create-factory 0.0.3-alpha.0 → 0.0.3-alpha.3

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # create-factory
 
+## 0.0.3-alpha.3
+
+### Patch Changes
+
+- The Software Factory template now pins every Mastra dep to `"latest"` instead of a caret range anchored on the current monorepo version, matching how every other create-mastra template ships. `sync-template.mjs` no longer shells out to `npm view` and no longer needs the `--tag` flag or the `legacy-peer-deps=true` `.npmrc` (which only existed to work around prerelease pins). The sync workflow no longer breaks whenever a linked package sits mid-alpha between publishes. ([#19989](https://github.com/mastra-ai/mastra/pull/19989))
+
+## 0.0.3-alpha.2
+
+### Patch Changes
+
+- Marked projects created by create-factory as factory-enabled on the Mastra platform. ([#19973](https://github.com/mastra-ai/mastra/pull/19973))
+
+- Updated dependencies:
+  - mastra@1.20.0-alpha.13
+
+## 0.0.3-alpha.1
+
+### Patch Changes
+
+- Apply prettier formatting to env.test.ts (post-merge follow-up) ([#19965](https://github.com/mastra-ai/mastra/pull/19965))
+
+- Harden .env handling in create-factory: tighten file permissions and skip git init when .env cannot be gitignored ([#19945](https://github.com/mastra-ai/mastra/pull/19945))
+
+  `.env` files created during scaffolding are now written with `0600` permissions so platform secrets (`MASTRA_PLATFORM_SECRET_KEY`, `DATABASE_URL`) are only readable by the owner. If the scaffolder can't add `.env` to `.gitignore` (e.g. permission denied on `.gitignore`), it now skips `git init` entirely and warns the user, so freshly-minted secrets can't accidentally be committed to the initial commit.
+
+- Fixed generated Software Factory projects missing their required `@mastra/memory` dependency. ([#19878](https://github.com/mastra-ai/mastra/pull/19878))
+
+- Added platform sign-in, project creation, and Neon Postgres provisioning to the `create factory` CLI. After scaffolding, the CLI: ([#19945](https://github.com/mastra-ai/mastra/pull/19945))
+
+  - Signs the user in via the existing Mastra browser-auth flow.
+  - Creates a Mastra platform server project in the chosen organization.
+  - Mints an `sk_` organization API key scoped to the new factory.
+  - Attaches and provisions a Neon Postgres database.
+  - Writes `MASTRA_SHARED_API_URL`, `MASTRA_ORGANIZATION_ID`, `MASTRA_PROJECT_ID`, `MASTRA_PLATFORM_SECRET_KEY`, and `DATABASE_URL` to the project's `.env`.
+
+  The result is a locally-runnable factory that can talk to the Mastra platform on first `npm run dev` without any manual configuration.
+
+  **New flags:**
+
+  - `--no-platform` — skip the platform round-trip; useful when iterating on the template offline.
+  - `--region <region>` — pass a specific Neon region id through to the platform.
+
+- Updated dependencies [[`8c88764`](https://github.com/mastra-ai/mastra/commit/8c88764162b32c8a24b3bf9d1ad2ec535aba5c9a), [`40ae860`](https://github.com/mastra-ai/mastra/commit/40ae860a674e7ee383a02c1f990d1e050619d5e4)]:
+  - mastra@1.20.0-alpha.12
+
 ## 0.0.3-alpha.0
 
 ### Patch Changes

package/README.md

@@ -1,47 +1,30 @@
 # create-factory
 
-Scaffolding CLI for the **Mastra Software Factory** — an open-source, agent-powered software delivery environment built on [Mastra](https://mastra.ai).
+Scaffolding CLI for the **Mastra Factory** — an open-source, agent-powered software delivery environment built on [Mastra](https://mastra.ai).
 
 ```bash
 npm create factory
 ```
 
-The CLI is intentionally minimal: it asks for a project name, clones the [softwarefactory-template](https://github.com/mastra-ai/softwarefactory-template), installs dependencies, and initializes git. That's it — run `npm run dev` and finish setup (model providers, integrations, database) from the web UI on first load. An "auth with the Mastra platform" step is planned as a follow-up.
+The CLI is intentionally minimal: it asks for a project name, clones the [softwarefactory-template](https://github.com/mastra-ai/softwarefactory-template), installs dependencies, and initializes git. That's it — run `npm run dev` and finish setup (model providers, integrations, database) from the web UI on first load.
 
