@saastemly/voidcommerce 0.18.0 → 0.19.0

package/dist/deploy/index.d.ts

@@ -43,9 +43,3 @@ export declare function keysHelp(): Promise<number>;
  * Exit code is the whole interface — a hook cares about nothing else.
  */
 export declare function guardCommand(): Promise<number>;
-/** `vc link` — GitHub holds the credentials; this is what puts them there. */
-export declare function linkCliCommand(args: string[]): Promise<number>;
-export declare function linkHelp(): Promise<number>;
-/** `vc publish` — create the repository, configure it, push. The push deploys. */
-export declare function publishCliCommand(args: string[]): Promise<number>;
-export declare function publishHelp(): Promise<number>;

package/dist/deploy/secrets.d.ts

@@ -121,6 +121,16 @@ export declare function initSecrets(project: Project): Promise<number>;
  * command runs, and shells keep it in history besides.
  */
 export declare function setSecretValue(project: Project, args: string[]): Promise<number>;
+/**
+ * One value out of `.env.secrets`, by name.
+ *
+ * How the deploy gets its Cloudflare credentials without anyone having put
+ * them in the environment: they are ordinary secrets in the committed file,
+ * so the deploy reads them out of what was pushed. Returns null rather than
+ * throwing — a caller that cannot decrypt has an env var to fall back on,
+ * and a better error to give than this one.
+ */
+export declare function secretValue(project: Project, name: string): Promise<string | null>;
 /**
  * Encrypt one value into `.env.secrets`, in process.
  *

package/dist/{index-khzk6a9z.js → index-68m1eg3f.js}

@@ -77,24 +77,6 @@ async function repoSlug(cwd) {
   const slug = viewed.out.trim();
   return /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
 }
-async function setSecret(cwd, name, value) {
-  const gh = findGh();
-  if (!gh)
-    return { ok: false, error: "gh is not installed" };
-  const result = await run(gh, ["secret", "set", name], cwd, value);
-  return result.code === 0 ? { ok: true } : { ok: false, error: result.out.trim().split(`
-`).slice(-2).join(" ") };
-}
-async function secretNames(cwd) {
-  const gh = findGh();
-  if (!gh)
-    return new Set;
-  const listed = await run(gh, ["secret", "list", "--json", "name", "-q", ".[].name"], cwd);
-  if (listed.code !== 0)
-    return new Set;
-  return new Set(listed.out.split(`
-`).map((line) => line.trim()).filter(Boolean));
-}
 async function setVariable(cwd, name, value) {
   const gh = findGh();
   if (!gh)
@@ -123,31 +105,6 @@ async function variableNames(cwd) {
   return new Set(listed.out.split(`
 `).map((line) => line.trim()).filter(Boolean));
 }
-async function verifyCloudflareToken(token) {
-  try {
-    const response = await fetch("https://api.cloudflare.com/client/v4/user/tokens/verify", {
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    const body = await response.json();
-    if (body.success && body.result?.status === "active")
-      return { ok: true, detail: "active" };
-    const message = body.errors?.[0]?.message ?? `HTTP ${response.status}`;
-    return { ok: false, detail: message };
-  } catch (error) {
-    return { ok: false, detail: `could not reach the Cloudflare API: ${String(error)}` };
-  }
-}
-async function cloudflareAccounts(token) {
-  try {
-    const response = await fetch("https://api.cloudflare.com/client/v4/accounts?per_page=50", {
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    const body = await response.json();
-    return body.success && Array.isArray(body.result) ? body.result.map((a) => ({ id: a.id, name: a.name })) : [];
-  } catch {
-    return [];
-  }
-}
 
 // src/deploy/secrets.ts
 import { existsSync as existsSync2, readFileSync, writeFileSync } from "node:fs";
@@ -158,6 +115,16 @@ import color from "picocolors";
 
