@timekast/factory 2.4.0 → 2.6.0

package/dist/lib/lockfile.js

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { CLIError } from './cli-error.js';
-import { CLAUDE_MD_FILE, LOCKFILE_FILE, MANIFEST_FILE, TIMEKAST_DIR, } from './constants.js';
+import { CLAUDE_MD_FILE, KIT_DEPS_FILE, LOCKFILE_FILE, MANIFEST_FILE, TIMEKAST_DIR, } from './constants.js';
 /**
  * Write the initial lockfile in `destDir/.timekast/lockfile.json` (used by
  * `new` / `add`). On the initial install the lockfile carries the tarball's
@@ -54,9 +54,11 @@ export function writeInitialLockfile(destDir, manifestRaw) {
     const stamped = { ...manifest, factoryVersion: manifest.version };
     // If the tarball already unpacked manifest.json into .timekast/, drop it: the
     // stamped lockfile is the SSOT and we do not keep a duplicate manifest around.
-    const unpackedManifest = path.join(timekastDir, MANIFEST_FILE);
-    if (existsSync(unpackedManifest)) {
-        rmSync(unpackedManifest, { force: true });
+    // Same for the dependency list (Factory#78): it is read from the staged tarball, never kept.
+    for (const unpacked of [MANIFEST_FILE, KIT_DEPS_FILE]) {
+        const abs = path.join(timekastDir, unpacked);
+        if (existsSync(abs))
+            rmSync(abs, { force: true });
     }
     writeLockfile(destDir, stamped);
 }
@@ -124,7 +126,10 @@ export function parseLockfile(raw, source = 'lockfile') {
         if (typeof e.path !== 'string' || typeof e.hash !== 'string') {
             throw new CLIError(`El ${source} tiene una entrada sin \`path\`/\`hash\` en files[${i}].`);
         }
-        return { path: e.path, hash: e.hash };
+        const keys = Array.isArray(e.keys) && e.keys.every((k) => typeof k === 'string')
+            ? { keys: e.keys }
+            : {};
+        return { path: e.path, hash: e.hash, ...keys };
     });
     return {
         version: obj.version,

package/dist/lib/prune-remote.js

@@ -391,11 +391,13 @@ async function listNotMigrated(legacy, deps) {
     }
     return out;
 }
-// ---------------------------------------------------------------------------
-// Invite
-// ---------------------------------------------------------------------------
-/** Invite an outside collaborator with read access, after checking they are not a member. */
-export async function pruneInvite(repo, user, deps) {
+/**
+ * Invite an outside collaborator, after checking they are not a member. Write (`push`) by
+ * default: collaborators work on branches of this repo and open PRs that `/integrate` checks.
+ * On GitHub Free a private repo cannot protect `main`, so write also reaches it directly —
+ * the owner's call, accepted for in-house devs; `--read` grants read only.
+ */
+export async function pruneInvite(repo, user, deps, permission = 'push') {
     const { owner } = splitRepo(repo);
     if (!/^[A-Za-z0-9-]+$/.test(user))
         throw new CLIError(`\`${user}\` no es un usuario de GitHub válido.`);
@@ -412,7 +414,7 @@ export async function pruneInvite(repo, user, deps) {
         'PUT',
         `repos/${repo}/collaborators/${user}`,
         '-f',
-        'permission=pull',
+        `permission=${permission}`,
     ]);
     if (r.exitCode !== 0) {
         if (/403|Forbidden|must have admin/i.test(r.stderr)) {