 ## Flags
 
 ```text
-npm create factory [project-name] -- [options]
+Usage: create-factory [options] [project-name]
 
-    --default              Non-interactive: default name
-    --template-ref <ref>   Pin a template repo tag/branch
-    --template-dir <dir>   Use a local template directory (development)
--t, --timeout [ms]         Timeout for dependency installation
-```
-
-## Development (monorepo)
-
-This package lives in the `mastra-ai/mastra` monorepo at `mastracode/mastra-factory`. Releases go through the monorepo's changesets release train (it is un-ignored in `.changeset/config.json`) — add a changeset with your change and the train versions and publishes it.
-
-```bash
-pnpm --filter ./mastracode/mastra-factory build   # bundle src -> dist
-pnpm --filter ./mastracode/mastra-factory test    # vitest
-node bin/cli.mjs my-app --default --template-dir ./template-out
-```
-
-### Template sync
-
-`scripts/sync-template.mjs` generates the template tree from `mastracode/web`:
+Create a new Mastra Factory project
 
-- `link:` deps → caret ranges on published versions (anchored on local monorepo versions by default, verified on npm; `--tag latest` for stable dist-tags)
-- monorepo tsconfig → standalone, test files/deps stripped, user-facing scripts
-- checked-in `template/README.md` → user-facing README (version tokens filled at sync)
-- `.env.schema` → `.env.example` (varlock decorators removed)
+Arguments:
+  project-name                Directory name of the project
 
-Syncing to [softwarefactory-template](https://github.com/mastra-ai/softwarefactory-template) is automated, mirroring the `templates/*` process: the `sync-softwarefactory-template` workflow regenerates the template using published local monorepo versions and force-pushes it on every push to `main` that touches `mastracode/web`, the sync script, or `template/README.md`. The monorepo is the source of truth — direct commits to the template repo get overwritten.
-
-```bash
-node scripts/sync-template.mjs            # writes ./template-out (local development)
+Options:
+  --template <template-name>  Create a project from a template (public GitHub URL) (default: "https://github.com/mastra-ai/softwarefactory-template")
+  --no-platform               Skip Mastra platform sign-in, project, and Neon provisioning
+  --org <org>                 Mastra organization id or name — skips the interactive org picker
+  --region <region>           Neon region id (passed to the platform verbatim)
+  -v, --version               output the version number
+  -h, --help                  display help for command
 ```
 
 ## License

package/dist/index.js

@@ -1,3 +1,5 @@
+#! /usr/bin/env node
+
 // src/index.ts
 import { readFileSync as readFileSync2 } from "fs";
 import path4 from "path";
@@ -67,156 +69,364 @@ var Analytics = class {
 };
 
 // src/create.ts
-import fs2 from "fs";
+import fs3 from "fs";
 import path3 from "path";
 import * as p from "@clack/prompts";
+import { fetchOrgs, getToken, MASTRA_PLATFORM_API_URL as MASTRA_PLATFORM_API_URL2, resolveCurrentOrg } from "mastra/internal/auth";
 import color from "picocolors";
+import { x as x2 } from "tinyexec";
 
-// src/utils/clone.ts
+// src/env.ts
 import fs from "fs";
-import path2 from "path";
-
-// src/utils/exec.ts
-import { execFile, spawn } from "child_process";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-function runInherit(command, args, options) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
-      cwd: options.cwd,
-      stdio: "inherit",
-      shell: process.platform === "win32"
-    });
-    let timeout;
-    let killTimer;
-    let timedOut = false;
-    if (options.timeoutMs) {
-      timeout = setTimeout(() => {
-        timedOut = true;
-        if (process.platform === "win32" && child.pid) {
-          const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
-          killer.on("error", () => child.kill());
-          killer.on("exit", (code) => {
-            if (code !== 0) child.kill();
-          });
-        } else {
-          child.kill("SIGTERM");
-          killTimer = setTimeout(() => child.kill("SIGKILL"), 5e3);
-        }
-      }, options.timeoutMs);
-    }
-    const clearTimers = () => {
-      if (timeout) clearTimeout(timeout);
-      if (killTimer) clearTimeout(killTimer);
-    };
-    child.on("error", (err) => {
-      clearTimers();
-      reject(err);
-    });
-    child.on("close", (code) => {
-      clearTimers();
-      if (timedOut) reject(new Error(`${command} ${args.join(" ")} timed out after ${options.timeoutMs}ms`));
-      else if (code === 0) resolve();
-      else reject(new Error(`${command} ${args.join(" ")} exited with code ${code}`));
-    });
+function upsertEnvFile(envPath, updates) {
+  const existing = fs.existsSync(envPath) ? fs.readFileSync(envPath, "utf8") : "";
+  const lines = existing === "" ? [] : existing.split("\n");
+  const remaining = new Map(Object.entries(updates));
+  const patched = lines.map((line) => {
+    const match = /^(\s*#\s*)?([A-Z][A-Z0-9_]*)\s*=/.exec(line);
+    if (!match) return line;
+    const key = match[2];
+    if (!remaining.has(key)) return line;
+    const value = remaining.get(key);
+    remaining.delete(key);
+    return `${key}=${value}`;
   });
+  if (remaining.size > 0) {
+    if (patched.length > 0 && patched[patched.length - 1] !== "") {
+      patched.push("");
+    }
+    for (const [key, value] of remaining) {
+      patched.push(`${key}=${value}`);
+    }
+  }
+  const output = patched.join("\n");
+  fs.writeFileSync(envPath, output, { mode: 384 });
+  try {
+    fs.chmodSync(envPath, 384);
+  } catch {
+  }
 }
 
