@timekast/factory 1.18.0 → 1.20.0

package/dist/commands/provision.js

@@ -25,11 +25,12 @@ import { execa } from 'execa';
 import prompts from 'prompts';
 import { FACTORY_ORG } from '../lib/constants.js';
 import { CLIError } from '../lib/cli-error.js';
-import { apexZoneOf, CloudflareApiError, CLOUDFLARE_API_BASE, ensureCnameRecord, findCnameRecord, resolveZoneId, resolveZoneIdForName, CNAME_VERCEL_TARGET, TIMEKAST_ZONE_NAME, provisionDomains, } from '../lib/cloudflare-api.js';
+import { apexZoneOf, CloudflareApiError, CLOUDFLARE_API_BASE, deleteDnsRecord, ensureCnameRecord, ensureDnsRecord, findCnameRecord, resolveZoneId, resolveZoneIdForName, CNAME_VERCEL_TARGET, TIMEKAST_ZONE_NAME, provisionDomains, } from '../lib/cloudflare-api.js';
 import { createDevelopBranch, createNeonProject, createProjectApiKey, deleteNeonApiKeysByName, deleteNeonProject, getConnectionUri, listNeonBranches, listNeonProjects, NeonApiError, NEON_API_BASE, NEON_DEVELOP_BRANCH, } from '../lib/neon-api.js';
-import { defaultEnvPath, readVercelToken, runProvisionPreflight, } from '../lib/provision-preflight.js';
+import { createBacklogProject, deleteBacklogProject, mintBacklogKey, BacklogApiError, } from '../lib/backlog-api.js';
+import { defaultEnvPath, readEnvKeyNames, readVercelToken, runProvisionPreflight, } from '../lib/provision-preflight.js';
 import { addVercelDomain, buildEnvPlan, createVercelProject, generateAuthSecret, generateMfaEncryptionKey, getLinkedRepoId, getVercelDomainStatus, GitHubAppNotInstalledError, linkGitRepo, listVercelProjects, patchProjectSettings, pushEnvPlan, removeVercelDomain, triggerDeployment, upsertEnvVar, listEnvVars, VercelApiError, writeVercelProjectJson, } from '../lib/vercel-env.js';
-import { writeE2eLocalCreds, writeEmailLocalCreds, writeEnvLocal } from '../lib/env-file.js';
+import { writeBacklogLocalCreds, writeE2eLocalCreds, writeEmailLocalCreds, writeEnvLocal, } from '../lib/env-file.js';
 import { adoptState, ADOPT_UNKNOWN, clearProvisionState, clearState, hasProvisionState, isServiceComplete, PROVISION_DIR, PROVISION_STATE_FILE, readDestroyTarget, readProvisionState, writeProvisionState, } from '../lib/provision-state.js';
 /**
  * The THREE GitHub Secrets the E2E runner (`pnpm test:e2e` → `e2e-runner.ts` +
@@ -103,9 +104,12 @@ export function isValidSubdomainSlug(slug) {
  * The services `--services` understands, in canonical provisioning order. `github`
  * precedes `vercel`: PROV-004 (the `github` step) builds the git substrate AND
  * creates the Vercel PROJECT, whose `projectId` PROV-003 (the `vercel` env-sync
- * step) then consumes. The order is normalized regardless of `--services` input.
+ * step) then consumes. `backlog` (BSYNC-003) runs LAST — after `vercel`/`dns` have
+ * created `.env.local` — so it APPENDS its two keys instead of racing the Neon-string
+ * write (`writeEnvLocal` only creates `.env.local` when absent). The order is
+ * normalized regardless of `--services` input.
  */
-const KNOWN_SERVICES = ['neon', 'github', 'vercel', 'dns'];
+const KNOWN_SERVICES = ['neon', 'github', 'vercel', 'dns', 'backlog'];
 /** The known `--dns` route tokens, for validation. */
 const KNOWN_DNS_ROUTES = ['org', 'cliente-cf', 'registrar'];
 /** Default verification-poll timeout (minutes) and interval (seconds) — issue §4. */
@@ -180,6 +184,21 @@ export function parseVerifyTimeout(raw) {
     }
     return minutes;
 }
+/**
+ * Parse + validate `--repo=<org/name>` (BOOT-001). Absent → `undefined` (the repo
+ * resolution then falls back to the `origin` remote / `FACTORY_ORG/projectName`).
+ * A malformed value (no `/`, more than one `/`, or an empty side) throws a clear
+ * `CLIError` — a corrupt slug must never silently reach the GitHub/Vercel calls.
+ */
+export function parseRepoFlag(raw) {
+    if (raw === undefined)
+        return undefined;
+    const parts = raw.split('/');
+    if (parts.length !== 2 || parts.some((part) => part.trim() === '')) {
+        throw new CLIError(`\`--repo\` debe tener el formato \`org/nombre\` (un solo \`/\`; recibí \`${raw}\`).`);
+    }
+    return raw;
+}
 /** Parse `provision`'s argv slice into typed flags. */
 export function parseProvisionFlags(argv) {
     return {
@@ -187,6 +206,7 @@ export function parseProvisionFlags(argv) {
         team: readValueFlag(argv, 'team'),
         orgId: readValueFlag(argv, 'org-id'),
         slug: readValueFlag(argv, 'slug'),
+        repo: parseRepoFlag(readValueFlag(argv, 'repo')),
         domain: readValueFlag(argv, 'domain'),
         dns: parseDnsRoute(readValueFlag(argv, 'dns')),
         verifyTimeout: parseVerifyTimeout(readValueFlag(argv, 'verify-timeout')),
@@ -206,6 +226,7 @@ const SERVICE_LABEL = {
     vercel: 'Vercel (env sync por target)',
     github: 'GitHub + Vercel (sustrato git + proyecto + env + E2E)',
     dns: 'DNS + Resend (dominio del entorno)',
+    backlog: 'Backlog central (proyecto en backlog.timekast.mx + API key)',
 };
 /** Build the ordered plan: each requested service is `skip` if complete, else `create`. */
 function buildPlan(services, state) {
@@ -217,6 +238,11 @@ function buildPlan(services, state) {
 /** Print the plain-text plan (the `--dry-run` and pre-run narration). */
 function printPlan(result) {
     console.log(`Plan de provision para \`${result.projectName}\` (lifecycle: ${result.lifecycle}):`);
+    // BOOT-001: print the RESOLVED repo (--repo → origin → FACTORY_ORG/name), so a
+    // `--dry-run` shows the exact repo the github step / E2E secrets will target.
+    if (result.repo) {
+        console.log(`  Repo de GitHub: ${result.repo}`);
+    }
     for (const step of result.steps) {
         const mark = step.action === 'skip' ? '⏭  (ya completado)' : '＋ crear';
         console.log(`  ${mark}  ${SERVICE_LABEL[step.service]}`);
@@ -405,9 +431,11 @@ function neonErrorToCliError(error, projectName, context) {
 }
 /** The GitHub repo (`owner/name`) the project-scoped secret is pushed to. */
 function neonSecretRepo(state) {
-    // PROV-004 records the created repo in `state.github.repo`; before it runs we
-    // fall back to the canonical `org/projectName` so the secret push is attempted
-    // (a non-existent repo → §8 pending path, never an abort).
