@saastemly/voidcommerce 0.3.0 → 0.4.0

package/dist/catalog.js

@@ -14,7 +14,8 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-z4qazajn.js";
+} from "./index-844b3qn9.js";
+import"./index-0v6na3yp.js";
 export {
   UI,
   TAX,

package/dist/cli.js

@@ -16,7 +16,9 @@ import {
   importHelp,
   initHelp,
   isVoidApp,
+  keysCommand,
   line,
+  plaintextSecretNames,
   preflight,
   printPreflight,
   row,
@@ -25,16 +27,17 @@ import {
   secretsCommand,
   version,
   voidAppsIn
-} from "./index-84wq4qp8.js";
+} from "./index-yzezvy5h.js";
 import {
   LAYOUTS,
   readManifest,
   validate,
   zoneOf
-} from "./index-zh3tmj08.js";
+} from "./index-pz6m2hkm.js";
 import {
   GROUPS
-} from "./index-z4qazajn.js";
+} from "./index-844b3qn9.js";
+import"./index-0v6na3yp.js";
 
 // src/deploy/index.ts
 import color from "picocolors";
@@ -145,6 +148,52 @@ async function secretsHelp() {
   ], width));
   return 0;
 }
+async function keysCliCommand(args) {
+  const project = await findProject();
+  if (!project) {
+    console.error("vc: no voidcommerce.json here.");
+    return 1;
+  }
+  return keysCommand(project.manifest, project.root, args);
+}
+async function keysHelp() {
+  const width = 80;
+  console.log(box("vc keys", [
+    line("The key that encrypts this repository's secrets is DERIVED from", width),
+    line("CLOUDFLARE_API_TOKEN, salted with the account id. Nothing is stored.", width),
+    line("", width),
+    ...row("vc keys", "what this token derives, and whether it matches the repository", width, 2),
+    ...row("vc keys --rotate", "re-encrypt under a new token, while the old one still works", width, 2),
+    line("", width),
+    line("Whoever can deploy the worker can read its secrets, and nobody else can.", width),
+    line("The price: rotating the token orphans every encrypted value, a second", width),
+    line("admin's token derives a different key, and the build must use the same", width),
+    line("token the values were encrypted under. `vc keys` checks the derived", width),
+    line("public key against the committed one, so a mismatch is a clear refusal", width),
+    line("rather than a decryption error nobody can place.", width)
+  ], width));
+  return 0;
+}
+async function guardCommand() {
+  const project = await findProject();
+  if (!project)
+    return 0;
+  const bare = plaintextSecretNames(project.root);
+  if (bare.length === 0)
+    return 0;
+  console.error(`
+${color.red("✗ refusing the commit")}: ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE} ${bare.length === 1 ? "is" : "are"} not encrypted.
+
+` + `    ${bare.join(`
+    `)}
+
+` + `  bunx dotenvx encrypt -f ${SECRETS_FILE}
+
+` + color.dim(`  Committing a secret in the clear cannot be undone by a later commit;
+  the value stays in the history and must be treated as burned.
+`));
+  return 1;
+}
 
 // src/init.ts
 import * as p2 from "@clack/prompts";
@@ -537,6 +586,8 @@ var EXTENDED = {
   deploy: { run: deployCommand, help: deployHelp },
   preflight: { run: preflightCommand, help: preflightHelp },
   secrets: { run: secretsCliCommand, help: secretsHelp },
+  keys: { run: keysCliCommand, help: keysHelp },
+  guard: { run: guardCommand, help: async () => guardCommand() },
   dev: { run: appScript("dev"), help: appScriptHelp("dev") },
   build: { run: appScript("build"), help: appScriptHelp("build") },
   preview: { run: appScript("preview"), help: appScriptHelp("preview") }

package/dist/deploy/index.d.ts

@@ -17,3 +17,12 @@ export declare function preflightHelp(): Promise<number>;
 /** `vc secrets` — what the repository declares, and whether it is encrypted. */
 export declare function secretsCliCommand(args: string[]): Promise<number>;
 export declare function secretsHelp(): Promise<number>;
+/** `vc keys` — what the token derives, and the warning that goes with it. */
+export declare function keysCliCommand(args: string[]): Promise<number>;
+export declare function keysHelp(): Promise<number>;
+/**
+ * The pre-commit gate: refuse a commit that would put a secret in the clear.
+ *
+ * Exit code is the whole interface — a hook cares about nothing else.
+ */
+export declare function guardCommand(): Promise<number>;

