@suluk/platform 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suluk/platform",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "The platform generator (C051): write one `definePlatform` manifest → it plans the shadcn-registry adds, generates the wired Hono entry, and merges each module's provision fragment into a single provision.config. The manifest compiles to a shadcn-add list + a C047 provision.config; the generator runs the adds + `@suluk/provision`. Turns the Suluk backend registry into a one-command platform. CANDIDATE tooling.",
   "publishConfig": {
   "access": "public"

package/src/generate.ts

@@ -58,6 +58,7 @@ export async function generatePlatform(input: PlatformManifest | Platform, opts:
     ["scripts/env-check.ts", plan.envCheck, true], // the encrypted-env preflight
     ["src/env.ts", plan.envTs, true], // the @suluk/env declare-once (derived from the manifest's secrets)
     ["scripts/sync-secrets.ts", plan.syncSecrets, true], // the deploy-time secret push (derived)
+    ["scripts/link-key.ts", plan.linkKey, true], // register the private key into ~/.suluk/settings.json (the central store)
     [".env", plan.envScaffold, false], // the COMMITTED encrypted-secrets file — SCAFFOLD IF ABSENT (never clobber secrets)
   ] as const) {
     if (always || (await read(file)) == null) {

package/src/plan.ts

@@ -36,6 +36,9 @@ export interface PlatformPlan {
   /** the generated `scripts/sync-secrets.ts` — decrypt the cloudflare-surfaced secrets from the committed .env and push them
    *  as `wrangler secret`s (the toolfactory-exact deploy path; the alternative is the entry's runtime `loadEnv`). */
   syncSecrets: string;
+  /** the generated `scripts/link-key.ts` — register the private key into the centralized `~/.suluk/settings.json` (the store
+   *  `@suluk/env` reads by default for local dev/deploy/CI), the toolfactory model. */
+  linkKey: string;
   /** the generated `.env` SCAFFOLD (committed) — a header + the setup steps, NO values. `generate` writes it only if absent
    *  (never clobbering the operator's encrypted secrets). Secret VALUES are added encrypted via `suluk-env set`. */
   envScaffold: string;
@@ -71,6 +74,7 @@ export function planPlatform(input: PlatformManifest | Platform): PlatformPlan {
     envCheck: buildEnvCheckScript(env),
     envTs: buildEnvTs(env),
     syncSecrets: buildSyncSecrets(),
+    linkKey: buildLinkKey(),
     envScaffold: buildEnvScaffold(env),
   };
 }
@@ -87,7 +91,8 @@ function buildEnvExample(env: EnvVar[]): string {
   const optional = secrets.filter((e) => !e.required);
   return [
     "# .env keys checklist (generated). The `.env` is COMMITTED with these values ENCRYPTED (@suluk/env, ML-KEM-768):",
-    "#   bunx suluk-env keygen                 # once — keypair (SULUK_PUBLIC_KEY → .env; private → .env.keys, gitignored)",
+    "#   bunx suluk-env keygen                 # once — keypair (SULUK_PUBLIC_KEY → .env; private → .env.keys)",
+    "#   bun run link-key                      # register the private key in ~/.suluk/settings.json (@suluk/env reads it by default)",
     "#   bunx suluk-env set KEY=value          # per secret — encrypts it into .env",
     "# Non-secret config lives in platform.config.ts `vars` (→ wrangler.toml [vars]), NOT here.",
     "",
@@ -151,6 +156,43 @@ console.log(\`✓ synced \${names.length} secret(s) to the Worker.\`);
 `;
 }
 
