@decocms/blocks-migrate 0.0.0-stage → 8.1.0-next.0

package/src/imports.ts

@@ -0,0 +1,335 @@
+/**
+ * The import codemod: v7 `@decocms/*` imports in the site's `src/`.
+ *
+ * It rewrites only what has a v8 equivalent with the same meaning:
+ *
+ * - an import of a vendored module (`@decocms/apps-shopify/loaders/…`)
+ *   points at the copy in `src/vendor`;
+ * - `createInstrumentedFetch` from `@decocms/blocks/sdk/instrumentedFetch`
+ *   comes from `@decocms/blocks/fetch`, and `createInstrumentedFetch("x")`
+ *   becomes `createInstrumentedFetch({ provider: "x" })`.
+ *
+ * Every other v7 import is reported with where its replacement lives; none
+ * is shimmed. Imports of the next major's documented entry points are left
+ * alone.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+import type { Report } from "./report";
+import { relativeSpecifier, resolvePackageFile } from "./vendor";
+
+/** The next major's documented API (/next/api-reference): imports of these stay. */
+export const V8_API: Record<string, ReadonlySet<string> | "*"> = {
+  // The root's next-major exports (packages/blocks/src/index.ts, from ./v8).
+  "@decocms/blocks": new Set([
+    "Analytics",
+    "Block",
+    "BlockFunction",
+    "Blocks",
+    "Client",
+    "CMS",
+    "CMSError",
+    "createCMS",
+    "DRAFT_COOKIE",
+    "DraftPointer",
+    "draftCookie",
+    "draftPointer",
+    "formatDraftPointer",
+    "Lazy",
+    "ListOptions",
+    "Loader",
+    "Match",
+    "matchRoute",
+    "Page",
+    "parseDraftPointer",
+    "Redirect",
+    "Result",
+    "Route",
+    "remoteLoader",
+    "resetForTests",
+    "Secret",
+    "Seo",
+    "Snapshot",
+    "Telemetry",
+    "TelemetryConfig",
+    "Variant",
+  ]),
+  "@decocms/blocks/fetch": "*",
+  "@decocms/blocks/analytics": "*",
+  "@decocms/blocks/secrets": "*",
+  "@decocms/blocks/cli": "*",
+  "@decocms/tanstack": new Set(["kvLoader"]),
+};
+
+/** Where each v7 import's replacement lives, first match wins. */
+const HINTS: [RegExp, string][] = [
+  [/^@decocms\/start(\/|$)/, "a 6.x import: upgrade the site to 7.x first"],
+  [
+    /^@decocms\/blocks\/sdk\/cachedLoader$/,
+    "cachedLoader is gone: upstream caching lives in the framework binding (/next/caching#upstream-data)",
+  ],
+  [
+    /(^|\/)(invoke|createInvoke)$|\/sdk\/invoke/,
+    "/deco/invoke is gone: call upstream clients from server functions or route handlers (/next/renames-and-migrations#loaders-actions-and-invoke)",
+  ],
+  [
+    /^@decocms\/blocks-admin(\/|$)/,
+    "next-major sites serve no admin endpoints; the site editor uses the content protocol (/next/studio-compatibility)",
+  ],
+  [
+    /^@decocms\/blocks-cli(\/|$)/,
+    "codegen is the deco CLI in @decocms/blocks: deco schema, deco content, deco check (/next/cli)",
+  ],
+  [
+    /^@decocms\/blocks\/(setup|cms)(\/|$)/,
+    "setup is createCMS from @decocms/blocks, with the block map in .deco/index.ts (/next/content#create-the-cms)",
+  ],
+  [
+    /^@decocms\/blocks\/sdk\/instrumentedFetch$/,
+    "createInstrumentedFetch({ provider, fetch?, retry?, circuitBreaker? }) from @decocms/blocks/fetch (/next/api-reference#createinstrumentedfetch-options)",
+  ],
+  [
+    /^@decocms\/blocks\/(sdk\/(otel|observability|logger)|middleware\/observability)/,
+    "telemetry is the telemetry option of createCMS (/next/telemetry)",
+  ],
+  [
+    /^@decocms\/blocks\/types\/widgets$/,
+    "type the field as a string with a @format tag (/next/schema#widgets)",
+  ],
+  [
+    /(OneDollarStats|Analytics)$|^@decocms\/blocks\/sdk\/analytics$/,
