EnvShare

envshare

EnvShare — share environment variables through a link only its holder can read: the browser encrypts with AES-GCM before anything is sent and keeps the key in the link's # fragment, each link limited to a number of reads and expiring after a TTL — running on Cloudflare Workers + Static Assets through @opennextjs/cloudflare. The ciphertext is in a Workers KV namespace, written with the document's TTL, and each document's read limit and expiry in a Cloudflare D1 database, both provisioned by Terraform through Orun, the schema applied by migrations, and packaged as an Orun baseline: one command takes a new product from nothing to live on stage and prod, in its own repository, under its own name — in ONE landing.

The template kept each document as one Upstash Redis hash with Redis's own EXPIRE and decremented its read count with HINCRBY. Here the ciphertext is a KV value with expirationTtl (so the shortest TTL is KV's 60 seconds), and the count is D1's: KV is eventually consistent, so the read limit is spent by one atomic UPDATE … WHERE remaining_reads > 0 RETURNING — two readers racing for the last read cannot both be served. The read that spends the last one deletes both halves. The encryption is the template's, unchanged, in the browser. What the baseline adds is everything needed to make a copy of it somebody else's, built the way cirrus-baseline is. See specs/epics/envshare for the design, the milestones and the as-built status.

Instantiating a product

git clone --depth 1 --branch <baseline-tag> https://github.com/sourceplane/envshare
cd envshare
orun new --blueprint repo-blueprint.yaml --out ~/sites/acme-vault --run-hooks --resume \
  --set reponame=acme-vault --set productname="Acme Vault" \
  --set githuborg=acme-inc --set subdomain=<workers-dev-subdomain>

Or, once the platform's registry lists it, from the Orun console (Baselines → envshare → Build). Two phases: 01-product creates the repository and lands the whole product as ONE pull request — intent, CI, tooling, the D1 and KV roots, the migrations, the site and its tests — and one convergence, per environment, applies the database and the namespace, then the migrations, then deploys the site bound to them; 02-docs records the live deployment from probed facts. BOOTSTRAP.md is the operator guide; docs/phases/ has a page per phase.

The new repository receives the product only — the app, its D1 and KV roots, its migrations and their runner, its tests, its CI, its tooling, a README of its own and its operating contract — renamed throughout to the product's name, repository, Cloudflare Worker, database and namespace names, and its HTTP API's headers. None of this repository's machinery ships.

What is here (the product)

Getting started

pnpm install
pnpm run wire:fixture   # render apps/web/wrangler.jsonc from the offline fixture
pnpm typecheck
pnpm lint
pnpm test
pnpm build              # next build --webpack + opennextjs-cloudflare build → apps/web/.open-next

pnpm --filter @app/web db:migrate:local   # the schema in wrangler's local D1
pnpm --filter @app/web dev                # http://localhost:3000 — local D1 and KV through wrangler's platform proxy
pnpm --filter @app/web preview            # wrangler dev over the built Worker, the same local bindings

How it maps to Vercel

How the bindings reach the Worker

infra/terraform/cloudflare-d1 ──apply──► orun secret WIRING_CLOUDFLARE_D1 (stage, prod)
infra/terraform/cloudflare-kv ──apply──► orun secret WIRING_CLOUDFLARE_KV
                                               │   (the landing's await checks they exist)
                                               ▼
infra/db-migrate  dependsOn cloudflare-d1 (enforced on main) · secretEnv WIRING_CLOUDFLARE_D1
  apply:  packages/db's runner → POST …/d1/database/<id>/query, each pending migration once
                                               ▼
apps/web  dependsOn cloudflare-d1, -kv + db-migrate (enforced on main) · secretEnv WIRING_CLOUDFLARE_*_<ENV>
  build:  tooling/wire/live.mjs → wrangler.jsonc with the environment's database and namespace
          (dev, verify-only, renders the fixture) → next build --webpack for the environment's origin
          → opennextjs-cloudflare

wrangler.jsonc is committed as the fixture render of wrangler.template.jsonc, because the deploy lane's verify-app-structure step checks the config exists before it builds; testing/e2e.test.sh fails if the two disagree.

CI