-// src/utils/clone.ts
-var DEFAULT_TEMPLATE_REPO = "https://github.com/mastra-ai/softwarefactory-template";
-async function cloneTemplate(options) {
-  const { repoUrl, projectPath, ref, localDir } = options;
-  if (fs.existsSync(projectPath)) {
-    throw new Error(`Directory ${path2.basename(projectPath)} already exists`);
-  }
-  if (localDir) {
-    fs.cpSync(localDir, projectPath, {
-      recursive: true,
-      filter: (src) => !src.split(path2.sep).includes("node_modules") && !src.split(path2.sep).includes(".git")
-    });
-    return;
-  }
-  const args = ["clone", "--depth", "1"];
-  if (ref) args.push("--branch", ref);
-  args.push(repoUrl, projectPath);
+// src/platform.ts
+import { MASTRA_PLATFORM_API_URL, authHeaders, extractApiErrorDetail, platformFetch } from "mastra/internal/auth";
+async function extractError(res) {
+  const text2 = await res.text().catch(() => "");
+  if (!text2) return `${res.status} ${res.statusText}`;
   try {
-    await execFileAsync("git", args);
-  } catch (err) {
-    throw new Error(
-      `Failed to clone template from ${repoUrl}${ref ? `@${ref}` : ""}: ${err instanceof Error ? err.message : String(err)}`
-    );
+    const parsed = JSON.parse(text2);
+    const detail = extractApiErrorDetail(parsed);
+    if (detail) return detail;
+  } catch {
+  }
+  return text2.slice(0, 500);
+}
+var PlatformApiError = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.name = "PlatformApiError";
+    this.status = status;
+  }
+};
+async function createServerProject({
+  token,
+  orgId,
+  name
+}) {
+  const res = await platformFetch(`${MASTRA_PLATFORM_API_URL}/v1/server/projects`, {
+    method: "POST",
+    headers: { ...authHeaders(token, orgId), "Content-Type": "application/json" },
+    body: JSON.stringify({ name, factoryEnabled: true })
+  });
+  if (!res.ok) {
+    throw new PlatformApiError(res.status, `Failed to create project \u2014 ${await extractError(res)}`);
   }
-  fs.rmSync(path2.join(projectPath, ".git"), { recursive: true, force: true });
+  const body = await res.json();
+  return body.project;
 }
-function renameProject(projectPath, projectName) {
+async function mintOrgApiKey({
+  token,
+  orgId,
+  keyName
+}) {
+  const res = await platformFetch(`${MASTRA_PLATFORM_API_URL}/v1/auth/tokens`, {
+    method: "POST",
+    headers: { ...authHeaders(token, orgId), "Content-Type": "application/json" },
+    body: JSON.stringify({ name: keyName })
+  });
+  if (!res.ok) {
+    throw new PlatformApiError(res.status, `Failed to create API key \u2014 ${await extractError(res)}`);
+  }
+  const body = await res.json();
+  return body.secret;
+}
+async function attachNeonDatabase({
+  token,
+  orgId,
+  projectId,
+  name,
+  regionId
+}) {
+  const res = await platformFetch(
+    `${MASTRA_PLATFORM_API_URL}/v1/server/projects/${encodeURIComponent(projectId)}/databases`,
+    {
+      method: "POST",
+      headers: { ...authHeaders(token, orgId), "Content-Type": "application/json" },
+      body: JSON.stringify({ kind: "neon", name, ...regionId ? { regionId } : {} })
+    }
+  );
+  if (!res.ok) {
+    if (res.status === 403) {
+      throw new PlatformApiError(
+        403,
+        `Attaching a database requires the admin role in your organization. Ask an org admin to run \`create-factory\`, or attach a database from the dashboard.`
+      );
+    }
+    throw new PlatformApiError(res.status, `Failed to attach Neon database \u2014 ${await extractError(res)}`);
+  }
+  const body = await res.json();
+  return body.database;
+}
+async function getDatabaseStatus({
+  token,
+  orgId,
+  projectId,
+  databaseId,
+  signal
+}) {
+  const res = await platformFetch(
+    `${MASTRA_PLATFORM_API_URL}/v1/server/projects/${encodeURIComponent(projectId)}/databases/${encodeURIComponent(databaseId)}`,
+    { headers: authHeaders(token, orgId), signal }
+  );
+  if (!res.ok) {
+    throw new PlatformApiError(res.status, `Failed to read database status \u2014 ${await extractError(res)}`);
+  }
+  const body = await res.json();
+  return body.database;
+}
+async function getDatabaseConnection({
+  token,
+  orgId,
+  projectId,
+  databaseId
+}) {
+  const res = await platformFetch(
+    `${MASTRA_PLATFORM_API_URL}/v1/server/projects/${encodeURIComponent(projectId)}/databases/${encodeURIComponent(databaseId)}/connection`,
+    { headers: authHeaders(token, orgId) }
+  );
+  if (!res.ok) {
+    throw new PlatformApiError(res.status, `Failed to fetch connection string \u2014 ${await extractError(res)}`);
