@timekast/factory 1.17.3 → 1.17.5

package/dist/commands/provision.js

@@ -29,7 +29,7 @@ import { apexZoneOf, CloudflareApiError, CLOUDFLARE_API_BASE, ensureCnameRecord,
 import { createDevelopBranch, createNeonProject, createProjectApiKey, deleteNeonApiKeysByName, deleteNeonProject, getConnectionUri, listNeonBranches, listNeonProjects, NeonApiError, NEON_API_BASE, NEON_DEVELOP_BRANCH, } from '../lib/neon-api.js';
 import { defaultEnvPath, readVercelToken, runProvisionPreflight, } from '../lib/provision-preflight.js';
 import { addVercelDomain, buildEnvPlan, createVercelProject, generateAuthSecret, generateMfaEncryptionKey, getLinkedRepoId, getVercelDomainStatus, GitHubAppNotInstalledError, linkGitRepo, listVercelProjects, patchProjectSettings, pushEnvPlan, removeVercelDomain, triggerDeployment, upsertEnvVar, listEnvVars, VercelApiError, writeVercelProjectJson, } from '../lib/vercel-env.js';
-import { writeE2eLocalCreds, writeEnvLocal } from '../lib/env-file.js';
+import { writeE2eLocalCreds, writeEmailLocalCreds, writeEnvLocal } from '../lib/env-file.js';
 import { adoptState, ADOPT_UNKNOWN, clearProvisionState, clearState, hasProvisionState, isServiceComplete, PROVISION_DIR, PROVISION_STATE_FILE, readDestroyTarget, readProvisionState, writeProvisionState, } from '../lib/provision-state.js';
 /**
  * The THREE GitHub Secrets the E2E runner (`pnpm test:e2e` → `e2e-runner.ts` +
@@ -752,6 +752,12 @@ export async function provisionVercel(rootDir, state, teamId, deps = {}) {
         writeE2eLocalCreds(rootDir, state.neon.projectId, readNeonApiKey(envPath))) {
         console.log('  ＋ .env.local (NEON_API_KEY · NEON_PROJECT_ID — para `pnpm test:e2e` local)');
     }
+    // Email config: write the org Resend key (from the rail) + the fixed EMAIL_FROM so local
+    // sends (`invite:admin`, magic-link, `db:seed`) DELIVER instead of the console fallback.
+    // No-op without a rail key. Non-prod sends are auto-tagged `[Dev]` by the dispatcher.
+    if (writeEmailLocalCreds(rootDir, readGateValue('RESEND_API_KEY', envPath), PROVISION_EMAIL_FROM)) {
+        console.log('  ＋ .env.local (EMAIL_PROVIDER=resend · RESEND_API_KEY · EMAIL_FROM — envío de correo local)');
+    }
     // `pnpm install` the derived dir (issue §4). A missing package.json (non-Node
     // derivative) is reported, NOT fatal (issue §8).
     if (existsSync(join(rootDir, 'package.json'))) {
@@ -2499,6 +2505,12 @@ export async function runProvision(flags) {
             console.log('  ＋ .env.local (NEON_API_KEY · NEON_PROJECT_ID — para `pnpm test:e2e` local)');
         }
     }
+    // Same for email config on resume/adopt (writeEmailLocalCreds only runs in the first
+    // provisionVercel pass). Idempotent — setEnvLine replaces/appends. No-op without a rail key.
+    if (!flags.dryRun &&
+        writeEmailLocalCreds(rootDir, readGateValue('RESEND_API_KEY', defaultEnvPath()), PROVISION_EMAIL_FROM)) {
+        console.log('  ＋ .env.local (EMAIL_PROVIDER=resend · RESEND_API_KEY · EMAIL_FROM — envío de correo local)');
+    }
     // 5b. Client domain (PROV-006) — runs AFTER the services so the Vercel project
     //     (and the interim domains) already exist. Standalone patch or post-services.
     if (hasDomain) {

package/dist/lib/env-file.js

@@ -108,3 +108,32 @@ export function writeE2eLocalCreds(rootDir, projectId, apiKey) {
     chmodSync(localPath, 0o600); // holds NEON_API_KEY → owner-only.
     return true;
 }
+/**
+ * Write the org email config into `.env.local` so local sends (`invite:admin`, magic-link,
+ * `db:seed`) actually DELIVER instead of falling back to the console. Sets `EMAIL_PROVIDER=resend`
+ * + `RESEND_API_KEY` (the org key from the rail — already on the dev's host; global, not per-env)
+ * + `EMAIL_FROM` (the fixed org sender). Non-production sends are auto-tagged `[Dev]` by the
+ * dispatcher (`src/lib/email/index.ts`), so local delivery is safe AND distinguishable.
+ *
+ * This closes the source-inconsistency bug: `invite-admin --target main` writes to the prod DB
+ * but the script always reads email config from `.env.local` — which provision otherwise never
+ * populated (it only synced Resend to Vercel), so the invite email silently fell back to console.
+ *
+ * Returns false (no-op) when the rail key is missing or `.env.local` does not exist yet
+ * (`writeEnvLocal` creates it first). Safe on an existing file: `setEnvLine` only touches these
+ * three keys, preserving the rest.
+ */
+export function writeEmailLocalCreds(rootDir, resendKey, emailFrom) {
+    if (!resendKey)
+        return false;
+    const localPath = join(rootDir, '.env.local');
+    if (!existsSync(localPath))
+        return false;
+    let body = readFileSync(localPath, 'utf8');
+    body = setEnvLine(body, 'EMAIL_PROVIDER', 'resend');
+    body = setEnvLine(body, 'RESEND_API_KEY', resendKey);
+    body = setEnvLine(body, 'EMAIL_FROM', emailFrom);
+    writeFileSync(localPath, body, 'utf8');
+    chmodSync(localPath, 0o600); // holds RESEND_API_KEY → owner-only.
+    return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.17.3",
+  "version": "1.17.5",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",
@@ -35,6 +35,7 @@
     "prepublishOnly": "pnpm build",
     "test": "vitest run",
     "test:unit": "vitest run tests/unit",
+    "test:provision": "vitest run tests/integration/provision-cycle.test.ts",
     "test:watch": "vitest"
   },
   "dependencies": {