@saastemly/voidcommerce 0.14.0 → 0.15.0

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-jvsednjr.js";
+} from "./index-jycz3x3g.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -50,7 +50,7 @@ import {
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-paeg95y4.js";
+} from "./index-s8se0x2d.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -255,11 +255,31 @@ async function preflightCommand(args) {
     console.error("vc: no voidcommerce.json here.");
     return 1;
   }
-  const source = args.includes("--cloudflare") ? "wrangler" : "void";
+  const source = args.includes("--repo") ? "repository" : args.includes("--cloudflare") ? "wrangler" : "void";
   const result = await preflight(project, source);
   printPreflight(project, result, source);
+  if (source !== "repository")
+    return result.ready ? 0 : 1;
+  const pending = await uncommittedMigrations(project.root);
+  if (pending.length > 0) {
+    console.error(`${color2.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:
+` + `    ${pending.join(`
+    `)}
+
+` + `  The deploy applies what is in the repository. Commit these, or the
+` + `  schema the shop runs on is not the one you tested.
+`);
+    return 1;
+  }
   return result.ready ? 0 : 1;
 }
+async function uncommittedMigrations(root) {
+  const status = await run("git", ["status", "--porcelain", "--", "migrations"], root);
+  if (status.code !== 0)
+    return [];
+  return status.out.split(`
+`).map((line2) => line2.trim()).filter(Boolean).map((line2) => line2.replace(/^\S+\s+/, ""));
+}
 async function deployHelp() {
   const captured = await captureVoid(["deploy", "--help"]);
   const width = 80;

package/dist/deploy/preflight.d.ts

@@ -21,7 +21,16 @@ export interface Preflight {
     bareSecrets: string[];
     ready: boolean;
 }
-export type SecretSource = "wrangler" | "void";
+/**
+ * Where a secret's presence is established.
+ *
+ * `repository` asks only what is committed, and is the right question before
+ * a PUSH: the deploy happens off this machine from what was pushed, so a
+ * check that needs local credentials is checking the wrong thing. It is also
+ * the only mode that works on a machine which has none — which, if config is
+ * properly in the environment, is every machine.
+ */
+export type SecretSource = "wrangler" | "void" | "repository";
 /** Keys committed in .env.production — safe values only, by construction. */
 export declare function productionEnv(appDir: string): Map<string, string>;
 /** The worker's hostnames must be what the layout says. */

package/dist/deploy/secrets.d.ts

@@ -66,6 +66,16 @@ export declare function committedPublicKeyInto(root: string, publicKey: string):
  * can say "all five are declared" on a machine that cannot read any of them.
  */
 export declare function declaredSecretNames(root: string): Set<string>;
+/**
+ * Declared names whose value is still the `unset` placeholder.
+ *
+ * Readable WITHOUT the key, because `unset` is plaintext — which is what
+ * lets a push-time gate tell "this shop has a Stripe key" from "this shop
+ * has a line that says STRIPE_SECRET_KEY". Preflight used to count the
+ * second as present, so a shop could pass every check and then fail to take
+ * money in production.
+ */
+export declare function unsetSecretNames(root: string): string[];
 /** Is a declared value actually encrypted, or was it committed in the clear? */
 export declare function plaintextSecretNames(root: string): string[];
 /**

package/dist/{index-jvsednjr.js → index-jycz3x3g.js}

@@ -10,8 +10,9 @@ import {
   renderEnvExample,
   renderEnvLocal,
   renderEnvProduction,
-  renderEnvTs
-} from "./index-paeg95y4.js";
+  renderEnvTs,
+  unsetSecretNames
+} from "./index-s8se0x2d.js";
 import {
   MANIFEST_FILE,
   has,
@@ -1378,7 +1379,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.14.0",
+  version: "0.15.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -2433,6 +2434,41 @@ async function link(root, file, target, result) {
   }
 }
 var sorted = (record) => Object.fromEntries(Object.entries(record).sort());
+async function generateHooks(root, result) {
+  await put(root, ".husky/pre-commit", `#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
+# file so the COMMIT carries the ciphertext rather than what you staged.
+# Encryption needs only the public key in that file, so this needs no
+# credential and works on a fresh clone.
+#
+# It refuses only when it cannot fix the problem itself: no key yet
+# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
+# committed in the clear cannot be un-committed — the value stays in the
+# history and has to be treated as burned.
+bunx vc guard
+`, result, "regenerate");
+  await put(root, ".husky/pre-push", `#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Pushing main deploys this shop, so the same checks the deploy would make
+# run here first — where you can read the error and fix it, rather than in a
+# build log after the shop is already updating.
+#
+# Needs no credentials: it reads only what is committed.
+# To push anyway, deliberately: git push --no-verify
+
+while read -r _local_ref _local_sha remote_ref _remote_sha; do
+  case "$remote_ref" in
+    refs/heads/main|refs/heads/master)
+      echo "vc: main is the deploy branch — checking what you are about to publish"
+      bunx vc preflight --repo || exit 1
+      ;;
+  esac
+done
+`, result, "regenerate");
+}
 async function generate(root, manifest) {
   const result = { written: [], kept: [], retired: [], packages: packagesOf(manifest) };
   await writeManifest(root, manifest);
@@ -2453,6 +2489,7 @@ async function generate(root, manifest) {
       await generateStrictApp(root, STRICT_APP, manifest, result);
       break;
   }
+  await generateHooks(root, result);
   return result;
 }
 async function generateApi(root, dir, manifest, result, opts) {
@@ -2601,20 +2638,6 @@ dist
 .DS_Store
 `, result, "own");
   await put(root, "patches/void@0.10.13.patch", renderVoidPatch(), result, "regenerate");
-  await put(root, ".husky/pre-commit", `#!/usr/bin/env sh
-# Generated by \`vc init\`.
-#
-# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
-# file so the COMMIT carries the ciphertext rather than what you staged.
-# Encryption needs only the public key in that file, so this needs no
-# credential and works on a fresh clone.
-#
-# It refuses only when it cannot fix the problem itself: no key yet
-# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
-# committed in the clear cannot be un-committed — the value stays in the
-# history and has to be treated as burned.
-bunx vc guard
-`, result, "regenerate");
   await put(root, ".github/workflows/deploy.yml", renderDistWorkflow(manifest), result, "regenerate");
   await retire(root, ".github/workflows/void-dist.yml", result);
   await put(root, "DEPLOY.md", renderDeployReadme(manifest, zone(manifest), workerHosts(manifest)), result, "regenerate");
@@ -3036,7 +3059,9 @@ function routeProblem(project) {
 async function preflight(project, source) {
   const present = productionEnv(project.appDir);
   let remote = null;
-  if (source === "wrangler") {
+  if (source === "repository") {
+    remote = null;
+  } else if (source === "wrangler") {
     const bin = findWrangler(project.appDir);
     remote = bin ? await secretNames(bin, project.appDir) : null;
   } else {
@@ -3044,8 +3069,11 @@ async function preflight(project, source) {
   }
   for (const name of remote ?? [])
     present.set(name, "<secret>");
-  for (const name of declaredSecretNames(project.root))
-    present.set(name, "<in the repository>");
+  const stillUnset = new Set(unsetSecretNames(project.root));
+  for (const name of declaredSecretNames(project.root)) {
+    if (!stillUnset.has(name))
+      present.set(name, "<in the repository>");
+  }
   const missing = allEnvKeys(project.manifest).filter((key) => {
     const value = present.get(key.key);
     return value === undefined || value === "" || value === UNSET;

package/dist/{index-paeg95y4.js → index-s8se0x2d.js}

@@ -342,6 +342,21 @@ function declaredSecretNames(root) {
   }
   return names;
 }
+function unsetSecretNames(root) {
+  const path = join2(root, SECRETS_FILE);
+  if (!existsSync2(path))
+    return [];
+  const out = [];
+  for (const line of readFileSync(path, "utf8").split(`
+`)) {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!match || match[1].startsWith("DOTENV_"))
+      continue;
+    if (match[2].trim().replace(/^['"]|['"]$/g, "") === "unset")
+      out.push(match[1]);
+  }
+  return out;
+}
 function plaintextSecretNames(root) {
   const path = join2(root, SECRETS_FILE);
   if (!existsSync2(path))
@@ -389,7 +404,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-nntc65pq.js");
+    const { publicKeyFor } = await import("./keys-6neyajsv.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -916,4 +931,4 @@ ${color2.green("✓")} re-keyed under ${made.publicKey.slice(0, 20)}… and ${PR
   return 0;
 }
 
-export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, ghAuth, repoSlug, setSecret, secretNames, setVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };
+export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, ghAuth, repoSlug, setSecret, secretNames, setVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-jvsednjr.js";
+} from "./index-jycz3x3g.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-paeg95y4.js";
+} from "./index-s8se0x2d.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/dist/{keys-nntc65pq.js → keys-6neyajsv.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-paeg95y4.js";
+} from "./index-s8se0x2d.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/deploy/index.ts

