@timekast/factory 1.28.1 → 2.0.1

package/dist/tui/provision-flow.js

@@ -29,11 +29,42 @@ import { CLIError } from '../lib/cli-error.js';
  * The services this flow can request, in canonical order. The TUI offers the
  * full ephemeral-safe set as the default; there is intentionally NO live-only or
  * destructive option here (issue §4 + §9). Kept as a literal so the test can
- * assert the exact, bounded surface.
+ * assert the exact, bounded surface. `vault` goes FIRST (VAULT-002): the repo's
+ * project in the vault is where every later step writes what it mints. (`provision`
+ * drops it on its own in a `core` repo, and stops a repo already live without one.)
+ * `vercel` and `railway` are the two destinations' deploy steps (RWAY-004): an alta
+ * uses the one of the destination it picked.
  */
-export const TUI_PROVISION_SERVICES = ['neon', 'github', 'vercel', 'dns'];
-/** The default `--services` string the flow seeds (all ephemeral-safe services). */
-export const TUI_PROVISION_DEFAULT_SERVICES = TUI_PROVISION_SERVICES.join(',');
+export const TUI_PROVISION_SERVICES = [
+    'vault',
+    'neon',
+    'github',
+    'vercel',
+    'railway',
+    'dns',
+];
+/** The destinations the flow offers (`--target`), Vercel first (the default). */
+export const TUI_PROVISION_TARGETS = ['vercel', 'railway'];
+/**
+ * The default `--services` string per destination: each one's deploy step plus `dns`.
+ */
+export const TUI_PROVISION_DEFAULT_SERVICES_BY_TARGET = {
+    vercel: 'vault,neon,github,vercel,dns',
+    railway: 'vault,neon,github,railway,dns',
+};
+/** The default `--services` string the flow seeds (the default destination, Vercel). */
+export const TUI_PROVISION_DEFAULT_SERVICES = TUI_PROVISION_DEFAULT_SERVICES_BY_TARGET.vercel;
+/** The destination a TUI alta passes when none was picked (`--target`). */
+export const TUI_PROVISION_TARGET = 'vercel';
+/** The `--services` tokens that deploy — an alta with one of them needs `--target`. */
+const TUI_DEPLOY_SERVICES = ['github', 'vercel', 'railway', 'dns'];
+/** Whether a comma-separated `--services` value includes a deploy step. */
+function hasDeployStep(services) {
+    return services
+        .split(',')
+        .map((token) => token.trim())
+        .some((token) => TUI_DEPLOY_SERVICES.includes(token));
+}
 /**
  * Build the `--ephemeral` flag set the TUI passes to `runProvision`. The slug is
  * threaded through `--slug` (the canonical stack identifier) so `deriveProjectName`
@@ -47,6 +78,9 @@ export const TUI_PROVISION_DEFAULT_SERVICES = TUI_PROVISION_SERVICES.join(',');
  */
 export function buildEphemeralFlags(inputs, dryRun) {
     const argv = [`--services=${inputs.services}`, `--slug=${inputs.slug}`, '--ephemeral'];
+    // RWAY-003: an alta with a deploy step must name its destination — the one the person picked.
+    if (hasDeployStep(inputs.services))
+        argv.push(`--target=${inputs.target ?? TUI_PROVISION_TARGET}`);
     if (inputs.team)
         argv.push(`--team=${inputs.team}`);
     if (dryRun)
@@ -78,7 +112,8 @@ export function validateSlug(value) {
  * completed provision — and NEVER throws to the caller (the menu stays alive).
  *
  * Order is load-bearing and asserted by the unit test:
- *   1. prompt slug (inline-validated) → team (optional) → services (defaulted)
+ *   1. prompt slug (inline-validated) → destination → team (Vercel only, optional) →
+ *      services (defaulted per destination)
  *   2. `runProvision({ ..., ephemeral: true, dryRun: true })` — show the plan
  *   3. `confirm` — only on "sí":
  *   4. `runProvision({ ..., ephemeral: true })` — the real run
@@ -103,20 +138,41 @@ export async function provisionFlow(deps = {}) {
         console.log('\nProvision cancelado.');
         return;
     }
-    const { team } = await prompts({
-        type: 'text',
-        name: 'team',
-        message: 'Vercel team id (opcional — enter para omitir):',
+    // RWAY-004 — the destination: where the app deploys (one per repo).
