@timekast/factory 1.23.1 → 1.24.0

package/dist/commands/provision.js

@@ -29,7 +29,7 @@ import { apexZoneOf, CloudflareApiError, CLOUDFLARE_API_BASE, deleteDnsRecord, e
 import { createDevelopBranch, createNeonProject, createProjectApiKey, deleteNeonApiKeysByName, deleteNeonProject, getConnectionUri, listNeonBranches, listNeonProjects, NeonApiError, NEON_API_BASE, NEON_DEVELOP_BRANCH, } from '../lib/neon-api.js';
 import { createBacklogProject, deleteBacklogProject, mintBacklogKey, BacklogApiError, } from '../lib/backlog-api.js';
 import { defaultEnvPath, readEnvKeyNames, readVercelToken, runProvisionPreflight, } from '../lib/provision-preflight.js';
-import { addVercelDomain, buildEnvPlan, createVercelProject, generateAuthSecret, generateMfaEncryptionKey, getLinkedRepoId, getVercelDomainStatus, GitHubAppNotInstalledError, linkGitRepo, listVercelProjects, patchProjectSettings, pushEnvPlan, removeVercelDomain, triggerDeployment, upsertEnvVar, listEnvVars, VercelApiError, writeVercelProjectJson, } from '../lib/vercel-env.js';
+import { addVercelDomain, buildEnvPlan, createVercelProject, generateAuthSecret, generateMfaEncryptionKey, getLinkedRepoId, getVercelDomainStatus, getVercelProjectByName, GitHubAppNotInstalledError, linkGitRepo, listProjectDomains, listVercelProjects, patchProjectSettings, pushEnvPlan, removeVercelDomain, triggerDeployment, upsertEnvVar, listEnvVars, VercelApiError, VERCEL_AUTO_APEX, writeVercelProjectJson, } from '../lib/vercel-env.js';
 import { writeBacklogLocalCreds, writeE2eLocalCreds, writeEmailLocalCreds, writeEnvLocal, } from '../lib/env-file.js';
 import { adoptState, ADOPT_UNKNOWN, clearProvisionState, clearState, hasProvisionState, isServiceComplete, PROVISION_DIR, PROVISION_STATE_FILE, readDestroyTarget, readProvisionState, writeProvisionState, } from '../lib/provision-state.js';
 /**
@@ -2279,19 +2279,58 @@ async function resolveCandidate(provider, candidates, deps, recordAmbiguity) {
     const chosen = await select(provider, candidates);
     return chosen?.id ?? null;
 }
-/** Reconstruct the Vercel project id (read-only) — filter by name/slug. */
+/**
+ * Normalize a provider-side project name for slug comparison. Provider consoles
+ * hold DISPLAY names — a Neon project created as `Aditivo CRM` is the same stack
+ * as the `aditivo-crm` directory — so a raw string compare answers "was this
+ * created by the CLI", not "is this my project". Lowercase, non-alphanumerics
+ * collapsed to a single `-`, edges trimmed: `Aditivo CRM` → `aditivo-crm`.
+ */
+function normalizeProjectName(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+/**
+ * Pick the candidate pool for a slug out of a provider's project list: an EXACT
+ * (normalized) name match wins alone; otherwise every normalized name that
+ * contains the slug (or is contained by it) is surfaced for disambiguation.
+ */
+function matchProjectsBySlug(projects, slug) {
+    const target = normalizeProjectName(slug);
+    const matches = projects.filter((p) => {
+        const name = normalizeProjectName(p.name);
+        return name === target || name.includes(target) || target.includes(name);
+    });
+    const exact = matches.filter((p) => normalizeProjectName(p.name) === target);
+    return exact.length === 1 ? exact : matches;
+}
+/**
+ * Reconstruct the Vercel project id (read-only).
+ *
+ * The exact lookup goes FIRST — `GET /v9/projects/{name}` answers "is there a
+ * project called `{slug}`" in one request. The listing is the fallback for a
+ * project whose name merely resembles the directory, and it is the reason this
+ * order matters: the listing is paginated, and a team with a real fleet used to
+ * bury the project past the first page, where "not in this page" was recorded
+ * as `unknown` — indistinguishable from "does not exist".
