@timekast/factory 1.28.0 → 2.0.0

package/dist/lib/package-json.js

@@ -8,7 +8,7 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { CLIError } from './cli-error.js';
-import { DEV_NEXT_GATE_FILE, DEV_NEXT_SCRIPT_CMD, DEV_NEXT_SCRIPT_NAME, E2E_SETUP_SCRIPT_CMD, E2E_SETUP_SCRIPT_FILE, E2E_SETUP_SCRIPT_NAME, EVIDENCE_VISUAL_SCRIPT_CMD, EVIDENCE_VISUAL_SCRIPT_FILE, EVIDENCE_VISUAL_SCRIPT_NAME, FACTORY_SCRIPTS, GENERATE_REFERENCE_CMD, GENERATE_REFERENCE_GATE_FILE, GENERATE_REFERENCE_NAME, GENERATOR_SCRIPTS, INVITE_ADMIN_SCRIPT_CMD, INVITE_ADMIN_SCRIPT_FILE, INVITE_ADMIN_SCRIPT_NAME, OBSOLETE_SCRIPT_CMDS, VERIFY_QUICK_SCRIPT_CMD, VERIFY_QUICK_SCRIPT_NAME, VERIFY_SCRIPT_CMD, VERIFY_SCRIPT_FILE, VERIFY_SCRIPT_NAME, PORTS_E2E_COMMENT, PORTS_E2E_COMMENT_KEY, PORTS_E2E_KEY, PORTS_KEY, PREFLIGHT_SCRIPT_CMD, PREFLIGHT_SCRIPT_FILE, PREFLIGHT_SCRIPT_NAME, PROFILES, RETIRED_SCRIPT_CMDS, SETUP_E2E_VARS_SCRIPT_CMD, SETUP_E2E_VARS_SCRIPT_FILE, SETUP_E2E_VARS_SCRIPT_NAME, SHIPPED_E2E_PORT, UPDATE_SCRIPT_NAME, VERCEL_BUILD_OBSOLETE_CMDS, VERCEL_BUILD_SCRIPT_CMD, VERCEL_BUILD_SCRIPT_NAME, } from './constants.js';
+import { DEV_NEXT_GATE_FILE, DEV_NEXT_SCRIPT_CMD, DEV_NEXT_SCRIPT_NAME, E2E_SETUP_SCRIPT_CMD, E2E_SETUP_SCRIPT_FILE, E2E_SETUP_SCRIPT_NAME, EVIDENCE_VISUAL_SCRIPT_CMD, EVIDENCE_VISUAL_SCRIPT_FILE, EVIDENCE_VISUAL_SCRIPT_NAME, FACTORY_SCRIPTS, GENERATE_REFERENCE_CMD, GENERATE_REFERENCE_GATE_FILE, GENERATE_REFERENCE_NAME, GENERATOR_SCRIPTS, INVITE_ADMIN_SCRIPT_CMD, INVITE_ADMIN_SCRIPT_FILE, INVITE_ADMIN_SCRIPT_NAME, OBSOLETE_SCRIPT_CMDS, VERIFY_QUICK_SCRIPT_CMD, VERIFY_QUICK_SCRIPT_NAME, VERIFY_SCRIPT_CMD, VERIFY_SCRIPT_FILE, VERIFY_SCRIPT_NAME, PORTS_E2E_COMMENT, PORTS_E2E_COMMENT_KEY, PORTS_E2E_KEY, PORTS_KEY, PREFLIGHT_SCRIPT_CMD, PREFLIGHT_SCRIPT_FILE, PREFLIGHT_SCRIPT_NAME, PROFILES, RETIRED_SCRIPT_CMDS, SETUP_E2E_VARS_SCRIPT_CMD, SETUP_E2E_VARS_SCRIPT_FILE, SETUP_E2E_VARS_SCRIPT_NAME, SHIPPED_E2E_PORT, UPDATE_SCRIPT_NAME, VERCEL_BUILD_OBSOLETE_CMDS, VERCEL_BUILD_SCRIPT_CMD, VERCEL_BUILD_SCRIPT_NAME, WITH_VAULT_SCRIPT_FILE, } from './constants.js';
 /**
  * Auto-detect the profile to install into an existing repo from its
  * `package.json`: a `factoryVersion` field means the repo was born from the
@@ -35,7 +35,7 @@ export function detectProfile(rootDir) {
     }
 }
 /** Detect the indentation used by an existing JSON document (defaults to 2 spaces). */
-function detectIndent(raw) {
+export function detectIndent(raw) {
     const match = raw.match(/^(\s+)"/m);
     if (!match)
         return 2;
@@ -57,6 +57,22 @@ export function parsePackageJson(raw) {
         throw new CLIError('El `package.json` desempacado no es JSON válido; no se puede continuar de forma segura.');
     }
 }
+/**
