@suluk/platform 0.4.0 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suluk/platform",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "The platform generator (C051): write one `definePlatform` manifest → it plans the shadcn-registry adds, generates the wired Hono entry, and merges each module's provision fragment into a single provision.config. The manifest compiles to a shadcn-add list + a C047 provision.config; the generator runs the adds + `@suluk/provision`. Turns the Suluk backend registry into a one-command platform. CANDIDATE tooling.",
   "publishConfig": {
   "access": "public"

package/src/plan.ts

@@ -96,21 +96,21 @@ const secretsOf = (env: EnvVar[]): EnvVar[] => env.filter((e) => e.secret);
  *  Non-secret config is NOT here — it's in the manifest `vars` → wrangler `[vars]`. Safe to commit (no values). */
 function buildEnvExample(env: EnvVar[]): string {
   const line = (e: EnvVar) => `${e.name}=${e.hint ? `        # ${e.hint}` : ""}`;
-  const provisioning = provisioningOf(env).filter((e) => !e.minted); // the master + account id (the raw inputs)
-  const minted = env.filter((e) => e.minted); // the scoped tokens the mint step creates
+  // .env.example mirrors the COMMITTED .env AFTER provisioning: SULUK_PUBLIC_KEY (plaintext) + every secret EXCEPT the
+  // EPHEMERAL master (deleted after minting). Keepers + minted scoped tokens + runtime secrets — all encrypted at rest.
+  const localKeepers = secretsOf(env).filter((e) => !e.provisioning && (e.minted || e.surface === "local")); // account-id + minted tokens
   const runtime = runtimeSecretsOf(env);
   return [
-    "# Secret keys checklist (generated). SETUP: fill `.env.temp` (plaintext) → `bun run provision`. It creates the keypair,",
-    "# provisions infra, mints the scoped tokens, ENCRYPTS the keepers into the COMMITTED `.env` (@suluk/env ML-KEM-768), and",
-    "# DELETES the ephemeral CF master token. Non-secret config lives in platform.config.ts `vars` (→ wrangler.toml [vars]).",
+    "# .env.example — the keys in the COMMITTED .env AFTER `bun run provision` (values ENCRYPTED with @suluk/env;",
+    "# SULUK_PUBLIC_KEY plaintext). The EPHEMERAL CF master token (CLOUDFLARE_API_TOKEN) is supplied in .env.temp and DELETED",
+    "# after minting — it is NOT here. Non-secret config lives in platform.config.ts `vars` (→ wrangler.toml [vars]).",
     "",
-    "# PROVISIONING creds — supply in .env.temp (plaintext). The master is EPHEMERAL (deleted after minting; never committed):",
-    ...provisioning.map(line),
+    "SULUK_PUBLIC_KEY=        # @suluk/env public key (plaintext; can only encrypt)",
     "",
-    "# Scoped least-privilege tokens — MINTED by `bun run provision`/`mint-tokens` (you don't supply these); kept encrypted:",
-    ...minted.map((e) => `# ${line(e)}`),
+    "# Provisioning keeper + minted scoped tokens (surface local — never shipped to the Worker; encrypted):",
+    ...localKeepers.map(line),
     "",
-    "# RUNTIME secrets — supply in .env.temp; encrypted into .env + shipped to the Worker:",
+    "# Runtime secrets (encrypted; reach the Worker via loadEnv / sync-secrets):",
     ...runtime.map((e) => (e.required ? line(e) : `# ${line(e)}`)),
     "",
   ].join("\n");
@@ -241,8 +241,9 @@ function buildEnvTemp(env: EnvVar[]): string {
     "# Provisioning creds (used to create infra + mint scoped tokens; the master is DELETED, never committed):",
     ...provisioningOf(env).filter((e) => !e.minted).map(line),
     "",
-    "# Runtime secrets (encrypted into .env + committed; shipped to the Worker):",
-    ...runtimeSecretsOf(env).map(line),
+    "# Runtime secrets (encrypted into .env + committed; shipped to the Worker). AUTO-GENERATED ones are NOT here — `provision`",
+    "# creates them: " + (runtimeSecretsOf(env).filter((e) => e.generated).map((e) => e.name).join(", ") || "(none)") + ".",
+    ...runtimeSecretsOf(env).filter((e) => !e.generated).map(line),
     "",
   ].join("\n");
 }
@@ -303,13 +304,16 @@ console.log("✓ scoped tokens ready (encrypted in .env).");
  */
 function buildProvisionScript(env: EnvVar[]): string {
   const ephemeral = ephemeralOf(env).map((e) => e.name);
+  const generated = env.filter((e) => e.generated).map((e) => e.name);
   return `#!/usr/bin/env bun
 // AUTO-GENERATED by @suluk/platform — stand up the infra + SEAL the secrets (@suluk/env encrypted-commit model). Run once
 // after filling .env.temp (or with an existing encrypted .env). Idempotent.
 import { existsSync, rmSync, readFileSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { loadEnvFile, setVar } from "@suluk/env/node";
 
