@timekast/factory 1.28.1 → 2.0.0

package/dist/commands/vault.js

@@ -0,0 +1,2627 @@
+/**
+ * `factory vault adopt [--apply]` (ADOPT-001) — move a repo born before the vault into it.
+ * Contract: `fx-secrets-vault §8`. The decisions live in `lib/vault-adopt.ts`; this module runs
+ * them against the real services, in the order the contract fixes:
+ *
+ *   Preconditions (both modes) — `core` profile → says so and does nothing; the brain up to date
+ *   (the comparison of `factory status`); no fork in the files the wrapper runs (the census of
+ *   `factory update --verify`).
+ *
+ *   Plan (no `--apply`) — inventory by NAME and display hash of `.env.local`, Vercel production +
+ *   preview and Railway; the state of each key, where the apply would write it, the confirmations
+ *   it will ask, the scripts of `package.json` it would rewrite or leave alone, and the GitHub
+ *   secrets it compares with `develop:/ci`. WRITES NOTHING.
+ *
+ *   Apply — (1) project + members, (2) the writes of the layout (ADR-005), (3) the syncs of
+ *   SYNC-001 with its caller flag (`guardForeignKeys: false`), (4) the link in
+ *   `.timekast/provision.json`, (5) the wrapper wiring (diff shown first), (6) `.env.local` →
+ *   `.env.local.pre-vault.bak`. A failure in any step leaves `.env.local` intact.
+ *
+ * FIRST SYNC ON A LIVE DEPLOY — answered by the user (2026-09-24): "importar primero; hacia
+ * GitHub, listar los nombres y detenerse antes de crear el sync si falta alguno en develop:/ci".
+ * So every key a deploy holds is written to the vault BEFORE any sync exists (a sync then finds a
+ * superset of its destination and deletes nothing — checked again right before creating it), and
+ * when a secret of the repo is missing from `develop:/ci` the apply stops before creating ANY
+ * sync, naming it. A `sensitive` var cannot be imported by reading it: it is CLASSIFIED
+ * (ADOPT-003) — derivable (recomputed from its provider), rotable (generated, or re-issued at its
+ * provider) or sealed (the apply stops and explains the bridge deploy; never generated).
+ *
+ * 🔴 NO-ECHO: stdout, stderr, errors and the `--json` plan carry key names, locations and display
+ * hashes — never a value.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { execa } from 'execa';
+import prompts from 'prompts';
+import { CLIError } from '../lib/cli-error.js';
+import { WITH_VAULT_SCRIPT_FILE } from '../lib/constants.js';
+import { parseEnvBody } from '../lib/env-wizard.js';
+import { hasLockfile, readLockfile } from '../lib/lockfile.js';
+import { getConnectionUri, getNeonProjectOrg, isNeonKeyFamily, listNeonApiKeys, listNeonBranches, NEON_DEVELOP_BRANCH, NeonApiKeyListError, } from '../lib/neon-api.js';
+import { detectCoreProfile } from '../lib/provision-preflight.js';
+import { readDestroyTarget, readNeonRevokePending, readVaultDeclined, readVaultLink, addNeonRevokePending, } from '../lib/provision-state.js';
+import { createRailResolver, RAIL_TIMEKAST } from '../lib/rail.js';
+import { createRailwayClient, RAILWAY_TOKEN_KEY, railwayFetchTransport, } from '../lib/railway-api.js';
+import { buildPlanEntries, classifySensitive, createDisplayHasher, describeWrite, ENV_LOCAL_BACKUP_FILE, ENV_LOCAL_FILE, FACTORY_REPO, FACTORY_SLUG, folderOfTarget, isConnectedEmptyDeploy, isFactoryIdentity, manualVaultProjectSteps, isFactoryMode, isProjectScopedNeonKey, isRailKey, isRailwayProvided, isRailwaySyncTo, listRailwayProjects, MFA_KEY, NEON_API_KEY, planAdoptionLayout, planRailwayImport, proposeRailwaySyncs, RAILWAY_VAULT_ENVS, railwaySyncDifferences, railwaySyncLabel, railwaySyncName, readRailwayInventory, readRailwayVariables, recordedAdoptionVercelId, RESEND_KEY, retiredKeys, retireEnvLocal, sealedStopExplanation, sharedCandidatesOf, SHORTIO_KEY, wrapperDrift, writeAdoptionLink, writeDeclineMark, } from '../lib/vault-adopt.js';
+import { createVaultClient, formatLocation, VAULT_CI_PATH, VAULT_ENV_DEVELOP, VAULT_ENV_LOCAL, VAULT_ENV_MAIN, VAULT_ROOT_PATH, VAULT_TEST_ISOLATION_KEY, VaultSeamMissingError, } from '../lib/vault-api.js';
+import { LOCAL_ONLY_KEYS } from '../lib/env-file.js';
+import { buildEnvPlan, deployHostCandidates, generateAuthSecret, listEnvVarNames, listProjectDomains, locateVercelProject, readEnvVarsWithValues, relatedOriginsFor, } from '../lib/vercel-env.js';
+import { DEPLOY_ENVS, DEPLOYS_REGISTRY_FILE, planDeploys, readDeploysRegistry, recordDeployProjectId, resolveDeploy, } from '../lib/vault-deploys.js';
+import { wireVaultWrapper } from '../lib/wrapper-wiring.js';
+import { assertValidSubdomainSlug, ensureVaultSyncs, ghSecretNames, mintProjectResendKey, parseOriginRepoSlug, PROJECT_CONFIG_PATH, provisionNeon, PROVISION_EMAIL_FROM, readConfigSlug, readE2eParentBranch, readOriginUrl, reportDeleteProtection, resolveDevelopBranch, resolveMainBranch, revokeResendKey, settleNeonRevokes, syncTargetsDestination, VAULT_SYNC_PLAN, } from './provision.js';
+import { computeStatus } from './status.js';
+// ---------------------------------------------------------------------------
+// Help + flags
+// ---------------------------------------------------------------------------
+/** What `factory vault` prints without a subcommand. */
+export const VAULT_HELP = `
+factory vault — la bóveda de secretos de la organización (fx-secrets-vault).
+
+Uso:
+  factory vault adopt [--apply] [--json] [--team=<id>] [--vercel-project <id>]
+  factory vault adopt --decline
+  factory vault sync railway --project <id> --service <id> --env <main|develop> [--railway-env <nombre>]
+  factory vault deploys [--deploy <slug>] [--apply] [--yes]
+
+Subcomandos:
+  adopt    Pasa a la bóveda un repo que nació antes de ella (fx-secrets-vault §8).
+           Sin --apply sólo enseña el plan: inventario por nombre y huella (nunca por valor)
+           de .env.local, Vercel production/preview y Railway, y dónde iría cada clave.
+           Con --apply: crea el proyecto con sus miembros, importa (main y develop desde el
+           deploy, local desde .env.local), crea los syncs, guarda el vínculo en
+           .timekast/provision.json, cablea el wrapper y renombra .env.local a
+           .env.local.pre-vault.bak. Cada diferencia la confirmas tú; sin terminal, no se
+           confirma nada a ciegas.
+           Si el repo despliega a Railway (el proyecto con el repo conectado, se llame como se
+           llame), propone un sync por cada servicio cuyo entorno de Railway se llama como uno
+           de la bóveda (main, develop), y lo crea después de importar. Con dos o más proyectos
+           conectados se detiene sin escribir: son varios despliegues (vault deploys).
+    --apply      Ejecuta el plan
+    --json       (sólo sin --apply) el plan como JSON — nombres y huellas, nunca valores
+    --team=<id>  Team de Vercel (default: VERCEL_TEAM_ID de rail-timekast)
+    --vercel-project <id>
+                 Con varios proyectos de Vercel conectados al repo, elige el que queda como
+                 proyecto principal (tiene que ser uno de ellos). Los demás despliegues se
+                 operan después con \`factory vault deploys\`.
+    --decline    Registra en .timekast/provision.json que este repo NO entra a la bóveda:
+                 sigue con .env.local y env:push, y doctor deja de proponerlo. No toca nada
+                 más ni consulta ningún servicio. Adoptar después sigue siendo posible.
+
+  sync railway
+           Crea el sync de un entorno de la bóveda del repo (su carpeta raíz) a un servicio de
+           Railway, con RAILWAY_TOKEN de rail-timekast. Antes importa a la bóveda lo que sólo
+           tiene Railway, así el primer sync no borra nada. Correrlo otra vez no duplica.
+    --project <id>          Proyecto de Railway
+    --service <id>          Servicio de Railway
+    --env <main|develop>    Entorno de la bóveda (y, por default, el de Railway con ese nombre)
+    --railway-env <nombre>  Entorno de Railway cuando se llama distinto (p. ej. production)
+
+  deploys  Un repo que se despliega N veces (uno por cliente): lee .timekast/deploys.json y
+           siembra el proyecto de la bóveda de cada despliegue desde la plantilla, con esta
+           precedencia por clave: su valor propio → lo que deriva su registro → la plantilla.
+           Sin --apply sólo enseña el plan (por nombre de clave, nunca por valor). Con --apply
+           crea lo que falta (y anota en el registro el id de cada proyecto que crea), escribe
+           y crea el sync de cada despliegue a SU Vercel / Railway. Un proyecto que ya existe
+           se adopta sólo si su id está anotado en el registro. Antes de escribir comprueba que
+           ningún valor de un despliegue esté en otro ni en el principal: si lo encuentra, no
+           escribe nada (fx-secrets-vault §6). Si va a cambiar valores ya guardados, los lista
+           y pide confirmación.
+    --deploy <slug>  Sólo ese despliegue (los demás se leen igual, para la comprobación)
+    --apply          Ejecuta el plan
+    --yes            (con --apply) confirma sin terminal los valores guardados que cambia
+
+No confundir con \`factory provision --adopt\`, que reconstruye el registro de infraestructura
+(.timekast/provision.json) y no toca secretos.
+`;
+/** Parse the argv AFTER `adopt`. Unknown flags stop (a typo must not run a real apply). */
+export function parseVaultAdoptFlags(argv) {
+    const flags = { apply: false, json: false };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === '--apply')
+            flags.apply = true;
+        else if (arg === '--json')
+            flags.json = true;
+        else if (arg === '--decline')
+            flags.decline = true;
+        else if (arg.startsWith('--team=') && arg.length > '--team='.length) {
+            flags.team = arg.slice('--team='.length);
+        }
+        else if (arg === '--vercel-project' || arg.startsWith('--vercel-project=')) {
+            let value;
+            if (arg.startsWith('--vercel-project='))
+                value = arg.slice('--vercel-project='.length);
+            else if (argv[i + 1] !== undefined && !argv[i + 1].startsWith('--')) {
+                value = argv[i + 1];
+                i += 1;
+            }
+            if (value === undefined || value.trim() === '') {
+                throw new CLIError('`--vercel-project` necesita el id de un proyecto de Vercel.');
+            }
+            flags.vercelProject = value.trim();
+        }
+        else {
+            throw new CLIError(`Opción desconocida para \`factory vault adopt\`: \`${arg}\`. Uso: \`factory vault adopt [--apply] [--json] [--team=<id>] [--vercel-project <id>]\` o \`factory vault adopt --decline\`.`);
+        }
+    }
+    if (flags.apply && flags.json) {
+        throw new CLIError('`--json` es sólo para el plan (sin `--apply`).');
+    }
+    if (flags.decline &&
+        (flags.apply || flags.json || flags.team !== undefined || flags.vercelProject !== undefined)) {
+        throw new CLIError('`--decline` va solo: registra que el repo no entra a la bóveda, sin plan ni `--apply`.');
+    }
+    return flags;
+}
+/** `factory vault <sub>` — dispatch. Without a subcommand it prints {@link VAULT_HELP}. */
+export async function runVaultCommand(argv, deps = {}) {
+    const [sub, ...rest] = argv;
+    if (sub === undefined) {
+        console.log(VAULT_HELP);
+        return;
+    }
+    if (sub === 'adopt') {
+        const result = await runVaultAdopt(parseVaultAdoptFlags(rest), deps);
+        // A sealed key is a RESULT (the stop and its explanation), reported with its own exit code.
+        if (result.status === 'sealed')
+            process.exitCode = VAULT_ADOPT_SEALED_EXIT_CODE;
+        return;
+    }
+    if (sub === 'deploys') {
+        await runVaultDeploys(parseVaultDeploysFlags(rest), deps);
+        return;
+    }
+    if (sub === 'sync') {
+        const [target, ...flags] = rest;
+        if (target !== 'railway') {
+            throw new CLIError(`Destino de \`factory vault sync\` desconocido: \`${target ?? ''}\`. Uso: ${VAULT_SYNC_RAILWAY_USAGE}.`);
+        }
+        await runVaultSyncRailway(parseVaultSyncRailwayFlags(flags), deps);
+        return;
+    }
+    throw new CLIError(`Subcomando de vault desconocido: \`${sub}\`. Uso: \`factory vault adopt\`, ${VAULT_DEPLOYS_USAGE} o ` +
+        `${VAULT_SYNC_RAILWAY_USAGE}.`);
+}
+// ---------------------------------------------------------------------------
+// `factory vault sync railway` — flags (ADOPT-002)
+// ---------------------------------------------------------------------------
+const VAULT_SYNC_RAILWAY_USAGE = '`factory vault sync railway --project <id> --service <id> --env <main|develop> [--railway-env <nombre>]`';
+const SYNC_RAILWAY_FLAGS = ['--project', '--service', '--env', '--railway-env'];
+/**
+ * Parse the argv AFTER `sync railway`. `--flag value` and `--flag=value` both work. A missing
+ * required flag stops naming it (never a partial sync); an unknown one stops too.
+ */
+export function parseVaultSyncRailwayFlags(argv) {
+    const values = new Map();
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        const eq = arg.indexOf('=');
+        const name = eq === -1 ? arg : arg.slice(0, eq);
+        if (!SYNC_RAILWAY_FLAGS.includes(name)) {
+            throw new CLIError(`Opción desconocida para \`factory vault sync railway\`: \`${arg}\`. Uso: ${VAULT_SYNC_RAILWAY_USAGE}.`);
+        }
+        let value;
+        if (eq !== -1)
+            value = arg.slice(eq + 1);
+        else if (argv[i + 1] !== undefined && !argv[i + 1].startsWith('--')) {
+            value = argv[i + 1];
+            i += 1;
+        }
+        if (value === undefined || value.trim() === '') {
+            throw new CLIError(`\`${name}\` necesita un valor. Uso: ${VAULT_SYNC_RAILWAY_USAGE}.`);
+        }
+        values.set(name, value.trim());
+    }
+    const missing = ['--project', '--service', '--env'].filter((flag) => !values.has(flag));
+    if (missing.length > 0) {
+        throw new CLIError(`Falta ${missing.map((flag) => `\`${flag}\``).join(', ')}: no creo un sync a medias. ` +
+            `Uso: ${VAULT_SYNC_RAILWAY_USAGE}.`);
+    }
+    const env = values.get('--env').toLowerCase();
+    if (!RAILWAY_VAULT_ENVS.includes(env)) {
+        throw new CLIError(`\`--env\` es un entorno de despliegue de la bóveda: ${RAILWAY_VAULT_ENVS.join(' o ')} ` +
+            `(\`${VAULT_ENV_LOCAL}\` nunca se sincroniza). Recibí \`${values.get('--env')}\`.`);
+    }
+    return {
+        project: values.get('--project'),
+        service: values.get('--service'),
+        env,
+        ...(values.has('--railway-env') ? { railwayEnv: values.get('--railway-env') } : {}),
+    };
+}
+/** The seams that reach the network, a session, git or `gh` — REQUIRED under Vitest. */
+const REQUIRED_TEST_SEAMS = [
+    'vaultClient',
+    'rail',
+    'fetchImpl',
+    'fetchLatest',
+    'listGithubSecretNames',
+    'resolveOriginRepo',
+    'isGitIgnored',
+];
+/**
+ * 🔴 Fail-closed under the CLI's Vitest setup (the vault client's own marker): a run without every
+ * seam that reaches a real service refuses BEFORE touching anything — no request to the vault,
+ * Vercel, Railway or GitHub, and no read or write of `.timekast/provision.json`, `package.json` or
+ * `.env.local`. Outside Vitest the marker does not exist and the real seams are used.
+ */
+function assertAdoptSeams(deps) {
+    if (globalThis[VAULT_TEST_ISOLATION_KEY] === undefined)
+        return;
+    for (const seam of REQUIRED_TEST_SEAMS) {
+        if (deps[seam] === undefined)
+            throw new VaultSeamMissingError(seam);
+    }
+}
+/**
+ * `owner/repo` of the `origin` remote — the same reader `provision` uses (`readOriginUrl`), over a
+ * real `git`. The default of the `resolveOriginRepo` seam; `null` without an `origin`.
