@saastemly/voidcommerce 0.21.0 → 0.22.1

package/dist/catalog.d.ts

@@ -24,6 +24,19 @@ export interface EnvKey {
     dev?: string | undefined;
     /** Where the real value comes from. */
     where?: string | undefined;
+    /**
+     * Needed to DEPLOY the shop, not to run it.
+     *
+     * The Cloudflare credentials are the case. They belong in `.env.secrets`
+     * so a push carries them, and preflight must insist on them — but the
+     * worker has no business seeing one. Left unmarked they ended up in three
+     * wrong places at once: `env.ts`, so the worker refused to boot without a
+     * deploy token; `.env`, where wrangler read `CLOUDFLARE_ACCOUNT_ID=unset`
+     * and addressed `accounts/unset/...`; and `--secrets-file`, which would
+     * have uploaded the deploy credential INTO the worker for any code
+     * running there to read.
+     */
+    deployOnly?: boolean | undefined;
 }
 export interface Choice {
     id: string;

package/dist/cli.js

@@ -25,7 +25,7 @@ import {
   version,
   voidAppsIn,
   wrangler
-} from "./index-pghh8nnq.js";
+} from "./index-51zee2vf.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -40,7 +40,7 @@ import {
   run,
   secretValue,
   secretsCommand
-} from "./index-940vpkwa.js";
+} from "./index-t1ggktg8.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -126,7 +126,7 @@ ${color.bold("This will destroy, on Cloudflare:")}
 ` + `  ${color.cyan(`vc teardown --cloudflare --confirm ${project.manifest.shop.domain}`)}`);
   }
   console.log(`▸ wrangler delete (${plan.worker})`);
-  const deleted = await wrangler(bin, ["delete", "--name", plan.worker, "--force"], app, true);
+  const deleted = await wrangler(bin, ["delete", "--name", plan.worker, "--force"], app);
   if (deleted.code !== 0 && !/not found|does not exist|10007|10090/i.test(deleted.out)) {
     return fail(`could not delete the worker:
 ${deleted.out.trim().split(`
@@ -135,7 +135,7 @@ ${deleted.out.trim().split(`
   }
   console.log(`${color.green("✓")} worker gone${/not found|does not exist/i.test(deleted.out) ? color.dim(" (it was already)") : ""}`);
   for (const queue of plan.queues) {
-    const dropped = await wrangler(bin, ["queues", "delete", queue], app, true);
+    const dropped = await wrangler(bin, ["queues", "delete", queue], app);
     if (dropped.code !== 0 && !/not found|does not exist|11009|11018/i.test(dropped.out)) {
       console.error(`${color.yellow("!")} queue "${queue}" could not be deleted: ${dropped.out.trim().split(`
 `).slice(-1)[0]}`);
@@ -144,7 +144,7 @@ ${deleted.out.trim().split(`
     }
   }
   if (plan.d1 && !opts.keepData) {
-    const dropped = await wrangler(bin, ["d1", "delete", plan.d1, "--skip-confirmation"], app, true);
+    const dropped = await wrangler(bin, ["d1", "delete", plan.d1, "--skip-confirmation"], app);
     if (dropped.code !== 0 && !/not found|does not exist|7404/i.test(dropped.out)) {
       return fail(`the worker and queues are gone but D1 "${plan.d1}" is not:
 ${dropped.out.trim().split(`

package/dist/{index-pghh8nnq.js → index-51zee2vf.js}

@@ -13,7 +13,7 @@ import {
   renderEnvTs,
   secretValue,
   unsetSecretNames
-} from "./index-940vpkwa.js";
+} from "./index-t1ggktg8.js";
 import {
   MANIFEST_FILE,
   has,
@@ -1383,7 +1383,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.21.0",
+  version: "0.22.1",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",

