@patronage/software-factory 1.0.0-alpha.37 → 1.0.0-alpha.39

package/dist/oxlint-jev/{bridge-B4Sx95ZO.js → bridge-PMzq2gZh.js}

@@ -193,8 +193,19 @@ const openJevCache = ({ directory = defaultJevCacheDirectory(process.cwd()), end
 };
 //#endregion
 //#region src/hq-access.ts
-const CF_ACCESS_CLIENT_ID_ENV = "CF-Access-Client-Id";
-const CF_ACCESS_CLIENT_SECRET_ENV = "CF-Access-Client-Secret";
+/**
+* The environment variables that carry the HQ Cloudflare Access service token.
+* Both names are shell identifiers, so `/bin/sh` passes them through on every
+* platform, dash included (#1286, #1311). These are the only names read.
+*/
+const CF_ACCESS_CLIENT_ID_ENV = "CF_ACCESS_CLIENT_ID";
+const CF_ACCESS_CLIENT_SECRET_ENV = "CF_ACCESS_CLIENT_SECRET";
+/**
+* The request headers Cloudflare Access reads the token from. They are the
+* wire contract and do not follow the environment variable names.
+*/
+const CF_ACCESS_CLIENT_ID_HEADER = "CF-Access-Client-Id";
+const CF_ACCESS_CLIENT_SECRET_HEADER = "CF-Access-Client-Secret";
 /**
 * True in a hosted runner, where secret-manager resolution must not be
 * tried (#312). Lives here — a dependency-free leaf both
@@ -211,8 +222,8 @@ const buildCloudflareAccessRequestInit = (token, init) => ({
 	...init,
 	headers: {
 		...init.headers,
-		[CF_ACCESS_CLIENT_ID_ENV]: token.clientId,
-		[CF_ACCESS_CLIENT_SECRET_ENV]: token.clientSecret
+		[CF_ACCESS_CLIENT_ID_HEADER]: token.clientId,
+		[CF_ACCESS_CLIENT_SECRET_HEADER]: token.clientSecret
 	},
 	redirect: "error"
 });
@@ -221,9 +232,11 @@ const buildCloudflareAccessRequestInit = (token, init) => ({
 /**
 * Resolving the HQ Access credentials, and saying *why* when that fails.
 *
-* A deliberate command (`psf hq:flush`, and doctor's remote checks in #394) is
-* the one place allowed to ask the secret manager for the HQ Access token. It
-* used to keep a value-or-nothing answer, so a missing binary, a sandbox that
+* A deliberate command (`psf hq:flush`, and doctor's remote checks in #394)
+* asks the secret manager for the HQ Access token, and since #1313 so does an
+* HQ emission on an operator machine, once per process
+* (`resolveHqCredentialsOncePerProcess`). This used to be a
+* value-or-nothing answer, so a missing binary, a sandbox that
 * cannot reach the keychain, and a mistyped reference all collapsed into one
 * generic "credentials are unavailable" line. A sandboxed lane read that as
 * environmental noise while every one of its proofs stayed spooled.
@@ -247,15 +260,16 @@ const spawnFailure = (error) => {
 	if (code === "EACCES" || code === "EPERM") return "resolver-blocked";
 	return "resolver-timeout";
 };
-const probe = (binary, reference, capture) => {
+const probe = (binary, reference, capture, timeoutMs) => {
 	const result = spawnSync(binary, ["read", reference], {
 		encoding: "utf-8",
+		killSignal: "SIGKILL",
 		stdio: [
 			"ignore",
 			capture ? "pipe" : "ignore",
 			"ignore"
 		],
-		timeout: SECRET_PROBE_TIMEOUT_MS
+		timeout: timeoutMs
 	});
 	if (result.error) return { status: spawnFailure(result.error) };
 	if (result.signal) return { status: "resolver-timeout" };
@@ -276,20 +290,26 @@ const probe = (binary, reference, capture) => {
 * *informative* one: a machine without `op-fast` that has `op` installed and
 * denied must report the denial, not the missing binary.
 */
-const resolveThrough = (reference, capture) => {
+const resolveThrough = (reference, capture, timeoutMs = SECRET_PROBE_TIMEOUT_MS) => {
 	let failure = "resolver-missing";
 	for (const binary of SECRET_RESOLVER_BINARIES) {
-		const outcome = probe(binary, reference, capture);
+		const outcome = probe(binary, reference, capture, timeoutMs);
 		if (outcome.status === "resolved") return outcome;
 		if (failure === "resolver-missing") failure = outcome.status;
 	}
 	return { status: failure };
 };
-const defaultSecretReferenceResolver = (reference) => resolveThrough(reference, true);
 /**
-* Environment first (the #312 emit-time path), then the operator's configured
-* references. The first reference that fails ends the resolution: a second
