@magoz/provision 0.0.0-stage → 0.1.0

package/dist/factory/providers/cloudflare.js

@@ -0,0 +1,126 @@
+import { createHash } from 'node:crypto';
+import { Effect, Option, Redacted, Schema } from 'effect';
+import { ProviderError, requestJson, requestJsonRequired } from '../http.js';
+const API_ROOT = 'https://api.cloudflare.com/client/v4';
+const headers = (token) => ({
+    Authorization: `Bearer ${Redacted.value(token)}`
+});
+const envelope = (result) => Schema.Struct({ success: Schema.Literal(true), result });
+const account = (admin) => `${API_ROOT}/accounts/${encodeURIComponent(admin.accountId)}`;
+export const r2Endpoint = (accountId) => `https://${accountId}.r2.cloudflarestorage.com`;
+// ---------------------------------------------------------------------------
+// buckets
+// ---------------------------------------------------------------------------
+export const bucketExists = (admin, name) => requestJson('R2 bucket lookup', `${account(admin)}/r2/buckets/${encodeURIComponent(name)}`, envelope(Schema.Struct({ name: Schema.String })), { headers: headers(admin.apiToken), allowNotFound: true }).pipe(Effect.map(Option.isSome));
+export const createBucket = (admin, name) => requestJsonRequired('R2 bucket creation', `${account(admin)}/r2/buckets`, envelope(Schema.Struct({ name: Schema.String })), { method: 'POST', headers: headers(admin.apiToken), body: { name } }).pipe(Effect.asVoid);
+/** Browser uploads use presigned PUTs; CORS allows exactly that. */
+const corsRules = (origin) => [
+    {
+        id: 'browser-uploads',
+        allowed: { methods: ['PUT'], origins: [origin], headers: ['content-type'] },
+        exposeHeaders: ['etag'],
+        maxAgeSeconds: 3600
+    }
+];
+const CorsRule = Schema.Struct({
+    allowed: Schema.Struct({
+        methods: Schema.Array(Schema.String),
+        origins: Schema.Array(Schema.String),
+        headers: Schema.optionalKey(Schema.Array(Schema.String))
+    }),
+    exposeHeaders: Schema.optionalKey(Schema.Array(Schema.String)),
+    maxAgeSeconds: Schema.optionalKey(Schema.Number)
+});
+const normalize = (values) => [...new Set(values.map(value => value.toLowerCase()))].toSorted().join('\n');
+const sameSet = (left = [], right = []) => normalize(left) === normalize(right);
+/**
+ * Whether `rules` grant exactly the upload policy for `origin`. Compares values, not JSON text:
+ * the API may reorder fields, drop the rule id, or change header case.
+ */
+export const corsRulesMatch = (rules, origin) => {
+    const [actual, ...rest] = rules;
+    const [expected] = corsRules(origin);
+    return (actual !== undefined &&
+        expected !== undefined &&
+        rest.length === 0 &&
+        sameSet(actual.allowed.methods, expected.allowed.methods) &&
+        sameSet(actual.allowed.origins, expected.allowed.origins) &&
+        sameSet(actual.allowed.headers, expected.allowed.headers) &&
+        sameSet(actual.exposeHeaders, expected.exposeHeaders) &&
+        actual.maxAgeSeconds === expected.maxAgeSeconds);
+};
+/** Whether the bucket already has exactly the upload CORS policy for `origin`. */
+export const bucketCorsMatches = (admin, name, origin) => requestJson('R2 CORS lookup', `${account(admin)}/r2/buckets/${encodeURIComponent(name)}/cors`, envelope(Schema.Struct({ rules: Schema.Array(CorsRule) })), { headers: headers(admin.apiToken), allowNotFound: true }).pipe(Effect.map(Option.match({
+    onNone: () => false,
+    onSome: response => corsRulesMatch(response.result.rules, origin)
+})));
+export const putBucketCors = (admin, name, origin) => requestJsonRequired('R2 CORS update', `${account(admin)}/r2/buckets/${encodeURIComponent(name)}/cors`, Schema.Struct({ success: Schema.Literal(true) }), {
+    method: 'PUT',
+    headers: headers(admin.apiToken),