+    const { target: picked } = await prompts({
+        type: 'select',
+        name: 'target',
+        message: '¿A qué plataforma se despliega?',
+        choices: [
+            { title: 'Vercel', value: 'vercel' },
+            { title: 'Railway (la bóveda le lleva las variables)', value: 'railway' },
+        ],
+        initial: 0,
     }, { onCancel });
     if (cancelled) {
         console.log('\nProvision cancelado.');
         return;
     }
+    const target = picked === 'railway' ? 'railway' : 'vercel';
+    // The Vercel team only matters with destination Vercel: a Railway alta never asks for it.
+    let team;
+    if (target === 'vercel') {
+        ({ team } = await prompts({
+            type: 'text',
+            name: 'team',
+            message: 'Vercel team id (opcional — enter para omitir):',
+        }, { onCancel }));
+        if (cancelled) {
+            console.log('\nProvision cancelado.');
+            return;
+        }
+    }
+    const defaultServices = TUI_PROVISION_DEFAULT_SERVICES_BY_TARGET[target];
     const { services } = await prompts({
         type: 'text',
         name: 'services',
         message: 'Servicios a aprovisionar:',
-        initial: TUI_PROVISION_DEFAULT_SERVICES,
+        initial: defaultServices,
     }, { onCancel });
     if (cancelled) {
         console.log('\nProvision cancelado.');
@@ -125,9 +181,8 @@ export async function provisionFlow(deps = {}) {
     const inputs = {
         slug: slug.trim(),
         team: typeof team === 'string' && team.trim() !== '' ? team.trim() : undefined,
-        services: typeof services === 'string' && services.trim() !== ''
-            ? services.trim()
-            : TUI_PROVISION_DEFAULT_SERVICES,
+        services: typeof services === 'string' && services.trim() !== '' ? services.trim() : defaultServices,
+        target,
     };
     // 2. ALWAYS dry-run first — show the plan BEFORE asking to proceed (issue §4).
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.28.1",
+  "version": "2.0.1",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",

package/dist/commands/secrets.js

@@ -1,71 +0,0 @@
-/**
- * `factory secrets <file>` — distribute methodology secrets safely (SEC-001).
- *
- * Reads a master `KEY=value` file and merges it idempotently into the
- * per-user secrets rail `~/.claude/.env`, creating it with `chmod 600` if it
- * does not exist. Two hard guarantees:
- *
- *   1. Fail-closed gate — `runPreflight()` (gh installed + authed + org member)
- *      runs FIRST, before any I/O on the target. A non-member, an expired
- *      session, or `gh` missing from PATH aborts with a non-zero exit and the
- *      target is never created or modified. In headless mode with no resolvable
- *      auth, preflight throws too → the command is a no-op fail-closed.
- *   2. No-echo — stdout lists only the KEY NAMES processed (added / updated /
- *      skipped), never their values. A secret value never reaches the terminal.
- *
- * The org gate is `runPreflight()` from `lib/preflight.ts` — the public API.
- * `preflight()` / `assertOrgMembership` are NOT public and are not called here.
- *
- * NOTE: the device-flow `secrets pull` + admin `secrets sync` (the org secrets
- * gate, SECGATE-*) were REMOVED — that gate/droplet effort is parked. The interim
- * model is this shared-file import; the future is Infisical (a fresh branch).
- */
-import { homedir } from 'node:os';
-import path from 'node:path';
-import { mergeEnvFile } from '../lib/env-merge.js';
-import { runPreflight } from '../lib/preflight.js';
-/** Absolute path to the per-user secrets rail (`~/.claude/.env`). */
-export function defaultSecretsTarget() {
-    return path.join(homedir(), '.claude', '.env');
-}
-/** Render the merge outcome to stdout — KEY NAMES only, never values (no-echo). */
-function reportMerge(result, targetPath) {
-    // Surface ignored lines first (P2-2): only the candidate name (left of `=`) is
-    // shown — the value of an invalid line is never echoed.
