@marvalt/digivalt-core 0.1.1 → 0.1.3

package/bin/init.cjs

@@ -34,7 +34,8 @@ try {
   console.log('\n🎉 DigiVAlt Cloudflare proxy routes installed successfully!');
   console.log('👉 Next Steps:');
   console.log('1. Copy .dev.vars.example to .dev.vars and add your API keys.');
-  console.log("2. Run `npm install -D wrangler` if you haven't already.");
+  console.log("2. Sync your production credentials to Cloudflare by running:");
+  console.log("   👉 node scripts/deploy-secrets.js");
   console.log("3. Run `npx wrangler pages dev` to test your proxy functions locally.");
 } catch (error) {
   console.error('❌ Failed to construct templates:', error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marvalt/digivalt-core",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Core glue logic and shared context for DigiVAlt frontend applications",
   "license": "GPL-3.0-or-later",
   "main": "dist/index.cjs",

package/template/scripts/deploy-secrets.js

@@ -0,0 +1,93 @@
+import fs from 'fs';
+import path from 'path';
+import { execSync } from 'child_process';
+
+/**
+ * 🚀 DigiVAlt Cloudflare Secrets Deployer
+ * 
+ * Automates the synchronization of local .env.local variables 
+ * securely straight into your Cloudflare Pages environment 
+ * using Wrangler bulk secret injection.
+ */
+
+const envPath = path.resolve(process.cwd(), '.env.local');
+
+if (!fs.existsSync(envPath)) {
+  console.error("❌ No .env.local file found in the root directory!");
+  console.log("👉 Please create a .env.local file with your production secrets.");
+  process.exit(1);
+}
+
+console.log("🔍 Parsing .env.local secrets...");
+const rawEnv = fs.readFileSync(envPath, 'utf8');
+const secrets = {};
+
+rawEnv.split('\n').forEach(line => {
+  const trimmed = line.trim();
+  // Ignore comments and empty lines
+  if (!trimmed || trimmed.startsWith('#')) return;
+  
+  const match = trimmed.match(/^([^=]+)=(.*)$/);
+  if (match) {
+    const key = match[1].trim();
+    let value = match[2].trim();
+    
+    // Strip surrounding quotes if present
+    if (value.startsWith('"') && value.endsWith('"')) value = value.slice(1, -1);
+    if (value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+    
+    secrets[key] = value;
+  }
+});
+
+const secretCount = Object.keys(secrets).length;
+if (secretCount === 0) {
+  console.log("⚠️ No valid SECRETS found in .env.local. Exiting.");
+  process.exit(0);
+}
+
+const tmpJsonPath = path.resolve(process.cwd(), '.tmp-cloudflare-secrets.json');
+fs.writeFileSync(tmpJsonPath, JSON.stringify(secrets, null, 2));
+
+try {
+  console.log(`🚀 Uploading ${secretCount} secrets to Cloudflare Pages...`);
+  
+  // Try to read the Cloudflare project name and account ID from wrangler.toml
+  const tomlPath = path.resolve(process.cwd(), 'wrangler.toml');
+  let projectName = '';
+  let accountId = '';
+  
+  if (fs.existsSync(tomlPath)) {
+    const tomlContent = fs.readFileSync(tomlPath, 'utf8');
+    
+    // Parse Project Name
+    const nameMatch = tomlContent.match(/^name\s*=\s*"([^"]+)"/m);
+    if (nameMatch) projectName = nameMatch[1];
+    
+    // Parse Account ID
+    const accountMatch = tomlContent.match(/^account_id\s*=\s*"([^"]+)"/m);
+    if (accountMatch) accountId = accountMatch[1];
+    
+    if (projectName) console.log(`📦 Targeted Cloudflare Project: ${projectName}`);
+    if (accountId) console.log(`🏢 Targeted Cloudflare Account: ${accountId}`);
+  }
+  
+  // Construct the command string tightly bound to the exact workspace
+  let cmd = `npx wrangler pages secret bulk .tmp-cloudflare-secrets.json`;
+  if (projectName) cmd += ` --project-name ${projectName}`;
+  if (accountId) cmd += ` --account-id ${accountId}`;
+    
+  // Execute Wrangler natively
+  execSync(cmd, { stdio: 'inherit' });
+  console.log("✅ All secrets deployed successfully to Cloudflare!");
+  
+} catch (error) {
+  console.error("❌ Failed to push secrets to Cloudflare.");
+  console.error("Ensure you are logged into Wrangler (`npx wrangler login`) and the project exists.");
+} finally {
+  // Always rigorously clean up the temporary plaintext JSON file for security
+  if (fs.existsSync(tmpJsonPath)) {
+    fs.unlinkSync(tmpJsonPath);
+    console.log("🧹 Cleaned up temporary credentials payload.");
+  }
+}