@saastemly/voidcommerce 0.14.0 → 0.16.0

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-jvsednjr.js";
+} from "./index-x70qxh3m.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -50,7 +50,7 @@ import {
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-paeg95y4.js";
+} from "./index-s8se0x2d.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -255,11 +255,31 @@ async function preflightCommand(args) {
     console.error("vc: no voidcommerce.json here.");
     return 1;
   }
-  const source = args.includes("--cloudflare") ? "wrangler" : "void";
+  const source = args.includes("--repo") ? "repository" : args.includes("--cloudflare") ? "wrangler" : "void";
   const result = await preflight(project, source);
   printPreflight(project, result, source);
+  if (source !== "repository")
+    return result.ready ? 0 : 1;
+  const pending = await uncommittedMigrations(project.root);
+  if (pending.length > 0) {
+    console.error(`${color2.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:
+` + `    ${pending.join(`
+    `)}
+
+` + `  The deploy applies what is in the repository. Commit these, or the
+` + `  schema the shop runs on is not the one you tested.
+`);
+    return 1;
+  }
   return result.ready ? 0 : 1;
 }
+async function uncommittedMigrations(root) {
+  const status = await run("git", ["status", "--porcelain", "--", "migrations"], root);
+  if (status.code !== 0)
+    return [];
+  return status.out.split(`
+`).map((line2) => line2.trim()).filter(Boolean).map((line2) => line2.replace(/^\S+\s+/, ""));
+}
 async function deployHelp() {
   const captured = await captureVoid(["deploy", "--help"]);
   const width = 80;

package/dist/deploy/preflight.d.ts

@@ -21,7 +21,16 @@ export interface Preflight {
     bareSecrets: string[];
     ready: boolean;
 }
-export type SecretSource = "wrangler" | "void";
+/**
+ * Where a secret's presence is established.
+ *
+ * `repository` asks only what is committed, and is the right question before
+ * a PUSH: the deploy happens off this machine from what was pushed, so a
+ * check that needs local credentials is checking the wrong thing. It is also
+ * the only mode that works on a machine which has none — which, if config is
+ * properly in the environment, is every machine.
+ */
+export type SecretSource = "wrangler" | "void" | "repository";
 /** Keys committed in .env.production — safe values only, by construction. */
 export declare function productionEnv(appDir: string): Map<string, string>;
 /** The worker's hostnames must be what the layout says. */

package/dist/deploy/secrets.d.ts

@@ -66,6 +66,16 @@ export declare function committedPublicKeyInto(root: string, publicKey: string):
  * can say "all five are declared" on a machine that cannot read any of them.
  */
 export declare function declaredSecretNames(root: string): Set<string>;
+/**
+ * Declared names whose value is still the `unset` placeholder.
+ *
+ * Readable WITHOUT the key, because `unset` is plaintext — which is what
+ * lets a push-time gate tell "this shop has a Stripe key" from "this shop
+ * has a line that says STRIPE_SECRET_KEY". Preflight used to count the
+ * second as present, so a shop could pass every check and then fail to take
+ * money in production.
+ */
+export declare function unsetSecretNames(root: string): string[];
 /** Is a declared value actually encrypted, or was it committed in the clear? */
 export declare function plaintextSecretNames(root: string): string[];
 /**

package/dist/{index-paeg95y4.js → index-s8se0x2d.js}

@@ -342,6 +342,21 @@ function declaredSecretNames(root) {
   }
   return names;
 }
+function unsetSecretNames(root) {
+  const path = join2(root, SECRETS_FILE);
+  if (!existsSync2(path))
+    return [];
+  const out = [];
+  for (const line of readFileSync(path, "utf8").split(`
+`)) {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!match || match[1].startsWith("DOTENV_"))
+      continue;
+    if (match[2].trim().replace(/^['"]|['"]$/g, "") === "unset")
+      out.push(match[1]);
+  }
+  return out;
+}
 function plaintextSecretNames(root) {
   const path = join2(root, SECRETS_FILE);
   if (!existsSync2(path))
@@ -389,7 +404,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-nntc65pq.js");
+    const { publicKeyFor } = await import("./keys-6neyajsv.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -916,4 +931,4 @@ ${color2.green("✓")} re-keyed under ${made.publicKey.slice(0, 20)}… and ${PR
   return 0;
 }
 