 // src/generate/env.ts
 var BASE = [
+  {
+    key: "CLOUDFLARE_API_TOKEN",
+    breaks: "nothing deploys: no worker, no database, no migrations",
+    where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token"
+  },
+  {
+    key: "CLOUDFLARE_ACCOUNT_ID",
+    breaks: "wrangler cannot tell which account to deploy into, and refuses rather than guessing",
+    where: "the Cloudflare dashboard sidebar, or `vc secrets set` it after the first provision"
+  },
   {
     key: "SHOP_DOMAIN",
     breaks: "everything derived from it is wrong at once — no public origin, the storefront rejected as untrusted, no DNS records",
@@ -403,18 +370,19 @@ async function decryptSecrets(project) {
   const root = project.root;
   if (!existsSync2(join2(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const privateKey = process.env[PRIVATE_KEY_VAR];
+  const { localPrivateKey } = await import("./keys-e6w5dcxx.js");
+  const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
   if (!privateKey) {
     return {
       error: `${PRIVATE_KEY_VAR} is not set, so ${SECRETS_FILE} cannot be decrypted here.
-` + `  That is the normal state on a laptop: the key lives in GitHub Actions and
-` + `  only the deploy uses it. Push, and the workflow does this step.
-` + `  To deploy by hand anyway, export the key for one command.`
+  That is the normal state on a laptop: the key lives in GitHub Actions and
+  only the deploy uses it. Push, and the workflow does this step.
+  To deploy by hand anyway, export the key for one command.`
     };
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-fn6wbv40.js");
+    const { publicKeyFor } = await import("./keys-e6w5dcxx.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -633,6 +601,18 @@ cancelled; nothing changed.
   }
   return String(answer);
 }
+async function secretValue(project, name) {
+  const decrypted = await decryptSecrets(project);
+  if ("error" in decrypted)
+    return null;
+  try {
+    const match = new RegExp(`^\\\\s*${name}\\\\s*=\\\\s*(.*)$`, "m").exec(readFileSync(decrypted.path, "utf8"));
+    const value = match?.[1]?.trim().replace(/^['"]|['"]$/g, "") ?? "";
+    return value && value !== "unset" ? value : null;
+  } finally {
+    decrypted.cleanup();
+  }
+}
 async function encryptInto(root, publicKey, name, value) {
   const { encrypt } = await import("./index-mpr7gm6k.js").then((m)=>__toESM(m.default,1));
   let ciphertext;
@@ -995,4 +975,4 @@ ${color2.green("✓")} re-keyed under ${made.publicKey.slice(0, 20)}… and ${PR
   return 0;
 }
 
-export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, findGh, run, ghAuth, repoSlug, setSecret, secretNames, setVariable, getVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run1, committedPublicKeyInto, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };
+export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, secretValue, encryptInto };