-* probe would add nothing but another chance to hang.
+* The capturing resolver with its own probe ceiling. Production uses
+* `defaultSecretReferenceResolver`; a test passes a short ceiling to prove the
+* probe really ends there.
+*/
+const secretReferenceResolverWithin = (timeoutMs) => (reference) => resolveThrough(reference, true, timeoutMs);
+const defaultSecretReferenceResolver = secretReferenceResolverWithin(SECRET_PROBE_TIMEOUT_MS);
+/**
+* Environment first, then the operator's configured references. The first
+* reference that fails ends the resolution: a second probe would add nothing
+* but another chance to hang.
 */
 const resolveHqCredentials = ({ env, references, resolve = defaultSecretReferenceResolver }) => {
 	const clientId = env[CF_ACCESS_CLIENT_ID_ENV];
@@ -354,7 +374,7 @@ const hqIngestCredentialReferencesSchema = z.object({
 const factoryUserConfigSchema = z.object({
 	githubApp: githubAppConfigSchema.optional(),
 	hqAllowedOrigins: z.array(hqAllowedOriginSchema).describe("Operator-controlled exact HTTPS origins authorized to receive HQ credential-bearing requests; an absent or empty list authorizes none.").optional(),
-	hqIngestCredentials: hqIngestCredentialReferencesSchema.describe("Operator-controlled secret-manager references for the HQ ingest Cloudflare Access service token. References only — the factory never reads, prints, exports, or caches the values.").optional(),
+	hqIngestCredentials: hqIngestCredentialReferencesSchema.describe("Operator-controlled secret-manager references for the HQ ingest Cloudflare Access service token. References only: the factory resolves them in memory when it sends HQ evidence, and never prints, exports, or writes the values.").optional(),
 	schemaVersion: z.literal(FACTORY_USER_CONFIG_SCHEMA_VERSION)
 });
 function defaultUserConfigPath(env = process.env) {
@@ -368,14 +388,19 @@ function defaultUserConfigPath(env = process.env) {
 *
 * A request that carries the token goes only to an HTTPS origin with no
 * embedded credentials that the operator listed, exactly, in
-* `hqAllowedOrigins` in the operator user config. Committed repository data
-* and the environment can name an origin; only the operator can authorize one
-* (ADR 0015). HQ ingest and the Jev client both call this module, so the two
-* cannot drift apart: one protocol rule, one reader, one parser.
+* `hqAllowedOrigins` in the operator user config or in
+* `FACTORY_HQ_ALLOWED_ORIGINS` in the process environment. Those two lists
+* are unioned. Committed repository data can name an origin; it cannot
+* authorize one (ADR 0015). The environment variable is operator
+* configuration, read only from the process environment passed in, never
+* from the profile or any repository file. HQ ingest and the Jev client both
+* call this module, so the two cannot drift apart: one protocol rule, one
+* resolver.
 *
-* The reader is bounded. A config path that is a FIFO, a huge file, or a disk
-* that hangs answers "no origin is authorized" within the caller's deadline
-* instead of holding a gate or a lint run open.
+* The file reader is bounded. A config path that is a FIFO, a huge file, or a
+* disk that hangs contributes no config origin within the caller's deadline
+* instead of holding a gate or a lint run open. The environment list does not
+* touch the filesystem, so it still applies when the file does not answer.
 */
 /** Largest operator config or profile file the HQ readers will open. */
 const MAX_HQ_CONFIG_BYTES = 1024 * 1024;
@@ -447,20 +472,59 @@ const hqAllowedOriginsFromConfigText = (text) => {
 		return [];
 	}
 };
+/** Operator allowlist supplied to a machine that has no user config file. */
+const FACTORY_HQ_ALLOWED_ORIGINS_ENV = "FACTORY_HQ_ALLOWED_ORIGINS";
+/**
+* Exact HTTPS origins from `FACTORY_HQ_ALLOWED_ORIGINS` in `env`.
+* Comma-separated. A segment that is not an exact origin is ignored.
+* This reads that one property and nothing else: no file, no profile.
+*/
+const hqAllowedOriginsFromEnv = (env) => {
+	let raw;
+	try {