+ */
 async function adoptVercel(slug, teamId, token, deps, recordAmbiguity) {
+    const exact = await getVercelProjectByName(slug, token, teamId, { fetchImpl: deps.fetchImpl });
+    if (exact)
+        return exact.id;
     const projects = await listVercelProjects(token, teamId, { fetchImpl: deps.fetchImpl });
     const candidates = projectsToCandidates(projects, slug, teamId);
+    if (candidates.length === 0) {
+        console.log(`  · Ningún proyecto de Vercel se parece a \`${slug}\` (revisé ${projects.length} del team \`${teamId}\`) — \`vercelProjectId: unknown\`.`);
+        return null;
+    }
     return resolveCandidate('Vercel', candidates, deps, recordAmbiguity);
 }
 /** Map Vercel project summaries to candidates, keeping only slug-name matches. */
 function projectsToCandidates(projects, slug, teamId) {
-    const matches = projects.filter((p) => p.name === slug || p.name.includes(slug) || slug.includes(p.name));
-    // Prefer an EXACT name match alone (unambiguous); otherwise surface all matches.
-    const exact = matches.filter((p) => p.name === slug);
-    const pool = exact.length === 1 ? exact : matches;
-    return pool.map((p) => ({
+    return matchProjectsBySlug(projects, slug).map((p) => ({
         id: p.id,
         name: p.name,
         url: `https://vercel.com/${teamId}/${p.name}`,
@@ -2303,16 +2342,17 @@ function projectsToCandidates(projects, slug, teamId) {
  * the `develop` one. A branch lookup failure leaves the branch id `unknown`
  * without failing the whole adopt (issue §4).
  */
-async function adoptNeon(slug, apiKey, deps, recordAmbiguity) {
-    const projects = await listNeonProjects(apiKey, { fetchImpl: deps.fetchImpl });
-    const matches = projects.filter((p) => p.name === slug || p.name.includes(slug) || slug.includes(p.name));
-    const exact = matches.filter((p) => p.name === slug);
-    const pool = exact.length === 1 ? exact : matches;
-    const candidates = pool.map((p) => ({
+async function adoptNeon(slug, apiKey, orgId, deps, recordAmbiguity) {
+    const projects = await listNeonProjects(apiKey, orgId, { fetchImpl: deps.fetchImpl });
+    const candidates = matchProjectsBySlug(projects, slug).map((p) => ({
         id: p.id,
         name: p.name,
         url: `https://console.neon.tech/app/projects/${p.id}`,
     }));
+    if (candidates.length === 0) {
+        console.log(`  · Ningún proyecto de Neon se parece a \`${slug}\` (revisé ${projects.length} de la org) — \`neonProjectId: unknown\`.`);
+        return { projectId: null, branchDevId: null };
+    }
     const projectId = await resolveCandidate('Neon', candidates, deps, recordAmbiguity);
     if (!projectId)
         return { projectId: null, branchDevId: null };
@@ -2359,17 +2399,23 @@ async function adoptGithub(slug, deps) {
  * source, through the very door DOM-001 closed from the other side.
  *
  * So it probes the org zones in order and keeps the one whose CNAMEs actually
- * exist. Deriving from the slug survives only as the LAST resort — no token, no
- * zone reachable, or a project whose CNAMEs are genuinely absent — where naming a
- * domain by convention is all anyone can do, and the narration says so.
+ * exist. When none does, it asks VERCEL where the app answers — a project living
+ * on the client's own domain (`crm.cliente.mx`) has no CNAME in any org zone, and
+ * for it the org-zone question has no true answer: the conventional name would be
+ * a host that resolves nowhere, written into the field destroy and the WebAuthn
+ * rpID both read.
