOptions, type FactoryPreviewCleanupAuditJob, type FactoryPreviewCleanupDestroyJob, type FactoryPreviewCleanupTopology, type FactoryPreviewCleanupTopologyOptions, type FactoryProductionImpactWorkflow, type FactoryProductionImpactWorkflowOptions, type FactoryProofGateOptions, type FactoryProofGateReason, type FactoryProofGateStep, type FactoryProofReusePresentationOptions, type FactoryProofReuseSummaryStep, type FactoryProofTimingStartStep, type FactoryPushIdentityConsumer, type FactoryPushIdentityConsumerOptions, type FactoryPushIdentityDisposition, type FactoryPushIdentityEnvelope, type FactoryPushIdentityProducer, type FactoryPushIdentityProducerOptions, type FactoryRunnerDecision, type FactoryRunnerHome, type FactoryRunnerKind, type FactoryRunnerOverride, type FactoryVerifyRunner, type FactoryVerifyRunnerMismatch, type FactoryVerifyRunnerPolicyInput, type FactoryVerifyRunnerPolicyReport, type FactoryVerifyRunnerTable, type FactoryWorkflowArtifact, type FactoryWorkflowOptions, type FactoryWorkflowSetupOptions, GitHubApiError, GitHubAppTokenTransportError, type GithubAppCredentials, type GithubAppInstallationPermissions, type GithubAppTokenOptions, type InstallStepOptions, type LocalPreviewStage, type LocalPreviewStageOptions, NODE_PNPM_ACTION_FAMILY_NODE24, type NodePnpmActionFamily, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, type ParseLocalPreviewStageExpected, type ParsedLocalPreviewStage, type PinnedAction, type PreviewProofCandidate, type PreviewProofCleanupOutcome, type PreviewProofCleanupStatus, type PreviewProofEnvelopeEvidence, type PreviewProofInventoryAccess, type PreviewProofInventoryCleanupInput, type PreviewProofInventoryListInput, type PreviewProofInventoryPersistInput, type PreviewProofInventoryStore, type PreviewProofInventoryTransport, type PreviewProofLifecycleEvent, type PreviewProofLifecycleState, type PreviewProofRegistration, type PreviewProofResolveQuery, PreviewProofTransportError, type ProofReuseCommand, type ProofReuseCoverageInput, type ProofReuseCoverageReport, SETUP_STEP_ROLES, type SetupNodeStepOptions, type SetupStepRole, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, type VitestJsonReport, type VitestProfile, type VitestProfileDependencies, type VitestProfileDurationSummary, type VitestProfileEnvironment, VitestProfileError, type VitestProfileOptions, type VitestProfileReadResult, type VitestProfileSample, type VitestProfileSampleExecution, type VitestTestStatus, type WorkflowShellParseFailure, type WorkflowStep, assertAlchemyBaseline, assertProofReuseCoverage, assertVerifyRunnerPolicy, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryVerifyRunner, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, setupStepsForRoles, verifyRunnerPolicy, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };
+export { ALCHEMY_BASELINE, type AlchemyBaselinePackageJson, type AssertAlchemyBaselineInput, type BundleAlchemyEntryOptions, type CheckoutStepOptions, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, type ExecuteAlchemyEntryOptions, type ExecuteAlchemyEntryResult, FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_APP_BROKER_TOKEN_PERMISSIONS, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_CURSOR_OIDC_AUDIENCE, FACTORY_CURSOR_OIDC_ISSUER, FACTORY_CURSOR_OIDC_JWKS_URL, FACTORY_CURSOR_OIDC_MANAGED_RUNTIME, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, type FactoryCandidateImpactWorkflow, type FactoryCandidateImpactWorkflowOptions, type FactoryLifecycleContractLane, type FactoryLifecycleContractLaneOptions, type FactoryMergeFreezeJob, type FactoryMergeFreezeJobOptions, type FactoryPrStatusHudWorkflow, type FactoryPrStatusHudWorkflowOptions, type