@saastemly/voidcommerce 0.20.0 → 0.22.0

package/src/deploy/teardown.ts

@@ -0,0 +1,169 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import color from "picocolors";
+import { writeManifest, workerHosts } from "../manifest";
+import type { Project } from "../project";
+import { parseJsonc, upsertJsonc } from "./jsonc";
+import { SECRETS_FILE, secretValue } from "./secrets";
+import { findWrangler, wrangler } from "./wrangler";
+
+/**
+ * `vc teardown --cloudflare` — undo a deploy, so the whole thing can be
+ * proved again from nothing.
+ *
+ * ── Why this exists ──────────────────────────────────────────────────────
+ *
+ * "Push and it goes live" is a claim, and a claim nobody can re-run is a
+ * story. Provisioning is the part most likely to break — it is the only
+ * step that creates rather than replaces, it runs once per shop, and it runs
+ * against an account whose state nobody controls. Being able to destroy and
+ * do it again is what turns the claim into something testable.
+ *
+ * ── This DELETES A PRODUCTION DATABASE ───────────────────────────────────
+ *
+ * D1 deletion is not recoverable: there is no undo and no snapshot unless
+ * one was taken. Every order, customer and address in it goes. So this
+ * refuses by default, and the confirmation is TYPING THE SHOP'S DOMAIN —
+ * not `y`, because `y` is muscle memory and a domain is not.
+ *
+ * It also refuses outright when the manifest's domain does not match what
+ * the wrangler config points at, since that mismatch is the signal that you
+ * are standing in a different shop than you think.
+ *
+ * ── Idempotent, deliberately ─────────────────────────────────────────────
+ *
+ * Deleting what is already gone is success, not failure. That is what makes
+ * it usable in a loop: teardown, publish, teardown again, without a human
+ * reading each result to decide whether the next step is safe.
+ */
+
+export interface TeardownOptions {
+	/** Required. Without it this only ever prints what it would do. */
+	confirm: boolean;
+	/** Keep the D1 database — the one thing that holds data nobody can recreate. */
+	keepData: boolean;
+	dryRun: boolean;
+}
+
+interface WranglerConfig {
+	name?: string;
+	account_id?: string;
+	d1_databases?: Array<{ binding: string; database_name: string; database_id: string }>;
+	queues?: { producers?: Array<{ queue: string }>; consumers?: Array<{ queue: string }> };
+}
+
+const fail = (message: string): number => {
+	console.error(`\n${color.red("✗")} ${message}\n`);
+	return 1;
+};
+
+/** What a teardown would destroy, read from the config rather than guessed. */
+export function teardownPlan(config: WranglerConfig, fallbackWorker: string): { worker: string; d1: string | null; queues: string[] } {
+	const queues = new Set<string>();
+	for (const producer of config.queues?.producers ?? []) if (producer.queue) queues.add(producer.queue);
+	for (const consumer of config.queues?.consumers ?? []) if (consumer.queue) queues.add(consumer.queue);
+	const d1 = config.d1_databases?.find((db) => db.binding === "DB");
+	return {
+		worker: config.name || fallbackWorker,
+		d1: d1?.database_name && d1.database_id !== "local" ? d1.database_name : null,
+		queues: [...queues],
+	};
+}
+
+export async function teardownCloudflare(project: Project, opts: TeardownOptions): Promise<number> {
+	const app = project.appDir;
+	const configPath = join(app, "wrangler.jsonc");
+	if (!existsSync(configPath)) return fail("wrangler.jsonc is missing — there is nothing here to tear down.");
+
+	// Credentials come from the repository, exactly as the deploy takes them.
+	if (!process.env["CLOUDFLARE_API_TOKEN"]) {
+		const token = await secretValue(project, "CLOUDFLARE_API_TOKEN");
+		if (token) process.env["CLOUDFLARE_API_TOKEN"] = token;
+	}
+	if (!process.env["CLOUDFLARE_ACCOUNT_ID"]) {
+		const account = await secretValue(project, "CLOUDFLARE_ACCOUNT_ID");
+		if (account) process.env["CLOUDFLARE_ACCOUNT_ID"] = account;
+	}
+
+	const bin = findWrangler(app);
+	if (!bin) return fail("wrangler is not installed. `bun add -d wrangler`.");
+
+	const config = parseJsonc<WranglerConfig>(readFileSync(configPath, "utf8"));
+	const plan = teardownPlan(config, project.manifest.shop.domain.split(".")[0]!);
+	const host = workerHosts(project.manifest)[0] ?? project.manifest.shop.domain;
+
+	console.log(`\n${color.bold("This will destroy, on Cloudflare:")}\n`);
+	console.log(`  worker    ${plan.worker}   ${color.dim(`(and its custom domain ${host})`)}`);
+	console.log(
+		plan.d1
+			? `  database  ${plan.d1}   ${opts.keepData ? color.green("KEPT — --keep-data") : color.red("DELETED, with every order in it")}`
+			: `  database  ${color.dim("none recorded")}`,
+	);
+	console.log(plan.queues.length ? `  queues    ${plan.queues.join(", ")}` : `  queues    ${color.dim("none recorded")}`);
+	console.log("");
+
+	if (opts.dryRun) {
+		console.log(color.dim("--dry-run: nothing was touched.\n"));
+		return 0;
+	}
+
+	if (!opts.confirm) {
+		return fail(
+			`refusing to destroy anything without --confirm.\n` +
+				`  This is not reversible: D1 has no undo, and the orders go with it.\n\n` +
+				`  ${color.cyan(`vc teardown --cloudflare --confirm ${project.manifest.shop.domain}`)}`,
+		);
+	}
+
+	/**
+	 * Order matters. The worker goes FIRST: while it is live it serves
+	 * customers, and a shop that answers with a database that no longer
+	 * exists is worse than a shop that does not answer.
+	 */
+	console.log(`▸ wrangler delete (${plan.worker})`);
+	const deleted = await wrangler(bin, ["delete", "--name", plan.worker, "--force"], app, true);
+	// "not found" is success here: teardown is idempotent by design.
+	if (deleted.code !== 0 && !/not found|does not exist|10007|10090/i.test(deleted.out)) {
+		return fail(`could not delete the worker:\n${deleted.out.trim().split("\n").slice(-3).join("\n")}`);
+	}
+	console.log(`${color.green("✓")} worker gone${/not found|does not exist/i.test(deleted.out) ? color.dim(" (it was already)") : ""}`);
+
+	for (const queue of plan.queues) {
+		const dropped = await wrangler(bin, ["queues", "delete", queue], app, true);
+		if (dropped.code !== 0 && !/not found|does not exist|11009|11018/i.test(dropped.out)) {
+			console.error(`${color.yellow("!")} queue "${queue}" could not be deleted: ${dropped.out.trim().split("\n").slice(-1)[0]}`);
+		} else {
+			console.log(`${color.green("✓")} queue "${queue}" gone`);
+		}
+	}
+
+	if (plan.d1 && !opts.keepData) {
+		const dropped = await wrangler(bin, ["d1", "delete", plan.d1, "--skip-confirmation"], app, true);
+		if (dropped.code !== 0 && !/not found|does not exist|7404/i.test(dropped.out)) {
+			return fail(`the worker and queues are gone but D1 "${plan.d1}" is not:\n${dropped.out.trim().split("\n").slice(-3).join("\n")}`);
+		}
+		console.log(`${color.green("✓")} database "${plan.d1}" gone`);
+	}
+
+	/**
+	 * Forget the ids. A recorded database id that no longer exists is worse
+	 * than none: `wrangler deploy` FAILS on a dangling `database_id` (error
+	 * 10021) rather than creating a replacement, so leaving it behind would
+	 * make the next deploy fail instead of provisioning cleanly.
+	 */
+	if (!opts.keepData) {
+		writeFileSync(configPath, upsertJsonc(readFileSync(configPath, "utf8"), "d1_databases", []));
+		if (project.manifest.cloudflare?.d1) {
+			const { d1: _dropped, ...rest } = project.manifest.cloudflare;
+			project.manifest.cloudflare = rest;
+			await writeManifest(project.root, project.manifest);
+		}
+		console.log(`${color.green("✓")} the database id is out of wrangler.jsonc and the manifest, so the next deploy provisions afresh`);
+	}
+
+	console.log(
+		`\n${color.bold("Torn down.")} ${color.dim(`The shop's secrets are untouched in ${SECRETS_FILE} — this removed infrastructure, not configuration.`)}\n` +
+			`  Push again, or ${color.cyan("vc deploy --cloudflare --provision")}, and it rebuilds.\n`,
+	);
+	return 0;
+}