+  }
+  return await res.json();
+}
+async function waitForDatabaseReady({
+  token,
+  orgId,
+  projectId,
+  databaseId,
+  intervalMs = 2e3,
+  timeoutMs = 6e4,
+  signal
+}) {
+  const deadline = Date.now() + timeoutMs;
+  let lastStatus = "provisioning";
+  const timeoutError = () => new PlatformApiError(
+    504,
+    `Neon database is still ${lastStatus} after ${Math.round(timeoutMs / 1e3)}s. Check the dashboard or retry \`mastra login\` + re-run.`
+  );
+  while (true) {
+    signal?.throwIfAborted();
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw timeoutError();
+    const perRequestSignal = composeSignals(signal, AbortSignal.timeout(remaining));
+    let row;
+    try {
+      row = await getDatabaseStatus({ token, orgId, projectId, databaseId, signal: perRequestSignal });
+    } catch (err) {
+      if (err instanceof DOMException && err.name === "TimeoutError") throw timeoutError();
+      throw err;
+    }
+    lastStatus = row.status;
+    if (row.status === "ready") return row;
+    if (row.status === "failed") {
+      throw new PlatformApiError(500, `Neon provisioning failed${row.error ? ` \u2014 ${row.error}` : ""}`);
+    }
+    if (Date.now() >= deadline) throw timeoutError();
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+}
+function composeSignals(outer, inner) {
+  if (!outer) return inner;
+  if (typeof AbortSignal.any === "function") {
+    return AbortSignal.any([outer, inner]);
+  }
+  const controller = new AbortController();
+  const abort = (reason) => controller.abort(reason);
+  if (outer.aborted) abort(outer.reason);
+  else outer.addEventListener("abort", () => abort(outer.reason), { once: true });
+  if (inner.aborted) abort(inner.reason);
+  else inner.addEventListener("abort", () => abort(inner.reason), { once: true });
+  return controller.signal;
+}
+
+// src/utils/clone.ts
+import fs2 from "fs/promises";
+import path2 from "path";
+import { x } from "tinyexec";
+async function renameProject(projectPath, projectName) {
   const pkgPath = path2.join(projectPath, "package.json");
-  const pkg2 = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+  const pkg2 = JSON.parse(await fs2.readFile(pkgPath, "utf8"));
   pkg2.name = toPackageName(projectName);
-  fs.writeFileSync(pkgPath, `${JSON.stringify(pkg2, null, 2)}
+  await fs2.writeFile(pkgPath, `${JSON.stringify(pkg2, null, 2)}
 `);
 }
 function toPackageName(name) {
   const cleaned = name.toLowerCase().replace(/[^a-z0-9-_.~]+/g, "-").replace(/^[-_.]+|[-_.]+$/g, "");
-  return cleaned || "softwarefactory";
+  return cleaned || "mastra-factory";
+}
+async function pathExists(filePath) {
+  try {
+    await fs2.access(filePath);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+async function directoryExists(dirPath) {
+  try {
+    return (await fs2.stat(dirPath)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function cloneTemplate(repoUrl, targetPath) {
+  if (await pathExists(targetPath)) {
+    throw new Error(`Directory ${path2.basename(targetPath)} already exists`);
+  }
+  const tempRoot = await fs2.mkdtemp(path2.join(path2.dirname(targetPath), `.${path2.basename(targetPath)}-`));
+  const tempTarget = path2.join(tempRoot, "template");
+  try {
+    try {
+      const degitRepo = repoUrl.replace("https://github.com/", "");
+      await x("npx", ["degit", degitRepo, tempTarget], {
+        throwOnError: true,
+        nodeOptions: { cwd: process.cwd() }
+      });
+      if ((await fs2.readdir(tempTarget)).length === 0) {
+        throw new Error("degit completed without cloning template files");
+      }
+    } catch {
+      await fs2.rm(tempTarget, { recursive: true, force: true });
+      try {
+        await x("git", ["clone", repoUrl, tempTarget], {
+          throwOnError: true,
+          nodeOptions: { cwd: process.cwd() }
+        });
+        const gitDir = path2.join(tempTarget, ".git");
+        if (await directoryExists(gitDir)) {
+          await fs2.rm(gitDir, { recursive: true, force: true });
+        }
+      } catch (gitError) {
+        throw new Error(
+          `Failed to clone repository: ${gitError instanceof Error ? gitError.message : "Unknown error"}`
+        );
+      }
+    }
+    if (await pathExists(targetPath)) {
+      throw new Error(`Directory ${path2.basename(targetPath)} already exists`);
+    }
+    await fs2.rename(tempTarget, targetPath);
+  } finally {
+    await fs2.rm(tempRoot, { recursive: true, force: true });
+  }
 }
 