+    // `state.github.repo` carries the RESOLVED repo: `runProvision` seeds it before
+    // any step runs (BOOT-001: --repo → origin → FACTORY_ORG/name) and PROV-004
+    // re-records it. The fallback only covers a direct `provisionNeon` call with no
+    // seeded state, so the secret push is still attempted (a non-existent repo →
+    // §8 pending path, never an abort).
     return state.github?.repo ?? `${FACTORY_ORG}/${state.projectName}`;
 }
 /**
@@ -556,6 +584,163 @@ export async function provisionNeon(rootDir, state, deps = {}) {
             '  La API key project-scoped se creó; reintenta con `--resume` cuando el repo exista.');
     }
 }
+// ─────────────────────────────────────────────────────────────────────────────
+// BSYNC-003 — `backlog`: register the project in backlog.timekast.mx
+// ─────────────────────────────────────────────────────────────────────────────
+/** The rail key holding the org-level backlog `admin` token (create/mint/delete). */
+export const BACKLOG_ADMIN_TOKEN_ENV = 'BACKLOG_ADMIN_TOKEN';
+/**
+ * The backlog-central `internalKey` rule (`^[a-z0-9-]{3,40}$`) — DELIBERATELY DISTINCT
+ * from the DNS subdomain rule of {@link isValidSubdomainSlug} (no leading/trailing
+ * hyphen, ≤59 chars). A backlog internalKey is NOT a DNS label, so it has its own
+ * shape: 3–40 chars of lowercase, digits and hyphens (server-side rule, live-verified
+ * in `project/abraham/smoke-findings.md` Hallazgo 1 — uppercase 422s).
+ */
+export const BACKLOG_SLUG_RE = /^[a-z0-9-]{3,40}$/;
+/**
+ * Normalize + validate a slug as a backlog-central `internalKey` BEFORE any POST
+ * (issue §4/§8). Lowercases first (the server 422s on uppercase), then asserts the
+ * {@link BACKLOG_SLUG_RE} shape. Returns the normalized value so the POST always uses
+ * the canonical form. Distinct from `assertValidSubdomainSlug` (the DNS-label check).
+ *
+ * @throws {CLIError} when the slug cannot be a valid backlog internalKey.
+ */
+export function normalizeBacklogSlug(raw) {
+    const slug = raw.toLowerCase();
+    if (!BACKLOG_SLUG_RE.test(slug)) {
+        throw new CLIError(`El slug \`${raw}\` no es un internalKey válido para backlog central.\n` +
+            'Debe ser 3–40 caracteres de minúsculas, dígitos y guiones (`^[a-z0-9-]{3,40}$`).');
+    }
+    return slug;
+}
+/**
+ * Map a backlog-central REST failure to an actionable, es-MX `CLIError` (issue §4/§8).
+ * The `409 INTERNAL_KEY_TAKEN` hints at `--adopt` WITHOUT auto-adopting (plan decision
+ * H2: silently adopting a colliding project risks mixing two projects by accident). A
+ * 401/403 points at re-importing the rail token; a 422 at the slug shape.
+ */
+function backlogErrorToCliError(error, internalKey, context) {
+    if (error instanceof BacklogApiError) {
+        switch (error.status) {
+            case 401:
+            case 403:
+                return new CLIError(`El \`BACKLOG_ADMIN_TOKEN\` es inválido o no autoriza ${context} (backlog respondió ${error.status}).\n` +
+                    'Renuévalo con `factory secrets <archivo>` y reintenta.');
+            case 409:
+                return new CLIError(`Ya existe un proyecto de backlog central con el internalKey \`${internalKey}\` ` +
+                    '(backlog respondió 409 `INTERNAL_KEY_TAKEN`).\n' +
+                    'NO se auto-adopta (evita mezclar dos proyectos por accidente). Si es tu proyecto, ' +
+                    'reconstruye el estado con `--adopt`; si no, elige otro con `--slug`.');
+            case 422:
+                return new CLIError(`Backlog central rechazó el internalKey \`${internalKey}\` como inválido (respondió 422).\n` +
+                    'Usa un slug de 3–40 caracteres de minúsculas, dígitos y guiones.');
+            default:
+                return new CLIError(`Falló la llamada a backlog central en ${context}: ${error.message}`);
+        }
+    }
+    return new CLIError(`Falló la llamada a backlog central en ${context}: ${error?.message ?? 'error'}`);
+}
+/**
+ * BSYNC-003 — provision the backlog-central project: normalize the slug, create the
+ * project (`POST /projects`, org `admin` token), mint a per-project `read_write` key
+ * (`POST /projects/{pid}/keys`), and write BOTH the key + the project id to
+ * `.env.local` (`BACKLOG_API_KEY` + `BACKLOG_PROJECT_ID`, PROVISION_OWNED → never
+ * pushed to Vercel). State records IDs ONLY (`{ projectId, keyMinted }`) — the
+ * SHOW-ONCE key value is NEVER persisted anywhere but the gitignored `.env.local`.
+ *
+ * Auth split (smoke Hallazgo 1): the org `admin` token drives ONLY the two org
+ * endpoints here (create project + mint key); the minted `read_write` key is what the
+ * derivative's `backlog push`/`sync` later consume. The project id is persisted
+ * IMMEDIATELY after create, so a mint failure leaves a resumable partial state.
+ *
+ * No-echo: the minted key value never reaches stdout/log — only key NAMES are printed.
+ *
+ * @throws {CLIError} on a missing rail token, an invalid slug (before any POST), a
+ *   `409 INTERNAL_KEY_TAKEN` (hint: `--adopt`, no auto-adopt), or any backlog failure.
+ */
+export async function provisionBacklog(rootDir, state, deps = {}) {
+    // Fully complete only when the key was minted + written. Re-entering a partial run
+    // (project created, key not yet minted) finishes the mint WITHOUT re-creating.
+    if (state.backlog?.keyMinted)
+        return;
+    const envPath = deps.envPath ?? defaultEnvPath();
+    const adminToken = readGateValue(BACKLOG_ADMIN_TOKEN_ENV, envPath);
+    if (!adminToken) {
+        throw new CLIError('No se pudo leer `BACKLOG_ADMIN_TOKEN` de `~/.claude/.env`.\n' +
+            'Ejecuta `factory secrets <archivo>` para bajar el token del archivo de secretos y reintenta.');
+    }
+    // Normalize + validate the slug against the backlog rule BEFORE any POST (§4/§8).
+    const internalKey = normalizeBacklogSlug(state.projectName);
+    const apiDeps = { fetchImpl: deps.fetchImpl, sleepImpl: deps.sleepImpl };
+    // 1. Create the project (reuse a partial run's projectId; else POST). Persist the id
+    //    IMMEDIATELY so a mint failure leaves a resumable partial state (IDs only).
+    let projectId;
+    if (state.backlog?.projectId) {
+        projectId = state.backlog.projectId;
+    }
+    else {
+        let project;
+        try {
+            project = await createBacklogProject(adminToken, { name: state.projectName, internalKey }, apiDeps);
+        }
+        catch (error) {
+            throw backlogErrorToCliError(error, internalKey, 'crear el proyecto');
+        }
+        projectId = project.id;
+        state.backlog = { projectId };
+        writeProvisionState(rootDir, state);
+    }
+    // 2. Mint the per-project `read_write` key (SHOW-ONCE). Its VALUE goes straight to
+    //    `.env.local`; it is NEVER persisted in the state nor printed (no-echo).
+    let apiKey;
+    try {
+        apiKey = await mintBacklogKey(adminToken, projectId, `${state.projectName}-provision`, apiDeps);
+    }
+    catch (error) {
+        throw backlogErrorToCliError(error, internalKey, 'mintar la API key del proyecto');
+    }
+    // 3. Write BACKLOG_API_KEY + BACKLOG_PROJECT_ID to `.env.local` (0600, PROVISION_OWNED).
