@timekast/factory 1.28.0 → 1.28.1

package/dist/commands/provision.js

@@ -26,7 +26,7 @@ import prompts from 'prompts';
 import { FACTORY_ORG } from '../lib/constants.js';
 import { CLIError } from '../lib/cli-error.js';
 import { apexZoneOf, CloudflareApiError, CLOUDFLARE_API_BASE, deleteDnsRecord, ensureCnameRecord, ensureDnsRecord, findCnameRecord, resolveZoneId, resolveZoneIdForName, resolveZoneIdForDomain, CNAME_VERCEL_TARGET, TIMEKAST_ZONE_NAME, provisionDomains, existingProvisionDomains, ORG_ZONE_NAMES, } from '../lib/cloudflare-api.js';
-import { createDevelopBranch, createNeonProject, createProjectApiKey, deleteNeonApiKeysByName, NEON_MAIN_BRANCH, findNeonProjectAcrossOrgs, listNeonOrgs, resolveNeonOrg, deleteNeonProject, getConnectionUri, listNeonBranches, listNeonProjects, NeonApiError, NEON_API_BASE, NEON_DEVELOP_BRANCH, } from '../lib/neon-api.js';
+import { createDevelopBranch, createNeonProject, createProjectApiKey, deleteNeonApiKeysByName, NEON_MAIN_BRANCH, getNeonProjectOrg, listNeonOrgs, resolveNeonOrg, deleteNeonProject, getConnectionUri, listNeonBranches, listNeonProjects, NeonApiError, NEON_API_BASE, NEON_DEVELOP_BRANCH, } from '../lib/neon-api.js';
 import { createBacklogProject, deleteBacklogProject, mintBacklogKey, BacklogApiError, } from '../lib/backlog-api.js';
 import { defaultEnvPath, readEnvKeyNames, readVercelToken, runProvisionPreflight, } from '../lib/provision-preflight.js';
 import { addVercelDomain, buildEnvPlan, createVercelProject, generateAuthSecret, generateMfaEncryptionKey, getLinkedRepoId, getVercelDomainStatus, getVercelProjectByName, GitHubAppNotInstalledError, linkGitRepo, listProjectDomains, listVercelProjects, patchProjectSettings, pushEnvPlan, removeVercelDomain, removeVercelProject, triggerDeployment, upsertEnvVar, listEnvVars, VercelApiError, VERCEL_AUTO_APEX, writeVercelProjectJson, } from '../lib/vercel-env.js';
@@ -565,7 +565,7 @@ export async function provisionNeon(rootDir, state, deps = {}) {
     // already exists — that distinction is the whole point:
     //   - already recorded in the state → use it verbatim, no call, no guessing;
     //   - exists in Neon but the state predates `orgId` (or this is a --remint on an
-    //     older stack) → read it OFF THE PROJECT by sweeping the orgs the key sees;
+    //     older stack) → ask Neon which org owns that project ID (`getNeonProjectOrg`);
     //   - brand new → resolve the selector / the rail default / the only org.
     // Pointing a teardown or a re-mint at the default instead of the project's real
     // org is exactly the class of error this whole change is fixing.
@@ -573,8 +573,19 @@ export async function provisionNeon(rootDir, state, deps = {}) {
     if (!orgId) {
         try {
             if (state.neon?.projectId) {
-                const found = await findNeonProjectAcrossOrgs(apiKey, state.projectName, apiDeps);
-                orgId = found?.org.id;
+                // 🔴 BY ID, not by name. Asking which project is called like this repo's folder
+                // fails for almost every real project — they are named by hand in the console
+                // (`Aditivo CRM`, `agent-fimubac`) — and the fallback then aims at the default
+                // org: silently right inside it, `404 project not found` outside. Both happened
+                // the same afternoon. With the id recorded, one GET answers it exactly.
+                orgId = (await getNeonProjectOrg(apiKey, state.neon.projectId, apiDeps)) ?? undefined;
+                if (!orgId) {
+                    throw new CLIError(`El proyecto Neon \`${state.neon.projectId}\` que registra el estado de este ` +
+                        'repo no existe o la key del rail no lo alcanza.\n' +
+                        '  Si el proyecto se borró, reconstruye el estado con `factory provision --adopt ' +
+                        '--force`. Si existe, revisa que la `NEON_API_KEY` del rail sea la de la cuenta ' +
+                        'de servicio con acceso a su organización.');
+                }
             }
             if (!orgId) {
                 const selector = deps.neonOrg ?? readGateValue('NEON_ORG', envPath) ?? undefined;
@@ -582,11 +593,13 @@ export async function provisionNeon(rootDir, state, deps = {}) {
             }
         }
         catch (error) {
+            if (error instanceof CLIError)
+                throw error;
             if (error instanceof NeonApiError) {
                 throw neonErrorToCliError(error, state.projectName, 'resolver la organización de Neon');
             }
-            // resolveNeonOrg / findNeonProjectAcrossOrgs throw plain Errors whose message
-            // is already the es-MX text the user needs; surface it as-is.
+            // resolveNeonOrg throws plain Errors whose message is already the es-MX text the
+            // user needs; surface it as-is.
             throw new CLIError(error instanceof Error ? error.message : String(error));
         }
     }
@@ -3301,9 +3314,9 @@ async function destroyNeonBranch(target, apiKey, fetchImpl) {
  *
  * The org id is resolved BEFORE the nuke, because after it the project is gone and
  * nothing can say which org owned it any more. It comes from the state when present
- * and is read off the project otherwise (every stack provisioned before `orgId`
- * existed takes that path). Unresolvable → the project is still nuked and only the
- * key cleanup is skipped, with the key named so it can be revoked by hand.
+ * and is asked of Neon BY PROJECT ID otherwise (every stack provisioned before `orgId`
+ * existed takes that path). Unresolvable → the project is still nuked and only the key
+ * cleanup is skipped, with the key named so it can be revoked by hand.
  */
 async function destroyNeonProject(target, apiKey, fetchImpl) {
     const resource = `Neon project (${target.neonProjectId})`;
@@ -3313,9 +3326,11 @@ async function destroyNeonProject(target, apiKey, fetchImpl) {
     const keyName = `${target.slug}-e2e`;
     let orgId = target.neonOrgId;
     if (!orgId) {
+        // BY ID (see `getNeonProjectOrg`): the project's name in the console rarely equals
+        // the repo's slug, so the by-name sweep this used to do found nothing for most real
+        // projects — and the key cleanup was then skipped for no good reason.
         try {
-            const found = await findNeonProjectAcrossOrgs(apiKey, target.slug, { fetchImpl });
-            orgId = found?.org.id ?? null;
+            orgId = await getNeonProjectOrg(apiKey, target.neonProjectId, { fetchImpl });
         }
         catch {
             orgId = null;

