@patronage/software-factory 1.0.0-alpha.3 → 1.0.0-alpha.5

package/README.md

@@ -37,7 +37,7 @@ A stacked release train has one terminal release-owning slice. Interior slices d
 A stable cut has two phases. Phase 1 is the verified package candidate: steps 1 through 4 below, ending in the attended npm publish, tag, and GitHub release. Phase 2 is post-publication stable-doc convergence: steps 5 and 6, a normal admitted docs PR followed by the read-only convergence assertion from a clean `main`. Stable docs must never claim an unpublished version, so they cannot land in the phase-1 change. Prerelease behavior is unchanged: prerelease notes may land before publish while stable docs keep naming the prior stable version.
 
 1. Bump `package.json` to valid SemVer. The assertion derives its expected stable or prerelease channel from the version; it accepts no channel flag.
-2. Publish to npm per the [repository operations runbook](../docs/repository-operations.md#publishing) (attended, hand-cut, `pnpm publish` only). A stable version uses `pnpm --filter @patronage/software-factory publish`, which assigns npm `latest`. A prerelease must use `pnpm --filter @patronage/software-factory publish --tag next`; bare `pnpm publish` defaults to `latest` and would move it before the post-hoc assertion can reject the release.
+2. Publish to npm per the [repository operations runbook](../docs/repository-operations.md#publishing) (attended, hand-cut, `pnpm publish` only). Both factory packages pin `publishConfig.tag: next`, so a bare `pnpm --filter @patronage/software-factory publish` lands on `next` and cannot move `latest`. A prerelease is therefore the bare command; a stable version must say it out loud: `pnpm --filter @patronage/software-factory publish --tag latest`. Forgetting the flag on a stable cut leaves `latest` untouched for the convergence assertion to flag — the safe failure direction.
 3. Cut the `software-factory-vX.Y.Z` tag and push it.
 4. Cut the GitHub release for that tag, with notes covering features, deletions, breaking changes, and closed issues. Mark it as a prerelease exactly when its SemVer version has a prerelease component. When the release changes the profile `schemaVersion`, state it in the notes — the profile schema version is a separate axis from the package version.
 5. Converge the stable docs after publication. Update affected `software-factory-docs/` pages through a normal admitted docs PR. Stable docs must state the current stable version. Prerelease docs may record the candidate and its migration notes, but must not represent it as the current stable release.

package/dist/index.d.ts

@@ -1252,8 +1252,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
         blocked: "blocked";
-        stale: "stale";
         "not-required": "not-required";
+        stale: "stale";
         current: "current";
         missing: "missing";
       }>;
@@ -1264,8 +1264,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
         blocked: "blocked";
-        stale: "stale";
         "not-required": "not-required";
+        stale: "stale";
         current: "current";
         missing: "missing";
       }>;
@@ -1779,8 +1779,8 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
   blocked: "blocked";
-  stale: "stale";
   "not-required": "not-required";
+  stale: "stale";
   current: "current";
   missing: "missing";
 }>;
@@ -2187,9 +2187,9 @@ declare const retroEnvelopeV1Schema: z.ZodObject<{
   kind: z.ZodLiteral<"retro-envelope">;
   outcome: z.ZodOptional<z.ZodObject<{
     status: z.ZodEnum<{
+      blocked: "blocked";
       success: "success";
       fail: "fail";
-      blocked: "blocked";
       "ship-with-followups": "ship-with-followups";
     }>;
     verdict: z.ZodOptional<z.ZodString>;
@@ -4076,13 +4076,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "stale" | "not-required" | "current" | "missing";
+        status: "blocked" | "not-required" | "stale" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "stale" | "not-required" | "current" | "missing";
+        status: "blocked" | "not-required" | "stale" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;