+    body: { rules: corsRules(origin) }
+}).pipe(Effect.asVoid);
+// ---------------------------------------------------------------------------
+// bucket-scoped account tokens
+// ---------------------------------------------------------------------------
+const permissionGroupNames = [
+    'Workers R2 Storage Bucket Item Read',
+    'Workers R2 Storage Bucket Item Write'
+];
+const bucketResource = (accountId, bucket) => `com.cloudflare.edge.r2.bucket.${accountId}_default_${bucket}`;
+const Token = Schema.Struct({ id: Schema.String, name: Schema.String });
+export const findToken = (admin, name) => Effect.gen(function* () {
+    const tokens = [];
+    let page = 1;
+    let totalPages = 1;
+    do {
+        const response = yield* requestJsonRequired('Cloudflare token listing', `${account(admin)}/tokens?page=${page}&per_page=100`, Schema.Struct({
+            success: Schema.Literal(true),
+            result: Schema.Array(Token),
+            result_info: Schema.Struct({ total_pages: Schema.Number })
+        }), { headers: headers(admin.apiToken) });
+        tokens.push(...response.result);
+        totalPages = response.result_info.total_pages;
+        page += 1;
+    } while (page <= totalPages);
+    const matches = tokens.filter(token => token.name === name);
+    if (matches.length > 1) {
+        return yield* new ProviderError({ message: `several Cloudflare tokens are named ${name}` });
+    }
+    return Option.map(Option.fromUndefinedOr(matches[0]), token => token.id);
+});
+const permissionGroupIds = (admin) => requestJsonRequired('Cloudflare permission groups', `${account(admin)}/tokens/permission_groups`, envelope(Schema.Array(Schema.Struct({ id: Schema.String, name: Schema.String }))), { headers: headers(admin.apiToken) }).pipe(Effect.flatMap(response => Effect.forEach(permissionGroupNames, name => {
+    const group = response.result.find(candidate => candidate.name === name);
+    return group === undefined
+        ? Effect.fail(new ProviderError({ message: `Cloudflare permission group ${name} is unavailable` }))
+        : Effect.succeed(group.id);
+})));
+/**
+ * Creates an object read/write token scoped to exactly one bucket. The S3 access key is the token
+ * id; the secret is the SHA-256 of the one-time token value (Cloudflare's R2 token contract).
+ */
+export const createBucketToken = (admin, name, bucket) => Effect.gen(function* () {
+    const ids = yield* permissionGroupIds(admin);
+    const created = yield* requestJsonRequired('Cloudflare token creation', `${account(admin)}/tokens`, envelope(Schema.Struct({ id: Schema.String, value: Schema.String })), {
+        method: 'POST',
+        headers: headers(admin.apiToken),
+        body: {
+            name,
+            policies: [
+                {
+                    effect: 'allow',
+                    permission_groups: ids.map(id => ({ id })),
+                    resources: { [bucketResource(admin.accountId, bucket)]: '*' }
+                }
+            ]
+        }
+    });
+    const value = Redacted.make(created.result.value);
+    // Verify the new token authenticates before anything depends on it.
+    yield* requestJsonRequired('Cloudflare token verification', `${account(admin)}/tokens/verify`, envelope(Schema.Struct({ status: Schema.Literal('active') })), { headers: headers(value) });
+    return {
+        id: created.result.id,
+        accessKeyId: created.result.id,
+        secretAccessKey: Redacted.make(createHash('sha256').update(Redacted.value(value)).digest('hex'))
+    };
+});
+export const deleteToken = (admin, tokenId) => requestJson('Cloudflare token deletion', `${account(admin)}/tokens/${encodeURIComponent(tokenId)}`, Schema.Unknown, { method: 'DELETE', headers: headers(admin.apiToken), allowNotFound: true }).pipe(Effect.asVoid);

