@timekast/factory 1.17.0 → 1.17.2

package/dist/commands/provision.js

@@ -1556,7 +1556,7 @@ async function retireInterimDomain(projectId, token, teamId, state, deps, fetchI
     // The DEV domain is intentionally never touched (issue §4 — conserved).
 }
 /**
- * Update `EMAIL_FROM` + `AUTH_URL`/`NEXTAUTH_URL` to the client domain in the
+ * Update `EMAIL_FROM` + `AUTH_URL`/`NEXTAUTH_URL` + `NEXT_PUBLIC_APP_URL` to the client domain in the
  * Vercel env, per-target and idempotently (PROV-006 §4). Lists the existing vars
  * once; an `AUTH_URL`/`NEXTAUTH_URL`/`EMAIL_FROM` already set to the target value
  * has its PATCH omitted (issue §8 — second run is a no-op). No-echo: only KEY
@@ -1574,6 +1574,9 @@ async function updateDomainEnv(projectId, token, teamId, domain, deps) {
         },
         { key: 'AUTH_URL', value: authUrl, target: ['production', 'preview'] },
         { key: 'NEXTAUTH_URL', value: authUrl, target: ['production', 'preview'] },
+        // Keep the public app origin in lockstep with AUTH_URL once a client domain lands
+        // (the substrate set it to the interim domain in buildEnvPlan; this re-points it).
+        { key: 'NEXT_PUBLIC_APP_URL', value: authUrl, target: ['production', 'preview'] },
     ];
     const existing = await listEnvVars(projectId, token, teamId, deps);
     for (const entry of plan) {
@@ -1599,7 +1602,7 @@ function printClientDomainPlan(domain, interim, route, confirm) {
     console.log(`  … sondea GET /v9/projects/.../domains/${domain} hasta verified:true (o timeout)`);
     console.log(`  ${confirm ? '－' : '? (requiere --confirm o prompt)'} retira el interino ${interim} ` +
         `(el dev ${domain}-dev se conserva)`);
-    console.log(`  ↻ EMAIL_FROM=noreply@${mailDomainFor(domain)} · AUTH_URL=https://${domain} · NEXTAUTH_URL=https://${domain}`);
+    console.log(`  ↻ EMAIL_FROM=noreply@${mailDomainFor(domain)} · AUTH_URL=https://${domain} · NEXTAUTH_URL=https://${domain} · NEXT_PUBLIC_APP_URL=https://${domain}`);
     console.log(`  ＋ Resend: POST /domains { name: ${mailDomainFor(domain)} } (subdominio mail, no el apex)`);
     console.log('\n(`--dry-run`) No se ejecutó ninguna llamada a API ni se escribió estado.');
 }

package/dist/index.js

@@ -151,6 +151,13 @@ async function main(argv) {
         console.log(HELP);
         return;
     }
+    // A `--help`/`-h` flag ANYWHERE (e.g. `factory env push --help`) prints help and
+    // NEVER runs the command. A help flag must never trigger a mutation: `env push --help`
+    // used to fire a REAL Vercel push, because the check above only inspects the first arg.
+    if (rest.includes('--help') || rest.includes('-h')) {
+        console.log(HELP);
+        return;
+    }
     // No command at all → interactive TUI menu (LTUI-001). The menu degrades to
     // HELP itself when there's no TTY (CI / pipe), so it never hangs.
     if (command === undefined) {

package/dist/lib/atomic-swap.js

@@ -26,21 +26,21 @@ import { CLIError } from './cli-error.js';
 import { CLAUDE_MD_FILE, TIMEKAST_DIR } from './constants.js';
 import { parseLockfile } from './lockfile.js';
 /** Roots a manifest path may live under (mirrors `profiles.json#track`). */
-const ALLOWED_ROOTS = ['.claude/', 'scripts/'];
+const ALLOWED_ROOTS = ['.claude/', 'scripts/', '.husky/'];
 /**
  * Reject a manifest path that is unsafe to write: absolute, escaping via `..`, or
- * outside the tracked scope (`.claude/**`, `scripts/**`, `CLAUDE.md`). A correct
+ * outside the tracked scope (`.claude/**`, `scripts/**`, `CLAUDE.md`, `.husky/**`). A correct
  * release never produces these — this guards a mispublished/tampered tarball from
  * writing `src/` or escaping the repo root. Separator-agnostic (Windows-safe).
  */
-function assertSafeTrackedPath(rel) {
+export function assertSafeTrackedPath(rel) {
     const segments = rel.split(/[\\/]/);
     if (rel.length === 0 || path.isAbsolute(rel) || segments.includes('..')) {
         throw new CLIError(`El manifest declara un path inseguro \`${rel}\` (absoluto o con \`..\`); no se tocó nada.`);
     }
     const tracked = rel === CLAUDE_MD_FILE || ALLOWED_ROOTS.some((root) => rel.startsWith(root));
     if (!tracked) {
-        throw new CLIError(`El manifest declara \`${rel}\`, fuera del scope rastreado (\`.claude/\`, \`scripts/\`, \`CLAUDE.md\`). ` +
+        throw new CLIError(`El manifest declara \`${rel}\`, fuera del scope rastreado (\`.claude/\`, \`scripts/\`, \`CLAUDE.md\`, \`.husky/\`). ` +
             'El release está mal construido; no se tocó nada.');
     }
 }

package/dist/lib/env-file.js

@@ -25,6 +25,10 @@ export const PROVISION_OWNED = new Set([
     'DATABASE_URL_MAIN',
     'AUTH_SECRET',
     'NEXT_PUBLIC_APP_ENV',
+    // Per-env app origin: provision sets it to the real domain per environment
+    // (prod/preview); `env:push` must NOT re-upload the `localhost:3000` default of
+    // `.env.local`, which would break links / OAuth callbacks / the PWA manifest in prod.
+    'NEXT_PUBLIC_APP_URL',
     // Provision mints these per-env too (P-1): the MFA key (base64url) + the
     // WebAuthn rpID (the exact host). A shared day-2 push would break passkeys
     // (rpID must match the env's host) or the at-rest TOTP crypto.

package/dist/lib/vercel-env.js

@@ -470,6 +470,20 @@ export function buildEnvPlan(input) {
         // Deployment identity — drives the env-aware PWA manifest (see .env.example).
         { key: 'NEXT_PUBLIC_APP_ENV', value: 'production', target: ['production'] },
         { key: 'NEXT_PUBLIC_APP_ENV', value: 'preview', target: ['preview'] },
+        // App origin — the EXACT per-env URL (same host as WEBAUTHN_RP_ID), so links,
+        // OAuth callbacks and the PWA manifest resolve to the real domain instead of the
+        // `localhost:3000` default of `.env.local`. Per-env (PROVISION_OWNED) → `env:push`
+        // never overwrites it with a single shared value (P-1 parity with the other hosts).
+        {
+            key: 'NEXT_PUBLIC_APP_URL',
+            value: `https://${input.webauthnRpIdProd}`,
+            target: ['production'],
+        },
+        {
+            key: 'NEXT_PUBLIC_APP_URL',
+            value: `https://${input.webauthnRpIdPreview}`,
+            target: ['preview'],
+        },
     ];
     for (const [key, value] of Object.entries(input.shared ?? {})) {
         if (!value)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.17.0",
+  "version": "1.17.2",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",