@timekast/factory 2.4.0 → 2.5.0

package/dist/lib/initial-writes.js

@@ -0,0 +1,113 @@
+/**
+ * What a FIRST install (`factory add`, and the legacy auto-register of `factory update`) may
+ * write over a repo that already has files of its own (Factory#76).
+ *
+ * Both paths used to write every manifest file without looking, which is right for the brain
+ * (`.claude/`, `scripts/tools/`) and wrong for the handful of kit files that live among the
+ * repo's own: an `add --full` replaced a repo's `.github/workflows/ci.yml` with the kit
+ * template and dropped its build, E2E and gitleaks steps. Three classes, decided by path:
+ *
+ *   - brain (`BRAIN_PREFIXES`) → always written, as before;
+ *   - `CLAUDE.md`             → written only when absent (dev-owned content, unchanged rule);
+ *   - every other kit file    → written when absent; left alone when it already holds the kit's
+ *     content; KEPT when it holds something else, with the kit's copy written next to it as
+ *     `<path>.kit-example` for the team to compare.
+ *
+ * The lockfile still records the KIT hash for a kept file (it is the embedded manifest), the
+ * same as a preserved `CLAUDE.md`. On the next `update` the diff engine then reads it as a local
+ * edit: kept silently while the kit does not change it (`ignoreLocal`), a mine/theirs prompt
+ * when it does.
+ */
+import { copyFileSync, existsSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { BRAIN_PREFIXES, CLAUDE_MD_FILE, KIT_EXAMPLE_SUFFIX } from './constants.js';
+import { normalizeThenHash } from './lockfile.js';
+/** Classify a manifest path (see the module header for what each class does). */
+export function classifyInitialWrite(relPath) {
+    if (BRAIN_PREFIXES.some((prefix) => relPath.startsWith(prefix)))
+        return 'brain';
+    if (relPath === CLAUDE_MD_FILE)
+        return 'claude-md';
+    return 'repo';
+}
+/** The kit's copy of a kept repo file: the suffix goes after the WHOLE name. */
+export function kitExamplePath(relPath) {
+    return `${relPath}${KIT_EXAMPLE_SUFFIX}`;
+}
+/**
+ * Split the manifest into what a first install writes and what it keeps. Reads the repo, writes
+ * nothing. A `repo`-class file whose normalized hash equals the kit's is neither written nor
+ * kept: it already is the kit's file.
+ */
+export function partitionInitialWrites(root, manifest) {
+    const writes = [];
+    const kept = [];
+    for (const entry of manifest.files) {
+        const abs = path.join(root, entry.path);
+        const onDisk = existsSync(abs) && statSync(abs).isFile();
+        switch (classifyInitialWrite(entry.path)) {
+            case 'brain':
+                writes.push(entry.path);
+                break;
+            case 'claude-md':
+                if (!onDisk)
+                    writes.push(entry.path);
+                break;
+            case 'repo':
+                if (!onDisk)
+                    writes.push(entry.path);
+                else if (normalizeThenHash(readFileSync(abs, 'utf8')) !== entry.hash)
+                    kept.push(entry.path);
+                break;
+        }
+    }
+    return { writes, kept };
+}
+/**
+ * Copy the kit's version of each kept file from the staged tarball to `<path>.kit-example`.
+ * Returns the example paths actually written (a path missing from the staged dir is skipped).
+ */
+export function writeKitExamples(root, stagedDir, kept) {
+    const written = [];
+    for (const rel of kept) {
+        const src = path.join(stagedDir, rel);
+        if (!existsSync(src))
+            continue;
+        copyFileSync(src, path.join(root, kitExamplePath(rel)));
+        written.push(kitExamplePath(rel));
+    }
+    return written;
+}
+/**
+ * `update`: refresh every `<path>.kit-example` already on disk with the incoming kit version,
+ * so the copy the team compares against never goes stale. Only paths of the manifest, only
+ * examples that already exist (an update never creates one), only when the bytes change.
+ * Returns the example paths rewritten.
+ */
+export function refreshKitExamples(root, stagedDir, manifestPaths) {
+    const refreshed = [];
+    for (const rel of manifestPaths) {
+        if (classifyInitialWrite(rel) !== 'repo')
+            continue;
+        const example = path.join(root, kitExamplePath(rel));
+        const src = path.join(stagedDir, rel);
+        if (!existsSync(example) || !existsSync(src))
+            continue;
+        const incoming = readFileSync(src);
+        if (readFileSync(example).equals(incoming))
+            continue;
+        copyFileSync(src, example);
+        refreshed.push(kitExamplePath(rel));
+    }
+    return refreshed;
+}
+/** Tell the dev which files were kept and where the kit's version went. */
+export function reportKeptRepoFiles(kept) {
+    if (kept.length === 0)
+        return;
+    console.log('\nConservé estos archivos tuyos; la versión del kit quedó al lado para comparar:');
+    for (const rel of kept)
+        console.log(`  • ${rel} → ${kitExamplePath(rel)}`);
+    console.log('  Si quieres algo de la versión del kit, cópialo a mano. Mientras el kit no cambie esos ' +
+        'archivos, `factory update` los deja como están; si los cambia, te pregunta cuál conservar.');
+}