+ *
+ * Deriving from the slug survives only as the LAST resort — no token, no zone
+ * reachable, and no Vercel project to ask — where naming a domain by convention
+ * is all anyone can do, and the narration says so.
  */
-async function adoptDns(slug, deps) {
+async function adoptDns(slug, deps, vercel) {
     const domains = provisionDomains(slug);
     const cfToken = readCloudflareApiKey(deps.envPath ?? defaultEnvPath());
     if (!cfToken) {
-        console.warn('⚠ No hay `CLOUDFLARE_API_TOKEN` en el rail — registro los dominios por nombre sin ' +
-            'confirmar sus CNAMEs (es read-only; corre `factory secrets <archivo>` si quieres la verificación).');
-        return domains;
+        console.warn('⚠ No hay `CLOUDFLARE_API_TOKEN` en el rail — no puedo confirmar CNAMEs ' +
+            '(es read-only; corre `factory secrets <archivo>` si quieres la verificación).');
+        return (await adoptDomainsFromVercel(vercel, deps)) ?? narrateDerivedDomains(domains);
     }
     const cfDeps = { fetchImpl: deps.fetchImpl };
     for (const zone of ORG_ZONE_NAMES) {
@@ -2407,9 +2453,60 @@ async function adoptDns(slug, deps) {
         }
     }
     console.log(`  · Sin CNAMEs en ninguna zona del org (${ORG_ZONE_NAMES.join(', ')}) — ` +
-        'registro los dominios por nombre en la zona actual.');
+        'le pregunto a Vercel dónde responde el proyecto.');
+    return (await adoptDomainsFromVercel(vercel, deps)) ?? narrateDerivedDomains(domains);
+}
+/** Say out loud that these hosts are a convention, not a confirmed fact. */
+function narrateDerivedDomains(domains) {
+    console.warn(`⚠ No pude confirmar dominios en ningún proveedor — registro los de convención ` +
+        `(\`${domains.prod}\` / \`${domains.dev}\`). Si el proyecto usa otro dominio, corrígelos ` +
+        'a mano en `.timekast/provision.json` antes de cualquier `--destroy`.');
     return domains;
 }
+/**
+ * Read the project's REAL hosts off Vercel (read-only) and split them into the
+ * dev/prod pair the state holds. A domain pinned to the `develop` branch is dev;
+ * an unpinned one is prod. Custom domains win over the `*.vercel.app` Vercel
+ * mints on its own — but the auto host is kept when a role has nothing else, so
+ * the rpID of a dev environment that never got a custom domain is still true.
+ *
+ * Returns `null` when there is no project to ask, the call fails, or the project
+ * has no domains at all — the caller falls back to the conventional names.
+ */
+async function adoptDomainsFromVercel(vercel, deps) {
+    if (!vercel)
+        return null;
+    let domains;
+    try {
+        domains = await listProjectDomains(vercel.projectId, vercel.token, vercel.teamId, {
+            fetchImpl: deps.fetchImpl,
+        });
+    }
+    catch {
+        console.warn('⚠ No se pudo leer los dominios del proyecto en Vercel (read-only) — continúo.');
+        return null;
+    }
+    if (domains.length === 0)
+        return null;
+    const isAuto = (d) => d.apexName === VERCEL_AUTO_APEX;
+    const isDev = (d) => d.gitBranch === NEON_DEVELOP_BRANCH;
+    const pick = (wantDev) => domains.find((d) => isDev(d) === wantDev && !isAuto(d)) ??
+        domains.find((d) => isDev(d) === wantDev);
+    const prod = pick(false);
+    const dev = pick(true);
+    if (!prod && !dev)
+        return null;
+    const resolved = { dev: dev?.name ?? '', prod: prod?.name ?? '' };
+    if (!resolved.prod || !resolved.dev) {
+        // One role has no host at all: report it rather than inventing its twin.