package/dist/{index-3j6jtjmk.js → index-y4dk27kf.js}

@@ -11,8 +11,9 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs,
+  secretValue,
   unsetSecretNames
-} from "./index-khzk6a9z.js";
+} from "./index-68m1eg3f.js";
 import {
   MANIFEST_FILE,
   has,
@@ -1379,7 +1380,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.18.0",
+  version: "0.19.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1717,14 +1718,13 @@ function renderDistWorkflow(manifest) {
 # Cloudflare. The check runs FIRST and on its own: nothing is built, created
 # or replaced for a shop that is not ready.
 #
-# The credentials come from the repository, set once by \`vc link\`:
+# ONE thing is configured outside the repository:
 #
-#   secrets.CLOUDFLARE_API_TOKEN        deploys, and creates D1 + the queue
-#   vars.${PRIVATE_KEY_VAR}      opens ${SECRETS_FILE} (a VARIABLE, so it can be read back)
-#   vars.CLOUDFLARE_ACCOUNT_ID          which account (an id, not a credential)
+#   vars.${PRIVATE_KEY_VAR}   the key that opens ${SECRETS_FILE}
 #
-# Nothing here needs a Cloudflare dashboard visit and nothing needs wrangler
-# on your machine. See DEPLOY.md.
+# Everything else — including the Cloudflare token and account id — is an
+# ordinary secret in that file, encrypted and committed, so it travels with
+# the push. See DEPLOY.md.
 on:
   push:
     branches: [main, master]
@@ -1815,8 +1815,8 @@ jobs:
       name: production
       url: https://${manifest.shop.domain}
     env:
-      CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
-      CLOUDFLARE_ACCOUNT_ID: \${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      # The only thing this deploy is given. The Cloudflare credentials are
+      # read out of .env.secrets, which this key opens.
       ${PRIVATE_KEY_VAR}: \${{ vars.${PRIVATE_KEY_VAR} }}
     steps:
       - uses: actions/checkout@v6
@@ -1830,19 +1830,15 @@ jobs:
       # that is what makes a new laptop or a second person possible — but
       # GitHub only masks SECRETS in logs automatically. Registering it with
       # ::add-mask:: buys back the redaction without giving up recovery.
-      - name: Are the credentials here?
+      - name: Is the key here?
         run: |
           set -euo pipefail
-          if [ -n "\${${PRIVATE_KEY_VAR}:-}" ]; then
-            echo "::add-mask::\${${PRIVATE_KEY_VAR}}"
-          fi
-          missing=""
-          [ -n "\${CLOUDFLARE_API_TOKEN:-}" ] || missing="$missing CLOUDFLARE_API_TOKEN"
-          [ -n "\${${PRIVATE_KEY_VAR}:-}" ] || missing="$missing ${PRIVATE_KEY_VAR}"
-          if [ -n "$missing" ]; then
-            echo "::error::this repository has no$missing. Run 'vc link' once, from a checkout."
+          if [ -z "\${${PRIVATE_KEY_VAR}:-}" ]; then
+            echo "::error::this repository has no ${PRIVATE_KEY_VAR} variable, so .env.secrets cannot be opened and nothing can deploy."
+            echo "Set it once, from a checkout: gh variable set ${PRIVATE_KEY_VAR}"
             exit 1
           fi
+          echo "::add-mask::\${${PRIVATE_KEY_VAR}}"
 
       - run: bun install --frozen-lockfile
 
@@ -1899,53 +1895,26 @@ below.
 ## Once, to start
 
 \`\`\`sh
-vc publish
+gh repo create --source=. --private     # or make it in the browser
+vc secrets --init                       # writes the key onto the repository
+vc secrets set CLOUDFLARE_API_TOKEN     # and every other key it lists
+git push -u origin main
 \`\`\`
 
-One command: it creates the repository, gives it what the deploy needs, and
-pushes — and the push is the deploy. After it, \`git push\` is the whole loop.
-
-Two of the three things it sets need nothing from you. The encryption key vc
-already holds; the account id is in \`voidcommerce.json\`. It asks only for a
-Cloudflare API token, because there is no OIDC between GitHub and Cloudflare
-and only a person can fetch one from the dashboard.
-
-It stores three things on the GitHub repository:
-
-| what | where | why |
-|---|---|---|
-| \`${PRIVATE_KEY_VAR}\` | repository **variable** | opens \`${SECRETS_FILE}\`. A variable, not a secret, so you can get it back — see below |
-| \`CLOUDFLARE_API_TOKEN\` | repository **secret** | deploys, and creates D1 and the queue |
-| \`CLOUDFLARE_ACCOUNT_ID\` | repository **variable** | which account. An identifier, not a credential |
-
-It will ask you to paste a Cloudflare API token. That is the only manual step
-in the whole setup, and it is worth saying exactly why it cannot be removed:
-
-> **GitHub cannot mint a Cloudflare credential.** There is no OIDC or workload
-> identity federation between them — the feature request has been open since
-> 2025 with no commitment, and Cloudflare's own CI guidance still says to store
-> a token in your CI provider's secrets. The Cloudflare GitHub App does not
-> help either: it grants *Cloudflare* access to your *repository*, not the
-> reverse. Something has to authorise creating a database in your account, and
-> only Cloudflare can issue that authorisation.
-
-Create the token at **My Profile → API Tokens → Create Token → Custom token**:
-
-| scope | permission | for |
-|---|---|---|
-| Account | Workers Scripts: Edit | deploying the worker |
-| Account | D1: Edit | creating the database, applying migrations |
-| Account | Queues: Edit | the order queue |
-| Account | Workers KV Storage: Edit | sessions and caches |
-| Account | Workers R2 Storage: Edit | product images |
-| Account | Account Settings: Read | confirming which account |
-| Zone | Workers Routes: Edit (${zone2}) | answering on your domain |
-| Zone | Zone: Read (${zone2}) | confirming the zone is on this account |
-| Zone | DNS: Read (${zone2}) | noticing a hostname that already answers |
-| User | User Details: Read, Memberships: Read | wrangler asks at startup |
-
-The token Cloudflare generates for its own Workers Builds will **not** do: it
-has no D1 and no Queues permission, so it cannot create this shop's database.
+That push is the deploy, and every push after it.
+
+**Exactly one thing lives outside the repository**: \`${PRIVATE_KEY_VAR}\`, a
+repository variable holding the key that opens \`${SECRETS_FILE}\`. It is set
+for you the moment the key is made, as long as the repository already exists
+— which is why the repository comes first above.
+
+Everything else, including the Cloudflare token and account id, is an
+ordinary secret in \`${SECRETS_FILE}\`: encrypted, committed, and read by the
+deploy out of what you pushed.
+
+The token itself has to be fetched by a person, once, because there is no
+OIDC between GitHub and Cloudflare and nothing else can issue one. Create it
+at **My Profile → API Tokens → Create Token → Custom token**:
 