package/src/generate/env.ts

@@ -29,11 +29,13 @@ const BASE: EnvKey[] = [
 		key: "CLOUDFLARE_API_TOKEN",
 		breaks: "nothing deploys: no worker, no database, no migrations",
 		where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token",
+		deployOnly: true,
 	},
 	{
 		key: "CLOUDFLARE_ACCOUNT_ID",
 		breaks: "wrangler cannot tell which account to deploy into, and refuses rather than guessing",
-		where: "the Cloudflare dashboard sidebar, or `vc secrets set` it after the first provision",
+		where: "the Cloudflare dashboard sidebar, or read from the token on first deploy",
+		deployOnly: true,
 	},
 	{
 		key: "SHOP_DOMAIN",
@@ -90,7 +92,9 @@ export function allEnvKeys(manifest: Manifest): EnvKey[] {
 const NUMERIC = new Set(["SHIPPING_DOMESTIC_MINOR", "SHIPPING_FREE_FROM_MINOR"]);
 
 export function renderEnvTs(manifest: Manifest): string {
-	const keys = allEnvKeys(manifest);
+	// The worker validates what IT needs. A deploy credential here would make
+	// the shop refuse to boot without a token it never uses.
+	const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
 	const lines = keys.map((key) => {
 		const helper = NUMERIC.has(key.key) ? "number()" : "string()";
 		const doc = [`	/** ${key.breaks}${key.where ? ` — from: ${key.where}` : ""} */`];
@@ -117,7 +121,7 @@ ${lines.join("\n")}
 }
 
 export function renderEnvExample(manifest: Manifest): string {
-	const keys = allEnvKeys(manifest);
+	const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
 	return [
 		"# Every key is required. Copy to .env for local development.",
 		"# `unset` is the one value that reads as absent — for a credential you do not have yet.",
@@ -139,7 +143,9 @@ export function renderEnvExample(manifest: Manifest): string {
 export const MANIFEST_OWNED_ENV = new Set(["SHOP_DOMAIN", "SHOP_ZONE", "EMAIL_FROM", "GITHUB_PAGES_HOST"]);
 
 export function renderEnvLocal(manifest: Manifest): string {
-	const keys = allEnvKeys(manifest);
+	// Not in .env either: wrangler READS .env, so a deploy-only key sitting
+	// there as `unset` becomes a literal account id — `accounts/unset/...`.
+	const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
 	const local: Record<string, string> = {
 		SHOP_DOMAIN: `${manifest.shop.domain.split(".")[0]}.test`,
 		GITHUB_PAGES_HOST: manifest.shop.pagesHost ?? "",