+/**
+ * `scripts/link-key.ts` — register THIS project's @suluk/env private key into the centralized `~/.suluk/settings.json`
+ * (keyed by the repo's absolute path), the toolfactory model. `readPrivateKey()` then resolves it from there BY DEFAULT
+ * (precedence: `SULUK_PRIVATE_KEY` env > `~/.suluk/settings.json` by path > legacy `.env.keys`), so local dev, deploy, and a
+ * CI worktree (which checks out the encrypted .env but not `.env.keys`, via `SULUK_PROJECT_DIR`) all decrypt from one store.
+ */
+function buildLinkKey(): string {
+  return `#!/usr/bin/env bun
+// AUTO-GENERATED by @suluk/platform. Register this project's @suluk/env private key into ~/.suluk/settings.json (keyed by the
+// repo path) — the central, out-of-git store @suluk/env reads by default. Run once after \`bunx suluk-env keygen\`; idempotent.
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { readPrivateKey } from "@suluk/env/node";
+
+const repo = process.cwd();
+const name = repo.split("/").filter(Boolean).pop() ?? "project";
+const priv = readPrivateKey(); // SULUK_PRIVATE_KEY env > ~/.suluk/settings.json > .env.keys (legacy)
+if (!priv) { console.error("✗ no private key — run \`bunx suluk-env keygen\` first"); process.exit(1); }
+
+const settingsPath = process.env.SULUK_SETTINGS_PATH || join(homedir(), ".suluk", "settings.json");
+type Proj = { name?: string; path?: string; env?: Array<{ key: string; value: string }> };
+let data: { projects?: Proj[] } = {};
+try { data = JSON.parse(readFileSync(settingsPath, "utf8")); } catch { /* fresh */ }
+const projects: Proj[] = Array.isArray(data.projects) ? data.projects : [];
+let entry = projects.find((p) => p.path === repo);
+if (!entry) { entry = { name, path: repo, env: [] }; projects.push(entry); }
+entry.name = name; entry.path = repo; entry.env = Array.isArray(entry.env) ? entry.env : [];
+const existing = entry.env.find((e) => e.key === "SULUK_PRIVATE_KEY");
+if (existing) existing.value = priv; else entry.env.push({ key: "SULUK_PRIVATE_KEY", value: priv });
+data.projects = projects;
+mkdirSync(dirname(settingsPath), { recursive: true });
+writeFileSync(settingsPath, JSON.stringify(data, null, 2) + "\\n");
+console.log(\`✓ linked \${name} → \${settingsPath}. You can now \\\`rm .env.keys\\\` — the key lives in the central store.\`);
+`;
+}
+
 /**
  * The `.env` SCAFFOLD — a header + setup steps, NO values (safe to commit). `generate` writes it ONLY IF ABSENT so it never
  * clobbers the operator's encrypted secrets. Its presence also lets `src/index.ts`'s `import "../.env"` resolve on a fresh app.
@@ -160,7 +202,9 @@ function buildEnvScaffold(env: EnvVar[]): string {
   return [
     "# This file is COMMITTED. Secret VALUES are stored ENCRYPTED (@suluk/env, post-quantum ML-KEM-768) — safe to push to git.",
     "# Setup:",
-    "#   bunx suluk-env keygen              # keypair: SULUK_PUBLIC_KEY here (commit); private key → .env.keys (gitignored)",
+    "#   bunx suluk-env keygen              # keypair: SULUK_PUBLIC_KEY here (commit); private key → .env.keys",
+    "#   bun run link-key                   # register the private key in ~/.suluk/settings.json (the central store @suluk/env",
+    "#                                      #   reads by DEFAULT for local dev/deploy/CI); then `rm .env.keys` if you like",
     "#   bunx suluk-env set BETTER_AUTH_SECRET=...   # encrypts + adds each secret" + (required.length ? ` (required: ${required.map((e) => e.name).join(", ")})` : ""),
     "# Get the secrets into the Worker EITHER way:",
     "#   • runtime:  `wrangler secret put SULUK_PRIVATE_KEY`  → src/index.ts decrypts this file on the first request",
@@ -239,14 +283,19 @@ function buildGitignore(): string {
 }
 
 /** Merge the generated .gitignore into an existing one — APPEND any missing entries (never skip-if-present, so an app's
- *  minimal .gitignore can't leave `.env`/`.env.temp` UNIGNORED and risk committing secrets). Dedup, preserve app entries. */
+ *  minimal .gitignore can't leave `.env.keys`/`.env.temp` UNIGNORED and risk committing the private key). Dedup, preserve app
+ *  entries. ENCRYPTED-ENV TRANSITION: if the new baseline ignores `.env.keys` (the private key) but NOT `.env`, a plaintext-era
+ *  `.env` ignore is REMOVED — the .env is now COMMITTED with its values encrypted, so ignoring it is wrong (and safe to undo). */
 export function mergeGitignore(generated: string, existing: string | null): string {
   if (!existing) return generated;
   const norm = (s: string) => s.trim().replace(/\/$/, "");
-  const have = new Set(existing.split("\n").map(norm).filter(Boolean));
+  const genLines = generated.split("\n").map(norm);
+  const encryptedModel = genLines.includes(".env.keys") && !genLines.includes(".env");
+  const existingClean = encryptedModel ? existing.split("\n").filter((l) => norm(l) !== ".env").join("\n") : existing;
+  const have = new Set(existingClean.split("\n").map(norm).filter(Boolean));
   const add = generated.split("\n").filter((l) => l.trim() && !have.has(norm(l)));
-  if (!add.length) return existing.endsWith("\n") ? existing : existing + "\n";
-  const base = existing.replace(/\n*$/, "");
+  if (!add.length) return existingClean.endsWith("\n") ? existingClean : existingClean + "\n";
+  const base = existingClean.replace(/\n*$/, "");
   return `${base}\n${add.join("\n")}\n`;
 }
 
@@ -309,6 +358,7 @@ export function buildPackageJson(name: string, services: string[], catalog: Reco
       dev: "wrangler dev",
       deploy: "wrangler deploy",
       "env:keygen": "suluk-env keygen", // create the @suluk/env keypair (SULUK_PUBLIC_KEY → .env; private → .env.keys)
+      "link-key": "bun run scripts/link-key.ts", // register the private key in ~/.suluk/settings.json (the central store)
       "env:set": "suluk-env set", // encrypt + add a secret: `bun run env:set BETTER_AUTH_SECRET=...`
       "sync-secrets": "bun run scripts/sync-secrets.ts", // decrypt cloudflare-surfaced secrets → `wrangler secret put` each
       typecheck: "tsc --noEmit -p .",