 ### The zone
 
@@ -3300,6 +3269,18 @@ async function deployCloudflare(project, opts) {
   const configPath = join8(app, "wrangler.jsonc");
   if (!existsSync8(configPath))
     return fail("wrangler.jsonc is missing — `vc generate` writes it.");
+  if (!process.env["CLOUDFLARE_API_TOKEN"]) {
+    const fromRepo = await secretValue(project, "CLOUDFLARE_API_TOKEN");
+    if (fromRepo) {
+      process.env["CLOUDFLARE_API_TOKEN"] = fromRepo;
+      console.log(`${color5.green("✓")} Cloudflare credentials read from ${SECRETS_FILE}`);
+    }
+  }
+  if (!process.env["CLOUDFLARE_ACCOUNT_ID"]) {
+    const fromRepo = await secretValue(project, "CLOUDFLARE_ACCOUNT_ID");
+    if (fromRepo)
+      process.env["CLOUDFLARE_ACCOUNT_ID"] = fromRepo;
+  }
   const bin = findWrangler(app);
   if (!bin)
     return fail("wrangler is not installed. `bun add -d wrangler`, then `wrangler login`.");

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-3j6jtjmk.js";
+} from "./index-y4dk27kf.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-khzk6a9z.js";
+} from "./index-68m1eg3f.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/dist/{keys-fn6wbv40.js → keys-e6w5dcxx.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-khzk6a9z.js";
+} from "./index-68m1eg3f.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -4,10 +4,6 @@ import {
 	guardCommand,
 	keysCliCommand,
 	keysHelp,
-	linkCliCommand,
-	linkHelp,
-	publishCliCommand,
-	publishHelp,
 	preflightCommand,
 	preflightHelp,
 	secretsCliCommand,
@@ -54,8 +50,6 @@ export const EXTENDED: Record<string, Extended> = {
 	preflight: { run: preflightCommand, help: preflightHelp },
 	secrets: { run: secretsCliCommand, help: secretsHelp },
 	keys: { run: keysCliCommand, help: keysHelp },
-	link: { run: linkCliCommand, help: linkHelp },
-	publish: { run: publishCliCommand, help: publishHelp },
 	// Called by the generated pre-commit hook; exit code is the interface.
 	guard: { run: guardCommand, help: async () => guardCommand() },
 	dev: { run: appScript("dev"), help: appScriptHelp("dev") },

package/src/deploy/cloudflare.ts

@@ -8,7 +8,7 @@ import { parseJsonc, upsertJsonc } from "./jsonc";
 import { apiToken } from "./github";
 import { preflight, printPreflight } from "./preflight";
 import { checkSameZone, printZoneCheck } from "./zone";
-import { SECRETS_FILE, decryptSecrets } from "./secrets";
+import { SECRETS_FILE, decryptSecrets, secretValue } from "./secrets";
 import { ensureD1, ensureQueue, findWrangler, whoami, wrangler } from "./wrangler";
 