package/dist/lib/kit-deps.js

@@ -0,0 +1,163 @@
+/**
+ * The npm packages the kit's files need, against the ones the repo declares (Factory#78).
+ *
+ * A derivative of an older kit (or an app that never was one) gets kit files that import
+ * packages it does not have — `sharp`, `@testing-library/*`, `knip`… — and its typecheck,
+ * `next build` and CI go red with nothing telling it why. The builder embeds the list in
+ * every tarball (`.timekast/kit-deps.json`, `distribution/build-dist.ts#buildKitDeps`):
+ * each package with the range the Factory declares. `add` and `update` compare it with the
+ * repo's `package.json` and OFFER to install what is missing:
+ *
+ *   · interactive terminal → asks, and on yes runs `<pm> add -D …` in the repo;
+ *   · no terminal, or `--yes` → only prints the exact command (never installs blindly —
+ *     installing a dependency is the dev's call, `CODING.md §7`);
+ *   · `--dry-run` → only lists them.
+ *
+ * A repo without `package.json` is not a Node project: nothing is offered, and none is
+ * ever created. A tarball from before this list existed has no file: nothing is offered.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { execa } from 'execa';
+import prompts from 'prompts';
+import { KIT_DEPS_FILE, TIMEKAST_DIR } from './constants.js';
+import { PACKAGE_JSON_FILE, PNPM_LOCKFILE } from './initial-migration.js';
+/** Lockfile → package manager, in detection order. No lockfile → `pnpm` (the kit's). */
+const PM_LOCKFILES = [
+    [PNPM_LOCKFILE, 'pnpm'],
+    ['yarn.lock', 'yarn'],
+    ['package-lock.json', 'npm'],
+    ['bun.lockb', 'bun'],
+    ['bun.lock', 'bun'],
+];
+/** The "add as devDependency" verb of each package manager. */
+const PM_ADD_DEV = {
+    pnpm: ['add', '-D'],
+    yarn: ['add', '-D'],
+    npm: ['install', '-D'],
+    bun: ['add', '-d'],
+};
+/**
+ * Read the list from a STAGED tarball. Absent (a release from before the list) → `null`,
+ * silently. Unreadable or with the wrong shape → `null` with a warning: the brain still
+ * installs, the offer is just skipped.
+ */
+export function readKitDeps(stagedDir) {
+    const file = path.join(stagedDir, TIMEKAST_DIR, KIT_DEPS_FILE);
+    if (!existsSync(file))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(file, 'utf8'));
+        const packages = parsed.packages;
+        if (typeof packages !== 'object' ||
+            packages === null ||
+            Array.isArray(packages) ||
+            !Object.values(packages).every((range) => typeof range === 'string')) {
+            throw new Error('shape');
+        }
+        return parsed;
+    }
+    catch {
+        console.warn(`Aviso: el \`${TIMEKAST_DIR}/${KIT_DEPS_FILE}\` del tarball no se pudo leer; omito la revisión de dependencias.`);
+        return null;
+    }
+}
+/**
+ * The kit packages the repo's `package.json` does not declare (in `dependencies`,
+ * `devDependencies`, `optionalDependencies` or `peerDependencies`), as `name@range`
+ * specs sorted by name — pure.
+ */
+export function missingKitDeps(pkg, kitDeps) {
+    const declared = new Set();
+    for (const field of [
+        'dependencies',
+        'devDependencies',
+        'optionalDependencies',
+        'peerDependencies',
+    ]) {
+        const deps = pkg[field];
+        if (deps && typeof deps === 'object')
+            for (const name of Object.keys(deps))
+                declared.add(name);
+    }
+    return Object.keys(kitDeps.packages)
+        .filter((name) => !declared.has(name))