@@ -61,12 +61,40 @@ export async function preflightCommand(args: string[]): Promise<number> {
 		console.error("vc: no voidcommerce.json here.");
 		return 1;
 	}
-	const source = args.includes("--cloudflare") ? "wrangler" : "void";
+	const source = args.includes("--repo") ? "repository" : args.includes("--cloudflare") ? "wrangler" : "void";
 	const result = await preflight(project, source);
 	printPreflight(project, result, source);
+	if (source !== "repository") return result.ready ? 0 : 1;
+
+	// A repository check is a check on what will be PUSHED, so it also asks
+	// the question CI would ask and cannot answer any earlier: is there a
+	// migration that was generated and never committed? Applied under a fresh
+	// name on the next run, against tables that already exist, it fails the
+	// deploy — and it fails it after the shop is already down for the update.
+	const pending = await uncommittedMigrations(project.root);
+	if (pending.length > 0) {
+		console.error(
+			`${color.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:\n` +
+				`    ${pending.join("\n    ")}\n\n` +
+				"  The deploy applies what is in the repository. Commit these, or the\n" +
+				"  schema the shop runs on is not the one you tested.\n",
+		);
+		return 1;
+	}
 	return result.ready ? 0 : 1;
 }
 
+/** Migration files git does not have — untracked or modified. */
+async function uncommittedMigrations(root: string): Promise<string[]> {
+	const status = await run("git", ["status", "--porcelain", "--", "migrations"], root);
+	if (status.code !== 0) return [];
+	return status.out
+		.split("\n")
+		.map((line) => line.trim())
+		.filter(Boolean)
+		.map((line) => line.replace(/^\S+\s+/, ""));
+}
+
 /** void's deploy help, then what vc adds. */
 export async function deployHelp(): Promise<number> {
 	const captured = await captureVoid(["deploy", "--help"]);

package/src/deploy/preflight.ts

@@ -7,7 +7,7 @@ import { workerHosts } from "../manifest";
 import type { Project } from "../project";
 import { captureVoid } from "../void";
 import { parseJsonc } from "./jsonc";
-import { SECRETS_FILE, declaredSecretNames, plaintextSecretNames } from "./secrets";
+import { SECRETS_FILE, declaredSecretNames, plaintextSecretNames, unsetSecretNames } from "./secrets";
 import { findWrangler, secretNames } from "./wrangler";
 
 /**
@@ -34,7 +34,16 @@ export interface Preflight {
 	ready: boolean;
 }
 
-export type SecretSource = "wrangler" | "void";
+/**
+ * Where a secret's presence is established.
+ *
+ * `repository` asks only what is committed, and is the right question before
+ * a PUSH: the deploy happens off this machine from what was pushed, so a
+ * check that needs local credentials is checking the wrong thing. It is also
+ * the only mode that works on a machine which has none — which, if config is
+ * properly in the environment, is every machine.
+ */
+export type SecretSource = "wrangler" | "void" | "repository";
 
 /** Keys committed in .env.production — safe values only, by construction. */
 export function productionEnv(appDir: string): Map<string, string> {
@@ -81,7 +90,9 @@ export function routeProblem(project: Project): string | null {
 export async function preflight(project: Project, source: SecretSource): Promise<Preflight> {
 	const present = productionEnv(project.appDir);
 	let remote: Set<string> | null = null;
-	if (source === "wrangler") {
+	if (source === "repository") {
+		remote = null;
+	} else if (source === "wrangler") {
 		const bin = findWrangler(project.appDir);
 		remote = bin ? await secretNames(bin, project.appDir) : null;
 	} else {
@@ -94,7 +105,12 @@ export async function preflight(project: Project, source: SecretSource): Promise
 	 * uploads it. The names are readable without the key — dotenvx encrypts
 	 * values, not keys — so this works on a machine that cannot decrypt.
 	 */
-	for (const name of declaredSecretNames(project.root)) present.set(name, "<in the repository>");
+	const stillUnset = new Set(unsetSecretNames(project.root));
+	for (const name of declaredSecretNames(project.root)) {
+		// A name is not a value. `unset` is the documented placeholder, so a
+		// key carrying it is declared and absent at the same time.
+		if (!stillUnset.has(name)) present.set(name, "<in the repository>");
+	}
 
 	const missing = allEnvKeys(project.manifest).filter((key) => {
 		const value = present.get(key.key);

package/src/deploy/secrets.ts

@@ -126,6 +126,27 @@ export function declaredSecretNames(root: string): Set<string> {
 	return names;
 }
 
+/**
+ * Declared names whose value is still the `unset` placeholder.
+ *
+ * Readable WITHOUT the key, because `unset` is plaintext — which is what
+ * lets a push-time gate tell "this shop has a Stripe key" from "this shop
+ * has a line that says STRIPE_SECRET_KEY". Preflight used to count the
+ * second as present, so a shop could pass every check and then fail to take
+ * money in production.
+ */
+export function unsetSecretNames(root: string): string[] {
+	const path = join(root, SECRETS_FILE);
+	if (!existsSync(path)) return [];
+	const out: string[] = [];
+	for (const line of readFileSync(path, "utf8").split("\n")) {
+		const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+		if (!match || match[1]!.startsWith("DOTENV_")) continue;
+		if (match[2]!.trim().replace(/^['"]|['"]$/g, "") === "unset") out.push(match[1]!);
+	}
+	return out;
+}
+
 /** Is a declared value actually encrypted, or was it committed in the clear? */
 export function plaintextSecretNames(root: string): string[] {
 	const path = join(root, SECRETS_FILE);

package/src/generate/index.ts

@@ -195,6 +195,82 @@ async function link(root: string, file: string, target: string, result: Generate
 
 const sorted = (record: Record<string, string>) => Object.fromEntries(Object.entries(record).sort());
 