package/dist/deploy/keys.d.ts

@@ -0,0 +1,34 @@
+import type { Manifest } from "../manifest";
+/** Where the token comes from, in the order wrangler itself reads them. */
+export declare function apiToken(): string | null;
+/**
+ * The private key this token and account derive.
+ *
+ * The account id is the salt rather than a constant, so the same token used
+ * against two accounts does not produce one key — tokens are often scoped to
+ * several accounts, and a shared key across them would be a wider blast
+ * radius than anyone asked for.
+ */
+export declare function derivePrivateKey(token: string, accountId: string): string;
+/** The public key for a private one, via dotenvx's own primitive. */
+export declare function publicKeyFor(privateKey: string): Promise<string | null>;
+/** The public key the repository was actually encrypted under. */
+export declare function committedPublicKey(root: string): string | null;
+export type KeyState = {
+    ok: true;
+    privateKey: string;
+    publicKey: string;
+    fresh: boolean;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The key for this repository, or a refusal that says exactly what is wrong.
+ *
+ * `fresh` means the repository has no secrets yet, so there is nothing to
+ * check the derivation against and any token is as good as another.
+ */
+export declare function keyFor(manifest: Manifest, root: string): Promise<KeyState>;
+/** `vc keys` — what the derivation says, without printing anything secret. */
+export declare function keysCommand(manifest: Manifest, root: string, args: string[]): Promise<number>;

package/dist/deploy/secrets.d.ts

@@ -13,8 +13,9 @@ import type { Project } from "../project";
  * dotenvx closes it. `.env.secrets` holds ciphertext and a public key, and
  * it is COMMITTED: the key names are readable, the values are not, and a
  * diff shows when a secret changed without showing what it changed to. The
- * private key is the one thing that stays out — a single value, set once
- * where the deploy runs.
+ * private key is not stored at all — it is derived from the Cloudflare API
+ * token, so whoever can deploy the worker can read its secrets and nobody
+ * else can. See `./keys.ts`, which also spells out what that costs.
  *
  * ── Why the values still become worker SECRETS ───────────────────────────
  *
@@ -27,14 +28,19 @@ import type { Project } from "../project";
  * applies ADDITIVELY, so a secret this file does not name is left alone
  * rather than deleted.
  *
- * ── The tradeoff, stated ─────────────────────────────────────────────────
+ * ── The tradeoffs, stated ────────────────────────────────────────────────
  *
- * Ciphertext in git is permanent. If the private key ever leaks, every
- * secret in the history is readable, including ones that were rotated —
- * which is not true of `wrangler secret put`, where a rotation genuinely
- * retires the old value. Rotating the dotenvx key re-encrypts the present,
- * not the past. That is the price of a shop that rebuilds from a checkout,
- * and it should be a decision rather than a surprise.
+ * Ciphertext in git is permanent. A key that ever leaks reads every secret
+ * in the history, including ones that were rotated — which is not true of
+ * `wrangler secret put`, where a rotation genuinely retires the old value.
+ *
+ * And because the key is derived, rotating the API token orphans the lot.
+ * `keys.ts` guards that with a public-key check, so the failure is a clear
+ * refusal rather than a decryption error nobody can place — but the guard
+ * cannot recover values, only explain them.
+ *
+ * Both are the price of a shop that rebuilds from a checkout, and both
+ * should be decisions rather than surprises.
  */
 export declare const SECRETS_FILE = ".env.secrets";
 export declare const PRIVATE_KEY_VAR = "DOTENV_PRIVATE_KEY_SECRETS";

package/dist/index-0v6na3yp.js

@@ -0,0 +1,35 @@
+import { createRequire } from "node:module";
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+export { __toESM, __commonJS, __require };

package/dist/{index-z4qazajn.js → index-844b3qn9.js}

@@ -1,6 +1,3 @@
-import { createRequire } from "node:module";
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-
 // src/catalog.ts
 var SIGN_IN = {
   id: "signIn",
@@ -586,4 +583,4 @@ var GROUPS = [
 ];
 var CHOICES = new Map(GROUPS.flatMap((group) => group.choices.map((choice) => [choice.id, choice])));
 
-export { __require, SIGN_IN, AUTH_PLUGINS, COMMERCE_CATALOG, COMMERCE_SALES, COMMERCE_OPERATIONS, PAYMENT, TAX, CARRIERS, ERP, EMAIL, DNS, CONTENT, UI, GROUPS, CHOICES };
+export { SIGN_IN, AUTH_PLUGINS, COMMERCE_CATALOG, COMMERCE_SALES, COMMERCE_OPERATIONS, PAYMENT, TAX, CARRIERS, ERP, EMAIL, DNS, CONTENT, UI, GROUPS, CHOICES };