+ */
+export async function originRepoOf(rootDir) {
+    const url = await readOriginUrl(async (args, cwd) => {
+        const { stdout } = await execa('git', args, { cwd });
+        return { stdout };
+    }, rootDir);
+    return url === null ? null : parseOriginRepoSlug(url);
+}
+async function defaultAskHost(question) {
+    const answer = (await prompts({ type: 'text', name: 'host', message: question }));
+    return typeof answer?.host === 'string' ? answer.host : null;
+}
+function defaultIsGitIgnored(rootDir) {
+    return async (relPath) => {
+        const result = await execa('git', ['check-ignore', '-q', relPath], {
+            cwd: rootDir,
+            reject: false,
+        });
+        return result.exitCode === 0;
+    };
+}
+async function defaultConfirm(question) {
+    const answer = (await prompts({
+        type: 'confirm',
+        name: 'ok',
+        message: question,
+        initial: false,
+    }));
+    return answer?.ok === true;
+}
+// ---------------------------------------------------------------------------
+// The plan
+// ---------------------------------------------------------------------------
+/** `owner/name` of a GitHub repo — checked before it reaches `gh` or a sync. */
+const REPO_RE = /^[A-Za-z0-9_.][A-Za-z0-9_.-]*\/[A-Za-z0-9_.][A-Za-z0-9_.-]*$/;
+const UNKNOWN = 'unknown';
+/**
+ * Exit code of `factory vault adopt --apply` when it stops on a sealed key: a RESULT the command
+ * reports (`resolveSuccessExitCode`), distinct from 0 so no one — person or agent — reads it as done.
+ */
+export const VAULT_ADOPT_SEALED_EXIT_CODE = 3;
+function realField(value) {
+    return value && value !== UNKNOWN ? value : null;
+}
+/** Split Vercel vars per target (the inventory's production/preview maps). */
+function vercelMaps(vars) {
+    const production = new Map();
+    const preview = new Map();
+    const branchScoped = [];
+    const sensitive = [];
+    const unreadableOther = new Set();
+    const note = (key, type, value, target) => {
+        if (value !== null)
+            return;
+        if (type === 'sensitive')
+            sensitive.push({ key, target });
+        else
+            unreadableOther.add(key);
+    };
+    for (const env of vars) {
+        if (env.target.includes('production')) {
+            production.set(env.key, env.value);
+            note(env.key, env.type, env.value, 'production');
+        }
+        if (env.target.includes('preview')) {
+            if (env.gitBranch)
+                branchScoped.push({ name: env.key, branch: env.gitBranch });
+            else {
+                preview.set(env.key, env.value);
+                note(env.key, env.type, env.value, 'preview');
+            }
+        }
+    }
+    return {
+        production,
+        preview,
+        branchScoped,
+        sensitive,
+        unreadableOther: [...unreadableOther].sort(),
+    };
+}
+/** Why a derivation needs a host, and which one. */
+function hostFor(item) {
+    if (item.verdict.class !== 'derivable')
+        return null;
+    switch (item.verdict.derive) {
+        case 'app-url':
+            return item.target === 'production' ? 'prod' : 'dev';
+        case 'rp-id':
+            return 'prod';
+        case 'related-origins':
+            return 'dev';
+        default:
+            return null;
+    }
+}
+/** How the plan describes one sensitive var — its source, its effect or its reason; no value. */
+function sensitiveDetail(item, hosts, neonProjectId) {
+    const v = item.verdict;
+    const where = formatLocation(folderOfTarget(item.target));
+    if (v.class === 'derivable') {
+        const host = hostFor(item);
+        const domain = host && hosts[host] ? ` (\`${hosts[host]}\`)` : '';
+        const neon = v.derive === 'neon-pooled' && neonProjectId
+            ? ` — proyecto \`${neonProjectId}\`, ${item.target === 'production' ? 'su branch default (producción)' : `branch \`${NEON_DEVELOP_BRANCH}\` (o, sin él, el de E2E)`}`
+            : '';
+        return `sale de ${v.source}${domain}${neon} → ${where}`;
+    }
+    if (v.class === 'rotable') {
+        const effect = v.effect.replace('de ese entorno', item.target === 'production' ? 'de producción' : 'de preview');
+        return v.rotate === 'auth-secret'
+            ? `genero uno nuevo tras tu confirmación — ${effect} → ${where}`
+            : `no la genero: ${effect}. La adopción espera a que esté en ${where}`;
+    }
+    if (v.class === 'sellada')
+        return `${v.reason}; se recupera con un deploy puente → ${where}`;
+    return 'el kit no la conoce: te pregunto si cifra datos guardados; sin terminal o sin respuesta, se trata como sellada';
+}
+/** Write the sensitive part of the plan from the items (again after the unknowns are resolved). */
+function refreshSensitivePlan(plan, items, hosts, neonProjectId, vaultProjectExists) {
+    plan.sensitive = items.map((item) => ({
+        name: item.key,
+        target: item.target,
+        class: item.verdict.class,
+        detail: sensitiveDetail(item, hosts, neonProjectId),
+        inVault: item.inVault,
+        ...(item.blocked && !item.inVault ? { blocked: item.blocked } : {}),
+    }));
+    plan.sealed = items
+        .filter((item) => item.verdict.class === 'sellada' && !item.inVault)
+        .map((item) => ({ name: item.key, target: item.target }));
+    plan.sealedExplanation =
+        plan.sealed.length > 0
+            ? sealedStopExplanation(plan.sealed, plan.slug, vaultProjectExists)
+            : null;
+}
+/**
+ * Classify every `sensitive` var of the inventory (a retired key is never imported, so it is left
+ * out), check whether each is ALREADY in its vault folder (after a bridge deploy, or a key loaded by
+ * hand), and read — only when a derivation needs it — the project's domains in Vercel. Reads only.
+ */
+async function inspectSensitive(input) {
+    const hosts = { prod: null, dev: null };
+    const hostCandidates = { prod: [], dev: [] };
+    const items = input.found
+        .filter((f) => !input.retired.has(f.key))
+        .map((f) => ({
+        key: f.key,
+        target: f.target,
+        verdict: classifySensitive({
+            key: f.key,
+            type: 'sensitive',
+            target: f.target,
+        }),
+        inVault: false,
+    }));
+    if (items.length === 0)
+        return { items, hosts, hostCandidates, vaultProjectExists: true };
+    const projectId = input.vaultProjectId ?? (await input.client.findProjectBySlug(input.slug))?.id ?? null;
+    if (projectId) {
+        const keysAt = new Map();
+        for (const item of items) {
+            const folder = folderOfTarget(item.target);
+            const where = formatLocation(folder);
+            if (!keysAt.has(where)) {
+                keysAt.set(where, new Set(await input.client.listSecretKeys(projectId, folder)));
+            }
+            item.inVault = keysAt.get(where)?.has(item.key) === true;
+        }
+    }
+    const problems = {};
+    if (items.some((item) => !item.inVault && hostFor(item) !== null)) {
+        if (!input.vercelProject) {
+            problems.prod = problems.dev = 'no hay proyecto de Vercel del que leer el dominio';
+        }
+        else {
+            let domains;
+            try {
+                domains = await listProjectDomains(input.vercelProject.id, input.vercelToken, input.teamId, {
+                    fetchImpl: input.fetchImpl,
+                });
+            }
+            catch {
+                throw new CLIError('Vercel no respondió bien al leer los dominios del proyecto. No hice nada.');
+            }
+            // ONE rule for the production host (the same as the connected-and-empty deploy's): the
+            // domains not bound to a branch; exactly one → it; zero or several → the `--apply` ASKS,
+            // never prefers one (an own domain over `*.vercel.app` was a guess, too).
+            const candidates = deployHostCandidates(domains);
+            hostCandidates.prod = candidates.production;
+            hostCandidates.dev = candidates.preview;
+            const pick = (names, what) => names.length === 1
+                ? names[0]
+                : {
+                    problem: (names.length === 0
+                        ? `Vercel no tiene un dominio de ${what}`
+                        : `Vercel tiene ${names.length} dominios de ${what} (${names.join(', ')}) y no elijo uno a ciegas`) +
+                        ': el --apply te pregunta cuál es (sin terminal se detiene)',
+                };
+            const p = pick(hostCandidates.prod, 'producción');
+            const d = pick(hostCandidates.dev, 'develop (rama `develop`)');
+            if (typeof p === 'string')
+                hosts.prod = p;
+            else
+                problems.prod = p.problem;
+            if (typeof d === 'string')
+                hosts.dev = d;
+            else
+                problems.dev = d.problem;
+        }
+    }
+    for (const item of items) {
+        if (item.inVault || item.verdict.class !== 'derivable')
+            continue;
+        const host = hostFor(item);
+        if (host && !hosts[host]) {
+            item.blocked = problems[host] ?? 'sin dominio del que derivarla';
+            if (input.vercelProject)
+                item.hostPending = host;
+        }
+        if (item.verdict.derive === 'neon-pooled' && !input.neonProjectId) {
+            item.blocked =
+                'no sé cuál es el proyecto de Neon: ni `.timekast/provision.json` ni `NEON_PROJECT_ID` de `.env.local` lo dicen';
+        }
+    }
+    return { items, hosts, hostCandidates, vaultProjectExists: projectId !== null };
+}
+/**
+ * The hosts a `sensitive` derivation needs and Vercel's domains did not settle (zero or several
+ * candidates): asked here, with the same rule and the same question as the connected-and-empty
+ * deploy ({@link resolveEmptyDeployHost}) — no terminal → stops naming them. Never picked.
+ */
+async function resolveSensitiveHosts(prepared, deps) {
+    const roles = [
+        { role: 'prod', what: 'producción' },
+        { role: 'dev', what: 'preview (rama `develop`)' },
+    ];
+    let changed = false;
+    for (const { role, what } of roles) {
+        const waiting = prepared.sensitive.filter((item) => !item.inVault && item.hostPending === role);
+        if (waiting.length === 0)
+            continue;
+        const host = await resolveEmptyDeployHost(what, null, prepared.hostCandidates[role], deps);
+        prepared.hosts[role] = host;
+        for (const item of waiting) {
+            delete item.hostPending;
+            delete item.blocked;
+        }
+        changed = true;
+    }
+    if (changed) {
+        refreshSensitivePlan(prepared.plan, prepared.sensitive, prepared.hosts, prepared.neonProjectId, prepared.vaultProjectExists);
+    }
+}
+/**
+ * Resolve the unknown `sensitive` vars: the person answers whether each one encrypts stored data.
+ * Only an explicit "it does NOT" makes it a provider-rotable credential; no terminal, no answer or
+ * a "no" → sealed (rotating a sealed key by mistake is the irreversible damage). Nothing is
+ * generated for an unknown key, ever.
+ */
+async function resolveUnknownSensitive(prepared, deps) {
+    const unknown = prepared.sensitive.filter((item) => item.verdict.class === 'desconocida' && !item.inVault);
+    if (unknown.length === 0)
+        return;
+    const confirm = resolveConfirm(deps);
+    for (const item of unknown) {
+        const notSealed = confirm
+            ? await confirm(`\`${item.key}\` (Vercel ${item.target}) es sensitive y el kit no la conoce. ¿Confirmas que NO cifra ` +
+                'datos guardados (es una credencial que se reemite en su proveedor)? Si dudas, responde que no: ' +
+                'se trata como sellada.')
+            : false;
+        item.verdict = notSealed
+            ? {
+                class: 'rotable',
+                rotate: 'provider',
+                effect: 'se reemite en la consola de su proveedor; la vieja deja de servir',
+            }
+            : { class: 'sellada', reason: 'cifra datos guardados (o no hubo quién lo confirmara)' };
+    }
+    refreshSensitivePlan(prepared.plan, prepared.sensitive, prepared.hosts, prepared.neonProjectId, prepared.vaultProjectExists);
+}
+/**
+ * Before writing anything: a provider-rotable credential that is not in the vault yet, or a
+ * derivable whose source is missing, stops the apply naming it. Then the person confirms each
+ * derivation (by its source — the domain is not a secret) and each `AUTH_SECRET` to generate (by
+ * its effect). Declined → nothing is written.
+ */
+async function confirmSensitive(prepared, deps) {
+    const pending = prepared.sensitive.filter((item) => !item.inVault);
+    const waiting = pending.filter((item) => item.verdict.class === 'rotable' && item.verdict.rotate === 'provider');
+    if (waiting.length > 0) {
+        throw new CLIError('Estas credenciales son sensitive (Vercel no devuelve su valor) y no las genero: se reemiten en la ' +
+            'consola de su proveedor y se cargan en la bóveda:\n' +
+            waiting
+                .map((item) => `  · ${item.key} (Vercel ${item.target}) → \`${formatLocation(folderOfTarget(item.target))}\` del proyecto \`${prepared.plan.slug}\``)
+                .join('\n') +
+            (prepared.vaultProjectExists
+                ? ''
+                : `\n${manualVaultProjectSteps(prepared.plan.slug, waiting.map((item) => formatLocation(folderOfTarget(item.target))))}`) +
+            '\nCuando estén ahí, repite `factory vault adopt --apply`. No se escribió nada.');
+    }
+    const blocked = pending.filter((item) => item.blocked);
+    if (blocked.length > 0) {
+        throw new CLIError('No puedo derivar estas variables sensitive:\n' +
+            blocked
+                .map((item) => `  · ${item.key} (Vercel ${item.target}): ${item.blocked}`)
+                .join('\n') +
+            '\nResuélvelo (o carga el valor en la bóveda a mano) y repite. No se escribió nada.');
+    }
+    const questions = pending.flatMap((item) => {
+        const detail = sensitiveDetail(item, prepared.hosts, prepared.neonProjectId);
+        if (item.verdict.class === 'derivable') {
+            const passkeys = item.verdict.derive === 'rp-id'
+                ? ' Si la app usa hoy otro rpID, todas las passkeys existentes quedan inservibles ' +
+                    '(retrofit passkey-domain-binding).'
+                : '';
+            return [
+                {
+                    name: item.key,
+                    question: `\`${item.key}\` (Vercel ${item.target}) es sensitive: la derivo — ${detail}.${passkeys} ¿Confirmas?`,
+                },
+            ];
+        }
+        if (item.verdict.class === 'rotable' && item.verdict.rotate === 'auth-secret') {
+            return [
+                {
+                    name: item.key,
+                    question: `\`${item.key}\` (Vercel ${item.target}) es sensitive: ${detail}. ¿Confirmas?`,
+                },
+            ];
+        }
+        return [];
+    });
+    await confirmQuestions(questions, deps, '`factory vault adopt --apply`');
+}
+/**
+ * After the confirmations: derive or generate each pending value, IN MEMORY, into the inventory —
+ * the layout then writes it like any other. Never a sealed or an unknown key: those have no
+ * generator here (`generateMfaEncryptionKey` is `provision`'s, for a repo with no data yet).
+ */
+async function materializeSensitive(prepared, deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    let neon = null;
+    let count = 0;
+    for (const item of prepared.sensitive) {
+        if (item.inVault)
+            continue;
+        const v = item.verdict;
+        let value = null;
+        if (v.class === 'rotable' && v.rotate === 'auth-secret')
+            value = generateAuthSecret();
+        else if (v.class === 'derivable') {
+            if (v.derive === 'neon-pooled') {
+                const projectId = prepared.neonProjectId;
+                try {
+                    if (!neon) {
+                        const apiKey = await prepared.rail.get('NEON_API_KEY');
+                        neon = { apiKey, branches: await listNeonBranches(apiKey, projectId, { fetchImpl }) };
+                    }
+                    // ADOPT-008's resolvers — the same ones `provision` and the empty-deploy route use.
+                    const branch = item.target === 'production'
+                        ? resolveMainBranch(neon.branches, projectId)
+                        : resolveDevelopBranch(neon.branches, readE2eParentBranch(prepared.rootDir));
+                    if (!branch) {
+                        throw new CLIError(`El proyecto \`${projectId}\` de Neon no reporta branches: no derivo ` +
+                            `\`${item.key}\` (Vercel ${item.target}). No se escribió nada.`);
+                    }
+                    value = await getConnectionUri(neon.apiKey, projectId, branch.id, true, { fetchImpl });
+                }
+                catch (error) {
+                    if (error instanceof CLIError)
+                        throw error;
+                    // Rebuilt without the provider's message: this path handles a connection string.
