@saastemly/voidcommerce 0.2.2 → 0.4.0

package/dist/catalog.js

@@ -14,7 +14,8 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-z4qazajn.js";
+} from "./index-844b3qn9.js";
+import"./index-0v6na3yp.js";
 export {
   UI,
   TAX,

package/dist/cli.js

@@ -1,4 +1,6 @@
 import {
+  PRIVATE_KEY_VAR,
+  SECRETS_FILE,
   box,
   captureVoid,
   deployCloudflare,
@@ -14,24 +16,28 @@ import {
   importHelp,
   initHelp,
   isVoidApp,
+  keysCommand,
   line,
+  plaintextSecretNames,
   preflight,
   printPreflight,
   row,
   runInherit,
   runVoid,
+  secretsCommand,
   version,
   voidAppsIn
-} from "./index-sbchkpa6.js";
+} from "./index-yzezvy5h.js";
 import {
   LAYOUTS,
   readManifest,
   validate,
   zoneOf
-} from "./index-zh3tmj08.js";
+} from "./index-pz6m2hkm.js";
 import {
   GROUPS
-} from "./index-z4qazajn.js";
+} from "./index-844b3qn9.js";
+import"./index-0v6na3yp.js";
 
 // src/deploy/index.ts
 import color from "picocolors";
@@ -113,6 +119,81 @@ async function preflightHelp() {
   ], width));
   return 0;
 }
+async function secretsCliCommand(args) {
+  const project = await findProject();
+  if (!project) {
+    console.error("vc: no voidcommerce.json here.");
+    return 1;
+  }
+  return secretsCommand(project, args);
+}
+async function secretsHelp() {
+  const width = 80;
+  console.log(box("vc secrets", [
+    line(`Secrets that live in the repository, encrypted, in ${SECRETS_FILE}.`, width),
+    line("", width),
+    ...row("vc secrets", "what this shop needs, and whether it is declared and encrypted", width, 2),
+    ...row("vc secrets --init", `write ${SECRETS_FILE} with every required key as \`unset\``, width, 2),
+    ...row(`dotenvx set KEY '…' -f ${SECRETS_FILE}`, "set one, without decrypting the file", width, 2),
+    ...row(`dotenvx encrypt -f ${SECRETS_FILE}`, "encrypt anything still in the clear", width, 2),
+    line("", width),
+    line("The file is COMMITTED: values are ciphertext, key names are not, so a", width),
+    line("diff shows which secret changed without showing what it changed to.", width),
+    line(`The private key stays out — .env.keys locally, and ${PRIVATE_KEY_VAR}`, width),
+    line("as one build variable where the deploy runs.", width),
+    line("", width),
+    line("Tradeoff worth knowing: ciphertext in git is permanent, so a leaked key", width),
+    line("exposes rotated secrets too. `wrangler secret put` does not have that", width),
+    line("property, and stays available for anything you would rather keep out.", width)
+  ], width));
+  return 0;
+}
+async function keysCliCommand(args) {
+  const project = await findProject();
+  if (!project) {
+    console.error("vc: no voidcommerce.json here.");
+    return 1;
+  }
+  return keysCommand(project.manifest, project.root, args);
+}
+async function keysHelp() {
+  const width = 80;
+  console.log(box("vc keys", [
+    line("The key that encrypts this repository's secrets is DERIVED from", width),
+    line("CLOUDFLARE_API_TOKEN, salted with the account id. Nothing is stored.", width),
+    line("", width),
+    ...row("vc keys", "what this token derives, and whether it matches the repository", width, 2),
+    ...row("vc keys --rotate", "re-encrypt under a new token, while the old one still works", width, 2),
+    line("", width),
+    line("Whoever can deploy the worker can read its secrets, and nobody else can.", width),
+    line("The price: rotating the token orphans every encrypted value, a second", width),
+    line("admin's token derives a different key, and the build must use the same", width),
+    line("token the values were encrypted under. `vc keys` checks the derived", width),
+    line("public key against the committed one, so a mismatch is a clear refusal", width),
+    line("rather than a decryption error nobody can place.", width)
+  ], width));
+  return 0;
+}
+async function guardCommand() {
+  const project = await findProject();
+  if (!project)
+    return 0;
+  const bare = plaintextSecretNames(project.root);
+  if (bare.length === 0)
+    return 0;
+  console.error(`
+${color.red("✗ refusing the commit")}: ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE} ${bare.length === 1 ? "is" : "are"} not encrypted.
+
+` + `    ${bare.join(`
+    `)}
+
+` + `  bunx dotenvx encrypt -f ${SECRETS_FILE}
+
+` + color.dim(`  Committing a secret in the clear cannot be undone by a later commit;
+  the value stays in the history and must be treated as burned.
+`));
+  return 1;
+}
 