-export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, ghAuth, repoSlug, setSecret, secretNames, setVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };
+export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, ghAuth, repoSlug, setSecret, secretNames, setVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };

package/dist/{index-jvsednjr.js → index-x70qxh3m.js}

@@ -10,8 +10,9 @@ import {
   renderEnvExample,
   renderEnvLocal,
   renderEnvProduction,
-  renderEnvTs
-} from "./index-paeg95y4.js";
+  renderEnvTs,
+  unsetSecretNames
+} from "./index-s8se0x2d.js";
 import {
   MANIFEST_FILE,
   has,
@@ -1378,7 +1379,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.14.0",
+  version: "0.16.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1711,8 +1712,10 @@ function renderDistWorkflow(manifest) {
 
 # Generated by \`vc init\` from voidcommerce.json.
 #
-# A push to main regenerates the Void app from the manifest, publishes it to
-# \`${DIST_BRANCH}\` as a standalone tree, and deploys it to Cloudflare.
+# A push to main is checked, then regenerates the Void app from the manifest,
+# publishes it to \`${DIST_BRANCH}\` as a standalone tree, and deploys it to
+# Cloudflare. The check runs FIRST and on its own: nothing is built, created
+# or replaced for a shop that is not ready.
 #
 # The credentials come from the repository, set once by \`vc link\`:
 #
@@ -1737,8 +1740,32 @@ permissions:
   contents: write
 
 jobs:
+  # ── Is what was just pushed fit to deploy? ─────────────────────────────
+  #
+  # First, and on its own, because everything after it costs something: a
+  # build, a database, a worker replaced. It answers the question the deploy
+  # would ask, against exactly what was pushed, and needs NO CREDENTIALS to
+  # do it — config lives in the repository, encrypted, so readiness is a
+  # property of the commit rather than of whoever pushed it.
+  #
+  # This is the gate. It cannot be skipped with --no-verify, and it runs the
+  # same way for every push and every person.
+  preflight:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install --frozen-lockfile
+
+      # Every required key actually SET rather than merely declared, nothing
+      # committed in the clear, the hostnames the manifest says, and no
+      # migration generated but left uncommitted.
+      - name: vc preflight --repo
+        run: bunx vc preflight --repo
+
   # ── Regenerate, and publish the standalone tree ────────────────────────
   dist:
+    needs: preflight
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -1838,7 +1865,12 @@ regenerate with \`vc generate\`.
 git push
 \`\`\`
 
-That is the deploy. GitHub Actions regenerates the app from
+That is the deploy. It is checked first: a \`preflight\` job runs before
+anything is built, and refuses a shop whose secrets are declared but unset,
+whose values were committed in the clear, or whose migrations are not all
+committed. It needs no credentials — readiness is a property of the commit,
+not of the machine that pushed it — so it fails the same way for everyone,
+and cannot be skipped. GitHub Actions regenerates the app from
 \`voidcommerce.json\`, publishes a standalone copy to \`${DIST_BRANCH}\`, creates the
 database and queue if they are not there, applies the migrations, and deploys
 the worker with this repository's secrets attached.
@@ -2433,6 +2465,23 @@ async function link(root, file, target, result) {
   }
 }
 var sorted = (record) => Object.fromEntries(Object.entries(record).sort());
+async function generateHooks(root, result) {
+  await put(root, ".husky/pre-commit", `#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
+# file so the COMMIT carries the ciphertext rather than what you staged.
+# Encryption needs only the public key in that file, so this needs no
+# credential and works on a fresh clone.
+#
+# It refuses only when it cannot fix the problem itself: no key yet
+# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
+# committed in the clear cannot be un-committed — the value stays in the
+# history and has to be treated as burned.
+bunx vc guard
+`, result, "regenerate");
+  await retire(root, ".husky/pre-push", result);
+}
 async function generate(root, manifest) {
   const result = { written: [], kept: [], retired: [], packages: packagesOf(manifest) };
   await writeManifest(root, manifest);
@@ -2453,6 +2502,7 @@ async function generate(root, manifest) {
       await generateStrictApp(root, STRICT_APP, manifest, result);
       break;
   }
+  await generateHooks(root, result);
   return result;
 }
 async function generateApi(root, dir, manifest, result, opts) {
@@ -2601,20 +2651,6 @@ dist
 .DS_Store
 `, result, "own");
   await put(root, "patches/void@0.10.13.patch", renderVoidPatch(), result, "regenerate");
-  await put(root, ".husky/pre-commit", `#!/usr/bin/env sh
-# Generated by \`vc init\`.
-#
-# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
-# file so the COMMIT carries the ciphertext rather than what you staged.
-# Encryption needs only the public key in that file, so this needs no
-# credential and works on a fresh clone.
-#
-# It refuses only when it cannot fix the problem itself: no key yet
-# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
-# committed in the clear cannot be un-committed — the value stays in the
-# history and has to be treated as burned.
-bunx vc guard
-`, result, "regenerate");
   await put(root, ".github/workflows/deploy.yml", renderDistWorkflow(manifest), result, "regenerate");
   await retire(root, ".github/workflows/void-dist.yml", result);
   await put(root, "DEPLOY.md", renderDeployReadme(manifest, zone(manifest), workerHosts(manifest)), result, "regenerate");
@@ -3036,7 +3072,9 @@ function routeProblem(project) {
 async function preflight(project, source) {
   const present = productionEnv(project.appDir);
   let remote = null;
-  if (source === "wrangler") {
+  if (source === "repository") {
+    remote = null;
+  } else if (source === "wrangler") {
     const bin = findWrangler(project.appDir);
     remote = bin ? await secretNames(bin, project.appDir) : null;
   } else {
@@ -3044,8 +3082,11 @@ async function preflight(project, source) {
   }
   for (const name of remote ?? [])
     present.set(name, "<secret>");
-  for (const name of declaredSecretNames(project.root))
-    present.set(name, "<in the repository>");
+  const stillUnset = new Set(unsetSecretNames(project.root));
+  for (const name of declaredSecretNames(project.root)) {
+    if (!stillUnset.has(name))
+      present.set(name, "<in the repository>");
+  }
   const missing = allEnvKeys(project.manifest).filter((key) => {
     const value = present.get(key.key);
     return value === undefined || value === "" || value === UNSET;