 /**
@@ -77,6 +77,28 @@ export async function deployCloudflare(project: Project, opts: CloudflareOptions
 	const configPath = join(app, "wrangler.jsonc");
 	if (!existsSync(configPath)) return fail("wrangler.jsonc is missing — `vc generate` writes it.");
 
+	/**
+	 * 0. The Cloudflare credentials, out of the repository.
+	 *
+	 * They are ordinary secrets in `.env.secrets`, so a deploy needs nothing
+	 * in its environment except the key that opens that file. This is what
+	 * makes a push the whole deploy: everything else travelled with it.
+	 *
+	 * An environment variable still wins, for the person running this by hand
+	 * against a different account.
+	 */
+	if (!process.env["CLOUDFLARE_API_TOKEN"]) {
+		const fromRepo = await secretValue(project, "CLOUDFLARE_API_TOKEN");
+		if (fromRepo) {
+			process.env["CLOUDFLARE_API_TOKEN"] = fromRepo;
+			console.log(`${color.green("✓")} Cloudflare credentials read from ${SECRETS_FILE}`);
+		}
+	}
+	if (!process.env["CLOUDFLARE_ACCOUNT_ID"]) {
+		const fromRepo = await secretValue(project, "CLOUDFLARE_ACCOUNT_ID");
+		if (fromRepo) process.env["CLOUDFLARE_ACCOUNT_ID"] = fromRepo;
+	}
+
 	// 1. wrangler, logged in, account pinned.
 	const bin = findWrangler(app);
 	if (!bin) return fail("wrangler is not installed. `bun add -d wrangler`, then `wrangler login`.");

package/src/deploy/index.ts

@@ -8,8 +8,6 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { PRIVATE_KEY_VAR, SECRETS_FILE, encryptInto, plaintextSecretEntries, plaintextSecretNames, run, secretsCommand } from "./secrets";
 import { LOCAL_KEY_FILE, committedPublicKey, ignoresKeyFile, keysCommand } from "./keys";
-import { linkCommand } from "./link";
-import { publishCommand } from "./publish";
 
 /**
  * `vc deploy` extends `void deploy`: vc's preflight first, then void's
@@ -308,76 +306,7 @@ export async function guardCommand(): Promise<number> {
 	return 0;
 }
 
-/** `vc link` — GitHub holds the credentials; this is what puts them there. */
-export async function linkCliCommand(args: string[]): Promise<number> {
-	const project = await findProject();
-	if (!project) {
-		console.error("vc: no voidcommerce.json here.");
-		return 1;
-	}
-	return linkCommand(project, args);
-}
 
-export async function linkHelp(): Promise<number> {
-	const width = 80;
-	console.log(
-		box("vc link", [
-			line("Put this shop's credentials on its GitHub repository, once, so that", width),
-			line("every deploy after this is a `git push`.", width),
-			line("", width),
-			...row("vc link", "store the encryption key and the Cloudflare token on the repository", width, 2),
-			...row("vc link --force", "replace what is already there", width, 2),
-			line("", width),
-			line(color.bold("What it stores, and where"), width),
-			...row(PRIVATE_KEY_VAR, "a repository SECRET. A key already waiting locally is MOVED here and the local copy deleted", width, 2),
-			...row("CLOUDFLARE_API_TOKEN", "a repository SECRET, checked against the Cloudflare API before it is stored", width, 2),
-			...row("CLOUDFLARE_ACCOUNT_ID", "a repository VARIABLE — an identifier, not a credential", width, 2),
-			line("", width),
-			line(color.bold("Why one token still has to be typed"), width),
-			line("GitHub cannot mint a Cloudflare credential. There is no OIDC federation", width),
-			line("between them, and the Cloudflare GitHub App runs the other way: it grants", width),
-			line("Cloudflare access to your repository, not your repository access to", width),
-			line("Cloudflare. So it is typed once, here, and never stored on this machine.", width),
-		], width),
-	);
-	return 0;
-}
 