 // src/utils/pm.ts
 function detectPackageManager() {
-  const agent = process.env.npm_config_user_agent ?? "";
-  if (agent.startsWith("pnpm")) return "pnpm";
-  if (agent.startsWith("yarn")) return "yarn";
-  if (agent.startsWith("bun")) return "bun";
+  const userAgent = process.env.npm_config_user_agent || "";
+  const execPath = process.env.npm_execpath || "";
+  if (userAgent.includes("bun")) {
+    return "bun";
+  }
+  if (userAgent.includes("yarn")) {
+    return "yarn";
+  }
+  if (userAgent.includes("pnpm")) {
+    return "pnpm";
+  }
+  if (userAgent.includes("npm")) {
+    return "npm";
+  }
+  if (execPath.includes("bun")) {
+    return "bun";
+  }
+  if (execPath.includes("yarn")) {
+    return "yarn";
+  }
+  if (execPath.includes("pnpm")) {
+    return "pnpm";
+  }
+  if (execPath.includes("npm")) {
+    return "npm";
+  }
   return "npm";
 }
+function getInstallArgs(packageManager) {
+  switch (packageManager) {
+    case "npm":
+      return ["install", "--prefer-offline", "--no-audit", "--no-fund"];
+    case "pnpm":
+      return ["install", "--prefer-offline"];
+    default:
+      return ["install"];
+  }
+}
 