+        console.log(`  ℹ Vercel solo tiene dominio de ${resolved.prod ? 'producción' : 'develop'} para este proyecto.`);
+    }
+    console.log(`  ✔ Dominios tomados de Vercel — prod: ${resolved.prod || '(ninguno)'} · dev: ${resolved.dev || '(ninguno)'}`);
+    return {
+        dev: resolved.dev || ADOPT_UNKNOWN,
+        prod: resolved.prod || ADOPT_UNKNOWN,
+    };
+}
 /** Print the reconstructed adopt state in plain es-MX (the non-`--json` narration). */
 function printAdoptState(result) {
     const s = result.state;
@@ -2481,9 +2578,12 @@ export async function runAdopt(flags, deps = {}) {
     let neonProjectId = null;
     let neonBranchDevId = null;
     const neonApiKey = readNeonApiKey(envPath);
+    // Same rail value the create path threads (`NEON_ORGANIZATION_ID`): Neon REQUIRES
+    // it on an org-scoped key, and answers `400 org_id is required` without it.
+    const neonOrgId = readGateValue('NEON_ORGANIZATION_ID', envPath) ?? undefined;
     if (neonApiKey) {
         try {
-            const neon = await adoptNeon(slug, neonApiKey, adeps, (list) => {
+            const neon = await adoptNeon(slug, neonApiKey, neonOrgId, adeps, (list) => {
                 candidates.neon = list;
             });
             neonProjectId = neon.projectId;
@@ -2499,8 +2599,11 @@ export async function runAdopt(flags, deps = {}) {
     }
     // GitHub (gh repo view) — uses the dev's gh auth (no rail token needed).
     const githubRepo = await adoptGithub(slug, adeps);
-    // DNS (GET dns_records) — domain names always derivable; CNAME check best-effort.
-    const domains = await adoptDns(slug, adeps);
+    // DNS (GET dns_records) — the org zones first, then the project's own Vercel
+    // domains, and only then the conventional names (see `adoptDns`).
+    const domains = await adoptDns(slug, adeps, vercelProjectId && vercelToken && flags.team
+        ? { projectId: vercelProjectId, teamId: flags.team, token: vercelToken }
+        : null);
     const partial = {
         slug,
         vercelProjectId: vercelProjectId ?? ADOPT_UNKNOWN,
@@ -2847,6 +2950,18 @@ async function teardownProviders(target, deps) {
     // was never found and stayed behind. Keyed by domain→zone-id, resolved on demand.
     const zoneIdByDomain = new Map();
     for (const domain of target.domains) {
+        // A `*.vercel.app` host reaches the state only via `--adopt`, which records the
+        // auto host when a role has no custom domain. Vercel mints and owns it: there is
+        // no CNAME of ours to delete and no zone to resolve, so both branches below would
+        // report a `failed` for a resource that was never ours.
+        if (domain.endsWith(`.${VERCEL_AUTO_APEX}`)) {
+            outcomes.push({
+                resource: `Dominio ${domain}`,
+                status: 'skipped',
+                detail: 'host automático de Vercel — se va con el proyecto',
+            });
+            continue;
+        }
         // The domain is registered in the state, so there IS a resource to remove. If
         // a prerequisite is missing (FIX 3: e.g. `scope` null on an adopted stack, or
         // no token), emit `failed` — NOT a silent skip — so `hadFailures` keeps the

package/dist/lib/neon-api.js

@@ -225,29 +225,60 @@ export async function getConnectionUri(apiKey, projectId, branchId, pooled, deps
     }
     return data.uri;
 }
+/** Page size for the project listing — Neon's documented maximum (`limit` ≤ 400). */
+const NEON_PROJECTS_PAGE_SIZE = 400;
+/** Hard stop on the pagination loop — 20 full pages is 8000 projects, far past any org. */
+const NEON_PROJECTS_MAX_PAGES = 20;
 /**
  * List the org's Neon projects — `GET /projects` (PROV-007 `--adopt`). STRICTLY
  * read-only: it never POSTs/PATCHes/DELETEs. The caller filters by slug/name to
  * reconstruct the adopted state and disambiguates when more than one matches
- * (issue §4). Neon paginates with `?limit=`; one page (default 100) covers the
- * org's project list for the adopt use case.
