@timekast/factory 1.13.0 → 1.14.2

package/dist/commands/doctor.js

@@ -246,6 +246,7 @@ const STATUS_GLYPH = {
     ok: '✅',
     fail: '❌',
     skipped: '—',
+    warn: '🟡',
 };
 /**
  * Render the launcher preflight report. Each check on its own line with a glyph,
@@ -268,13 +269,17 @@ export function renderLauncherDoctor(checks) {
             }
         }
     }
-    const allOk = checks.every((c) => c.status === 'ok');
+    const hasFail = checks.some((c) => c.status === 'fail');
+    const hasWarn = checks.some((c) => c.status === 'warn');
     console.log('');
-    if (allOk) {
-        console.log('Entorno listo para usar el launcher.');
+    if (hasFail) {
+        console.log('Entorno incompleto: corrige los checks marcados ❌ y vuelve a intentar.');
+    }
+    else if (hasWarn) {
+        console.log('Entorno listo. Revisa los avisos 🟡 (no bloquean el launcher).');
     }
     else {
-        console.log('Entorno incompleto: corrige los checks marcados ❌ y vuelve a intentar.');
+        console.log('Entorno listo para usar el launcher.');
     }
 }
 /**

package/dist/commands/provision.js

@@ -203,7 +203,7 @@ export function parseProvisionFlags(argv) {
 const SERVICE_LABEL = {
     neon: 'Neon (proyecto + branch develop)',
     vercel: 'Vercel (env sync por target)',
-    github: 'GitHub + Vercel (sustrato git + proyecto + migrate.yml)',
+    github: 'GitHub + Vercel (sustrato git + proyecto + env + E2E)',
     dns: 'DNS + Resend (dominio del entorno)',
 };
 /** Build the ordered plan: each requested service is `skip` if complete, else `create`. */
@@ -244,14 +244,17 @@ function deriveProjectName(flags, rootDir) {
     // it wins over the dir name. Validate it as a subdomain label when given,
     // since it flows into `{slug}.timekast.mx` downstream (PROV-005).
     if (flags.slug) {
-        assertValidSubdomainSlug(flags.slug);
-        return flags.slug;
+        const slug = flags.slug.toLowerCase(); // every resource is lowercase (repo/dir/domains)
+        assertValidSubdomainSlug(slug);
+        return slug;
     }
     // No `--slug`: the project name is the directory provision runs in (the scaffold
     // dir), NOT the org/team scope. A team id like `team_ldqH...` is neither a real
     // project name nor a valid subdomain, and falling back to it produced a confusing
     // `repo TimeKast/team_ldqH... no existe` error. Validate it like an explicit slug.
-    const fromDir = basename(rootDir);
+    // Lowercased so a dir created with mixed case (e.g. `Edmond/`) yields a valid slug
+    // instead of being rejected for the uppercase — matches the `new` normalization.
+    const fromDir = basename(rootDir).toLowerCase();
     assertValidSubdomainSlug(fromDir);
     return fromDir;
 }
@@ -833,7 +836,13 @@ async function buildGitSubstrate(rootDir, repoSlug, runGit, force) {
     // 2. Add (or reset, under --force) the `origin` remote → the HTTPS repo URL.
     const existingOrigin = await readOriginUrl(runGit, rootDir);
     if (existingOrigin && existingOrigin !== url) {
-        if (!force) {
+        // GitHub repo URLs are case-insensitive: an `origin` differing ONLY by case
+        // (e.g. `TimeKast/Edmond.git` vs the canonical lowercase `TimeKast/edmond.git`)
+        // points at the SAME repo. Re-case it to the canonical URL silently — no `--force`
+        // needed. A difference BEYOND case is a genuinely different repo → throw unless
+        // `--force` resets it.
+        const sameRepoDifferentCase = existingOrigin.toLowerCase() === url.toLowerCase();
+        if (!sameRepoDifferentCase && !force) {
             throw new CLIError(`El repo ya tiene un remote \`origin\` apuntando a otro URL (\`${existingOrigin}\` ≠ \`${url}\`).\n` +
                 'Usa `--force` para sobrescribirlo, o limpia el remote si reutilizas este directorio.');
         }
@@ -927,8 +936,9 @@ export function writeE2eWorkflow(rootDir) {
 /**
  * PROV-004 — the `github` step: build the git substrate, create the Vercel PROJECT,
  * connect the GitHub repo (GitHub App gate), confirm `productionBranch: main`,
- * write `.vercel/project.json` + the `migrate.yml` template, and push the migration