+    "AnalyticsScript and track from @decocms/blocks/analytics, with the built-in analytics block (/next/analytics)",
+  ],
+  [
+    /^@decocms\/apps-salesforce(\/|$)|^@decocms\/apps\/salesforce(\/|$)/,
+    "the Salesforce client is @decocms/apps-sfmc-personalization (/next/upstream-clients#what-a-client-is)",
+  ],
+  [
+    /^@decocms\/apps-commerce(\/|$)|^@decocms\/apps\/commerce(\/|$)/,
+    "converters, hooks and shared commerce types live in your platform template (/next/upstream-clients#what-a-client-is)",
+  ],
+  [
+    /^@decocms\/apps-website(\/|$)|^@decocms\/apps\/website(\/|$)/,
+    "website features (SEO, sitemaps, redirects) live in your platform template (/next/upstream-clients#what-a-client-is)",
+  ],
+  [
+    /^@decocms\/apps(-[a-z]+)?(\/|$)/,
+    "apps are thin upstream clients now; call the platform's client from your own code (/next/upstream-clients)",
+  ],
+  [
+    /^@decocms\/(tanstack|nextjs)(\/|$)/,
+    "the v7 binding: follow your framework's guide (/next/tanstack-start-descriptors, /next/nextjs)",
+  ],
+];
+const DEFAULT_HINT = "no v8 equivalent";
+
+const SOURCE = /\.(tsx?|mts|cts)$/;
+
+function listSources(dir: string): string[] {
+  if (!fs.existsSync(dir)) return [];
+  return fs
+    .readdirSync(dir, { recursive: true, withFileTypes: true })
+    .filter((d) => d.isFile() && SOURCE.test(d.name) && !d.name.endsWith(".d.ts"))
+    .map((d) => path.join(d.parentPath, d.name))
+    .filter((f) => !f.split(path.sep).includes("node_modules"));
+}
+
+interface Found {
+  /** The string literal node holding the specifier. */
+  literal: ts.StringLiteral;
+  /** Named imports (`*` for a namespace or default import). */
+  names: string[];
+  declaration?: ts.ImportDeclaration;
+}
+
+function findImports(source: ts.SourceFile): Found[] {
+  const found: Found[] = [];
+  const visit = (node: ts.Node) => {
+    if (
+      (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&
+      node.moduleSpecifier &&
+      ts.isStringLiteral(node.moduleSpecifier)
+    ) {
+      const names: string[] = [];
+      if (ts.isImportDeclaration(node)) {
+        const clause = node.importClause;
+        if (clause?.name) names.push("default");
+        const bindings = clause?.namedBindings;
+        if (bindings && ts.isNamespaceImport(bindings)) names.push("*");
+        if (bindings && ts.isNamedImports(bindings)) {
+          for (const el of bindings.elements) names.push((el.propertyName ?? el.name).text);
+        }
+      } else if (node.exportClause && ts.isNamedExports(node.exportClause)) {
+        for (const el of node.exportClause.elements) names.push((el.propertyName ?? el.name).text);
+      } else {
+        names.push("*");
+      }
+      found.push({
+        literal: node.moduleSpecifier,
+        names,
+        declaration: ts.isImportDeclaration(node) ? node : undefined,
+      });
+    } else if (
+      ts.isCallExpression(node) &&
+      node.expression.kind === ts.SyntaxKind.ImportKeyword &&
+      node.arguments[0] &&
+      ts.isStringLiteral(node.arguments[0])
+    ) {
+      found.push({ literal: node.arguments[0], names: ["*"] });
+    } else if (
+      ts.isImportTypeNode(node) &&
+      ts.isLiteralTypeNode(node.argument) &&
+      ts.isStringLiteral(node.argument.literal)
+    ) {
+      found.push({ literal: node.argument.literal, names: ["*"] });
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return found;
+}
+
+function isDocumented(specifier: string, names: string[]): boolean {
+  const api = V8_API[specifier];