+ * (issue §4).
+ *
+ * Two things this endpoint does NOT forgive, both learned the hard way from an
+ * adopt that recorded `neonProjectId: unknown` on a project that plainly exists:
+ *
+ *   - `org_id` is REQUIRED for an org-scoped API key — the same requirement
+ *     {@link createNeonProject} already honors. Without it Neon answers `400
+ *     org_id is required`, so the adopt path had never once resolved a project.
+ *   - The default page size is 10. An org with a real fleet needs the FULL list,
+ *     or the answer to "does this project exist" is decided by how recently it
+ *     was touched. Pages are walked to exhaustion via `pagination.cursor`.
  *
  * @throws {NeonApiError} on any non-2xx (caller records the field as `unknown`).
  */
-export async function listNeonProjects(apiKey, deps = {}) {
+export async function listNeonProjects(apiKey, orgId, deps = {}) {
     const fetchImpl = deps.fetchImpl ?? fetch;
-    const response = await fetchImpl(`${NEON_API_BASE}/projects`, {
-        method: 'GET',
-        headers: neonHeaders(apiKey),
-        signal: AbortSignal.timeout(NEON_API_TIMEOUT_MS),
-    });
-    if (!response.ok) {
-        throw new NeonApiError(response.status, await safeBody(response), 'GET /projects');
+    const collected = [];
+    let cursor;
+    for (let page = 0; page < NEON_PROJECTS_MAX_PAGES; page += 1) {
+        const query = new URLSearchParams({ limit: String(NEON_PROJECTS_PAGE_SIZE) });
+        if (orgId)
+            query.set('org_id', orgId);
+        if (cursor)
+            query.set('cursor', cursor);
+        const response = await fetchImpl(`${NEON_API_BASE}/projects?${query.toString()}`, {
+            method: 'GET',
+            headers: neonHeaders(apiKey),
+            signal: AbortSignal.timeout(NEON_API_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            throw new NeonApiError(response.status, await safeBody(response), 'GET /projects');
+        }
+        const data = (await response.json());
+        const projects = data.projects ?? [];
+        for (const p of projects) {
+            if (p.id && p.name)
+                collected.push({ id: p.id, name: p.name });
+        }
+        // Neon returns a cursor even on the LAST page, so a short page — not a missing
+        // cursor — is what ends the walk; the cursor guard only catches a truncated body.
+        const next = data.pagination?.cursor;
+        if (projects.length < NEON_PROJECTS_PAGE_SIZE || !next || next === cursor)
+            break;
+        cursor = next;
     }
-    const data = (await response.json());
-    return (data.projects ?? [])
-        .filter((p) => Boolean(p.id) && Boolean(p.name))
-        .map((p) => ({ id: p.id, name: p.name }));
+    return collected;
 }
 /**
  * List a Neon project's branches — `GET /projects/{id}/branches` (PROV-007

package/dist/lib/vercel-env.js

@@ -303,25 +303,83 @@ export async function removeVercelDomain(projectId, name, token, teamId, deps =
         throw error;
     }
 }
+/** Page size for the project listing — Vercel's documented maximum (`limit` ≤ 100). */
+const VERCEL_PROJECTS_PAGE_SIZE = 100;
+/** Hard stop on the pagination loop — 20 full pages is 2000 projects, far past any team. */
+const VERCEL_PROJECTS_MAX_PAGES = 20;
 /**
- * List the team's Vercel projects — `GET /v9/projects?teamId=&limit=20` (PROV-007
+ * Look up ONE Vercel project by name — `GET /v9/projects/{idOrName}` (PROV-007
+ * `--adopt`). Vercel accepts the project NAME in that path slot, which is the
+ * cheap exact answer to "is there a project called `{slug}`": one request, no
+ * pagination, no substring heuristic. Returns `null` on a 404 (no such project)
+ * so the caller can fall back to the fuzzy listing below.