FactoryPreviewCleanupAuditJob, type FactoryPreviewCleanupDestroyJob, type FactoryPreviewCleanupTopology, type FactoryPreviewCleanupTopologyOptions, type FactoryPreviewReceiptWorkflow, type FactoryPreviewReceiptWorkflowOptions, type FactoryProductionImpactWorkflow, type FactoryProductionImpactWorkflowOptions, type FactoryProofGateOptions, type FactoryProofGateReason, type FactoryProofGateStep, type FactoryProofReusePresentationOptions, type FactoryProofReuseSummaryStep, type FactoryProofTimingStartStep, type FactoryPushIdentityConsumer, type FactoryPushIdentityConsumerOptions, type FactoryPushIdentityDisposition, type FactoryPushIdentityEnvelope, type FactoryPushIdentityProducer, type FactoryPushIdentityProducerOptions, type FactoryRunnerDecision, type FactoryRunnerHome, type FactoryRunnerKind, type FactoryRunnerOverride, type FactoryVerifyRunner, type FactoryVerifyRunnerMismatch, type FactoryVerifyRunnerPolicyInput, type FactoryVerifyRunnerPolicyReport, type FactoryVerifyRunnerTable, type FactoryWorkflowArtifact, type FactoryWorkflowOptions, type FactoryWorkflowSetupOptions, GitHubApiError, GitHubAppTokenTransportError, type GithubAppCredentials, type GithubAppInstallationPermissions, type GithubAppTokenOptions, type InstallStepOptions, type LocalPreviewStage, type LocalPreviewStageOptions, NODE_PNPM_ACTION_FAMILY_NODE24, type NodePnpmActionFamily, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, type ParseLocalPreviewStageExpected, type ParsedLocalPreviewStage, type PinnedAction, type PreviewProofCandidate, type PreviewProofCleanupOutcome, type PreviewProofCleanupStatus, type PreviewProofEnvelopeEvidence, type PreviewProofInventoryAccess, type PreviewProofInventoryCleanupInput, type PreviewProofInventoryListInput, type PreviewProofInventoryPersistInput, type PreviewProofInventoryStore, type PreviewProofInventoryTransport, type PreviewProofLifecycleEvent, type PreviewProofLifecycleState, type PreviewProofRegistration, type PreviewProofResolveQuery, PreviewProofTransportError, type ProofReuseCommand, type ProofReuseCoverageInput, type ProofReuseCoverageReport, SETUP_STEP_ROLES, type SetupNodeStepOptions, type SetupStepRole, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, type VitestJsonReport, type VitestProfile, type VitestProfileDependencies, type VitestProfileDurationSummary, type VitestProfileEnvironment, VitestProfileError, type VitestProfileOptions, type VitestProfileReadResult, type VitestProfileSample, type VitestProfileSampleExecution, type VitestTestStatus, type WorkflowShellParseFailure, type WorkflowStep, assertAlchemyBaseline, assertProofReuseCoverage, assertVerifyRunnerPolicy, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryPreviewReceiptWorkflow, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryVerifyRunner, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, setupStepsForRoles, verifyRunnerPolicy, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };

package/dist/index.js

@@ -1,5 +1,5 @@
 import { t as bundleAlchemyEntry } from "./bundle-alchemy-entry-CT5hCphA.js";
-import { a as localPreviewStage, c as assertAlchemyBaseline, i as isLocalPreviewStage, n as executeAlchemyEntry, o as parseLocalPreviewStage, s as ALCHEMY_BASELINE, t as EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER } from "./execute-alchemy-entry-BZpk0eOQ.js";
+import { a as localPreviewStage, c as assertAlchemyBaseline, i as isLocalPreviewStage, n as executeAlchemyEntry, o as parseLocalPreviewStage, s as ALCHEMY_BASELINE, t as EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER } from "./execute-alchemy-entry-CZ7Knz4q.js";
 import { createRequire } from "node:module";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -2337,6 +2337,67 @@ const factoryPreviewCleanupTopology = (options) => {
