@patronage/software-factory 1.0.0-alpha.36 → 1.0.0-alpha.38

package/dist/oxlint-jev/{bridge-B4Sx95ZO.js → bridge-PMzq2gZh.js}

@@ -193,8 +193,19 @@ const openJevCache = ({ directory = defaultJevCacheDirectory(process.cwd()), end
 };
 //#endregion
 //#region src/hq-access.ts
-const CF_ACCESS_CLIENT_ID_ENV = "CF-Access-Client-Id";
-const CF_ACCESS_CLIENT_SECRET_ENV = "CF-Access-Client-Secret";
+/**
+* The environment variables that carry the HQ Cloudflare Access service token.
+* Both names are shell identifiers, so `/bin/sh` passes them through on every
+* platform, dash included (#1286, #1311). These are the only names read.
+*/
+const CF_ACCESS_CLIENT_ID_ENV = "CF_ACCESS_CLIENT_ID";
+const CF_ACCESS_CLIENT_SECRET_ENV = "CF_ACCESS_CLIENT_SECRET";
+/**
+* The request headers Cloudflare Access reads the token from. They are the
+* wire contract and do not follow the environment variable names.
+*/
+const CF_ACCESS_CLIENT_ID_HEADER = "CF-Access-Client-Id";
+const CF_ACCESS_CLIENT_SECRET_HEADER = "CF-Access-Client-Secret";
 /**
 * True in a hosted runner, where secret-manager resolution must not be
 * tried (#312). Lives here — a dependency-free leaf both
@@ -211,8 +222,8 @@ const buildCloudflareAccessRequestInit = (token, init) => ({
 	...init,
 	headers: {
 		...init.headers,
-		[CF_ACCESS_CLIENT_ID_ENV]: token.clientId,
-		[CF_ACCESS_CLIENT_SECRET_ENV]: token.clientSecret
+		[CF_ACCESS_CLIENT_ID_HEADER]: token.clientId,
+		[CF_ACCESS_CLIENT_SECRET_HEADER]: token.clientSecret
 	},
 	redirect: "error"
 });
@@ -221,9 +232,11 @@ const buildCloudflareAccessRequestInit = (token, init) => ({
 /**
 * Resolving the HQ Access credentials, and saying *why* when that fails.
 *
-* A deliberate command (`psf hq:flush`, and doctor's remote checks in #394) is
-* the one place allowed to ask the secret manager for the HQ Access token. It
-* used to keep a value-or-nothing answer, so a missing binary, a sandbox that
+* A deliberate command (`psf hq:flush`, and doctor's remote checks in #394)
+* asks the secret manager for the HQ Access token, and since #1313 so does an
+* HQ emission on an operator machine, once per process
+* (`resolveHqCredentialsOncePerProcess`). This used to be a
+* value-or-nothing answer, so a missing binary, a sandbox that
 * cannot reach the keychain, and a mistyped reference all collapsed into one
 * generic "credentials are unavailable" line. A sandboxed lane read that as
 * environmental noise while every one of its proofs stayed spooled.
@@ -247,15 +260,16 @@ const spawnFailure = (error) => {
 	if (code === "EACCES" || code === "EPERM") return "resolver-blocked";
 	return "resolver-timeout";
 };
-const probe = (binary, reference, capture) => {
+const probe = (binary, reference, capture, timeoutMs) => {
 	const result = spawnSync(binary, ["read", reference], {
 		encoding: "utf-8",
+		killSignal: "SIGKILL",
 		stdio: [
 			"ignore",
 			capture ? "pipe" : "ignore",
 			"ignore"
 		],
-		timeout: SECRET_PROBE_TIMEOUT_MS
+		timeout: timeoutMs
 	});
 	if (result.error) return { status: spawnFailure(result.error) };
 	if (result.signal) return { status: "resolver-timeout" };
@@ -276,20 +290,26 @@ const probe = (binary, reference, capture) => {
 * *informative* one: a machine without `op-fast` that has `op` installed and
 * denied must report the denial, not the missing binary.
 */
-const resolveThrough = (reference, capture) => {
+const resolveThrough = (reference, capture, timeoutMs = SECRET_PROBE_TIMEOUT_MS) => {
 	let failure = "resolver-missing";
 	for (const binary of SECRET_RESOLVER_BINARIES) {
-		const outcome = probe(binary, reference, capture);
+		const outcome = probe(binary, reference, capture, timeoutMs);
 		if (outcome.status === "resolved") return outcome;
 		if (failure === "resolver-missing") failure = outcome.status;
 	}
 	return { status: failure };
 };
-const defaultSecretReferenceResolver = (reference) => resolveThrough(reference, true);
 /**
-* Environment first (the #312 emit-time path), then the operator's configured
-* references. The first reference that fails ends the resolution: a second
-* probe would add nothing but another chance to hang.