+ *
+ * @throws {VercelApiError} on any non-2xx OTHER than 404 (401/403 must not be
+ *   read as "absent" — a bad token is a different fact from a missing project).
+ */
+export async function getVercelProjectByName(name, token, teamId, deps = {}) {
+    try {
+        const data = (await vercelApi('GET', `/v9/projects/${encodeURIComponent(name)}`, token, teamId, deps));
+        return data.id && data.name ? { id: data.id, name: data.name } : null;
+    }
+    catch (error) {
+        if (error instanceof VercelApiError && error.status === 404)
+            return null;
+        throw error;
+    }
+}
+/**
+ * List the team's Vercel projects — `GET /v9/projects?teamId=` (PROV-007
  * `--adopt`). STRICTLY read-only: it never POSTs/PATCHes/DELETEs anything. The
  * caller filters the returned summaries by slug/name to reconstruct the adopted
  * state; an exact-name match is preferred, but every project name that CONTAINS
  * the slug is returned as a candidate so the caller can disambiguate (issue §4).
  *
- * `limit` is threaded as a query param (default 20 — issue §6); `teamId` flows
- * through {@link vercelUrl} like every other call. Used by `--adopt` only.
+ * Pages are walked to exhaustion (`pagination.next` → `until`). It used to take
+ * the first 20 and stop, which on a real team meant the listing answered "are you
+ * among the 20 most recently touched projects", not "do you exist" — a project
+ * further down was recorded `unknown` with no way to tell that from absent.
  *
  * @throws {VercelApiError} on any non-2xx (caller maps it / records `unknown`).
  */
-export async function listVercelProjects(token, teamId, deps = {}, limit = 20) {
-    const data = (await vercelApi('GET', '/v9/projects', token, teamId, deps, undefined, {
-        limit: String(limit),
-    }));
-    return (data.projects ?? [])
-        .filter((p) => Boolean(p.id) && Boolean(p.name))
-        .map((p) => ({ id: p.id, name: p.name }));
+export async function listVercelProjects(token, teamId, deps = {}) {
+    const collected = [];
+    let until;
+    for (let page = 0; page < VERCEL_PROJECTS_MAX_PAGES; page += 1) {
+        const query = { limit: String(VERCEL_PROJECTS_PAGE_SIZE) };
+        if (until !== undefined)
+            query.until = String(until);
+        const data = (await vercelApi('GET', '/v9/projects', token, teamId, deps, undefined, query));
+        for (const p of data.projects ?? []) {
+            if (p.id && p.name)
+                collected.push({ id: p.id, name: p.name });
+        }
+        const next = data.pagination?.next;
+        if (next === undefined || next === null || next === until)
+            break;
+        until = next;
+    }
+    return collected;
+}
+/**
+ * Apex of the hosts Vercel mints on its own (`{project}.vercel.app`). Nobody
+ * created these and nobody can delete them, so they are the LAST choice when
+ * reconstructing a project's domains and are skipped by the teardown.
+ */
+export const VERCEL_AUTO_APEX = 'vercel.app';
+/**
+ * List the domains attached to a Vercel project — `GET /v9/projects/{id}/domains`
+ * (PROV-007 `--adopt`). STRICTLY read-only. This is the authority on where a
+ * derived app actually answers: a project on a client's own domain has no CNAME
+ * in any org zone, so DNS alone cannot reconstruct its hosts.
+ *
+ * @throws {VercelApiError} on any non-2xx (caller degrades, never fails the adopt).
+ */
+export async function listProjectDomains(projectId, token, teamId, deps = {}) {
+    const data = (await vercelApi('GET', `/v9/projects/${encodeURIComponent(projectId)}/domains`, token, teamId, deps));
+    return (data.domains ?? [])
+        .filter((d) => Boolean(d.name))
+        .map((d) => ({ name: d.name, apexName: d.apexName ?? '', gitBranch: d.gitBranch ?? null }));
 }
 /**
  * List the project's existing env vars (issue §8 idempotency: we PATCH a var that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.23.1",
+  "version": "1.24.0",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",