-    if (result.invalid.length > 0) {
-        console.warn(`⚠ Ignoré ${result.invalid.length} línea(s) con nombre de clave inválido: ` +
-            `${result.invalid.join(', ')} (solo se permite [A-Za-z_][A-Za-z0-9_]*).`);
-    }
-    const total = result.added.length + result.updated.length + result.skipped.length;
-    if (total === 0) {
-        console.log('No había claves que procesar en el archivo fuente.');
-        return;
-    }
-    console.log(`✔ Secretos sincronizados en \`${targetPath}\` (permisos 600).`);
-    if (result.added.length > 0) {
-        console.log(`  Agregadas:    ${result.added.join(', ')}`);
-    }
-    if (result.updated.length > 0) {
-        console.log(`  Actualizadas: ${result.updated.join(', ')}`);
-    }
-    if (result.skipped.length > 0) {
-        console.log(`  Sin cambios:  ${result.skipped.join(', ')}`);
-    }
-    // Reaffirm the no-echo guarantee so the operator knows values were never shown.
-    console.log('ℹ Solo se muestran NOMBRES de clave; los valores nunca se imprimen.');
-}
-/**
- * Run `factory secrets <file>`. Order is deliberate and security-relevant:
- * preflight gate first (fail-closed — no target I/O on failure), then the merge.
- */
-export async function secretsCommand(file, deps = {}) {
-    const preflight = deps.preflight ?? runPreflight;
-    const targetPath = deps.targetPath ?? defaultSecretsTarget();
-    // 1. Fail-closed gate. Throws BEFORE any read/write of the source or target —
-    //    a non-member / unauthenticated / headless-no-token run touches nothing.
-    await preflight();
-    // 2. Merge the source into the rail (creates it 0600 if absent, idempotent).
-    const result = await mergeEnvFile(file, targetPath);
-    // 3. Report — KEY NAMES only.
-    reportMerge(result, targetPath);
-}

package/dist/lib/env-merge.js

@@ -1,238 +0,0 @@
-/**
- * Non-naive `.env` parser + merger for the `factory secrets` rail (SEC-001).
- *
- * Two entry points, one engine:
- *   - `mergeEnvFile(sourcePath, target)` — merge a `.env` FILE on disk (the local
- *     master of `factory secrets <file>`).
- *   - `mergeEnvText(text, target)`       — merge an in-memory `KEY=value` BLOB (a
- *     caller that already holds the text can merge without writing a temp file).
- * `mergeEnvFile` reads its file and delegates to `mergeEnvText`; the merge logic
- * below is written once.
- *
- * Merges a SOURCE `.env` blob into a TARGET (`~/.claude/.env` in production),
- * idempotently and additively:
- *   - keys in source that are absent in target → ADDED
- *   - keys in source that already exist with a different value → UPDATED
- *   - keys in source whose value already matches target → SKIPPED (no churn)
- *   - keys in target NOT mentioned in source → preserved verbatim
- *   - comment lines (`# ...`) + blank lines in target → preserved verbatim
- *   - the target's trailing newline → preserved
- *   - target absent → created with `chmod 600` BEFORE the first write
- *
- * "Non-naive" parsing rules (the sharp cases the tests pin):
- *   - split a `KEY=value` line on the FIRST `=` only — a value may contain `=`
- *     (`KEY=a=b=c` → value `a=b=c`).
- *   - a value wrapped in single or double quotes keeps its quotes literally
- *     (`KEY="val"` and `KEY='val'` round-trip byte-for-byte).
- *   - a `#` INSIDE a quoted value is literal, NOT a comment start
- *     (`KEY="val#hash"` keeps `#hash`). A `#` at column 0 (after optional
- *     whitespace) is a comment line and is never parsed as a key.
- *
- * The merge is line-oriented and surgical: an updated key is rewritten in place
- * (its original line position is kept), so re-running with the same source is a
- * no-op on disk (idempotent — every key SKIPs the second time).
- *
- * Known limitation (documented, not blocked — SEC-001 §8): concurrent writers
- * on the same target may corrupt it (no file lock). The command is manual.
- */
-import { chmodSync, existsSync, lstatSync, readFileSync, writeFileSync } from 'node:fs';
-/**
- * True when a line is a comment or blank — never parsed as a key. A comment is
- * a `#` at the first non-whitespace column; a blank line is empty/whitespace.
- */
-function isCommentOrBlank(line) {
-    const trimmed = line.trimStart();
-    return trimmed === '' || trimmed.startsWith('#');
-}
-/**
- * A valid env-var name: a letter or underscore, then letters/digits/underscores
- * (POSIX shell name shape). The source file is the one fully-untrusted input the
- * tool otherwise trusts, so a line whose key fails this shape (`export FOO`,
- * `; rm -rf`, `FOO BAR`) is NOT written to the rail — it's reported as invalid
- * (P2-2 hardening). Inert as `.env` data, but we refuse to write surprising keys.