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-jvsednjr.js";
+} from "./index-x70qxh3m.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-paeg95y4.js";
+} from "./index-s8se0x2d.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/dist/{keys-nntc65pq.js → keys-6neyajsv.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-paeg95y4.js";
+} from "./index-s8se0x2d.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/deploy/index.ts

@@ -61,12 +61,40 @@ export async function preflightCommand(args: string[]): Promise<number> {
 		console.error("vc: no voidcommerce.json here.");
 		return 1;
 	}
-	const source = args.includes("--cloudflare") ? "wrangler" : "void";
+	const source = args.includes("--repo") ? "repository" : args.includes("--cloudflare") ? "wrangler" : "void";
 	const result = await preflight(project, source);
 	printPreflight(project, result, source);
+	if (source !== "repository") return result.ready ? 0 : 1;
+
+	// A repository check is a check on what will be PUSHED, so it also asks
+	// the question CI would ask and cannot answer any earlier: is there a
+	// migration that was generated and never committed? Applied under a fresh
+	// name on the next run, against tables that already exist, it fails the
+	// deploy — and it fails it after the shop is already down for the update.
+	const pending = await uncommittedMigrations(project.root);
+	if (pending.length > 0) {
+		console.error(
+			`${color.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:\n` +
+				`    ${pending.join("\n    ")}\n\n` +
+				"  The deploy applies what is in the repository. Commit these, or the\n" +
+				"  schema the shop runs on is not the one you tested.\n",
+		);
+		return 1;
+	}
 	return result.ready ? 0 : 1;
 }
 
+/** Migration files git does not have — untracked or modified. */
+async function uncommittedMigrations(root: string): Promise<string[]> {
+	const status = await run("git", ["status", "--porcelain", "--", "migrations"], root);
+	if (status.code !== 0) return [];
+	return status.out
+		.split("\n")
+		.map((line) => line.trim())
+		.filter(Boolean)
+		.map((line) => line.replace(/^\S+\s+/, ""));
+}
+
 /** void's deploy help, then what vc adds. */
 export async function deployHelp(): Promise<number> {
 	const captured = await captureVoid(["deploy", "--help"]);

package/src/deploy/preflight.ts

@@ -7,7 +7,7 @@ import { workerHosts } from "../manifest";
 import type { Project } from "../project";
 import { captureVoid } from "../void";
 import { parseJsonc } from "./jsonc";
-import { SECRETS_FILE, declaredSecretNames, plaintextSecretNames } from "./secrets";
+import { SECRETS_FILE, declaredSecretNames, plaintextSecretNames, unsetSecretNames } from "./secrets";
 import { findWrangler, secretNames } from "./wrangler";
 