+		raw = env[FACTORY_HQ_ALLOWED_ORIGINS_ENV];
+	} catch {
+		return [];
+	}
+	if (typeof raw !== "string" || raw.trim() === "") return [];
+	const origins = [];
+	for (const segment of raw.split(",")) {
+		const candidate = segment.trim();
+		if (candidate === "") continue;
+		const endpoint = validatedHqOrigin(candidate);
+		if (endpoint !== void 0 && candidate === endpoint.origin) origins.push(endpoint.origin);
+	}
+	return origins;
+};
+/**
+* Operator-authorized HQ origins. `configOrigins` (the user config's
+* `hqAllowedOrigins`) is unioned with `FACTORY_HQ_ALLOWED_ORIGINS` from
+* `env`. The environment value never replaces the config list, and neither
+* list is read from the profile or any repository file.
+*/
+const resolveHqAllowedOrigins = (env, configOrigins) => {
+	const fromEnv = hqAllowedOriginsFromEnv(env);
+	if (fromEnv.length === 0) return [...configOrigins];
+	const allowed = [...configOrigins];
+	for (const origin of fromEnv) if (!allowed.includes(origin)) allowed.push(origin);
+	return allowed;
+};
 /**
 * The operator's `hqAllowedOrigins`, read from the operator user config within
-* `deadline` (a `performance.now()` time). A missing, unreadable, oversized or
-* invalid file, or one that does not answer in time, authorizes nothing.
+* `deadline` (a `performance.now()` time), unioned with
+* `FACTORY_HQ_ALLOWED_ORIGINS`. A missing, unreadable, oversized or invalid
+* file, or one that does not answer in time, contributes no config origin.
+* The environment list still applies.
 */
 const loadHqAllowedOrigins = async (env, deadline) => {
-	let configPath;
+	let configOrigins = [];
 	try {
-		configPath = defaultUserConfigPath(env);
+		const contents = await readBoundedTextFile(defaultUserConfigPath(env), deadline);
+		if (contents !== void 0) configOrigins = hqAllowedOriginsFromConfigText(contents);
 	} catch {
-		return [];
+		configOrigins = [];
 	}
-	const contents = await readBoundedTextFile(configPath, deadline);
-	return contents === void 0 ? [] : hqAllowedOriginsFromConfigText(contents);
+	return resolveHqAllowedOrigins(env, configOrigins);
 };
 /**
 * The matching rule: the URL's origin must equal one listed origin exactly.
@@ -481,8 +545,8 @@ const isHqOriginAuthorized = (allowedOrigins, endpoint) => allowedOrigins.includ
 * anything else happens, by the same code HQ ingest uses
 * (`hq-origin-policy.ts`, ADR 0015): it must be an `https:` origin with no
 * embedded credentials, listed exactly in the operator's `hqAllowedOrigins`.
-* Only then are credentials read: `resolveHqCredentials` reads the hyphenated
-* `CF-Access-Client-Id` / `CF-Access-Client-Secret` pair, and
+* Only then are credentials read: `resolveHqCredentials` reads the
+* `CF_ACCESS_CLIENT_ID` / `CF_ACCESS_CLIENT_SECRET` pair, and
 * `buildCloudflareAccessRequestInit` attaches them to a request that refuses
 * redirects so the credentials cannot leave the authorized origin.
 *
@@ -647,11 +711,8 @@ const exchange = async (input) => {
 		throw new JevRequestError(0, "exchange_failed", "The HQ Jev exchange failed before a response could be read. No upstream text is reported: it can quote the request.");
 	}
 };
-/**
-* The whole remedy, in one sentence. The variable names are literally
-* hyphenated, so a plain `export` does not set them.
-*/
-const MISSING_CREDENTIALS_REASON = `no HQ credentials: ${CF_ACCESS_CLIENT_ID_ENV} and ${CF_ACCESS_CLIENT_SECRET_ENV} are not both in the environment. The names are literally hyphenated, so a plain \`export\` does not set them — prefix the command: \`env '${CF_ACCESS_CLIENT_ID_ENV}=…' '${CF_ACCESS_CLIENT_SECRET_ENV}=…' <the command> …\`.`;
+/** The whole remedy, in one sentence. */
+const MISSING_CREDENTIALS_REASON = `no HQ credentials: ${CF_ACCESS_CLIENT_ID_ENV} and ${CF_ACCESS_CLIENT_SECRET_ENV} are not both in the environment. Set both, or prefix the command: \`env '${CF_ACCESS_CLIENT_ID_ENV}=…' '${CF_ACCESS_CLIENT_SECRET_ENV}=…' <the command> …\`.`;
 /** Where the operator config was looked for, for a message that names it. */
 const operatorConfigLocation = (env) => {
 	try {