+* The capturing resolver with its own probe ceiling. Production uses
+* `defaultSecretReferenceResolver`; a test passes a short ceiling to prove the
+* probe really ends there.
+*/
+const secretReferenceResolverWithin = (timeoutMs) => (reference) => resolveThrough(reference, true, timeoutMs);
+const defaultSecretReferenceResolver = secretReferenceResolverWithin(SECRET_PROBE_TIMEOUT_MS);
+/**
+* Environment first, then the operator's configured references. The first
+* reference that fails ends the resolution: a second probe would add nothing
+* but another chance to hang.
 */
 const resolveHqCredentials = ({ env, references, resolve = defaultSecretReferenceResolver }) => {
 	const clientId = env[CF_ACCESS_CLIENT_ID_ENV];
@@ -354,7 +374,7 @@ const hqIngestCredentialReferencesSchema = z.object({
 const factoryUserConfigSchema = z.object({
 	githubApp: githubAppConfigSchema.optional(),
 	hqAllowedOrigins: z.array(hqAllowedOriginSchema).describe("Operator-controlled exact HTTPS origins authorized to receive HQ credential-bearing requests; an absent or empty list authorizes none.").optional(),
-	hqIngestCredentials: hqIngestCredentialReferencesSchema.describe("Operator-controlled secret-manager references for the HQ ingest Cloudflare Access service token. References only — the factory never reads, prints, exports, or caches the values.").optional(),
+	hqIngestCredentials: hqIngestCredentialReferencesSchema.describe("Operator-controlled secret-manager references for the HQ ingest Cloudflare Access service token. References only: the factory resolves them in memory when it sends HQ evidence, and never prints, exports, or writes the values.").optional(),
 	schemaVersion: z.literal(FACTORY_USER_CONFIG_SCHEMA_VERSION)
 });
 function defaultUserConfigPath(env = process.env) {
@@ -368,14 +388,19 @@ function defaultUserConfigPath(env = process.env) {
 *
 * A request that carries the token goes only to an HTTPS origin with no
 * embedded credentials that the operator listed, exactly, in
-* `hqAllowedOrigins` in the operator user config. Committed repository data
-* and the environment can name an origin; only the operator can authorize one
-* (ADR 0015). HQ ingest and the Jev client both call this module, so the two
-* cannot drift apart: one protocol rule, one reader, one parser.
+* `hqAllowedOrigins` in the operator user config or in
+* `FACTORY_HQ_ALLOWED_ORIGINS` in the process environment. Those two lists
+* are unioned. Committed repository data can name an origin; it cannot
+* authorize one (ADR 0015). The environment variable is operator
+* configuration, read only from the process environment passed in, never
+* from the profile or any repository file. HQ ingest and the Jev client both
+* call this module, so the two cannot drift apart: one protocol rule, one
+* resolver.
 *
-* The reader is bounded. A config path that is a FIFO, a huge file, or a disk
-* that hangs answers "no origin is authorized" within the caller's deadline
-* instead of holding a gate or a lint run open.
+* The file reader is bounded. A config path that is a FIFO, a huge file, or a
+* disk that hangs contributes no config origin within the caller's deadline
+* instead of holding a gate or a lint run open. The environment list does not
+* touch the filesystem, so it still applies when the file does not answer.
 */
 /** Largest operator config or profile file the HQ readers will open. */
 const MAX_HQ_CONFIG_BYTES = 1024 * 1024;
@@ -447,20 +472,59 @@ const hqAllowedOriginsFromConfigText = (text) => {
 		return [];
 	}
 };
+/** Operator allowlist supplied to a machine that has no user config file. */
+const FACTORY_HQ_ALLOWED_ORIGINS_ENV = "FACTORY_HQ_ALLOWED_ORIGINS";
+/**
+* Exact HTTPS origins from `FACTORY_HQ_ALLOWED_ORIGINS` in `env`.
+* Comma-separated. A segment that is not an exact origin is ignored.
+* This reads that one property and nothing else: no file, no profile.