 // src/create.ts
 async function create(args) {
-  p.intro(color.inverse(" Mastra Software Factory "));
-  let projectName = args.projectName;
-  if (!projectName && args.useDefaults) {
-    projectName = "my-software-factory";
-  }
-  if (!projectName) {
-    const entered = await p.text({
-      message: "What is your project named?",
-      initialValue: "my-software-factory",
-      validate: (value) => {
-        if (!value?.trim()) return "Required";
-        if (fs2.existsSync(path3.resolve(value.trim()))) return `Directory ${value.trim()} already exists`;
-        return void 0;
-      }
-    });
-    if (p.isCancel(entered)) return cancel2();
-    projectName = entered.trim();
+  p.intro(color.inverse(" Mastra Factory "));
+  const projectName = args.projectName ?? await p.text({
+    message: "What do you want to name your project?",
+    placeholder: "my-mastra-factory",
+    validate: (value) => {
+      if (!value?.trim()) return `Project name can't be empty`;
+      if (fs3.existsSync(path3.resolve(value.trim()))) return `Directory ${value.trim()} already exists`;
+      return void 0;
+    }
+  });
+  if (p.isCancel(projectName)) {
+    p.cancel("Operation cancelled");
+    process.exit(0);
   }
   const projectPath = path3.resolve(projectName);
   const packageManager = detectPackageManager();
   args.analytics.trackEvent("sf_create_started", {
     package_manager: packageManager,
-    non_interactive: Boolean(args.useDefaults)
+    no_platform: Boolean(args.noPlatform)
   });
   const spinner2 = p.spinner();
-  spinner2.start("Downloading the Software Factory template...");
+  spinner2.start("Downloading the Mastra Factory template...");
   try {
-    await cloneTemplate({
-      repoUrl: DEFAULT_TEMPLATE_REPO,
-      projectPath,
-      ref: args.templateRef,
-      localDir: args.templateDir
-    });
-    renameProject(projectPath, projectName);
-    fs2.copyFileSync(path3.join(projectPath, ".env.example"), path3.join(projectPath, ".env"));
+    await cloneTemplate(args.template, projectPath);
+    await renameProject(projectPath, projectName);
+    const envPath = path3.join(projectPath, ".env");
+    fs3.copyFileSync(path3.join(projectPath, ".env.example"), envPath);
+    try {
+      fs3.chmodSync(envPath, 384);
+    } catch {
+    }
     spinner2.stop("Template downloaded.");
   } catch (err) {
     spinner2.stop("Template download failed.");
     throw err;
   }
   const installSpinner = p.spinner();
-  installSpinner.start(`Installing dependencies with ${packageManager} (this can take a few minutes)...`);
+  installSpinner.start(`Installing dependencies...`);
   try {
-    await runInherit(packageManager, ["install"], {
-      cwd: projectPath,
-      timeoutMs: args.timeout
+    await x2(packageManager, getInstallArgs(packageManager), {
+      throwOnError: true,
+      nodeOptions: { cwd: projectPath }
     });
     installSpinner.stop("Dependencies installed.");
   } catch (err) {
@@ -226,36 +436,195 @@ async function create(args) {
 You can retry manually: cd ${projectName} && ${packageManager} install`
     );
   }
+  let platformResult = null;
+  let platformError = null;
+  if (!args.noPlatform) {
+    try {
+      platformResult = await runPlatformProvisioning({
+        projectName,
+        projectPath,
+        region: args.region,
+        org: args.org
+      });
+    } catch (err) {
+      platformError = err instanceof Error ? err.message : String(err);
+      p.log.warn(`Platform provisioning failed: ${platformError}`);
+    }
+  }
+  let gitignoreOk = true;
   try {
-    await runInherit("git", ["init", "-q"], { cwd: projectPath });
-    await runInherit("git", ["add", "-A"], { cwd: projectPath });
-    await runInherit("git", ["commit", "-q", "-m", "Initial commit from create-factory"], {
-      cwd: projectPath
-    });
-  } catch {
-    p.log.warn("git init failed \u2014 you can initialize the repository yourself later.");
+    ensureEnvGitignored(projectPath);
+  } catch (err) {
+    gitignoreOk = false;
+    const detail = err instanceof Error ? err.message : String(err);
+    p.log.warn(
+      `Could not update .gitignore to protect .env (${detail}). Skipping git init to avoid committing secrets. Add ".env" to .gitignore manually before running 'git init && git add -A'.`
+    );
+  }
+  if (gitignoreOk) {
+    try {
+      await x2("git", ["init", "-q"], { throwOnError: true, nodeOptions: { cwd: projectPath } });
+      await x2("git", ["add", "-A"], { throwOnError: true, nodeOptions: { cwd: projectPath } });
+      await x2("git", ["commit", "-q", "-m", "Initial commit from create-factory"], {
+        throwOnError: true,
+        nodeOptions: { cwd: projectPath }
+      });
+    } catch {
+      p.log.warn("git init failed \u2014 you can initialize the repository yourself later.");
+    }
   }
   args.analytics.trackEvent("sf_create_completed", {
     package_manager: packageManager,
-    non_interactive: Boolean(args.useDefaults)
+    no_platform: Boolean(args.noPlatform),
+    platform_provisioned: platformResult !== null
   });
   const lines = [
-    color.green("Your Software Factory is ready!"),
+    color.green("Your Mastra Factory is ready!"),
     "",
     `${color.cyan("cd")} ${projectName}`,
     color.cyan(`${packageManager} run dev`),
     "",
     `Factory UI     ${color.underline("http://localhost:5173")}`,
     `Mastra Studio  ${color.underline("http://localhost:4111")}`,
-    "",
-    "Open the Factory UI to finish setup (models, integrations, database)."
+    ""
