code-foundry 1.53.0 → 1.53.2

package/.github/workflows/cloudflare-deploy.yml

@@ -289,16 +289,9 @@ jobs:
           if (!buildEnv || typeof buildEnv !== 'object' || Array.isArray(buildEnv)) {
             throw new Error('build-env must be a JSON object of string values')
           }
-          const allowedNames = new Set([
-            'ADEA_PREVIEW_HYPERDRIVE_ID',
-            'ADEA_PREVIEW_SECRETS_STORE_ID',
-            'ADEA_PREVIEW_DATABASE_URL_SECRET',
-            'ADEA_PREVIEW_AUTH_BASE_URL_SECRET',
-            'ADEA_PREVIEW_AUTH_COOKIE_SECRET_NAME',
-            'ADEA_PREVIEW_AUTH_TRUSTED_ORIGINS_SECRET',
-          ])
+          const allowedName = /^ADEA_PREVIEW_(?:HYPERDRIVE_ID|SECRETS_STORE_ID|DATABASE_URL_SECRET|AUTH_(?:BASE_URL_SECRET|COOKIE_SECRET_NAME|HYPERDRIVE_ID|TRUSTED_ORIGINS_SECRET))(?![\s\S])/
           for (const [name, value] of Object.entries(buildEnv)) {
-            if (!allowedNames.has(name)) {
+            if (!allowedName.test(name)) {
               throw new Error(`Invalid build-env variable name: ${name}`)
             }
             if (typeof value !== 'string') throw new Error(`build-env value for ${name} must be a string`)

package/.github/workflows/release_self-ci.yml

@@ -10,6 +10,11 @@ on:
         required: false
         type: boolean
         default: false
+      recover-npm-tag:
+        description: Requalify and publish the exact archive for a current immutable release missing from npm.
+        required: false
+        type: string
+        default: ''
 
 permissions:
   contents: read
@@ -28,7 +33,7 @@ jobs:
     # content they merge was already audited on its pull request, and the
     # release merge re-qualifies the exact tree it publishes.
     needs: [release, recovery]
-    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && !(github.event_name == 'workflow_dispatch' && inputs['recover-npm-tag'] != '') && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
     uses: ./.github/workflows/consumer-qualification.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
@@ -38,7 +43,7 @@ jobs:
 
   preflight:
     name: Verify release prerequisites
-    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && !(github.event_name == 'workflow_dispatch' && inputs['recover-npm-tag'] != '')
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
@@ -76,7 +81,7 @@ jobs:
     # it. Version pull requests keep flowing even when the candidate is broken;
     # publication stays gated on qualification success in the stage job.
     needs: [preflight]
-    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && !(github.event_name == 'workflow_dispatch' && inputs['recover-npm-tag'] != '')
     uses: ./.github/workflows/release.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
@@ -97,7 +102,7 @@ jobs:
   recovery:
     name: Recover qualified draft identity
     needs: [release]
-    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && needs.release.result == 'success'
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && !(github.event_name == 'workflow_dispatch' && inputs['recover-npm-tag'] != '') && needs.release.result == 'success'
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
@@ -170,7 +175,7 @@ jobs:
     # Qualification only runs when this push created a release or recovery
     # found a stuck one; staging additionally requires its success so an
     # unqualified tree can never reach publication.
-    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && needs.qualification.result == 'success' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && !(github.event_name == 'workflow_dispatch' && inputs['recover-npm-tag'] != '') && needs.qualification.result == 'success' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
@@ -244,7 +249,7 @@ jobs:
   publish:
     name: Publish verified package
     needs: [qualification, release, recovery, stage]
-    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && needs.stage.result == 'success' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && !(github.event_name == 'workflow_dispatch' && inputs['recover-npm-tag'] != '') && needs.stage.result == 'success' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
     uses: ./.github/workflows/qualified-foundry-publish.yml
     permissions:
       actions: read
@@ -255,3 +260,52 @@ jobs:
       tag: ${{ needs.release.outputs.tag_name || needs.recovery.outputs.tag }}
       asset: ${{ needs.qualification.outputs.filename }}
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
+
+  npm_recovery_target:
+    name: Verify npm recovery target
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs['recover-npm-tag'] != '' && vars.CI_BILLING_PAUSED != 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      tag: ${{ steps.target.outputs.tag }}
+      asset: ${{ steps.target.outputs.asset }}
+      source-sha: ${{ steps.target.outputs.source-sha }}
+    steps:
+      - name: Checkout trusted recovery verifier
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Require exact immutable release and absent npm version
+        id: target
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs['recover-npm-tag'] }}
+          CURRENT_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          node src/commands/release-recovery.mjs verify-target \
+            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$CURRENT_SHA" "$GITHUB_OUTPUT"
+
+  npm_recovery_publish:
+    name: Requalify and publish recovered archive
+    needs: npm_recovery_target
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && needs.npm_recovery_target.result == 'success' && vars.CI_BILLING_PAUSED != 'true'
+    uses: ./.github/workflows/qualified-foundry-publish.yml
+    permissions:
+      actions: read
+      attestations: read
+      contents: read
+      id-token: write
+    with:
+      tag: ${{ needs.npm_recovery_target.outputs.tag }}
+      asset: ${{ needs.npm_recovery_target.outputs.asset }}
+      source-sha: ${{ needs.npm_recovery_target.outputs['source-sha'] }}
+      billing-pause-bypass: false