+                    throw new CLIError(`Neon no respondió bien al derivar \`${item.key}\` (Vercel ${item.target}). No se escribió nada.`);
+                }
+            }
+            else {
+                const prod = prepared.hosts.prod;
+                const dev = prepared.hosts.dev;
+                if (v.derive === 'app-url')
+                    value = `https://${item.target === 'production' ? prod : dev}`;
+                else if (v.derive === 'rp-id')
+                    value = prod;
+                else
+                    value = relatedOriginsFor([dev]);
+            }
+        }
+        if (value === null)
+            continue;
+        (item.target === 'production' ? prepared.values.production : prepared.values.preview).set(item.key, value);
+        count += 1;
+    }
+    return count;
+}
+const MAIN_ROOT = { env: VAULT_ENV_MAIN, path: VAULT_ROOT_PATH };
+const DEVELOP_CI = { env: VAULT_ENV_DEVELOP, path: VAULT_CI_PATH };
+/** Order in which the apply writes the folders — a reference always after its target. */
+const LOCATION_ORDER = ['main:/', 'main:/ci', 'develop:/', 'develop:/ci', 'local:/'];
+/** Stable sort of the writes by {@link LOCATION_ORDER} (Railway's are appended after the layout). */
+function sortByLocation(writes) {
+    const rank = (w) => {
+        const index = LOCATION_ORDER.indexOf(formatLocation(w.location));
+        return index === -1 ? LOCATION_ORDER.length : index;
+    };
+    return writes
+        .map((w, i) => ({ w, i }))
+        .sort((a, b) => rank(a.w) - rank(b.w) || a.i - b.i)
+        .map((x) => x.w);
+}
+/**
+ * Stand-in for a value the apply mints (the project's Resend key): present, and — with its NUL
+ * bytes — never equal to a value read from a deploy. In memory only.
+ */
+const MINTED_PLACEHOLDER = '\u0000minted-by-the-apply\u0000';
+/**
+ * What a folder WILL hold after `writes`, references resolved one level — in memory only, to
+ * compare with what Railway holds. A minted value is present and unequal to every read value.
+ */
+function resolvedFolder(writes, location) {
+    const where = formatLocation(location);
+    const valueAt = (loc, key) => {
+        const w = writes.find((x) => formatLocation(x.location) === formatLocation(loc) && x.key === key);
+        if (!w)
+            return undefined;
+        if (w.kind === 'value')
+            return w.value;
+        if (w.kind === 'minted-resend')
+            return MINTED_PLACEHOLDER;
+        return valueAt(w.target, w.target.key);
+    };
+    const folder = new Map();
+    for (const w of writes) {
+        if (formatLocation(w.location) !== where)
+            continue;
+        const value = valueAt(w.location, w.key);
+        if (value !== undefined)
+            folder.set(w.key, value);
+    }
+    return folder;
+}
+/**
+ * The writes of the apply — the ADR-005 layout, plus the import of Railway into the root of each
+ * environment a selected Railway sync reads (ADOPT-002, "importar primero") — with the plan's
+ * entries and confirmations. Pure: values in, writes (in memory) and names out.
+ */
+function planWrites(input) {
+    const { values, retired, replaceResend, proposals } = input;
+    const layout = planAdoptionLayout(values, {
+        retired,
+        replaceResend,
+        importLocalNeonKey: input.importLocalNeonKey,
+        extra: input.extra,
+    });
+    const railwayWrites = [];
+    const differing = [];
+    const railwayConflicts = [];
+    for (const vaultEnv of RAILWAY_VAULT_ENVS) {
+        const here = proposals.filter((p) => p.vaultEnv === vaultEnv);
+        if (here.length === 0)
+            continue;
+        const location = { env: vaultEnv, path: VAULT_ROOT_PATH };
+        const all = [...layout, ...railwayWrites];
+        const imported = planRailwayImport({
+            location,
+            sources: here.map((p) => p.source.values),
+            folder: resolvedFolder(all, location),
+            mainFolder: resolvedFolder(all, MAIN_ROOT),
+            retired,
+        });
+        railwayWrites.push(...imported.writes);
+        for (const key of imported.differing) {
+            differing.push({
+                key,
+                labels: here.filter((p) => p.source.values.has(key)).map((p) => p.source.label),
+            });
+        }
+        railwayConflicts.push(...imported.conflicting.map((key) => `${key} (${formatLocation(location)})`));
+    }
+    const writes = sortByLocation([...layout, ...railwayWrites]);
+    const { entries, confirmations, unreadable } = buildPlanEntries({
+        values,
+        writes,
+        retired,
+        replaceResend,
+        hash: input.hash,
+        notes: input.notes,
+    });
+    for (const { key, labels } of differing) {
+        confirmations.push({
+            name: key,
+            question: `\`${key}\` tiene en Railway (${labels.join(', ')}) otro valor que el que queda en la bóveda: ` +
+                'el sync pondrá en Railway el de la bóveda. ¿Confirmas?',
+        });
+    }
+    return { writes, entries, confirmations, unreadable, railwayConflicts };
+}
+/** How the plan names a precondition that does not apply on the kit's origin. */
+const FACTORY_NOT_APPLICABLE = 'no aplica — es el origen del kit';
+/** Preconditions 1 and 2 of a derivative (ADOPT-001). Throw naming what to fix. */
+async function assertDerivativePreconditions(rootDir, deps) {
+    // Precondition 1 — the brain up to date (the same comparison as `factory status`).
+    if (!hasLockfile(rootDir)) {
+        throw new CLIError('Este repo no tiene `.timekast/lockfile.json`: no sé qué cerebro tiene. Corre `factory update` y repite.');
+    }
+    const status = await computeStatus({
+        rootDir,
+        ...(deps.fetchLatest ? { fetchLatest: deps.fetchLatest } : {}),
+    });
+    if (status.networkError) {
+        throw new CLIError('No pude confirmar cuál es la última versión del cerebro (sin conexión o sin `gh`). La adopción ' +
+            'exige el cerebro al día: revisa tu conexión y repite.');
+    }
+    if (status.hasUpdate) {
+        throw new CLIError(`El cerebro de este repo está en v${status.installed} y la última es v${status.latest}. ` +
+            'Corre `factory update` y repite `factory vault adopt`.');
+    }
+    // Precondition 2 — no fork in what the wrapper runs.
+    const drift = wrapperDrift(rootDir, readLockfile(rootDir));
+    if (drift.length > 0) {
+        throw new CLIError('Estos archivos que corre el wrapper de la bóveda difieren de lo que instaló el kit (o faltan):\n' +
+            drift.map((file) => `  · ${file}`).join('\n') +
+            '\nResuélvelos antes de adoptar (`factory update --verify` los reporta; `factory update` trae los del kit). ' +
+            'No hice nada.');
+    }
+}
+/** Neon's failures in this path are rebuilt without the provider's body. */
+function neonFailure(what) {
+    return new CLIError(`Neon no respondió bien al ${what}. No hice nada.`);
+}
+/**
+ * The branches of the Neon project for `main` and `develop`, from ADOPT-008's resolvers — the
+ * same ones the `--apply` uses (it reuses this result). Reads only.
+ */
+async function resolveAdoptBranches(rootDir, projectId, rail, fetchImpl) {
+    const apiKey = await rail.get('NEON_API_KEY');
+    let branches;
+    try {
+        branches = await listNeonBranches(apiKey, projectId, { fetchImpl });
+    }
+    catch {
+        throw neonFailure(`listar los branches del proyecto \`${projectId}\``);
+    }
+    const main = resolveMainBranch(branches, projectId);
+    const develop = resolveDevelopBranch(branches, readE2eParentBranch(rootDir)) ?? main;
+    return { main, develop };
+}
+/**
+ * The project's Neon key for CI (ADOPT-009): the one already in `develop:/ci` if it is PROVEN the
+ * project's, else the one of `.env.local` if proven, else a new one is minted — whose plan lists
+ * the live keys of its family (`<slug>-e2e`, by `isNeonKeyFamily`). A listing that fails stops the
+ * run naming it, before anything is minted. `null` when no CI key is at stake (no GitHub repo, no
+ * Neon project, or the repo's CI does not carry one).
+ */
+async function inspectNeonKey(input) {
+    const localKey = input.local.get(NEON_API_KEY);
+    const proofDeps = {
+        railKey: () => input.rail.get('NEON_API_KEY'),
+        fetchImpl: input.fetchImpl,
+    };
+    const localProven = localKey !== undefined && input.neonProjectId !== null
+        ? await isProjectScopedNeonKey(localKey, input.neonProjectId, proofDeps)
+        : false;
+    const family = `${input.slug}-e2e`;
+    const ciCarriesKey = input.githubSecretNames?.includes(NEON_API_KEY) === true || localKey !== undefined;
+    if (!input.repo || !input.neonProjectId || !ciCarriesKey) {
+        return { plan: null, localProven, orgId: null };
+    }
+    if (input.vaultProjectId) {
+        const inCi = await input.client.readSecrets(input.vaultProjectId, DEVELOP_CI);
+        const current = inCi.get(NEON_API_KEY);
+        if (current !== undefined &&
+            (await isProjectScopedNeonKey(current, input.neonProjectId, proofDeps))) {
+            return {
+                plan: { action: 'ya está en la bóveda', family, oldKeys: [] },
+                localProven,
+                orgId: null,
+            };
+        }
+    }
+    if (localProven) {
+        return {
+            plan: { action: 'importar de .env.local', family, oldKeys: [] },
+            localProven,
+            orgId: null,
+        };
+    }
+    const railKey = await input.rail.get('NEON_API_KEY');
+    let orgId;
+    try {
+        orgId = await getNeonProjectOrg(railKey, input.neonProjectId, { fetchImpl: input.fetchImpl });
+    }
+    catch {
+        throw neonFailure(`leer el proyecto \`${input.neonProjectId}\``);
+    }
+    if (!orgId) {
+        throw new CLIError(`El proyecto Neon \`${input.neonProjectId}\` no existe o la \`NEON_API_KEY\` del rail no lo alcanza: ` +
+            'no puedo acuñar la key de CI del proyecto. No hice nada.');
+    }
+    let oldKeys;
+    try {
+        oldKeys = (await listNeonApiKeys(railKey, orgId, { fetchImpl: input.fetchImpl }))
+            .filter((key) => isNeonKeyFamily(key.name, family))
+            .map((key) => key.name)
+            .sort();
+    }
+    catch (error) {
+        if (error instanceof NeonApiKeyListError) {
+            throw new CLIError(`${error.message} No acuñé ninguna key: sin la lista no sé qué key reemplazo. No hice nada.`);
+        }
+        throw error;
+    }
+    return { plan: { action: 'acuñar', family, oldKeys }, localProven, orgId };
+}
+/** Preconditions + inventory + plan. Reads only: nothing here writes anywhere. */
+async function prepareAdoption(rootDir, flags, deps) {
+    // Precondition — the files the vault needs locally.
+    if (!existsSync(path.join(rootDir, WITH_VAULT_SCRIPT_FILE))) {
+        throw new CLIError(`Este repo no trae \`${WITH_VAULT_SCRIPT_FILE}\`, el wrapper que inyecta la bóveda a tus scripts. ` +
+            'Corre `factory update` para traer el cerebro al día y repite `factory vault adopt`.');
+    }
+    // ADOPT-009 — Factory mode: two signals at once (no lockfile AND origin = the Factory's repo).
+    const readOrigin = deps.resolveOriginRepo ?? originRepoOf;
+    const factoryMode = await isFactoryMode(rootDir, readOrigin);
+    if (!factoryMode)
+        await assertDerivativePreconditions(rootDir, deps);
+    const preconditions = factoryMode
+        ? { brain: FACTORY_NOT_APPLICABLE, forks: FACTORY_NOT_APPLICABLE }
+        : { brain: 'pasada', forks: 'pasada' };
+    // The state on disk (both shapes; fail-closed when unreadable or with a malformed `vault`).
+    const target = readDestroyTarget(rootDir);
+    const link = readVaultLink(rootDir);
+    const declined = readVaultDeclined(rootDir);
+    const rail = deps.rail ?? createRailResolver();
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const vercelToken = await rail.get('VERCEL_TOKEN');
+    const teamId = flags.team ?? (await rail.getOptional('VERCEL_TEAM_ID'));
+    if (!teamId) {
+        throw new CLIError('No sé en qué team de Vercel buscar: falta `VERCEL_TEAM_ID` en `rail-timekast`. Pásalo con `--team=<id>`.');
+    }
+    const originRepo = target?.githubRepo ? null : await readOrigin(rootDir);
+    const repoCandidate = target?.githubRepo ?? originRepo;
+    const repo = repoCandidate && REPO_RE.test(repoCandidate) ? repoCandidate : null;
+    const location = await locateVercelProject({
+        recordedId: recordedAdoptionVercelId(link) ?? target?.vercelProjectId ?? null,
+        repo,
+        token: vercelToken,
+        teamId,
+        deps: { fetchImpl },
+    });
+    const candidates = location.kind === 'ambiguous'
+        ? location.candidates
+        : location.kind === 'found'
+            ? [location.project]
+            : [];
+    const named = (list) => list.map((p) => `\`${p.name}\` (${p.id})`).join(', ');
+    let vercelProject = location.kind === 'found' ? location.project : null;
+    if (flags.vercelProject !== undefined) {
+        const chosen = candidates.find((p) => p.id === flags.vercelProject);
+        if (!chosen) {
+            throw new CLIError(`\`--vercel-project ${flags.vercelProject}\` no es ${location.kind === 'found' && location.source === 'recorded' ? 'el proyecto que registra `.timekast/provision.json`' : 'uno de los proyectos de Vercel conectados al repo'}: ` +
+                `${candidates.length > 0 ? `los candidatos son ${named(candidates)}` : 'no hay ninguno'}. No se escribió nada.`);
+        }
+        vercelProject = chosen;
+    }
+    else if (location.kind === 'ambiguous') {
+        throw new CLIError(`Hay ${location.candidates.length} proyectos de Vercel conectados a \`${repo}\`: ` +
+            `${named(location.candidates)}. No elijo uno a ciegas.\n` +
+            '  · Elige el que queda como proyecto principal con `factory vault adopt --vercel-project <id>`.\n' +
+            '  · Los demás despliegues se operan después con `factory vault deploys` (fx-secrets-vault §6).');
+    }
+    let slug;
+    if (factoryMode) {
+        // The Factory's directory name is not a valid slug; its identity doc is the source.
+        const fromConfig = readConfigSlug(rootDir);
+        if (!fromConfig) {
+            throw new CLIError(`Modo Factory: no encontré un \`Slug\` válido en \`${PROJECT_CONFIG_PATH}\` §1. El slug del ` +
+                'proyecto de la bóveda sale de ahí, nunca del nombre del directorio. No hice nada.');
+        }
+        slug = fromConfig;
+    }
+    else {
+        slug = (realField(target?.slug) ?? vercelProject?.name ?? path.basename(rootDir)).toLowerCase();
+    }
+    assertValidSubdomainSlug(slug);
+    const railwayToken = await rail.getOptional(RAILWAY_TOKEN_KEY);
+    if (!railwayToken) {
+        console.warn('⚠ No hay `RAILWAY_TOKEN` en `rail-timekast`: no inventarié Railway. Si este repo despliega ahí, ' +
+            'pide a un admin que lo cargue y repite.');
+    }
+    else if (!repo) {
+        console.warn('⚠ Sin remote `origin` de GitHub no sé qué repo buscar en Railway (se busca por el repo conectado): ' +
+            'no inventarié Railway.');
+    }
+    // Railway is searched by the repo its services have CONNECTED (Decision 13), never by a name:
+    // two or more connected projects stop here, before anything is written.
+    const railway = railwayToken && repo ? await readRailwayInventory(repo, railwayToken, fetchImpl) : null;
+    // 🔴 Not consulted is never "absent": it can never make the deploy count as empty.
+    const railwayPresence = !railwayToken || !repo ? 'no consultado' : railway ? 'presente' : 'ausente';
+    if (!vercelProject && !railway) {
+        throw new CLIError(`No encontré ningún despliegue de este repo: ni un proyecto de Vercel ni uno de Railway conectados a ` +
+            `\`${repo ?? '(sin remote origin de GitHub)'}\`. ` +
+            'No hay nada que adoptar desde un deploy. No hice nada.');
+    }
+    // Inventory — values in memory only. `null` = Vercel answered WITHOUT the list.
+    const vercelEnvs = vercelProject
+        ? await readEnvVarsWithValues(vercelProject.id, vercelToken, teamId, { fetchImpl })
+        : null;
+    const vercel = vercelMaps(vercelEnvs ?? []);
+    const envLocalPath = path.join(rootDir, ENV_LOCAL_FILE);
+    const hasEnvLocal = existsSync(envLocalPath);
+    const values = {
+        local: new Map(Object.entries(hasEnvLocal ? parseEnvBody(readFileSync(envLocalPath, 'utf8')) : {})),
+        production: vercel.production,
+        preview: vercel.preview,
+        railway: new Map((railway?.sources ?? []).map((s) => [s.label, s.values])),
+    };
+    // The rail's TEAM Resend key, compared in memory (never printed, never stored).
+    const hasResend = [values.local, values.production, values.preview].some((m) => m.has(RESEND_KEY));
+    const resendTeamKey = hasResend ? await rail.getOptional(RESEND_KEY) : null;
+    const replaceResend = resendTeamKey !== null &&
+        [values.production, values.preview, values.local].some((m) => m.get(RESEND_KEY) === resendTeamKey);
+    const sender = values.production.get('EMAIL_FROM') ??
+        values.preview.get('EMAIL_FROM') ??
+        values.local.get('EMAIL_FROM') ??