+        .sort()
+        .map((name) => `${name}@${kitDeps.packages[name]}`);
+}
+/** The repo's package manager, by its lockfile — pure over `exists`. */
+export function detectPackageManager(rootDir, exists = existsSync) {
+    return PM_LOCKFILES.find(([file]) => exists(path.join(rootDir, file)))?.[1] ?? 'pnpm';
+}
+/** `<pm>` + its args to add `specs` as devDependencies. */
+export function installArgs(pm, specs) {
+    return [pm, [...PM_ADD_DEV[pm], ...specs]];
+}
+/** The command as a dev types it: each spec quoted when the shell could read it (`^` in zsh). */
+export function installCommand(pm, specs) {
+    const [bin, args] = installArgs(pm, specs);
+    const quote = (arg) => (/^[A-Za-z0-9@/._=-]+$/.test(arg) ? arg : `'${arg}'`);
+    return [bin, ...args.map(quote)].join(' ');
+}
+async function defaultConfirm(question) {
+    const answer = (await prompts({
+        type: 'confirm',
+        name: 'ok',
+        message: question,
+        initial: true,
+    }));
+    return answer?.ok === true;
+}
+async function defaultRun(bin, args, cwd) {
+    const result = await execa(bin, args, { cwd, stdio: 'inherit', reject: false });
+    return result.exitCode ?? 1;
+}
+/**
+ * Compare the kit's list with the repo's `package.json` and offer to install what is
+ * missing (see the module doc for who gets asked). Never throws for a missing or invalid
+ * `package.json` — the brain is installed either way.
+ */
+export async function offerKitDeps(rootDir, kitDeps, opts = {}) {
+    const pkgPath = path.join(rootDir, PACKAGE_JSON_FILE);
+    if (kitDeps === null || !existsSync(pkgPath))
+        return { action: 'none', missing: [] };
+    let pkg;
+    try {
+        pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+    }
+    catch {
+        return { action: 'none', missing: [] };
+    }
+    const missing = missingKitDeps(pkg, kitDeps);
+    if (missing.length === 0)
+        return { action: 'none', missing };
+    const pm = detectPackageManager(rootDir);
+    const command = installCommand(pm, missing);
+    console.log(`\nLos archivos del kit usan ${missing.length} paquete(s) que tu \`package.json\` no declara ` +
+        '(sin ellos el typecheck, el build o el CI pueden fallar):');
+    for (const spec of missing)
+        console.log(`  • ${spec}`);
+    if (opts.dryRun) {
+        console.log(`Para instalarlos: \`${command}\``);
+        return { action: 'listed', missing };
+    }
+    const isTTY = opts.isTTY ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    if (opts.assumeYes || !isTTY) {
+        console.log(`Instálalos con: \`${command}\``);
+        return { action: 'printed', missing };
+    }
+    const confirm = opts.confirm ?? defaultConfirm;
+    if (!(await confirm(`¿Los instalo ahora como devDependencies? (\`${command}\`)`))) {
+        console.log(`No instalé nada. Cuando quieras: \`${command}\``);
+        return { action: 'declined', missing };
+    }
+    const [bin, args] = installArgs(pm, missing);
+    const exitCode = await (opts.run ?? defaultRun)(bin, args, rootDir);
+    if (exitCode !== 0) {
+        console.warn(`Aviso: \`${command}\` falló (código ${exitCode}). Revísalo y repítelo a mano.`);
+        return { action: 'failed', missing };
+    }
+    console.log(`✔ Paquetes instalados. \`package.json\` y el lockfile de \`${pm}\` quedaron modificados ` +
+        'y sin commitear: revísalos y commitéalos tú.');
+    return { action: 'installed', missing };
+}