- * GitHub Secrets. HIGH-risk: every failure is recoverable via `--resume`.
+ * write `.vercel/project.json`, and activate the E2E workflow. Migrations run in the
+ * Vercel build (`vercel-build`: `pnpm db:migrate && pnpm build`), NOT a GitHub Actions
+ * workflow. HIGH-risk: every failure is recoverable via `--resume`.
  *
  * Order (asserted by the unit test): git substrate (rename → remote add → push
  * main) runs ENTIRELY before `POST /v9/projects`. The project create is skipped on
@@ -1115,7 +1125,7 @@ function cloudflareErrorToCliError(error, context) {
  *      CNAME for BOTH domains (create, or PATCH a manually-proxied record).
  *   4. Resend: upsert `RESEND_API_KEY` (production+preview) + the org
  *      `EMAIL_FROM=noreply@updates.timekast.mx` (mail subdomain) — no-echo.
- *   5. Record `state.dns = { domain }` (the prod domain) and persist.
+ *   5. Record `state.dns = { domain, devDomain }` (prod + the dev domain) and persist.
  *
  * Requires `state.vercel.projectId` (PROV-004). No-echo: the Cloudflare token and
  * the Resend key never reach stdout — only domain NAMES + key NAMES are printed.
@@ -1191,8 +1201,10 @@ export async function provisionDns(rootDir, state, teamId, deps = {}) {
     }
     // 4. Resend — wire RESEND_API_KEY (rail) + the FIXED EMAIL_FROM into Vercel env.
     await wireResendEnv(projectId, vercelToken, teamId, envPath, vercelDeps);
-    // 5. Record the DNS state (the prod domain is the canonical one) and persist.
-    state.dns = { domain: prod };
+    // 5. Record BOTH interim domains in state — prod is canonical, dev tracks `develop`.
+    //    The dev domain is derivable from the slug, but persisting it keeps the state
+    //    file transparent about every domain provision created (not just prod).
+    state.dns = { domain: prod, devDomain: dev };
     writeProvisionState(rootDir, state);
 }
 /**
@@ -1451,7 +1463,10 @@ export async function provisionClientDomain(rootDir, state, teamId, domain, deps
     if (!verified) {
         // Timeout: persist the pending state (resumable) and stop with a clear error (§5).
         state.dns = {
-            ...(state.dns ?? { domain: provisionDomains(state.projectName).prod }),
+            ...(state.dns ?? {
+                domain: provisionDomains(state.projectName).prod,
+                devDomain: provisionDomains(state.projectName).dev,
+            }),
             clientDomain: domain,
             clientDomainStatus: 'pending-verification',
         };
@@ -1470,7 +1485,10 @@ export async function provisionClientDomain(rootDir, state, teamId, domain, deps
     await registerResendDomain(mailDomainFor(domain), envPath, fetchImpl);
     // 7. Record the client domain as LIVE and persist.
     state.dns = {
-        ...(state.dns ?? { domain: provisionDomains(state.projectName).prod }),
+        ...(state.dns ?? {
+            domain: provisionDomains(state.projectName).prod,
+            devDomain: provisionDomains(state.projectName).dev,
+        }),
         clientDomain: domain,
         clientDomainStatus: 'live',
     };
@@ -1577,13 +1595,13 @@ async function runServiceStep(service, rootDir, state, flags) {
         case 'github':
             // PROV-004: git substrate (rename → remote add → push main) + create the
             // Vercel project + connect git (GitHub App) + PATCH production-branch +
-            // .vercel/project.json + migrate.yml + migration secrets.
+            // .vercel/project.json + activate E2E. Migrations run in vercel-build, not a workflow.
             await provisionGithubVercel(rootDir, state, flags.team, { force: flags.force });
             break;
         case 'dns':
             // PROV-005: attach the interim domains to Vercel (dev → develop, prod →
             // production) + create their Cloudflare CNAMEs (proxied:false) + wire Resend
-            // (RESEND_API_KEY + the fixed EMAIL_FROM), then `state.dns = { domain }`.
+            // (RESEND_API_KEY + the fixed EMAIL_FROM), then `state.dns = { domain, devDomain }`.
             await provisionDns(rootDir, state, flags.team);
             break;
         default:

