@timekast/factory 1.17.3 → 1.18.0

package/dist/commands/provision.js

@@ -29,7 +29,7 @@ import { apexZoneOf, CloudflareApiError, CLOUDFLARE_API_BASE, ensureCnameRecord,
 import { createDevelopBranch, createNeonProject, createProjectApiKey, deleteNeonApiKeysByName, deleteNeonProject, getConnectionUri, listNeonBranches, listNeonProjects, NeonApiError, NEON_API_BASE, NEON_DEVELOP_BRANCH, } from '../lib/neon-api.js';
 import { defaultEnvPath, readVercelToken, runProvisionPreflight, } from '../lib/provision-preflight.js';
 import { addVercelDomain, buildEnvPlan, createVercelProject, generateAuthSecret, generateMfaEncryptionKey, getLinkedRepoId, getVercelDomainStatus, GitHubAppNotInstalledError, linkGitRepo, listVercelProjects, patchProjectSettings, pushEnvPlan, removeVercelDomain, triggerDeployment, upsertEnvVar, listEnvVars, VercelApiError, writeVercelProjectJson, } from '../lib/vercel-env.js';
-import { writeE2eLocalCreds, writeEnvLocal } from '../lib/env-file.js';
+import { writeE2eLocalCreds, writeEmailLocalCreds, writeEnvLocal } from '../lib/env-file.js';
 import { adoptState, ADOPT_UNKNOWN, clearProvisionState, clearState, hasProvisionState, isServiceComplete, PROVISION_DIR, PROVISION_STATE_FILE, readDestroyTarget, readProvisionState, writeProvisionState, } from '../lib/provision-state.js';
 /**
  * The THREE GitHub Secrets the E2E runner (`pnpm test:e2e` → `e2e-runner.ts` +
@@ -752,6 +752,12 @@ export async function provisionVercel(rootDir, state, teamId, deps = {}) {
         writeE2eLocalCreds(rootDir, state.neon.projectId, readNeonApiKey(envPath))) {
         console.log('  ＋ .env.local (NEON_API_KEY · NEON_PROJECT_ID — para `pnpm test:e2e` local)');
     }
+    // Email config: write the org Resend key (from the rail) + the fixed EMAIL_FROM so local
+    // sends (`invite:admin`, magic-link, `db:seed`) DELIVER instead of the console fallback.
+    // No-op without a rail key. Non-prod sends are auto-tagged `[Dev]` by the dispatcher.
+    if (writeEmailLocalCreds(rootDir, readGateValue('RESEND_API_KEY', envPath), PROVISION_EMAIL_FROM)) {
+        console.log('  ＋ .env.local (EMAIL_PROVIDER=resend · RESEND_API_KEY · EMAIL_FROM — envío de correo local)');
+    }
     // `pnpm install` the derived dir (issue §4). A missing package.json (non-Node
     // derivative) is reported, NOT fatal (issue §8).
     if (existsSync(join(rootDir, 'package.json'))) {
@@ -2499,6 +2505,12 @@ export async function runProvision(flags) {
             console.log('  ＋ .env.local (NEON_API_KEY · NEON_PROJECT_ID — para `pnpm test:e2e` local)');
         }
     }
+    // Same for email config on resume/adopt (writeEmailLocalCreds only runs in the first
+    // provisionVercel pass). Idempotent — setEnvLine replaces/appends. No-op without a rail key.
+    if (!flags.dryRun &&
+        writeEmailLocalCreds(rootDir, readGateValue('RESEND_API_KEY', defaultEnvPath()), PROVISION_EMAIL_FROM)) {
+        console.log('  ＋ .env.local (EMAIL_PROVIDER=resend · RESEND_API_KEY · EMAIL_FROM — envío de correo local)');
+    }
     // 5b. Client domain (PROV-006) — runs AFTER the services so the Vercel project
     //     (and the interim domains) already exist. Standalone patch or post-services.
     if (hasDomain) {