package/dist/lib/neon-api.js

@@ -171,36 +171,36 @@ export async function resolveNeonOrg(apiKey, selector, deps = {}) {
         '`NEON_ORG=<nombre>` en `~/.claude/.env`.');
 }
 /**
- * Find an EXISTING project by name across every org the key can reach, and
- * return it together with the org that owns it.
+ * The organization that owns a project, asked BY ID — `GET /projects/{id}`.
  *
- * This is how every operation on an already-created project (`--adopt`,
- * `--destroy`, `--remint`, a `--resume` over a state written before `orgId`
- * existed) learns its org: read it off the project, never from a flag or a
- * default. Using the default here would point a teardown at the wrong org.
+ * 🔴 This is the right question whenever the project id is known, and the reason is a
+ * bug that shipped: the org used to be resolved by sweeping every org for a project
+ * whose NAME equals the repo's slug. Projects are named by humans in the console
+ * (`Aditivo CRM`, `agent-fimubac`), so that match usually fails — and when it fails the
+ * caller falls back to a configured default. In the org that happens to be the default
+ * it silently "works"; outside it, the mint 404s with `project not found`. Observed on
+ * both, the same afternoon. With an id in hand, asking by name is a detour.
  *
- * A name that exists in TWO orgs THROWS instead of picking one — an ambiguous
- * teardown target is precisely what must not resolve silently.
+ * Returns `null` when the project does not exist or the key cannot see it — the caller
+ * then decides (a re-mint refuses; nothing is ever created on a guess).
  *
- * @returns the match, or `null` when no org holds a project with that name.
+ * @throws {NeonApiError} on a non-2xx that is NOT 404 (auth, quota, network): those are
+ *   real failures and must not be read as "no such project".
  */
-export async function findNeonProjectAcrossOrgs(apiKey, projectName, deps = {}) {
-    const orgs = await listNeonOrgs(apiKey, deps);
-    const needle = projectName.trim().toLowerCase();
-    const hits = [];
-    for (const org of orgs) {
-        const projects = await listNeonProjects(apiKey, org.id, deps);
-        for (const project of projects) {
-            if (project.name.trim().toLowerCase() === needle)
-                hits.push({ org, project });
-        }
-    }
-    if (hits.length > 1) {
-        throw new Error(`Hay un proyecto de Neon llamado \`${projectName}\` en más de una organización: ` +
-            `${hits.map((h) => `${h.org.name} (${h.project.id})`).join(', ')}.\n` +
-            '  No elijo por ti: resuélvelo a mano en la consola de Neon (renombra uno) y reintenta.');
+export async function getNeonProjectOrg(apiKey, projectId, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const response = await fetchImpl(`${NEON_API_BASE}/projects/${encodeURIComponent(projectId)}`, {
+        method: 'GET',
+        headers: neonHeaders(apiKey),
+        signal: AbortSignal.timeout(NEON_API_TIMEOUT_MS),
+    });
+    if (response.status === 404)
+        return null;
+    if (!response.ok) {
+        throw new NeonApiError(response.status, await safeBody(response), 'GET /projects/{id}');
     }
-    return hits[0] ?? null;
+    const data = (await response.json());
+    return data.project?.org_id ?? null;
 }
 /**
  * Create a Neon project. The project is born WITH its primary branch — we name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.28.0",
+  "version": "1.28.1",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",