+    //    writeBacklogLocalCreds CREATES `.env.local` when absent (a standalone `backlog`
+    //    run has no Neon/Vercel step to seed it). No-echo: print only KEY NAMES.
+    if (writeBacklogLocalCreds(rootDir, projectId, apiKey)) {
+        console.log('  ＋ .env.local (BACKLOG_API_KEY · BACKLOG_PROJECT_ID — registro en backlog.timekast.mx)');
+    }
+    else {
+        console.warn('⚠ No se pudieron escribir las credenciales de backlog en `.env.local`. ' +
+            'El proyecto se creó; agrégalas a mano (la key es show-once, revísala en la app).');
+    }
+    // 4. Mark done — key minted + written. State holds IDs only (never the key value).
+    state.backlog = { projectId, keyMinted: true };
+    writeProvisionState(rootDir, state);
+}
+/**
+ * Resolve whether the `backlog` service can run given the rail token. UNLIKE the
+ * fail-closed rail tokens (Neon/Vercel abort when missing), a missing
+ * `BACKLOG_ADMIN_TOKEN` degrades GRACEFULLY (issue AC): a WARN + skip when `backlog`
+ * is ONE of several requested services (the rest continue), but a hard error when it
+ * is the SOLE service requested (there'd be nothing to do). Returns the services to
+ * actually run — `backlog` stripped when skipped. Pure + FS-light: `envPath` is
+ * explicit so the unit test drives every branch against a temp rail.
+ *
+ * Runs BEFORE the preflight, so a stripped `backlog` never reaches
+ * `assertGateTokensPresent` (which would otherwise fail-close on the missing token).
+ *
+ * @throws {CLIError} when `backlog` is the sole requested service and the token is absent.
+ */
+export function resolveBacklogService(services, envPath = defaultEnvPath()) {
+    if (!services.includes('backlog'))
+        return services;
+    if (readEnvKeyNames(envPath).has(BACKLOG_ADMIN_TOKEN_ENV))
+        return services;
+    if (services.length === 1) {
+        throw new CLIError('Falta `BACKLOG_ADMIN_TOKEN` en `~/.claude/.env` y `backlog` es el único servicio pedido.\n' +
+            'Impórtalo con `factory secrets <archivo>` (el master del org) y reintenta.');
+    }
+    console.warn('⚠ Falta `BACKLOG_ADMIN_TOKEN` en `~/.claude/.env` — omito el servicio `backlog` ' +
+        '(los demás continúan).\n' +
+        '  Impórtalo con `factory secrets <archivo>` para registrar el proyecto en backlog.timekast.mx.');
+    return services.filter((s) => s !== 'backlog');
+}
 /**
  * Resolve the four pooled+direct Neon connection strings, ALWAYS by re-deriving
  * fresh from Neon — provision persists NO credentials file (Neon is the source of
@@ -696,10 +881,10 @@ export async function provisionVercel(rootDir, state, teamId, deps = {}) {
     // Mint an INDEPENDENT AUTH_SECRET per environment (issue §4 — never shared).
     // POOLED strings → the Vercel runtime DATABASE_URL (serverless/concurrent).
     // WebAuthn rpID = the EXACT host per env (provision's interim domains). A passkey
-    // dies if the rpID changes, so a later custom-domain swap (--domain / PROV-006)
-    // must also re-point WEBAUTHN_RP_ID — tracked as a follow-up. MFA_ENCRYPTION_KEY
-    // is minted independently per env (base64url) so a derivative with MFA enabled
-    // never boots broken (P-1).
+    // dies if the rpID changes, so the custom-domain swap (--domain / PROV-006)
+    // re-points the PRODUCTION WEBAUTHN_RP_ID too (`updateDomainEnv`, BOOT-004).
+    // MFA_ENCRYPTION_KEY is minted independently per env (base64url) so a derivative
+    // with MFA enabled never boots broken (P-1).
     const rpDomains = provisionDomains(state.projectName);
     const plan = buildEnvPlan({
         mainDatabaseUrl: neonSecrets.mainPooled,
@@ -811,6 +996,19 @@ export { writeEnvLocal };
 function repoHttpsUrl(repoSlug) {
     return `https://github.com/${repoSlug}.git`;
 }
+/**
+ * Parse the `owner/name` slug out of a GitHub `origin` URL, HTTPS or SSH
+ * (`https://github.com/Owner/repo[.git]`, `git@github.com:Owner/repo[.git]`,
+ * `ssh://git@github.com/Owner/repo[.git]`). Returns `null` for anything else —
+ * including non-GitHub hosts, deliberately: deriving a slug from a GitLab/other
+ * origin and re-pointing it at `github.com` (see {@link repoHttpsUrl}) would
+ * silently retarget the project, so an unparsable origin falls back to the
+ * historical `FACTORY_ORG/projectName` default instead (BOOT-001).
+ */
+export function parseOriginRepoSlug(originUrl) {
+    const match = /^(?:https:\/\/|ssh:\/\/git@|git@)github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?\/?$/.exec(originUrl.trim());
+    return match ? `${match[1]}/${match[2]}` : null;
+}
 /** Default git runner — `execa` in the derived dir, no shell. */
 async function gitInDir(args, cwd) {
     const { stdout } = await execa('git', args, { cwd });
@@ -831,6 +1029,47 @@ async function readOriginUrl(runGit, cwd) {
         return null;
     }
 }
+/**
+ * Resolve the GitHub repo slug (`owner/name`) the `github` step targets (BOOT-001
+ * — decouples the repo from the project slug). Priority:
+ *   1. The repo PERSISTED in the state (a prior run's authority — a `--resume`
+ *      must never silently re-point a repo already in progress; a CONFLICTING
+ *      `--repo` throws instead, mirroring the `--force` discipline of the other
+ *      steps — discard the state with `--force` to start over).
+ *   2. An explicit `--repo=<org/name>` (the dev's stated intent — wins over an
+ *      `origin` pointing elsewhere; the remote is updated via `buildGitSubstrate`'s
+ *      existing same-repo/`--force` flow).
+ *   3. The existing `origin` remote, when it parses as a GitHub repo (a derived
+ *      project whose repo name ≠ slug, or living outside the Factory org).
+ *   4. The historical default `${FACTORY_ORG}/${projectName}` (unchanged behavior
+ *      when there is no flag and no `origin`).
+ */
+export async function resolveRepoSlug(rootDir, projectName, persistedRepo, explicitRepo, runGit) {
+    if (persistedRepo) {
+        // GitHub slugs are case-insensitive — only a REAL divergence is a conflict.
+        if (explicitRepo && explicitRepo.toLowerCase() !== persistedRepo.toLowerCase()) {
+            throw new CLIError(`El estado de provision ya registra el repo \`${persistedRepo}\` (de un run anterior), ` +
+                `distinto de \`--repo=${explicitRepo}\`.\n` +
+                'En `--resume` el estado es la autoridad; usa `--force` para descartarlo y empezar de cero con el repo nuevo.');
+        }
+        return persistedRepo;
+    }
+    if (explicitRepo)
+        return explicitRepo;
+    const fallback = `${FACTORY_ORG}/${projectName}`;
+    const origin = await readOriginUrl(runGit, rootDir);
+    if (origin) {
+        const derived = parseOriginRepoSlug(origin);
+        if (derived) {
+            // An origin at the SAME repo as the canonical default (case drift only, e.g.
+            // `TimeKast/Acme` vs `TimeKast/acme`) keeps the CANONICAL slug, so
+            // `buildGitSubstrate` re-cases the remote exactly as it always did (GitHub
+            // slugs are case-insensitive — reuse that normalization, don't fork it).