package/dist/lib/prune-vercel.js

@@ -0,0 +1,137 @@
+/**
+ * `factory prune vercel` — reconnect the Vercel project to the repo the cut created.
+ *
+ * Vercel binds a project to GitHub's NUMERIC repo id, and a rename keeps the id: after
+ * `prune cutover` the project still deploys from `<repo>-legacy`. Re-linking to the new
+ * repo takes an unlink + link (`DELETE` then `POST /v9/projects/{id}/link`); the project,
+ * its env vars, domains and deployments stay.
+ *
+ * Order is the safety argument:
+ *   1. read the current link and the new repo's id — already linked → nothing to do;
+ *   2. without `--confirm`, print the plan and stop;
+ *   3. unlink → link → READ the link back and require the new repo's id.
+ * A failure between 1 and 3 leaves the project unlinked (it serves its last deployment, it
+ * just stops deploying on push); a re-run with `--confirm` links it, since step 1 sees no link.
+ * Never triggers a deployment.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { CLIError } from './cli-error.js';
+import { readDestroyTarget } from './provision-state.js';
+import { getGitLink, linkGitRepo, unlinkGitRepo, } from './vercel-env.js';
+/** GitHub's numeric id of `repo`, read with the member's `gh` session. */
+async function githubRepoId(repo, deps) {
+    const r = await deps.gh(['api', `repos/${repo}`, '--jq', '.id']);
+    const id = Number(r.stdout.trim());
+    if (r.exitCode !== 0 || !Number.isInteger(id)) {
+        throw new CLIError(`No pude leer \`${repo}\` en GitHub: ${r.stderr || 'respuesta sin id'}`);
+    }
+    return id;
+}
+export async function pruneVercelRelink(input, deps) {
+    const { projectId, teamId, token } = input;
+    const api = deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {};
+    const targetId = await githubRepoId(input.repo, deps);
+    const from = await getGitLink(projectId, token, teamId, api);
+    if (from?.repoId === targetId)
+        return { status: 'already-linked', link: from };
+    if (!input.confirm)
+        return { status: 'plan', from, to: input.repo };
+    if (from)
+        await unlinkGitRepo(projectId, token, teamId, api);
+    try {
+        await linkGitRepo(projectId, token, teamId, input.repo, api);
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        throw new CLIError(`Desconecté el proyecto de Vercel${from ? ` de \`${from.repo}\`` : ''} pero no pude conectarlo a ` +
+            `\`${input.repo}\`: ${why}\nEl proyecto sigue sirviendo su último deploy; sólo dejó de desplegar ` +
+            'con cada push. Corrige la causa (p. ej. la GitHub App de Vercel sin acceso al repo nuevo) y ' +
+            'vuelve a correr `factory prune vercel --confirm`: ve que no hay vínculo y sólo conecta.');
+    }
+    const to = await getGitLink(projectId, token, teamId, api);
+    if (to?.repoId !== targetId) {
+        throw new CLIError(`Vercel aceptó el vínculo pero al releerlo apunta a ${to ? `\`${to.repo}\`` : 'ningún repo'}, no a ` +
+            `\`${input.repo}\`. Revísalo en el dashboard (Settings → Git) antes de seguir.`);
+    }
+    return { status: 'relinked', from, to };
+}
+/**
+ * The project and team to relink: flags first, then `.vercel/project.json`, then the provision
+ * state (`.timekast/provision.json`). Never guessed from a project listing.
+ */
+export function resolveVercelProject(rootDir, flags) {
+    let projectId = flags.project;
+    let teamId = flags.team;
+    const linkFile = path.join(rootDir, '.vercel', 'project.json');
+    if ((!projectId || !teamId) && existsSync(linkFile)) {
+        try {
+            const link = JSON.parse(readFileSync(linkFile, 'utf8'));
+            projectId ??= link.projectId;
+            teamId ??= link.teamId ?? link.orgId;
+        }
+        catch {
+            // unreadable → fall through to the provision state
+        }
+    }
+    if (!projectId || !teamId) {
+        const target = readDestroyTarget(rootDir);
+        projectId ??= target?.vercelProjectId ?? undefined;
+        teamId ??= target?.scope ?? undefined;
+    }
+    if (!projectId || !teamId) {
+        throw new CLIError('No encontré el proyecto de Vercel de este repo (ni en `.vercel/project.json` ni en ' +
+            '`.timekast/provision.json`). Pásalo: `factory prune vercel --project=prj_… --team=team_…`.');
+    }
+    return { projectId, teamId };
+}
+/**
+ * Which branches deploy on push in a pruned repo: only `main` and `develop`. Vercel deploys
+ * when ANY matching rule is `true`, so `**: false` turns off every other branch — a
+ * collaborator's branch (an author without a Vercel seat) never starts a deployment Vercel
+ * would block. `**`, not `*`: minimatch's `*` does not cross a `/` (`feat/login`).
+ */
+export const BRANCH_DEPLOY_RULE = {
+    '**': false,
+    main: true,
+    develop: true,
+};
+export const VERCEL_JSON = 'vercel.json';
+/** Whether `vercel.json` already carries {@link BRANCH_DEPLOY_RULE}. `null` without the file. */
+export function hasBranchDeployRule(rootDir) {
+    const file = path.join(rootDir, VERCEL_JSON);
+    if (!existsSync(file))
+        return null;
+    const config = JSON.parse(readFileSync(file, 'utf8'));
+    const rules = config.git?.deploymentEnabled;
+    if (!rules || typeof rules !== 'object')
+        return false;
+    return Object.entries(BRANCH_DEPLOY_RULE).every(([branch, on]) => rules[branch] === on);
+}
+/**
+ * Write {@link BRANCH_DEPLOY_RULE} into `vercel.json`, keeping every other key and any other
+ * branch rule. A repo without `vercel.json` (not on Vercel) is left alone.
+ *
+ * @throws {CLIError} when `vercel.json` is not valid JSON.
+ */
+export function ensureBranchDeployRule(rootDir) {
+    const file = path.join(rootDir, VERCEL_JSON);
+    if (!existsSync(file))
+        return 'no-vercel-json';
+    let config;
+    try {
+        config = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        throw new CLIError(`\`${VERCEL_JSON}\` no es JSON válido; corrígelo y vuelve a correr.`);
+    }
+    if (hasBranchDeployRule(rootDir))
+        return 'present';
+    const git = (config.git && typeof config.git === 'object' ? config.git : {});
+    const prior = git.deploymentEnabled && typeof git.deploymentEnabled === 'object'
+        ? git.deploymentEnabled
+        : {};
+    config.git = { ...git, deploymentEnabled: { ...prior, ...BRANCH_DEPLOY_RULE } };
+    writeFileSync(file, `${JSON.stringify(config, null, 2)}\n`);
+    return 'added';
+}