+  if (!api) return false;
+  return api === "*" || names.every((n) => api.has(n));
+}
+
+function hintFor(specifier: string): string {
+  return HINTS.find(([pattern]) => pattern.test(specifier))?.[1] ?? DEFAULT_HINT;
+}
+
+/** `createInstrumentedFetch("x")` calls, or null when one has another argument shape. */
+function instrumentedFetchCalls(source: ts.SourceFile, local: string): ts.CallExpression[] | null {
+  const calls: ts.CallExpression[] = [];
+  let convertible = true;
+  const visit = (node: ts.Node) => {
+    if (
+      ts.isCallExpression(node) &&
+      ts.isIdentifier(node.expression) &&
+      node.expression.text === local
+    ) {
+      const [arg] = node.arguments;
+      if (node.arguments.length === 1 && arg && ts.isStringLiteralLike(arg)) calls.push(node);
+      else convertible = false;
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return convertible ? calls : null;
+}
+
+interface Edit {
+  start: number;
+  end: number;
+  text: string;
+}
+
+/**
+ * Rewrite and report the `@decocms/*` imports of every source file in `src/`.
+ * `vendored` maps an installed source file to its copy in the site.
+ */
+export function rewriteImports(root: string, report: Report, vendored: Map<string, string>): void {
+  const reported = new Map<string, { names: Set<string>; files: Set<string> }>();
+  let rewrittenFiles = 0;
+
+  for (const file of listSources(path.join(root, "src"))) {
+    const text = fs.readFileSync(file, "utf8");
+    if (!text.includes("@decocms/")) continue;
+    const source = ts.createSourceFile(
+      file,
+      text,
+      ts.ScriptTarget.Latest,
+      true,
+      file.endsWith("x") ? ts.ScriptKind.TSX : ts.ScriptKind.TS,
+    );
+    const edits: Edit[] = [];
+    const rel = path.relative(root, file).split(path.sep).join("/");
+
+    for (const found of findImports(source)) {
+      const specifier = found.literal.text;
+      if (!specifier.startsWith("@decocms/")) continue;
+      const replace = (to: string) =>
+        edits.push({
+          start: found.literal.getStart(source) + 1,
+          end: found.literal.getEnd() - 1,
+          text: to,
+        });
+
+      // 1. A vendored module: import the copy.
+      const target = resolvePackageFile(root, specifier);
+      const copy = target ? vendored.get(target) : undefined;
+      if (copy) {
+        replace(relativeSpecifier(file, copy));
+        continue;
+      }
+
+      // 2. createInstrumentedFetch moved to @decocms/blocks/fetch, options-only.
+      const decl = found.declaration;
+      const bindings = decl?.importClause?.namedBindings;
+      if (
+        specifier === "@decocms/blocks/sdk/instrumentedFetch" &&
+        decl &&
+        !decl.importClause?.isTypeOnly &&
+        !decl.importClause?.name &&
+        bindings &&
+        ts.isNamedImports(bindings) &&
+        bindings.elements.length === 1 &&
+        (bindings.elements[0].propertyName ?? bindings.elements[0].name).text ===
+          "createInstrumentedFetch"
+      ) {
+        const calls = instrumentedFetchCalls(source, bindings.elements[0].name.text);
+        if (calls) {
+          replace("@decocms/blocks/fetch");
+          for (const call of calls) {
+            const arg = call.arguments[0];
+            edits.push({
+              start: arg.getStart(source),
+              end: arg.getEnd(),
+              text: `{ provider: ${arg.getText(source)} }`,
+            });
+          }
+          continue;
+        }
+      }
+
+      // 3. The next major's documented API: nothing to do.