+ * THE one comparison every heal of a kit-owned script uses (`ensureFactoryScripts`,
+ * `healVercelBuildOrder`, the vault wiring of `wrapper-wiring.ts`): exact match, byte for byte,
+ * against the current command and the registered values the kit shipped. A variant nobody
+ * registered — a flag appended, different spacing, a step chained in front — is `own`: erring
+ * toward "leave it alone" is the safe side of this mistake.
+ */
+export function classifyKitScript(existing, current, shipped) {
+    if (existing === undefined)
+        return 'absent';
+    if (existing === current)
+        return 'current';
+    if (shipped.includes(existing))
+        return 'shipped';
+    return 'own';
+}
 /**
  * Pure core of the script insertion: mutate `pkg.scripts` in place to ensure ALL
  * `factory:*` convenience scripts exist (`update` / `doctor` / `status`), adding
@@ -79,18 +95,19 @@ function ensureFactoryScripts(pkg, extraScripts = {}) {
     for (const [name, cmd] of Object.entries({ ...FACTORY_SCRIPTS, ...extraScripts })) {
         const existing = scripts[name];
         let result;
-        if (existing === undefined) {
+        // The value is a KNOWN-OBSOLETE kit command (e.g. the old `node …mjs` that the .ts
+        // migration retired) → heal it to the current command. A genuinely dev-divergent value
+        // is a `conflict` and is left intact.
+        const kind = classifyKitScript(existing, cmd, OBSOLETE_SCRIPT_CMDS[name] ?? []);
+        if (kind === 'absent') {
             scripts[name] = cmd;
             changed = true;
             result = { action: 'added' };
         }
-        else if (existing === cmd) {
+        else if (kind === 'current') {
             result = { action: 'already-correct' };
         }
-        else if ((OBSOLETE_SCRIPT_CMDS[name] ?? []).includes(existing)) {
-            // The value is a KNOWN-OBSOLETE kit command (e.g. the old `node …mjs` that
-            // the .ts migration retired) — heal it to the current command. A genuinely
-            // dev-divergent value falls through to `conflict` and is left intact.
+        else if (kind === 'shipped') {
             scripts[name] = cmd;
             changed = true;
             result = { action: 'healed' };
@@ -112,7 +129,8 @@ function ensureFactoryScripts(pkg, extraScripts = {}) {
  *
  * - `preflight` — when its sweep script ships (full brain).
  * - `setup:e2e:vars` — publishes the CI E2E auth env vars (Fase 1 of the
- *   `e2e-ci-auth-env` retrofit), when `scripts/tools/setup-e2e.ts` ships (full brain).
+ *   `e2e-ci-auth-env` retrofit), when `scripts/tools/setup-e2e.ts` ships (full brain) AND the
+ *   vault wrapper `scripts/tools/with-vault.mjs` does too — its value runs through it (VAULT-004).
