@timekast/factory 1.26.0 → 1.27.0

package/dist/lib/package-json.js

@@ -8,7 +8,7 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { CLIError } from './cli-error.js';
-import { DEV_NEXT_GATE_FILE, DEV_NEXT_SCRIPT_CMD, DEV_NEXT_SCRIPT_NAME, FACTORY_SCRIPTS, GENERATE_REFERENCE_CMD, GENERATE_REFERENCE_GATE_FILE, GENERATE_REFERENCE_NAME, GENERATOR_SCRIPTS, INVITE_ADMIN_SCRIPT_CMD, INVITE_ADMIN_SCRIPT_FILE, INVITE_ADMIN_SCRIPT_NAME, OBSOLETE_SCRIPT_CMDS, VERIFY_QUICK_SCRIPT_CMD, VERIFY_QUICK_SCRIPT_NAME, VERIFY_SCRIPT_CMD, VERIFY_SCRIPT_FILE, VERIFY_SCRIPT_NAME, PORTS_E2E_COMMENT, PORTS_E2E_COMMENT_KEY, PORTS_E2E_KEY, PORTS_KEY, PREFLIGHT_SCRIPT_CMD, PREFLIGHT_SCRIPT_FILE, PREFLIGHT_SCRIPT_NAME, PROFILES, RETIRED_SCRIPT_CMDS, SHIPPED_E2E_PORT, UPDATE_SCRIPT_NAME, } from './constants.js';
+import { DEV_NEXT_GATE_FILE, DEV_NEXT_SCRIPT_CMD, DEV_NEXT_SCRIPT_NAME, E2E_SETUP_SCRIPT_CMD, E2E_SETUP_SCRIPT_FILE, E2E_SETUP_SCRIPT_NAME, EVIDENCE_VISUAL_SCRIPT_CMD, EVIDENCE_VISUAL_SCRIPT_FILE, EVIDENCE_VISUAL_SCRIPT_NAME, FACTORY_SCRIPTS, GENERATE_REFERENCE_CMD, GENERATE_REFERENCE_GATE_FILE, GENERATE_REFERENCE_NAME, GENERATOR_SCRIPTS, INVITE_ADMIN_SCRIPT_CMD, INVITE_ADMIN_SCRIPT_FILE, INVITE_ADMIN_SCRIPT_NAME, OBSOLETE_SCRIPT_CMDS, VERIFY_QUICK_SCRIPT_CMD, VERIFY_QUICK_SCRIPT_NAME, VERIFY_SCRIPT_CMD, VERIFY_SCRIPT_FILE, VERIFY_SCRIPT_NAME, PORTS_E2E_COMMENT, PORTS_E2E_COMMENT_KEY, PORTS_E2E_KEY, PORTS_KEY, PREFLIGHT_SCRIPT_CMD, PREFLIGHT_SCRIPT_FILE, PREFLIGHT_SCRIPT_NAME, PROFILES, RETIRED_SCRIPT_CMDS, SETUP_E2E_VARS_SCRIPT_CMD, SETUP_E2E_VARS_SCRIPT_FILE, SETUP_E2E_VARS_SCRIPT_NAME, SHIPPED_E2E_PORT, UPDATE_SCRIPT_NAME, VERCEL_BUILD_OBSOLETE_CMDS, VERCEL_BUILD_SCRIPT_CMD, VERCEL_BUILD_SCRIPT_NAME, } from './constants.js';
 /**
  * Auto-detect the profile to install into an existing repo from its
  * `package.json`: a `factoryVersion` field means the repo was born from the
@@ -111,6 +111,18 @@ function ensureFactoryScripts(pkg, extraScripts = {}) {
  * backing file lands.
  *
  * - `preflight` — when its sweep script ships (full brain).
+ * - `setup:e2e:vars` — publishes the CI E2E auth env vars (Fase 1 of the
+ *   `e2e-ci-auth-env` retrofit), when `scripts/tools/setup-e2e.ts` ships (full brain).
+ * - `evidence:visual` — the visual-evidence harness (`fx-visual-evidence`), gated on the
+ *   harness itself (`scripts/tools/visual-evidence/`) rather than on the runner: it is what
+ *   this alias needs, and a `core` derivative receives neither. Forwards to `test:e2e`, so the
+ *   capture pass goes through the ephemeral Neon branch like every other phase.
+ * - `e2e:setup` — installs the Playwright browsers, gated on the e2e runner that
+ *   refuses to start without them and names this alias in its message. A repo
+ *   whose runner ships but whose `package.json` lacks the alias would be told to
+ *   run a script it does not have — which is why it is maintained here rather
+ *   than only in the Factory's own `package.json` (frozen at bootstrap in a
+ *   derivative, so it is unreachable any other way).
  * - `generate:*` — one alias per reference generator whose `scripts/tools/
  *   generate-*.mjs` ships (full brain). These arrive via the `scripts/**`
  *   tracked set on `update`/`beta`, so an existing derivative self-heals the
@@ -140,6 +152,12 @@ export function kitLocalScripts(rootDir) {
         scripts[PREFLIGHT_SCRIPT_NAME] = PREFLIGHT_SCRIPT_CMD;
     if (has(INVITE_ADMIN_SCRIPT_FILE))
         scripts[INVITE_ADMIN_SCRIPT_NAME] = INVITE_ADMIN_SCRIPT_CMD;
+    if (has(SETUP_E2E_VARS_SCRIPT_FILE))
+        scripts[SETUP_E2E_VARS_SCRIPT_NAME] = SETUP_E2E_VARS_SCRIPT_CMD;
+    if (has(E2E_SETUP_SCRIPT_FILE))
+        scripts[E2E_SETUP_SCRIPT_NAME] = E2E_SETUP_SCRIPT_CMD;
+    if (has(EVIDENCE_VISUAL_SCRIPT_FILE))
+        scripts[EVIDENCE_VISUAL_SCRIPT_NAME] = EVIDENCE_VISUAL_SCRIPT_CMD;
     for (const gen of GENERATOR_SCRIPTS) {
         if (has(gen.file))
             scripts[gen.name] = gen.cmd;
@@ -355,6 +373,48 @@ export function removeRetiredScripts(pkgPath) {
     }
     return report;
 }
+/**
+ * Reorder a derivative's `vercel-build` so the production build runs BEFORE the migration.
+ *
+ * WHY THIS IS ITS OWN FUNCTION AND NOT AN ENTRY IN `FACTORY_SCRIPTS`. Everything in that
+ * registry is INSERTED when missing, because those are the CLI's own `factory:*` aliases and a