+        PROVISION_EMAIL_FROM;
+    const resendDomain = sender.slice(sender.indexOf('@') + 1);
+    const client = deps.vaultClient ?? createVaultClient();
+    const githubSecretNames = repo
+        ? [...(await (deps.listGithubSecretNames ?? ghSecretNames)(repo))].sort()
+        : null;
+    const neonProjectId = realField(target?.neonProjectId) ?? values.local.get('NEON_PROJECT_ID') ?? null;
+    // ADOPT-009 — the project's Neon key for CI (imported only when proven; else minted).
+    const neonKey = await inspectNeonKey({
+        slug,
+        repo,
+        neonProjectId,
+        githubSecretNames,
+        local: values.local,
+        vaultProjectId: link?.projectId ?? null,
+        client,
+        rail,
+        fetchImpl,
+    });
+    const notes = new Map();
+    if (values.local.has(NEON_API_KEY) && !neonKey.localProven) {
+        notes.set(NEON_API_KEY, 'no se prueba como la key del proyecto (del rail, personal, vieja o muerta): no se importa' +
+            (neonKey.plan?.action === 'acuñar' ? '; se acuña una propia del proyecto' : ''));
+    }
+    // ADOPT-009 — Factory mode: `SHORTIO_API_KEY` from the rail (in memory) to `develop:/ci`, and
+    // any sync of `rail-timekast` that writes to this repo — found BY DESTINATION, not by name.
+    let factory = null;
+    const extra = [];
+    const factoryIdentity = factoryMode && isFactoryIdentity(slug, repo);
+    if (factoryMode && !factoryIdentity) {
+        console.warn(`⚠ Modo Factory, pero el slug resuelto (\`${slug}\`) o el repo (\`${repo ?? '(sin remote)'}\`) no ` +
+            `son los del Factory (\`${FACTORY_SLUG}\`, \`${FACTORY_REPO}\`): no propongo la copia de ` +
+            `\`${SHORTIO_KEY}\` del rail. Un token del rail sólo sale hacia el CI del propio Factory.`);
+    }
+    if (factoryIdentity) {
+        const shortio = await rail.get(SHORTIO_KEY);
+        extra.push({
+            kind: 'value',
+            location: DEVELOP_CI,
+            key: SHORTIO_KEY,
+            origin: SHORTIO_KEY,
+            value: shortio,
+        });
+        notes.set(SHORTIO_KEY, 'modo Factory: va a develop:/ci con el valor del rail (una copia que se rota a mano), nunca el de este archivo');
+        const github = VAULT_SYNC_PLAN.find((spec) => spec.role === 'github-ci');
+        let railSyncs;
+        try {
+            railSyncs = await client.listSecretSyncs(RAIL_TIMEKAST.projectId);
+        }
+        catch {
+            throw new CLIError('No pude listar los syncs de `rail-timekast`: sin esa lista no sé si otro sync escribe en el repo ' +
+                'del Factory (dos escritores de la misma clave). No hice nada.');
+        }
+        factory = {
+            shortio: 'develop:/ci (valor del rail, leído con tu sesión)',
+            railSyncsToRepo: railSyncs
+                .filter((sync) => syncTargetsDestination(sync, github, { repo: repo ?? FACTORY_REPO }))
+                .map((sync) => sync.name)
+                .sort(),
+        };
+    }
+    const retired = retiredKeys(values);
+    const { proposals, unmapped } = railway
+        ? proposeRailwaySyncs(railway)
+        : { proposals: [], unmapped: [] };
+    const railwayProposals = proposals.map((p) => ({
+        ...p,
+        project: railway.project,
+        label: railwaySyncLabel(p.vaultEnv, p.source),
+    }));
+    const hash = createDisplayHasher();
+    const replan = (selected) => planWrites({
+        values,
+        retired,
+        replaceResend,
+        proposals: selected,
+        hash,
+        importLocalNeonKey: neonKey.localProven,
+        extra,
+        notes,
+    });
+    const { writes, entries, confirmations, railwayConflicts } = replan(railwayProposals);
+    // ADOPT-003 — the `sensitive` vars: classified by name, never read.
+    const { items: sensitive, hosts, hostCandidates, vaultProjectExists, } = await inspectSensitive({
+        found: vercel.sensitive,
+        retired,
+        client,
+        vaultProjectId: link?.projectId ?? null,
+        slug,
+        vercelProject,
+        vercelToken,
+        teamId,
+        fetchImpl,
+        neonProjectId,
+    });
+    // ADOPT-009 — the connected-and-empty deploy (fail-closed) and its hosts, from Vercel's domains.
+    let emptyDeploy = null;
+    let neonBranches = null;
+    if (isConnectedEmptyDeploy({
+        hasVercelProject: vercelProject !== null,
+        vercelEnvs,
+        railway: railwayPresence,
+    })) {
+        let domains;
+        try {
+            domains = await listProjectDomains(vercelProject.id, vercelToken, teamId, {
+                fetchImpl,
+            });
+        }
+        catch {
+            throw new CLIError('Vercel no respondió bien al leer los dominios del proyecto. No hice nada.');
+        }
+        const candidates = deployHostCandidates(domains);
+        if (neonProjectId) {
+            neonBranches = await resolveAdoptBranches(rootDir, neonProjectId, rail, fetchImpl);
+        }
+        emptyDeploy = {
+            prodHost: candidates.production.length === 1 ? candidates.production[0] : null,
+            previewHost: candidates.preview.length === 1 ? candidates.preview[0] : null,
+            prodCandidates: candidates.production,
+            previewCandidates: candidates.preview,
+            shared: sharedCandidatesOf(values.local),
+            blocked: neonProjectId
+                ? null
+                : 'no sé cuál es el proyecto de Neon (ni `.timekast/provision.json` ni `NEON_PROJECT_ID` de `.env.local`): sin él no hay `DATABASE_URL` por branch',
+        };
+    }
+    let github = null;
+    if (repo && githubSecretNames) {
+        const planned = new Set(writes.filter((w) => isCiFolder(w.location)).map((w) => w.key));
+        // A key minted in the `--apply` lands in `develop:/ci` before the syncs exist; on an empty
+        // deploy the `DATABASE_URL` reference follows the generated `develop:/DATABASE_URL`.
+        if (neonKey.plan?.action === 'acuñar')
+            planned.add(NEON_API_KEY);
+        if (emptyDeploy && !emptyDeploy.blocked)
+            planned.add('DATABASE_URL');
+        const existing = link
+            ? new Set(await client.listSecretKeys(link.projectId, DEVELOP_CI))
+            : new Set();
+        github = {
+            repo,
+            secretNames: githubSecretNames,
+            missingInCi: githubSecretNames.filter((name) => !planned.has(name) && !existing.has(name)),
+        };
+    }
+    let wiring;
+    try {
+        wiring = wireVaultWrapper(rootDir, { dryRun: true });
+    }
+    catch (error) {
+        throw new CLIError(`No puedo leer \`package.json\` para cablear el wrapper: ${error.message}`);
+    }
+    const plan = {
+        slug,
+        factoryMode,
+        preconditions,
+        emptyDeploy,
+        neon: neonBranches && neonProjectId
+            ? {
+                projectId: neonProjectId,
+                main: neonBranches.main.name,
+                develop: neonBranches.develop.name,
+                sameBase: neonBranches.main.id === neonBranches.develop.id,
+            }
+            : null,
+        neonKey: neonKey.plan,
+        factory,
+        vaultProjectId: link?.projectId ?? null,
+        declined,
+        vercelProject: vercelProject
+            ? {
+                id: vercelProject.id,
+                name: vercelProject.name,
+                source: location.kind === 'found' ? location.source : 'connected',
+            }
+            : null,
+        railway: railway
+            ? {
+                project: railway.project.name,
+                projectId: railway.project.id,
+                sources: railway.sources.map((s) => s.label),
+            }
+            : null,
+        railwaySyncs: railwayProposals.map((p) => p.label),
+        railwayUnmapped: unmapped.map((s) => s.label),
+        railwayConflicts,
+        repo,
+        entries,
+        unreadable: vercel.unreadableOther,
+        sensitive: [],
+        sealed: [],
+        sealedExplanation: null,
+        branchScoped: vercel.branchScoped,
+        confirmations: confirmations.map((c) => c.name),
+        github,
+        wrapper: {
+            rewritten: wiring.rewritten,
+            customized: wiring.customized.map((c) => c.name),
+        },
+        envLocal: hasEnvLocal ? 'presente' : 'ausente',
+        syncs: [
+            ...VAULT_SYNC_PLAN.filter((spec) => spec.destination === 'vercel' ? Boolean(vercelProject) : Boolean(repo)).map((spec) => spec.label),
+            ...railwayProposals.map((p) => p.label),
+        ],
+    };
+    refreshSensitivePlan(plan, sensitive, hosts, neonProjectId, vaultProjectExists);
+    return {
+        plan,
+        rootDir,
+        writes,
+        questions: confirmations,
+        railwayToken,
+        railwayProposals,
+        replan,
+        values,
+        rail,
+        sensitive,
+        neonProjectId,
+        hosts,
+        hostCandidates,
+        vaultProjectExists,
+        vercelToken,
+        teamId,
+        resendTeamKey: replaceResend ? resendTeamKey : null,
+        resendDomain,
+        client,
+        neonBranches,
+        neonOrgId: neonKey.orgId,
+    };
+}
+function isCiFolder(location) {
+    return location.env === DEVELOP_CI.env && location.path === DEVELOP_CI.path;
+}
+/** Print the plan for a person — names and hashes only. */
+function printPlan(plan, apply) {
+    const out = (line = '') => console.log(line);
+    out(`\nAdopción de la bóveda — \`${plan.slug}\`${apply ? '' : ' (plan: no se escribe nada sin `--apply`)'}`);
+    if (plan.declined) {
+        out('  ⚠ Este repo había declinado la bóveda (`factory vault adopt --decline`). ' +
+            (apply
+                ? 'Al guardar el vínculo borro esa marca: adoptar es la decisión más nueva.'
+                : 'Si lo adoptas, el `--apply` borra esa marca al guardar el vínculo.'));
+    }
+    if (plan.vercelProject) {
+        const how = plan.vercelProject.source === 'recorded'
+            ? 'registrado en provision.json'
+            : `conectado a ${plan.repo}`;
+        out(`  Vercel:  \`${plan.vercelProject.name}\` (${plan.vercelProject.id}, ${how})`);
+    }
+    else {
+        out('  Vercel:  sin proyecto conectado a este repo');
+    }
+    out(plan.railway
+        ? `  Railway: \`${plan.railway.project}\` (${plan.railway.projectId}) — ${plan.railway.sources.join(', ') || '(sin servicios)'}`
+        : '  Railway: sin proyecto conectado al repo');
+    out(`  Repo:    ${plan.repo ?? '(sin remote de GitHub)'}`);
+    out(plan.vaultProjectId
+        ? `  Bóveda:  el repo ya tiene bloque \`vault\` (${plan.vaultProjectId}): el --apply sólo completa lo que falte`
+        : `  Bóveda:  proyecto \`${plan.slug}\` (entornos main/develop/local; miembros: quien corre + los admins)`);
+    if (plan.factoryMode) {
+        out('  Modo Factory: es el checkout del origen del kit (sin lockfile y con origin del Factory); el slug ' +
+            'sale de project-config.md §1 y el vínculo se escribe sin `provision --adopt`.');
+    }
+    out(`  Precondición cerebro al día: ${plan.preconditions.brain}`);
+    out(`  Precondición sin forks en el wrapper: ${plan.preconditions.forks}`);
+    if (plan.neon) {
+        out(`  Neon:    proyecto \`${plan.neon.projectId}\` — main ← branch \`${plan.neon.main}\`, develop ← branch \`${plan.neon.develop}\``);
+        if (plan.neon.sameBase) {
+            out('  ⚠ El proyecto de Neon tiene un solo branch: main y develop quedan en la MISMA base. El --apply te pide confirmarlo.');
+        }
+    }
+    if (plan.neonKey) {
+        const key = plan.neonKey;
+        out(key.action === 'acuñar'
+            ? `  Key de Neon de CI: se acuña una del proyecto (sólo-key, a develop:/ci, antes de los syncs). ` +
+                (key.oldKeys.length > 0
+                    ? `Key vieja encontrada en la familia \`${key.family}\`: ${key.oldKeys.join(', ')} — se revoca cuando el sync entregue la nueva a GitHub.`
+                    : `No encontré ninguna key vieja en la familia \`${key.family}\`.`)
+            : `  Key de Neon de CI: ${key.action} (probada como del proyecto).`);
+    }
+    if (plan.emptyDeploy) {
+        const e = plan.emptyDeploy;
+        const host = (value, candidates) => value ??