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.53.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.1...v1.53.2) (2026-10-30)
+
+
+### Bug Fixes
+
+* support reviewed Playwright 1.64.1 UI receipts ([#817](https://github.com/0xPlayerOne/code-foundry/issues/817)) ([814bf68](https://github.com/0xPlayerOne/code-foundry/commit/814bf68818dcf2a80253e133895cbe3e539b5b7f))
+
+
+### Maintenance
+
+* add verified npm publication recovery ([#815](https://github.com/0xPlayerOne/code-foundry/issues/815)) ([5876361](https://github.com/0xPlayerOne/code-foundry/commit/58763616b3dc38d127680914eeef6151b3375b37))
+
+## [1.53.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.0...v1.53.1) (2026-10-30)
+
+
+### Bug Fixes
+
+* allow isolated preview auth Hyperdrive build binding ([#813](https://github.com/0xPlayerOne/code-foundry/issues/813)) ([cc267fc](https://github.com/0xPlayerOne/code-foundry/commit/cc267fcb84c2828fb5c7090e0b494991ea90f249))
+
 ## [1.53.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.52.4...v1.53.0) (2026-10-30)
 
 
@@ -131,23 +150,9 @@
 
 * **release:** audit generated release content for stale snapshots ([#775](https://github.com/0xPlayerOne/code-foundry/issues/775)) ([f842c27](https://github.com/0xPlayerOne/code-foundry/commit/f842c271e6b270b63a6d9b839795a849237c7a7d))
 
-## [1.48.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.4...v1.48.5) (2026-10-22)
-
-
-### Bug Fixes
-
-* **ci:** serialize billing receipt and report uploads ([#773](https://github.com/0xPlayerOne/code-foundry/issues/773)) ([6497225](https://github.com/0xPlayerOne/code-foundry/commit/6497225bf2d672380b6b5231378b424dffb8afbb))
-
-## [1.48.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.3...v1.48.4) (2026-10-22)
-
-
-### Maintenance
-
-* bun-1.4.4-cloud ([#771](https://github.com/0xPlayerOne/code-foundry/issues/771)) ([c99f0ed](https://github.com/0xPlayerOne/code-foundry/commit/c99f0ed8b66129f3b599326bc67d900719b921f4))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 271 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 273 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/qualified-publication.md

@@ -35,13 +35,11 @@ actual caller workflow filename, `release_self-ci.yml`, in repository
 environment. Both the caller and reusable publisher grant `id-token: write`.
 For generated consumer workflows, the caller filename is `release.yml` and the
 auth mode remains configurable with `npm_publish_auth`.
-Existing version publication is not overwritten: retrying an already-published
-version fails rather than treating a registry conflict or network error as proof
-of identity.
+To recover a GitHub release missing from npm, the self-only dispatch requires the
+current stable tag, immutable release, exact archive, npm 404, fresh Node 24/26
+qualification, and OIDC publication. Existing npm versions are never overwritten.
 
-The publisher never rebuilds the package, publishes a directory, or treats an
-already-published version conflict as proof of success. It never accepts or
-forwards `NPM_TOKEN`.
+The publisher never rebuilds a package or accepts `NPM_TOKEN`.
 