+            return derived.toLowerCase() === fallback.toLowerCase() ? fallback : derived;
+        }
+    }
+    return fallback;
+}
 /**
  * Build the git substrate in the documented, asserted ORDER (issue §6):
  *   1. rename `master` → `main` (only when the current branch is `master`)
@@ -870,11 +1109,14 @@ async function buildGitSubstrate(rootDir, repoSlug, runGit, force) {
     if (existingOrigin && existingOrigin !== url) {
         // GitHub repo URLs are case-insensitive: an `origin` differing ONLY by case
         // (e.g. `TimeKast/Edmond.git` vs the canonical lowercase `TimeKast/edmond.git`)
-        // points at the SAME repo. Re-case it to the canonical URL silently — no `--force`
-        // needed. A difference BEYOND case is a genuinely different repo → throw unless
-        // `--force` resets it.
-        const sameRepoDifferentCase = existingOrigin.toLowerCase() === url.toLowerCase();
-        if (!sameRepoDifferentCase && !force) {
+        // points at the SAME repo. So does an SSH origin (`git@github.com:Org/name.git`)
+        // whose parsed `owner/name` matches the resolved slug (BOOT-001 — the slug may
+        // have been DERIVED from that very origin). Either way, re-point it to the
+        // canonical HTTPS URL silently — no `--force` needed. A genuinely different
+        // repo → throw unless `--force` resets it.
+        const sameRepo = existingOrigin.toLowerCase() === url.toLowerCase() ||
+            parseOriginRepoSlug(existingOrigin)?.toLowerCase() === repoSlug.toLowerCase();
+        if (!sameRepo && !force) {
             throw new CLIError(`El repo ya tiene un remote \`origin\` apuntando a otro URL (\`${existingOrigin}\` ≠ \`${url}\`).\n` +
                 'Usa `--force` para sobrescribirlo, o limpia el remote si reutilizas este directorio.');
         }
@@ -988,7 +1230,10 @@ export async function provisionGithubVercel(rootDir, state, teamId, deps = {}) {
     }
     const runGit = deps.runGit ?? gitInDir;
     const apiDeps = { fetchImpl: deps.fetchImpl };
-    const repoSlug = `${FACTORY_ORG}/${state.projectName}`;
+    // BOOT-001: the repo is RESOLVED (--repo → existing origin → FACTORY_ORG/name),
+    // no longer hardcoded to `${FACTORY_ORG}/${projectName}`. On resume the persisted
+    // `state.github.repo` is the authority (a conflicting `--repo` throws).
+    const repoSlug = await resolveRepoSlug(rootDir, state.projectName, state.github?.repo, deps.repo, runGit);
     // Record the repo on the state up-front so the Neon secret push (PROV-002) and a
     // `--resume` target it; this is durable even if a later REST step fails.
     state.github = { repo: repoSlug };
@@ -1287,44 +1532,262 @@ async function promptConfirm(message) {
     const { ok } = await prompts({ type: 'confirm', name: 'ok', message, initial: false });
     return ok === true;
 }
+/** The `status` Resend reports once its DNS records validated (the poll's goal). */
+const RESEND_DOMAIN_VERIFIED_STATUS = 'verified';
+/** Shared headers for every Resend REST call (Bearer auth + JSON) — no-echo. */
+function resendHeaders(resendKey) {
+    return {
+        Authorization: `Bearer ${resendKey}`,
+        'Content-Type': 'application/json',
+    };
+}
+/**
+ * Build the FQDN for a record name Resend returns (BOOT-003 §4). Resend hands
+ * record names RELATIVE to the registered domain (`send` → `send.updates.miapp.com`,
+ * `resend._domainkey` → `resend._domainkey.updates.miapp.com`); Cloudflare's
+ * `dns_records` API wants the fully-qualified name. Defensive on shape drift: a
+ * name that already carries the domain (or the apex marker `@`) passes through.
+ */
+export function resendRecordFqdn(name, domain) {
+    if (name === '' || name === '@' || name === domain)
+        return domain;
+    if (name.endsWith(`.${domain}`))
+        return name;
+    return `${name}.${domain}`;
+}
+/**
+ * Look up an existing Resend domain by NAME — `GET /domains` (list) then
+ * `GET /domains/{id}` for its records. This is the `--resume` path (issue §8):
+ * a re-run's `POST /domains` 403s when the domain already exists in THIS account,
+ * so recovering the domain object lets the step re-ensure the DNS records and
+ * re-poll verification instead of dead-ending on a warning. Returns `null` when
+ * the domain is NOT in this account (then it really is "another account" and the
+ * caller keeps the preserved warning behavior — issue §4). Best-effort: any
+ * network/API failure degrades to `null`, never a throw.
+ */
+async function findResendDomain(domain, resendKey, fetchImpl) {
+    try {
+        const listResponse = await fetchImpl(`${RESEND_API_BASE}/domains`, {
+            method: 'GET',
+            headers: resendHeaders(resendKey),
+            signal: AbortSignal.timeout(RESEND_API_TIMEOUT_MS),
+        });
+        if (!listResponse.ok)
+            return null;
+        const list = (await listResponse.json());
+        const match = (list.data ?? []).find((d) => d.name === domain);
+        if (!match?.id)
+            return null;
+        const getResponse = await fetchImpl(`${RESEND_API_BASE}/domains/${match.id}`, {
+            method: 'GET',
+            headers: resendHeaders(resendKey),
+            signal: AbortSignal.timeout(RESEND_API_TIMEOUT_MS),
+        });
+        // Detail fetch failed → still return the id (poll works; records unknown → none created).
+        if (!getResponse.ok)
+            return { id: match.id, name: domain };
+        return (await getResponse.json());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Trigger Resend's DNS verification for a domain — `POST /domains/{id}/verify`
+ * (BOOT-003 §4). Without this call Resend never starts checking the records and
+ * the domain sits `not_started` forever (the exact bug this issue fixes). Best
+ * effort: a failure here is non-fatal (the poll surfaces the real outcome, and
+ * the step is re-runnable with `--resume`).
+ */
+async function triggerResendVerification(domainId, resendKey, fetchImpl) {
+    try {
+        await fetchImpl(`${RESEND_API_BASE}/domains/${domainId}/verify`, {
+            method: 'POST',
+            headers: resendHeaders(resendKey),
+            signal: AbortSignal.timeout(RESEND_API_TIMEOUT_MS),
+        });
+    }
+    catch {
+        // Non-fatal — the verification poll below reports the actual state.
+    }
+}
+/**
+ * Poll `GET /domains/{id}` until Resend reports `status: verified` or the timeout
+ * budget runs out (BOOT-003 §4) — the Resend sibling of {@link pollDomainVerification},
+ * same injectable `sleep`/`now`/timeout seams so the unit test never waits for real.
+ * Returns `true` once verified; `false` on timeout OR on any network/API failure
+ * (non-fatal either way — the DNS records are already created, Resend keeps
+ * checking them in background, and the step is re-runnable with `--resume`).
+ */
+async function pollResendDomainVerification(domainId, resendKey, deps, fetchImpl) {
+    const sleep = deps.sleep ?? realSleep;
+    const now = deps.now ?? Date.now;
+    const timeoutMs = (deps.verifyTimeoutMin ?? DEFAULT_VERIFY_TIMEOUT_MIN) * 60_000;
+    const intervalMs = VERIFY_POLL_INTERVAL_SEC * 1_000;
+    const deadline = now() + timeoutMs;
+    // First check immediately (the domain may already be verified — idempotent re-run).