+            (candidates.length === 0
+                ? 'sin candidato — te lo pregunto en el --apply'
+                : `${candidates.join(' | ')} — eliges en el --apply`);
+        out('\nDeploy conectado y VACÍO (Vercel sin variables, Railway consultado y sin proyecto): los valores por ' +
+            'entorno se generan o derivan como en un deploy nuevo, nunca de .env.local.');
+        out(`  Host de producción: ${host(e.prodHost, e.prodCandidates)}`);
+        out(`  Host de preview:    ${host(e.previewHost, e.previewCandidates)}`);
+        out('  Por entorno: AUTH_SECRET (uno nuevo por entorno), NEXT_PUBLIC_APP_URL, NEXT_PUBLIC_APP_ENV, ' +
+            'WEBAUTHN_RP_ID/WEBAUTHN_RELATED_ORIGINS (de los hosts), DATABASE_URL (por branch de Neon).');
+        if (e.shared.length > 0) {
+            out(`  Compartidos candidatos de .env.local (confirmas cada uno): ${e.shared.join(', ')}`);
+        }
+        if (e.blocked)
+            out(`  🔴 Bloquea el --apply: ${e.blocked}`);
+    }
+    if (plan.factory) {
+        out(`  SHORTIO_API_KEY → ${plan.factory.shortio}`);
+        if (plan.factory.railSyncsToRepo.length > 0) {
+            out(`  🔴 Syncs de rail-timekast hacia este repo: ${plan.factory.railSyncsToRepo.join(', ')}. ` +
+                'Serían un segundo escritor: el --apply se detiene hasta que se borren.');
+        }
+    }
+    out('\nVariables — nombre · estado · huellas (HMAC con llave de esta corrida; no se comparan entre corridas) · destino:');
+    for (const entry of plan.entries) {
+        const hashes = [
+            entry.sources.local ? `local=${entry.sources.local}` : null,
+            entry.sources.production ? `production=${entry.sources.production}` : null,
+            entry.sources.preview ? `preview=${entry.sources.preview}` : null,
+            ...Object.entries(entry.sources.railway ?? {}).map(([label, h]) => `railway(${label})=${h}`),
+        ].filter(Boolean);
+        const destination = entry.targets.length > 0 ? entry.targets.join(', ') : '(no se escribe)';
+        out(`  · ${entry.name} [${entry.state}] ${hashes.join(' ')} → ${destination}`);
+        if (entry.note)
+            out(`      ↳ ${entry.action ? `${entry.action}: ` : ''}${entry.note}`);
+    }
+    if (plan.sensitive.length > 0) {
+        out('\nVariables sensitive de Vercel (no devuelve su valor; nunca lo leo ni lo imprimo):');
+        for (const entry of plan.sensitive) {
+            const state = entry.inVault
+                ? 'ya está en la bóveda: la uso, no la toco'
+                : `${entry.class}: ${entry.detail}`;
+            out(`  · ${entry.name} (${entry.target}) — ${state}`);
+            if (entry.blocked)
+                out(`      ↳ 🔴 no se puede derivar: ${entry.blocked}`);
+        }
+    }
+    if (plan.sealedExplanation)
+        out(`\n${plan.sealedExplanation}`);
+    if (plan.unreadable.length > 0) {
+        out(`\n🔴 Ilegibles sin ser sensitive (un error de lectura u otro tipo de variable): ${plan.unreadable.join(', ')}. ` +
+            'Bloquean el --apply.');
+    }
+    if (plan.branchScoped.length > 0) {
+        out(`\n🔴 Variables de preview atadas a una rama (no las mapeo solas a develop): ` +
+            `${plan.branchScoped.map((v) => `${v.name} (rama ${v.branch})`).join(', ')}. ` +
+            'Decide en Vercel (quítales la rama o bórralas) y repite. Bloquean el --apply.');
+    }
+    if (plan.railwaySyncs.length > 0) {
+        out(`\nRailway${plan.railway ? ` (proyecto \`${plan.railway.project}\`, id ${plan.railway.projectId})` : ''} — ` +
+            'syncs propuestos (confirmas cada uno; el que no confirmes no se importa ni se crea): ' +
+            plan.railwaySyncs.join(' · '));
+    }
+    if (plan.railwayUnmapped.length > 0) {
+        out(`  Sin sync (su entorno de Railway no se llama como uno de la bóveda: ${RAILWAY_VAULT_ENVS.join(', ')}): ` +
+            `${plan.railwayUnmapped.join(', ')}. Después de adoptar: \`factory vault sync railway --project <id> ` +
+            '--service <id> --env <main|develop> --railway-env <nombre>`.');
+    }
+    if (plan.railwayConflicts.length > 0) {
+        out(`\n🔴 Dos servicios de Railway que leerían la misma carpeta tienen otro valor: ${plan.railwayConflicts.join(', ')}. ` +
+            'Una carpeta tiene un solo valor por clave. Bloquean el --apply (o no confirmes uno de esos syncs).');
+    }
+    if (plan.github) {
+        out(`\nGitHub (${plan.github.repo}) — secrets del repo: ${plan.github.secretNames.join(', ') || '(ninguno)'}`);
+        if (plan.github.missingInCi.length > 0) {
+            out(`  ⚠ No estarían en develop:/ci: ${plan.github.missingInCi.join(', ')}. El sync a GitHub los borraría: ` +
+                'el --apply importa todo y se detiene ANTES de crear los syncs hasta que estén en develop:/ci ' +
+                '(agrégalos en la bóveda, o bórralos del repo si ya no se usan) y lo repitas.');
+        }
+    }
+    if (plan.wrapper.rewritten.length > 0) {
+        out(`\nWrapper: se envuelven los scripts ${plan.wrapper.rewritten.join(', ')} (el diff se muestra antes de escribir).`);
+    }
+    if (plan.wrapper.customized.length > 0) {
+        out(`Scripts customizados de package.json (no se tocan; corren sin la bóveda hasta que los adapten): ` +
+            plan.wrapper.customized.join(', '));
+    }
+    if (plan.syncs.length > 0) {
+        out(`\nSyncs (se crean DESPUÉS de importar, así el primero no borra nada): ${plan.syncs.join(' · ')}`);
+    }
+    out(plan.envLocal === 'presente'
+        ? `\n.env.local → se renombra a ${ENV_LOCAL_BACKUP_FILE} al final (si git lo ignora y no existe ya).`
+        : '\nSin .env.local: local queda con lo que el layout le pone por referencia.');
+    if (!apply)
+        out('\nPara ejecutarlo: `factory vault adopt --apply`.');
+}
+// ---------------------------------------------------------------------------
+// The apply
+// ---------------------------------------------------------------------------
+/** The confirm seam, or `undefined` when nobody can answer (no terminal, none injected). */
+function resolveConfirm(deps) {
+    const tty = deps.isTTY ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    return deps.confirm ?? (tty ? defaultConfirm : undefined);
+}
+/** Ask every confirmation BEFORE writing anything. Unconfirmed → nothing is written. */
+async function confirmAll(prepared, deps) {
+    await confirmQuestions(prepared.questions, deps, '`factory vault adopt --apply`');
+}
+/** Ask `questions` (all must be `yes`); without a terminal nothing is confirmed blindly. */
+async function confirmQuestions(questions, deps, command) {
+    if (questions.length === 0)
+        return;
+    const confirm = resolveConfirm(deps);
+    if (!confirm) {
+        throw new CLIError('Estas diferencias necesitan tu confirmación y no hay una terminal para dártela: ' +
+            `${questions.map((q) => q.name).join(', ')}. No hay modo que las confirme a ciegas: ` +
+            `corre ${command} en una terminal. No se escribió nada.`);
+    }
+    const declined = [];
+    for (const question of questions) {
+        if (!(await confirm(question.question)))
+            declined.push(question.name);
+    }
+    if (declined.length > 0) {
+        throw new CLIError(`No confirmaste: ${declined.join(', ')}. No se escribió nada; resuélvelo y repite.`);
+    }
+}
+/** Step (2): the writes of the layout, location by location (values, then references). */
+async function writeLayout(prepared, projectId, deps) {
+    const { client, writes } = prepared;
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    let resend = null;
+    const order = [];
+    for (const write of writes) {
+        const where = formatLocation(write.location);
+        if (!order.includes(where))
+            order.push(where);
+    }
+    for (const where of order) {
+        const here = writes.filter((w) => formatLocation(w.location) === where);
+        const location = here[0].location;
+        for (const write of here.filter((w) => w.kind === 'minted-resend')) {
+            const existing = await client.readSecrets(projectId, location);
+            if (existing.has(write.key)) {
+                console.log(`  = bóveda ${where} ${write.key} (ya existía)`);
+                continue;
+            }
+            const teamKey = prepared.resendTeamKey;
+            const minted = await mintProjectResendKey(prepared.plan.slug, prepared.resendDomain, teamKey, fetchImpl, 'repite `factory vault adopt --apply`');
+            if (!minted) {
+                throw new CLIError('No pude acuñar la key de Resend del proyecto. No creé ningún sync: el despliegue sigue con su ' +
+                    'key actual. Resuélvelo y repite `factory vault adopt --apply`.');
+            }
+            try {
+                await client.writeSecrets(projectId, location, { [write.key]: minted.token }, 'create-if-missing');
+            }
+            catch (error) {
+                const revoked = await revokeResendKey(minted.id, teamKey, fetchImpl);
+                console.warn(revoked
+                    ? '⚠ No pude guardar la key de Resend del proyecto en la bóveda; la revoqué para no dejarla huérfana.'
+                    : `⚠ No pude guardar la key de Resend del proyecto NI revocarla (id \`${minted.id}\`): revócala en Resend.`);
+                throw error;
+            }
+            resend = { apiKeyId: minted.id, domain: prepared.resendDomain };
+            console.log(`  ＋ bóveda ${where} ${write.key} (key propia del proyecto)`);
+        }
+        const entries = {};
+        for (const write of here)
+            if (write.kind === 'value')
+                entries[write.key] = write.value;
+        if (Object.keys(entries).length > 0) {
+            const result = await client.writeSecrets(projectId, location, entries, 'create-if-missing');
+            for (const key of result.created)
+                console.log(`  ＋ bóveda ${where} ${key}`);
+            for (const key of result.unchanged)
+                console.log(`  = bóveda ${where} ${key} (ya existía)`);
+        }
+        for (const write of here) {
+            if (write.kind !== 'reference')
+                continue;
+            const result = await client.writeReference(projectId, location, write.key, write.target, 'create-if-missing');
+            const mark = result.created.length > 0 ? '＋' : '=';
+            console.log(`  ${mark} bóveda ${describeWrite(write)} ${write.key}`);
+        }
+    }
+    return resend;
+}
+/**
+ * Right before creating the syncs: the vault folder must hold every key its Vercel target holds
+ * (import first — the first sync deletes nothing), except the retirements already confirmed; and
+ * every secret of the repo must be in `develop:/ci` (the user's answer for GitHub). Any gap stops
+ * here, before ANY sync exists.
+ */
+async function assertNothingToDelete(prepared, projectId, deps, railwaySelected = []) {
+    const { client, plan } = prepared;
+    const retired = new Set(plan.entries.filter((e) => e.action === 'retirar').map((e) => e.name));
+    const gaps = [];
+    if (plan.vercelProject) {
+        const names = await listEnvVarNames(plan.vercelProject.id, prepared.vercelToken, prepared.teamId, {
+            fetchImpl: deps.fetchImpl ?? fetch,
+        });
+        for (const spec of VAULT_SYNC_PLAN.filter((s) => s.destination === 'vercel')) {
+            const inVault = new Set(await client.listSecretKeys(projectId, spec.source));
+            const missing = [
+                ...new Set(names
+                    .filter((env) => env.target.includes(spec.vercelTarget))
+                    .map((env) => env.key)),
+            ]
+                .filter((key) => !inVault.has(key) && !retired.has(key))
+                .sort();
+            if (missing.length > 0)
+                gaps.push(`\`${spec.label}\`: ${missing.join(', ')}`);
+        }
+    }
+    // ADOPT-002: each selected Railway service, re-read now — its keys must be in the folder.
+    for (const proposal of railwaySelected) {
+        const now = await readRailwayVariables(prepared.railwayToken, {
+            projectId: proposal.project.id,
+            environmentId: proposal.source.environment.id,
+            serviceId: proposal.source.service.id,
+            serviceName: proposal.source.service.name,
+        }, deps.fetchImpl ?? fetch);
+        const inVault = new Set(await client.listSecretKeys(projectId, { env: proposal.vaultEnv, path: VAULT_ROOT_PATH }));
+        const missing = [...now.keys()]
+            .filter((key) => !isRailwayProvided(key) && !inVault.has(key) && !retired.has(key))
+            .sort();
+        if (missing.length > 0)
+            gaps.push(`\`${proposal.label}\`: ${missing.join(', ')}`);
+    }
+    if (plan.github) {
+        const inCi = new Set(await client.listSecretKeys(projectId, DEVELOP_CI));
+        const names = await (deps.listGithubSecretNames ?? ghSecretNames)(plan.github.repo);
+        const missing = [...new Set(names)].filter((name) => !inCi.has(name)).sort();
+        if (missing.length > 0) {
+            gaps.push(`\`develop:/ci → secrets de GitHub Actions\`: ${missing.join(', ')}`);
+        }
+    }
+    if (gaps.length > 0) {
+        throw new CLIError('Importé a la bóveda, pero me detengo ANTES de crear los syncs: estas claves del destino no están en ' +
+            'su carpeta y el primer sync las borraría.\n' +
+            gaps.map((line) => `  · ${line}`).join('\n') +
+            '\nAgrégalas en esa carpeta de la bóveda (o bórralas del destino si ya no se usan) y repite ' +
+            '`factory vault adopt --apply`: adopta lo que ya existe. No se creó ningún sync; `.env.local` sigue intacto.');
+    }
+}
+/** A bare host (`app.example.com`, `slug.vercel.app`) — no scheme, no path, no port. */
+const HOST_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+/**
+ * The host of one deploy on a connected-and-empty deploy: the one Vercel gives when it gives
+ * exactly one; otherwise whoever runs answers (the candidates are shown, none is picked). No
+ * terminal → stop naming it. Never invented.
+ */
+async function resolveEmptyDeployHost(what, resolved, candidates, deps) {
+    if (resolved)
+        return resolved;
+    const tty = deps.isTTY ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    const ask = deps.askHost ?? (tty ? defaultAskHost : undefined);
+    const seen = candidates.length === 0
+        ? `Vercel no tiene un dominio de ${what}`
+        : `Vercel tiene ${candidates.length} dominios de ${what} (${candidates.join(', ')}) y no elijo uno`;
+    if (!ask) {
+        throw new CLIError(`No sé el host de ${what}: ${seen}. No lo invento y no hay una terminal para preguntártelo: ` +
+            'corre `factory vault adopt --apply` en una terminal. No se escribió nada.');
+    }
+    const answer = (await ask(`${seen}. ¿Cuál es el host de ${what}? (sólo el host, sin https://)`))
+        ?.trim()
+        .toLowerCase();
+    if (!answer || !HOST_RE.test(answer)) {
+        throw new CLIError(`No recibí un host válido para ${what}. No lo invento: repite \`factory vault adopt --apply\`. ` +
+            'No se escribió nada.');
+    }
+    return answer;
+}
+/**
+ * ADOPT-009 — a connected-and-EMPTY deploy: the per-environment values are generated or derived
+ * exactly like `provision` does for a new deploy (`buildEnvPlan`): `AUTH_SECRET` distinct per
+ * environment, the origins and the rpID from the hosts, `DATABASE_URL` per branch from ADOPT-008's
+ * resolvers. Never from `.env.local` — only the product's SHARED values come from it, each one
+ * confirmed by whoever runs (a "no" keeps it in `local` only). In memory, into the inventory; the
+ * layout then writes it like any other value.
+ */
+async function materializeEmptyDeploy(prepared, deps) {
+    const empty = prepared.plan.emptyDeploy;
+    if (empty.blocked || !prepared.neonProjectId || !prepared.neonBranches) {
+        throw new CLIError(`El deploy está conectado y vacío, pero ${empty.blocked ?? 'no pude resolver los branches de Neon'}. ` +
+            'No se escribió nada.');
+    }
+    const prodHost = await resolveEmptyDeployHost('producción', empty.prodHost, empty.prodCandidates, deps);
+    const previewHost = await resolveEmptyDeployHost('preview (rama `develop`)', empty.previewHost, empty.previewCandidates, deps);
+    empty.prodHost = prodHost;
+    empty.previewHost = previewHost;
+    const confirm = resolveConfirm(deps);
+    const sameBase = prepared.plan.neon?.sameBase === true;
+    if (empty.shared.length > 0 || sameBase) {
+        if (!confirm) {
+            throw new CLIError('El deploy está vacío y estas decisiones necesitan tu confirmación, sin una terminal para dártela: ' +
+                `${[...empty.shared, ...(sameBase ? ['misma base para main y develop'] : [])].join(', ')}. ` +
+                'Corre `factory vault adopt --apply` en una terminal. No se escribió nada.');
+        }
+    }
+    if (sameBase && confirm) {
+        const neon = prepared.plan.neon;
+        const ok = await confirm(`El proyecto de Neon \`${neon.projectId}\` tiene un solo branch (\`${neon.main}\`): main y develop ` +
+            'quedan en la MISMA base (los previews escriben en la de producción). ¿Confirmas?');
+        if (!ok) {
+            throw new CLIError('No confirmaste que main y develop compartan la base. Crea un branch `develop` en Neon y repite. ' +
+                'No se escribió nada.');
+        }
+    }
+    const shared = {};
+    for (const key of empty.shared) {
+        const yes = await confirm(`\`${key}\` de .env.local: ¿es un valor compartido del producto y va a los despliegues ` +
+            '(main:/, y develop:/ lo referencia)? Si no, queda sólo en local.');
+        if (yes)
+            shared[key] = prepared.values.local.get(key);
+        else
+            console.log(`  · ${key}: sólo en local (no lo confirmaste para los despliegues)`);
+    }
+    const mfa = shared[MFA_KEY] ?? '';
+    delete shared[MFA_KEY];
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const apiKey = await prepared.rail.get('NEON_API_KEY');
+    const uri = async (branch) => {
+        try {
+            return await getConnectionUri(apiKey, prepared.neonProjectId, branch.id, true, {
+                fetchImpl,
+            });
+        }
+        catch {
+            throw new CLIError(`Neon no respondió bien al leer la cadena del branch \`${branch.name}\`. No se escribió nada.`);
+        }
+    };
+    const mainDatabaseUrl = await uri(prepared.neonBranches.main);
+    const developDatabaseUrl = sameBase ? mainDatabaseUrl : await uri(prepared.neonBranches.develop);
+    const authSecretProd = generateAuthSecret();
+    const authSecretPreview = generateAuthSecret();
+    if (authSecretProd === authSecretPreview) {
+        throw new CLIError('Los dos AUTH_SECRET generados salieron iguales. No se escribió nada.');
+    }
+    const envPlan = buildEnvPlan({
+        mainDatabaseUrl,
+        developDatabaseUrl,
+        authSecretProd,
+        authSecretPreview,
+        mfaEncryptionKeyProd: mfa,
+        mfaEncryptionKeyPreview: mfa,
+        prodHost,
+        previewHost,
+        shared,
+    });
+    for (const entry of envPlan) {
+        if (entry.value === '')
+            continue; // no MFA key confirmed: never generated here (it is sealed)
+        if (entry.target.includes('production'))
+            prepared.values.production.set(entry.key, entry.value);
+        if (entry.target.includes('preview'))
+            prepared.values.preview.set(entry.key, entry.value);
+    }
+}
+/** A `gh secret set` the key-only mint must never reach (the vault is the single writer). */
+async function refuseGhSecretSet() {
+    throw new CLIError('vault adopt no escribe secrets de GitHub: el sync de develop:/ci es su escritor.');
+}
+/**
+ * ADOPT-009 — step (2b): the project's Neon key, only when the plan said so (no proven key). Minted
+ * with `provisionNeon`'s key-only option (ADOPT-008) over an IN-MEMORY state (slug, Neon project,
+ * repo; `readRemintState` is never read): lists the family and the delivery marker, settles what a
+ * previous run left, mints, writes ONLY `NEON_API_KEY` + `NEON_PROJECT_ID` into `develop:/ci`. The
+ * revocations it leaves are RETURNED — persisted at step (4), settled after the syncs.
+ */
+async function mintNeonKey(prepared, projectId, deps) {
+    const { plan } = prepared;
+    if (plan.neonKey?.action !== 'acuñar')
+        return null;
+    const now = deps.now ?? (() => new Date());
+    const state = {
+        projectName: plan.slug,
+        lifecycle: 'live',
+        scope: prepared.teamId,
+        createdAt: now().toISOString(),
+        neon: {
+            projectId: prepared.neonProjectId,
+            ...(prepared.neonOrgId ? { orgId: prepared.neonOrgId } : {}),
+            mainBranchId: '',
+            developBranchId: '',
+        },
+        ...(plan.repo ? { github: { repo: plan.repo, done: true } } : {}),
+    };
+    let pending = null;
+    await provisionNeon(prepared.rootDir, state, {
+        keyOnly: true,
+        remint: true,
+        persistState: false,
+        vault: { client: prepared.client, projectId },
+        rail: prepared.rail,
+        fetchImpl: deps.fetchImpl ?? fetch,
+        setSecret: refuseGhSecretSet,
+        ...(plan.repo ? { ciRepo: plan.repo } : {}),
+        now,
+        onRevokePending: (p) => {
+            pending = p;
+        },
+    });
+    console.log(`  ＋ bóveda develop:/ci ${NEON_API_KEY} (key propia del proyecto, nueva)`);
+    return pending;
+}
+async function applyAdoption(prepared, deps) {
+    const { plan, client, rootDir } = prepared;
+    // ADOPT-009 — a sync of `rail-timekast` toward the Factory's repo is a second writer of the
+    // same secrets (`SHORTIO_API_KEY`): stop before anything, naming it.