package/dist/lib/constants.js

@@ -123,38 +123,39 @@ export const INVITE_ADMIN_SCRIPT_CMD = 'npx @timekast/factory invite-admin';
 export const INVITE_ADMIN_SCRIPT_FILE = 'scripts/tools/invite-admin.ts';
 /**
  * Kit-local reference generators — autogen of `project/reference/*` (INVENTORY,
- * CODEBASE, HOOKS, SCHEMA, API). Each shells a `scripts/tools/generate-*.mjs`
- * that ships with the FULL brain, so the installer ensures each alias ONLY when
- * its backing file exists (file-gated, insert-if-missing — same contract as
- * `preflight`). A derivative bootstrapped before a generator existed self-heals
- * the alias on the next `update`/`beta` (the script file arrives via `scripts/**`
- * in the tracked set, then the alias appears). Never overwrites a dev's own value.
+ * CODEBASE, HOOKS, SCHEMA, API). Each shells a `scripts/tools/generate-*.ts`
+ * (run via `tsx`, same as the other TS tools) that ships with the FULL brain, so
+ * the installer ensures each alias ONLY when its backing file exists (file-gated,
+ * insert-if-missing — same contract as `preflight`). A derivative bootstrapped
+ * before a generator existed self-heals the alias on the next `update`/`beta`
+ * (the script file arrives via `scripts/**` in the tracked set, then the alias
+ * appears). Never overwrites a dev's own value.
  */
 export const GENERATOR_SCRIPTS = [
     {
         name: 'generate:inventory',
-        cmd: 'node scripts/tools/generate-inventory.mjs',
-        file: 'scripts/tools/generate-inventory.mjs',
+        cmd: 'tsx scripts/tools/generate-inventory.ts',
+        file: 'scripts/tools/generate-inventory.ts',
     },
     {
         name: 'generate:codebase',
-        cmd: 'node scripts/tools/generate-codebase.mjs',
-        file: 'scripts/tools/generate-codebase.mjs',
+        cmd: 'tsx scripts/tools/generate-codebase.ts',
+        file: 'scripts/tools/generate-codebase.ts',
     },
     {
         name: 'generate:hooks',
-        cmd: 'node scripts/tools/generate-hooks.mjs',
-        file: 'scripts/tools/generate-hooks.mjs',
+        cmd: 'tsx scripts/tools/generate-hooks.ts',
+        file: 'scripts/tools/generate-hooks.ts',
     },
     {
         name: 'generate:schema',
-        cmd: 'node scripts/tools/generate-schema.mjs',
-        file: 'scripts/tools/generate-schema.mjs',
+        cmd: 'tsx scripts/tools/generate-schema.ts',
+        file: 'scripts/tools/generate-schema.ts',
     },
     {
         name: 'generate:api',
-        cmd: 'node scripts/tools/generate-api.mjs',
-        file: 'scripts/tools/generate-api.mjs',
+        cmd: 'tsx scripts/tools/generate-api.ts',
+        file: 'scripts/tools/generate-api.ts',
     },
 ];
 /**
@@ -165,5 +166,21 @@ export const GENERATOR_SCRIPTS = [
  * generator set shipped" (they ship together in the FULL brain).
  */
 export const GENERATE_REFERENCE_NAME = 'generate:reference';
-export const GENERATE_REFERENCE_CMD = 'node scripts/tools/generate-inventory.mjs && node scripts/tools/generate-codebase.mjs && node scripts/tools/generate-hooks.mjs && node scripts/tools/generate-schema.mjs && node scripts/tools/generate-api.mjs';
-export const GENERATE_REFERENCE_GATE_FILE = 'scripts/tools/generate-schema.mjs';
+export const GENERATE_REFERENCE_CMD = 'tsx scripts/tools/generate-inventory.ts && tsx scripts/tools/generate-codebase.ts && tsx scripts/tools/generate-hooks.ts && tsx scripts/tools/generate-schema.ts && tsx scripts/tools/generate-api.ts';
+export const GENERATE_REFERENCE_GATE_FILE = 'scripts/tools/generate-schema.ts';
+/**
+ * Update-time healing registry: for each kit-owned script, the prior command(s)
+ * the kit used to ship. When the kit changes HOW a script is invoked (e.g. the
+ * `node`/`.mjs` → `tsx`/`.ts` migration of the reference generators), an existing
+ * derivative carries the OLD command in its `package.json`; `factory update`
+ * overwrites that stale kit-owned alias with the current command — but NEVER a
+ * value the dev diverged on their own (see `ensureFactoryScripts`). Add an entry
+ * whenever a kit-owned script's invocation changes, so existing derivatives
+ * self-heal on their next update instead of pointing at a deleted file.
+ */
+export const OBSOLETE_SCRIPT_CMDS = {
+    ...Object.fromEntries(GENERATOR_SCRIPTS.map((g) => [g.name, [`node ${g.file.replace(/\.ts$/, '.mjs')}`]])),
+    [GENERATE_REFERENCE_NAME]: [
+        GENERATOR_SCRIPTS.map((g) => `node ${g.file.replace(/\.ts$/, '.mjs')}`).join(' && '),
+    ],
+};