 // src/init.ts
 import * as p2 from "@clack/prompts";
@@ -504,6 +585,9 @@ var EXTENDED = {
   import: { run: importCommand, help: importHelp },
   deploy: { run: deployCommand, help: deployHelp },
   preflight: { run: preflightCommand, help: preflightHelp },
+  secrets: { run: secretsCliCommand, help: secretsHelp },
+  keys: { run: keysCliCommand, help: keysHelp },
+  guard: { run: guardCommand, help: async () => guardCommand() },
   dev: { run: appScript("dev"), help: appScriptHelp("dev") },
   build: { run: appScript("build"), help: appScriptHelp("build") },
   preview: { run: appScript("preview"), help: appScriptHelp("preview") }

package/dist/deploy/cloudflare.d.ts

@@ -16,7 +16,9 @@ import type { Project } from "../project";
  *      secret-class key and every `unset` is removed from dist/ssr/wrangler.json
  *      before it is uploaded; the worker reads those from `wrangler secret`.
  *   6. apply the committed migrations to the remote D1
- *   7. wrangler deploy, on exactly the config that was scrubbed
+ *   7. decrypt the repository's own secrets, if it keeps any
+ *   8. wrangler deploy, on exactly the config that was scrubbed, carrying
+ *      those secrets up with the version
  */
 export interface CloudflareOptions {
     provision: boolean;

package/dist/deploy/index.d.ts

@@ -14,3 +14,15 @@ export declare function preflightCommand(args: string[]): Promise<number>;
 /** void's deploy help, then what vc adds. */
 export declare function deployHelp(): Promise<number>;
 export declare function preflightHelp(): Promise<number>;
+/** `vc secrets` — what the repository declares, and whether it is encrypted. */
+export declare function secretsCliCommand(args: string[]): Promise<number>;
+export declare function secretsHelp(): Promise<number>;
+/** `vc keys` — what the token derives, and the warning that goes with it. */
+export declare function keysCliCommand(args: string[]): Promise<number>;
+export declare function keysHelp(): Promise<number>;
+/**
+ * The pre-commit gate: refuse a commit that would put a secret in the clear.
+ *
+ * Exit code is the whole interface — a hook cares about nothing else.
+ */
+export declare function guardCommand(): Promise<number>;

package/dist/deploy/keys.d.ts

@@ -0,0 +1,34 @@
+import type { Manifest } from "../manifest";
+/** Where the token comes from, in the order wrangler itself reads them. */
+export declare function apiToken(): string | null;
+/**
+ * The private key this token and account derive.
+ *
+ * The account id is the salt rather than a constant, so the same token used
+ * against two accounts does not produce one key — tokens are often scoped to
+ * several accounts, and a shared key across them would be a wider blast
+ * radius than anyone asked for.
+ */
+export declare function derivePrivateKey(token: string, accountId: string): string;
+/** The public key for a private one, via dotenvx's own primitive. */
+export declare function publicKeyFor(privateKey: string): Promise<string | null>;
+/** The public key the repository was actually encrypted under. */
+export declare function committedPublicKey(root: string): string | null;
+export type KeyState = {
+    ok: true;
+    privateKey: string;
+    publicKey: string;
+    fresh: boolean;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The key for this repository, or a refusal that says exactly what is wrong.
+ *
+ * `fresh` means the repository has no secrets yet, so there is nothing to
+ * check the derivation against and any token is as good as another.
+ */
+export declare function keyFor(manifest: Manifest, root: string): Promise<KeyState>;
+/** `vc keys` — what the derivation says, without printing anything secret. */
+export declare function keysCommand(manifest: Manifest, root: string, args: string[]): Promise<number>;

package/dist/deploy/preflight.d.ts

@@ -17,6 +17,8 @@ export interface Preflight {
     remote: Set<string> | null;
     missing: EnvKey[];
     routeProblem: string | null;
+    /** Names in `.env.secrets` whose value was committed unencrypted. */
+    bareSecrets: string[];
     ready: boolean;
 }
 export type SecretSource = "wrangler" | "void";