+/**
+ * Git hooks, for every layout.
+ *
+ * They guard `.env.secrets`, which exists whatever the layout, so making
+ * them strict-only left an `app` shop able to commit a credential in the
+ * clear with nothing to stop it. Installed by husky on `bun install`, so a
+ * fresh clone is guarded without anyone remembering.
+ */
+async function generateHooks(root: string, result: GenerateResult) {
+	/**
+	 * The hook lives in `.husky/`, which is COMMITTED, so the guard travels
+	 * with the repository instead of being something each clone remembers to
+	 * install. A secret committed in the clear cannot be un-committed.
+	 */
+	await put(
+		root,
+		".husky/pre-commit",
+		`#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
+# file so the COMMIT carries the ciphertext rather than what you staged.
+# Encryption needs only the public key in that file, so this needs no
+# credential and works on a fresh clone.
+#
+# It refuses only when it cannot fix the problem itself: no key yet
+# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
+# committed in the clear cannot be un-committed — the value stays in the
+# history and has to be treated as burned.
+bunx vc guard
+`,
+		result,
+		"regenerate",
+	);
+	/**
+	 * Pushing main IS the deploy, so this is the last moment anything is
+	 * checked by someone who can read the error.
+	 *
+	 * Everything the deploy needs is in the repository — that is the whole
+	 * point of keeping config in the environment — so the check needs no
+	 * credentials and runs anywhere. It asks the questions CI cannot answer
+	 * until it is too late to matter: is every required key actually SET
+	 * rather than merely declared, is anything committed in the clear, do the
+	 * hostnames match the manifest, is a migration missing.
+	 *
+	 * Only for main. Pushing a branch is not a deploy, and gating it would
+	 * teach people to reach for --no-verify, which turns the gate off for the
+	 * push that does matter.
+	 */
+	await put(
+		root,
+		".husky/pre-push",
+		`#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Pushing main deploys this shop, so the same checks the deploy would make
+# run here first — where you can read the error and fix it, rather than in a
+# build log after the shop is already updating.
+#
+# Needs no credentials: it reads only what is committed.
+# To push anyway, deliberately: git push --no-verify
+
+while read -r _local_ref _local_sha remote_ref _remote_sha; do
+  case "$remote_ref" in
+    refs/heads/main|refs/heads/master)
+      echo "vc: main is the deploy branch — checking what you are about to publish"
+      bunx vc preflight --repo || exit 1
+      ;;
+  esac
+done
+`,
+		result,
+		"regenerate",
+	);
+}
+
 export async function generate(root: string, manifest: Manifest): Promise<GenerateResult> {
 	const result: GenerateResult = { written: [], kept: [], retired: [], packages: packagesOf(manifest) };
 
@@ -218,6 +294,7 @@ export async function generate(root: string, manifest: Manifest): Promise<Genera
 			await generateStrictApp(root, STRICT_APP, manifest, result);
 			break;
 	}
+	await generateHooks(root, result);
 	return result;
 }
 
@@ -424,31 +501,6 @@ async function generateStrictRoot(root: string, manifest: Manifest, result: Gene
 		"own",
 	);
 	await put(root, "patches/void@0.10.13.patch", renderVoidPatch(), result, "regenerate");
-	/**
-	 * The hook lives in `.husky/`, which is COMMITTED, so the guard travels
-	 * with the repository instead of being something each clone remembers to
-	 * install. A secret committed in the clear cannot be un-committed.
-	 */
-	await put(
-		root,
-		".husky/pre-commit",
-		`#!/usr/bin/env sh
-# Generated by \`vc init\`.
-#
-# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
-# file so the COMMIT carries the ciphertext rather than what you staged.
-# Encryption needs only the public key in that file, so this needs no
-# credential and works on a fresh clone.
-#
-# It refuses only when it cannot fix the problem itself: no key yet
-# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
-# committed in the clear cannot be un-committed — the value stays in the
-# history and has to be treated as burned.
-bunx vc guard
-`,
-		result,
-		"regenerate",
-	);
 	await put(root, ".github/workflows/deploy.yml", renderDistWorkflow(manifest), result, "regenerate");
 	// Renamed when GitHub Actions took over the deploy from Cloudflare's own
 	// build. Two workflows on the same push would deploy the shop twice.