package/dist/factory/providers/neon.js

@@ -0,0 +1,81 @@
+import { Effect, Option, Redacted, Schedule, Schema } from 'effect';
+import { ProviderError, requestJson, requestJsonRequired } from '../http.js';
+const API_ROOT = 'https://console.neon.tech/api/v2';
+export const neonRegion = 'aws-eu-central-1';
+export const neonPgVersion = 18;
+/** Production keeps a 7-day restore window. */
+export const neonProductionHistoryRetentionSeconds = 7 * 24 * 3600;
+const headers = (admin) => ({ Authorization: `Bearer ${Redacted.value(admin.apiKey)}` });
+const Project = Schema.Struct({ id: Schema.String, name: Schema.String });
+const Branch = Schema.Struct({
+    id: Schema.String,
+    name: Schema.String,
+    default: Schema.optional(Schema.Boolean),
+    protected: Schema.optional(Schema.Boolean)
+});
+const Database = Schema.Struct({ name: Schema.String, owner_name: Schema.String });
+export const findProject = (admin, name) => Effect.gen(function* () {
+    const query = new URLSearchParams({ org_id: admin.orgId, search: name, limit: '100' });
+    const response = yield* requestJsonRequired('Neon project lookup', `${API_ROOT}/projects?${query.toString()}`, Schema.Struct({ projects: Schema.Array(Project) }), { headers: headers(admin) });
+    const matches = response.projects.filter(project => project.name === name);
+    if (matches.length > 1) {
+        return yield* new ProviderError({ message: `several Neon projects are named ${name}` });
+    }
+    return Option.fromUndefinedOr(matches[0]);
+});
+export const createProject = (admin, options) => requestJsonRequired('Neon project creation', `${API_ROOT}/projects`, Schema.Struct({ project: Project, branch: Branch }), {
+    method: 'POST',
+    headers: headers(admin),
+    body: {
+        project: {
+            name: options.name,
+            org_id: admin.orgId,
+            region_id: neonRegion,
+            pg_version: neonPgVersion,
+            branch: { name: options.branchName },
+            ...(options.historyRetentionSeconds === undefined
+                ? {}
+                : { history_retention_seconds: options.historyRetentionSeconds })
+        }
+    }
+});
+export const listBranches = (admin, projectId) => requestJsonRequired('Neon branch listing', `${API_ROOT}/projects/${encodeURIComponent(projectId)}/branches`, Schema.Struct({ branches: Schema.Array(Branch) }), { headers: headers(admin) }).pipe(Effect.map(response => response.branches));
+/** Neon rejects changes while project operations run (423/409); retry briefly. */
+const whileLocked = Schedule.max([Schedule.spaced('1 second'), Schedule.recurs(30)]);
+export const protectBranch = (admin, projectId, branchId) => requestJsonRequired('Neon branch protection', `${API_ROOT}/projects/${encodeURIComponent(projectId)}/branches/${encodeURIComponent(branchId)}`, Schema.Struct({ branch: Branch }), { method: 'PATCH', headers: headers(admin), body: { branch: { protected: true } } }).pipe(Effect.retry({
+    schedule: whileLocked,
+    while: error => error.status === 423 || error.status === 409
+}));
+export const connectionUri = (admin, projectId, branchId, pooled) => Effect.gen(function* () {
+    const databases = yield* requestJsonRequired('Neon database listing', `${API_ROOT}/projects/${encodeURIComponent(projectId)}/branches/${encodeURIComponent(branchId)}/databases`, Schema.Struct({ databases: Schema.Array(Database) }), { headers: headers(admin) });
+    const database = databases.databases.length === 1 ? databases.databases[0] : undefined;
+    if (database === undefined) {
+        return yield* new ProviderError({
+            message: `expected one database on Neon branch ${branchId}, found ${databases.databases.length}`
+        });
+    }
+    const query = new URLSearchParams({
+        branch_id: branchId,
+        database_name: database.name,
+        role_name: database.owner_name,
+        pooled: String(pooled)
+    });
+    const response = yield* requestJsonRequired('Neon connection URI', `${API_ROOT}/projects/${encodeURIComponent(projectId)}/connection_uri?${query.toString()}`, Schema.Struct({ uri: Schema.String }), { headers: headers(admin) });
+    return Redacted.make(response.uri);
+}).pipe(Effect.retry({
+    schedule: whileLocked,
+    while: error => error.status === 423 || error.status === 409
+}));
+const ApiKey = Schema.Struct({
+    id: Schema.Number,
+    name: Schema.String,
+    project_id: Schema.optional(Schema.String)
+});
+export const findApiKey = (admin, name) => requestJsonRequired('Neon API key listing', `${API_ROOT}/organizations/${encodeURIComponent(admin.orgId)}/api_keys`, Schema.Array(ApiKey), { headers: headers(admin) }).pipe(Effect.flatMap(keys => {
+    const matches = keys.filter(key => key.name === name);
+    return matches.length > 1
+        ? Effect.fail(new ProviderError({ message: `several Neon API keys are named ${name}` }))
+        : Effect.succeed(Option.map(Option.fromUndefinedOr(matches[0]), key => String(key.id)));
+}));
+export const createProjectApiKey = (admin, name, projectId) => requestJsonRequired('Neon API key creation', `${API_ROOT}/organizations/${encodeURIComponent(admin.orgId)}/api_keys`, Schema.Struct({ id: Schema.Number, key: Schema.String }), { method: 'POST', headers: headers(admin), body: { key_name: name, project_id: projectId } }).pipe(Effect.map(created => ({ id: String(created.id), key: Redacted.make(created.key) })));
+export const revokeApiKey = (admin, keyId) => requestJson('Neon API key revocation', `${API_ROOT}/organizations/${encodeURIComponent(admin.orgId)}/api_keys/${encodeURIComponent(keyId)}`, Schema.Unknown, { method: 'DELETE', headers: headers(admin), allowNotFound: true }).pipe(Effect.asVoid);