+      if (isDocumented(specifier, found.names)) continue;
+
+      // 4. Everything else: report.
+      const entry = reported.get(specifier) ?? { names: new Set(), files: new Set() };
+      for (const n of found.names) entry.names.add(n);
+      entry.files.add(
+        `${rel}:${source.getLineAndCharacterOfPosition(found.literal.getStart(source)).line + 1}`,
+      );
+      reported.set(specifier, entry);
+    }
+
+    if (edits.length > 0) {
+      let out = text;
+      for (const edit of edits.sort((a, b) => b.start - a.start)) {
+        out = out.slice(0, edit.start) + edit.text + out.slice(edit.end);
+      }
+      fs.writeFileSync(file, out);
+      rewrittenFiles++;
+    }
+  }
+
+  if (rewrittenFiles > 0) {
+    report.done.push({
+      step: "imports",
+      subject: "src/",
+      message: `rewrote imports in ${rewrittenFiles} files`,
+    });
+  }
+  for (const [specifier, { names, files }] of [...reported].sort(([a], [b]) => (a < b ? -1 : 1))) {
+    const list = [...files];
+    const where = `${list.slice(0, 3).join(", ")}${list.length > 3 ? `, +${list.length - 3} more` : ""}`;
+    report.manual.push({
+      step: "imports",
+      subject: `${specifier} {${[...names].join(", ")}}`,
+      message: `${hintFor(specifier)}; in ${where}`,
+    });
+  }
+}

package/src/legacyNames.ts

@@ -0,0 +1,45 @@
+/**
+ * Legacy type names the next major's alias table doesn't carry (spec:
+ * studio-compatibility › Well-known types and the alias table). v7 resolved
+ * these; the next major resolves only the names the site editor's screens
+ * look for, so the migration rewrites the others to one of those (or to the
+ * built-in's own name) in the saved content.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { serializeBlock } from "@decocms/blocks/protocol/keys";
+import type { Report } from "./report";
+import { forEachBlock, readContent } from "./walk";
+
+/** Old name → the name it's saved under after the migration. Same props, same behaviour. */
+export const RENAMED_TYPES: Readonly<Record<string, string>> = {
+  "website/flags/multivariate/image.ts": "website/flags/multivariate.ts",
+  "website/flags/multivariate/message.ts": "website/flags/multivariate.ts",
+  "website/flags/multivariate/page.ts": "website/flags/multivariate.ts",
+  "$live/flags/multivariate.ts": "website/flags/multivariate.ts",
+  "$live/matchers/MatchAlways.ts": "website/matchers/always.ts",
+  "website/matchers/date.ts": "date",
+  "$live/matchers/MatchDate.ts": "date",
+};
+
+export function renameLegacyTypes(root: string, report: Report): void {
+  const { blocks, files } = readContent(root);
+  for (const [entry, block] of Object.entries(blocks)) {
+    const renamed = new Set<string>();
+    forEachBlock(block, (node) => {
+      const to = Object.hasOwn(RENAMED_TYPES, node.__resolveType)
+        ? RENAMED_TYPES[node.__resolveType]
+        : undefined;
+      if (to === undefined) return;
+      renamed.add(`${node.__resolveType} → ${to}`);
+      node.__resolveType = to;
+    });
+    if (renamed.size === 0) continue;
+    fs.writeFileSync(path.join(root, ".deco", "blocks", files[entry]!), serializeBlock(block));
+    report.done.push({
+      step: "content",
+      subject: files[entry]!,
+      message: `renamed ${[...renamed].join(", ")}`,
+    });
+  }
+}

package/src/main.ts

@@ -0,0 +1,43 @@
+/** The `blocks-migrate` bin's entry. */
+import { parseArgs } from "node:util";
+import { migrate } from "./migrate";
+import { formatReport } from "./report";
+
+const USAGE = `Usage: blocks-migrate [--root <dir>] [--decofile <file>]
+
+Migrates a v7 Deco site to the next major, in place, and prints what is left
+to do. Run it on a clean working tree with DECO_CRYPTO_KEY set and
+.deco/secrets.pub committed (see /next/renames-and-migrations).