+ * repo without them is a repo that is missing them. `vercel-build` is the opposite kind of key:
+ * it belongs to the boilerplate, arrives frozen with `src/` at `factory new` (BR-FACTORY-006),
+ * and in a `core`/non-Factory repo its absence is CORRECT — inserting it there would point a
+ * build command at a stack that repo does not have. So this heals in place and never inserts,
+ * the same shape as `emptyShippedE2EPort`.
+ *
+ * The damage it repairs is in `VERCEL_BUILD_SCRIPT_NAME`'s docstring: with the migration first,
+ * a build that fails AFTER it leaves the production database migrated while Vercel keeps
+ * serving the previous build — new schema, old code, and a deployment rollback cannot undo it.
+ *
+ * Surgical like the rest of this module: reads, mutates a single key, re-serializes with the
+ * original indentation + trailing newline, and writes ONLY on a real change — so a second run
+ * finds `already-correct` and writes nothing.
+ *
+ * @param pkgPath Absolute path to the derived project's `package.json`.
+ */
+export function healVercelBuildOrder(pkgPath) {
+    const raw = readFileSync(pkgPath, 'utf8');
+    const indent = detectIndent(raw);
+    const pkg = parsePackageJson(raw);
+    const scripts = pkg.scripts;
+    if (typeof scripts !== 'object' || scripts === null || Array.isArray(scripts))
+        return 'absent';
+    const current = scripts[VERCEL_BUILD_SCRIPT_NAME];
+    if (current === undefined)
+        return 'absent';
+    if (current === VERCEL_BUILD_SCRIPT_CMD)
+        return 'already-correct';
+    // Exact match against what the kit actually shipped, byte for byte. A dev who appended a flag
+    // — or wrote the same two halves with different spacing — keeps their command through every
+    // future update: an unlisted variant erring toward "leave it alone" is the safe side here.
+    if (!VERCEL_BUILD_OBSOLETE_CMDS.includes(current))
+        return 'preserved';
+    scripts[VERCEL_BUILD_SCRIPT_NAME] = VERCEL_BUILD_SCRIPT_CMD;
+    writeFileSync(pkgPath, `${JSON.stringify(pkg, null, indent)}\n`, 'utf8');
+    return 'reordered';
+}
 /**
  * The kit-owned maintenance of a derivative's `package.json`, in the ONE order that is correct.
  *
@@ -395,6 +455,10 @@ export function maintainKitScripts(pkgPath) {
     // `scripts/**` can derive one per checkout. Conditional: it only ever touches that exact
     // value, so a dev-chosen port survives untouched.
     const portAction = emptyShippedE2EPort(pkgPath);
+    // Reorder `vercel-build` so the build runs before the migration. Conditional in the same way:
+    // it only ever rewrites a value the kit itself shipped, and never creates the key — a repo
+    // without it is a repo that should not have one.
+    const vercelBuildAction = healVercelBuildOrder(pkgPath);
     const removedKeys = new Set(Object.entries(retiredReport)
         .filter(([, action]) => action === 'removed')
         .map(([name]) => name));
@@ -402,7 +466,7 @@ export function maintainKitScripts(pkgPath) {
         .filter(([name, r]) => (r.action === 'added' || r.action === 'healed') && !removedKeys.has(name))
         .map(([name]) => name);
     const retired = [...removedKeys].filter((name) => insert.perScript[name]?.action !== 'added');
-    return { insert, retiredReport, portAction, inserted, retired };
+    return { insert, retiredReport, portAction, vercelBuildAction, inserted, retired };
 }
 /**
  * Surgically set the derived project's `package.json.agentKitVersion` to the

package/dist/lib/public-env-keys.json

@@ -0,0 +1,27 @@
+{
+    "prefixes": ["NEXT_PUBLIC_", "RATE_LIMIT_"],
+    "keys": [
+        "APP_URL",
+        "AUTH_DEBUG",
+        "AUTH_GITHUB_ID",
+        "AUTH_GOOGLE_ID",
+        "AUTH_TRUST_HOST",
+        "EMAIL_FROM",
+        "EMAIL_LOGO_URL",
+        "EMAIL_PROVIDER",
+        "EMAIL_SERVER_HOST",
+        "EMAIL_SERVER_PORT",
+        "EMAIL_SERVER_SECURE",
+        "EMAIL_SERVER_USER",
+        "MFA_ENABLED",
+        "MFA_REQUIRED_ALL",
+        "NEXTAUTH_URL",
+        "NODE_ENV",
+        "SENTRY_ORG",
+        "SENTRY_PROJECT",
+        "SUPPORT_EMAIL",
+        "VAPID_SUBJECT",
+        "WEBAUTHN_RP_ID",
+        "WEBAUTHN_RP_NAME"
+    ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.26.0",
+  "version": "1.27.0",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",