@saastemly/voidcommerce 0.8.0 → 0.9.0

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-y6qzjd9h.js";
+} from "./index-0w66yc8y.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -50,7 +50,7 @@ import {
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-j5xjh6qp.js";
+} from "./index-wykd4zmk.js";
 import {
   LAYOUTS,
   oneOrigin,

package/dist/{index-y6qzjd9h.js → index-0w66yc8y.js}

@@ -9,7 +9,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-j5xjh6qp.js";
+} from "./index-wykd4zmk.js";
 import {
   MANIFEST_FILE,
   has,
@@ -1344,7 +1344,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.8.0",
+  version: "0.9.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -2293,6 +2293,39 @@ async function exists(path) {
     return false;
   }
 }
+async function putEnv(root, file, rendered, result) {
+  const path = join4(root, file);
+  if (!await exists(path)) {
+    await mkdir2(dirname2(path), { recursive: true });
+    await writeFile2(path, rendered, "utf8");
+    result.written.push(file);
+    return;
+  }
+  const read = (text) => {
+    const out = new Map;
+    for (const line2 of text.split(`
+`)) {
+      const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line2);
+      if (match)
+        out.set(match[1], match[2]);
+    }
+    return out;
+  };
+  const existing = read(await readFile2(path, "utf8"));
+  const wanted = read(rendered);
+  const merged = rendered.split(`
+`).map((line2) => {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line2);
+    if (!match)
+      return line2;
+    const had = existing.get(match[1]);
+    return had !== undefined && had !== "" && had !== "unset" ? `${match[1]}=${had}` : line2;
+  }).join(`
+`);
+  const dropped = [...existing.keys()].filter((key) => !wanted.has(key) && !key.startsWith("VITE_"));
+  await writeFile2(path, merged, "utf8");
+  result.written.push(dropped.length > 0 ? `${file} ${`(dropped ${dropped.join(", ")})`}` : file);
+}
 async function put(root, file, content, result, mode) {
   const path = join4(root, file);
   if (mode === "own" && await exists(path)) {
@@ -2364,7 +2397,7 @@ async function generateApi(root, dir, manifest, result, opts) {
   await put(root, at(".env.production"), renderEnvProduction(manifest), result, "regenerate");
   await put(root, at("lib/deploy/requirements.ts"), renderRequirementsTs(manifest), result, "regenerate");
   if (opts.env)
-    await put(root, at(".env"), renderEnvLocal(manifest), result, "own");
+    await putEnv(root, at(".env"), renderEnvLocal(manifest), result);
   await put(root, at("lib/domain.ts"), renderDomainTs(manifest.layout), result, own);
   await put(root, at("lib/payment.ts"), renderPaymentTs(manifest), result, own);
   await put(root, at("lib/notifications.ts"), renderNotificationsTs(), result, own);
@@ -2517,7 +2550,7 @@ bunx vc guard
   await put(root, ".github/workflows/deploy.yml", renderDistWorkflow(manifest), result, "regenerate");
   await retire(root, ".github/workflows/void-dist.yml", result);
   await put(root, "DEPLOY.md", renderDeployReadme(manifest, zone(manifest), workerHosts(manifest)), result, "regenerate");
-  await put(root, ".env", renderEnvLocal(manifest), result, "own");
+  await putEnv(root, ".env", renderEnvLocal(manifest), result);
   await put(root, "data/README.md", DATA_README, result, "own");
   await put(root, "branding/README.md", BRANDING_README, result, "own");
   await put(root, "migrations/README.md", MIGRATIONS_README, result, "own");