+    for (;;) {
+        let status;
+        try {
+            const response = await fetchImpl(`${RESEND_API_BASE}/domains/${domainId}`, {
+                method: 'GET',
+                headers: resendHeaders(resendKey),
+                signal: AbortSignal.timeout(RESEND_API_TIMEOUT_MS),
+            });
+            if (!response.ok)
+                return false;
+            status = (await response.json()).status;
+        }
+        catch {
+            // A failure while POLLING is non-fatal: pending + resumable, never a throw.
+            return false;
+        }
+        if (status === RESEND_DOMAIN_VERIFIED_STATUS)
+            return true;
+        if (now() >= deadline)
+            return false;
+        console.log(`  … esperando verificación del dominio en Resend (reintento en ${VERIFY_POLL_INTERVAL_SEC}s)`);
+        await sleep(intervalMs);
+    }
+}
 /**
- * Register the client domain in Resend — `POST /domains { name }` (PROV-006 §4),
- * reusing the rail's `RESEND_API_KEY`. Idempotency (issue §8): Resend returns an
- * error when the domain is already verified on ANOTHER account; that is a WARNING,
- * not an abort — `EMAIL_FROM` is updated regardless. An absent `RESEND_API_KEY` is
- * also a warning (mail stays unconfigured). No-echo: the key never reaches stdout.
+ * Register the client mail domain in Resend AND make it verifiable end-to-end
+ * (BOOT-003): `POST /domains { name }` with the rail's `RESEND_API_KEY`, then
+ * CREATE the DNS records Resend returns (DKIM/SPF/MX — exactly the ones it
+ * returns, never an assumed fixed set, §8) in the client's Cloudflare zone via
+ * {@link ensureDnsRecord} (create-or-PATCH, idempotent on re-run, never delete),
+ * trigger verification, and poll until `verified` or timeout.
+ *
+ * `dns` carries the zone + token already resolved for the client-domain CNAME
+ * (same org/cliente-cf route); `null` = the `registrar` route (no DNS API — the
+ * records must be created by hand in the Resend dashboard; extending
+ * `printManualRecords` to them is an explicit follow-up, issue §9).
+ *
+ * Non-fatal by design — the domain switch already happened on Vercel:
+ *   - absent `RESEND_API_KEY` → warning (mail stays unconfigured).
+ *   - `POST /domains` rejected → recover the domain from THIS account when it
+ *     exists (`--resume`, §8) or keep the preserved warning ("another account", §4).
+ *   - a record create/PATCH failure → warning; the poll is skipped (it cannot
+ *     succeed with missing records) and the step stays re-runnable.
+ *   - poll timeout → warning + `pending-verification` note, NEVER a hard failure
+ *     (§8 — the records are in place; Resend keeps verifying in background).
+ *
+ * No-echo: the Resend key and Cloudflare token never reach stdout.
  */
-async function registerResendDomain(domain, envPath, fetchImpl) {
+async function registerResendDomain(domain, envPath, deps, fetchImpl, dns) {
     const resendKey = readGateValue('RESEND_API_KEY', envPath);
     if (!resendKey) {
         console.warn('⚠ No hay `RESEND_API_KEY` en `~/.claude/.env` — omito el alta del dominio en Resend ' +
             '(bájala con `factory secrets <archivo>` y reintenta con `--resume`).');
         return;
     }
+    // 1. Register (or recover, on re-run) the domain in Resend.
+    let resendDomain = null;
     try {
         const response = await fetchImpl(`${RESEND_API_BASE}/domains`, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${resendKey}`,
-                'Content-Type': 'application/json',
-            },
+            headers: resendHeaders(resendKey),
             body: JSON.stringify({ name: domain }),
             signal: AbortSignal.timeout(RESEND_API_TIMEOUT_MS),
         });
-        if (!response.ok) {
-            // Already verified elsewhere / validation error → warn + continue (issue §8).
-            console.warn(`⚠ Resend rechazó el alta de \`${domain}\` (status ${response.status}). ` +
-                'Quizá ya está verificado en otra cuenta — `EMAIL_FROM` se actualiza igual; ' +
-                'verifica el dominio a mano en Resend si hace falta.');
-            return;
+        if (response.ok) {
+            resendDomain = (await response.json());
+            console.log(`  ＋ Resend: dominio ${domain} registrado`);
+        }
+        else {
+            // Rejected (e.g. 403 already-exists). If the domain lives in THIS account
+            // (a `--resume` re-run), recover it and continue; otherwise keep the
+            // preserved warning behavior (issue §4) — warn + continue, never abort.
+            const status = response.status;
+            resendDomain = await findResendDomain(domain, resendKey, fetchImpl);
+            if (resendDomain) {
+                console.log(`  ↻ Resend: dominio ${domain} ya registrado en esta cuenta (reuso sus records)`);
+            }
+            else {
+                console.warn(`⚠ Resend rechazó el alta de \`${domain}\` (status ${status}). ` +
+                    'Quizá ya está verificado en otra cuenta — `EMAIL_FROM` se actualiza igual; ' +
+                    'verifica el dominio a mano en Resend si hace falta.');
+                return;
+            }
         }
-        console.log(`  ＋ Resend: dominio ${domain} registrado (verifica los records DNS en Resend)`);
     }
     catch (error) {
         // A network/timeout failure on Resend is non-fatal — the domain switch already
         // happened on Vercel; Resend verification is re-runnable with `--resume`.
         console.warn(`⚠ No se pudo dar de alta \`${domain}\` en Resend (${error?.message ?? 'error'}). ` +
             'Reintenta con `--resume`; `EMAIL_FROM` ya se actualizó.');
+        return;
+    }
+    if (resendDomain.status === RESEND_DOMAIN_VERIFIED_STATUS) {
+        console.log(`  ✔ Resend: dominio ${domain} ya verificado`);
+        return;
+    }
+    // 2. Create the DNS records Resend returned — the ones it RETURNS, no fixed set (§8).
+    if (!dns) {
+        // `registrar` route: no DNS API — the records live in the Resend dashboard and
+        // must be created by hand (printing them here is a follow-up — issue §9).
+        console.warn(`⚠ (registrar) Los records DNS de Resend para \`${domain}\` no se crean automáticamente. ` +
+            'Créalos a mano desde el dashboard de Resend y verifica el dominio ahí.');
+        return;
+    }
+    const records = resendDomain.records ?? [];
+    const cloudflareDeps = { fetchImpl };
+    let allEnsured = true;
+    for (const record of records) {
+        const type = record.type?.toUpperCase();
+        if ((type !== 'TXT' && type !== 'MX') || !record.name || !record.value) {
+            // Only the types Resend requires are supported (issue §9) — anything else
+            // (or a malformed record) is surfaced for manual creation, never guessed.
+            console.warn(`  ⚠ Record de Resend no soportado o incompleto (${record.record ?? record.type ?? '?'}) — créalo a mano en Cloudflare.`);
+            allEnsured = false;
+            continue;
+        }
+        const spec = {
+            type,
+            name: resendRecordFqdn(record.name, domain),
+            content: record.value,
+            ...(record.priority !== undefined ? { priority: record.priority } : {}),
+        };
+        try {
+            const outcome = await ensureDnsRecord(dns.zoneId, spec, dns.token, cloudflareDeps);
+            const mark = outcome === 'created'
+                ? '＋'
+                : outcome === 'updated'
+                    ? '↻ (contenido actualizado)'
+                    : '⏭ (ya estaba)';
+            console.log(`  ${mark} ${spec.type} ${spec.name} (record ${record.record ?? 'DNS'} de Resend)`);
+        }
+        catch (error) {
+            // Non-fatal (the mail path is additive): warn with the actionable mapping
+            // and keep going — the step is re-runnable with `--resume`.