+
+  --root <dir>       the app root, with the site's package.json (default: .)
+  --decofile <file>  content to split into .deco/blocks when the site has none
+                     (the JSON served at <site>/.decofile)`;
+
+async function main(argv: string[]): Promise<number> {
+  const { values } = parseArgs({
+    args: argv,
+    options: {
+      root: { type: "string", default: "." },
+      decofile: { type: "string" },
+      help: { type: "boolean", short: "h" },
+    },
+  });
+  if (values.help) {
+    console.log(USAGE);
+    return 0;
+  }
+  const report = await migrate({ root: values.root!, decofile: values.decofile });
+  console.log(formatReport(report));
+  return 0;
+}
+
+main(process.argv.slice(2)).then(
+  (code) => {
+    process.exitCode = code;
+  },
+  (error) => {
+    console.error(error instanceof Error ? error.message : error);
+    console.error(USAGE);
+    process.exitCode = 1;
+  },
+);

package/src/migrate.ts

@@ -0,0 +1,88 @@
+/**
+ * `blocks-migrate`: moves a v7 site to the next major in one pass (spec:
+ * renames-and-migrations › Migrating from v7). The steps, in order:
+ *
+ * 1. content: saved blocks in `.deco/blocks`, v7 generated files removed,
+ *    legacy type names outside the alias table renamed, and A/B tests keyed
+ *    on a random matcher get its name as `experiment`;
+ * 2. secrets: v7 secrets re-encrypted with `.deco/secrets.pub`;
+ * 3. block map: `.deco/index.ts` with aliases under the v7 names, after
+ *    vendoring the app loaders and actions the content calls;
+ * 4. imports: the codemod over `src/`;
+ * 5. scripts: `deco schema && deco content` before dev and build.
+ *
+ * It changes files in place, so run it on a clean working tree and review the
+ * diff. What it can't do is returned in the report.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { writeBlockMap } from "./blockMap";
+import { moveContent } from "./content";
+import { copyExperimentIds } from "./experiments";
+import { rewriteImports } from "./imports";
+import { renameLegacyTypes } from "./legacyNames";
+import { createReport, type Report } from "./report";
+import { reencryptSecrets } from "./secrets";
+
+interface MigrateOptions {
+  /** The app root: the folder with the site's package.json. */
+  root: string;
+  /** A decofile to split into `.deco/blocks` when the site has none, relative to the root. */
+  decofile?: string;
+}
+
+/** The scripts /next/cli#run-it-before-dev-and-build asks for. */
+const SCRIPTS: Record<string, string> = {
+  predev: "deco schema && deco content",
+  prebuild: "deco schema && deco content && deco check",
+};
+
+function addScripts(root: string, report: Report): void {
+  const file = path.join(root, "package.json");
+  const manifest = JSON.parse(fs.readFileSync(file, "utf8"));
+  manifest.scripts ??= {};
+  const added: string[] = [];
+  for (const [name, command] of Object.entries(SCRIPTS)) {
+    const current = manifest.scripts[name];
+    if (current === undefined) {
+      manifest.scripts[name] = command;
+      added.push(name);
+    } else if (!current.includes(command)) {
+      report.manual.push({
+        step: "scripts",
+        subject: `package.json ${name}`,
+        message: `run ${command} in it (/next/cli#run-it-before-dev-and-build)`,
+      });
+    }
+  }
+  if (added.length > 0) {
+    fs.writeFileSync(file, `${JSON.stringify(manifest, null, 2)}\n`);
+    report.done.push({
+      step: "scripts",
+      subject: "package.json",
+      message: `added ${added.join(" and ")}`,
+    });
+  }
+  report.manual.push({
+    step: "scripts",
