code-foundry 1.52.4 → 1.53.1

package/.github/workflows/cloudflare-deploy.yml

@@ -289,16 +289,9 @@ jobs:
           if (!buildEnv || typeof buildEnv !== 'object' || Array.isArray(buildEnv)) {
             throw new Error('build-env must be a JSON object of string values')
           }
-          const allowedNames = new Set([
-            'ADEA_PREVIEW_HYPERDRIVE_ID',
-            'ADEA_PREVIEW_SECRETS_STORE_ID',
-            'ADEA_PREVIEW_DATABASE_URL_SECRET',
-            'ADEA_PREVIEW_AUTH_BASE_URL_SECRET',
-            'ADEA_PREVIEW_AUTH_COOKIE_SECRET_NAME',
-            'ADEA_PREVIEW_AUTH_TRUSTED_ORIGINS_SECRET',
-          ])
+          const allowedName = /^ADEA_PREVIEW_(?:HYPERDRIVE_ID|SECRETS_STORE_ID|DATABASE_URL_SECRET|AUTH_(?:BASE_URL_SECRET|COOKIE_SECRET_NAME|HYPERDRIVE_ID|TRUSTED_ORIGINS_SECRET))(?![\s\S])/
           for (const [name, value] of Object.entries(buildEnv)) {
-            if (!allowedNames.has(name)) {
+            if (!allowedName.test(name)) {
               throw new Error(`Invalid build-env variable name: ${name}`)
             }
             if (typeof value !== 'string') throw new Error(`build-env value for ${name} must be a string`)

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.53.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.0...v1.53.1) (2026-10-30)
+
+
+### Bug Fixes
+
+* allow isolated preview auth Hyperdrive build binding ([#813](https://github.com/0xPlayerOne/code-foundry/issues/813)) ([cc267fc](https://github.com/0xPlayerOne/code-foundry/commit/cc267fcb84c2828fb5c7090e0b494991ea90f249))
+
+## [1.53.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.52.4...v1.53.0) (2026-10-30)
+
+
+### Features
+
+* document Adea UI workspace receipt reuse ([#811](https://github.com/0xPlayerOne/code-foundry/issues/811)) ([6d0322c](https://github.com/0xPlayerOne/code-foundry/commit/6d0322c619f82753ca1818523a7cb7fb6583934e))
+
 ## [1.52.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.52.3...v1.52.4) (2026-10-30)
 
 
@@ -131,23 +145,9 @@
 
 * **ci:** serialize billing receipt and report uploads ([#773](https://github.com/0xPlayerOne/code-foundry/issues/773)) ([6497225](https://github.com/0xPlayerOne/code-foundry/commit/6497225bf2d672380b6b5231378b424dffb8afbb))
 
-## [1.48.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.3...v1.48.4) (2026-10-22)
-
-
-### Maintenance
-
-* bun-1.4.4-cloud ([#771](https://github.com/0xPlayerOne/code-foundry/issues/771)) ([c99f0ed](https://github.com/0xPlayerOne/code-foundry/commit/c99f0ed8b66129f3b599326bc67d900719b921f4))
-
-## [1.48.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.2...v1.48.3) (2026-10-17)
-
-
-### Tests
-
-* read the chained hook fixture with fs.readFileSync ([#769](https://github.com/0xPlayerOne/code-foundry/issues/769)) ([5d5925a](https://github.com/0xPlayerOne/code-foundry/commit/5d5925ac38975f5b1cc9b0785aa492db029e420c))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 270 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 272 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/RELEASES.md

@@ -40,6 +40,10 @@ publication](qualified-publication.md).
 For an explicit version, put `Release-As: 2.0.0` in a commit or pull request
 body. Existing `CHANGELOG.md` history remains repository-owned.
 
+### Adea UI receipts
+
+Only `packages/ui` may opt in; others use full validation. Packed Node 24/26 checks remain.
+
 ## Configuration
 
 Set these values in `.github/code-foundry.yml`:

package/docs/WORKFLOWS.md

@@ -65,16 +65,16 @@ with the same validation workflow, Code Foundry runtime, CodeQL policy, and
 pull-request/run identity. Verification checks the merged source PR, the
 aggregate gate's success in the exact run attempt, the required component
 results, and the artifact's bounded download size and SHA-256 digest. The release-diff preflight must confirm a
-version-only patch. Reuse is currently supported only for a public npm package
-released from the repository root; private roots, workspaces, and unknown
-Release Please layouts use the full CI and test fallback. A root package may
-use `prepublishOnly` only when it exactly invokes the configured package
-manager's `run build` task; other lifecycle hooks and custom prepublish commands
-use the full fallback. With a verified
-receipt, the applicable build is forced even when path filtering would skip it,
-and the versioned root npm package inspection still runs. Only duplicate
-format, lint, type-check, and unit-test work is skipped. The receipt never
-replaces the release-diff audit or configured CodeQL scan.
+version-only patch. Receipts support public root npm packages, plus the
+repository-specific `adea-ui-workspace-v1` contract for `@adea-ai/ui` at
+`packages/ui`. That contract checks linked versions, Release Please's exact
+extra-file mapping, and the single Bun lock workspace-version change; it admits
+no other private root or workspace. Unsupported layouts, lifecycle hooks, and
+release diffs use full CI and test fallback. UI's tag publisher still builds,
+qualifies, and publishes the exact archive through packed-consumer gates; a
+source receipt does not qualify archive bytes. Only duplicate format, lint,
+type-check, and unit-test work is skipped, and release-diff plus CodeQL checks
+remain required.
 The managed branch rulesets require only the aggregate `Validation / Gate`
 check; do not hand-require individual job contexts on release branches.
 In the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.52.4",
+  "version": "1.53.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {