@pixelated-tech/components 3.7.6 → 3.7.7

package/dist/components/config/config.js

@@ -1,15 +1,48 @@
+import { decrypt, isEncrypted } from './crypto';
+import fs from 'fs';
+import path from 'path';
 const debug = false;
 /**
- * Read the full master config blob from environment.
+ * Read the full master config blob from environment or local file.
  * This function is intended for server-side use only.
  */
 export function getFullPixelatedConfig() {
-    const raw = process.env.PIXELATED_CONFIG_JSON || (process.env.PIXELATED_CONFIG_B64 && Buffer.from(process.env.PIXELATED_CONFIG_B64, 'base64').toString('utf8'));
+    let raw = process.env.PIXELATED_CONFIG_JSON || (process.env.PIXELATED_CONFIG_B64 && Buffer.from(process.env.PIXELATED_CONFIG_B64, 'base64').toString('utf8'));
+    let source = process.env.PIXELATED_CONFIG_JSON ? 'PIXELATED_CONFIG_JSON' : (process.env.PIXELATED_CONFIG_B64 ? 'PIXELATED_CONFIG_B64' : 'none');
+    // If not in environment, try reading from the conventional file location
     if (!raw) {
-        console.error('PIXELATED_CONFIG not found: neither PIXELATED_CONFIG_JSON nor PIXELATED_CONFIG_B64 is set in the environment.');
+        const configPath = path.join(process.cwd(), 'src/app/config/pixelated.config.json');
+        if (fs.existsSync(configPath)) {
+            try {
+                raw = fs.readFileSync(configPath, 'utf8');
+                source = 'src/app/config/pixelated.config.json';
+            }
+            catch (err) {
+                console.error(`Failed to read config file at ${configPath}`, err);
+            }
+        }
+    }
+    if (!raw) {
+        console.error('PIXELATED_CONFIG not found: neither environment variables nor src/app/config/pixelated.config.json are available.');
         return {};
     }
-    const source = process.env.PIXELATED_CONFIG_JSON ? 'PIXELATED_CONFIG_JSON' : 'PIXELATED_CONFIG_B64';
+    // Handle decryption if the content is encrypted
+    if (isEncrypted(raw)) {
+        const key = process.env.PIXELATED_CONFIG_KEY;
+        if (!key) {
+            console.error('PIXELATED_CONFIG is encrypted but PIXELATED_CONFIG_KEY is not set in the environment.');
+            return {};
+        }
+        try {
+            raw = decrypt(raw, key);
+            if (debug)
+                console.log(`PIXELATED_CONFIG decrypted using key from environment.`);
+        }
+        catch (err) {
+            console.error('Failed to decrypt PIXELATED_CONFIG', err);
+            return {};
+        }
+    }
     try {
         const parsed = JSON.parse(raw);
         if (debug)

package/dist/components/config/config.server.js

@@ -1,3 +1,4 @@
+"use server";
 import { jsx as _jsx } from "react/jsx-runtime";
 import PropTypes from 'prop-types';
 import { getClientOnlyPixelatedConfig } from './config';

package/dist/components/config/crypto.js

@@ -0,0 +1,62 @@
+import crypto from 'crypto';
+/**
+ * AES-256-GCM encryption/decryption utility.
+ * Requires a 32-byte key (64 hex characters).
+ */
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // GCM recommended IV length
+const AUTH_TAG_LENGTH = 16;
+const ENCRYPTED_PREFIX = 'pxl:v1:';
+/**
+ * Encrypts a string using a hex-encoded 32-byte key.
+ * Returns a prefixed string: pxl:v1:iv:authTag:encryptedContent (all hex).
+ */
+export function encrypt(text, keyHex) {
+    if (!keyHex)
+        throw new Error('Encryption key is required.');
+    const key = Buffer.from(keyHex, 'hex');
+    if (key.length !== 32) {
+        throw new Error('Encryption key must be 32 bytes (64 hex characters).');
+    }
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return `${ENCRYPTED_PREFIX}${iv.toString('hex')}:${authTag}:${encrypted}`;
+}
+/**
+ * Decrypts a string using a hex-encoded 32-byte key.
+ * Expects format: pxl:v1:iv:authTag:encryptedContent
+ */
+export function decrypt(payload, keyHex) {
+    if (!keyHex)
+        throw new Error('Decryption key is required.');
+    if (!payload.startsWith(ENCRYPTED_PREFIX)) {
+        throw new Error('Payload is not in a recognized encrypted format.');
+    }
+    const data = payload.slice(ENCRYPTED_PREFIX.length);
+    const key = Buffer.from(keyHex, 'hex');
+    if (key.length !== 32) {
+        throw new Error('Decryption key must be 32 bytes (64 hex characters).');
+    }
+    const parts = data.split(':');
+    if (parts.length !== 3) {
+        throw new Error('Invalid encrypted data format. Expected iv:authTag:encryptedContent');
+    }
+    const [ivHex, authTagHex, encryptedHex] = parts;
+    const iv = Buffer.from(ivHex, 'hex');
+    const authTag = Buffer.from(authTagHex, 'hex');
+    const encryptedText = Buffer.from(encryptedHex, 'hex');
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
+/**
+ * Checks if a string is encrypted using our format.
+ */
+export function isEncrypted(text) {
+    return typeof text === 'string' && text.startsWith(ENCRYPTED_PREFIX);
+}

package/dist/components/utilities/functions.js

@@ -200,6 +200,7 @@ export const SERVER_ONLY_PATTERNS = [
     /\bfs\b/,
     /\bfs\.readFileSync\b/,
     /\bfs\.existsSync\b/,
+    /\bcrypto\b/,
     /\bimport.*googleapis\b|\brequire.*googleapis\b/, // Actual import of googleapis
     /\bimport.*next\/server\b|\brequire.*next\/server\b/, // Actual import of next/server
     /\bimport.*path\b|\brequire.*path\b/, // Actual import of path module

package/dist/index.js

@@ -1,7 +1,5 @@
 // sorted alphabetically and grouped by folder for easier reading
-export * from './components/config/config';
 export * from './components/config/config.client';
-export * from './components/config/config.server';
 export * from './components/config/config.types';
 export * from './components/general/404';
 export * from './components/general/accordion';

package/dist/index.server.js

@@ -8,6 +8,7 @@ export * from './components/admin/sites/sites.integration';
 export * from './components/config/config';
 export * from './components/config/config.server';
 export * from './components/config/config.types';
+export * from './components/config/crypto';
 // SEO
 export * from './components/general/contentful.delivery';
 export * from './components/general/contentful.management';

package/dist/scripts/config-vault.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env npx tsx
+import fs from 'fs';
+import path from 'path';
+import { encrypt, decrypt, isEncrypted } from '../components/config/crypto';
+/**
+ * CLI Tool for encrypting/decrypting pixelated.config.json
+ * Usage:
+ *   npx tsx src/scripts/config-vault.js encrypt <filePath> <key>
+ *   npx tsx src/scripts/config-vault.js decrypt <filePath> <key>
+ */
+const [, , command, targetPath, key] = process.argv;
+if (!command || !targetPath || !key) {
+    console.log('Usage:');
+    console.log('  encrypt <filePath> <key> - Encrypts the file in place');
+    console.log('  decrypt <filePath> <key> - Decrypts the file in place');
+    process.exit(1);
+}
+const fullPath = path.isAbsolute(targetPath) ? targetPath : path.resolve(process.cwd(), targetPath);
+if (!fs.existsSync(fullPath)) {
+    console.error(`File not found: ${fullPath}`);
+    process.exit(1);
+}
+const content = fs.readFileSync(fullPath, 'utf8');
+try {
+    if (command === 'encrypt') {
+        if (isEncrypted(content)) {
+            console.log('File is already encrypted.');
+            process.exit(0);
+        }
+        const encrypted = encrypt(content, key);
+        fs.writeFileSync(fullPath, encrypted, 'utf8');
+        console.log(`Successfully encrypted ${targetPath}`);
+    }
+    else if (command === 'decrypt') {
+        if (!isEncrypted(content)) {
+            console.log('File is not encrypted.');
+            process.exit(0);
+        }
+        const decrypted = decrypt(content, key);
+        fs.writeFileSync(fullPath, decrypted, 'utf8');
+        console.log(`Successfully decrypted ${targetPath}`);
+    }
+    else {
+        console.error(`Unknown command: ${command}`);
+        process.exit(1);
+    }
+}
+catch (err) {
+    console.error(`Operation failed: ${err.message}`);
+    process.exit(1);
+}

package/dist/scripts/config-vault.ts

@@ -0,0 +1,55 @@
+#!/usr/bin/env npx tsx
+import fs from 'fs';
+import path from 'path';
+import { encrypt, decrypt, isEncrypted } from '../components/config/crypto';
+
+/**
+ * CLI Tool for encrypting/decrypting pixelated.config.json
+ * Usage: 
+ *   npx tsx src/scripts/config-vault.js encrypt <filePath> <key>
+ *   npx tsx src/scripts/config-vault.js decrypt <filePath> <key>
+ */
+
+const [,, command, targetPath, key] = process.argv;
+
+if (!command || !targetPath || !key) {
+	console.log('Usage:');
+	console.log('  encrypt <filePath> <key> - Encrypts the file in place');
+	console.log('  decrypt <filePath> <key> - Decrypts the file in place');
+	process.exit(1);
+}
+
+const fullPath = path.isAbsolute(targetPath) ? targetPath : path.resolve(process.cwd(), targetPath);
+
+if (!fs.existsSync(fullPath)) {
+	console.error(`File not found: ${fullPath}`);
+	process.exit(1);
+}
+
+const content = fs.readFileSync(fullPath, 'utf8');
+
+try {
+	if (command === 'encrypt') {
+		if (isEncrypted(content)) {
+			console.log('File is already encrypted.');
+			process.exit(0);
+		}
+		const encrypted = encrypt(content, key);
+		fs.writeFileSync(fullPath, encrypted, 'utf8');
+		console.log(`Successfully encrypted ${targetPath}`);
+	} else if (command === 'decrypt') {
+		if (!isEncrypted(content)) {
+			console.log('File is not encrypted.');
+			process.exit(0);
+		}
+		const decrypted = decrypt(content, key);
+		fs.writeFileSync(fullPath, decrypted, 'utf8');
+		console.log(`Successfully decrypted ${targetPath}`);
+	} else {
+		console.error(`Unknown command: ${command}`);
+		process.exit(1);
+	}
+} catch (err: any) {
+	console.error(`Operation failed: ${err.message}`);
+	process.exit(1);
+}

package/dist/scripts/release.sh

@@ -103,7 +103,14 @@ if [ "$current_branch" != "dev" ]; then
 fi
 
 echo "📦 Step 1: Updating dependencies..."
-npm outdated | awk 'NR>1 {print $1"@"$4}' | xargs npm install --force --save 2>/dev/null || true
+UPDATES=$(npm outdated | awk 'NR>1 {print $1"@"$4}' || true)
+if [ -n "$UPDATES" ]; then
+    echo "Updating the following packages: $UPDATES"
+    echo "$UPDATES" | xargs npm install --force --save 2>/dev/null || true
+    echo "✅ Successfully updated: $UPDATES"
+else
+    echo "✅ No dependency updates needed."
+fi
 npm audit fix --force 2>/dev/null || true
 
 echo "🔍 Step 2: Running lint..."
@@ -124,6 +131,10 @@ if [ "$version_type" != "none" ]; then
 fi
 
 echo "💾 Step 5: Committing changes..."
+if npm run | grep -q "config:encrypt"; then
+    echo "🔒 Encrypting configuration..."
+    npm run config:encrypt
+fi
 commit_message=$(prompt_commit_message)
 git add . -v
 if git diff --cached --quiet; then
@@ -171,6 +182,11 @@ else
     echo "ℹ️  Tag v$new_version already exists"
 fi
 
+if npm run | grep -q "config:decrypt"; then
+    echo "🔓 Decrypting configuration for local development..."
+    npm run config:decrypt
+fi
+
 echo "🔐 Step 9: Publishing to npm..."
 should_publish=$(prompt_publish)
 if [ "$should_publish" = "yes" ]; then

package/dist/types/components/config/config.d.ts

@@ -1,6 +1,6 @@
 import type { PixelatedConfig } from './config.types';
 /**
- * Read the full master config blob from environment.
+ * Read the full master config blob from environment or local file.
  * This function is intended for server-side use only.
  */
 export declare function getFullPixelatedConfig(): PixelatedConfig;

package/dist/types/components/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/components/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,eAAe,CAexD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,CAAC,EAAE,eAAe,GAAG,eAAe,CAwBpF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/components/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMtD;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,eAAe,CA8CxD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,CAAC,EAAE,eAAe,GAAG,eAAe,CAwBpF"}

package/dist/types/components/config/config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.server.d.ts","sourceRoot":"","sources":["../../../../src/components/config/config.server.tsx"],"names":[],"mappings":"AACA,OAAO,SAAS,EAAE,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAUnD,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,SAAS,CAAC,CAAC;AAC3G,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,iCAAiC,oDAM3F;yBANqB,6BAA6B"}
+{"version":3,"file":"config.server.d.ts","sourceRoot":"","sources":["../../../../src/components/config/config.server.tsx"],"names":[],"mappings":"AAGA,OAAO,SAAS,EAAE,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAUnD,MAAM,MAAM,iCAAiC,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,SAAS,CAAC,CAAC;AAC3G,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,iCAAiC,oDAM3F;yBANqB,6BAA6B"}

package/dist/types/components/config/crypto.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Encrypts a string using a hex-encoded 32-byte key.
+ * Returns a prefixed string: pxl:v1:iv:authTag:encryptedContent (all hex).
+ */
+export declare function encrypt(text: string, keyHex: string): string;
+/**
+ * Decrypts a string using a hex-encoded 32-byte key.
+ * Expects format: pxl:v1:iv:authTag:encryptedContent
+ */
+export declare function decrypt(payload: string, keyHex: string): string;
+/**
+ * Checks if a string is encrypted using our format.
+ */
+export declare function isEncrypted(text: string): boolean;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/types/components/config/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../../src/components/config/crypto.ts"],"names":[],"mappings":"AAYA;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAgB5D;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CA6B/D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD"}

package/dist/types/components/utilities/functions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../../../src/components/utilities/functions.ts"],"names":[],"mappings":"AAGA,wBAAgB,QAAQ,CAAE,GAAG,EAAE,MAAM,oBAUpC;AAGD,wBAAgB,SAAS,CAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG;;EAmBxC;AAED,wBAAgB,wBAAwB,CAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAIhF;AAED,wBAAgB,aAAa,CAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,UAOtD;AAED,wBAAgB,WAAW,WAc1B;AAED,wBAAgB,YAAY,WAK3B;AAED,wBAAgB,UAAU,CAAE,GAAG,EAAE,MAAM,UAEtC;AAQD,wBAAgB,YAAY,CAAE,YAAY,EAAE,MAAM,UAgCjD;AAID;;;;OAII;AACJ,wBAAgB,YAAY,SAoB3B;AAKD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,UA0BhC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE9D;AAGD;;GAEG;AACH,eAAO,MAAM,uBAAuB,UAQnC,CAAC;AAEF,eAAO,MAAM,wBAAwB,UAOpC,CAAC;AAGF;;GAEG;AACH,eAAO,MAAM,oBAAoB,UAiBhC,CAAC"}
+{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../../../src/components/utilities/functions.ts"],"names":[],"mappings":"AAGA,wBAAgB,QAAQ,CAAE,GAAG,EAAE,MAAM,oBAUpC;AAGD,wBAAgB,SAAS,CAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG;;EAmBxC;AAED,wBAAgB,wBAAwB,CAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAIhF;AAED,wBAAgB,aAAa,CAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,UAOtD;AAED,wBAAgB,WAAW,WAc1B;AAED,wBAAgB,YAAY,WAK3B;AAED,wBAAgB,UAAU,CAAE,GAAG,EAAE,MAAM,UAEtC;AAQD,wBAAgB,YAAY,CAAE,YAAY,EAAE,MAAM,UAgCjD;AAID;;;;OAII;AACJ,wBAAgB,YAAY,SAoB3B;AAKD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,UA0BhC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE9D;AAGD;;GAEG;AACH,eAAO,MAAM,uBAAuB,UAQnC,CAAC;AAEF,eAAO,MAAM,wBAAwB,UAOpC,CAAC;AAGF;;GAEG;AACH,eAAO,MAAM,oBAAoB,UAkBhC,CAAC"}

package/dist/types/index.d.ts

@@ -1,6 +1,4 @@
-export * from "./components/config/config";
 export * from "./components/config/config.client";
-export * from "./components/config/config.server";
 export * from "./components/config/config.types";
 export * from "./components/general/404";
 export * from "./components/general/accordion";

package/dist/types/index.server.d.ts

@@ -2,6 +2,7 @@ export * from "./components/admin/sites/sites.integration";
 export * from "./components/config/config";
 export * from "./components/config/config.server";
 export * from "./components/config/config.types";
+export * from "./components/config/crypto";
 export * from "./components/general/contentful.delivery";
 export * from "./components/general/contentful.management";
 export * from "./components/general/flickr";

package/dist/types/scripts/config-vault.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env npx tsx
+export {};
+//# sourceMappingURL=config-vault.d.ts.map

package/dist/types/scripts/config-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-vault.d.ts","sourceRoot":"","sources":["../../../src/scripts/config-vault.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@pixelated-tech/components",
-	"version": "3.7.6",
+	"version": "3.7.7",
 	"private": false,
 	"author": {
 		"name": "Pixelated Technologies",
@@ -85,7 +85,8 @@
 		"test:coverage": "vitest run --coverage",
 		"test:run": "vitest run",
 		"lint": "eslint --fix",
-		"release": "./src/scripts/release.sh"
+		"release": "./src/scripts/release.sh",
+		"vault": "tsx src/scripts/config-vault.ts"
 	},
 	"scripts-old": {
 		"buildBabel": "npm run buildClean && NODE_ENV=production babel src --out-dir dist --copy-files",