package/dist/lib/kit-settings-history.json

@@ -0,0 +1,13 @@
+{
+    "473a92392f7357596cf877cf4703a49ee03786141313e0959734c8c537561006": "0c2922a8fce7c8073d3740392caaedbdd1b502efd0da07b988fca271dd32bc93",
+    "ac139661924928e1080053b6032409c6b105f5c929355ce95ff5a91ee03cd100": "f24cc44dd20bb99edf5511e1202948fe3fe35ee063e283790eaabdf07eac6cee",
+    "9784f61835263225d26c4f2d5646e9540597667173510e4865c64439aff26950": "b582d978287acf77175fdc0048d23771da7b8c6f04d519eb98253d6b726d624a",
+    "04664118924eb3a936fff0c37818befe0b950e8cc5fc8ced04917d4575b1dae8": "69fc8443158543232b07c6e0177a4630b25287f7b298811192ec5ecc65586fa9",
+    "a2fd91e21cf3110ad7c59b54b209ae2228e9797e16ef346e040af01dd640f1ef": "d1f75b3591fc12ac29c670183376cd1a1c79f30149be0aa28c5e412a6879227b",
+    "0b834d5e7f2e14d2d617b665bd768b89876d2bd8e3f17244a03194c02d03c528": "7ad35befedc2260fb75df0d6bd4c42720c478e02f97f1d43e23769fd7516da78",
+    "2ab69db4fcab8cd10637b41004503caaedf30855af7779bc19cc85ea39f9b62a": "49cb2ac5d07b69fa9d35c7ab97acd23a311c0fe76cbacd74e137e7dce5300ef2",
+    "8ab33214c9204aebfb655a9f8b44fdf14e3d6e553b6142014f54b441400b82af": "2cc1afb006290a1ddf88b43b9fdc9f12354f1c22c5983c52a9d47c796a0c44ff",
+    "6248c3c08b75455d5e0af8fd38089ac48a501ed851d4982b1fb2bbbade76f8ed": "bc50ff7698b6e7f9573649015295a58b3667d3eed72e8369f1178b3f2d553b53",
+    "62f90996cf30610266fc95b8be85ac6e79b2156d03083415dc7c063b9efe4205": "d48522be6e87f07ae60c8cd26bda469014d0fe15632f3ff8a0a50562a58d44d9",
+    "5a11e07728b61229a0cbcc5f9b31daf8c71e8c701f5daf4b026328226481d167": "92ad1c42bd0f3f4e93ba9a3ff358d084083ad87acc8719dfc7211edd76c30348"
+}