+            allEnsured = false;
+            const detail = error instanceof CloudflareApiError
+                ? cloudflareErrorToCliError(error, `crear el record ${spec.type} \`${spec.name}\``)
+                    .message
+                : (error?.message ?? 'error');
+            console.warn(`  ⚠ No se pudo asegurar el record ${spec.type} \`${spec.name}\`: ${detail}`);
+        }
+    }
+    if (!allEnsured) {
+        console.warn(`⚠ El dominio \`${domain}\` queda pending en Resend (faltaron records DNS). ` +
+            'Corrige lo anterior y reintenta con `--resume`.');
+        return;
+    }
+    // 3. Trigger verification + poll until `verified` or timeout (never a hard fail).
+    if (!resendDomain.id) {
+        console.warn(`⚠ Resend no devolvió un id para \`${domain}\` — no puedo sondear la verificación. ` +
+            'Revisa el dominio en el dashboard de Resend.');
+        return;
+    }
+    await triggerResendVerification(resendDomain.id, resendKey, fetchImpl);
+    const verified = await pollResendDomainVerification(resendDomain.id, resendKey, deps, fetchImpl);
+    if (verified) {
+        console.log(`  ✔ Resend: dominio ${domain} verificado`);
+    }
+    else {
+        // §8: the records ARE created — pending-verification, resumable, never fatal.
+        console.warn(`⚠ El dominio \`${domain}\` quedó pending-verification en Resend (los records DNS ya están; ` +
+            'Resend sigue verificando en background). Reintenta con `--resume` o revisa el dashboard.');
     }
 }
 /** Print the exact DNS records the owner must create for the `--dns=registrar` path. */
@@ -1421,6 +1884,9 @@ async function resolveDnsToken(route, envPath, headless) {
  *   - domain already attached to Vercel (409) → only polls, never re-adds.
  *   - interim retire fails → WARNING, the step is NOT marked failed (interim stays).
  *   - Resend already verified elsewhere → warning + continue.
+ *   - Resend DNS records (BOOT-003) → `ensureDnsRecord` create-or-PATCH (a rotated
+ *     DKIM is PATCHed in place, never deleted); a Resend poll timeout is a WARNING
+ *     (pending-verification, resumable), never a step failure.
  *   - `AUTH_URL`/`NEXTAUTH_URL` already correct → the upsert PATCH is omitted.
  *
  * On timeout the state is left `clientDomainStatus: pending-verification` (resumable);
@@ -1456,6 +1922,9 @@ export async function provisionClientDomain(rootDir, state, teamId, domain, deps
         throw error;
     }
     // 2. DNS record: org/cliente-cf CREATE the CNAME; registrar only PRINTS it (§4).
+    //    The resolved zone + token are kept for step 6: the Resend DKIM/SPF/MX records
+    //    live in the SAME client zone (`updates.<domain>` shares the apex — BOOT-003).
+    let resendDns = null;
     if (route === 'registrar') {
         // Print the canonical record now; the poll loop re-prints Vercel's verification.
         printManualRecords(domain, []);
@@ -1474,6 +1943,7 @@ export async function provisionClientDomain(rootDir, state, teamId, domain, deps
             }
             throw error; // resolveZoneIdForName's own CLIError (zone not found) propagates.
         }
+        resendDns = { zoneId, token: cfToken };
         try {
             const cnameOutcome = await ensureCnameRecord(zoneId, domain, cfToken, cloudflareDeps);
             const mark = cnameOutcome === 'created'
@@ -1514,7 +1984,9 @@ export async function provisionClientDomain(rootDir, state, teamId, domain, deps
     // 6. Register the client's MAIL SUBDOMAIN (`updates.<domain>`) in Resend — NOT the
     //    apex, which holds the client's corporate MX/SPF (Google Workspace, M365, …).
     //    Verifying Resend on a dedicated subdomain keeps the client's own mail intact.
-    await registerResendDomain(mailDomainFor(domain), envPath, fetchImpl);
+    //    BOOT-003: also CREATES the DKIM/SPF/MX records Resend returns (in the same
+    //    client zone as the CNAME) and polls until Resend reports `verified`.
+    await registerResendDomain(mailDomainFor(domain), envPath, deps, fetchImpl, resendDns);
     // 7. Record the client domain as LIVE and persist.
     state.dns = {
         ...(state.dns ?? {
@@ -1532,6 +2004,12 @@ export async function provisionClientDomain(rootDir, state, teamId, domain, deps
  * pre-approves; otherwise a TTY prompt asks (headless without `--confirm` → NOT
  * retired). The DEV domain (`{slug}-dev.timekast.mx`) is ALWAYS conserved. A
  * removal failure is a WARNING, never a step failure (issue §8 — interim stays up).
+ *
+ * BOOT-007: once Vercel detaches the interim, its CNAME in the org `timekast.mx`
+ * zone is deleted too — otherwise it stays orphaned, resolving to Vercel's generic
+ * target and serving a 404 forever. The delete lives INSIDE the confirmed block
+ * (a declined prompt never touches Cloudflare) and is SKIPPED when the Vercel
+ * detach failed (the interim is still live — its CNAME must keep resolving).
  */
 async function retireInterimDomain(projectId, token, teamId, state, deps, fetchImpl) {
     const interim = provisionDomains(state.projectName).prod;
@@ -1558,15 +2036,78 @@ async function retireInterimDomain(projectId, token, teamId, state, deps, fetchI
         // the step is NOT marked failed, the dev retires it manually later.
         console.warn(`⚠ No se pudo retirar el dominio interino \`${interim}\` (${error?.message ?? 'error'}).\n` +
             '  Queda activo; retíralo a mano en Vercel o reintenta con `--resume`. El paso NO falla por esto.');
+        // BOOT-007: the interim is still attached to Vercel — its CNAME stays too.
+        return;
     }
     // The DEV domain is intentionally never touched (issue §4 — conserved).
+    // BOOT-007: the interim is off Vercel — delete its now-orphaned CNAME as well.
+    await deleteInterimCname(interim, deps.envPath ?? defaultEnvPath(), fetchImpl);
 }
 /**
- * Update `EMAIL_FROM` + `AUTH_URL`/`NEXTAUTH_URL` + `NEXT_PUBLIC_APP_URL` to the client domain in the
- * Vercel env, per-target and idempotently (PROV-006 §4). Lists the existing vars
- * once; an `AUTH_URL`/`NEXTAUTH_URL`/`EMAIL_FROM` already set to the target value
- * has its PATCH omitted (issue §8 — second run is a no-op). No-echo: only KEY
- * NAMES + targets print (the values here are public, but the discipline holds).
+ * Delete the interim CNAME (`{slug}.timekast.mx`) from the org Cloudflare zone
+ * after Vercel detached the domain (BOOT-007). Without this, the record stays
+ * orphaned: it keeps resolving to `cname.vercel-dns.com` while no Vercel project
+ * answers for the host → a 404 forever, dead weight in the `timekast.mx` zone.
+ *
+ * Runs ONLY inside the already-confirmed retire block (a declined prompt never
+ * reaches here). Best-effort by design (issue §4 + §8): EVERY failure — missing
+ * rail token, zone not visible to the token (the `resolveZoneId` CLIError that is
+ * hard in the CREATION path), an out-of-scope token, a 5xx on the DELETE — is a
+ * WARNING, never a step failure; the record stays and the cleanup is retryable.