- */
-function isValidKey(key) {
-    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
-}
-/**
- * Parse a single `KEY=value` line, splitting on the FIRST `=` only. Returns null
- * for comment/blank lines, lines with no `=`, and lines whose key is not a valid
- * env-var name (all preserved as-is by the target rewrite, never treated as a
- * key). The key is trimmed; the value keeps its quotes and inner characters
- * literally (only trailing whitespace, which a real `.env` loader ignores, is
- * stripped so re-runs stay idempotent).
- */
-function parseLine(line) {
-    if (isCommentOrBlank(line))
-        return null;
-    const eq = line.indexOf('=');
-    if (eq === -1)
-        return null;
-    const key = line.slice(0, eq).trim();
-    if (key === '')
-        return null;
-    if (!isValidKey(key))
-        return null;
-    const value = line.slice(eq + 1).replace(/\s+$/, '');
-    return { key, value };
-}
-/**
- * Build the canonical `KEY=value` line for a pair. Centralized so source parse
- * and target rewrite emit identical text (the idempotency contract depends on
- * byte-equality between a freshly written line and the one parsed back).
- */
-function renderLine(pair) {
-    return `${pair.key}=${pair.value}`;
-}
-/**
- * Read `.env` text, failing closed with a clear error on non-UTF-8 input (SEC-001
- * §8 edge case). `readFileSync(..., 'utf8')` does not throw on invalid bytes — it
- * substitutes U+FFFD — so we detect the replacement character and reject rather
- * than silently corrupt a secret. An empty/missing target is the caller's
- * concern; this only runs on files known to exist.
- */
-function readEnvText(filePath) {
-    const text = readFileSync(filePath, 'utf8');
-    if (text.includes('�')) {
-        throw new Error(`El archivo \`${filePath}\` no es UTF-8 válido (bytes no decodificables). ` +
-            'Revisa su codificación; no se modificó nada.');
-    }
-    return text;
-}
-/**
- * Parse the SOURCE file's key/value pairs, last-write-wins on duplicate keys (a
- * source listing a key twice resolves to its final value — mirrors how a real
- * loader reads top-to-bottom). Order of first appearance is preserved for the
- * keys that get appended to the target. Lines whose key fails `isValidKey` are
- * NOT merged — their candidate name (value-free) is collected in `invalid` so
- * the command can warn the operator (P2-2).
- */
-function parseSource(text) {
-    const byKey = new Map();
-    const order = [];
-    const invalid = [];
-    for (const line of text.split('\n')) {
-        if (isCommentOrBlank(line))
-            continue;
-        const eq = line.indexOf('=');
-        if (eq === -1)
-            continue; // no '=' — not a key assignment; ignored in a source file
-        const key = line.slice(0, eq).trim();
-        if (key === '')
-            continue;
-        if (!isValidKey(key)) {
-            if (!invalid.includes(key))
-                invalid.push(key); // candidate only — never the value
-            continue;
-        }
-        const value = line.slice(eq + 1).replace(/\s+$/, '');
-        if (!byKey.has(key))
-            order.push(key);
-        byKey.set(key, value);
-    }
-    return { pairs: order.map((key) => ({ key, value: byKey.get(key) })), invalid };
-}
-/**
- * Merge `sourcePath` into `targetPath`. See the module docstring for the full
- * contract. Async to match the CLI's command surface (`mergeEnvFile(...)` is
- * awaited), though the FS ops are synchronous under the hood — the cost is a
- * couple of small reads/writes, and sync keeps the chmod-before-write ordering
- * race-free.
- *
- * Thin wrapper over {@link mergeEnvText}: reads + validates the SOURCE FILE, then
- * delegates the merge to the text-level engine. `factory secrets <file>` (a local
- * master on disk) uses this; a caller that already holds the text in memory uses
- * `mergeEnvText` directly.
- *
- * @throws when the source is missing/unreadable, or either file is not UTF-8.
- */
-export async function mergeEnvFile(sourcePath, targetPath) {
-    // Source must exist and be readable — fail closed with a clear message (the
-    // command never half-writes a target off a missing/garbled source).
-    if (!existsSync(sourcePath)) {
-        throw new Error(`No encontré el archivo fuente \`${sourcePath}\`.`);
-    }
-    // The only difference from a `pull` is WHERE the source text comes from (a file
-    // here, an HTTP body there). Once read, the merge is identical — so read here
-    // and hand the text to the shared engine. No reimplementation of the merge.
