@timekast/factory 1.15.0 → 1.16.0

package/dist/commands/provision.js

@@ -28,7 +28,7 @@ import { CLIError } from '../lib/cli-error.js';
 import { apexZoneOf, CloudflareApiError, CLOUDFLARE_API_BASE, ensureCnameRecord, findCnameRecord, resolveZoneId, resolveZoneIdForName, CNAME_VERCEL_TARGET, TIMEKAST_ZONE_NAME, provisionDomains, } from '../lib/cloudflare-api.js';
 import { createDevelopBranch, createNeonProject, createProjectApiKey, deleteNeonApiKeysByName, deleteNeonProject, getConnectionUri, listNeonBranches, listNeonProjects, NeonApiError, NEON_API_BASE, NEON_DEVELOP_BRANCH, } from '../lib/neon-api.js';
 import { defaultEnvPath, readVercelToken, runProvisionPreflight, } from '../lib/provision-preflight.js';
-import { addVercelDomain, buildEnvPlan, createVercelProject, generateAuthSecret, getLinkedRepoId, getVercelDomainStatus, GitHubAppNotInstalledError, linkGitRepo, listVercelProjects, patchProjectSettings, pushEnvPlan, removeVercelDomain, triggerDeployment, upsertEnvVar, listEnvVars, VercelApiError, writeVercelProjectJson, } from '../lib/vercel-env.js';
+import { addVercelDomain, buildEnvPlan, createVercelProject, generateAuthSecret, generateMfaEncryptionKey, getLinkedRepoId, getVercelDomainStatus, GitHubAppNotInstalledError, linkGitRepo, listVercelProjects, patchProjectSettings, pushEnvPlan, removeVercelDomain, triggerDeployment, upsertEnvVar, listEnvVars, VercelApiError, writeVercelProjectJson, } from '../lib/vercel-env.js';
 import { writeEnvLocal } from '../lib/env-file.js';
 import { adoptState, ADOPT_UNKNOWN, clearProvisionState, clearState, hasProvisionState, isServiceComplete, PROVISION_DIR, PROVISION_STATE_FILE, readDestroyTarget, readProvisionState, writeProvisionState, } from '../lib/provision-state.js';
 /**
@@ -652,11 +652,21 @@ export async function provisionVercel(rootDir, state, teamId, deps = {}) {
     writeVercelProjectJson(rootDir, { projectId, orgId: teamId, teamId }, { force: deps.force });
     // Mint an INDEPENDENT AUTH_SECRET per environment (issue §4 — never shared).
     // POOLED strings → the Vercel runtime DATABASE_URL (serverless/concurrent).
+    // WebAuthn rpID = the EXACT host per env (provision's interim domains). A passkey
+    // dies if the rpID changes, so a later custom-domain swap (--domain / PROV-006)
+    // must also re-point WEBAUTHN_RP_ID — tracked as a follow-up. MFA_ENCRYPTION_KEY
+    // is minted independently per env (base64url) so a derivative with MFA enabled
+    // never boots broken (P-1).
+    const rpDomains = provisionDomains(state.projectName);
     const plan = buildEnvPlan({
         mainDatabaseUrl: neonSecrets.mainPooled,
         developDatabaseUrl: neonSecrets.developPooled,
         authSecretProd: generateAuthSecret(),
         authSecretPreview: generateAuthSecret(),
+        mfaEncryptionKeyProd: generateMfaEncryptionKey(),
+        mfaEncryptionKeyPreview: generateMfaEncryptionKey(),
+        webauthnRpIdProd: rpDomains.prod,
+        webauthnRpIdPreview: rpDomains.dev,
         shared: readSharedVercelEnv(envPath),
     });
     let result;

package/dist/lib/env-file.js

@@ -25,6 +25,11 @@ export const PROVISION_OWNED = new Set([
     'DATABASE_URL_MAIN',
     'AUTH_SECRET',
     'NEXT_PUBLIC_APP_ENV',
+    // Provision mints these per-env too (P-1): the MFA key (base64url) + the
+    // WebAuthn rpID (the exact host). A shared day-2 push would break passkeys
+    // (rpID must match the env's host) or the at-rest TOTP crypto.
+    'MFA_ENCRYPTION_KEY',
+    'WEBAUTHN_RP_ID',
 ]);
 /**
  * Replace the value of `KEY=...` in an env-file body, preserving every other line.

package/dist/lib/vercel-env.js

@@ -369,6 +369,17 @@ export async function upsertEnvVar(projectId, token, teamId, plan, existing, dep
 export function generateAuthSecret() {
     return randomBytes(32).toString('hex');
 }
+/**
+ * Generate a fresh `MFA_ENCRYPTION_KEY` — the AES-256 key the runtime uses to
+ * encrypt TOTP secrets at rest (`src/lib/auth/totp-crypto.ts`). It MUST be
+ * base64url of EXACTLY 32 bytes — NOT hex like `AUTH_SECRET` (the runtime rejects
+ * a wrong-length/format key). Minted independently per environment so prod and
+ * preview never share it. Without this var a derivative with MFA enabled boots
+ * broken (P-1).
+ */
+export function generateMfaEncryptionKey() {
+    return randomBytes(32).toString('base64url');
+}
 /** Absolute path to `.vercel/project.json` under a repo root. */
 export function vercelProjectPath(rootDir) {
     return path.join(rootDir, VERCEL_DIR, VERCEL_PROJECT_FILE);
@@ -447,6 +458,15 @@ export function buildEnvPlan(input) {
         // Auth secret — distinct value per environment (never shared).
         { key: 'AUTH_SECRET', value: input.authSecretProd, target: ['production'] },
         { key: 'AUTH_SECRET', value: input.authSecretPreview, target: ['preview'] },
+        // MFA encryption key — distinct per env (base64url 32 bytes). Without it a
+        // derivative with MFA enabled boots broken; minted independently so prod and
+        // preview never share it (P-1).
+        { key: 'MFA_ENCRYPTION_KEY', value: input.mfaEncryptionKeyProd, target: ['production'] },
+        { key: 'MFA_ENCRYPTION_KEY', value: input.mfaEncryptionKeyPreview, target: ['preview'] },
+        // WebAuthn relying-party id — the EXACT host per env (a passkey dies if the
+        // rpID changes), so passkeys work without manual Vercel setup (P-1 / PASSKEY-002 §8).
+        { key: 'WEBAUTHN_RP_ID', value: input.webauthnRpIdProd, target: ['production'] },
+        { key: 'WEBAUTHN_RP_ID', value: input.webauthnRpIdPreview, target: ['preview'] },
         // Deployment identity — drives the env-aware PWA manifest (see .env.example).
         { key: 'NEXT_PUBLIC_APP_ENV', value: 'production', target: ['production'] },
         { key: 'NEXT_PUBLIC_APP_ENV', value: 'preview', target: ['preview'] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",