package/dist/factory/providers/report-receiver.js

@@ -0,0 +1,37 @@
+import { Effect, Option, Redacted, Schema } from 'effect';
+import { ProviderError, requestJson, requestJsonRequired } from '../http.js';
+/** The receiver's factory API lives on the same origin: `/api/factory/report-tokens`. */
+const tokensUrl = (receiver) => Effect.try({
+    try: () => new URL('/api/factory/report-tokens', receiver.url).href,
+    catch: () => new ProviderError({ message: 'report_receiver.url is not a valid URL' })
+});
+const headers = (receiver) => ({
+    Authorization: `Bearer ${Redacted.value(receiver.factoryKey)}`
+});
+const ReportToken = Schema.Struct({
+    id: Schema.String,
+    name: Schema.String,
+    revokedAt: Schema.optional(Schema.NullOr(Schema.String))
+});
+export const findReportToken = (receiver, name) => Effect.gen(function* () {
+    const url = yield* tokensUrl(receiver);
+    const tokens = yield* requestJsonRequired('report token listing', url, Schema.Struct({ tokens: Schema.Array(ReportToken) }), { headers: headers(receiver) });
+    const active = tokens.tokens.filter(token => token.name === name && (token.revokedAt === undefined || token.revokedAt === null));
+    if (active.length > 1) {
+        return yield* new ProviderError({ message: `several active report tokens are named ${name}` });
+    }
+    return Option.map(Option.fromUndefinedOr(active[0]), token => token.id);
+});
+export const createReportToken = (receiver, name) => Effect.gen(function* () {
+    const url = yield* tokensUrl(receiver);
+    const created = yield* requestJsonRequired('report token creation', url, Schema.Struct({ id: Schema.String, token: Schema.String }), { method: 'POST', headers: headers(receiver), body: { name } });
+    return { id: created.id, token: Redacted.make(created.token) };
+});
+export const revokeReportToken = (receiver, id) => Effect.gen(function* () {
+    const url = yield* tokensUrl(receiver);
+    yield* requestJson('report token revocation', `${url}/${encodeURIComponent(id)}`, Schema.Unknown, {
+        method: 'DELETE',
+        headers: headers(receiver),
+        allowNotFound: true
+    });
+});

package/dist/factory/providers/resend.js

@@ -0,0 +1,32 @@
+import { Effect, Option, Redacted, Schema } from 'effect';
+import { ProviderError, requestJson, requestJsonRequired } from '../http.js';
+const API_ROOT = 'https://api.resend.com';
+const headers = (apiKey) => ({
+    Authorization: `Bearer ${Redacted.value(apiKey)}`
+});
+const Domain = Schema.Struct({ id: Schema.String, name: Schema.String, status: Schema.String });
+/** The sender domain must be registered and verified in this Resend account. */
+export const requireVerifiedDomain = (apiKey, name) => Effect.gen(function* () {
+    const response = yield* requestJsonRequired('Resend domain listing', `${API_ROOT}/domains`, Schema.Struct({ data: Schema.Array(Domain) }), { headers: headers(apiKey) });
+    const domain = response.data.find(candidate => candidate.name === name);
+    if (domain === undefined || domain.status !== 'verified') {
+        return yield* new ProviderError({
+            message: `Resend domain ${name} must be verified in the factory's Resend account (${domain === undefined ? 'not registered' : `status ${domain.status}`})`
+        });
+    }
+});
+export const findApiKey = (apiKey, name) => requestJsonRequired('Resend API key listing', `${API_ROOT}/api-keys`, Schema.Struct({
+    data: Schema.Array(Schema.Struct({ id: Schema.String, name: Schema.String }))
+}), { headers: headers(apiKey) }).pipe(Effect.flatMap(response => {
+    const matches = response.data.filter(key => key.name === name);
+    return matches.length > 1
+        ? Effect.fail(new ProviderError({ message: `several Resend API keys are named ${name}` }))
+        : Effect.succeed(Option.map(Option.fromUndefinedOr(matches[0]), key => key.id));
+}));
+/** A sending-only key (it can send from any verified domain, but read and manage nothing). */
+export const createSendingKey = (apiKey, name) => requestJsonRequired('Resend API key creation', `${API_ROOT}/api-keys`, Schema.Struct({ id: Schema.String, token: Schema.String }), {
+    method: 'POST',
+    headers: headers(apiKey),
+    body: { name, permission: 'sending_access' }
+}).pipe(Effect.map(created => ({ id: created.id, token: Redacted.make(created.token) })));
+export const deleteApiKey = (apiKey, keyId) => requestJson('Resend API key deletion', `${API_ROOT}/api-keys/${encodeURIComponent(keyId)}`, Schema.Unknown, { method: 'DELETE', headers: headers(apiKey), allowNotFound: true }).pipe(Effect.asVoid);