 Qualification and publication are gated on `main` push or an explicitly
 requested `workflow_dispatch`. The shared billing pause blocks normal runs. A
@@ -123,6 +121,11 @@ state still match the qualified candidate. An already-published release is never
 restaged or overwritten. Inspect the retained staging and publication identity
 receipts when recovery is needed.
 
+To recover a published GitHub release that is missing from npm, dispatch the
+self-only `release_self-ci.yml` workflow on `main` with `recover-npm-tag`. It
+requires the current stable tag, immutable release, exact archive, and exact npm
+404, then requalifies that archive on Node 24/26 before OIDC publication.
+
 ## Publication prerequisites
 
 Enable immutable releases and verify the setting with the actual

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.53.0",
+  "version": "1.53.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {
@@ -17,11 +17,13 @@
   "files": [
     "src",
     "!src/commands/qualification-receipt.mjs",
+    "!src/commands/release-recovery.mjs",
     "!src/lib/qualification-receipt.mjs",
     "!src/lib/release-package-contract.mjs",
     "docs",
     ".github",
     "!.github/actions/**",
+    "!.github/workflows/qualified-foundry-publish.yml",
     ".githooks",
     ".editorconfig",
     ".gitattributes",

package/src/commands/sync.mjs

@@ -1247,19 +1247,28 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
     // recovery, staging, and qualified publication. Consumer callers must
     // retain the ordinary reusable Release Please path instead of inheriting
     // self-only jobs whose outputs and environments do not exist for them.
-    for (const job of ['qualification', 'preflight', 'recovery', 'stage', 'publish'])
+    for (const job of [
+      'qualification',
+      'preflight',
+      'recovery',
+      'stage',
+      'publish',
+      'npm_recovery_target',
+      'npm_recovery_publish',
+    ])
       rendered = removeWorkflowBlock(rendered, job)
+    rendered = removeWorkflowBlock(rendered, 'recover-npm-tag', '      ')
     rendered = rendered.replace(/^    needs: \[preflight\]\n/m, '')
     rendered = rendered.replace(/^      config-file: \.github\/release-please-foundry\.json\n/m, '')
     if (config.release_defer_publication !== 'true') {
       rendered = rendered.replace(/^      defer-publication: true\n/m, '')
     }
     rendered = rendered.replace(
-      /^    if: github\.ref == 'refs\/heads\/main' && \(vars\.CI_BILLING_PAUSED != 'true' \|\| \(github\.event_name == 'workflow_dispatch' && inputs\['release-while-paused'\] == true\)\)\n/m,
+      /^    if: github\.ref == 'refs\/heads\/main' && \(vars\.CI_BILLING_PAUSED != 'true' \|\| \(github\.event_name == 'workflow_dispatch' && inputs\['release-while-paused'\] == true\)\) && !\(github\.event_name == 'workflow_dispatch' && inputs\['recover-npm-tag'\] != ''\)\n/m,
       "    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)\n"
     )
     rendered = rendered.replace(
-      /^    if: github\.ref == 'refs\/heads\/main' && \(vars\.CI_BILLING_PAUSED != 'true' \|\| \(github\.event_name == 'workflow_dispatch' && inputs\['release-while-paused'\] == true\)\)\n/m,
+      /^    if: github\.ref == 'refs\/heads\/main' && \(vars\.CI_BILLING_PAUSED != 'true' \|\| \(github\.event_name == 'workflow_dispatch' && inputs\['release-while-paused'\] == true\)\) && !\(github\.event_name == 'workflow_dispatch' && inputs\['recover-npm-tag'\] != ''\)\n/m,
       "    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)\n"
     )
     // Gate ordinary pushes while allowing the release squash and manual hotfixes.
@@ -1386,19 +1395,25 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
 }
 
 /**
- * Remove a root-level YAML block by id while preserving the surrounding file.
- * This is used for workflow jobs and triggers whose feature is disabled by
- * configuration.
+ * Remove an indented YAML mapping block by id while preserving the surrounding
+ * file. This is used for workflow jobs, inputs, and triggers whose feature is
+ * disabled by configuration.
  * @param {string} content
  * @param {string} blockId
+ * @param {string} [indentation]
  * @returns {string}
  */
-function removeWorkflowBlock(content, blockId) {
+function removeWorkflowBlock(content, blockId, indentation = '  ') {
   const lines = content.split('\n')
-  const start = lines.findIndex((line) => line === `  ${blockId}:`)
+  const start = lines.findIndex((line) => line === `${indentation}${blockId}:`)
   if (start === -1) return content
   let end = start + 1
-  while (end < lines.length && !/^  [A-Za-z0-9_-]+:\s*$/.test(lines[end])) end += 1
+  while (end < lines.length) {
+    const line = lines[end]
+    const level = line.match(/^ */)?.[0].length ?? 0
+    if (line.trim() && level <= indentation.length) break
+    end += 1
+  }
   lines.splice(start, end - start)
   if (content.endsWith('\n') && lines.at(-1) !== '') lines.push('')
   return lines.join('\n')