+    if (plan.factory && plan.factory.railSyncsToRepo.length > 0) {
+        throw new CLIError(`\`rail-timekast\` tiene ${plan.factory.railSyncsToRepo.length === 1 ? 'un sync' : 'syncs'} hacia ` +
+            `\`${plan.repo ?? FACTORY_REPO}\`: ${plan.factory.railSyncsToRepo.map((n) => `\`${n}\``).join(', ')}. ` +
+            'Con el sync de `develop:/ci` serían dos escritores de los mismos secrets de GitHub y se pisarían. ' +
+            'Bórralo en la bóveda (el rail no tiene syncs, fx-secrets-vault §2) y repite. No se escribió nada.');
+    }
+    if (plan.unreadable.length > 0) {
+        throw new CLIError(`No puedo importar estas variables: el deploy no devolvió su valor y no son sensitive (un error de ` +
+            `lectura u otro tipo): ${plan.unreadable.join(', ')}. Mientras falte una, no creo el sync (borraría ` +
+            'su valor del deploy). No se escribió nada.');
+    }
+    if (plan.branchScoped.length > 0) {
+        throw new CLIError(`Hay variables de preview atadas a una rama: ${plan.branchScoped
+            .map((v) => `${v.name} (rama ${v.branch})`)
+            .join(', ')}. No las mapeo solas a develop: decide en Vercel y repite. No se escribió nada.`);
+    }
+    // ADOPT-002: which Railway syncs go ahead — the person confirms each; the rest is replanned.
+    const railwaySelected = await selectRailwaySyncs(prepared, deps);
+    if (railwaySelected.length !== prepared.railwayProposals.length) {
+        const replanned = prepared.replan(railwaySelected);
+        prepared.writes = replanned.writes;
+        prepared.questions = replanned.confirmations;
+        plan.railwayConflicts = replanned.railwayConflicts;
+    }
+    // ADOPT-003: the sensitive vars — hosts asked, confirmed, then derived/generated in memory, then
+    // replanned.
+    await resolveSensitiveHosts(prepared, deps);
+    await confirmSensitive(prepared, deps);
+    if ((await materializeSensitive(prepared, deps)) > 0) {
+        const replanned = prepared.replan(railwaySelected);
+        prepared.writes = replanned.writes;
+        prepared.questions = replanned.confirmations;
+        plan.railwayConflicts = replanned.railwayConflicts;
+    }
+    // ADOPT-009: a connected-and-empty deploy — hosts, shared values, then generated per env.
+    if (plan.emptyDeploy) {
+        await materializeEmptyDeploy(prepared, deps);
+        const replanned = prepared.replan(railwaySelected);
+        prepared.writes = replanned.writes;
+        prepared.questions = replanned.confirmations;
+        plan.railwayConflicts = replanned.railwayConflicts;
+    }
+    if (plan.railwayConflicts.length > 0) {
+        throw new CLIError(`Dos servicios de Railway que leerían la misma carpeta de la bóveda tienen otro valor: ` +
+            `${plan.railwayConflicts.join(', ')}. Una carpeta tiene un solo valor por clave y no elijo uno a ` +
+            'ciegas: iguálalos en Railway, o no confirmes uno de esos syncs. No se escribió nada.');
+    }
+    await confirmAll(prepared, deps);
+    // Resolved BEFORE writing anything: without it no Railway sync can exist, so nothing is imported.
+    const railwayConnection = railwaySelected.length > 0 ? await requireRailwayConnection(client) : null;
+    // (1) project + members (idempotent: adopts what exists).
+    const layout = await client.ensureProjectLayout({ name: plan.slug, slug: plan.slug });
+    if (plan.vaultProjectId && plan.vaultProjectId !== layout.project.id) {
+        throw new CLIError(`El bloque \`vault\` de este repo apunta al proyecto ${plan.vaultProjectId}, pero el proyecto ` +
+            `\`${plan.slug}\` de la bóveda es ${layout.project.id}. No escribo en ninguno: corrige el vínculo y repite.`);
+    }
+    const projectId = layout.project.id;
+    console.log(`  ${layout.projectCreated ? '＋' : '↻ (ya existía)'} bóveda: proyecto \`${layout.project.slug}\``);
+    // ADOPT-006: born protected, or turned on here when a pre-existing project lacked it.
+    reportDeleteProtection(layout.project.slug, layout.deleteProtection);
+    for (const member of layout.members.added)
+        console.log(`  ＋ bóveda: miembro ${member}`);
+    // (2) the writes — import first.
+    const resend = await writeLayout(prepared, projectId, deps);
+    // (2b) ADOPT-009 — the project's Neon key, minted key-only BEFORE any sync exists (so the GitHub
+    // names check finds it in `develop:/ci`). Its pending revocations stay in memory until (4).
+    const neonPending = await mintNeonKey(prepared, projectId, deps);
+    // (3) the syncs, with the caller flag of `adopt`.
+    await assertNothingToDelete(prepared, projectId, deps, railwaySelected);
+    const roles = [
+        ...(plan.vercelProject ? ['vercel-production', 'vercel-preview'] : []),
+        ...(plan.repo ? ['github-ci'] : []),
+    ];
+    if (roles.length > 0) {
+        await ensureVaultSyncs({ client, projectId }, {
+            roles,
+            guardForeignKeys: false,
+            projectName: plan.slug,
+            destinations: {
+                ...(plan.vercelProject ? { vercelProjectId: plan.vercelProject.id } : {}),
+                teamId: prepared.teamId,
+                ...(plan.repo ? { repo: plan.repo, repoExists: true } : {}),
+            },
+            vercelToken: async () => prepared.vercelToken,
+        }, {
+            ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+            ...(deps.listGithubSecretNames
+                ? { listGithubSecretNames: deps.listGithubSecretNames }
+                : {}),
+        });
+    }
+    // (3b) ADOPT-002: the Railway syncs — after the import (each is adopted when it already exists).
+    for (const proposal of railwaySelected) {
+        const destination = railwayDestinationOf(proposal);
+        const source = { env: proposal.vaultEnv, path: VAULT_ROOT_PATH };
+        const found = await findRailwaySync(client, projectId, destination, source, proposal.label);
+        if (found) {
+            console.log(`  ↻ (ya existía) sync ${proposal.label}`);
+            continue;
+        }
+        await createRailwaySyncFor(client, projectId, {
+            name: railwaySyncName(plan.slug, proposal.vaultEnv, proposal.source.service.name),
+            source,
+            destination,
+            connection: railwayConnection,
+            label: proposal.label,
+        });
+    }
+    // (4) the link — it CARRIES the block's other fields (a pending revocation of a previous run).
+    writeAdoptionLink(rootDir, {
+        projectId,
+        slug: plan.slug,
+        vercelProjectId: plan.vercelProject?.id ?? null,
+        githubRepo: plan.repo,
+        neonProjectId: prepared.neonProjectId,
+        ...(resend ? { resend } : {}),
+        ...(deps.now ? { now: deps.now } : {}),
+    });
+    console.log(`  ＋ vínculo con la bóveda en .timekast/provision.json`);
+    // (4b) ADOPT-008's narrow writer persists the revocations this run left, then its settle —
+    // AFTER the `develop:/ci` sync exists: the old key is revoked only once the new one reached GitHub.
+    if (neonPending)
+        addNeonRevokePending(rootDir, neonPending);
+    if (readNeonRevokePending(rootDir)) {
+        await settleNeonRevokes(rootDir, { client, projectId }, {
+            repo: plan.repo ?? undefined,
+            rail: prepared.rail,
+            fetchImpl: deps.fetchImpl ?? fetch,
+            wait: neonPending !== null,
+            recordedThisRun: neonPending !== null,
+            neon: { projectId: prepared.neonProjectId, slug: plan.slug },
+            ...(deps.vaultSync ? { sync: deps.vaultSync } : {}),
+        });
+    }
+    // (5) the wrapper — the diff first, then the write; customized scripts are never touched.
+    const preview = wireVaultWrapper(rootDir, { dryRun: true });
+    if (preview.diff.length > 0) {
+        console.log(`\nCableo el wrapper de la bóveda en \`package.json\` (${preview.rewritten.join(', ')}):`);
+        for (const line of preview.diff)
+            console.log(`    ${line}`);
+        wireVaultWrapper(rootDir);
+    }
+    if (preview.customized.length > 0) {
+        console.warn('\n⚠ Estos scripts de `package.json` son de tu equipo y no los toqué: corren SIN la bóveda hasta que ' +
+            'los adapten (por ejemplo, anteponiendo `node scripts/tools/with-vault.mjs`):\n' +
+            preview.customized.map((c) => `    · ${c.name}`).join('\n'));
+    }
+    // (6) `.env.local` — last.
+    const retirement = await retireEnvLocal(rootDir, deps.isGitIgnored ?? defaultIsGitIgnored(rootDir));
+    if (retirement === 'renamed')
+        console.log(`  ↻ .env.local → ${ENV_LOCAL_BACKUP_FILE}`);
+    else if (retirement === 'backup-exists') {
+        console.warn(`⚠ Ya existe \`${ENV_LOCAL_BACKUP_FILE}\`: no lo sobrescribo, así que \`.env.local\` se queda. ` +
+            'Next.js lo carga encima de la bóveda: retíralo tú cuando revises el respaldo viejo.');
+    }
+    else if (retirement === 'backup-not-ignored') {
+        console.warn(`⚠ git no ignora \`${ENV_LOCAL_BACKUP_FILE}\`: no renombro \`.env.local\` (un secreto en el historial es ` +
+            'permanente). Agrega `.env*` a tu `.gitignore` y renómbralo tú.');
+    }
+    console.log(`\n✔ Repo adoptado en la bóveda: \`${plan.slug}\` (${projectId}).`);
+    return retirement;
+}
+// ---------------------------------------------------------------------------
+// Railway syncs (ADOPT-002) — shared by `vault adopt --apply` and `vault sync railway`
+// ---------------------------------------------------------------------------
+/** Ask which proposed Railway syncs go ahead; without a terminal, nothing is chosen blindly. */
+async function selectRailwaySyncs(prepared, deps) {
+    if (prepared.railwayProposals.length === 0)
+        return [];
+    const confirm = resolveConfirm(deps);
+    if (!confirm) {
+        throw new CLIError('Los syncs a Railway necesitan tu confirmación y no hay una terminal para dártela: ' +
+            `${prepared.railwayProposals.map((p) => p.label).join(', ')}. No los elijo a ciegas: corre ` +
+            '`factory vault adopt --apply` en una terminal. No se escribió nada.');
+    }
+    const selected = [];
+    for (const proposal of prepared.railwayProposals) {
+        const yes = await confirm(`¿Creo el sync ${proposal.label} (proyecto de Railway \`${proposal.project.name}\`, id ` +
+            `${proposal.project.id})? Importo antes a la bóveda lo que sólo tiene Railway; desde ahí ` +
+            'la bóveda es el único escritor de sus variables y lo que borres en la bóveda se borra en Railway.');
+        if (yes)
+            selected.push(proposal);
+        else
+            console.log(`  · sin sync ${proposal.label} (no lo confirmaste): no importo sus variables`);
+    }
+    return selected;
+}
+function railwayDestinationOf(proposal) {
+    return {
+        projectId: proposal.project.id,
+        projectName: proposal.project.name,
+        environmentId: proposal.source.environment.id,
+        environmentName: proposal.source.environment.name,
+        serviceId: proposal.source.service.id,
+        serviceName: proposal.source.service.name,
+    };
+}
+/**
+ * The organization's app connection with Railway — REUSED, never created: creating one would store
+ * a copy of the rail's team token in the vault that nobody rotates (`fx-secrets-vault §2`).
+ */
+async function requireRailwayConnection(client) {
+    const connection = await client.findAppConnection('railway');
+    if (!connection) {
+        throw new CLIError('La organización no tiene en la bóveda una conexión con Railway (app connection de tipo `railway`). ' +
+            'No la creo yo: guardaría en la bóveda una copia del token del rail que nadie rotaría ' +
+            '(fx-secrets-vault §2). Pide a un admin de la bóveda que la cree y repite. No se escribió nada ' +
+            'ni se creó ningún sync.');
+    }
+    return connection;
+}
+/**
+ * The sync the vault already has toward this Railway service × environment, or `null`. Adopted
+ * only if it is the expected one (source, deletion ON, auto-sync ON, no key schema); two syncs
+ * toward one destination, or one that differs, stop the run naming why — never patched.
+ */
+async function findRailwaySync(client, projectId, destination, source, label) {
+    const matches = (await client.listSecretSyncs(projectId)).filter((sync) => isRailwaySyncTo(sync, destination));
+    if (matches.length > 1) {
+        throw new CLIError(`La bóveda tiene ${matches.length} syncs hacia el destino de \`${label}\` ` +
+            `(${matches.map((sync) => `\`${sync.name}\``).join(', ')}): dos escritores en un destino se pisan. ` +
+            'Deja uno solo en la bóveda y repite.');
+    }
+    const [found] = matches;
+    if (!found)
+        return null;
+    const differences = railwaySyncDifferences(found, source);
+    if (differences.length > 0) {
+        throw new CLIError(`Ya existe en la bóveda un sync hacia el destino de \`${label}\` (\`${found.name}\`), pero no es el ` +
+            `esperado: ${differences.join('; ')}.\nNo lo adopto ni lo modifico: corrígelo o bórralo en la bóveda y repite.`);
+    }
+    return found;
+}
+async function createRailwaySyncFor(client, projectId, input) {
+    const sync = await client.createRailwaySync(projectId, {
+        name: input.name,
+        source: input.source,
+        connectionId: input.connection.id,
+        railway: input.destination,
+    });
+    console.log(`  ＋ sync ${input.label} (borra en destino · primer sync: sobrescribe, ya importado)`);
+    return sync;
+}
+/** The seams `factory vault sync railway` needs — REQUIRED under Vitest. */
+const REQUIRED_SYNC_RAILWAY_SEAMS = [
+    'vaultClient',
+    'rail',
+    'fetchImpl',
+];
+/**
+ * `factory vault sync railway --project <id> --service <id> --env <main|develop>
+ * [--railway-env <nombre>]` (ADOPT-002) — the sync of a vault deploy root to one Railway service.
+ *
+ *   1. The vault project comes from the `vault` block of `.timekast/provision.json`; without it,
+ *      abort pointing at `factory vault adopt` (or `factory provision`). Nothing is created.
+ *   2. `RAILWAY_TOKEN` from the rail (`rail.ts`), never from `process.env` nor a file; the ids are
+ *      checked with a GraphQL query over projects — never `me` (`fx-secrets-vault §5`).
+ *   3. The Railway environment is the one named like `--env`, or `--railway-env` when it differs
+ *      (the user's answer, 2026-09-24); a name Railway does not have aborts naming the ones it has.
+ *   4. An existing sync toward that service × environment is adopted (a second run creates none).
+ *   5. The org's `railway` app connection is reused; none → abort (never created).
+ *   6. Import first: what only Railway holds is written to the vault BEFORE the sync (its first
+ *      run deletes nothing); a different value, or a key that cannot live in a deploy root, is
+ *      confirmed by the person (no terminal → nothing is written).
+ *   7. Checked again by names, then created: deletion in the destination ON (ADR-005 §4).
+ *
+ * 🔴 NO-ECHO: the token and the values never reach stdout, stderr, an error or a URL.
+ */
+export async function runVaultSyncRailway(flags, deps = {}) {
+    if (globalThis[VAULT_TEST_ISOLATION_KEY] !== undefined) {
+        for (const seam of REQUIRED_SYNC_RAILWAY_SEAMS) {
+            if (deps[seam] === undefined)
+                throw new VaultSeamMissingError(seam);
+        }
+    }
+    const rootDir = deps.rootDir ?? process.cwd();
+    const link = readVaultLink(rootDir);
+    if (!link) {
+        throw new CLIError('Este repo no tiene bloque `vault` en `.timekast/provision.json`: no sé de qué proyecto de la bóveda ' +
+            'sale el sync. Si el repo nació antes de la bóveda, corre `factory vault adopt`; si es un repo nuevo, ' +
+            '`factory provision`. No creé nada.');
+    }
+    const projectId = link.projectId;
+    const rail = deps.rail ?? createRailResolver();
+    const client = deps.vaultClient ?? createVaultClient();
+    const token = await rail.get(RAILWAY_TOKEN_KEY);
+    // Validated with the Railway client: a query over projects (never `me`), by the ids given.