  * - `evidence:visual` — the visual-evidence harness (`fx-visual-evidence`), gated on the
  *   harness itself (`scripts/tools/visual-evidence/`) rather than on the runner: it is what
  *   this alias needs, and a `core` derivative receives neither. Forwards to `test:e2e`, so the
@@ -152,7 +170,10 @@ export function kitLocalScripts(rootDir) {
         scripts[PREFLIGHT_SCRIPT_NAME] = PREFLIGHT_SCRIPT_CMD;
     if (has(INVITE_ADMIN_SCRIPT_FILE))
         scripts[INVITE_ADMIN_SCRIPT_NAME] = INVITE_ADMIN_SCRIPT_CMD;
-    if (has(SETUP_E2E_VARS_SCRIPT_FILE))
+    // Its value runs through the vault wrapper, so it is ALSO gated on the wrapper: without it
+    // the alias is neither inserted nor healed (a script pointing at a missing file is worse than
+    // an old one that still runs).
+    if (has(SETUP_E2E_VARS_SCRIPT_FILE) && has(WITH_VAULT_SCRIPT_FILE))
         scripts[SETUP_E2E_VARS_SCRIPT_NAME] = SETUP_E2E_VARS_SCRIPT_CMD;
     if (has(E2E_SETUP_SCRIPT_FILE))
         scripts[E2E_SETUP_SCRIPT_NAME] = E2E_SETUP_SCRIPT_CMD;
@@ -401,15 +422,15 @@ export function healVercelBuildOrder(pkgPath) {
     const scripts = pkg.scripts;
     if (typeof scripts !== 'object' || scripts === null || Array.isArray(scripts))
         return 'absent';
-    const current = scripts[VERCEL_BUILD_SCRIPT_NAME];
-    if (current === undefined)
-        return 'absent';
-    if (current === VERCEL_BUILD_SCRIPT_CMD)
-        return 'already-correct';
     // Exact match against what the kit actually shipped, byte for byte. A dev who appended a flag
     // — or wrote the same two halves with different spacing — keeps their command through every
     // future update: an unlisted variant erring toward "leave it alone" is the safe side here.
-    if (!VERCEL_BUILD_OBSOLETE_CMDS.includes(current))
+    const kind = classifyKitScript(scripts[VERCEL_BUILD_SCRIPT_NAME], VERCEL_BUILD_SCRIPT_CMD, VERCEL_BUILD_OBSOLETE_CMDS);
+    if (kind === 'absent')
+        return 'absent';
+    if (kind === 'current')
+        return 'already-correct';
+    if (kind === 'own')
         return 'preserved';
     scripts[VERCEL_BUILD_SCRIPT_NAME] = VERCEL_BUILD_SCRIPT_CMD;
     writeFileSync(pkgPath, `${JSON.stringify(pkg, null, indent)}\n`, 'utf8');

package/dist/lib/preflight.js

@@ -15,12 +15,11 @@
  * --launcher` can render every step with ✅ / ❌ across all platforms (the
  * cross-platform equivalent of the macOS launcher's `checkPrereqs`).
  */
-import { readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import path from 'node:path';
 import { execa } from 'execa';
 import { PreflightError } from './cli-error.js';
 import { FACTORY_ORG } from './constants.js';
+import { RailError, createRailResolver } from './rail.js';
+import { VAULT_CONFIG } from './vault-config.js';
 /** Minimum Node major version the kit requires (mirrors `engines.node` + the launcher AppleScript). */
 export const MIN_NODE_MAJOR = 22;
 /** Timeout (ms) for the GitHub API calls in the org-membership check — a slow / dead network must not hang. */
@@ -136,9 +135,10 @@ export async function runPreflight() {
     await assertOrgMembership();
 }
 /**
- * The methodology-rail keys the launcher expects in `~/.claude/.env` (imported
- * via `factory secrets <file>`). Provisioning tokens + their team/org ids + the
- * proposal tooling keys. Single source so the check + tests agree.
+ * The methodology-rail keys the launcher expects in the vault rail (`rail-timekast`,
+ * read with the person's session — `fx-secrets-vault §3`). Provisioning tokens +
+ * their team/org ids + the proposal tooling keys. Single source so the check + tests
+ * agree.