package/dist/{index-940vpkwa.js → index-t1ggktg8.js}

@@ -118,12 +118,14 @@ var BASE = [
   {
     key: "CLOUDFLARE_API_TOKEN",
     breaks: "nothing deploys: no worker, no database, no migrations",
-    where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token"
+    where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token",
+    deployOnly: true
   },
   {
     key: "CLOUDFLARE_ACCOUNT_ID",
     breaks: "wrangler cannot tell which account to deploy into, and refuses rather than guessing",
-    where: "the Cloudflare dashboard sidebar, or `vc secrets set` it after the first provision"
+    where: "the Cloudflare dashboard sidebar, or read from the token on first deploy",
+    deployOnly: true
   },
   {
     key: "SHOP_DOMAIN",
@@ -174,7 +176,7 @@ function allEnvKeys(manifest) {
 }
 var NUMERIC = new Set(["SHIPPING_DOMESTIC_MINOR", "SHIPPING_FREE_FROM_MINOR"]);
 function renderEnvTs(manifest) {
-  const keys = allEnvKeys(manifest);
+  const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
   const lines = keys.map((key) => {
     const helper = NUMERIC.has(key.key) ? "number()" : "string()";
     const doc = [`	/** ${key.breaks}${key.where ? ` — from: ${key.where}` : ""} */`];
@@ -203,7 +205,7 @@ ${lines.join(`
 `;
 }
 function renderEnvExample(manifest) {
-  const keys = allEnvKeys(manifest);
+  const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
   return [
     "# Every key is required. Copy to .env for local development.",
     "# `unset` is the one value that reads as absent — for a credential you do not have yet.",
@@ -215,7 +217,7 @@ function renderEnvExample(manifest) {
 }
 var MANIFEST_OWNED_ENV = new Set(["SHOP_DOMAIN", "SHOP_ZONE", "EMAIL_FROM", "GITHUB_PAGES_HOST"]);
 function renderEnvLocal(manifest) {
-  const keys = allEnvKeys(manifest);
+  const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
   const local = {
     SHOP_DOMAIN: `${manifest.shop.domain.split(".")[0]}.test`,
     GITHUB_PAGES_HOST: manifest.shop.pagesHost ?? "",
@@ -370,7 +372,7 @@ async function decryptSecrets(project) {
   const root = project.root;
   if (!existsSync2(join2(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const { localPrivateKey } = await import("./keys-mewxnkwg.js");
+  const { localPrivateKey } = await import("./keys-1h4zpvd7.js");
   const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
   if (!privateKey) {
     return {
@@ -382,7 +384,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-mewxnkwg.js");
+    const { publicKeyFor } = await import("./keys-1h4zpvd7.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -402,8 +404,13 @@ async function decryptSecrets(project) {
   if (result.code !== 0)
     return { error: `dotenvx could not decrypt ${SECRETS_FILE}: ${result.out.trim().split(`
 `).slice(-2).join(" ")}` };
+  const deployOnly = new Set(allEnvKeys(project.manifest).filter((key) => key.deployOnly).map((key) => key.key));
   const lines = result.out.split(`
-`).filter((line) => /^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) && !line.trimStart().startsWith("DOTENV_"));
+`).filter((line) => {
+    if (!/^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) || line.trimStart().startsWith("DOTENV_"))
+      return false;
+    return !deployOnly.has(line.slice(0, line.indexOf("=")).trim());
+  });
   const names = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
   const path = join2(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
   writeFileSync(path, `${lines.join(`
@@ -725,7 +732,7 @@ vc: no ${SECRETS_FILE} here — \`vc secrets --init\` starts a fresh one.
 `);
     return 1;
   }
-  const { localPrivateKey, publicKeyFor, generateKeypair } = await import("./keys-mewxnkwg.js");
+  const { localPrivateKey, publicKeyFor, generateKeypair } = await import("./keys-1h4zpvd7.js");
   const current = committedPublicKey(root);
   const mine = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root);
   if (mine && current && (await publicKeyFor(mine))?.toLowerCase() === current.toLowerCase()) {