package/dist/lib/env-file.js

@@ -108,3 +108,32 @@ export function writeE2eLocalCreds(rootDir, projectId, apiKey) {
     chmodSync(localPath, 0o600); // holds NEON_API_KEY → owner-only.
     return true;
 }
+/**
+ * Write the org email config into `.env.local` so local sends (`invite:admin`, magic-link,
+ * `db:seed`) actually DELIVER instead of falling back to the console. Sets `EMAIL_PROVIDER=resend`
+ * + `RESEND_API_KEY` (the org key from the rail — already on the dev's host; global, not per-env)
+ * + `EMAIL_FROM` (the fixed org sender). Non-production sends are auto-tagged `[Dev]` by the
+ * dispatcher (`src/lib/email/index.ts`), so local delivery is safe AND distinguishable.
+ *
+ * This closes the source-inconsistency bug: `invite-admin --target main` writes to the prod DB
+ * but the script always reads email config from `.env.local` — which provision otherwise never
+ * populated (it only synced Resend to Vercel), so the invite email silently fell back to console.
+ *
+ * Returns false (no-op) when the rail key is missing or `.env.local` does not exist yet
+ * (`writeEnvLocal` creates it first). Safe on an existing file: `setEnvLine` only touches these
+ * three keys, preserving the rest.
+ */
+export function writeEmailLocalCreds(rootDir, resendKey, emailFrom) {
+    if (!resendKey)
+        return false;
+    const localPath = join(rootDir, '.env.local');
+    if (!existsSync(localPath))
+        return false;
+    let body = readFileSync(localPath, 'utf8');
+    body = setEnvLine(body, 'EMAIL_PROVIDER', 'resend');
+    body = setEnvLine(body, 'RESEND_API_KEY', resendKey);
+    body = setEnvLine(body, 'EMAIL_FROM', emailFrom);
+    writeFileSync(localPath, body, 'utf8');
+    chmodSync(localPath, 0o600); // holds RESEND_API_KEY → owner-only.
+    return true;
+}

package/dist/lib/package-json.js

@@ -8,7 +8,7 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { CLIError } from './cli-error.js';
-import { FACTORY_SCRIPTS, GENERATE_REFERENCE_CMD, GENERATE_REFERENCE_GATE_FILE, GENERATE_REFERENCE_NAME, GENERATOR_SCRIPTS, INVITE_ADMIN_SCRIPT_CMD, INVITE_ADMIN_SCRIPT_FILE, INVITE_ADMIN_SCRIPT_NAME, PREFLIGHT_SCRIPT_CMD, PREFLIGHT_SCRIPT_FILE, PREFLIGHT_SCRIPT_NAME, PROFILES, UPDATE_SCRIPT_NAME, } from './constants.js';
+import { FACTORY_SCRIPTS, GENERATE_REFERENCE_CMD, GENERATE_REFERENCE_GATE_FILE, GENERATE_REFERENCE_NAME, GENERATOR_SCRIPTS, INVITE_ADMIN_SCRIPT_CMD, INVITE_ADMIN_SCRIPT_FILE, INVITE_ADMIN_SCRIPT_NAME, OBSOLETE_SCRIPT_CMDS, PREFLIGHT_SCRIPT_CMD, PREFLIGHT_SCRIPT_FILE, PREFLIGHT_SCRIPT_NAME, PROFILES, UPDATE_SCRIPT_NAME, } from './constants.js';
 /**
  * Auto-detect the profile to install into an existing repo from its
  * `package.json`: a `factoryVersion` field means the repo was born from the
@@ -82,6 +82,14 @@ function ensureFactoryScripts(pkg, extraScripts = {}) {
         else if (existing === cmd) {
             result = { action: 'already-correct' };
         }
+        else if ((OBSOLETE_SCRIPT_CMDS[name] ?? []).includes(existing)) {
+            // The value is a KNOWN-OBSOLETE kit command (e.g. the old `node …mjs` that
+            // the .ts migration retired) — heal it to the current command. A genuinely
+            // dev-divergent value falls through to `conflict` and is left intact.
+            scripts[name] = cmd;
+            changed = true;
+            result = { action: 'healed' };
+        }
         else {
             result = { action: 'conflict', existingValue: existing };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.17.3",
+  "version": "1.18.0",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",
@@ -35,6 +35,7 @@
     "prepublishOnly": "pnpm build",
     "test": "vitest run",
     "test:unit": "vitest run tests/unit",
+    "test:provision": "vitest run tests/integration/provision-cycle.test.ts",
     "test:watch": "vitest"
   },
   "dependencies": {