+*/
+const hqAllowedOriginsFromEnv = (env) => {
+	let raw;
+	try {
+		raw = env[FACTORY_HQ_ALLOWED_ORIGINS_ENV];
+	} catch {
+		return [];
+	}
+	if (typeof raw !== "string" || raw.trim() === "") return [];
+	const origins = [];
+	for (const segment of raw.split(",")) {
+		const candidate = segment.trim();
+		if (candidate === "") continue;
+		const endpoint = validatedHqOrigin(candidate);
+		if (endpoint !== void 0 && candidate === endpoint.origin) origins.push(endpoint.origin);
+	}
+	return origins;
+};
+/**
+* Operator-authorized HQ origins. `configOrigins` (the user config's
+* `hqAllowedOrigins`) is unioned with `FACTORY_HQ_ALLOWED_ORIGINS` from
+* `env`. The environment value never replaces the config list, and neither
+* list is read from the profile or any repository file.
+*/
+const resolveHqAllowedOrigins = (env, configOrigins) => {
+	const fromEnv = hqAllowedOriginsFromEnv(env);
+	if (fromEnv.length === 0) return [...configOrigins];
+	const allowed = [...configOrigins];
+	for (const origin of fromEnv) if (!allowed.includes(origin)) allowed.push(origin);
+	return allowed;
+};
 /**
 * The operator's `hqAllowedOrigins`, read from the operator user config within
-* `deadline` (a `performance.now()` time). A missing, unreadable, oversized or
-* invalid file, or one that does not answer in time, authorizes nothing.
+* `deadline` (a `performance.now()` time), unioned with
+* `FACTORY_HQ_ALLOWED_ORIGINS`. A missing, unreadable, oversized or invalid
+* file, or one that does not answer in time, contributes no config origin.
+* The environment list still applies.
 */
 const loadHqAllowedOrigins = async (env, deadline) => {
-	let configPath;
+	let configOrigins = [];
 	try {
-		configPath = defaultUserConfigPath(env);
+		const contents = await readBoundedTextFile(defaultUserConfigPath(env), deadline);
+		if (contents !== void 0) configOrigins = hqAllowedOriginsFromConfigText(contents);
 	} catch {
-		return [];
+		configOrigins = [];
 	}
-	const contents = await readBoundedTextFile(configPath, deadline);
-	return contents === void 0 ? [] : hqAllowedOriginsFromConfigText(contents);
+	return resolveHqAllowedOrigins(env, configOrigins);
 };
 /**
 * The matching rule: the URL's origin must equal one listed origin exactly.
@@ -481,8 +545,8 @@ const isHqOriginAuthorized = (allowedOrigins, endpoint) => allowedOrigins.includ
 * anything else happens, by the same code HQ ingest uses
 * (`hq-origin-policy.ts`, ADR 0015): it must be an `https:` origin with no
 * embedded credentials, listed exactly in the operator's `hqAllowedOrigins`.
-* Only then are credentials read: `resolveHqCredentials` reads the hyphenated
-* `CF-Access-Client-Id` / `CF-Access-Client-Secret` pair, and
+* Only then are credentials read: `resolveHqCredentials` reads the
+* `CF_ACCESS_CLIENT_ID` / `CF_ACCESS_CLIENT_SECRET` pair, and
 * `buildCloudflareAccessRequestInit` attaches them to a request that refuses
 * redirects so the credentials cannot leave the authorized origin.
 *
@@ -647,11 +711,8 @@ const exchange = async (input) => {
 		throw new JevRequestError(0, "exchange_failed", "The HQ Jev exchange failed before a response could be read. No upstream text is reported: it can quote the request.");
 	}
 };
-/**
-* The whole remedy, in one sentence. The variable names are literally
-* hyphenated, so a plain `export` does not set them.
-*/
-const MISSING_CREDENTIALS_REASON = `no HQ credentials: ${CF_ACCESS_CLIENT_ID_ENV} and ${CF_ACCESS_CLIENT_SECRET_ENV} are not both in the environment. The names are literally hyphenated, so a plain \`export\` does not set them — prefix the command: \`env '${CF_ACCESS_CLIENT_ID_ENV}=…' '${CF_ACCESS_CLIENT_SECRET_ENV}=…' <the command> …\`.`;
+/** The whole remedy, in one sentence. */
+const MISSING_CREDENTIALS_REASON = `no HQ credentials: ${CF_ACCESS_CLIENT_ID_ENV} and ${CF_ACCESS_CLIENT_SECRET_ENV} are not both in the environment. Set both, or prefix the command: \`env '${CF_ACCESS_CLIENT_ID_ENV}=…' '${CF_ACCESS_CLIENT_SECRET_ENV}=…' <the command> …\`.`;
 /** Where the operator config was looked for, for a message that names it. */
 const operatorConfigLocation = (env) => {
 	try {