package/dist/lib/public-env-keys.json

@@ -13,10 +13,12 @@
         "EMAIL_SERVER_PORT",
         "EMAIL_SERVER_SECURE",
         "EMAIL_SERVER_USER",
+        "MCP_ENABLED",
         "MFA_ENABLED",
         "MFA_REQUIRED_ALL",
         "NEXTAUTH_URL",
         "NODE_ENV",
+        "QUESTIONS_ENABLED",
         "SENTRY_ORG",
         "SENTRY_PROJECT",
         "SUPPORT_EMAIL",

package/dist/lib/rail.js

@@ -53,8 +53,10 @@ import { VAULT_CONFIG } from './vault-config.js';
 export const RAIL_ENV = 'main';
 /** Name of the vault CLI binary on PATH. */
 export const INFISICAL_BIN = 'infisical';
-/** How to install the vault CLI (`fx-secrets-vault §3`). */
-export const INFISICAL_INSTALL_HINT = 'brew install infisical';
+/** How to install the vault CLI, per platform, already code-quoted (`sk-vault §2`). */
+export const INFISICAL_INSTALL_HINT = '`brew install infisical` (Windows: `winget install --id infisical.infisical` y abre una terminal nueva)';
+/** How to upgrade the vault CLI, per platform, already code-quoted. */
+export const INFISICAL_UPGRADE_HINT = '`brew upgrade infisical` o `winget upgrade --id infisical.infisical`';
 /** Default time budget (ms) for one rail read — a dead network or a stuck prompt must not hang. */
 export const RAIL_READ_TIMEOUT_MS = 30_000;
 /** Grace (ms) between SIGTERM and SIGKILL once the timeout fires. */
@@ -135,7 +137,7 @@ export class RailUnrecognizedError extends RailError {
 export class RailNotInstalledError extends RailError {
     constructor(config = VAULT_CONFIG) {
         super('not-installed', 'El CLI de la bóveda (`infisical`) no está instalado o no está en el PATH.\n' +
-            `Instálalo con \`${INFISICAL_INSTALL_HINT}\` y entra con \`${loginCommand(config)}\`.`);
+            `Instálalo con ${INFISICAL_INSTALL_HINT} y entra con \`${loginCommand(config)}\`.`);
         this.name = 'RailNotInstalledError';
         Object.setPrototypeOf(this, new.target.prototype);
     }

package/dist/lib/railway-api.js

@@ -744,6 +744,9 @@ export function createRailwayClient(deps = {}) {
                 if (typeof settings[key] === 'string')
                     input[key] = settings[key];
             }
+            if (typeof settings.drainingSeconds === 'number') {
+                input.drainingSeconds = settings.drainingSeconds;
+            }
             if (Object.keys(input).length === 0)
                 return false;
             await call('serviceInstanceUpdate', { serviceId, environmentId, input }, `ajustar el servicio \`${serviceId}\` en su entorno`);