package/dist/{index-j5xjh6qp.js → index-wykd4zmk.js}

@@ -384,7 +384,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-3zjezaxk.js");
+    const { publicKeyFor } = await import("./keys-68c6vmds.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -432,7 +432,7 @@ async function secretsCommand(project, args) {
   if (args[0] === "set")
     return setSecretValue(project, args.slice(1));
   if (args.includes("--sync"))
-    return syncSecrets(project);
+    return syncSecrets(project, args.includes("--prune"));
   if (!existsSync2(join2(root, SECRETS_FILE))) {
     console.log(`
 ${color.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,
@@ -625,7 +625,7 @@ function upsertLine(path, name, value) {
 `)}${name}=${value}
 `);
 }
-async function syncSecrets(project) {
+async function syncSecrets(project, prune) {
   const root = project.root;
   const path = join2(root, SECRETS_FILE);
   if (!existsSync2(path)) {
@@ -656,13 +656,39 @@ ${color.green("+")} ${missing.length} key${missing.length === 1 ? "" : "s"} adde
 ${color.green("✓")} every secret this shop needs is already declared.
 `);
   }
-  if (extra.length > 0) {
+  if (extra.length > 0 && prune) {
+    const body = readFileSync(path, "utf8");
+    const kept = [];
+    const lines = body.split(`
+`);
+    for (let i = 0;i < lines.length; i++) {
+      const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(lines[i] ?? "");
+      if (match && extra.includes(match[1])) {
+        while (kept.length > 0 && (kept[kept.length - 1].startsWith("#") || kept[kept.length - 1].trim() === ""))
+          kept.pop();
+        if (lines[i + 1]?.trim() === "")
+          i++;
+        continue;
+      }
+      kept.push(lines[i]);
+    }
+    writeFileSync(path, `${kept.join(`
+`).replace(/\n{3,}/g, `
+
+`).replace(/\n*$/, "")}
+`);
+    console.log(`${color.red("-")} ${extra.length} key${extra.length === 1 ? "" : "s"} removed from ${SECRETS_FILE}: ${extra.join(", ")}
+
+` + color.dim(`  Their ciphertext is still in git history, so nothing is unrecoverable —
+  but nothing in this shop reads them any more.
+`));
+  } else if (extra.length > 0) {
     console.log(`${color.yellow("!")} ${extra.length} declared key${extra.length === 1 ? " is" : "s are"} no longer required by this shop:
     ${extra.join(`
     `)}
 
-` + color.dim(`  Left alone — they cost nothing, and deleting a value you may still want
-  is not this command's call. Remove them by hand when you are sure.
+` + color.dim(`  Left alone: deleting a value you may still want is not this command's
+  call to make by default. \`vc secrets --sync --prune\` makes it.
 `));
   }
   return 0;

package/dist/index.js

@@ -51,7 +51,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-y6qzjd9h.js";
+} from "./index-0w66yc8y.js";
 import {
   allEnvKeys,
   envSummary,
@@ -59,7 +59,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-j5xjh6qp.js";
+} from "./index-wykd4zmk.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/dist/{keys-3zjezaxk.js → keys-68c6vmds.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-j5xjh6qp.js";
+} from "./index-wykd4zmk.js";
 import"./index-tjy6yygc.js";
 import"./index-mnb7fz2t.js";
 import"./index-0v6na3yp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/deploy/secrets.ts

@@ -250,7 +250,7 @@ export async function secretsCommand(project: Project, args: string[]): Promise<
 
 	if (args.includes("--init")) return initSecrets(project);
 	if (args[0] === "set") return setSecretValue(project, args.slice(1));
-	if (args.includes("--sync")) return syncSecrets(project);
+	if (args.includes("--sync")) return syncSecrets(project, args.includes("--prune"));
 
 	if (!existsSync(join(root, SECRETS_FILE))) {
 		console.log(
@@ -482,7 +482,7 @@ function upsertLine(path: string, name: string, value: string): void {
  * claims — the value may still be wanted, and it is not this command's to
  * destroy. Extras are reported instead.
  */
-async function syncSecrets(project: Project): Promise<number> {
+async function syncSecrets(project: Project, prune: boolean): Promise<number> {
 	const root = project.root;
 	const path = join(root, SECRETS_FILE);
 	if (!existsSync(path)) {
@@ -505,11 +505,33 @@ async function syncSecrets(project: Project): Promise<number> {
 		console.log(`\n${color.green("✓")} every secret this shop needs is already declared.\n`);
 	}
 
-	if (extra.length > 0) {
+	if (extra.length > 0 && prune) {
+		// Deleting a value is the operator's call, and --prune is them making
+		// it. The whole entry goes — its comment line too — so the file reads
+		// as though the key was never required.
+		const body = readFileSync(path, "utf8");
+		const kept: string[] = [];
+		const lines = body.split("\n");
+		for (let i = 0; i < lines.length; i++) {
+			const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(lines[i] ?? "");
+			if (match && extra.includes(match[1]!)) {
+				// Drop the comment that introduces it, and the blank line after.
+				while (kept.length > 0 && (kept[kept.length - 1]!.startsWith("#") || kept[kept.length - 1]!.trim() === "")) kept.pop();
+				if (lines[i + 1]?.trim() === "") i++;
+				continue;
+			}
+			kept.push(lines[i]!);
+		}
+		writeFileSync(path, `${kept.join("\n").replace(/\n{3,}/g, "\n\n").replace(/\n*$/, "")}\n`);
+		console.log(
+			`${color.red("-")} ${extra.length} key${extra.length === 1 ? "" : "s"} removed from ${SECRETS_FILE}: ${extra.join(", ")}\n\n` +
+				color.dim(`  Their ciphertext is still in git history, so nothing is unrecoverable —\n  but nothing in this shop reads them any more.\n`),
+		);
+	} else if (extra.length > 0) {
 		console.log(
 			`${color.yellow("!")} ${extra.length} declared key${extra.length === 1 ? " is" : "s are"} no longer required by this shop:\n` +
 				`    ${extra.join("\n    ")}\n\n` +
-				color.dim("  Left alone — they cost nothing, and deleting a value you may still want\n  is not this command's call. Remove them by hand when you are sure.\n"),
+				color.dim(`  Left alone: deleting a value you may still want is not this command's\n  call to make by default. \`vc secrets --sync --prune\` makes it.\n`),
 		);
 	}
 	return 0;