package/dist/oxlint-jev/index.js

@@ -1,4 +1,4 @@
-import { i as buildJevRequests, l as noul, n as spawnJevBridge, o as defaultJevCacheDirectory } from "./bridge-B4Sx95ZO.js";
+import { i as buildJevRequests, l as noul, n as spawnJevBridge, o as defaultJevCacheDirectory } from "./bridge-PMzq2gZh.js";
 import path from "node:path";
 import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";

package/dist/oxlint-jev/worker.js

@@ -1,4 +1,4 @@
-import { a as resolveJevGateway, r as runJevFiles, s as openJevCache, t as allUnavailable } from "./bridge-B4Sx95ZO.js";
+import { a as resolveJevGateway, r as runJevFiles, s as openJevCache, t as allUnavailable } from "./bridge-PMzq2gZh.js";
 import { readFileSync } from "node:fs";
 //#region src/oxlint-jev/worker.ts
 /**

package/dist/schemas.d.ts

@@ -1000,8 +1000,8 @@ declare const closeoutArtifactSchema: z.ZodObject<{
     }, z.core.$strict>;
     unit: z.ZodEnum<{
       boolean: "boolean";
-      count: "count";
       text: "text";
+      count: "count";
       tokens: "tokens";
       usd: "usd";
     }>;
@@ -1012,6 +1012,28 @@ declare const closeoutArtifactSchema: z.ZodObject<{
 }, z.core.$strict>;
 type CloseoutArtifact = z.infer<typeof closeoutArtifactSchema>;
 //#endregion
+//#region src/gate-timing-record.d.ts
+declare const gateTimingRecordSchema: z.ZodObject<{
+  agentRunId: z.ZodString;
+  cycle: z.ZodNumber;
+  durationMs: z.ZodNumber;
+  gate: z.ZodEnum<{
+    "boundary:check": "boundary:check";
+    "factory:closeout": "factory:closeout";
+    "pr:ready": "pr:ready";
+    "pr:review": "pr:review";
+    "pr:verify": "pr:verify";
+  }>;
+  outcome: z.ZodEnum<{
+    pass: "pass";
+    fail: "fail";
+  }>;
+  schemaVersion: z.ZodLiteral<1>;
+  startOffsetMs: z.ZodNumber;
+  startedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+type GateTimingRecord = z.infer<typeof gateTimingRecordSchema>;
+//#endregion
 //#region src/schemas.d.ts
 declare const EVIDENCE_ENVELOPE_SCHEMA_VERSION = 1;
 declare const evidenceEnvelopeSchema: z.ZodObject<{
@@ -1408,4 +1430,4 @@ declare const prReadyProofSchema: z.ZodObject<{
   waivedDemands: z.ZodOptional<z.ZodArray<z.ZodType<WaivedDemand, unknown, z.core.$ZodTypeInternals<WaivedDemand, unknown>>>>;
 }, z.core.$strip>;
 //#endregion
-export { BLOCKED_REASONS_MAX, BLOCKED_REASON_DETAIL_MAX, BOUNDARY_CHECK_SCHEMA_VERSION, BOUNDARY_REVIEW_PROOF_KIND, type BlockedReason, BoundaryCheckProofRecord, type BoundaryReviewProof, type CloseoutArtifact, EVIDENCE_ENVELOPE_SCHEMA_VERSION, type EvidenceEnvelope, PR_READY_SCHEMA_VERSION, PR_REVIEW_SCHEMA_VERSION, type PrReadyProof, type PrReviewProof, type PrVerifyProof, type ReviewPromptSection, type ReviewPromptSectionProvenance, SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS, SUPPORTED_PR_READY_SCHEMA_VERSIONS, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, type WaivedDemand, blockedReasonSchema, blockedReasonsSchema, boundaryCheckProofSchema, boundaryReviewProofSchema, closeoutArtifactSchema, evidenceEnvelopeSchema, prReadyProofSchema, prReviewFindingSchema, prReviewProofSchema, prReviewResultSchema, prVerifyProofSchema, reviewPromptSectionSchema, reviewPromptSectionsSchema, waivedDemandSchema };
+export { BLOCKED_REASONS_MAX, BLOCKED_REASON_DETAIL_MAX, BOUNDARY_CHECK_SCHEMA_VERSION, BOUNDARY_REVIEW_PROOF_KIND, type BlockedReason, BoundaryCheckProofRecord, type BoundaryReviewProof, type CloseoutArtifact, EVIDENCE_ENVELOPE_SCHEMA_VERSION, type EvidenceEnvelope, type GateTimingRecord, PR_READY_SCHEMA_VERSION, PR_REVIEW_SCHEMA_VERSION, type PrReadyProof, type PrReviewProof, type PrVerifyProof, type ReviewPromptSection, type ReviewPromptSectionProvenance, SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS, SUPPORTED_PR_READY_SCHEMA_VERSIONS, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, type WaivedDemand, blockedReasonSchema, blockedReasonsSchema, boundaryCheckProofSchema, boundaryReviewProofSchema, closeoutArtifactSchema, evidenceEnvelopeSchema, gateTimingRecordSchema, prReadyProofSchema, prReviewFindingSchema, prReviewProofSchema, prReviewResultSchema, prVerifyProofSchema, reviewPromptSectionSchema, reviewPromptSectionsSchema, waivedDemandSchema };