  *
  * `NEON_ORG` is deliberately NOT here: it only names a default organization, and
  * its absence is a valid configuration (a key that reaches exactly one org needs
@@ -153,14 +153,26 @@ export const REQUIRED_SECRET_KEYS = [
     'SHORTIO_API_KEY',
     'GAMMA_API_KEY',
     'VERCEL_TEAM_ID',
+    // RWAY-003: `provision` asks Railway for the connected repo to discover a repo's destination
+    // (and to refuse a `--target=vercel` over a repo that lives in Railway) — in Vercel repos too.
+    'RAILWAY_TOKEN',
 ];
+/**
+ * Time budget (ms) of the launcher's vault read. Deliberately SHORTER than the
+ * resolver's default (`RAIL_READ_TIMEOUT_MS`, 30 s): the desktop launcher waits 30 s
+ * IN TOTAL for the whole `doctor --launcher --json` document
+ * (`desktop/renderer/panels/home.tsx`), and `npx @latest` already eats part of that.
+ * A vault that does not answer must end as a `warn` "could not be determined" inside
+ * the document — not as a launcher-side "connection error" because the JSON never came.
+ */
+export const LAUNCHER_RAIL_TIMEOUT_MS = 10_000;
 /** The ordered launcher labels (single source so render + tests agree). */
 const LAUNCHER_LABELS = {
     node: `Node ≥ ${MIN_NODE_MAJOR}`,
     gh: 'GitHub CLI (gh) instalado',
     auth: 'Sesión de GitHub activa',
     org: `Membresía del org ${FACTORY_ORG}`,
-    secrets: 'Secrets del org en el rail',
+    secrets: `Secrets del org en la bóveda (${VAULT_CONFIG.rail.name})`,
 };
 /** A confirmation message for a passing check (the `ok` branch). */
 const OK_MESSAGES = {
@@ -168,43 +180,81 @@ const OK_MESSAGES = {
     gh: 'GitHub CLI (gh) está instalado.',
     auth: 'Tu sesión de GitHub CLI está activa.',
     org: `Eres miembro del org ${FACTORY_ORG}.`,
-    secrets: `Las ${REQUIRED_SECRET_KEYS.length} keys del rail están presentes.`,
+    secrets: `Las ${REQUIRED_SECRET_KEYS.length} claves requeridas están en ` +
+        `\`${VAULT_CONFIG.rail.name}\` y tu sesión de la bóveda está activa.`,
 };
+/** The vault state skeleton — coordinates always present, everything else undetermined. */
+function vaultState(overrides) {
+    return {
+        domain: VAULT_CONFIG.domain,
+        project: VAULT_CONFIG.rail.name,
+        session: null,
+        access: null,
+        missingKeys: null,
+        unknownReason: null,
+        ...overrides,
+    };
+}
+/** Map a rail failure (other than a missing key) to the published vault state. */
+function vaultStateForFailure(kind) {
+    switch (kind) {
+        case 'no-session':
+            return vaultState({ session: false });
+        case 'no-access':
+            return vaultState({ session: true, access: false });
+        case 'not-installed':
+        case 'timeout':
+        case 'unrecognized':
+            return vaultState({ unknownReason: kind });
+        case 'key-missing':
+            // Never reaches here (`getOptional` turns it into `null`), kept for exhaustiveness.
+            return vaultState({ session: true, access: true });
+    }
+}
 /**
- * Read the secret KEY NAMES present in the rail (`~/.claude/.env`), never values.
- * A missing/unreadable rail yields an empty set (→ the check warns with all keys
- * missing). Tests inject `railContent` to avoid touching the real home dir.
+ * Build the secrets check against the vault rail: session → access → presence of
+ * each {@link REQUIRED_SECRET_KEYS}, in that order (the resolver reads the rail
+ * project ONCE; a session/access failure surfaces on the first key). NAMES ONLY —
+ * each value is dropped the moment the resolver hands it over.