 
-/** `vc publish` — create the repository, configure it, push. The push deploys. */
-export async function publishCliCommand(args: string[]): Promise<number> {
-	const project = await findProject();
-	if (!project) {
-		console.error("vc: no voidcommerce.json here.");
-		return 1;
-	}
-	return publishCommand(project, args);
-}
 
-export async function publishHelp(): Promise<number> {
-	const width = 80;
-	console.log(
-		box("vc publish", [
-			line("Create this shop's GitHub repository, give it what the deploy needs,", width),
-			line("and push. The push IS the deploy. Run once; after that, `git push`.", width),
-			line("", width),
-			...row("vc publish", "create the repository, set the credentials, push main", width, 2),
-			line("", width),
-			line(color.bold("What it does for you"), width),
-			...row("the encryption key", "vc already holds it — set with no input from you", width, 2),
-			...row("the account id", "read from voidcommerce.json", width, 2),
-			...row("the Cloudflare token", "the one thing it has to ask for", width, 2),
-			line("", width),
-			line(color.bold("Why the token cannot be automated away"), width),
-			line("There is no OIDC between GitHub and Cloudflare, so something must carry", width),
-			line("a token across, and only a person can fetch one from the dashboard. It", width),
-			line("is asked for once, checked against the Cloudflare API, and stored on the", width),
-			line("repository — never on this machine.", width),
-			line("", width),
-			line("The repository is created WITHOUT pushing, then configured, then pushed.", width),
-			line("Pushing first would start a deploy against a repository that has no key", width),
-			line("and no token: a red run, for no reason but the wrong order.", width),
-		], width),
-	);
-	return 0;
-}

package/src/deploy/secrets.ts

@@ -202,7 +202,12 @@ export async function decryptSecrets(project: Project): Promise<DecryptedSecrets
 	// The private key comes from the environment, which in the normal case is
 	// GitHub Actions injecting the repository secret. A laptop has no reason
 	// to hold it, so a missing one is explained rather than treated as a fault.
-	const privateKey = process.env[PRIVATE_KEY_VAR];
+	// The environment first — that is CI, where the repository variable is
+	// injected — then a key parked locally by `vc keys --init` or restored by
+	// `vc keys --restore`. Reading only the environment made a local deploy
+	// fail while the key sat in a file two lines away.
+	const { localPrivateKey } = await import("./keys");
+	const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
 	if (!privateKey) {
 		return {
 			error:
@@ -443,6 +448,27 @@ async function readValue(name: string, breaks?: string, where?: string): Promise
 }
 
 
+/**
+ * One value out of `.env.secrets`, by name.
+ *
+ * How the deploy gets its Cloudflare credentials without anyone having put
+ * them in the environment: they are ordinary secrets in the committed file,
+ * so the deploy reads them out of what was pushed. Returns null rather than
+ * throwing — a caller that cannot decrypt has an env var to fall back on,
+ * and a better error to give than this one.
+ */
+export async function secretValue(project: Project, name: string): Promise<string | null> {
+	const decrypted = await decryptSecrets(project);
+	if ("error" in decrypted) return null;
+	try {
+		const match = new RegExp(`^\\\\s*${name}\\\\s*=\\\\s*(.*)$`, "m").exec(readFileSync(decrypted.path, "utf8"));
+		const value = match?.[1]?.trim().replace(/^['"]|['"]$/g, "") ?? "";
+		return value && value !== "unset" ? value : null;
+	} finally {
+		decrypted.cleanup();
+	}
+}
+
 /**
  * Encrypt one value into `.env.secrets`, in process.
  *