package/dist/index.js

@@ -4,7 +4,7 @@ import { appendFileSync, constants, cpSync, createReadStream, existsSync, mkdirS
 import { pathToFileURL } from "node:url";
 import { Command, InvalidArgumentError } from "commander";
 import path from "node:path";
-import crypto, { createHash, createSign, randomUUID } from "node:crypto";
+import crypto, { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { execFileSync, spawnSync } from "node:child_process";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
@@ -16,8 +16,9 @@ import { Worker } from "node:worker_threads";
 import picomatch from "picomatch";
 import { parse } from "yaml";
 import { promisify } from "node:util";
+import { GitHubApiError, mintInstallationToken } from "@patronage/factory-ci";
 //#region package.json
-var version = "1.0.0-alpha.3";
+var version = "1.0.0-alpha.5";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -7673,31 +7674,6 @@ const defaultSleep = async (ms) => {
 	const { setTimeout: delay } = await import("node:timers/promises");
 	await delay(ms);
 };
-const base64url = (value) => Buffer.from(value).toString("base64url");
-function appJwt(config, now) {
-	const issuedAt = Math.floor(now / 1e3) - 60;
-	const unsigned = `${base64url(JSON.stringify({
-		alg: "RS256",
-		typ: "JWT"
-	}))}.${base64url(JSON.stringify({
-		exp: issuedAt + 600,
-		iat: issuedAt,
-		iss: config.appId
-	}))}`;
-	const signer = createSign("RSA-SHA256");
-	signer.update(unsigned);
-	signer.end();
-	return `${unsigned}.${signer.sign(readFileSync(config.privateKeyPath), "base64url")}`;
-}
-/** Carries the HTTP status so a caller can tell a retryable failure apart. */
-var GitHubApiError = class extends Error {
-	status;
-	constructor(status, statusText) {
-		super(`GitHub API ${status} ${statusText}`);
-		this.name = "GitHubApiError";
-		this.status = status;
-	}
-};
 /**
 * Worth another attempt: 422 is what GitHub answers for a head SHA it has not
 * seen yet (the whole reason the retry exists), 5xx and rate limiting are
@@ -7752,24 +7728,24 @@ async function githubJson(request, url, init, timeoutMs = GITHUB_PUBLISH_TIMEOUT
 	if (!response.ok) throw new GitHubApiError(response.status, response.statusText);
 	return await response.json();
 }
-async function installationToken(repository, config, request, now, timeoutMs = GITHUB_PUBLISH_TIMEOUT_MS) {
-	const jwt = appJwt(config, now);
-	let { installationId } = config;
-	if (installationId === void 0) {
-		const installation = await githubJson(request, `https://api.github.com/repos/${repository.owner}/${repository.repo}/installation`, {
-			headers: { Authorization: `Bearer ${jwt}` },
-			method: "GET"
-		}, timeoutMs);
-		if (typeof installation.id !== "number") throw new TypeError("GitHub App installation response omitted id");
-		installationId = installation.id;
-	}
-	const token = await githubJson(request, `https://api.github.com/app/installations/${installationId}/access_tokens`, {
-		headers: { Authorization: `Bearer ${jwt}` },
-		method: "POST"
-	}, timeoutMs);
-	if (typeof token.token !== "string") throw new TypeError("GitHub App token response omitted token");
-	return token.token;
-}
+/**
+* Mint an installation token for the Patronage Factory App.
+*
+* The mechanism — app JWT, installation lookup, token exchange — lives in
+* `@patronage/factory-ci` (#617), because paitronage's proof-comment publisher
+* had grown a second copy of it. What stays here is what is this repository's:
+* where the credentials come from (`user-config`), and the publish timeout the
+* rest of these calls are bound by. Nothing is cached, as before.
+*/
+const installationToken = (repository, config, request, now, timeoutMs = GITHUB_PUBLISH_TIMEOUT_MS) => mintInstallationToken({
+	credentials: config,
+	owner: repository.owner,
+	repo: repository.repo
+}, {
+	fetch: request,
+	now: () => now,
+	timeoutMs
+});
 function verifyOutput(proof) {
 	const value = proof;
 	const commands = value.executedCommands?.length ?? 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.3",
+  "version": "1.0.0-alpha.5",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -29,13 +29,15 @@
     }
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "next"
   },
   "dependencies": {
     "commander": "14.0.3",
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
-    "zod": "4.4.3"
+    "zod": "4.4.3",
+    "@patronage/factory-ci": "1.0.0-alpha.5"
   },
   "devDependencies": {
     "@types/node": "24.13.3",