package/dist/factory/providers/upstash.js

@@ -0,0 +1,21 @@
+import { Effect, Option, Redacted, Schema } from 'effect';
+import { ProviderError, requestJsonRequired } from '../http.js';
+const API_ROOT = 'https://api.upstash.com/v2';
+const basic = (email, apiKey) => ({
+    Authorization: `Basic ${Buffer.from(`${email}:${Redacted.value(apiKey)}`).toString('base64')}`
+});
+const Team = Schema.Struct({ team_id: Schema.String, team_name: Schema.String });
+export const findTeam = (email, apiKey, name) => requestJsonRequired('Upstash team listing', `${API_ROOT}/teams`, Schema.Array(Team), {
+    headers: basic(email, apiKey)
+}).pipe(Effect.flatMap(teams => {
+    const matches = teams.filter(team => team.team_name === name);
+    return matches.length > 1
+        ? Effect.fail(new ProviderError({ message: `several Upstash teams are named ${name}` }))
+        : Effect.succeed(Option.map(Option.fromUndefinedOr(matches[0]), team => team.team_id));
+}));
+/** Creates a team without copying the payment method or billing details. */
+export const createTeam = (email, apiKey, name) => requestJsonRequired('Upstash team creation', `${API_ROOT}/team`, Team, {
+    method: 'POST',
+    headers: basic(email, apiKey),
+    body: { team_name: name, copy_cc: false }
+}).pipe(Effect.map(team => team.team_id));

package/dist/factory/registry.js

@@ -0,0 +1,50 @@
+import { join } from 'node:path';
+import { Context, Data, Effect, FileSystem, Layer, Option, Schema } from 'effect';
+import { readPrivately, writePrivately } from '../shared/private-file.js';
+/**
+ * The CLI-owned factory registry: where each factory's 1Password item lives. Non-secret; stored at
+ * `${XDG_CONFIG_HOME:-~/.config}/provision/config.json` with mode `0600`.
+ */
+export class RegistryLocation extends Context.Service()('provision/factory/RegistryLocation') {
+}
+export const RegistryLocationLive = Layer.sync(RegistryLocation, () => ({
+    file: join(process.env.XDG_CONFIG_HOME ?? join(process.env.HOME ?? '', '.config'), 'provision', 'config.json')
+}));
+export class RegistryError extends Data.TaggedError('RegistryError') {
+}
+export const factoryNamePattern = /^[a-z][a-z0-9-]{0,31}$/;
+const FactoryName = Schema.String.check(Schema.isPattern(factoryNamePattern));
+export const FactoryEntry = Schema.Struct({
+    vault: Schema.NonEmptyString,
+    item: Schema.NonEmptyString,
+    account: Schema.optionalKey(Schema.NonEmptyString),
+    /** Copied from the item by `config add`, so selecting a factory reads only that factory's item. */
+    githubOwner: Schema.optionalKey(Schema.NonEmptyString)
+});
+const RegistryFile = Schema.Struct({
+    factories: Schema.Record(FactoryName, FactoryEntry)
+});
+const RegistryJson = Schema.fromJsonString(RegistryFile);
+const emptyRegistry = { factories: {} };
+export const readRegistry = Effect.gen(function* () {
+    const { file } = yield* RegistryLocation;
+    const content = yield* readPrivately(file).pipe(Effect.mapError(error => new RegistryError({ message: error.message })));
+    if (content === undefined)
+        return emptyRegistry;
+    return yield* Schema.decodeUnknownEffect(RegistryJson, { onExcessProperty: 'error' })(content).pipe(Effect.mapError(cause => new RegistryError({ message: `invalid factory registry ${file}: ${cause.message}` })));
+});
+export const writeRegistry = (registry) => Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const { file } = yield* RegistryLocation;
+    const directory = file.slice(0, file.lastIndexOf('/'));
+    yield* fs
+        .makeDirectory(directory, { recursive: true })
+        .pipe(Effect.mapError(() => new RegistryError({ message: `cannot create ${directory}` })));
+    yield* writePrivately(file, `${JSON.stringify(registry, null, 2)}\n`).pipe(Effect.mapError(error => new RegistryError({ message: error.message })));
+});
+export const validateFactoryName = (name) => factoryNamePattern.test(name)
+    ? Effect.succeed(name)
+    : Effect.fail(new RegistryError({
+        message: 'factory names are 1-32 lowercase letters, digits, or hyphens, starting with a letter'
+    }));
+export const findFactory = (registry, name) => Option.fromUndefinedOr(registry.factories[name]);

