@saastemly/voidcommerce 0.2.2 → 0.3.0

package/dist/cli.js

@@ -1,4 +1,6 @@
 import {
+  PRIVATE_KEY_VAR,
+  SECRETS_FILE,
   box,
   captureVoid,
   deployCloudflare,
@@ -20,9 +22,10 @@ import {
   row,
   runInherit,
   runVoid,
+  secretsCommand,
   version,
   voidAppsIn
-} from "./index-sbchkpa6.js";
+} from "./index-84wq4qp8.js";
 import {
   LAYOUTS,
   readManifest,
@@ -113,6 +116,35 @@ async function preflightHelp() {
   ], width));
   return 0;
 }
+async function secretsCliCommand(args) {
+  const project = await findProject();
+  if (!project) {
+    console.error("vc: no voidcommerce.json here.");
+    return 1;
+  }
+  return secretsCommand(project, args);
+}
+async function secretsHelp() {
+  const width = 80;
+  console.log(box("vc secrets", [
+    line(`Secrets that live in the repository, encrypted, in ${SECRETS_FILE}.`, width),
+    line("", width),
+    ...row("vc secrets", "what this shop needs, and whether it is declared and encrypted", width, 2),
+    ...row("vc secrets --init", `write ${SECRETS_FILE} with every required key as \`unset\``, width, 2),
+    ...row(`dotenvx set KEY '…' -f ${SECRETS_FILE}`, "set one, without decrypting the file", width, 2),
+    ...row(`dotenvx encrypt -f ${SECRETS_FILE}`, "encrypt anything still in the clear", width, 2),
+    line("", width),
+    line("The file is COMMITTED: values are ciphertext, key names are not, so a", width),
+    line("diff shows which secret changed without showing what it changed to.", width),
+    line(`The private key stays out — .env.keys locally, and ${PRIVATE_KEY_VAR}`, width),
+    line("as one build variable where the deploy runs.", width),
+    line("", width),
+    line("Tradeoff worth knowing: ciphertext in git is permanent, so a leaked key", width),
+    line("exposes rotated secrets too. `wrangler secret put` does not have that", width),
+    line("property, and stays available for anything you would rather keep out.", width)
+  ], width));
+  return 0;
+}
 
 // src/init.ts
 import * as p2 from "@clack/prompts";
@@ -504,6 +536,7 @@ var EXTENDED = {
   import: { run: importCommand, help: importHelp },
   deploy: { run: deployCommand, help: deployHelp },
   preflight: { run: preflightCommand, help: preflightHelp },
+  secrets: { run: secretsCliCommand, help: secretsHelp },
   dev: { run: appScript("dev"), help: appScriptHelp("dev") },
   build: { run: appScript("build"), help: appScriptHelp("build") },
   preview: { run: appScript("preview"), help: appScriptHelp("preview") }

package/dist/deploy/cloudflare.d.ts

@@ -16,7 +16,9 @@ import type { Project } from "../project";
  *      secret-class key and every `unset` is removed from dist/ssr/wrangler.json
  *      before it is uploaded; the worker reads those from `wrangler secret`.
  *   6. apply the committed migrations to the remote D1
- *   7. wrangler deploy, on exactly the config that was scrubbed
+ *   7. decrypt the repository's own secrets, if it keeps any
+ *   8. wrangler deploy, on exactly the config that was scrubbed, carrying
+ *      those secrets up with the version
  */
 export interface CloudflareOptions {
     provision: boolean;

package/dist/deploy/index.d.ts

@@ -14,3 +14,6 @@ export declare function preflightCommand(args: string[]): Promise<number>;
 /** void's deploy help, then what vc adds. */
 export declare function deployHelp(): Promise<number>;
 export declare function preflightHelp(): Promise<number>;
+/** `vc secrets` — what the repository declares, and whether it is encrypted. */
+export declare function secretsCliCommand(args: string[]): Promise<number>;
+export declare function secretsHelp(): Promise<number>;

package/dist/deploy/preflight.d.ts

@@ -17,6 +17,8 @@ export interface Preflight {
     remote: Set<string> | null;
     missing: EnvKey[];
     routeProblem: string | null;
+    /** Names in `.env.secrets` whose value was committed unencrypted. */
+    bareSecrets: string[];
     ready: boolean;
 }
 export type SecretSource = "wrangler" | "void";

package/dist/deploy/secrets.d.ts

@@ -0,0 +1,68 @@
+import type { Project } from "../project";
+/**
+ * Secrets that live in the repository, encrypted.
+ *
+ * ── The problem this solves ──────────────────────────────────────────────
+ *
+ * A shop's secrets were set by hand, one `wrangler secret put` at a time,
+ * on a machine that happened to have them. Nothing in the repository said
+ * what the values WERE, only what they were called, so the shop could not
+ * be rebuilt from a checkout and a new deploy target needed somebody to
+ * remember. That is the last manual step between "push" and "live".
+ *
+ * dotenvx closes it. `.env.secrets` holds ciphertext and a public key, and
+ * it is COMMITTED: the key names are readable, the values are not, and a
+ * diff shows when a secret changed without showing what it changed to. The
+ * private key is the one thing that stays out — a single value, set once
+ * where the deploy runs.
+ *
+ * ── Why the values still become worker SECRETS ───────────────────────────
+ *
+ * The lazy version of this would decrypt at build time and let the values
+ * land in the worker's `vars`. That undoes the thing we built the scrub
+ * step for: `vars` are plaintext in the deployed configuration and readable
+ * by anyone with dashboard access. So the plaintext exists only inside the
+ * build, in a temp file, and goes up through `wrangler deploy
+ * --secrets-file`, which stores them as real secrets and — importantly —
+ * applies ADDITIVELY, so a secret this file does not name is left alone
+ * rather than deleted.
+ *
+ * ── The tradeoff, stated ─────────────────────────────────────────────────
+ *
+ * Ciphertext in git is permanent. If the private key ever leaks, every
+ * secret in the history is readable, including ones that were rotated —
+ * which is not true of `wrangler secret put`, where a rotation genuinely
+ * retires the old value. Rotating the dotenvx key re-encrypts the present,
+ * not the past. That is the price of a shop that rebuilds from a checkout,
+ * and it should be a decision rather than a surprise.
+ */
+export declare const SECRETS_FILE = ".env.secrets";
+export declare const PRIVATE_KEY_VAR = "DOTENV_PRIVATE_KEY_SECRETS";
+/** dotenvx, from the project's own install rather than a global one. */
+export declare function findDotenvx(from: string): string | null;
+/**
+ * The names a `.env.secrets` declares, read WITHOUT decrypting.
+ *
+ * dotenvx leaves keys in plaintext and encrypts only values, so preflight
+ * can say "all five are declared" on a machine that cannot read any of them.
+ */
+export declare function declaredSecretNames(root: string): Set<string>;
+/** Is a declared value actually encrypted, or was it committed in the clear? */
+export declare function plaintextSecretNames(root: string): string[];
+export interface DecryptedSecrets {
+    /** A temp file in `.env` format, for `wrangler deploy --secrets-file`. */
+    path: string;
+    names: string[];
+    cleanup: () => void;
+}
+/**
+ * Decrypt into a temp file the deploy can hand to wrangler.
+ *
+ * Written to disk rather than piped because that is what `--secrets-file`
+ * takes, and removed by `cleanup()` whatever happens next.
+ */
+export declare function decryptSecrets(project: Project): Promise<DecryptedSecrets | {
+    error: string;
+}>;
+/** `vc secrets` — what the repository declares, and whether it is readable here. */
+export declare function secretsCommand(project: Project, args: string[]): Promise<number>;