@patronage/software-factory 1.0.0-alpha.3 → 1.0.0-alpha.4

package/dist/index.d.ts

@@ -1252,8 +1252,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
         blocked: "blocked";
-        stale: "stale";
         "not-required": "not-required";
+        stale: "stale";
         current: "current";
         missing: "missing";
       }>;
@@ -1264,8 +1264,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
         blocked: "blocked";
-        stale: "stale";
         "not-required": "not-required";
+        stale: "stale";
         current: "current";
         missing: "missing";
       }>;
@@ -1779,8 +1779,8 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
   blocked: "blocked";
-  stale: "stale";
   "not-required": "not-required";
+  stale: "stale";
   current: "current";
   missing: "missing";
 }>;
@@ -4076,13 +4076,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "stale" | "not-required" | "current" | "missing";
+        status: "blocked" | "not-required" | "stale" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "stale" | "not-required" | "current" | "missing";
+        status: "blocked" | "not-required" | "stale" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;

package/dist/index.js

@@ -4,7 +4,7 @@ import { appendFileSync, constants, cpSync, createReadStream, existsSync, mkdirS
 import { pathToFileURL } from "node:url";
 import { Command, InvalidArgumentError } from "commander";
 import path from "node:path";
-import crypto, { createHash, createSign, randomUUID } from "node:crypto";
+import crypto, { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { execFileSync, spawnSync } from "node:child_process";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
@@ -16,8 +16,9 @@ import { Worker } from "node:worker_threads";
 import picomatch from "picomatch";
 import { parse } from "yaml";
 import { promisify } from "node:util";
+import { GitHubApiError, mintInstallationToken } from "@patronage/factory-ci";
 //#region package.json
-var version = "1.0.0-alpha.3";
+var version = "1.0.0-alpha.4";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -7673,31 +7674,6 @@ const defaultSleep = async (ms) => {
 	const { setTimeout: delay } = await import("node:timers/promises");
 	await delay(ms);
 };
-const base64url = (value) => Buffer.from(value).toString("base64url");
-function appJwt(config, now) {
-	const issuedAt = Math.floor(now / 1e3) - 60;
-	const unsigned = `${base64url(JSON.stringify({
-		alg: "RS256",
-		typ: "JWT"
-	}))}.${base64url(JSON.stringify({
-		exp: issuedAt + 600,
-		iat: issuedAt,
-		iss: config.appId
-	}))}`;
-	const signer = createSign("RSA-SHA256");
-	signer.update(unsigned);
-	signer.end();
-	return `${unsigned}.${signer.sign(readFileSync(config.privateKeyPath), "base64url")}`;
-}
-/** Carries the HTTP status so a caller can tell a retryable failure apart. */
-var GitHubApiError = class extends Error {
-	status;
-	constructor(status, statusText) {
-		super(`GitHub API ${status} ${statusText}`);
-		this.name = "GitHubApiError";
-		this.status = status;
-	}
-};
 /**
 * Worth another attempt: 422 is what GitHub answers for a head SHA it has not
 * seen yet (the whole reason the retry exists), 5xx and rate limiting are
@@ -7752,24 +7728,24 @@ async function githubJson(request, url, init, timeoutMs = GITHUB_PUBLISH_TIMEOUT
 	if (!response.ok) throw new GitHubApiError(response.status, response.statusText);
 	return await response.json();
 }
-async function installationToken(repository, config, request, now, timeoutMs = GITHUB_PUBLISH_TIMEOUT_MS) {
-	const jwt = appJwt(config, now);
-	let { installationId } = config;
-	if (installationId === void 0) {
-		const installation = await githubJson(request, `https://api.github.com/repos/${repository.owner}/${repository.repo}/installation`, {
-			headers: { Authorization: `Bearer ${jwt}` },
-			method: "GET"
-		}, timeoutMs);
-		if (typeof installation.id !== "number") throw new TypeError("GitHub App installation response omitted id");
-		installationId = installation.id;
-	}
-	const token = await githubJson(request, `https://api.github.com/app/installations/${installationId}/access_tokens`, {
-		headers: { Authorization: `Bearer ${jwt}` },
-		method: "POST"
-	}, timeoutMs);
-	if (typeof token.token !== "string") throw new TypeError("GitHub App token response omitted token");
-	return token.token;
-}
+/**
+* Mint an installation token for the Patronage Factory App.
+*
+* The mechanism — app JWT, installation lookup, token exchange — lives in
+* `@patronage/factory-ci` (#617), because paitronage's proof-comment publisher
+* had grown a second copy of it. What stays here is what is this repository's:
+* where the credentials come from (`user-config`), and the publish timeout the
+* rest of these calls are bound by. Nothing is cached, as before.
+*/
+const installationToken = (repository, config, request, now, timeoutMs = GITHUB_PUBLISH_TIMEOUT_MS) => mintInstallationToken({
+	credentials: config,
+	owner: repository.owner,
+	repo: repository.repo
+}, {
+	fetch: request,
+	now: () => now,
+	timeoutMs
+});
 function verifyOutput(proof) {
 	const value = proof;
 	const commands = value.executedCommands?.length ?? 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.3",
+  "version": "1.0.0-alpha.4",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -35,7 +35,8 @@
     "commander": "14.0.3",
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
-    "zod": "4.4.3"
+    "zod": "4.4.3",
+    "@patronage/factory-ci": "1.0.0-alpha.4"
   },
   "devDependencies": {
     "@types/node": "24.13.3",