package/dist/factory/scoped-key.js

@@ -0,0 +1,30 @@
+import { Console, Effect, Option } from 'effect';
+import { decide, factoryError, mutate } from './context.js';
+/**
+ * Ensures one scoped key per environment group:
+ * - none exists: create it and write Vercel;
+ * - it exists and Vercel is complete: reuse, or rotate on overwrite;
+ * - it exists but Vercel is incomplete: the value cannot be recovered, so only rotation fixes it.
+ *
+ * Rotation creates the new key and writes Vercel before deleting the old key.
+ */
+export const ensureScopedKey = (context, key) => Effect.gen(function* () {
+    if (Option.isNone(key.existing)) {
+        yield* mutate(context, `create ${key.description}`, key.createAndWrite);
+        return;
+    }
+    const description = key.vercelComplete
+        ? key.description
+        : `${key.description} (its value is missing from Vercel and cannot be recovered)`;
+    const decision = yield* decide(context, 'key', description);
+    if (decision === 'reuse') {
+        if (!key.vercelComplete && !context.dryRun) {
+            return yield* factoryError(`${key.description} cannot be reused because Vercel lacks its value; rerun with --on-existing=overwrite to rotate it`);
+        }
+        yield* Console.log(`  reusing ${key.description}`);
+        return;
+    }
+    const previous = key.existing.value;
+    yield* mutate(context, `rotate ${key.description}`, key.createAndWrite);
+    yield* mutate(context, `delete the previous ${key.description}`, key.remove(previous));
+});

package/dist/factory/sealed.js

@@ -0,0 +1,64 @@
+import { createCipheriv, createDecipheriv, randomBytes, scrypt } from 'node:crypto';
+import { Data, Effect, Redacted, Schema } from 'effect';
+/**
+ * Passphrase sealing for stored tokens: scrypt-derived key, AES-256-GCM, with the credential
+ * name as associated data so a sealed token cannot be swapped between factories.
+ */
+export class SealError extends Data.TaggedError('SealError') {
+}
+/** ~128 MiB and a few hundred milliseconds per derivation. */
+export const defaultKdf = { N: 2 ** 17, r: 8, p: 1 };
+const Envelope = Schema.Struct({
+    v: Schema.Literal(1),
+    kdf: Schema.Literal('scrypt'),
+    N: Schema.Number,
+    r: Schema.Number,
+    p: Schema.Number,
+    salt: Schema.String,
+    iv: Schema.String,
+    tag: Schema.String,
+    data: Schema.String
+});
+const EnvelopeJson = Schema.fromJsonString(Envelope);
+const deriveKey = (passphrase, salt, kdf) => Effect.callback(resume => {
+    const options = { ...kdf, maxmem: 256 * kdf.N * kdf.r + 1024 * 1024 };
+    scrypt(Redacted.value(passphrase), salt, 32, options, (error, key) => {
+        resume(error === null
+            ? Effect.succeed(key)
+            : Effect.fail(new SealError({ reason: 'crypto', message: 'key derivation failed' })));
+    });
+});
+export const seal = (passphrase, plaintext, associatedData, kdf = defaultKdf) => Effect.gen(function* () {
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const key = yield* deriveKey(passphrase, salt, kdf);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(Buffer.from(associatedData, 'utf8'));
+    const data = Buffer.concat([cipher.update(Redacted.value(plaintext), 'utf8'), cipher.final()]);
+    return JSON.stringify({
+        v: 1,
+        kdf: 'scrypt',
+        ...kdf,
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        data: data.toString('base64')
+    });
+});
+export const unseal = (passphrase, sealed, associatedData) => Effect.gen(function* () {
+    const envelope = yield* Schema.decodeUnknownEffect(EnvelopeJson)(sealed.trim()).pipe(Effect.mapError(() => new SealError({ reason: 'malformed', message: 'stored token is not sealed' })));
+    const key = yield* deriveKey(passphrase, Buffer.from(envelope.salt, 'base64'), envelope);
+    return yield* Effect.try({
+        try: () => {
+            const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(envelope.iv, 'base64'));
+            decipher.setAAD(Buffer.from(associatedData, 'utf8'));
+            decipher.setAuthTag(Buffer.from(envelope.tag, 'base64'));
+            const plaintext = Buffer.concat([
+                decipher.update(Buffer.from(envelope.data, 'base64')),
+                decipher.final()
+            ]);
+            return Redacted.make(plaintext.toString('utf8'));
+        },
+        catch: () => new SealError({ reason: 'wrong-passphrase', message: 'wrong passphrase' })
+    });
+});