package/.github/workflows/qualified-foundry-publish.yml

@@ -1,130 +0,0 @@
-name: Qualified Foundry Publication
-
-on:
-  workflow_call:
-    inputs:
-      tag:
-        description: Published immutable release tag at the caller commit.
-        required: true
-        type: string
-      asset:
-        description: Exact pre-attached Code Foundry npm tarball name.
-        required: true
-        type: string
-      billing-pause-bypass:
-        description: Allow only an explicitly dispatched release while shared CI remains paused.
-        required: false
-        type: boolean
-        default: false
-
-permissions:
-  attestations: read
-  contents: read
-
-jobs:
-  qualify:
-    name: Qualify Node ${{ matrix.node }}
-    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['billing-pause-bypass'] == true)) && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        node: ['24', '26']
-    steps:
-      - name: Checkout trusted qualification runtime
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          ref: ${{ github.sha }}
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: ${{ matrix.node }}
-      - name: Install pinned Actionlint
-        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
-      - name: Download and cryptographically verify the release archive
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ inputs.tag }}
-          RELEASE_ASSET: ${{ inputs.asset }}
-        run: |
-          set -euo pipefail
-          node src/commands/qualified-publication.mjs download \
-            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$GITHUB_SHA" "$RELEASE_ASSET" \
-            "$RUNNER_TEMP/candidate" > "$RUNNER_TEMP/download.json"
-      - name: Qualify those exact bytes
-        env:
-          RELEASE_ASSET: ${{ inputs.asset }}
-        run: |
-          set -euo pipefail
-          node src/lib/consumer-qualification.mjs \
-            "$RUNNER_TEMP/candidate/$RELEASE_ASSET" "$GITHUB_SHA" \
-            "$RUNNER_TEMP/report.json" "$(go env GOPATH)/bin/actionlint"
-      - name: Retain this attempt's qualification report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: qualified-${{ github.run_attempt }}-node-${{ matrix.node }}
-          path: ${{ runner.temp }}/report.json
-          if-no-files-found: error
-          retention-days: 14
-
-  publish:
-    name: Publish qualified archive
-    needs: qualify
-    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['billing-pause-bypass'] == true)) && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    concurrency:
-      group: qualified-foundry-npm-${{ github.repository }}-${{ inputs.tag }}
-      cancel-in-progress: false
-    permissions:
-      actions: read
-      attestations: read
-      contents: read
-      id-token: write
-    env:
-      RELEASE_TAG: ${{ inputs.tag }}
-      RELEASE_ASSET: ${{ inputs.asset }}
-    steps:
-      - name: Checkout trusted publication runtime
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          ref: ${{ github.sha }}
-      - name: Setup Node for trusted publishing
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '24'
-      - name: Retrieve only this run attempt's evidence
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          for node in 24 26; do
-            gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
-              --name "qualified-$GITHUB_RUN_ATTEMPT-node-$node" \
-              --dir "$RUNNER_TEMP/reports/$node"
-          done
-          node src/commands/qualified-publication.mjs download \
-            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$GITHUB_SHA" "$RELEASE_ASSET" \
-            "$RUNNER_TEMP/candidate" > "$RUNNER_TEMP/download.json"
-      - name: Reverify and publish the tested tarball without lifecycle hooks
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          node src/commands/qualified-publication.mjs publish \
-            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$GITHUB_SHA" "$RELEASE_ASSET" \
-            "$RUNNER_TEMP/candidate" \
-            "$RUNNER_TEMP/reports/24/report.json" \
-            "$RUNNER_TEMP/reports/26/report.json" > "$RUNNER_TEMP/publication.json"
-      - name: Retain publication identity
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: qualified-publication-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/publication.json
-          if-no-files-found: warn
-          retention-days: 14