package/dist/lib/lockfile.js

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { CLIError } from './cli-error.js';
-import { CLAUDE_MD_FILE, LOCKFILE_FILE, MANIFEST_FILE, TIMEKAST_DIR, } from './constants.js';
+import { CLAUDE_MD_FILE, KIT_DEPS_FILE, LOCKFILE_FILE, MANIFEST_FILE, TIMEKAST_DIR, } from './constants.js';
 /**
  * Write the initial lockfile in `destDir/.timekast/lockfile.json` (used by
  * `new` / `add`). On the initial install the lockfile carries the tarball's
@@ -54,9 +54,11 @@ export function writeInitialLockfile(destDir, manifestRaw) {
     const stamped = { ...manifest, factoryVersion: manifest.version };
     // If the tarball already unpacked manifest.json into .timekast/, drop it: the
     // stamped lockfile is the SSOT and we do not keep a duplicate manifest around.
-    const unpackedManifest = path.join(timekastDir, MANIFEST_FILE);
-    if (existsSync(unpackedManifest)) {
-        rmSync(unpackedManifest, { force: true });
+    // Same for the dependency list (Factory#78): it is read from the staged tarball, never kept.
+    for (const unpacked of [MANIFEST_FILE, KIT_DEPS_FILE]) {
+        const abs = path.join(timekastDir, unpacked);
+        if (existsSync(abs))
+            rmSync(abs, { force: true });
     }
     writeLockfile(destDir, stamped);
 }
@@ -124,7 +126,10 @@ export function parseLockfile(raw, source = 'lockfile') {
         if (typeof e.path !== 'string' || typeof e.hash !== 'string') {
             throw new CLIError(`El ${source} tiene una entrada sin \`path\`/\`hash\` en files[${i}].`);
         }
-        return { path: e.path, hash: e.hash };
+        const keys = Array.isArray(e.keys) && e.keys.every((k) => typeof k === 'string')
+            ? { keys: e.keys }
+            : {};
+        return { path: e.path, hash: e.hash, ...keys };
     });
     return {
         version: obj.version,

package/dist/lib/prune-remote.js

@@ -391,11 +391,13 @@ async function listNotMigrated(legacy, deps) {
     }
     return out;
 }
-// ---------------------------------------------------------------------------
-// Invite
-// ---------------------------------------------------------------------------
-/** Invite an outside collaborator with read access, after checking they are not a member. */
-export async function pruneInvite(repo, user, deps) {
+/**
+ * Invite an outside collaborator, after checking they are not a member. Write (`push`) by
+ * default: collaborators work on branches of this repo and open PRs that `/integrate` checks.
+ * On GitHub Free a private repo cannot protect `main`, so write also reaches it directly —
+ * the owner's call, accepted for in-house devs; `--read` grants read only.
+ */
+export async function pruneInvite(repo, user, deps, permission = 'push') {
     const { owner } = splitRepo(repo);
     if (!/^[A-Za-z0-9-]+$/.test(user))
         throw new CLIError(`\`${user}\` no es un usuario de GitHub válido.`);
@@ -412,7 +414,7 @@ export async function pruneInvite(repo, user, deps) {
         'PUT',
         `repos/${repo}/collaborators/${user}`,
         '-f',
-        'permission=pull',
+        `permission=${permission}`,
     ]);
     if (r.exitCode !== 0) {
         if (/403|Forbidden|must have admin/i.test(r.stderr)) {

package/dist/lib/prune-vercel.js

@@ -0,0 +1,137 @@
+/**
+ * `factory prune vercel` — reconnect the Vercel project to the repo the cut created.
+ *
+ * Vercel binds a project to GitHub's NUMERIC repo id, and a rename keeps the id: after
+ * `prune cutover` the project still deploys from `<repo>-legacy`. Re-linking to the new
+ * repo takes an unlink + link (`DELETE` then `POST /v9/projects/{id}/link`); the project,
+ * its env vars, domains and deployments stay.
+ *
+ * Order is the safety argument:
+ *   1. read the current link and the new repo's id — already linked → nothing to do;
+ *   2. without `--confirm`, print the plan and stop;
+ *   3. unlink → link → READ the link back and require the new repo's id.
+ * A failure between 1 and 3 leaves the project unlinked (it serves its last deployment, it
+ * just stops deploying on push); a re-run with `--confirm` links it, since step 1 sees no link.
+ * Never triggers a deployment.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { CLIError } from './cli-error.js';
+import { readDestroyTarget } from './provision-state.js';
+import { getGitLink, linkGitRepo, unlinkGitRepo, } from './vercel-env.js';
+/** GitHub's numeric id of `repo`, read with the member's `gh` session. */
+async function githubRepoId(repo, deps) {
+    const r = await deps.gh(['api', `repos/${repo}`, '--jq', '.id']);
+    const id = Number(r.stdout.trim());
+    if (r.exitCode !== 0 || !Number.isInteger(id)) {
+        throw new CLIError(`No pude leer \`${repo}\` en GitHub: ${r.stderr || 'respuesta sin id'}`);
+    }
+    return id;
+}
+export async function pruneVercelRelink(input, deps) {
+    const { projectId, teamId, token } = input;
+    const api = deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {};
+    const targetId = await githubRepoId(input.repo, deps);
+    const from = await getGitLink(projectId, token, teamId, api);
+    if (from?.repoId === targetId)
+        return { status: 'already-linked', link: from };
+    if (!input.confirm)
+        return { status: 'plan', from, to: input.repo };
+    if (from)
+        await unlinkGitRepo(projectId, token, teamId, api);
+    try {
+        await linkGitRepo(projectId, token, teamId, input.repo, api);
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        throw new CLIError(`Desconecté el proyecto de Vercel${from ? ` de \`${from.repo}\`` : ''} pero no pude conectarlo a ` +
+            `\`${input.repo}\`: ${why}\nEl proyecto sigue sirviendo su último deploy; sólo dejó de desplegar ` +
+            'con cada push. Corrige la causa (p. ej. la GitHub App de Vercel sin acceso al repo nuevo) y ' +
+            'vuelve a correr `factory prune vercel --confirm`: ve que no hay vínculo y sólo conecta.');
+    }
+    const to = await getGitLink(projectId, token, teamId, api);
+    if (to?.repoId !== targetId) {
+        throw new CLIError(`Vercel aceptó el vínculo pero al releerlo apunta a ${to ? `\`${to.repo}\`` : 'ningún repo'}, no a ` +
+            `\`${input.repo}\`. Revísalo en el dashboard (Settings → Git) antes de seguir.`);
+    }
+    return { status: 'relinked', from, to };
+}
+/**
+ * The project and team to relink: flags first, then `.vercel/project.json`, then the provision
+ * state (`.timekast/provision.json`). Never guessed from a project listing.
+ */
+export function resolveVercelProject(rootDir, flags) {
+    let projectId = flags.project;
+    let teamId = flags.team;
+    const linkFile = path.join(rootDir, '.vercel', 'project.json');
+    if ((!projectId || !teamId) && existsSync(linkFile)) {
+        try {
+            const link = JSON.parse(readFileSync(linkFile, 'utf8'));
+            projectId ??= link.projectId;
+            teamId ??= link.teamId ?? link.orgId;
+        }
+        catch {
+            // unreadable → fall through to the provision state
+        }
+    }
+    if (!projectId || !teamId) {
+        const target = readDestroyTarget(rootDir);
+        projectId ??= target?.vercelProjectId ?? undefined;
+        teamId ??= target?.scope ?? undefined;
+    }
+    if (!projectId || !teamId) {
+        throw new CLIError('No encontré el proyecto de Vercel de este repo (ni en `.vercel/project.json` ni en ' +
+            '`.timekast/provision.json`). Pásalo: `factory prune vercel --project=prj_… --team=team_…`.');
+    }
+    return { projectId, teamId };
+}
+/**
+ * Which branches deploy on push in a pruned repo: only `main` and `develop`. Vercel deploys
+ * when ANY matching rule is `true`, so `**: false` turns off every other branch — a
+ * collaborator's branch (an author without a Vercel seat) never starts a deployment Vercel
+ * would block. `**`, not `*`: minimatch's `*` does not cross a `/` (`feat/login`).
+ */
+export const BRANCH_DEPLOY_RULE = {
+    '**': false,
+    main: true,
+    develop: true,
+};
+export const VERCEL_JSON = 'vercel.json';
+/** Whether `vercel.json` already carries {@link BRANCH_DEPLOY_RULE}. `null` without the file. */
+export function hasBranchDeployRule(rootDir) {
+    const file = path.join(rootDir, VERCEL_JSON);
+    if (!existsSync(file))
+        return null;
+    const config = JSON.parse(readFileSync(file, 'utf8'));
+    const rules = config.git?.deploymentEnabled;
+    if (!rules || typeof rules !== 'object')
+        return false;
+    return Object.entries(BRANCH_DEPLOY_RULE).every(([branch, on]) => rules[branch] === on);
+}
+/**
+ * Write {@link BRANCH_DEPLOY_RULE} into `vercel.json`, keeping every other key and any other
+ * branch rule. A repo without `vercel.json` (not on Vercel) is left alone.
+ *
+ * @throws {CLIError} when `vercel.json` is not valid JSON.
+ */
+export function ensureBranchDeployRule(rootDir) {
+    const file = path.join(rootDir, VERCEL_JSON);
+    if (!existsSync(file))
+        return 'no-vercel-json';
+    let config;
+    try {
+        config = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        throw new CLIError(`\`${VERCEL_JSON}\` no es JSON válido; corrígelo y vuelve a correr.`);
+    }
+    if (hasBranchDeployRule(rootDir))
+        return 'present';
+    const git = (config.git && typeof config.git === 'object' ? config.git : {});
+    const prior = git.deploymentEnabled && typeof git.deploymentEnabled === 'object'
+        ? git.deploymentEnabled
+        : {};
+    config.git = { ...git, deploymentEnabled: { ...prior, ...BRANCH_DEPLOY_RULE } };
+    writeFileSync(file, `${JSON.stringify(config, null, 2)}\n`);
+    return 'added';
+}

package/dist/lib/rail.js

@@ -53,8 +53,10 @@ import { VAULT_CONFIG } from './vault-config.js';
 export const RAIL_ENV = 'main';
 /** Name of the vault CLI binary on PATH. */
 export const INFISICAL_BIN = 'infisical';
-/** How to install the vault CLI (`fx-secrets-vault §3`). */
-export const INFISICAL_INSTALL_HINT = 'brew install infisical';
+/** How to install the vault CLI, per platform, already code-quoted (`sk-vault §2`). */
+export const INFISICAL_INSTALL_HINT = '`brew install infisical` (Windows: `winget install --id infisical.infisical` y abre una terminal nueva)';
+/** How to upgrade the vault CLI, per platform, already code-quoted. */
+export const INFISICAL_UPGRADE_HINT = '`brew upgrade infisical` o `winget upgrade --id infisical.infisical`';
 /** Default time budget (ms) for one rail read — a dead network or a stuck prompt must not hang. */
 export const RAIL_READ_TIMEOUT_MS = 30_000;
 /** Grace (ms) between SIGTERM and SIGKILL once the timeout fires. */
@@ -135,7 +137,7 @@ export class RailUnrecognizedError extends RailError {
 export class RailNotInstalledError extends RailError {
     constructor(config = VAULT_CONFIG) {
         super('not-installed', 'El CLI de la bóveda (`infisical`) no está instalado o no está en el PATH.\n' +
-            `Instálalo con \`${INFISICAL_INSTALL_HINT}\` y entra con \`${loginCommand(config)}\`.`);
+            `Instálalo con ${INFISICAL_INSTALL_HINT} y entra con \`${loginCommand(config)}\`.`);
         this.name = 'RailNotInstalledError';
         Object.setPrototypeOf(this, new.target.prototype);
     }

package/dist/lib/railway-api.js

@@ -744,6 +744,9 @@ export function createRailwayClient(deps = {}) {
                 if (typeof settings[key] === 'string')
                     input[key] = settings[key];
             }
+            if (typeof settings.drainingSeconds === 'number') {
+                input.drainingSeconds = settings.drainingSeconds;
+            }
             if (Object.keys(input).length === 0)
                 return false;
             await call('serviceInstanceUpdate', { serviceId, environmentId, input }, `ajustar el servicio \`${serviceId}\` en su entorno`);