-    return mergeEnvText(readEnvText(sourcePath), targetPath);
-}
-/**
- * Merge SOURCE TEXT (a `KEY=value` blob already in memory) into `targetPath`.
- *
- * This is the engine `mergeEnvFile` delegates to, kept as a separate text-level
- * entry point so a caller that already holds the blob in memory can merge it
- * straight in, so a secret value NEVER lands in a temp file or any intermediate
- * path on the way to `~/.claude/.env`.
- *
- * Same contract as `mergeEnvFile` for everything downstream of the source read:
- * additive/idempotent merge, first-`=` split, quoted values preserved, comments +
- * untouched target keys preserved, trailing newline preserved, target created
- * `0600` if absent and re-asserted `0600` if it already existed (Edge case §8 —
- * a `0644` file edited by hand is corrected before any secret is written).
- *
- * @throws when the target is a symlink or not UTF-8. (The source is in-memory
- *   text, so there is no "source missing" failure mode here — the caller owns
- *   validating that the HTTP body is well-formed before calling.)
- */
-export async function mergeEnvText(text, targetPath) {
-    const { pairs: sourcePairs, invalid } = parseSource(text);
-    // Reject a symlink target explicitly (SEC-001 §8): writing through a symlink
-    // could redirect secrets outside `~/.claude/`. We refuse rather than follow.
-    if (existsSync(targetPath) && lstatSync(targetPath).isSymbolicLink()) {
-        throw new Error(`El destino \`${targetPath}\` es un symlink. Por seguridad no escribo a través de symlinks; ` +
-            'apunta a un archivo regular.');
-    }
-    // Target absent → create empty with 0600 BEFORE writing any secret, so the
-    // file is never world-readable even for the instant between create and chmod.
-    const targetExists = existsSync(targetPath);
-    if (!targetExists) {
-        writeFileSync(targetPath, '', { mode: 0o600 });
-    }
-    const targetText = targetExists ? readEnvText(targetPath) : '';
-    // Preserve the trailing-newline shape of the original target: an empty file and
-    // a file ending in `\n` both round-trip; a file without a final newline gets one
-    // (a well-formed `.env` ends in a newline — POSIX text-file convention).
-    const hadTrailingNewline = targetText.endsWith('\n');
-    const lines = targetText.length === 0 ? [] : targetText.replace(/\n$/, '').split('\n');
-    const sourceByKey = new Map(sourcePairs.map((p) => [p.key, p.value]));
-    const seenInTarget = new Set();
-    const added = [];
-    const updated = [];
-    const skipped = [];
-    // Rewrite existing target lines in place: a key present in source is updated
-    // (or skipped if unchanged); comments, blanks, and untouched keys pass through.
-    const rewritten = lines.map((line) => {
-        const pair = parseLine(line);
-        if (!pair)
-            return line; // comment / blank / malformed — preserve verbatim
-        seenInTarget.add(pair.key);
-        if (!sourceByKey.has(pair.key))
-            return line; // key not in source — preserve
-        const nextValue = sourceByKey.get(pair.key);
-        if (nextValue === pair.value) {
-            skipped.push(pair.key);
-            return line;
-        }
-        updated.push(pair.key);
-        return renderLine({ key: pair.key, value: nextValue });
-    });
-    // Append source keys that were not already in the target, in source order.
-    for (const pair of sourcePairs) {
-        if (seenInTarget.has(pair.key))
-            continue;
-        added.push(pair.key);
-        rewritten.push(renderLine(pair));
-    }
-    // Reassemble. Restore the trailing newline when the original had one (or when
-    // we created/append-grew the file — a `.env` should end in `\n`).
-    const body = rewritten.join('\n');
-    const shouldEndWithNewline = hadTrailingNewline || !targetExists || rewritten.length > lines.length;
-    const finalText = shouldEndWithNewline && rewritten.length > 0 ? `${body}\n` : body;
-    writeFileSync(targetPath, finalText, { mode: 0o600 });
-    // Re-assert 0600 even when the file already existed (it may have been created
-    // with looser perms before this rail existed — SEC-001 §8). `writeFileSync`'s
-    // `mode` is ignored for an existing file, so chmod explicitly.
-    chmodSync(targetPath, 0o600);
-    return { added, updated, skipped, invalid };
-}