package/dist/factory/secret-input.js

@@ -0,0 +1,43 @@
+import { Context, Effect, Layer, Option, Redacted } from 'effect';
+import { readHiddenLines } from './passphrase.js';
+/** One `KEY=value` line of a `.env` block (optionally `export`ed, value optionally quoted). */
+export const parseEnvLine = (line) => {
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/.exec(line);
+    if (match === null)
+        return undefined;
+    const [, key = '', raw = ''] = match;
+    const quoted = /^(["'])(.*)\1$/.exec(raw);
+    return { key, value: quoted?.[2] ?? raw };
+};
+/** The values for `keys` found in `lines`; later lines win. */
+export const parseEnvBlock = (lines, keys) => {
+    const values = new Map();
+    for (const line of lines) {
+        const parsed = parseEnvLine(line);
+        if (parsed !== undefined && keys.includes(parsed.key) && parsed.value !== '') {
+            values.set(parsed.key, Redacted.make(parsed.value));
+        }
+    }
+    return values;
+};
+export class SecretInput extends Context.Service()('provision/factory/SecretInput') {
+}
+const interactive = () => process.stdin.isTTY === true && process.stdout.isTTY === true;
+export const SecretInputLive = Layer.succeed(SecretInput, SecretInput.of({
+    readEnv: (message, keys) => interactive()
+        ? readHiddenLines(message, {
+            complete: lines => parseEnvBlock(lines, keys).size === keys.length,
+            note: line => {
+                const parsed = parseEnvLine(line);
+                return parsed !== undefined && keys.includes(parsed.key)
+                    ? `  ✓ ${parsed.key}`
+                    : line.trim() === ''
+                        ? undefined
+                        : '  · ignored a line that is not one of the expected variables';
+            }
+        }).pipe(Effect.map(lines => {
+            const values = parseEnvBlock(lines.map(line => Redacted.value(line)), keys);
+            return values.size === 0 ? Option.none() : Option.some(values);
+        }))
+        : Effect.succeed(Option.none())
+}));

package/dist/factory/steps/domain.js

@@ -0,0 +1,23 @@
+import { Console, Effect, Option } from 'effect';
+import { decide, factoryError, mutate, requireProject } from '../context.js';
+import { addProjectDomain, getProjectDomain } from '../vercel-api.js';
+/** Attaches `--domain` to the Vercel project and reports whether DNS verification is pending. */
+export const domainStep = (context) => Effect.gen(function* () {
+    const domain = context.domain;
+    if (domain === undefined)
+        return yield* factoryError('the domain step needs --domain');
+    const handle = yield* requireProject(context);
+    if (Option.isNone(handle)) {
+        yield* Console.log(`  would attach ${domain} after the vercel step creates the project`);
+        return;
+    }
+    const teamId = context.credentials.vercel.teamId;
+    const projectId = handle.value.project.id;
+    const existing = yield* getProjectDomain(teamId, projectId, domain);
+    const attached = Option.isSome(existing)
+        ? yield* decide(context, 'data', `Vercel domain ${domain}`).pipe(Effect.as(existing))
+        : yield* mutate(context, `attach ${domain} to ${context.names.project}`, addProjectDomain(teamId, projectId, domain));
+    if (Option.isSome(attached) && attached.value.verified === false) {
+        yield* Console.log(`  manual: ${domain} needs DNS verification; see the project's Domains page in Vercel`);
+    }
+});

