spfn 0.3.0-beta.13 → 0.3.0-beta.14

package/README.md

@@ -495,7 +495,7 @@ reads plain `process.env`.
 | `secret rotate [key]` | Rotate values; external secrets are flagged for manual reissue (`-a/--all`) |
 | `secret keygen` | Generate an age key pair for the SOPS no-cloud backend |
 | `secret recipients <add\|remove\|list> [age1…]` | Manage `.sops.yaml` recipients + re-encrypt |
-| `secret check` | Static lint — flag plaintext secret leaks; with a deployed `--env`, names in the wrong layer's file |
+| `secret check` | Static lint — flag plaintext secret leaks; with a deployed `--env`, names outside their declared layer or in both files |
 | `secret export` | Decrypt and merge one deployment's layers into a 0600 dotenv file (prints names only) |
 
 Options: `-e, --env <env>` (`local` default; also `development`/`staging`/`production`),
@@ -508,11 +508,15 @@ whole of stdin as the value — one trailing newline dropped, inner newlines kep
 local and deployed targets alike. It never prompts, and refuses a terminal on stdin.
 Shaped values such as key pairs come from the app's own command, piped in.
 
-**Layers.** A schema entry's `layer` (`'environment'` default, or `'instance'`) says where a
-deployment's value comes from. Without `--instance`, `set`/`generate`/`rotate`/`list` on a
-deployed environment work on the `environment` names in `secrets/<env>.enc.json`; with
-`--instance blue`, on the `instance` names in `secrets/<env>.blue.enc.json`. A named key of
-the other layer is refused.
+**Layers.** A schema entry's `layer` (`'environment'` or `'instance'`) pins where a
+deployment's value must live; unset, the value may come from any layer. Without
+`--instance`, `set`/`generate`/`rotate`/`list` on a deployed environment work on
+`secrets/<env>.enc.json`; with `--instance blue`, on `secrets/<env>.blue.enc.json`. A named
+key declared with the other layer is refused; a key without `layer` is accepted by either.
+`--all` (and `list`) takes the names declared with the target's layer, and names without
+`layer` on the environment target only — so `--all --instance blue` never fills an
+instance file with names every instance shares. To give each instance its own value of
+such a name, set it by name with `--instance`.
 
 **Export.**
 
@@ -525,8 +529,8 @@ Decrypts `secrets/<env>.enc.json` and — with `--instance`, when it exists —
 instance values such as port and URLs), and writes the merge to `--out`. Only names in the
 whole-app list are written; an unlisted name in an encrypted file is a warning by name.
 The export fails, writing nothing, when a required name is in no layer, a name is in two
-layers, an `instance` name is in the environment file, an `environment` name is in an
-instance layer, a value fails its validator (the error names the variable and the
+layers, a name declared `instance` is in the environment file, a name declared
+`environment` is in an instance layer, a value fails its validator (the error names the variable and the
 reason, never the value), or decryption fails. `--out` is required and its directory must
 exist; relative paths resolve from the working directory. The file is created 0600 beside
 the destination and renamed over it, so a failure leaves the previous file untouched

package/dist/index.js

@@ -949,7 +949,7 @@ import { dirname as dirname2, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getCliVersion() {
   if (true) {
-    return "0.3.0-beta.13";
+    return "0.3.0-beta.14";
   }
   return fromPackageJson ?? (fromPackageJson = readPackageVersion());
 }
@@ -5375,8 +5375,8 @@ function secretEntries(schema) {
 function generatableSecrets(schema) {
   return secretEntries(schema).filter((entry) => !!entry.generate);
 }
-function layerOf(entry) {
-  return entry.layer ?? "environment";
+function allowsLayer(entry, layer) {
+  return entry.layer === void 0 || entry.layer === layer;
 }
 
 // src/utils/env-list.ts
@@ -5432,7 +5432,7 @@ function describeEnvList(options) {
   return options.package ?? "whole app";
 }
 function describeRules(entry) {
-  return `"${entry.type}" (${entry.required ? "required" : "optional"}${entry.sensitive ? ", sensitive" : ""}${layerOf(entry) === "instance" ? ", instance layer" : ""})`;
+  return `"${entry.type}" (${entry.required ? "required" : "optional"}${entry.sensitive ? ", sensitive" : ""}${entry.layer ? `, ${entry.layer} layer` : ""})`;
 }
 async function loadAppSchemas(cwd) {
   const paths = (await loadAppConfig3(cwd)).env?.schemas ?? [];
@@ -7514,15 +7514,15 @@ function targetLayer(target) {
 }
 function entriesForTarget(entries, target) {
   const layer = targetLayer(target);
-  return layer ? entries.filter((entry) => layerOf(entry) === layer) : entries;
+  return layer ? entries.filter((entry) => (entry.layer ?? "environment") === layer) : entries;
 }
 function assertTargetLayer(entry, target) {
   const layer = targetLayer(target);
-  if (!entry || !layer || layerOf(entry) === layer) {
+  if (!entry || !layer || allowsLayer(entry, layer)) {
     return;
   }
   const hint = layer === "environment" ? "pass --instance <name>" : "drop --instance";
-  logger.error(`${entry.key} is declared with layer "${layerOf(entry)}" \u2014 ${hint}.`);
+  logger.error(`${entry.key} is declared with layer "${entry.layer}" \u2014 ${hint}.`);
   process.exit(1);
 }
 
@@ -7946,6 +7946,7 @@ async function secretCheck(options) {
 }
 function checkPlacement(cwd, schema, target, issues, warnings) {
   const files = [{ file: getSopsFile(cwd, target.env), layer: "environment" }];
+  const seenIn = /* @__PURE__ */ new Map();
   if (target.instance) {
     files.push({ file: getSopsFile(cwd, target.env, target.instance), layer: "instance" });
   }
@@ -7954,9 +7955,12 @@ function checkPlacement(cwd, schema, target, issues, warnings) {
       const entry = Object.hasOwn(schema, name) ? schema[name] : void 0;
       if (!entry) {
         warnings.push(`${chalk43.cyan(name)} in ${chalk43.yellow(file.relFile)} is not in the env list \u2014 export skips it.`);
-      } else if (layerOf(entry) !== layer) {
-        issues.push(`${chalk43.cyan(name)} is declared with layer "${layerOf(entry)}" but is in ${chalk43.yellow(file.relFile)}.`);
+      } else if (!allowsLayer(entry, layer)) {
+        issues.push(`${chalk43.cyan(name)} is declared with layer "${entry.layer}" but is in ${chalk43.yellow(file.relFile)}.`);
+      } else if (seenIn.has(name)) {
+        issues.push(`${chalk43.cyan(name)} is in both ${chalk43.yellow(seenIn.get(name))} and ${chalk43.yellow(file.relFile)}.`);
       }
+      seenIn.set(name, file.relFile);
     }
   }
 }
@@ -8023,8 +8027,8 @@ function placementError(entry, found) {
   if (found.length > 1) {
     return `in more than one layer: ${found.map((source) => source.label).join(" and ")}`;
   }
-  if (found[0].kind !== layerOf(entry)) {
-    return `declared with layer "${layerOf(entry)}", but found in ${found[0].label}`;
+  if (!allowsLayer(entry, found[0].kind)) {
+    return `declared with layer "${entry.layer}", but found in ${found[0].label}`;
   }
   return void 0;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spfn",
-  "version": "0.3.0-beta.13",
+  "version": "0.3.0-beta.14",
   "description": "Scaffold a full-stack TypeScript backend onto a Next.js app built with an AI coding agent: auth, database, typed routes and codegen, one fixed vertical slice per feature",
   "type": "module",
   "bin": {