 const EPHEMERAL = ${JSON.stringify(ephemeral)}; // the CF master token(s): used to provision + mint, then DELETED (never committed)
+const GENERATED = ${JSON.stringify(generated)}; // secrets the app creates itself (e.g. BETTER_AUTH_SECRET) — never operator-supplied
 const sh = async (cmd: string, args: string[]) => { const p = Bun.spawn([cmd, ...args], { stdout: "inherit", stderr: "inherit" }); if ((await p.exited) !== 0) { console.error(\`✗ \${cmd} \${args.join(" ")}\`); process.exit(1); } };
 
 // 1. keypair → the central ~/.suluk/settings.json (the private key never stays in the repo).
@@ -327,6 +331,12 @@ if (existsSync(".env.temp")) {
 await loadEnvFile({ override: true }); // decrypt everything into process.env
 if (!process.env.CLOUDFLARE_API_TOKEN || !process.env.CLOUDFLARE_ACCOUNT_ID) { console.error("✗ CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID missing — put them in .env.temp"); process.exit(1); }
 
+// 2b. auto-generate any app-created secret (e.g. BETTER_AUTH_SECRET ← 32 random bytes) not already set — the operator never
+//     supplies these in .env.temp. Staged plaintext here, encrypted at step 5.
+for (const name of GENERATED) {
+  if (!process.env[name]) { await setVar(name, randomBytes(32).toString("base64"), { plain: true }); console.log(\`✓ generated \${name}\`); }
+}
+
 // 3. provision the infra (D1/KV — the C047 provision.config), 4. mint the scoped least-privilege tokens from the master.
 await sh("bunx", ["suluk-provision", "apply"]);
 await sh("bun", ["run", "scripts/mint-tokens.ts"]);

package/src/service.ts

@@ -40,6 +40,9 @@ export interface EnvVar {
   provisioning?: boolean;
   /** a scoped least-privilege token MINTED during provisioning (from the master), then kept ENCRYPTED in `.env`. `surface: "local"`. */
   minted?: boolean;
+  /** a random secret the provisioning flow AUTO-GENERATES (e.g. `BETTER_AUTH_SECRET` ← 32 random bytes) if not already set —
+   *  so the operator never supplies it in `.env.temp`; it still lands ENCRYPTED in the committed `.env`. */
+  generated?: boolean;
 }
 
 /** The old catalog record — now a DERIVED VIEW of a {@link Service} (see {@link toCatalogEntry}); kept so `planPlatform`
@@ -191,7 +194,7 @@ export const authService = defineService({
   provision: { symbol: "authProvision", from: "./src/provision/auth" },
   deps: ["better-auth", "@better-auth/api-key", "@better-auth/passkey", "@suluk/better-auth"],
   env: [
-    { name: "BETTER_AUTH_SECRET", required: true, secret: true, hint: "session-signing key — `openssl rand -base64 32`" },
+    { name: "BETTER_AUTH_SECRET", required: true, secret: true, generated: true, hint: "session-signing key — AUTO-GENERATED by `bun run provision` (32 random bytes); no need to supply it" },
     { name: "BETTER_AUTH_URL", hint: "your deployed origin, e.g. https://api.example.com" },
     { name: "GOOGLE_CLIENT_ID", secret: true, hint: "optional — enables Google sign-in" },
     { name: "GOOGLE_CLIENT_SECRET", secret: true, hint: "optional — pairs with GOOGLE_CLIENT_ID" },