+    subject: "package.json",
+    message:
+      "depend on the next major of @decocms/blocks, drop the v7 codegen from build and the @decocms/blocks-admin and @decocms/blocks-cli dependencies once nothing imports them",
+  });
+}
+
+export async function migrate(options: MigrateOptions): Promise<Report> {
+  const root = path.resolve(options.root);
+  if (!fs.existsSync(path.join(root, "package.json"))) {
+    throw new Error(`no package.json in ${root}; pass the app root with --root`);
+  }
+  const report = createReport();
+  moveContent(root, report, { decofile: options.decofile });
+  renameLegacyTypes(root, report);
+  copyExperimentIds(root, report);
+  await reencryptSecrets(root, report);
+  const { vendored } = writeBlockMap(root, report);
+  rewriteImports(root, report, vendored);
+  addScripts(root, report);
+  return report;
+}

package/src/report.ts

@@ -0,0 +1,40 @@
+/**
+ * What a migration did and what it left for a person: every step adds to one
+ * report, which the command prints at the end.
+ */
+type Step = "content" | "secrets" | "block map" | "vendor" | "imports" | "scripts";
+
+export interface Note {
+  step: Step;
+  /** What the note is about: a type name, a file, an import specifier. */
+  subject: string;
+  message: string;
+}
+
+export interface Report {
+  /** Changes the migration made. */
+  done: Note[];
+  /** Work left for a person: nothing was changed for these. */
+  manual: Note[];
+}
+
+export function createReport(): Report {
+  return { done: [], manual: [] };
+}
+
+function section(title: string, notes: Note[]): string[] {
+  if (notes.length === 0) return [];
+  const lines = [`${title} (${notes.length})`];
+  for (const step of new Set(notes.map((n) => n.step))) {
+    lines.push(`  ${step}`);
+    for (const n of notes.filter((n) => n.step === step)) {
+      lines.push(`    ${n.subject}: ${n.message}`);
+    }
+  }
+  return lines;
+}
+
+export function formatReport(report: Report): string {
+  const lines = [...section("Done", report.done), ...section("Left to do", report.manual)];
+  return lines.length > 0 ? lines.join("\n") : "Nothing to migrate.";
+}

package/src/secrets.ts

@@ -0,0 +1,117 @@
+/**
+ * Secrets (spec: renames-and-migrations › Secrets). v7 saved each credential
+ * as a `website/loaders/secret.ts` block holding `encrypted`, an AES-CBC
+ * value under `DECO_CRYPTO_KEY`. The next major's `secret` block holds
+ * `ciphertext`, encrypted with the site's public key (`.deco/secrets.pub`).
+ * This step decrypts each v7 secret (v7's format, read here so nothing from
+ * v7 is imported) and re-encrypts it with `encryptSecret`, in place, so the
+ * content commit carries the change.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { LEGACY_ALIASES } from "@decocms/blocks/cli";
+import { serializeBlock } from "@decocms/blocks/protocol/keys";
+import { encryptSecret } from "@decocms/blocks/secrets";
+import type { Report } from "./report";
+import { forEachBlock, type JsonObject, readContent } from "./walk";
+
+const DOCS = "/next/renames-and-migrations#secrets";
+
+/** The v7 type names of a secret: every legacy alias of `secret`, with and without the extension. */
+const LEGACY_SECRET_TYPES = new Set(
+  Object.entries(LEGACY_ALIASES)
+    .filter(([, target]) => target === "secret")
+    .flatMap(([name]) => [name, name.replace(/\.tsx?$/, "")]),
+);
+
+/**
+ * v7's secret format: `DECO_CRYPTO_KEY` is base64 JSON `{ key, iv }` (byte
+ * arrays) for AES-CBC, and `encrypted` is the ciphertext in hex. Returns null
+ * when the value doesn't decrypt with that key.