+ * Idempotent: an already-absent record (`findCnameRecord` → null, or a 404 on the
+ * DELETE) is a narrated no-op. The record content is NOT validated before deleting
+ * (this is a retirement, not a repair — issue §8). The DEV domain's CNAME is never
+ * touched: only the prod interim name is looked up.
+ */
+async function deleteInterimCname(interim, envPath, fetchImpl) {
+    const warnRetryable = (reason) => {
+        console.warn(`⚠ No se pudo borrar el CNAME interino \`${interim}\` en Cloudflare (${reason}).\n` +
+            `  El registro queda en la zona \`${TIMEKAST_ZONE_NAME}\`; bórralo a mano o reintenta. El paso NO falla por esto.`);
+    };
+    const cloudflareToken = readCloudflareApiKey(envPath);
+    if (!cloudflareToken) {
+        warnRetryable('sin `CLOUDFLARE_API_TOKEN` en el rail');
+        return;
+    }
+    const cloudflareDeps = { fetchImpl };
+    try {
+        const zoneId = await resolveZoneId(cloudflareToken, cloudflareDeps);
+        const record = await findCnameRecord(zoneId, interim, cloudflareToken, cloudflareDeps);
+        // Same outcome narration as the Vercel retire above (no-echo — only the
+        // domain NAME prints; the token never crosses this boundary).
+        const outcome = record
+            ? await deleteDnsRecord(zoneId, record.id, cloudflareToken, cloudflareDeps)
+            : 'absent';
+        console.log(outcome === 'absent'
+            ? `  ⏭ (ya no estaba) CNAME interino ${interim} en Cloudflare`
+            : `  － CNAME interino ${interim} borrado de Cloudflare`);
+    }
+    catch (error) {
+        // §8: zone not visible (CLIError) / out-of-scope token / 5xx → warning,
+        // retryable — never the hard CLIError the creation path uses.
+        warnRetryable(error?.message ?? 'error');
+    }
+}
+/**
+ * Update `EMAIL_FROM` + `AUTH_URL`/`NEXTAUTH_URL` + `NEXT_PUBLIC_APP_URL` +
+ * `WEBAUTHN_RP_ID` to the client domain in the Vercel env, per-target and
+ * idempotently (PROV-006 §4 + BOOT-004). Lists the existing vars once and upserts
+ * each entry via `upsertEnvVar`, which reconciles a key that the substrate left
+ * SPLIT per target (e.g. `NEXT_PUBLIC_APP_URL` as `['production']` + `['preview']`
+ * from `buildEnvPlan`) into ONE combined-target record (BOOT-002 — a single-record
+ * PATCH would 400 against the sibling). A second run over the reconciled state
+ * re-PATCHes in place: no duplicate records, no 400 (issue §8).
+ *
+ * `WEBAUTHN_RP_ID` is re-pointed for PRODUCTION ONLY: the interim dev domain stays
+ * the preview rpID (the dev domain is never retired — see `retireInterimDomain`),
+ * so `buildEnvPlan`'s intentional split pair is preserved — the single-target plan
+ * only PATCHes the overlapping production record and never touches the preview
+ * sibling (no BOOT-002 400 reintroduced). Changing the rpID invalidates every
+ * passkey registered under the interim rpID and the CLI cannot count them (that
+ * table lives in the derivative's DB), so a warning prints UNCONDITIONALLY.
+ *
+ * No-echo: only KEY NAMES + targets print (the values here are public, but the
+ * discipline holds).
  */
 async function updateDomainEnv(projectId, token, teamId, domain, deps) {
     const authUrl = `https://${domain}`;
@@ -1583,12 +2124,22 @@ async function updateDomainEnv(projectId, token, teamId, domain, deps) {
         // Keep the public app origin in lockstep with AUTH_URL once a client domain lands
         // (the substrate set it to the interim domain in buildEnvPlan; this re-points it).
         { key: 'NEXT_PUBLIC_APP_URL', value: authUrl, target: ['production', 'preview'] },
+        // WebAuthn rpID is the registrable HOST, never a URL — the bare domain (BOOT-004).
+        // PRODUCTION only: the interim dev domain remains the preview rpID (the dev domain
+        // is never retired), so the intentional split pair from buildEnvPlan is preserved.
+        { key: 'WEBAUTHN_RP_ID', value: domain, target: ['production'] },
     ];
     const existing = await listEnvVars(projectId, token, teamId, deps);
     for (const entry of plan) {
         const outcome = await upsertEnvVar(projectId, token, teamId, entry, existing, deps);
         console.log(`  ${outcome === 'created' ? '＋' : '↻'} ${entry.key} [${entry.target.join(', ')}]`);
     }
+    // BOOT-004: changing the rpID orphans every passkey registered under the interim
+    // rpID. The CLI cannot query how many exist (that table lives in the derivative's
+    // DB, unreachable from provisioning), so the warning is UNCONDITIONAL.
+    console.warn(`⚠ WEBAUTHN_RP_ID (production) ahora es \`${domain}\`: cualquier passkey registrada ` +
+        'bajo el rpID interino queda invalidada — esos usuarios deben registrar una nueva ' +
+        'passkey en el dominio definitivo.');
 }
 /**
  * Print the resolved client-domain operation tree for `--domain --dry-run`
@@ -1609,7 +2160,14 @@ function printClientDomainPlan(domain, interim, route, confirm) {
     console.log(`  ${confirm ? '－' : '? (requiere --confirm o prompt)'} retira el interino ${interim} ` +
         `(el dev ${domain}-dev se conserva)`);
     console.log(`  ↻ EMAIL_FROM=noreply@${mailDomainFor(domain)} · AUTH_URL=https://${domain} · NEXTAUTH_URL=https://${domain} · NEXT_PUBLIC_APP_URL=https://${domain}`);
+    console.log(`  ↻ WEBAUTHN_RP_ID=${domain} (solo production — las passkeys del rpID interino quedan invalidadas; el preview conserva el rpID dev)`);
     console.log(`  ＋ Resend: POST /domains { name: ${mailDomainFor(domain)} } (subdominio mail, no el apex)`);
+    if (route === 'registrar') {
+        console.log('  · (registrar) los records DNS de Resend (DKIM/SPF/MX) se crean a mano en el dashboard de Resend');
+    }
+    else {
+        console.log(`  ＋ records DNS de Resend (DKIM/SPF/MX, los que devuelva) en la zona ${apexZoneOf(domain)} + sondeo hasta verified`);
+    }
     console.log('\n(`--dry-run`) No se ejecutó ninguna llamada a API ni se escribió estado.');
 }
 /**
@@ -1631,7 +2189,10 @@ async function runServiceStep(service, rootDir, state, flags) {
             // PROV-004: git substrate (rename → remote add → push main) + create the
             // Vercel project + connect git (GitHub App) + PATCH production-branch +
             // .vercel/project.json + activate E2E. Migrations run in vercel-build, not a workflow.
-            await provisionGithubVercel(rootDir, state, flags.team, { force: flags.force });
+            await provisionGithubVercel(rootDir, state, flags.team, {
+                force: flags.force,
+                repo: flags.repo,
+            });
             break;
         case 'dns':
             // PROV-005: attach the interim domains to Vercel (dev → develop, prod →
@@ -1639,6 +2200,12 @@ async function runServiceStep(service, rootDir, state, flags) {
             // (RESEND_API_KEY + the fixed EMAIL_FROM), then `state.dns = { domain, devDomain }`.
             await provisionDns(rootDir, state, flags.team);
             break;
+        case 'backlog':
+            // BSYNC-003: register the project in backlog.timekast.mx (POST /projects with the
+            // org admin token) + mint a per-project read_write key + write BACKLOG_API_KEY /
+            // BACKLOG_PROJECT_ID to `.env.local` (PROVISION_OWNED — never to Vercel).