 /**
@@ -34,7 +34,16 @@ export interface Preflight {
 	ready: boolean;
 }
 
-export type SecretSource = "wrangler" | "void";
+/**
+ * Where a secret's presence is established.
+ *
+ * `repository` asks only what is committed, and is the right question before
+ * a PUSH: the deploy happens off this machine from what was pushed, so a
+ * check that needs local credentials is checking the wrong thing. It is also
+ * the only mode that works on a machine which has none — which, if config is
+ * properly in the environment, is every machine.
+ */
+export type SecretSource = "wrangler" | "void" | "repository";
 
 /** Keys committed in .env.production — safe values only, by construction. */
 export function productionEnv(appDir: string): Map<string, string> {
@@ -81,7 +90,9 @@ export function routeProblem(project: Project): string | null {
 export async function preflight(project: Project, source: SecretSource): Promise<Preflight> {
 	const present = productionEnv(project.appDir);
 	let remote: Set<string> | null = null;
-	if (source === "wrangler") {
+	if (source === "repository") {
+		remote = null;
+	} else if (source === "wrangler") {
 		const bin = findWrangler(project.appDir);
 		remote = bin ? await secretNames(bin, project.appDir) : null;
 	} else {
@@ -94,7 +105,12 @@ export async function preflight(project: Project, source: SecretSource): Promise
 	 * uploads it. The names are readable without the key — dotenvx encrypts
 	 * values, not keys — so this works on a machine that cannot decrypt.
 	 */
-	for (const name of declaredSecretNames(project.root)) present.set(name, "<in the repository>");
+	const stillUnset = new Set(unsetSecretNames(project.root));
+	for (const name of declaredSecretNames(project.root)) {
+		// A name is not a value. `unset` is the documented placeholder, so a
+		// key carrying it is declared and absent at the same time.
+		if (!stillUnset.has(name)) present.set(name, "<in the repository>");
+	}
 
 	const missing = allEnvKeys(project.manifest).filter((key) => {
 		const value = present.get(key.key);

package/src/deploy/secrets.ts

@@ -126,6 +126,27 @@ export function declaredSecretNames(root: string): Set<string> {
 	return names;
 }
 
+/**
+ * Declared names whose value is still the `unset` placeholder.
+ *
+ * Readable WITHOUT the key, because `unset` is plaintext — which is what
+ * lets a push-time gate tell "this shop has a Stripe key" from "this shop
+ * has a line that says STRIPE_SECRET_KEY". Preflight used to count the
+ * second as present, so a shop could pass every check and then fail to take
+ * money in production.
+ */
+export function unsetSecretNames(root: string): string[] {
+	const path = join(root, SECRETS_FILE);
+	if (!existsSync(path)) return [];
+	const out: string[] = [];
+	for (const line of readFileSync(path, "utf8").split("\n")) {
+		const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+		if (!match || match[1]!.startsWith("DOTENV_")) continue;
+		if (match[2]!.trim().replace(/^['"]|['"]$/g, "") === "unset") out.push(match[1]!);
+	}
+	return out;
+}
+
 /** Is a declared value actually encrypted, or was it committed in the clear? */
 export function plaintextSecretNames(root: string): string[] {
 	const path = join(root, SECRETS_FILE);

package/src/generate/ci.ts

@@ -42,8 +42,10 @@ export function renderDistWorkflow(manifest: Manifest): string {
 
 # Generated by \`vc init\` from voidcommerce.json.
 #
-# A push to main regenerates the Void app from the manifest, publishes it to
-# \`${DIST_BRANCH}\` as a standalone tree, and deploys it to Cloudflare.
+# A push to main is checked, then regenerates the Void app from the manifest,
+# publishes it to \`${DIST_BRANCH}\` as a standalone tree, and deploys it to
+# Cloudflare. The check runs FIRST and on its own: nothing is built, created
+# or replaced for a shop that is not ready.
 #
 # The credentials come from the repository, set once by \`vc link\`:
 #
@@ -68,8 +70,32 @@ permissions:
   contents: write
 
 jobs:
+  # ── Is what was just pushed fit to deploy? ─────────────────────────────
+  #
+  # First, and on its own, because everything after it costs something: a
+  # build, a database, a worker replaced. It answers the question the deploy
+  # would ask, against exactly what was pushed, and needs NO CREDENTIALS to
+  # do it — config lives in the repository, encrypted, so readiness is a
+  # property of the commit rather than of whoever pushed it.
+  #
+  # This is the gate. It cannot be skipped with --no-verify, and it runs the
+  # same way for every push and every person.
+  preflight:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install --frozen-lockfile
+
+      # Every required key actually SET rather than merely declared, nothing
+      # committed in the clear, the hostnames the manifest says, and no
+      # migration generated but left uncommitted.
+      - name: vc preflight --repo
+        run: bunx vc preflight --repo
+
   # ── Regenerate, and publish the standalone tree ────────────────────────
   dist:
+    needs: preflight
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -171,7 +197,12 @@ regenerate with \`vc generate\`.
 git push
 \`\`\`
 
