@suluk/platform 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suluk/platform",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "The platform generator (C051): write one `definePlatform` manifest → it plans the shadcn-registry adds, generates the wired Hono entry, and merges each module's provision fragment into a single provision.config. The manifest compiles to a shadcn-add list + a C047 provision.config; the generator runs the adds + `@suluk/provision`. Turns the Suluk backend registry into a one-command platform. CANDIDATE tooling.",
   "publishConfig": {
   "access": "public"

package/src/plan.ts

@@ -241,8 +241,9 @@ function buildEnvTemp(env: EnvVar[]): string {
     "# Provisioning creds (used to create infra + mint scoped tokens; the master is DELETED, never committed):",
     ...provisioningOf(env).filter((e) => !e.minted).map(line),
     "",
-    "# Runtime secrets (encrypted into .env + committed; shipped to the Worker):",
-    ...runtimeSecretsOf(env).map(line),
+    "# Runtime secrets (encrypted into .env + committed; shipped to the Worker). AUTO-GENERATED ones are NOT here — `provision`",
+    "# creates them: " + (runtimeSecretsOf(env).filter((e) => e.generated).map((e) => e.name).join(", ") || "(none)") + ".",
+    ...runtimeSecretsOf(env).filter((e) => !e.generated).map(line),
     "",
   ].join("\n");
 }
@@ -303,13 +304,16 @@ console.log("✓ scoped tokens ready (encrypted in .env).");
  */
 function buildProvisionScript(env: EnvVar[]): string {
   const ephemeral = ephemeralOf(env).map((e) => e.name);
+  const generated = env.filter((e) => e.generated).map((e) => e.name);
   return `#!/usr/bin/env bun
 // AUTO-GENERATED by @suluk/platform — stand up the infra + SEAL the secrets (@suluk/env encrypted-commit model). Run once
 // after filling .env.temp (or with an existing encrypted .env). Idempotent.
 import { existsSync, rmSync, readFileSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { loadEnvFile, setVar } from "@suluk/env/node";
 
 const EPHEMERAL = ${JSON.stringify(ephemeral)}; // the CF master token(s): used to provision + mint, then DELETED (never committed)
+const GENERATED = ${JSON.stringify(generated)}; // secrets the app creates itself (e.g. BETTER_AUTH_SECRET) — never operator-supplied
 const sh = async (cmd: string, args: string[]) => { const p = Bun.spawn([cmd, ...args], { stdout: "inherit", stderr: "inherit" }); if ((await p.exited) !== 0) { console.error(\`✗ \${cmd} \${args.join(" ")}\`); process.exit(1); } };
 
 // 1. keypair → the central ~/.suluk/settings.json (the private key never stays in the repo).
@@ -327,6 +331,12 @@ if (existsSync(".env.temp")) {
 await loadEnvFile({ override: true }); // decrypt everything into process.env
 if (!process.env.CLOUDFLARE_API_TOKEN || !process.env.CLOUDFLARE_ACCOUNT_ID) { console.error("✗ CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID missing — put them in .env.temp"); process.exit(1); }
 
+// 2b. auto-generate any app-created secret (e.g. BETTER_AUTH_SECRET ← 32 random bytes) not already set — the operator never
+//     supplies these in .env.temp. Staged plaintext here, encrypted at step 5.
+for (const name of GENERATED) {
+  if (!process.env[name]) { await setVar(name, randomBytes(32).toString("base64"), { plain: true }); console.log(\`✓ generated \${name}\`); }
+}
+
 // 3. provision the infra (D1/KV — the C047 provision.config), 4. mint the scoped least-privilege tokens from the master.
 await sh("bunx", ["suluk-provision", "apply"]);
 await sh("bun", ["run", "scripts/mint-tokens.ts"]);

package/src/service.ts

@@ -40,6 +40,9 @@ export interface EnvVar {
   provisioning?: boolean;
   /** a scoped least-privilege token MINTED during provisioning (from the master), then kept ENCRYPTED in `.env`. `surface: "local"`. */
   minted?: boolean;
+  /** a random secret the provisioning flow AUTO-GENERATES (e.g. `BETTER_AUTH_SECRET` ← 32 random bytes) if not already set —
+   *  so the operator never supplies it in `.env.temp`; it still lands ENCRYPTED in the committed `.env`. */
+  generated?: boolean;
 }
 
 /** The old catalog record — now a DERIVED VIEW of a {@link Service} (see {@link toCatalogEntry}); kept so `planPlatform`
@@ -191,7 +194,7 @@ export const authService = defineService({
   provision: { symbol: "authProvision", from: "./src/provision/auth" },
   deps: ["better-auth", "@better-auth/api-key", "@better-auth/passkey", "@suluk/better-auth"],
   env: [
-    { name: "BETTER_AUTH_SECRET", required: true, secret: true, hint: "session-signing key — `openssl rand -base64 32`" },
+    { name: "BETTER_AUTH_SECRET", required: true, secret: true, generated: true, hint: "session-signing key — AUTO-GENERATED by `bun run provision` (32 random bytes); no need to supply it" },
     { name: "BETTER_AUTH_URL", hint: "your deployed origin, e.g. https://api.example.com" },
     { name: "GOOGLE_CLIENT_ID", secret: true, hint: "optional — enables Google sign-in" },
     { name: "GOOGLE_CLIENT_SECRET", secret: true, hint: "optional — pairs with GOOGLE_CLIENT_ID" },