 	});
 };
 //#endregion
+//#region src/preview-receipt-workflow.ts
+/** Receipt transport only. The consumer owns selection, lifecycle, smoke, and freshness. */
+const factoryPreviewReceiptWorkflow = (options) => {
+	if (!/^preview:[a-z][a-z0-9-]*$/u.test(options.target)) throw new Error("Preview receipts require a declared preview target name.");
+	const cli = options.cli ?? "pnpm exec psf";
+	assertRunnableCli("cli", cli);
+	const id = `preview_intent_${options.target.slice(8).replaceAll("-", "_")}`;
+	const deploymentId = `\${{ steps.${id}.outputs.deployment_id }}`;
+	const hasIntent = `steps.${id}.outputs.deployment_id != ''`;
+	const env = {
+		FACTORY_PREVIEW_PR: options.pr ?? `\${{ github.event.pull_request.number }}`,
+		GH_TOKEN: `\${{ github.token }}`
+	};
+	const command = `${cli} preview:receipt --pr "$FACTORY_PREVIEW_PR" --target '${options.target}'`;
+	return Object.freeze({
+		beginStep: Object.freeze({
+			env,
+			id,
+			name: `Record preview intent for ${options.target}`,
+			run: `${command} --action begin --github-output "$GITHUB_OUTPUT"`
+		}),
+		completionSteps: Object.freeze([
+			Object.freeze({
+				env: {
+					...env,
+					FACTORY_DEPLOYMENT_ID: deploymentId
+				},
+				if: `success() && ${hasIntent}`,
+				name: `Complete preview receipt for ${options.target}`,
+				run: `${command} --action complete --deployment-id "$FACTORY_DEPLOYMENT_ID" --outcome success`
+			}),
+			Object.freeze({
+				env: { FACTORY_DEPLOYMENT_ID: deploymentId },
+				if: `success() && ${hasIntent}`,
+				name: `Bind deployment receipt ${deploymentId}`,
+				run: "test -n \"$FACTORY_DEPLOYMENT_ID\""
+			}),
+			Object.freeze({
+				env: {
+					...env,
+					FACTORY_DEPLOYMENT_ID: deploymentId
+				},
+				if: `failure() && ${hasIntent}`,
+				name: `Fail preview receipt for ${options.target}`,
+				run: `${command} --action complete --deployment-id "$FACTORY_DEPLOYMENT_ID" --outcome failure`
+			})
+		]),
+		invalidateStep: Object.freeze({
+			env,
+			name: `Invalidate preview receipts for ${options.target}`,
+			run: `${command} --action invalidate`
+		}),
+		permissions: Object.freeze({
+			actions: "read",
+			contents: "read",
+			deployments: "write",
+			"pull-requests": "read"
+		})
+	});
+};
+//#endregion
 //#region src/push-identity-workflow.ts
 /** `owner/repo` slice of the catalog's `UPLOAD_ARTIFACT` pin, derived rather
 * than repeated as a literal, so a repository rename here cannot drift from
@@ -3530,4 +3591,4 @@ const assertWorkflowShellParses = (yaml, options) => {
 	throw new Error(`${options.source} emits shell bash cannot parse; the runner would treat it as a no-op:\n${detail}`);
 };
 //#endregion
-export { ALCHEMY_BASELINE, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_APP_BROKER_TOKEN_PERMISSIONS, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_CURSOR_OIDC_AUDIENCE, FACTORY_CURSOR_OIDC_ISSUER, FACTORY_CURSOR_OIDC_JWKS_URL, FACTORY_CURSOR_OIDC_MANAGED_RUNTIME, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, GitHubApiError, GitHubAppTokenTransportError, NODE_PNPM_ACTION_FAMILY_NODE24, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, PreviewProofTransportError, SETUP_STEP_ROLES, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, VitestProfileError, assertAlchemyBaseline, assertProofReuseCoverage, assertVerifyRunnerPolicy, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryVerifyRunner, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, setupStepsForRoles, verifyRunnerPolicy, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };
+export { ALCHEMY_BASELINE, EXECUTE_ALCHEMY_ENTRY_MAX_BUFFER, FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_APP_BROKER_TOKEN_PERMISSIONS, FACTORY_CANDIDATE_IMPACT_BASIS_OUTPUT, FACTORY_CANDIDATE_IMPACT_DECISION_OUTPUT, FACTORY_CANDIDATE_IMPACT_INERT_OUTPUT, FACTORY_CANDIDATE_IMPACT_STEP_ID, FACTORY_CANDIDATE_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_CANDIDATE_PULL_REQUEST_TYPES, FACTORY_CURSOR_OIDC_AUDIENCE, FACTORY_CURSOR_OIDC_ISSUER, FACTORY_CURSOR_OIDC_JWKS_URL, FACTORY_CURSOR_OIDC_MANAGED_RUNTIME, FACTORY_LIFECYCLE_CONTRACT_JOB_ID, FACTORY_LIFECYCLE_CONTRACT_JOB_NAME, FACTORY_MERGE_FREEZE_APP_TOKEN_STEP_ID, FACTORY_MERGE_FREEZE_CHECK_NAME, FACTORY_MERGE_FREEZE_IF, FACTORY_MERGE_FREEZE_JOB_ID, FACTORY_MERGE_FREEZE_JOB_NAME, FACTORY_MERGE_FREEZE_PERMISSIONS, FACTORY_MERGE_FREEZE_VERIFY_RESULT_EXPRESSION, FACTORY_MERGE_TARGET_REF_CONDITION, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_ID, FACTORY_PREVIEW_CLEANUP_AUDIT_JOB_NAME, FACTORY_PRODUCTION_IMPACT_BASIS_OUTPUT, FACTORY_PRODUCTION_IMPACT_DECISION_OUTPUT, FACTORY_PRODUCTION_IMPACT_STEP_ID, FACTORY_PRODUCTION_IMPACT_UNSUBSCRIBED_OUTPUT, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_CHECK_NAME, FACTORY_PROOF_GATE_GUARD, FACTORY_PROOF_GATE_IF, FACTORY_PROOF_GATE_MODE_OUTPUT, FACTORY_PROOF_GATE_OUTPUT, FACTORY_PROOF_GATE_REASONS, FACTORY_PROOF_GATE_REASON_OUTPUT, FACTORY_PROOF_GATE_SHELL, FACTORY_PROOF_GATE_SOURCE_URL_OUTPUT, FACTORY_PROOF_GATE_STEP_ID, FACTORY_PROOF_GATE_STEP_NAME, FACTORY_PR_STATUS_HUD_APP_TOKEN_STEP_ID, FACTORY_PR_STATUS_HUD_CONCURRENCY, FACTORY_PR_STATUS_HUD_IF, FACTORY_PR_STATUS_HUD_JOB_ID, FACTORY_PR_STATUS_HUD_JOB_NAME, FACTORY_PR_STATUS_HUD_PERMISSIONS, FACTORY_PR_STATUS_HUD_PLAN_PATH, FACTORY_PUSH_IDENTITY_SCHEMA_VERSION, GitHubApiError, GitHubAppTokenTransportError, NODE_PNPM_ACTION_FAMILY_NODE24, PREVIEW_PROOF_INVENTORY_CHECK_NAME, PREVIEW_PROOF_INVENTORY_LIST_PERMISSIONS, PreviewProofTransportError, SETUP_STEP_ROLES, UPLOAD_ARTIFACT, VITEST_PROFILE_SCHEMA_VERSION, VITEST_PROFILE_TOOL, VitestProfileError, assertAlchemyBaseline, assertProofReuseCoverage, assertVerifyRunnerPolicy, assertWorkflowShellParses, bundleAlchemyEntry, captureVitestProfileEnvironment, executeAlchemyEntry, factoryCandidateImpactWorkflow, factoryCandidateOrPushCondition, factoryLifecycleContractLane, factoryMergeFreezeJob, factoryMergeFreezeScript, factoryPrStatusHudWorkflow, factoryPreviewCleanupTopology, factoryPreviewReceiptWorkflow, factoryProductionImpactWorkflow, factoryProofGateScript, factoryProofGateStep, factoryProofReuseSummaryStep, factoryProofTimingStartStep, factoryPushIdentityConsumer, factoryPushIdentityProducer, factoryVerifyRunner, factoryWorkflow, githubAppJwt, isLocalPreviewStage, localPreviewStage, mintInstallationToken, normalizeVitestProfileSample, parseLocalPreviewStage, previewCleanupDestroyJobId, previewProofInventory, previewProofLifecycle, productionImpactTargetOutput, proofReuseCoverage, proofReuseRequiredCommands, readVitestProfileDocument, resolveProofReuseCommands, runVitestProfile, setupStepsForRoles, verifyRunnerPolicy, workflowRunBlocks, workflowShellParseFailures, writeVitestProfile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/factory-ci",
-  "version": "1.0.0-alpha.34",
+  "version": "1.0.0-alpha.36",
   "description": "Deep CI and deploy building blocks for Patronage factory projects: workflow source artifacts, hosted diff classification, Alchemy entry execution, and disposable-stage semantics",
   "keywords": [
     "alchemy",
@@ -49,7 +49,7 @@
     "typescript": "5.9.3",
     "ultracite": "7.10.5",
     "vitest": "4.1.10",
-    "@patronage/alchemy-d1-state": "0.3.0"
+    "@patronage/alchemy-d1-state": "0.4.0"
   },
   "peerDependencies": {
     "alchemy": ">=2.0.0-beta.63 <3",