package/dist/lib/preflight.js

@@ -15,6 +15,9 @@
  * --launcher` can render every step with ✅ / ❌ across all platforms (the
  * cross-platform equivalent of the macOS launcher's `checkPrereqs`).
  */
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
 import { execa } from 'execa';
 import { PreflightError } from './cli-error.js';
 import { FACTORY_ORG } from './constants.js';
@@ -132,12 +135,28 @@ export async function runPreflight() {
     await assertGhAuthenticated();
     await assertOrgMembership();
 }
+/**
+ * The methodology-rail keys the launcher expects in `~/.claude/.env` (imported
+ * via `factory secrets <file>`). Provisioning tokens + their team/org ids + the
+ * proposal tooling keys. Single source so the check + tests agree.
+ */
+export const REQUIRED_SECRET_KEYS = [
+    'NEON_API_KEY',
+    'VERCEL_TOKEN',
+    'RESEND_API_KEY',
+    'CLOUDFLARE_API_TOKEN',
+    'SHORTIO_API_KEY',
+    'GAMMA_API_KEY',
+    'VERCEL_TEAM_ID',
+    'NEON_ORGANIZATION_ID',
+];
 /** The ordered launcher labels (single source so render + tests agree). */
 const LAUNCHER_LABELS = {
     node: `Node ≥ ${MIN_NODE_MAJOR}`,
     gh: 'GitHub CLI (gh) instalado',
     auth: 'Sesión de GitHub activa',
     org: `Membresía del org ${FACTORY_ORG}`,
+    secrets: 'Secrets del org en el rail',
 };
 /** A confirmation message for a passing check (the `ok` branch). */
 const OK_MESSAGES = {
@@ -145,7 +164,45 @@ const OK_MESSAGES = {
     gh: 'GitHub CLI (gh) está instalado.',
     auth: 'Tu sesión de GitHub CLI está activa.',
     org: `Eres miembro del org ${FACTORY_ORG}.`,
+    secrets: `Las ${REQUIRED_SECRET_KEYS.length} keys del rail están presentes.`,
 };
+/**
+ * Read the secret KEY NAMES present in the rail (`~/.claude/.env`), never values.
+ * A missing/unreadable rail yields an empty set (→ the check warns with all keys
+ * missing). Tests inject `railContent` to avoid touching the real home dir.
+ */
+function readRailKeyNames(railContent) {
+    let content = railContent;
+    if (content === undefined) {
+        try {
+            content = readFileSync(path.join(homedir(), '.claude', '.env'), 'utf8');
+        }
+        catch {
+            content = '';
+        }
+    }
+    const names = new Set();
+    for (const line of content.split(/\r?\n/)) {
+        const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        if (match)
+            names.add(match[1]);
+    }
+    return names;
+}
+/** Build the secrets check (`ok` if all required keys present, else `warn`). */
+function secretsCheck(railContent) {
+    const present = readRailKeyNames(railContent);
+    const missing = REQUIRED_SECRET_KEYS.filter((key) => !present.has(key));
+    return {
+        id: 'secrets',
+        label: LAUNCHER_LABELS.secrets,
+        status: missing.length === 0 ? 'ok' : 'warn',
+        message: missing.length === 0
+            ? OK_MESSAGES.secrets
+            : `Faltan ${missing.length} de ${REQUIRED_SECRET_KEYS.length} secrets en el rail: ` +
+                `${missing.join(', ')}. Impórtalos desde el card Secrets.`,
+    };
+}
 /**
  * Run the launcher preflight (LTUI-002): the cross-platform equivalent of the
  * macOS launcher's `checkPrereqs`. Verifies, IN ORDER:
@@ -211,5 +268,8 @@ export async function runLauncherPreflight(deps = {}) {
             });
         }
     }
+    // Secrets check — independent of the gh/auth/org chain (runs even if those
+    // failed) and non-blocking: resolves to `ok` or `warn`, never `fail`/`skipped`.
+    results.push(secretsCheck(deps.railContent));
     return results;
 }