package/dist/deploy/secrets.d.ts

@@ -0,0 +1,74 @@
+import type { Project } from "../project";
+/**
+ * Secrets that live in the repository, encrypted.
+ *
+ * ── The problem this solves ──────────────────────────────────────────────
+ *
+ * A shop's secrets were set by hand, one `wrangler secret put` at a time,
+ * on a machine that happened to have them. Nothing in the repository said
+ * what the values WERE, only what they were called, so the shop could not
+ * be rebuilt from a checkout and a new deploy target needed somebody to
+ * remember. That is the last manual step between "push" and "live".
+ *
+ * dotenvx closes it. `.env.secrets` holds ciphertext and a public key, and
+ * it is COMMITTED: the key names are readable, the values are not, and a
+ * diff shows when a secret changed without showing what it changed to. The
+ * private key is not stored at all — it is derived from the Cloudflare API
+ * token, so whoever can deploy the worker can read its secrets and nobody
+ * else can. See `./keys.ts`, which also spells out what that costs.
+ *
+ * ── Why the values still become worker SECRETS ───────────────────────────
+ *
+ * The lazy version of this would decrypt at build time and let the values
+ * land in the worker's `vars`. That undoes the thing we built the scrub
+ * step for: `vars` are plaintext in the deployed configuration and readable
+ * by anyone with dashboard access. So the plaintext exists only inside the
+ * build, in a temp file, and goes up through `wrangler deploy
+ * --secrets-file`, which stores them as real secrets and — importantly —
+ * applies ADDITIVELY, so a secret this file does not name is left alone
+ * rather than deleted.
+ *
+ * ── The tradeoffs, stated ────────────────────────────────────────────────
+ *
+ * Ciphertext in git is permanent. A key that ever leaks reads every secret
+ * in the history, including ones that were rotated — which is not true of
+ * `wrangler secret put`, where a rotation genuinely retires the old value.
+ *
+ * And because the key is derived, rotating the API token orphans the lot.
+ * `keys.ts` guards that with a public-key check, so the failure is a clear
+ * refusal rather than a decryption error nobody can place — but the guard
+ * cannot recover values, only explain them.
+ *
+ * Both are the price of a shop that rebuilds from a checkout, and both
+ * should be decisions rather than surprises.
+ */
+export declare const SECRETS_FILE = ".env.secrets";
+export declare const PRIVATE_KEY_VAR = "DOTENV_PRIVATE_KEY_SECRETS";
+/** dotenvx, from the project's own install rather than a global one. */
+export declare function findDotenvx(from: string): string | null;
+/**
+ * The names a `.env.secrets` declares, read WITHOUT decrypting.
+ *
+ * dotenvx leaves keys in plaintext and encrypts only values, so preflight
+ * can say "all five are declared" on a machine that cannot read any of them.
+ */
+export declare function declaredSecretNames(root: string): Set<string>;
+/** Is a declared value actually encrypted, or was it committed in the clear? */
+export declare function plaintextSecretNames(root: string): string[];
+export interface DecryptedSecrets {
+    /** A temp file in `.env` format, for `wrangler deploy --secrets-file`. */
+    path: string;
+    names: string[];
+    cleanup: () => void;
+}
+/**
+ * Decrypt into a temp file the deploy can hand to wrangler.
+ *
+ * Written to disk rather than piped because that is what `--secrets-file`
+ * takes, and removed by `cleanup()` whatever happens next.
+ */
+export declare function decryptSecrets(project: Project): Promise<DecryptedSecrets | {
+    error: string;
+}>;
+/** `vc secrets` — what the repository declares, and whether it is readable here. */
+export declare function secretsCommand(project: Project, args: string[]): Promise<number>;

package/dist/index-0v6na3yp.js

@@ -0,0 +1,35 @@
+import { createRequire } from "node:module";
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+export { __toESM, __commonJS, __require };

package/dist/{index-z4qazajn.js → index-844b3qn9.js}

@@ -1,6 +1,3 @@
-import { createRequire } from "node:module";
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-
 // src/catalog.ts
 var SIGN_IN = {
   id: "signIn",
@@ -586,4 +583,4 @@ var GROUPS = [
 ];
 var CHOICES = new Map(GROUPS.flatMap((group) => group.choices.map((choice) => [choice.id, choice])));
 
-export { __require, SIGN_IN, AUTH_PLUGINS, COMMERCE_CATALOG, COMMERCE_SALES, COMMERCE_OPERATIONS, PAYMENT, TAX, CARRIERS, ERP, EMAIL, DNS, CONTENT, UI, GROUPS, CHOICES };
+export { SIGN_IN, AUTH_PLUGINS, COMMERCE_CATALOG, COMMERCE_SALES, COMMERCE_OPERATIONS, PAYMENT, TAX, CARRIERS, ERP, EMAIL, DNS, CONTENT, UI, GROUPS, CHOICES };