-That is the deploy. GitHub Actions regenerates the app from
+That is the deploy. It is checked first: a \`preflight\` job runs before
+anything is built, and refuses a shop whose secrets are declared but unset,
+whose values were committed in the clear, or whose migrations are not all
+committed. It needs no credentials — readiness is a property of the commit,
+not of the machine that pushed it — so it fails the same way for everyone,
+and cannot be skipped. GitHub Actions regenerates the app from
 \`voidcommerce.json\`, publishes a standalone copy to \`${DIST_BRANCH}\`, creates the
 database and queue if they are not there, applies the migrations, and deploys
 the worker with this repository's secrets attached.

package/src/generate/index.ts

@@ -195,6 +195,46 @@ async function link(root: string, file: string, target: string, result: Generate
 
 const sorted = (record: Record<string, string>) => Object.fromEntries(Object.entries(record).sort());
 
+/**
+ * Git hooks, for every layout.
+ *
+ * They guard `.env.secrets`, which exists whatever the layout, so making
+ * them strict-only left an `app` shop able to commit a credential in the
+ * clear with nothing to stop it. Installed by husky on `bun install`, so a
+ * fresh clone is guarded without anyone remembering.
+ */
+async function generateHooks(root: string, result: GenerateResult) {
+	/**
+	 * The hook lives in `.husky/`, which is COMMITTED, so the guard travels
+	 * with the repository instead of being something each clone remembers to
+	 * install. A secret committed in the clear cannot be un-committed.
+	 */
+	await put(
+		root,
+		".husky/pre-commit",
+		`#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
+# file so the COMMIT carries the ciphertext rather than what you staged.
+# Encryption needs only the public key in that file, so this needs no
+# credential and works on a fresh clone.
+#
+# It refuses only when it cannot fix the problem itself: no key yet
+# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
+# committed in the clear cannot be un-committed — the value stays in the
+# history and has to be treated as burned.
+bunx vc guard
+`,
+		result,
+		"regenerate",
+	);
+	// The pre-PUSH gate lives in CI now: the deploy runs off-machine, so the
+	// authoritative check belongs there, where nobody can --no-verify past it.
+	// See renderDistWorkflow.
+	await retire(root, ".husky/pre-push", result);
+}
+
 export async function generate(root: string, manifest: Manifest): Promise<GenerateResult> {
 	const result: GenerateResult = { written: [], kept: [], retired: [], packages: packagesOf(manifest) };
 
@@ -218,6 +258,7 @@ export async function generate(root: string, manifest: Manifest): Promise<Genera
 			await generateStrictApp(root, STRICT_APP, manifest, result);
 			break;
 	}
+	await generateHooks(root, result);
 	return result;
 }
 
@@ -424,31 +465,6 @@ async function generateStrictRoot(root: string, manifest: Manifest, result: Gene
 		"own",
 	);
 	await put(root, "patches/void@0.10.13.patch", renderVoidPatch(), result, "regenerate");
-	/**
-	 * The hook lives in `.husky/`, which is COMMITTED, so the guard travels
-	 * with the repository instead of being something each clone remembers to
-	 * install. A secret committed in the clear cannot be un-committed.
-	 */
-	await put(
-		root,
-		".husky/pre-commit",
-		`#!/usr/bin/env sh
-# Generated by \`vc init\`.
-#
-# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
-# file so the COMMIT carries the ciphertext rather than what you staged.
-# Encryption needs only the public key in that file, so this needs no
-# credential and works on a fresh clone.
-#
-# It refuses only when it cannot fix the problem itself: no key yet
-# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
-# committed in the clear cannot be un-committed — the value stays in the
-# history and has to be treated as burned.
-bunx vc guard
-`,
-		result,
-		"regenerate",
-	);
 	await put(root, ".github/workflows/deploy.yml", renderDistWorkflow(manifest), result, "regenerate");
 	// Renamed when GitHub Actions took over the deploy from Cloudflare's own
 	// build. Two workflows on the same push would deploy the shop twice.