@patronage/software-factory 1.0.0-alpha.2 → 1.0.0-alpha.4

package/dist/index.d.ts

@@ -753,8 +753,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    stale: "stale";
     active: "active";
+    stale: "stale";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -1234,8 +1234,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       "run-interior-cycle": "run-interior-cycle";
     }>;
     stage: z.ZodEnum<{
-      interior: "interior";
       gate: "gate";
+      interior: "interior";
       "interior-complete": "interior-complete";
     }>;
   }, z.core.$strip>>;
@@ -1251,10 +1251,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        "not-required": "not-required";
         blocked: "blocked";
-        current: "current";
+        "not-required": "not-required";
         stale: "stale";
+        current: "current";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -1263,10 +1263,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        "not-required": "not-required";
         blocked: "blocked";
-        current: "current";
+        "not-required": "not-required";
         stale: "stale";
+        current: "current";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
@@ -1277,8 +1277,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
     docsOnlyVerifiedHeadSha: z.ZodOptional<z.ZodString>;
     prVerify: z.ZodEnum<{
-      passed: "passed";
       stale: "stale";
+      passed: "passed";
       missing: "missing";
     }>;
     trivialDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
@@ -1778,10 +1778,10 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  "not-required": "not-required";
   blocked: "blocked";
-  current: "current";
+  "not-required": "not-required";
   stale: "stale";
+  current: "current";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -2949,8 +2949,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    interior: "interior";
     gate: "gate";
+    interior: "interior";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3002,8 +3002,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    interior: "interior";
     gate: "gate";
+    interior: "interior";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3046,8 +3046,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     stage: z.ZodEnum<{
-      interior: "interior";
       gate: "gate";
+      interior: "interior";
     }>;
     usage: z.ZodOptional<z.ZodObject<{
       estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3077,7 +3077,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     staleRepeats: number;
   };
   observedAt: string;
-  stage: "interior" | "gate";
+  stage: "gate" | "interior";
   issue?: number | undefined;
   pr?: number | undefined;
   threadId?: string | undefined;
@@ -4076,13 +4076,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "not-required" | "blocked" | "current" | "stale" | "missing";
+        status: "blocked" | "not-required" | "stale" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "not-required" | "blocked" | "current" | "stale" | "missing";
+        status: "blocked" | "not-required" | "stale" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -4090,7 +4090,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     schemaVersion: 1;
     verification: {
       command: "patronage-factory pr:verify";
-      prVerify: "passed" | "stale" | "missing";
+      prVerify: "stale" | "passed" | "missing";
       docsOnlyDeltaAccepted?: boolean | undefined;
       docsOnlyVerifiedHeadSha?: string | undefined;
       trivialDeltaAccepted?: boolean | undefined;
@@ -4133,7 +4133,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human" | "advance-to-gate" | "run-interior-cycle";
-      stage: "interior" | "gate" | "interior-complete";
+      stage: "gate" | "interior" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;