package/dist/schemas.js

@@ -1284,6 +1284,31 @@ const closeoutArtifactSchema = z.object({
 	repo: RepoSchema,
 	schemaVersion: z.literal(5)
 }).strict();
+/** The self-timed gate commands. */
+const FACTORY_GATE_NAMES = [
+	"boundary:check",
+	"factory:closeout",
+	"pr:ready",
+	"pr:review",
+	"pr:verify"
+];
+const nonNegativeInteger = z.number().int().nonnegative();
+const gateTimingRecordSchema = z.object({
+	/** The lane run identity the ledger is keyed by. */
+	agentRunId: z.string().min(1),
+	cycle: z.number().int().positive(),
+	durationMs: nonNegativeInteger,
+	gate: z.enum(FACTORY_GATE_NAMES),
+	outcome: z.enum(["fail", "pass"]),
+	schemaVersion: z.literal(1),
+	/**
+	* Milliseconds from the lane run's origin (the first record's start) to
+	* this record's start. The first record is offset 0.
+	*/
+	startOffsetMs: nonNegativeInteger,
+	/** Wall-clock start of this gate invocation (ISO 8601). */
+	startedAt: z.iso.datetime()
+}).strict();
 //#endregion
 //#region src/schemas.ts
 const evidenceCheckTypeSchema = z.enum(EVIDENCE_CHECK_TYPES);
@@ -1626,4 +1651,4 @@ const prReadyProofSchema = z.object({
 	for (const issue of blockedReasonIssues({ ...proof })) context.addIssue(issue);
 });
 //#endregion
-export { BLOCKED_REASONS_MAX, BLOCKED_REASON_DETAIL_MAX, BOUNDARY_CHECK_SCHEMA_VERSION, BOUNDARY_REVIEW_PROOF_KIND, EVIDENCE_ENVELOPE_SCHEMA_VERSION, PR_READY_SCHEMA_VERSION, PR_REVIEW_SCHEMA_VERSION, SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS, SUPPORTED_PR_READY_SCHEMA_VERSIONS, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, blockedReasonSchema, blockedReasonsSchema, boundaryCheckProofSchema, boundaryReviewProofSchema, closeoutArtifactSchema, evidenceEnvelopeSchema, prReadyProofSchema, prReviewFindingSchema, prReviewProofSchema, prReviewResultSchema, prVerifyProofSchema, reviewPromptSectionSchema, reviewPromptSectionsSchema, waivedDemandSchema };
+export { BLOCKED_REASONS_MAX, BLOCKED_REASON_DETAIL_MAX, BOUNDARY_CHECK_SCHEMA_VERSION, BOUNDARY_REVIEW_PROOF_KIND, EVIDENCE_ENVELOPE_SCHEMA_VERSION, PR_READY_SCHEMA_VERSION, PR_REVIEW_SCHEMA_VERSION, SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS, SUPPORTED_PR_READY_SCHEMA_VERSIONS, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, blockedReasonSchema, blockedReasonsSchema, boundaryCheckProofSchema, boundaryReviewProofSchema, closeoutArtifactSchema, evidenceEnvelopeSchema, gateTimingRecordSchema, prReadyProofSchema, prReviewFindingSchema, prReviewProofSchema, prReviewResultSchema, prVerifyProofSchema, reviewPromptSectionSchema, reviewPromptSectionsSchema, waivedDemandSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.37",
+  "version": "1.0.0-alpha.39",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -42,7 +42,7 @@
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
     "zod": "4.4.3",
-    "@patronage/factory-ci": "1.0.0-alpha.37"
+    "@patronage/factory-ci": "1.0.0-alpha.39"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.76.0",