+            await provisionBacklog(rootDir, state, {});
+            break;
         default:
             throw new CLIError(`Paso de provision no implementado: \`${service}\`.`);
     }
@@ -1962,6 +2529,10 @@ function describeDestroyPlan(target) {
     if (target.githubRepo) {
         lines.push(`  － Repo GitHub ${target.githubRepo} — \`gh repo delete\` (sesión del dev)`);
     }
+    if (target.backlogProjectId) {
+        lines.push(`  － Proyecto backlog central ${target.backlogProjectId} — DELETE /projects ` +
+            '(soft-delete, `BACKLOG_ADMIN_TOKEN` del rail)');
+    }
     if (lines.length === 0) {
         lines.push('  (No hay recursos registrados que destruir — el estado no tiene ids.)');
     }
@@ -2148,6 +2719,38 @@ async function destroyGithubRepo(target, runGh) {
         return { resource, status: 'failed', detail: message || 'error en `gh repo delete`' };
     }
 }
+/**
+ * Soft-delete the backlog-central project via `DELETE /projects/{pid}` (BSYNC-003).
+ * INTENTIONALLY DIFFERENT from the other providers' teardown: those hard-delete with
+ * the DEV's own session (`gh`/`vercel`) — backlog has no such per-dev session, so it
+ * reuses the rail's `BACKLOG_ADMIN_TOKEN` (the smoke confirmed the admin token DELETEs
+ * a project). The delete is a SOFT delete (deactivates, no cascade) and IDEMPOTENT: a
+ * repeat returns 200, and a 404 (already gone) is treated as "already clean" — same
+ * 404-tolerance principle as {@link destroyNeonProject} (issue §8).
+ */
+async function destroyBacklogProject(target, adminToken, deps) {
+    const resource = `Proyecto backlog central (${target.backlogProjectId})`;
+    if (!target.backlogProjectId) {
+        return {
+            resource: 'Proyecto backlog central',
+            status: 'skipped',
+            detail: 'sin id en el estado',
+        };
+    }
+    try {
+        await deleteBacklogProject(adminToken, target.backlogProjectId, deps);
+        return { resource, status: 'removed', detail: 'desactivado (soft-delete idempotente)' };
+    }
+    catch (error) {
+        if (error instanceof BacklogApiError && error.status === 404) {
+            return { resource, status: 'removed', detail: 'ya estaba desactivado (404)' };
+        }
+        const detail = error instanceof BacklogApiError
+            ? `backlog respondió ${error.status}`
+            : (error?.message ?? 'error de red');
+        return { resource, status: 'failed', detail };
+    }
+}
 /**
  * Orchestrate the per-provider teardown (issue §4 + §8). Each provider failure is
  * logged and the run CONTINUES with the others; the outcomes are collected so the
@@ -2250,6 +2853,24 @@ async function teardownProviders(target, deps) {
     if (target.githubRepo) {
         outcomes.push(await destroyGithubRepo(target, deps.runGh));
     }
+    // 5. Backlog central — soft-delete the project via `DELETE /projects` with the rail's
+    //    `BACKLOG_ADMIN_TOKEN`. UNLIKE the providers above (deleted with the dev's own
+    //    session), backlog only HAS the org admin token — create+delete-capable per the
+    //    smoke — so the teardown reuses it. A missing token is a `failed` (keeps the
+    //    state + flags the orphan), never a silent skip. Soft + idempotent (404 → gone).
+    if (target.backlogProjectId) {
+        const backlogToken = readGateValue(BACKLOG_ADMIN_TOKEN_ENV, deps.envPath);
+        if (!backlogToken) {
+            outcomes.push({
+                resource: `Proyecto backlog central (${target.backlogProjectId})`,
+                status: 'failed',
+                detail: 'sin `BACKLOG_ADMIN_TOKEN` en el rail — desactívalo a mano en la app',
+            });
+        }
+        else {
+            outcomes.push(await destroyBacklogProject(target, backlogToken, { fetchImpl: deps.fetchImpl }));
+        }
+    }
     return outcomes;
 }
 /** Print the per-provider teardown report (es-MX) and flag the not-removed ones. */
@@ -2387,6 +3008,12 @@ export async function runProvision(flags) {
     // with no `--services` (a deferred go-live over an existing provision) or
     // alongside the initial run. It always runs AFTER the service steps.
     const hasDomain = Boolean(flags.domain);
+    // Backlog token gate (BSYNC-003): degrade gracefully vs the fail-closed rail tokens.
+    // A missing `BACKLOG_ADMIN_TOKEN` strips `backlog` (WARN) when it is one of several
+    // services, or throws when it is the only one — BEFORE the preflight so the stripped
+    // service never reaches the fail-closed `assertGateTokensPresent`. Reads the rail for
+    // presence only (no mutation) → safe to run ahead of the `--dry-run` return too.
+    flags.services = resolveBacklogService(flags.services);
     // 1. Flag validation.
     if (flags.services.length === 0 && !hasDomain) {
         throw new CLIError('No seleccionaste servicios. Usa `--services=neon,vercel,github,dns` ' +
@@ -2431,6 +3058,16 @@ export async function runProvision(flags) {
     // In patch mode the projectName comes from the loaded state (the interim slug);
     // a fresh run derives it from flags (the scaffold default).
     const projectName = state?.projectName ?? deriveProjectName(flags, rootDir);
+    // BOOT-001: resolve the target GitHub repo ONCE (--repo → existing origin →
+    // FACTORY_ORG/projectName) for every consumer of the slug: the plan/report
+    // (`--dry-run` included), the Neon E2E-secret push (which runs BEFORE the github
+    // step) and the github step itself. Reading the local `origin` is a read-only
+    // git call — safe under `--dry-run` (no REST, no state write). On resume the
+    // persisted repo is the authority (a conflicting `--repo` throws, never a
+    // silent re-point).
+    const repoSlug = flags.services.includes('github') || flags.services.includes('neon')
+        ? await resolveRepoSlug(rootDir, projectName, state?.github?.repo, flags.repo, gitInDir)
+        : undefined;
     const steps = buildPlan(flags.services, state);
     const result = {
         projectName,
@@ -2439,6 +3076,9 @@ export async function runProvision(flags) {
         resumed: (flags.resume || standaloneDomain) && !flags.force,
         steps,
     };
+    if (repoSlug) {
+        result.repo = repoSlug;
+    }
     if (hasDomain) {
         result.clientDomain = { domain: flags.domain, route: flags.dns };
     }
@@ -2472,6 +3112,13 @@ export async function runProvision(flags) {
         scope: flags.team ?? flags.orgId ?? '',
         createdAt: new Date().toISOString(),
     };
+    // BOOT-001: record the resolved repo BEFORE the steps run, so the Neon E2E-secret
+    // push (`neonSecretRepo`, which runs before the github step) targets the resolved
+    // repo — not the historical `${FACTORY_ORG}/${projectName}` fallback. Never
+    // clobbers a resumed state's repo (that one is the authority).
+    if (repoSlug && !runState.github?.repo) {
+        runState.github = { repo: repoSlug };
+    }
     // Ensure the state dir exists + a baseline file before the first step, so a
     // step failure on the very first service still leaves a resumable state.
     writeProvisionState(rootDir, runState);