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-pghh8nnq.js";
+} from "./index-51zee2vf.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-940vpkwa.js";
+} from "./index-t1ggktg8.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/dist/{keys-mewxnkwg.js → keys-1h4zpvd7.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-940vpkwa.js";
+} from "./index-t1ggktg8.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.21.0",
+  "version": "0.22.1",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/catalog.ts

@@ -25,6 +25,19 @@ export interface EnvKey {
 	dev?: string | undefined;
 	/** Where the real value comes from. */
 	where?: string | undefined;
+	/**
+	 * Needed to DEPLOY the shop, not to run it.
+	 *
+	 * The Cloudflare credentials are the case. They belong in `.env.secrets`
+	 * so a push carries them, and preflight must insist on them — but the
+	 * worker has no business seeing one. Left unmarked they ended up in three
+	 * wrong places at once: `env.ts`, so the worker refused to boot without a
+	 * deploy token; `.env`, where wrangler read `CLOUDFLARE_ACCOUNT_ID=unset`
+	 * and addressed `accounts/unset/...`; and `--secrets-file`, which would
+	 * have uploaded the deploy credential INTO the worker for any code
+	 * running there to read.
+	 */
+	deployOnly?: boolean | undefined;
 }
 
 export interface Choice {

package/src/deploy/secrets.ts

@@ -242,11 +242,21 @@ export async function decryptSecrets(project: Project): Promise<DecryptedSecrets
 	});
 	if (result.code !== 0) return { error: `dotenvx could not decrypt ${SECRETS_FILE}: ${result.out.trim().split("\n").slice(-2).join(" ")}` };
 
-	// Keep only the shop's own keys: dotenvx echoes the public key back, and
-	// it has no business being a worker secret.
-	const lines = result.out
-		.split("\n")
-		.filter((line) => /^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) && !line.trimStart().startsWith("DOTENV_"));
+	/**
+	 * Keep only the secrets the WORKER needs.
+	 *
+	 * dotenvx echoes its own public key back, which has no business being a
+	 * worker secret. And the deploy-only keys are the important exclusion:
+	 * `--secrets-file` uploads what it is given, so leaving CLOUDFLARE_API_TOKEN
+	 * in here would put the credential that can deploy, delete and re-create
+	 * this shop INSIDE the shop, readable by any code running in the worker.
+	 * A compromised dependency would have found it there.
+	 */
+	const deployOnly = new Set(allEnvKeys(project.manifest).filter((key) => key.deployOnly).map((key) => key.key));
+	const lines = result.out.split("\n").filter((line) => {
+		if (!/^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) || line.trimStart().startsWith("DOTENV_")) return false;
+		return !deployOnly.has(line.slice(0, line.indexOf("=")).trim());
+	});
 	const names = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
 
 	const path = join(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);

package/src/deploy/teardown.ts

@@ -116,12 +116,18 @@ export async function teardownCloudflare(project: Project, opts: TeardownOptions
 	}
 
 	/**
+	 * Every call CAPTURES its output rather than streaming it, because
+	 * idempotency depends on reading what wrangler said. `wrangler(..., true)`
+	 * inherits stdio, which leaves `out` empty — so "this worker does not
+	 * exist" could never be recognised and a second teardown failed where it
+	 * should have been a no-op.
+	 *
 	 * Order matters. The worker goes FIRST: while it is live it serves
 	 * customers, and a shop that answers with a database that no longer
 	 * exists is worse than a shop that does not answer.
 	 */
 	console.log(`▸ wrangler delete (${plan.worker})`);
-	const deleted = await wrangler(bin, ["delete", "--name", plan.worker, "--force"], app, true);
+	const deleted = await wrangler(bin, ["delete", "--name", plan.worker, "--force"], app);
 	// "not found" is success here: teardown is idempotent by design.
 	if (deleted.code !== 0 && !/not found|does not exist|10007|10090/i.test(deleted.out)) {
 		return fail(`could not delete the worker:\n${deleted.out.trim().split("\n").slice(-3).join("\n")}`);
@@ -129,7 +135,7 @@ export async function teardownCloudflare(project: Project, opts: TeardownOptions
 	console.log(`${color.green("✓")} worker gone${/not found|does not exist/i.test(deleted.out) ? color.dim(" (it was already)") : ""}`);
 