package/dist/factory/steps/neon.js

@@ -0,0 +1,101 @@
+import { Console, Effect, Option, Redacted } from 'effect';
+import { defaultDatabaseUrlKeys, sandboxProfileKeys } from '../../shared/sandbox-profile.js';
+import { decide, envGroups, factoryError, groupHasKeys, mutate, requireProject, writeGroup } from '../context.js';
+import { connectionUri, createProject, createProjectApiKey, findApiKey, findProject, listBranches, neonProductionHistoryRetentionSeconds, protectBranch, revokeApiKey } from '../providers/neon.js';
+import { ensureScopedKey } from '../scoped-key.js';
+import { listEnvRecords } from '../vercel-api.js';
+/** Finds or creates a Neon project; returns its id and protected default branch (`None` in a dry run). */
+const ensureProject = (context, admin, name, branchName, historyRetentionSeconds) => Effect.gen(function* () {
+    const existing = yield* findProject(admin, name);
+    if (Option.isSome(existing)) {
+        yield* decide(context, 'data', `Neon project ${name}`);
+        const branches = yield* listBranches(admin, existing.value.id);
+        const branch = branches.find(candidate => candidate.default === true);
+        if (branch === undefined) {
+            return yield* factoryError(`Neon project ${name} has no default branch`);
+        }
+        if (branch.protected !== true) {
+            yield* mutate(context, `protect Neon branch ${name}/${branch.name}`, protectBranch(admin, existing.value.id, branch.id));
+        }
+        return Option.some({ projectId: existing.value.id, branch });
+    }
+    const created = yield* mutate(context, `create Neon project ${name} with protected branch ${branchName}`, createProject(admin, {
+        name,
+        branchName,
+        ...(historyRetentionSeconds === undefined ? {} : { historyRetentionSeconds })
+    }).pipe(Effect.tap(response => protectBranch(admin, response.project.id, response.branch.id))));
+    return Option.map(created, response => ({
+        projectId: response.project.id,
+        branch: response.branch
+    }));
+});
+/**
+ * `<repo>-dev`: the sandbox project whose parent branch disposable databases clone, plus a
+ * project-scoped key, written to Vercel Development as the `SANDBOX_DB_*` profile.
+ * `<repo>-prod`: the production project, written to Vercel Production as `DATABASE_URL(_UNPOOLED)`.
+ */
+export const neonStep = (context) => Effect.gen(function* () {
+    const admin = context.credentials.neon;
+    if (admin === undefined) {
+        return yield* factoryError('the factory item has no neon section');
+    }
+    const handle = yield* requireProject(context);
+    if (Option.isNone(handle)) {
+        yield* Console.log('  would run after the vercel step creates the project');
+        return;
+    }
+    const teamId = context.credentials.vercel.teamId;
+    const groups = envGroups(handle.value);
+    const records = yield* listEnvRecords(teamId, handle.value.project.id);
+    const mode = context.repoConfig.factory.neon.sandboxParent ?? 'empty-baseline';
+    // Development sandbox ----------------------------------------------------
+    const sandbox = mode === 'empty-baseline'
+        ? Option.map(yield* ensureProject(context, admin, context.names.development, 'baseline'), project => ({ projectId: project.projectId, parentBranch: project.branch.id }))
+        : yield* findProject(admin, context.names.development).pipe(Effect.flatMap(Option.match({
+            onNone: () => Effect.fail(factoryError(`existing-branch mode needs the Neon project ${context.names.development} to exist`)),
+            onSome: project => decide(context, 'data', `Neon project ${project.name}`).pipe(Effect.as(Option.some({ projectId: project.id, parentBranch: context.neonParentBranch })))
+        })));
+    if (Option.isSome(sandbox)) {
+        const { projectId, parentBranch } = sandbox.value;
+        const keyName = `${context.names.development}-sandbox-branch-manager`;
+        yield* ensureScopedKey(context, {
+            description: `Neon key ${keyName}`,
+            existing: yield* findApiKey(admin, keyName),
+            vercelComplete: groupHasKeys(records, groups.development, sandboxProfileKeys),
+            createAndWrite: Effect.gen(function* () {
+                if (parentBranch === undefined) {
+                    return yield* factoryError('existing-branch mode needs --neon-parent-branch to (re)write the sandbox profile');
+                }
+                const created = yield* createProjectApiKey(admin, keyName, projectId);
+                const [apiKey, project, parent] = sandboxProfileKeys;
+                const written = yield* writeGroup(context, handle.value, groups.development, [
+                    { key: apiKey, value: created.key, type: 'encrypted' },
+                    { key: project, value: Redacted.make(projectId), type: 'encrypted' },
+                    { key: parent, value: Redacted.make(parentBranch), type: 'encrypted' }
+                ]).pipe(Effect.tapError(() => revokeApiKey(admin, created.id).pipe(Effect.ignore)));
+                return written;
+            }).pipe(Effect.asVoid),
+            remove: id => revokeApiKey(admin, id)
+        });
+    }
+    // Production ---------------------------------------------------------------
+    const production = yield* ensureProject(context, admin, context.names.production, 'production', neonProductionHistoryRetentionSeconds);
+    if (Option.isNone(production))
+        return;
+    const { projectId, branch } = production.value;
+    const writeUrls = Effect.gen(function* () {
+        const [pooledKey, directKey] = defaultDatabaseUrlKeys;
+        const pooled = yield* connectionUri(admin, projectId, branch.id, true);
+        const direct = yield* connectionUri(admin, projectId, branch.id, false);
+        yield* writeGroup(context, handle.value, groups.production, [
+            { key: pooledKey, value: pooled, type: 'sensitive' },
+            { key: directKey, value: direct, type: 'sensitive' }
+        ]);
+    });
+    if (groupHasKeys(records, groups.production, defaultDatabaseUrlKeys)) {
+        const decision = yield* decide(context, 'key', 'production DATABASE_URL records');
+        if (decision === 'reuse')
+            return;
+    }
+    yield* writeUrls;
+});