package/src/generate/index.ts

@@ -89,6 +89,57 @@ async function exists(path: string): Promise<boolean> {
 	}
 }
 
+/**
+ * Write a dotenv file that RECONCILES rather than freezes.
+ *
+ * `.env` used to be written once and never touched, so a shop that swapped a
+ * carrier or a payment rail kept the old keys forever and never gained the
+ * new ones. devprints ended up carrying five Adyen keys and a Resend key for
+ * a shop that uses neither, while missing two it needed. That is the same
+ * owned-file drift that shipped a `.gitignore` without `.env.keys` and an
+ * api.ts pointing at another shop's domain.
+ *
+ * So: the template decides which keys EXIST, and the file on disk decides
+ * what they are SET TO. A value a person put there is always kept; a key the
+ * manifest no longer declares goes, and is reported rather than vanishing.
+ */
+async function putEnv(root: string, file: string, rendered: string, result: GenerateResult) {
+	const path = join(root, file);
+	if (!(await exists(path))) {
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, rendered, "utf8");
+		result.written.push(file);
+		return;
+	}
+
+	const read = (text: string): Map<string, string> => {
+		const out = new Map<string, string>();
+		for (const line of text.split("\n")) {
+			const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+			if (match) out.set(match[1]!, match[2]!);
+		}
+		return out;
+	};
+	const existing = read(await readFile(path, "utf8"));
+	const wanted = read(rendered);
+
+	const merged = rendered
+		.split("\n")
+		.map((line) => {
+			const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+			if (!match) return line;
+			const had = existing.get(match[1]!);
+			// A real value the operator set beats the template's placeholder.
+			// `unset` and empty are placeholders, not answers.
+			return had !== undefined && had !== "" && had !== "unset" ? `${match[1]}=${had}` : line;
+		})
+		.join("\n");
+
+	const dropped = [...existing.keys()].filter((key) => !wanted.has(key) && !key.startsWith("VITE_"));
+	await writeFile(path, merged, "utf8");
+	result.written.push(dropped.length > 0 ? `${file} ${`(dropped ${dropped.join(", ")})`}` : file);
+}
+
 async function put(root: string, file: string, content: string, result: GenerateResult, mode: "regenerate" | "own") {
 	const path = join(root, file);
 	if (mode === "own" && (await exists(path))) {
@@ -182,7 +233,7 @@ async function generateApi(root: string, dir: string, manifest: Manifest, result
 	await put(root, at(".env.production"), renderEnvProduction(manifest), result, "regenerate");
 	await put(root, at("lib/deploy/requirements.ts"), renderRequirementsTs(manifest), result, "regenerate");
 
-	if (opts.env) await put(root, at(".env"), renderEnvLocal(manifest), result, "own");
+	if (opts.env) await putEnv(root, at(".env"), renderEnvLocal(manifest), result);
 	await put(root, at("lib/domain.ts"), renderDomainTs(manifest.layout), result, own);
 	await put(root, at("lib/payment.ts"), renderPaymentTs(manifest), result, own);
 	await put(root, at("lib/notifications.ts"), renderNotificationsTs(), result, own);
@@ -395,7 +446,7 @@ bunx vc guard
 	// build. Two workflows on the same push would deploy the shop twice.
 	await retire(root, ".github/workflows/void-dist.yml", result);
 	await put(root, "DEPLOY.md", renderDeployReadme(manifest, zone(manifest), workerHosts(manifest)), result, "regenerate");
-	await put(root, ".env", renderEnvLocal(manifest), result, "own");
+	await putEnv(root, ".env", renderEnvLocal(manifest), result);
 	await put(root, "data/README.md", DATA_README, result, "own");
 	await put(root, "branding/README.md", BRANDING_README, result, "own");
 	await put(root, "migrations/README.md", MIGRATIONS_README, result, "own");