+    const railwayClient = createRailwayClient({
+        token,
+        ...(deps.fetchImpl ? { transport: railwayFetchTransport(deps.fetchImpl) } : {}),
+    });
+    const project = (await railwayClient.listProjects()).find((p) => p.id === flags.project);
+    if (!project) {
+        throw new CLIError(`No encontré en Railway el proyecto \`${flags.project}\` con \`RAILWAY_TOKEN\` (el token de equipo de ` +
+            'la organización TimeKast): no existe, o vive en la cuenta propia de un cliente, que usa otro token ' +
+            'y este comando no maneja (fx-secrets-vault §5). No creé nada.');
+    }
+    const service = project.services.find((s) => s.id === flags.service);
+    if (!service) {
+        throw new CLIError(`El proyecto \`${project.name}\` de Railway no tiene el servicio \`${flags.service}\`. Sus servicios: ` +
+            `${project.services.map((s) => `\`${s.name}\` (${s.id})`).join(', ') || '(ninguno)'}. No creé nada.`);
+    }
+    const railwayEnvName = flags.railwayEnv ?? flags.env;
+    const environment = project.environments.find((e) => e.name === railwayEnvName);
+    if (!environment) {
+        throw new CLIError(`El proyecto \`${project.name}\` de Railway no tiene un entorno \`${railwayEnvName}\`. Tiene: ` +
+            `${project.environments.map((e) => `\`${e.name}\``).join(', ') || '(ninguno)'}.` +
+            (flags.railwayEnv
+                ? ''
+                : ` Si el entorno de Railway se llama distinto, dilo con \`--railway-env <nombre>\`.`) +
+            ' No creé nada.');
+    }
+    const source = { env: flags.env, path: VAULT_ROOT_PATH };
+    const destination = {
+        projectId: project.id,
+        projectName: project.name,
+        environmentId: environment.id,
+        environmentName: environment.name,
+        serviceId: service.id,
+        serviceName: service.name,
+    };
+    const label = railwaySyncLabel(flags.env, { label: `${service.name}@${environment.name}` });
+    const existing = await findRailwaySync(client, projectId, destination, source, label);
+    if (existing) {
+        console.log(`✔ Ya existe el sync ${label} (${existing.id}): no creo otro.`);
+        return { syncId: existing.id, created: false, imported: [] };
+    }
+    const connection = await requireRailwayConnection(client);
+    // Import first — values in memory only.
+    const railwayValues = await railwayClient.readVariableValues({
+        projectId: project.id,
+        environmentId: environment.id,
+        serviceId: service.id,
+        serviceName: service.name,
+    });
+    const folder = await client.readSecrets(projectId, source, { expandReferences: true });
+    const mainFolder = flags.env === VAULT_ENV_DEVELOP
+        ? await client.readSecrets(projectId, MAIN_ROOT, { expandReferences: true })
+        : undefined;
+    const retired = new Set([...railwayValues.keys()].filter((key) => isRailKey(key) || LOCAL_ONLY_KEYS.has(key)));
+    const imported = planRailwayImport({
+        location: source,
+        sources: [railwayValues],
+        folder,
+        ...(mainFolder ? { mainFolder } : {}),
+        retired,
+    });
+    const where = formatLocation(source);
+    await confirmQuestions([
+        ...imported.differing.map((key) => ({
+            name: key,
+            question: `\`${key}\` tiene en Railway otro valor que en ${where}: el sync pondrá en Railway el de la bóveda. ` +
+                '¿Confirmas?',
+        })),
+        ...imported.removed.map((key) => ({
+            name: key,
+            question: `\`${key}\` está en Railway y no puede vivir en ${where} ` +
+                `(${isRailKey(key) ? 'token del rail' : 'clave sólo-local'}): el sync la quitará de ` +
+                'Railway. ¿Confirmas?',
+        })),
+    ], deps, `\`factory vault sync railway\``);
+    const values = {};
+    for (const write of imported.writes)
+        if (write.kind === 'value')
+            values[write.key] = write.value;
+    if (Object.keys(values).length > 0) {
+        const result = await client.writeSecrets(projectId, source, values, 'create-if-missing');
+        for (const key of result.created)
+            console.log(`  ＋ bóveda ${where} ${key} (importada de Railway)`);
+    }
+    for (const write of imported.writes) {
+        if (write.kind !== 'reference')
+            continue;
+        await client.writeReference(projectId, source, write.key, write.target, 'create-if-missing');
+        console.log(`  ＋ bóveda ${describeWrite(write)} ${write.key}`);
+    }
+    // Right before creating it: every key Railway holds is in the folder (the first sync deletes nothing).
+    const inVault = new Set(await client.listSecretKeys(projectId, source));
+    const missing = [...railwayValues.keys()]
+        .filter((key) => !isRailwayProvided(key) && !inVault.has(key) && !retired.has(key))
+        .sort();
+    if (missing.length > 0) {
+        throw new CLIError(`Importé a la bóveda, pero me detengo ANTES de crear el sync: ${missing.join(', ')} no están en ` +
+            `${where} y el primer sync las borraría de Railway. Agrégalas ahí y repite. No se creó ningún sync.`);
+    }
+    const sync = await createRailwaySyncFor(client, projectId, {
+        name: railwaySyncName(
+        // The vault project's slug IS the repo's (`fx-secrets-vault §6`) — whatever shape the state has.
+        (await client.getProject(projectId)).slug, flags.env, service.name),
+        source,
+        destination,
+        connection,
+        label,
+    });
+    console.log(`✔ Sync ${label} creado (${sync.id}) — proyecto de Railway \`${project.name}\` (${project.id}).`);
+    return {
+        syncId: sync.id,
+        created: true,
+        imported: imported.writes.map((w) => w.key),
+    };
+}
+/**
+ * `factory vault adopt --decline` (ADOPT-004) — record the repo's "no" and nothing else: no
+ * `.env.local`, no `package.json`, no Vercel, no vault (not even a read). The shape of the record
+ * is ADOPT-001's ({@link writeDeclineMark}); a repo already in the vault refuses; twice is a no-op.
+ */
+function declineVault(rootDir, deps) {
+    const slug = path.basename(rootDir).toLowerCase();
+    assertValidSubdomainSlug(slug);
+    const outcome = writeDeclineMark(rootDir, { slug, ...(deps.now ? { now: deps.now } : {}) });
+    if (outcome === 'already-declined') {
+        console.log('ℹ️  Este repo ya había declinado la bóveda: no cambié nada. Sigue con `.env.local` y `env:push`.');
+        return { status: 'already-declined' };
+    }
+    console.log('✔ Registré en `.timekast/provision.json` que este repo no entra a la bóveda. Sigue con ' +
+        '`.env.local` y `env:push` como hasta hoy, y `factory doctor` deja de proponerlo. No toqué nada ' +
+        'más. Si algún día cambias de opinión, `factory vault adopt` sigue disponible.');
+    return { status: 'declined' };
+}
+/** `factory vault adopt [--apply | --decline]`. */
+export async function runVaultAdopt(flags, deps = {}) {
+    assertAdoptSeams(deps);
+    const rootDir = deps.rootDir ?? process.cwd();
+    const core = detectCoreProfile(rootDir);
+    if (core !== null) {
+        const why = core === 'lockfile'
+            ? 'el lockfile declara el perfil `core`'
+            : `no hay lockfile y falta \`${WITH_VAULT_SCRIPT_FILE}\``;
+        console.log(`ℹ️  La bóveda no se ofrece en perfil \`core\` (${why}): ese perfil no trae el wrapper que la inyecta ` +
+            'a los scripts. No hice nada.');
+        return { status: 'core' };
+    }
+    if (flags.decline)
+        return declineVault(rootDir, deps);
+    const prepared = await prepareAdoption(rootDir, flags, deps);
+    if (!flags.apply) {
+        if (flags.json)
+            console.log(JSON.stringify(prepared.plan, null, 2));
+        else
+            printPlan(prepared.plan, false);
+        return { status: 'planned', plan: prepared.plan };
+    }
+    printPlan(prepared.plan, true);
+    // ADOPT-003: a sealed key not in the vault stops HERE — before any question or write.
+    await resolveUnknownSensitive(prepared, deps);
+    if (prepared.plan.sealedExplanation) {
+        console.log(`\n${prepared.plan.sealedExplanation}`);
+        return { status: 'sealed', plan: prepared.plan, explanation: prepared.plan.sealedExplanation };
+    }
+    const envLocal = await applyAdoption(prepared, deps);
+    return { status: 'applied', plan: prepared.plan, envLocal };
+}
+// ---------------------------------------------------------------------------
+// `factory vault deploys` (MDEP-001) — a repo deployed once per client
+// ---------------------------------------------------------------------------
+const VAULT_DEPLOYS_USAGE = '`factory vault deploys [--deploy <slug>] [--apply] [--yes]`';
+/** Parse the argv AFTER `deploys`. `--deploy value` and `--deploy=value` both work; unknown stops. */
+export function parseVaultDeploysFlags(argv) {
+    const flags = { apply: false };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === '--apply') {
+            flags.apply = true;
+            continue;
+        }
+        if (arg === '--yes') {
+            flags.yes = true;
+            continue;
+        }
+        if (arg === '--deploy' || arg.startsWith('--deploy=')) {
+            let value;
+            if (arg.startsWith('--deploy='))
+                value = arg.slice('--deploy='.length);
+            else if (argv[i + 1] !== undefined && !argv[i + 1].startsWith('--')) {
+                value = argv[i + 1];
+                i += 1;
+            }
+            if (value === undefined || value.trim() === '') {
+                throw new CLIError(`\`--deploy\` necesita el slug de un despliegue. Uso: ${VAULT_DEPLOYS_USAGE}.`);
+            }
+            flags.deploy = value.trim();
+            continue;
+        }
+        throw new CLIError(`Opción desconocida para \`factory vault deploys\`: \`${arg}\`. Uso: ${VAULT_DEPLOYS_USAGE}.`);
+    }
+    if (flags.yes && !flags.apply) {
+        throw new CLIError('`--yes` sólo va con `--apply`: el plan no escribe nada que confirmar.');
+    }
+    return flags;
+}
+/** The seams `factory vault deploys` needs — REQUIRED under Vitest. */
+const REQUIRED_DEPLOYS_SEAMS = [
+    'vaultClient',
+    'rail',
+    'fetchImpl',
+    'resolveOriginRepo',
+];
+/** The two Vercel syncs of a client: `main:/` → production, `develop:/` → preview. Never `/ci`. */
+const DEPLOY_VERCEL_SYNCS = VAULT_SYNC_PLAN.filter((spec) => spec.destination === 'vercel');
+/** Keys of a destination the client's folder will not hold — the first sync would delete them. */
+function foreignDestinationKeys(destination, folder) {
+    const managed = new Set(folder);
+    return [...new Set(destination)].filter((key) => !managed.has(key)).sort();
+}
+/** How a message names a project of the run. */
+function describeRunProject(project) {
+    if (project.role === 'principal')
+        return `el proyecto principal \`${project.slug}\``;
+    if (project.role === 'plantilla')
+        return `la plantilla \`${project.slug}\``;
+    return `el proyecto \`${project.slug}\` (despliegue \`${project.role}\`)`;
+}
+/** The "pending" reason of a sync whose environment still misses own values. */
+function pendingReason(keys) {
+    return `pendiente — faltan valores propios: ${keys.join(', ')}`;
+}
+/**
+ * BEFORE the first write: where each client syncs and whether each sync can be created or adopted.
+ * Reads only. Stops (all collected, then one error):
+ *
+ *   - a destination that ANOTHER project of the run (principal, template, another client) already
+ *     syncs to — two writers on one destination;
+ *   - an existing sync of the client that is not the expected one (source, deletion ON, auto-sync
+ *     ON, no key schema) — never adopted, never patched;
+ *   - a destination with no sync yet that holds keys the client's folder will not have (the first
+ *     sync would delete them);
+ *   - a missing app connection for a sync that has to be created.
+ *
+ * A sync whose environment still misses the client's own values is NOT a stop: it stays pending
+ * (named), is not created, and the destination is not compared — the next run, with the values
+ * loaded, decides.
+ */
+async function inspectDeployDestinations(input) {
+    const { plan, registry, client, rail, fetchImpl, repo } = input;
+    const tasks = [];
+    const problems = [];
+    /** Per team: ids of the Vercel projects connected to THIS repo (the reader `vault adopt` uses). */
+    const connectedByTeam = new Map();
+    /**
+     * A client's Vercel project must be connected to THIS repo before a sync toward it is created or
+     * adopted: an id copied from another repo's project would pour this client's values into a
+     * deploy of other code. Returns the team, or `null` after naming the problem.
