@timekast/factory 1.17.1 → 1.17.3

package/dist/commands/provision.js

@@ -1556,7 +1556,7 @@ async function retireInterimDomain(projectId, token, teamId, state, deps, fetchI
     // The DEV domain is intentionally never touched (issue §4 — conserved).
 }
 /**
- * Update `EMAIL_FROM` + `AUTH_URL`/`NEXTAUTH_URL` to the client domain in the
+ * Update `EMAIL_FROM` + `AUTH_URL`/`NEXTAUTH_URL` + `NEXT_PUBLIC_APP_URL` to the client domain in the
  * Vercel env, per-target and idempotently (PROV-006 §4). Lists the existing vars
  * once; an `AUTH_URL`/`NEXTAUTH_URL`/`EMAIL_FROM` already set to the target value
  * has its PATCH omitted (issue §8 — second run is a no-op). No-echo: only KEY
@@ -1574,6 +1574,9 @@ async function updateDomainEnv(projectId, token, teamId, domain, deps) {
         },
         { key: 'AUTH_URL', value: authUrl, target: ['production', 'preview'] },
         { key: 'NEXTAUTH_URL', value: authUrl, target: ['production', 'preview'] },
+        // Keep the public app origin in lockstep with AUTH_URL once a client domain lands
+        // (the substrate set it to the interim domain in buildEnvPlan; this re-points it).
+        { key: 'NEXT_PUBLIC_APP_URL', value: authUrl, target: ['production', 'preview'] },
     ];
     const existing = await listEnvVars(projectId, token, teamId, deps);
     for (const entry of plan) {
@@ -1599,7 +1602,7 @@ function printClientDomainPlan(domain, interim, route, confirm) {
     console.log(`  … sondea GET /v9/projects/.../domains/${domain} hasta verified:true (o timeout)`);
     console.log(`  ${confirm ? '－' : '? (requiere --confirm o prompt)'} retira el interino ${interim} ` +
         `(el dev ${domain}-dev se conserva)`);
-    console.log(`  ↻ EMAIL_FROM=noreply@${mailDomainFor(domain)} · AUTH_URL=https://${domain} · NEXTAUTH_URL=https://${domain}`);
+    console.log(`  ↻ EMAIL_FROM=noreply@${mailDomainFor(domain)} · AUTH_URL=https://${domain} · NEXTAUTH_URL=https://${domain} · NEXT_PUBLIC_APP_URL=https://${domain}`);
     console.log(`  ＋ Resend: POST /domains { name: ${mailDomainFor(domain)} } (subdominio mail, no el apex)`);
     console.log('\n(`--dry-run`) No se ejecutó ninguna llamada a API ni se escribió estado.');
 }
@@ -2487,6 +2490,15 @@ export async function runProvision(flags) {
         await provisionNeon(rootDir, runState);
         writeProvisionState(rootDir, runState);
     }
+    // 5a.2. Ensure the local E2E creds are in `.env.local` even on a resume/adopt where
+    //       the Vercel substrate was already `done` (writeE2eLocalCreds only runs inside
+    //       that step's first pass). Idempotent — `setEnvLine` replaces/appends the two
+    //       keys — so `pnpm test:e2e` works locally without a manual edit after a re-run.
+    if (!flags.dryRun && runState.neon?.projectId) {
+        if (writeE2eLocalCreds(rootDir, runState.neon.projectId, readNeonApiKey())) {
+            console.log('  ＋ .env.local (NEON_API_KEY · NEON_PROJECT_ID — para `pnpm test:e2e` local)');
+        }
+    }
     // 5b. Client domain (PROV-006) — runs AFTER the services so the Vercel project
     //     (and the interim domains) already exist. Standalone patch or post-services.
     if (hasDomain) {

package/dist/index.js

@@ -151,6 +151,13 @@ async function main(argv) {
         console.log(HELP);
         return;
     }
+    // A `--help`/`-h` flag ANYWHERE (e.g. `factory env push --help`) prints help and
+    // NEVER runs the command. A help flag must never trigger a mutation: `env push --help`
+    // used to fire a REAL Vercel push, because the check above only inspects the first arg.
+    if (rest.includes('--help') || rest.includes('-h')) {
+        console.log(HELP);
+        return;
+    }
     // No command at all → interactive TUI menu (LTUI-001). The menu degrades to
     // HELP itself when there's no TTY (CI / pipe), so it never hangs.
     if (command === undefined) {

package/dist/lib/env-file.js

@@ -25,6 +25,10 @@ export const PROVISION_OWNED = new Set([
     'DATABASE_URL_MAIN',
     'AUTH_SECRET',
     'NEXT_PUBLIC_APP_ENV',
+    // Per-env app origin: provision sets it to the real domain per environment
+    // (prod/preview); `env:push` must NOT re-upload the `localhost:3000` default of
+    // `.env.local`, which would break links / OAuth callbacks / the PWA manifest in prod.
+    'NEXT_PUBLIC_APP_URL',
     // Provision mints these per-env too (P-1): the MFA key (base64url) + the
     // WebAuthn rpID (the exact host). A shared day-2 push would break passkeys
     // (rpID must match the env's host) or the at-rest TOTP crypto.

package/dist/lib/vercel-env.js

@@ -470,6 +470,20 @@ export function buildEnvPlan(input) {
         // Deployment identity — drives the env-aware PWA manifest (see .env.example).
         { key: 'NEXT_PUBLIC_APP_ENV', value: 'production', target: ['production'] },
         { key: 'NEXT_PUBLIC_APP_ENV', value: 'preview', target: ['preview'] },
+        // App origin — the EXACT per-env URL (same host as WEBAUTHN_RP_ID), so links,
+        // OAuth callbacks and the PWA manifest resolve to the real domain instead of the
+        // `localhost:3000` default of `.env.local`. Per-env (PROVISION_OWNED) → `env:push`
+        // never overwrites it with a single shared value (P-1 parity with the other hosts).
+        {
+            key: 'NEXT_PUBLIC_APP_URL',
+            value: `https://${input.webauthnRpIdProd}`,
+            target: ['production'],
+        },
+        {
+            key: 'NEXT_PUBLIC_APP_URL',
+            value: `https://${input.webauthnRpIdPreview}`,
+            target: ['preview'],
+        },
     ];
     for (const [key, value] of Object.entries(input.shared ?? {})) {
         if (!value)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.17.1",
+  "version": "1.17.3",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",