+ *
+ * Never `fail`, never throws: every outcome is `ok` or `warn`. The message on a
+ * failure is the resolver's own (built from the classification, never from what
+ * the vault printed), so it names the login command with the domain, the rail
+ * project, or how to install `infisical`.
  */
-function readRailKeyNames(railContent) {
-    let content = railContent;
-    if (content === undefined) {
-        try {
-            content = readFileSync(path.join(homedir(), '.claude', '.env'), 'utf8');
-        }
-        catch {
-            content = '';
+async function secretsCheck(rail) {
+    const base = { id: 'secrets', label: LAUNCHER_LABELS.secrets };
+    const missing = [];
+    try {
+        for (const key of REQUIRED_SECRET_KEYS) {
+            // Presence only: the value is compared to null and discarded right here.
+            if ((await rail.getOptional(key)) === null)
+                missing.push(key);
         }
     }
-    const names = new Set();
-    for (const line of content.split(/\r?\n/)) {
-        const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/);
-        if (match)
-            names.add(match[1]);
+    catch (error) {
+        const kind = error instanceof RailError ? error.kind : 'unrecognized';
+        return {
+            ...base,
+            status: 'warn',
+            // A non-RailError is not ours to echo (its text could carry anything).
+            message: error instanceof RailError
+                ? error.message
+                : 'No se pudo determinar el estado de la bóveda (error interno al leerla).',
+            vault: vaultStateForFailure(kind),
+        };
+    }
+    const vault = vaultState({ session: true, access: true, missingKeys: missing });
+    if (missing.length === 0) {
+        return { ...base, status: 'ok', message: OK_MESSAGES.secrets, vault };
     }
-    return names;
-}
-/** Build the secrets check (`ok` if all required keys present, else `warn`). */
-function secretsCheck(railContent) {
-    const present = readRailKeyNames(railContent);
-    const missing = REQUIRED_SECRET_KEYS.filter((key) => !present.has(key));
     return {
-        id: 'secrets',
-        label: LAUNCHER_LABELS.secrets,
-        status: missing.length === 0 ? 'ok' : 'warn',
-        message: missing.length === 0
-            ? OK_MESSAGES.secrets
-            : `Faltan ${missing.length} de ${REQUIRED_SECRET_KEYS.length} secrets en el rail: ` +
-                `${missing.join(', ')}. Impórtalos desde el card Secrets.`,
+        ...base,
+        status: 'warn',
+        message: `Faltan ${missing.length} de ${REQUIRED_SECRET_KEYS.length} claves en ` +
+            `\`${VAULT_CONFIG.rail.name}\`: ${missing.join(', ')}.\n` +
+            'Pide a un admin de la bóveda que las cargue.',
+        vault,
     };
 }
 /**
@@ -222,6 +272,10 @@ function secretsCheck(railContent) {
  * depends on the previous — no auth without gh, no org without auth) but still
  * RETURNS a full ordered report, marking the checks after the failure as
  * `skipped`. The caller decides exit code (0 = all ok, 1 = any fail).
+ *
+ * Then, always and independently of 1-4, the `secrets` check (5): session → access
+ * → key presence in the vault rail. It is `ok` or `warn`, never `fail`, so it never
+ * trips the exit code.
  */
 export async function runLauncherPreflight(deps = {}) {
     const ghInstalled = deps.ghInstalled ?? assertGhInstalled;
@@ -274,6 +328,6 @@ export async function runLauncherPreflight(deps = {}) {
     }
     // Secrets check — independent of the gh/auth/org chain (runs even if those
     // failed) and non-blocking: resolves to `ok` or `warn`, never `fail`/`skipped`.
-    results.push(secretsCheck(deps.railContent));
+    results.push(await secretsCheck(deps.rail ?? createRailResolver({ timeoutMs: LAUNCHER_RAIL_TIMEOUT_MS })));
     return results;
 }