package/dist/index.js

@@ -4,7 +4,7 @@ import { appendFileSync, constants, cpSync, createReadStream, existsSync, mkdirS
 import { pathToFileURL } from "node:url";
 import { Command, InvalidArgumentError } from "commander";
 import path from "node:path";
-import crypto, { createHash, createSign, randomUUID } from "node:crypto";
+import crypto, { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { execFileSync, spawnSync } from "node:child_process";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
@@ -16,8 +16,9 @@ import { Worker } from "node:worker_threads";
 import picomatch from "picomatch";
 import { parse } from "yaml";
 import { promisify } from "node:util";
+import { GitHubApiError, mintInstallationToken } from "@patronage/factory-ci";
 //#region package.json
-var version = "1.0.0-alpha.2";
+var version = "1.0.0-alpha.4";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -3050,7 +3051,10 @@ async function flushHqSpool(input, dependencies = {}) {
 	const env = dependencies.env ?? process.env;
 	const request = dependencies.fetch ?? fetch;
 	const transportBudgetMs = dependencies.transportTimeoutMs ?? DEFAULT_HQ_TRANSPORT_TIMEOUT_MS;
-	const flushBudgetMs = dependencies.journalFlushBudgetMs ?? HQ_JOURNAL_FLUSH_BUDGET_MS;
+	const flushBudgetMs = journalFlushBudgetFor({
+		env,
+		journalFlushBudgetMs: dependencies.journalFlushBudgetMs
+	});
 	const deadline = performance.now() + (dependencies.budgetMs ?? DEFAULT_HQ_FLUSH_BUDGET_MS);
 	const writeLayout = repositorySpoolLayout(input.repository, env);
 	const layouts = input.explicitDirectories && input.explicitDirectories.length > 0 ? input.explicitDirectories.map(explicitSpoolLayout) : [writeLayout, legacySpoolLayout(input.cwd)];
@@ -7670,31 +7674,6 @@ const defaultSleep = async (ms) => {
 	const { setTimeout: delay } = await import("node:timers/promises");
 	await delay(ms);
 };
-const base64url = (value) => Buffer.from(value).toString("base64url");
-function appJwt(config, now) {
-	const issuedAt = Math.floor(now / 1e3) - 60;
-	const unsigned = `${base64url(JSON.stringify({
-		alg: "RS256",
-		typ: "JWT"
-	}))}.${base64url(JSON.stringify({
-		exp: issuedAt + 600,
-		iat: issuedAt,
-		iss: config.appId
-	}))}`;
-	const signer = createSign("RSA-SHA256");
-	signer.update(unsigned);
-	signer.end();
-	return `${unsigned}.${signer.sign(readFileSync(config.privateKeyPath), "base64url")}`;
-}
-/** Carries the HTTP status so a caller can tell a retryable failure apart. */
-var GitHubApiError = class extends Error {
-	status;
-	constructor(status, statusText) {
-		super(`GitHub API ${status} ${statusText}`);
-		this.name = "GitHubApiError";
-		this.status = status;
-	}
-};
 /**
 * Worth another attempt: 422 is what GitHub answers for a head SHA it has not
 * seen yet (the whole reason the retry exists), 5xx and rate limiting are
@@ -7749,24 +7728,24 @@ async function githubJson(request, url, init, timeoutMs = GITHUB_PUBLISH_TIMEOUT
 	if (!response.ok) throw new GitHubApiError(response.status, response.statusText);
 	return await response.json();
 }
-async function installationToken(repository, config, request, now, timeoutMs = GITHUB_PUBLISH_TIMEOUT_MS) {
-	const jwt = appJwt(config, now);
-	let { installationId } = config;
-	if (installationId === void 0) {
-		const installation = await githubJson(request, `https://api.github.com/repos/${repository.owner}/${repository.repo}/installation`, {
-			headers: { Authorization: `Bearer ${jwt}` },
-			method: "GET"
-		}, timeoutMs);
-		if (typeof installation.id !== "number") throw new TypeError("GitHub App installation response omitted id");
-		installationId = installation.id;
-	}
-	const token = await githubJson(request, `https://api.github.com/app/installations/${installationId}/access_tokens`, {
-		headers: { Authorization: `Bearer ${jwt}` },
-		method: "POST"
-	}, timeoutMs);
-	if (typeof token.token !== "string") throw new TypeError("GitHub App token response omitted token");
-	return token.token;
-}
+/**
+* Mint an installation token for the Patronage Factory App.
+*
+* The mechanism — app JWT, installation lookup, token exchange — lives in
+* `@patronage/factory-ci` (#617), because paitronage's proof-comment publisher
+* had grown a second copy of it. What stays here is what is this repository's:
+* where the credentials come from (`user-config`), and the publish timeout the
+* rest of these calls are bound by. Nothing is cached, as before.
+*/
+const installationToken = (repository, config, request, now, timeoutMs = GITHUB_PUBLISH_TIMEOUT_MS) => mintInstallationToken({
+	credentials: config,
+	owner: repository.owner,
+	repo: repository.repo
+}, {
+	fetch: request,
+	now: () => now,
+	timeoutMs
+});
 function verifyOutput(proof) {
 	const value = proof;
 	const commands = value.executedCommands?.length ?? 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.4",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -35,7 +35,8 @@
     "commander": "14.0.3",
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
-    "zod": "4.4.3"
+    "zod": "4.4.3",
+    "@patronage/factory-ci": "1.0.0-alpha.4"
   },
   "devDependencies": {
     "@types/node": "24.13.3",