+     */
+    const connectedHere = async (deploy, vercel) => {
+        const teamId = vercel.teamId ?? (await rail.get('VERCEL_TEAM_ID'));
+        const field = `deploys[${registry.deploys.findIndex((d) => d.slug === deploy.slug)}].vercel.projectId`;
+        if (!repo) {
+            problems.push(`\`${deploy.slug}\`: no sé de qué repo de GitHub es este checkout (no tiene remote \`origin\` de ` +
+                'GitHub), así que no puedo comprobar que el proyecto de Vercel ' +
+                `\`${vercel.projectId}\` esté conectado a él — configura el remote \`origin\` y repite`);
+            return null;
+        }
+        let ids = connectedByTeam.get(teamId);
+        if (!ids) {
+            const location = await locateVercelProject({
+                repo,
+                token: await rail.get('VERCEL_TOKEN'),
+                teamId,
+                deps: { fetchImpl },
+            });
+            ids = new Set(location.kind === 'found'
+                ? [location.project.id]
+                : location.kind === 'ambiguous'
+                    ? location.candidates.map((p) => p.id)
+                    : []);
+            connectedByTeam.set(teamId, ids);
+        }
+        if (!ids.has(vercel.projectId)) {
+            problems.push(`\`${deploy.slug}\`: el proyecto de Vercel \`${vercel.projectId}\` no está conectado a este repo ` +
+                `(\`${repo}\`, team \`${teamId}\`) — un sync hacia él escribiría los valores de este despliegue en el ` +
+                `de otro repo. Corrige \`${field}\` (o conecta ese proyecto a este repo en Vercel)`);
+            return null;
+        }
+        return teamId;
+    };
+    const syncsOf = new Map();
+    for (const project of plan.projects) {
+        if (!syncsOf.has(project.id))
+            syncsOf.set(project.id, await client.listSecretSyncs(project.id));
+    }
+    /** The OTHER projects' syncs that write to a destination. */
+    const otherWriters = (own, matches) => plan.projects
+        .filter((project) => project.id !== own)
+        .flatMap((project) => (syncsOf.get(project.id) ?? []).filter(matches).map((sync) => ({ project, sync })));
+    /** An existing sync of the client toward this destination: adopted only if it is the expected one. */
+    const checkOwn = (deploy, found, label, source) => {
+        if (found.length > 1) {
+            problems.push(`\`${deploy.slug}\` → \`${label}\`: la bóveda tiene ${found.length} syncs hacia ese destino ` +
+                `(${found.map((sync) => `\`${sync.name}\``).join(', ')}); deja uno solo`);
+            return true;
+        }
+        const [sync] = found;
+        if (!sync)
+            return false;
+        const differences = railwaySyncDifferences(sync, source);
+        if (differences.length > 0) {
+            problems.push(`\`${deploy.slug}\` → \`${label}\`: el sync existente \`${sync.name}\` no es el esperado — ` +
+                `${differences.join('; ')}. No lo adopto ni lo modifico: corrígelo o bórralo en la bóveda`);
+        }
+        return true;
+    };
+    let railwayProjects;
+    let railwayToken;
+    const needs = { vercel: false, railway: false };
+    for (const deploy of plan.deploys) {
+        const entry = registry.deploys.find((d) => d.slug === deploy.slug);
+        if (!entry.vercel && !entry.railway)
+            continue;
+        const clientSyncs = deploy.projectId ? (syncsOf.get(deploy.projectId) ?? []) : [];
+        const teamId = entry.vercel ? await connectedHere(deploy, entry.vercel) : null;
+        if (entry.vercel && teamId !== null) {
+            const vercelProjectId = entry.vercel.projectId;
+            const missing = [];
+            const pending = [];
+            let names;
+            for (const spec of DEPLOY_VERCEL_SYNCS) {
+                const where = { vercelProjectId };
+                const label = `${spec.label} (Vercel \`${vercelProjectId}\`)`;
+                const writers = otherWriters(deploy.projectId, (sync) => syncTargetsDestination(sync, spec, where));
+                if (writers.length > 0) {
+                    for (const { project, sync } of writers) {
+                        problems.push(`\`${deploy.slug}\`: ${describeRunProject(project)} ya tiene un sync (\`${sync.name}\`) hacia ` +
+                            `\`${spec.label}\` del proyecto de Vercel \`${vercelProjectId}\` (dos escritores se pisan): ` +
+                            'quita uno de los dos');
+                    }
+                    continue;
+                }
+                const own = clientSyncs.filter((sync) => syncTargetsDestination(sync, spec, where));
+                if (checkOwn(deploy, own, label, spec.source))
+                    continue;
+                const env = spec.source.env;
+                if (deploy.ownMissing[env].length > 0) {
+                    pending.push(spec.role);
+                    continue;
+                }
+                missing.push(spec.role);
+                names ??= await listEnvVarNames(vercelProjectId, await rail.get('VERCEL_TOKEN'), teamId, {
+                    fetchImpl,
+                });
+                const foreign = foreignDestinationKeys(names.filter((v) => v.target.includes(spec.vercelTarget)).map((v) => v.key), deploy.folderKeys[env]);
+                if (foreign.length > 0) {
+                    problems.push(`\`${deploy.slug}\` → \`${spec.label}\`: ${foreign.join(', ')} están en el destino y no en la ` +
+                        'bóveda (el primer sync las borraría) — decláralas propias (`ownKeys` + su valor) o ponlas en la plantilla');
+                }
+            }
+            if (missing.length > 0)
+                needs.vercel = true;
+            tasks.push({
+                kind: 'vercel',
+                deploy,
+                label: `Vercel \`${vercelProjectId}\``,
+                vercelProjectId,
+                teamId,
+                missing,
+                pending,
+            });
+        }
+        for (const service of entry.railway?.services ?? []) {
+            railwayToken ??= await rail.get(RAILWAY_TOKEN_KEY);
+            railwayProjects ??= await listRailwayProjects(railwayToken, fetchImpl);
+            const railwayProjectId = entry.railway.projectId;
+            const project = railwayProjects.find((p) => p.id === railwayProjectId);
+            const serviceInfo = project?.services.find((s) => s.id === service.serviceId);
+            const envName = service.railwayEnv ?? service.env;
+            const environment = project?.environments.find((e) => e.name === envName);
+            if (!project || !serviceInfo || !environment) {
+                problems.push(`\`${deploy.slug}\`: Railway no tiene ${!project ? `el proyecto \`${railwayProjectId}\`` : !serviceInfo ? `el servicio \`${service.serviceId}\`` : `el entorno \`${envName}\``} ` +
+                    'con `RAILWAY_TOKEN` (o vive en la cuenta propia de un cliente, que usa otro token) — corrige el registro');
+                continue;
+            }
+            const destination = {
+                projectId: project.id,
+                projectName: project.name,
+                environmentId: environment.id,
+                environmentName: environment.name,
+                serviceId: serviceInfo.id,
+                serviceName: serviceInfo.name,
+            };
+            const label = railwaySyncLabel(service.env, {
+                label: `${serviceInfo.name}@${environment.name}`,
+            });
+            const writers = otherWriters(deploy.projectId, (sync) => isRailwaySyncTo(sync, destination));
+            if (writers.length > 0) {
+                for (const { project: other, sync } of writers) {
+                    problems.push(`\`${deploy.slug}\`: ${describeRunProject(other)} ya tiene un sync (\`${sync.name}\`) hacia ` +
+                        `\`${label}\` (dos escritores se pisan): quita uno de los dos`);
+                }
+                continue;
+            }
+            const source = { env: service.env, path: VAULT_ROOT_PATH };
+            const own = clientSyncs.filter((sync) => isRailwaySyncTo(sync, destination));
+            const exists = checkOwn(deploy, own, label, source);
+            const pending = !exists && deploy.ownMissing[service.env].length > 0;
+            if (!exists && !pending) {
+                needs.railway = true;
+                const vars = await readRailwayVariables(railwayToken, {
+                    projectId: project.id,
+                    environmentId: environment.id,
+                    serviceId: serviceInfo.id,
+                    serviceName: serviceInfo.name,
+                }, fetchImpl);
+                const foreign = foreignDestinationKeys([...vars.keys()].filter((key) => !isRailwayProvided(key)), deploy.folderKeys[service.env]);
+                if (foreign.length > 0)
+                    problems.push(`\`${deploy.slug}\` → \`${label}\`: ${foreign.join(', ')} están en el destino y no en la bóveda ` +
+                        '(el primer sync las borraría) — decláralas propias (`ownKeys` + su valor) o ponlas en la plantilla');
+            }
+            tasks.push({
+                kind: 'railway',
+                deploy,
+                label,
+                env: service.env,
+                destination,
+                exists,
+                pending,
+            });
+        }
+    }
+    for (const app of ['vercel', 'railway']) {
+        if (needs[app] && !(await client.findAppConnection(app))) {
+            problems.push(`la organización no tiene en la bóveda una conexión con ${app === 'vercel' ? 'Vercel' : 'Railway'} ` +
+                `(app connection de tipo \`${app}\`): pide a un admin de la bóveda que la cree`);
+        }
+    }
+    if (problems.length > 0) {
+        throw new CLIError('No escribo nada: los syncs de los despliegues no se pueden crear o adoptar así.\n' +
+            problems.map((line) => `  · ${line}.`).join('\n') +
+            '\nResuélvelo y repite. No se creó ningún proyecto ni se escribió ningún valor.');
+    }
+    return tasks;
+}
+/** How the plan names a change. */
+function describeDeployChange(change) {
+    const mark = change.action === 'añade' ? '＋ añade' : '~ cambia';
+    return `${mark} ${change.key}${change.as === 'referencia' ? ' (referencia a main)' : ''}`;
+}
+function printDeploysPlan(plan, tasks, apply) {
+    console.log(`\nDespliegues — sesión de ${plan.person} · principal \`${plan.principal.slug}\` · plantilla ` +
+        `\`${plan.template.slug}\`${apply ? '' : ' (plan: no escribo nada)'}`);
+    for (const deploy of plan.deploys) {
+        console.log(`\n▸ ${deploy.slug} (${deploy.name}) → proyecto \`${deploy.project}\` ` +
+            `${deploy.create ? '[se crea, con sus miembros y protegido contra borrado; su id se anota en el registro]' : '[existe]'}`);
+        for (const env of DEPLOY_ENVS) {
+            const changes = deploy.changes.filter((c) => c.environment === env);
+            console.log(changes.length === 0
+                ? `  ${env}:/ sin cambios`
+                : `  ${env}:/\n${changes.map((c) => `    ${describeDeployChange(c)}`).join('\n')}`);
+            if (deploy.extra[env].length > 0) {
+                console.log(`    · en la bóveda y fuera del cálculo (no se borran): ${deploy.extra[env].join(', ')}`);
+            }
+            if (deploy.ownMissing[env].length > 0) {
+                console.log(`    · propias sin valor todavía (cárgalas en la bóveda): ${deploy.ownMissing[env].join(', ')}`);
+            }
+        }
+        for (const task of tasks.filter((t) => t.deploy === deploy)) {
+            if (task.kind === 'vercel') {
+                for (const spec of DEPLOY_VERCEL_SYNCS) {
+                    const env = spec.source.env;
+                    const state = task.pending.includes(spec.role)
+                        ? pendingReason(deploy.ownMissing[env])
+                        : task.missing.includes(spec.role)
+                            ? 'se crea'
+                            : 'ya existe';
+                    console.log(`  sync ${spec.label} (${task.label}): ${state}`);
+                }
+            }
+            else {
+                const state = task.exists
+                    ? 'ya existe'
+                    : task.pending
+                        ? pendingReason(deploy.ownMissing[task.env])
+                        : 'se crea';
+                console.log(`  sync ${task.label}: ${state}`);
+            }
+        }
+    }
+    const total = plan.deploys.reduce((n, d) => n + d.changes.length, 0);
+    const creates = plan.deploys.filter((d) => d.create).length;
+    if (total === 0 && creates === 0)
+        console.log('\nNada que cambiar en la bóveda.');
+    if (!apply)
+        console.log(`\nPara ejecutarlo: ${VAULT_DEPLOYS_USAGE.replace('[--apply] [--yes]', '--apply')}`);
+}
+/**
+ * D1 — values already stored in a client that the apply CHANGES (additions are not asked). Listed
+ * by name and environment, then one confirmation; without a terminal, only `--yes` confirms.
+ * Runs before the first write: a "no" or a missing terminal leaves the vault untouched.
+ */
+async function confirmOverwrites(plan, flags, deps) {
+    const overwrites = plan.deploys.flatMap((deploy) => deploy.changes
+        .filter((change) => change.action === 'cambia')
+        .map((change) => `${deploy.slug} ${change.environment}:/${change.key}`));
+    if (overwrites.length === 0)
+        return;
+    console.log(`\nEl --apply CAMBIA ${overwrites.length} valor(es) ya guardado(s) en la bóveda:\n` +
+        overwrites.map((line) => `  ~ ${line}`).join('\n'));
+    if (flags.yes) {
+        console.log('  (confirmado con --yes)');
+        return;
+    }
+    const confirm = resolveConfirm(deps);
+    if (!confirm) {
+        throw new CLIError('Pisar esos valores necesita tu confirmación y no hay una terminal para dártela. Corre el comando en ' +
+            'una terminal, o agrega `--yes` si ya revisaste la lista. No se escribió nada.');
+    }
+    if (!(await confirm(`¿Sobrescribo esos ${overwrites.length} valor(es) guardado(s)?`))) {
+        throw new CLIError('No confirmaste sobrescribir esos valores. No se escribió nada.');
+    }
+}
+/**
+ * `factory vault deploys [--deploy <slug>] [--apply] [--yes]` (MDEP-001) — seed the vault project of
+ * each deploy of `.timekast/deploys.json` from the template, and sync each one to ITS destinations.
+ *
+ *   1. The registry, the principal link (`.timekast/provision.json`) and a PERSON behind the session.
+ *   2. Every client is read, computed and checked (annotated ids, template, foreign values against
+ *      the other clients and the principal, write guard), every destination inspected, and the
+ *      overwrite of stored values confirmed — all BEFORE the first write. A stop up to here leaves
+ *      the vault untouched.
+ *   3. Without `--apply`: the plan, by key name. With it, in this order: projects (layout + members
+ *      + delete protection; the id of each one created is annotated in the registry at once),
+ *      values, then the syncs — `main:/` → Vercel production, `develop:/` → preview, and each
+ *      declared Railway service; a sync whose environment misses own values stays pending. Never
+ *      `/ci`: CI syncs only from the principal. A failure in this phase leaves what was already
+ *      written, and names it; a re-run adopts it and completes the rest.
+ *
+ * 🔴 NO-ECHO: values never reach stdout, stderr or an error — only key names, slugs and ids.
+ */
+export async function runVaultDeploys(flags, deps = {}) {
+    if (globalThis[VAULT_TEST_ISOLATION_KEY] !== undefined) {
+        for (const seam of REQUIRED_DEPLOYS_SEAMS) {
+            if (deps[seam] === undefined)
+                throw new VaultSeamMissingError(seam);
+        }
+    }
+    const rootDir = deps.rootDir ?? process.cwd();
+    const registry = readDeploysRegistry(rootDir);
+    if (flags.deploy !== undefined)
+        resolveDeploy(registry, flags.deploy);
+    const link = readVaultLink(rootDir);
+    if (!link) {
+        throw new CLIError('Este repo no tiene bloque `vault` en `.timekast/provision.json`: el proyecto principal de la bóveda es ' +
+            'el que da nombre a los de cada despliegue. Pásalo primero a la bóveda (`factory vault adopt`, o ' +
+            '`factory provision` si es nuevo). No se escribió nada.');
+    }
+    const client = deps.vaultClient ?? createVaultClient();
+    const rail = deps.rail ?? createRailResolver();
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const { plan, apply } = await planDeploys({
+        client,
+        registry,
+        principalProjectId: link.projectId,
+        ...(flags.deploy !== undefined ? { only: flags.deploy } : {}),
+        onProjectCreated: (slug, projectId) => {
+            recordDeployProjectId(rootDir, slug, projectId);
+            console.log(`  ✎ anoté el id del proyecto de \`${slug}\` en \`${DEPLOYS_REGISTRY_FILE}\` (sin commitear: commitéalo)`);
+        },
+    });
+    // The repo of THIS checkout — only when a targeted client declares a Vercel project (the check
+    // that the project is connected here). Read from the `origin` remote, as `vault adopt` does; not
+    // from the provision state, which a vault-only `provision.json` does not carry.
+    const hasVercel = plan.deploys.some((deploy) => registry.deploys.find((d) => d.slug === deploy.slug)?.vercel !== undefined);
+    let repo = null;
+    if (hasVercel) {
+        const candidate = await (deps.resolveOriginRepo ?? originRepoOf)(rootDir);
+        repo = candidate && REPO_RE.test(candidate) ? candidate : null;
+    }
+    const tasks = await inspectDeployDestinations({
+        plan,
+        registry,
+        client,
+        rail,
+        fetchImpl,
+        repo,
+    });
+    printDeploysPlan(plan, tasks, flags.apply);
+    const syncsPending = tasks.flatMap((task) => task.kind === 'vercel'
+        ? task.pending.map((role) => `${task.deploy.slug}:${role}`)
+        : task.pending
+            ? [`${task.deploy.slug}:${task.label}`]
+            : []);
+    if (!flags.apply)
+        return { plan, applied: null, syncsCreated: [], syncsPending };
+    await confirmOverwrites(plan, flags, deps);
+    const applied = await apply();
+    for (const result of applied) {
+        console.log(`\n✔ ${result.slug}: proyecto \`${result.project}\` ${result.created ? 'creado' : 'adoptado'}` +
+            (result.written.length > 0
+                ? ` · escritas: ${result.written.map((w) => `${w.environment}:/${w.key}`).join(', ')}`
+                : ' · sin escrituras'));
+    }
+    const syncsCreated = [];
+    for (const task of tasks) {
+        const projectId = applied.find((r) => r.slug === task.deploy.slug)
+            .projectId;
+        if (task.kind === 'vercel') {
+            if (task.missing.length === 0)
+                continue;
+            // Right before creating: the destination against the folder as it is NOW.
+            const names = await listEnvVarNames(task.vercelProjectId, await rail.get('VERCEL_TOKEN'), task.teamId, { fetchImpl });
+            for (const role of task.missing) {
+                const spec = DEPLOY_VERCEL_SYNCS.find((s) => s.role === role);
+                const foreign = foreignDestinationKeys(names
+                    .filter((v) => v.target.includes(spec.vercelTarget))
+                    .map((v) => v.key), await client.listSecretKeys(projectId, spec.source));
+                if (foreign.length > 0) {
+                    throw new CLIError(`Me detengo ANTES de crear \`${spec.label}\` de \`${task.deploy.slug}\`: ${foreign.join(', ')} no están ` +
+                        `en ${formatLocation(spec.source)} y el primer sync las borraría. Los proyectos y valores de esta ` +
+                        'corrida ya se escribieron; agrega esas claves en la bóveda y repite: adopta lo que ya existe.');
+                }
+            }
+            const outcome = await ensureVaultSyncs({ client, projectId }, {
+                roles: task.missing,
+                guardForeignKeys: false,
+                projectName: task.deploy.project,
+                destinations: { vercelProjectId: task.vercelProjectId, teamId: task.teamId },
+            }, { fetchImpl });
+            for (const role of task.missing) {
+                if (outcome.active[role])
+                    syncsCreated.push(`${task.deploy.slug}:${role}`);
+            }
+            continue;
+        }
+        if (task.exists || task.pending)
+            continue;
+        const source = { env: task.env, path: VAULT_ROOT_PATH };
+        if (await findRailwaySync(client, projectId, task.destination, source, task.label))
+            continue;
+        const vars = await readRailwayVariables(await rail.get(RAILWAY_TOKEN_KEY), {
+            projectId: task.destination.projectId,
+            environmentId: task.destination.environmentId,
+            serviceId: task.destination.serviceId,
+            serviceName: task.destination.serviceName,
+        }, fetchImpl);
+        const foreign = foreignDestinationKeys([...vars.keys()].filter((key) => !isRailwayProvided(key)), await client.listSecretKeys(projectId, source));
+        if (foreign.length > 0) {
+            throw new CLIError(`Me detengo ANTES de crear el sync ${task.label} de \`${task.deploy.slug}\`: ${foreign.join(', ')} no ` +
+                `están en ${formatLocation(source)} y el primer sync las borraría. Los proyectos y valores de esta ` +
+                'corrida ya se escribieron; agrega esas claves en la bóveda y repite.');
+        }
+        await createRailwaySyncFor(client, projectId, {
+            name: railwaySyncName(task.deploy.project, task.env, task.destination.serviceName),
+            source,
+            destination: task.destination,
+            connection: await requireRailwayConnection(client),
+            label: task.label,
+        });
+        syncsCreated.push(`${task.deploy.slug}:${task.label}`);
+    }
+    if (syncsPending.length > 0) {
+        console.log(`\n⏸ Syncs pendientes (faltan valores propios; no se crearon): ${syncsPending.join(', ')}. Carga esos ` +
+            'valores en el proyecto del despliegue y repite el --apply.');
+    }
+    return { plan, applied, syncsCreated, syncsPending };
+}