 	for (const queue of plan.queues) {
-		const dropped = await wrangler(bin, ["queues", "delete", queue], app, true);
+		const dropped = await wrangler(bin, ["queues", "delete", queue], app);
 		if (dropped.code !== 0 && !/not found|does not exist|11009|11018/i.test(dropped.out)) {
 			console.error(`${color.yellow("!")} queue "${queue}" could not be deleted: ${dropped.out.trim().split("\n").slice(-1)[0]}`);
 		} else {
@@ -138,7 +144,7 @@ export async function teardownCloudflare(project: Project, opts: TeardownOptions
 	}
 
 	if (plan.d1 && !opts.keepData) {
-		const dropped = await wrangler(bin, ["d1", "delete", plan.d1, "--skip-confirmation"], app, true);
+		const dropped = await wrangler(bin, ["d1", "delete", plan.d1, "--skip-confirmation"], app);
 		if (dropped.code !== 0 && !/not found|does not exist|7404/i.test(dropped.out)) {
 			return fail(`the worker and queues are gone but D1 "${plan.d1}" is not:\n${dropped.out.trim().split("\n").slice(-3).join("\n")}`);
 		}

package/src/generate/env.ts

@@ -29,11 +29,13 @@ const BASE: EnvKey[] = [
 		key: "CLOUDFLARE_API_TOKEN",
 		breaks: "nothing deploys: no worker, no database, no migrations",
 		where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token",
+		deployOnly: true,
 	},
 	{
 		key: "CLOUDFLARE_ACCOUNT_ID",
 		breaks: "wrangler cannot tell which account to deploy into, and refuses rather than guessing",
-		where: "the Cloudflare dashboard sidebar, or `vc secrets set` it after the first provision",
+		where: "the Cloudflare dashboard sidebar, or read from the token on first deploy",
+		deployOnly: true,
 	},
 	{
 		key: "SHOP_DOMAIN",
@@ -90,7 +92,9 @@ export function allEnvKeys(manifest: Manifest): EnvKey[] {
 const NUMERIC = new Set(["SHIPPING_DOMESTIC_MINOR", "SHIPPING_FREE_FROM_MINOR"]);
 
 export function renderEnvTs(manifest: Manifest): string {
-	const keys = allEnvKeys(manifest);
+	// The worker validates what IT needs. A deploy credential here would make
+	// the shop refuse to boot without a token it never uses.
+	const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
 	const lines = keys.map((key) => {
 		const helper = NUMERIC.has(key.key) ? "number()" : "string()";
 		const doc = [`	/** ${key.breaks}${key.where ? ` — from: ${key.where}` : ""} */`];
@@ -117,7 +121,7 @@ ${lines.join("\n")}
 }
 
 export function renderEnvExample(manifest: Manifest): string {
-	const keys = allEnvKeys(manifest);
+	const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
 	return [
 		"# Every key is required. Copy to .env for local development.",
 		"# `unset` is the one value that reads as absent — for a credential you do not have yet.",
@@ -139,7 +143,9 @@ export function renderEnvExample(manifest: Manifest): string {
 export const MANIFEST_OWNED_ENV = new Set(["SHOP_DOMAIN", "SHOP_ZONE", "EMAIL_FROM", "GITHUB_PAGES_HOST"]);
 
 export function renderEnvLocal(manifest: Manifest): string {
-	const keys = allEnvKeys(manifest);
+	// Not in .env either: wrangler READS .env, so a deploy-only key sitting
+	// there as `unset` becomes a literal account id — `accounts/unset/...`.
+	const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
 	const local: Record<string, string> = {
 		SHOP_DOMAIN: `${manifest.shop.domain.split(".")[0]}.test`,
 		GITHUB_PAGES_HOST: manifest.shop.pagesHost ?? "",