   ];
+  if (platformResult) {
+    lines.push(
+      `${color.green("Platform connected.")} Project ${color.cyan(platformResult.project.name)} in ${color.cyan(platformResult.orgName)}.`,
+      `Wrote ${color.cyan("MASTRA_PROJECT_ID")}, ${color.cyan("MASTRA_PLATFORM_SECRET_KEY")}, and ${color.cyan("DATABASE_URL")} to ${color.cyan(".env")}.`
+    );
+  } else if (args.noPlatform) {
+    lines.push(
+      `${color.yellow("Skipped platform provisioning (--no-platform).")} Configure ${color.cyan(".env")} manually before running.`
+    );
+  } else if (platformError) {
+    lines.push(
+      `${color.yellow("Platform provisioning failed:")} ${platformError}`,
+      `Any credentials that were minted before the failure have been written to ${color.cyan(".env")}. Re-run \`npx create factory\` after fixing, or fill in the rest manually from ${color.underline("https://platform.mastra.ai")}.`
+    );
+  } else {
+    lines.push("Open the Factory UI to finish setup (models, integrations, database).");
+  }
   p.note(lines.join("\n"), "Next steps");
-  p.outro(`Problems or feedback? ${color.underline("https://github.com/mastra-ai/mastra/issues")}`);
 }
-function cancel2() {
-  p.cancel("Cancelled.");
-  process.exitCode = 1;
+async function runPlatformProvisioning({
+  projectName,
+  projectPath,
+  region,
+  org
+}) {
+  const envAccumulator = {};
+  const envPath = path3.join(projectPath, ".env");
+  let flushed = false;
+  const flush = () => {
+    if (flushed || Object.keys(envAccumulator).length === 0) return;
+    upsertEnvFile(envPath, envAccumulator);
+    flushed = true;
+  };
+  try {
+    p.log.info("Signing in to Mastra\u2026");
+    const token = await getToken();
+    const { orgId, orgName } = org ? await resolveOrgFromFlag(token, org) : await resolveCurrentOrg(token, { forcePrompt: true });
+    p.log.info(`Using organization ${color.cyan(orgName)}.`);
+    envAccumulator.MASTRA_SHARED_API_URL = MASTRA_PLATFORM_API_URL2;
+    envAccumulator.MASTRA_ORGANIZATION_ID = orgId;
+    const projectSpinner = p.spinner();
+    projectSpinner.start(`Creating platform project "${projectName}"\u2026`);
+    let project;
+    try {
+      project = await createServerProject({ token, orgId, name: projectName });
+      projectSpinner.stop(`Created platform project ${color.cyan(project.slug)}.`);
+    } catch (err) {
+      projectSpinner.stop("Project creation failed.");
+      throw err;
+    }
+    envAccumulator.MASTRA_PROJECT_ID = project.id;
+    const keySpinner = p.spinner();
+    keySpinner.start("Creating platform API key\u2026");
+    let secretKey;
+    try {
+      secretKey = await mintOrgApiKey({
+        token,
+        orgId,
+        keyName: `create-factory: ${projectName}`
+      });
+      keySpinner.stop("Platform API key created.");
+    } catch (err) {
+      keySpinner.stop("API key creation failed.");
+      throw err;
+    }
+    envAccumulator.MASTRA_PLATFORM_SECRET_KEY = secretKey;
+    const neonSpinner = p.spinner();
+    neonSpinner.start("Provisioning Neon Postgres database\u2026");
+    let databaseUrl;
+    try {
+      const attached = await attachNeonDatabase({
+        token,
+        orgId,
+        projectId: project.id,
+        name: sanitizeDatabaseName(projectName),
+        regionId: region
+      });
+      const ready = await waitForDatabaseReady({
+        token,
+        orgId,
+        projectId: project.id,
+        databaseId: attached.id
+      });
+      const connection = await getDatabaseConnection({
+        token,
+        orgId,
+        projectId: project.id,
+        databaseId: ready.id
+      });
+      const dbEnv = connection.envVars.find((v) => v.name === "DATABASE_URL");
+      if (!dbEnv?.value) {
+        throw new PlatformApiError(500, "Platform connection response missing DATABASE_URL.");
+      }
+      databaseUrl = dbEnv.value;
+      neonSpinner.stop("Neon database ready.");
+    } catch (err) {
+      neonSpinner.stop("Database provisioning failed.");
+      throw err;
+    }
+    envAccumulator.DATABASE_URL = databaseUrl;
+    flush();
+    return { orgId, orgName, project, secretKey, databaseUrl };
+  } finally {
+    flush();
+  }
+}
+async function resolveOrgFromFlag(token, value) {
+  const orgs = await fetchOrgs(token);
+  const match = orgs.find((o) => o.id === value || o.name === value);
+  if (!match) {
+    const available = orgs.map((o) => `${o.name} (${o.id})`).join(", ") || "(none)";
+    throw new Error(`No organization matched --org "${value}". Available: ${available}.`);
+  }
+  return { orgId: match.id, orgName: match.name };
+}
+function sanitizeDatabaseName(projectName) {
+  const cleaned = projectName.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/^-+|-+$/g, "");
+  const truncated = (cleaned || "factory").slice(0, 64);
+  return truncated;
+}
+function ensureEnvGitignored(projectPath) {
+  const gitignorePath = path3.join(projectPath, ".gitignore");
+  const existing = fs3.existsSync(gitignorePath) ? fs3.readFileSync(gitignorePath, "utf8") : "";
+  const lines = existing.split(/\r?\n/).map((line) => line.trim());
+  const covered = lines.some((line) => {
+    if (!line || line.startsWith("#")) return false;
+    return line === ".env" || line === ".env*" || line === "/.env" || line === "/.env*";
+  });
+  if (covered) return;
+  const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+  fs3.writeFileSync(
+    gitignorePath,
+    `${existing}${prefix}
+# Added by create-factory to protect platform credentials
+.env
+`
+  );
 }
 