package/dist/lib/provision-preflight.js

@@ -111,7 +111,7 @@ async function assertGhAuthenticated(spawn) {
 }
 /**
  * Step 1b' — the `gh` token carries the `workflow` scope. The derived scaffold ships
- * `.github/workflows/*.yml` (ci, e2e, …) and provision generates more (migrate.yml);
+ * `.github/workflows/*.yml` (ci, e2e, …) and provision activates more (e2e.yml);
  * GitHub REJECTS an HTTPS push that creates/updates a workflow file unless the OAuth
  * token has the `workflow` scope ("refusing to allow an OAuth App to create or update
  * workflow … without `workflow` scope"). Parses `gh auth status` for the scope; the

package/dist/lib/provision-state.js

@@ -358,14 +358,15 @@ export function readDestroyTarget(rootDir) {
             'Bórralo o reconstrúyelo con `--adopt`.');
     }
     const lifecycle = step.lifecycle === 'ephemeral' ? 'ephemeral' : 'live';
-    // The committed `dns` block records only the prod domain (`domain`) + the optional
-    // client domain — NOT the interim DEV domain (`{slug}-dev.timekast.mx`), which
-    // provision ALWAYS creates (Vercel binding + Cloudflare CNAME). Re-derive it from
-    // the slug (same as the `--adopt` shape + the `--domain` dry-run already do) so
-    // `--destroy` tears down the dev CNAME instead of orphaning it. Gated on `dns`
-    // being present (no DNS step → no dev domain to remove); passed through the same
+    // The `dns` block now records the interim DEV domain (`{slug}-dev.timekast.mx`)
+    // alongside prod, but it stays derivable from the slug. Prefer the persisted value
+    // and fall back to deriving it (state files written before `devDomain` existed) so
+    // `--destroy` tears down the dev CNAME instead of orphaning it. Gated on `dns` being
+    // present (no DNS step → no dev domain to remove); passed through the same
     // `realDomain` shape guard as every other low-trust domain field.
-    const devDomain = step.dns ? realDomain(provisionDomains(step.projectName).dev) : null;
+    const devDomain = step.dns
+        ? realDomain(step.dns.devDomain ?? provisionDomains(step.projectName).dev)
+        : null;
     const domains = [
         realDomain(step.dns?.domain),
         devDomain,

package/dist/lib/validate-name.js

@@ -13,7 +13,12 @@ const VALID_NAME = /^[A-Za-z0-9._-]+$/;
 const FORMAT_HINT = 'El nombre solo puede contener letras, números, guiones (-), guiones bajos (_) y puntos (.), ' +
     'sin espacios, y no puede empezar con `-` ni `.`.';
 /**
- * Validate a project name. Returns the trimmed name on success.
+ * Validate a project name. Returns the trimmed, LOWERCASED name on success — every
+ * derived resource (local dir, GitHub repo, `package.json.name`, the `{slug}` /
+ * `{slug}-dev` provision subdomains) must be lowercase, so this is the single
+ * chokepoint that normalizes it. GitHub repo names and DNS labels are
+ * case-insensitive, and `provision` rejects an uppercase slug outright — creating
+ * the repo lowercase here keeps `new` and `provision` from disagreeing on casing.
  * @throws {CLIError} with the allowed-format hint on any invalid input.
  */
 export function validateProjectName(raw) {
@@ -30,5 +35,5 @@ export function validateProjectName(raw) {
     if (!VALID_NAME.test(name)) {
         throw new CLIError(`Nombre inválido: \`${name}\` contiene caracteres no permitidos.\n${FORMAT_HINT}`);
     }
-    return name;
+    return name.toLowerCase();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.13.0",
+  "version": "1.14.2",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",