+ */
+async function decryptV7(encryptedHex: string, cryptoKey: string): Promise<string | null> {
+  try {
+    const parsed = JSON.parse(atob(cryptoKey));
+    const bytes = (v: unknown) => new Uint8Array(Array.isArray(v) ? v : Object.values(v as object));
+    const key = await crypto.subtle.importKey("raw", bytes(parsed.key), "AES-CBC", false, [
+      "decrypt",
+    ]);
+    const data = Uint8Array.from(encryptedHex.match(/../g) ?? [], (h) => Number.parseInt(h, 16));
+    const plain = await crypto.subtle.decrypt({ name: "AES-CBC", iv: bytes(parsed.iv) }, key, data);
+    return new TextDecoder().decode(plain);
+  } catch {
+    return null;
+  }
+}
+
+/** Re-encrypt every v7 secret in `.deco/blocks`. Reads `DECO_CRYPTO_KEY` from the environment. */
+export async function reencryptSecrets(root: string, report: Report): Promise<void> {
+  const { blocks, files } = readContent(root);
+  const found: { entry: string; block: JsonObject }[] = [];
+  for (const [entry, block] of Object.entries(blocks)) {
+    forEachBlock(block, (node) => {
+      if (!LEGACY_SECRET_TYPES.has(node.__resolveType)) return;
+      if (typeof node.encrypted === "string") {
+        found.push({ entry, block: node });
+        return;
+      }
+      const env = typeof node.name === "string" ? ` (it read env ${node.name})` : "";
+      report.manual.push({
+        step: "secrets",
+        subject: files[entry],
+        message: `a v7 secret with no encrypted value${env}: save it in the site editor (${DOCS})`,
+      });
+    });
+  }
+  if (found.length === 0) return;
+
+  const leave = (message: string) => {
+    for (const { entry } of found) {
+      report.manual.push({ step: "secrets", subject: files[entry], message });
+    }
+  };
+  const publicKeyFile = path.join(root, ".deco", "secrets.pub");
+  if (!fs.existsSync(publicKeyFile)) {
+    leave(
+      `a v7 secret: create the key pair (.deco/secrets.pub) and run again with DECO_CRYPTO_KEY set (${DOCS})`,
+    );
+    return;
+  }
+  const cryptoKey = process.env.DECO_CRYPTO_KEY;
+  if (!cryptoKey) {
+    leave(`a v7 secret: run again with DECO_CRYPTO_KEY set to re-encrypt it (${DOCS})`);
+    return;
+  }
+  const publicKey = fs.readFileSync(publicKeyFile, "utf8");
+
+  const changed = new Set<string>();
+  for (const { entry, block } of found) {
+    const name = typeof block.name === "string" ? block.name : undefined;
+    const value = await decryptV7(block.encrypted as string, cryptoKey);
+    if (value === null) {
+      report.manual.push({
+        step: "secrets",
+        subject: files[entry],
+        message: `secret${name ? ` ${name}` : ""} didn't decrypt with DECO_CRYPTO_KEY; save it again in the site editor`,
+      });
+      continue;
+    }
+    const { __resolveType, ciphertext } = await encryptSecret(publicKey, value);
+    // Keep fields this step doesn't know; drop the v7 ones.
+    delete block.encrypted;
+    delete block.name;
+    Object.assign(block, { __resolveType, ciphertext });
+    changed.add(entry);
+    report.done.push({
+      step: "secrets",
+      subject: files[entry],
+      message: `re-encrypted secret${name ? ` ${name}` : ""} with .deco/secrets.pub`,
+    });
+  }
+  for (const entry of changed) {
+    fs.writeFileSync(
+      path.join(root, ".deco", "blocks", files[entry]),
+      serializeBlock(blocks[entry]),
+    );
+  }
+}