 // src/index.ts
@@ -264,20 +633,15 @@ var pkg = JSON.parse(
 );
 var analytics = new Analytics(pkg.version);
 var program = new Command();
-program.name("create-factory").description("Create a Mastra Software Factory project").version(pkg.version, "-v, --version").argument("[project-name]", "Directory name of the project").option("--default", "Non-interactive: default name").option("--template-ref <ref>", "Pin a template repo tag/branch").option("--template-dir <dir>", "Use a local template directory instead of cloning (development)").option("-t, --timeout [ms]", "Timeout for dependency installation in ms").action(async (projectNameArg, args) => {
-  let timeout;
-  if (args.timeout !== void 0) {
-    timeout = args.timeout === true ? 6e4 : Number(args.timeout);
-    if (!Number.isInteger(timeout) || timeout <= 0) {
-      throw new Error(`--timeout must be a positive integer in milliseconds (got ${String(args.timeout)})`);
-    }
-  }
+var DEFAULT_TEMPLATE_REPO = "https://github.com/mastra-ai/softwarefactory-template";
+program.name("create-factory").description("Create a new Mastra Factory project").argument("[project-name]", "Directory name of the project").option("--template <template-name>", "Create a project from a template (public GitHub URL)", DEFAULT_TEMPLATE_REPO).option("--no-platform", "Skip Mastra platform sign-in, project, and Neon provisioning").option("--org <org>", "Mastra organization id or name \u2014 skips the interactive org picker").option("--region <region>", "Neon region id (passed to the platform verbatim)").version(pkg.version, "-v, --version").action(async (projectNameArg, args) => {
   await create({
     projectName: projectNameArg,
-    useDefaults: Boolean(args.default),
-    templateRef: args.templateRef ? String(args.templateRef) : void 0,
-    templateDir: args.templateDir ? String(args.templateDir) : void 0,
-    timeout,
+    template: args.template,
+    // commander's `--no-platform` flips `platform` to false when present, true by default.
+    noPlatform: args.platform === false,
+    org: args.org ? String(args.org) : void 0,
+    region: args.region ? String(args.region) : void 0,
     analytics
   });
 });

package/package.json

@@ -1,19 +1,18 @@
 {
   "name": "create-factory",
-  "version": "0.0.3-alpha.0",
-  "description": "Create a Mastra Software Factory project: an agent-powered software delivery environment built on Mastra. Run `npm create factory` to scaffold and get started.",
+  "version": "0.0.3-alpha.3",
+  "description": "Create a Mastra Factory project: an agent-powered software delivery environment built on Mastra. Run `npm create factory` to scaffold and get started.",
   "type": "module",
   "license": "Apache-2.0",
   "bin": {
-    "create-factory": "./bin/cli.mjs"
+    "create-factory": "./dist/index.js"
   },
   "files": [
-    "bin",
     "dist",
     "CHANGELOG.md"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=22.13.0"
   },
   "repository": {
     "type": "git",
@@ -37,7 +36,9 @@
     "@clack/prompts": "^1.7.0",
     "commander": "^14.0.3",
     "picocolors": "^1.1.1",
-    "posthog-node": "^5.37.0"
+    "posthog-node": "^5.37.0",
+    "tinyexec": "^1.2.4",
+    "mastra": "1.20.0-alpha.13"
   },
   "devDependencies": {
     "@types/node": "22.20.1",

package/bin/cli.mjs

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import '../dist/index.js';