@saastemly/voidcommerce 0.19.1 → 0.21.0

package/dist/deploy/teardown.d.ts

@@ -0,0 +1,62 @@
+import type { Project } from "../project";
+/**
+ * `vc teardown --cloudflare` — undo a deploy, so the whole thing can be
+ * proved again from nothing.
+ *
+ * ── Why this exists ──────────────────────────────────────────────────────
+ *
+ * "Push and it goes live" is a claim, and a claim nobody can re-run is a
+ * story. Provisioning is the part most likely to break — it is the only
+ * step that creates rather than replaces, it runs once per shop, and it runs
+ * against an account whose state nobody controls. Being able to destroy and
+ * do it again is what turns the claim into something testable.
+ *
+ * ── This DELETES A PRODUCTION DATABASE ───────────────────────────────────
+ *
+ * D1 deletion is not recoverable: there is no undo and no snapshot unless
+ * one was taken. Every order, customer and address in it goes. So this
+ * refuses by default, and the confirmation is TYPING THE SHOP'S DOMAIN —
+ * not `y`, because `y` is muscle memory and a domain is not.
+ *
+ * It also refuses outright when the manifest's domain does not match what
+ * the wrangler config points at, since that mismatch is the signal that you
+ * are standing in a different shop than you think.
+ *
+ * ── Idempotent, deliberately ─────────────────────────────────────────────
+ *
+ * Deleting what is already gone is success, not failure. That is what makes
+ * it usable in a loop: teardown, publish, teardown again, without a human
+ * reading each result to decide whether the next step is safe.
+ */
+export interface TeardownOptions {
+    /** Required. Without it this only ever prints what it would do. */
+    confirm: boolean;
+    /** Keep the D1 database — the one thing that holds data nobody can recreate. */
+    keepData: boolean;
+    dryRun: boolean;
+}
+interface WranglerConfig {
+    name?: string;
+    account_id?: string;
+    d1_databases?: Array<{
+        binding: string;
+        database_name: string;
+        database_id: string;
+    }>;
+    queues?: {
+        producers?: Array<{
+            queue: string;
+        }>;
+        consumers?: Array<{
+            queue: string;
+        }>;
+    };
+}
+/** What a teardown would destroy, read from the config rather than guessed. */
+export declare function teardownPlan(config: WranglerConfig, fallbackWorker: string): {
+    worker: string;
+    d1: string | null;
+    queues: string[];
+};
+export declare function teardownCloudflare(project: Project, opts: TeardownOptions): Promise<number>;
+export {};

package/dist/deploy/token-link.d.ts

@@ -0,0 +1,15 @@
+import type { Manifest } from "../manifest";
+/**
+ * The link, for this shop.
+ *
+ * The USER-token form, deliberately: it is the one that accepts the two
+ * user-scoped permissions wrangler wants, and account-owned tokens are
+ * documented as not taking `accountId`/`zoneId` at all. `zoneId=all` because
+ * a shop's zone is not known until the domain is on Cloudflare, and picking
+ * the wrong one is a worse failure than picking from a list.
+ */
+export declare function cloudflareTokenLink(manifest: Manifest): string;
+/** The same permissions as a table, for anyone who would rather tick them. */
+export declare function cloudflareTokenTable(): string;
+/** Markdown, for DEPLOY.md. */
+export declare function cloudflareTokenMarkdown(): string;

package/dist/index-6e4eh08g.js

@@ -0,0 +1,35 @@
+// src/deploy/token-link.ts
+var PERMISSIONS = [
+  ["Workers Scripts: Edit", "workers_scripts", "edit", "deploy the worker"],
+  ["D1: Edit", "d1", "edit", "create the database and apply migrations"],
+  ["Queues: Edit", "queues", "edit", "create the order queue"],
+  ["Workers KV Storage: Edit", "workers_kv_storage", "edit", "sessions and caches"],
+  ["Workers R2 Storage: Edit", "workers_r2", "edit", "product images"],
+  ["Account Settings: Read", "account_settings", "read", "confirm which account this is"],
+  ["Zone: Read", "zone", "read", "confirm the domain's zone is on this account"],
+  ["DNS: Read", "dns", "read", "notice a hostname that already answers"],
+  ["Workers Routes: Edit", "workers_routes", "edit", "answer on your domain"],
+  ["User Details: Read", "user_details", "read", "wrangler asks at startup"],
+  ["Memberships: Read", "memberships", "read", "the same"]
+];
+function cloudflareTokenLink(manifest) {
+  const groups = PERMISSIONS.map(([, key, type]) => ({ key, type }));
+  const params = new URLSearchParams({
+    permissionGroupKeys: JSON.stringify(groups),
+    accountId: "*",
+    zoneId: "all",
+    name: `${manifest.shop.domain} deploy`
+  });
+  return `https://dash.cloudflare.com/profile/api-tokens?${params.toString()}`;
+}
+function cloudflareTokenTable() {
+  const width = Math.max(...PERMISSIONS.map(([label]) => label.length));
+  return PERMISSIONS.map(([label, , , why]) => `  ${label.padEnd(width)}  ${why}`).join(`
+`);
+}
+function cloudflareTokenMarkdown() {
+  return ["| permission | for |", "|---|---|", ...PERMISSIONS.map(([label, , , why]) => `| ${label} | ${why} |`)].join(`
+`);
+}
+
+export { cloudflareTokenLink, cloudflareTokenTable, cloudflareTokenMarkdown };

package/dist/{index-hsc97bf2.js → index-940vpkwa.js}

@@ -370,7 +370,7 @@ async function decryptSecrets(project) {
   const root = project.root;
   if (!existsSync2(join2(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const { localPrivateKey } = await import("./keys-knmqsqz1.js");
+  const { localPrivateKey } = await import("./keys-mewxnkwg.js");
   const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
   if (!privateKey) {
     return {
@@ -382,7 +382,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-knmqsqz1.js");
+    const { publicKeyFor } = await import("./keys-mewxnkwg.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -431,6 +431,8 @@ async function secretsCommand(project, args) {
     return setSecretValue(project, args.slice(1));
   if (args.includes("--sync"))
     return syncSecrets(project, args.includes("--prune"));
+  if (args.includes("--adopt"))
+    return adoptSecrets(project, args.includes("--confirm"));
   if (!existsSync2(join2(root, SECRETS_FILE))) {
     console.log(`
 ${color.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,
@@ -548,6 +550,17 @@ vc: ${SECRETS_FILE} has no DOTENV_PUBLIC_KEY_SECRETS, so there is nothing to enc
     return 1;
   }
   const known = allEnvKeys(project.manifest).find((key) => key.key === name);
+  if (name === "CLOUDFLARE_API_TOKEN") {
+    const { cloudflareTokenLink, cloudflareTokenTable } = await import("./token-link-wxpp5xzp.js");
+    console.log(`
+${color.bold("Open this — the permissions are already selected:")}
+
+  ${color.cyan(cloudflareTokenLink(project.manifest))}
+
+${color.dim("It opens your own dashboard; the token is shown only to you. What it grants:")}
+${color.dim(cloudflareTokenTable())}
+`);
+  }
   const value = await readValue(name, known?.breaks, known?.where);
   if (value === null)
     return 1;
@@ -703,6 +716,75 @@ ${color.green("✓")} every secret this shop needs is already declared.
   }
   return 0;
 }
+async function adoptSecrets(project, confirmed) {
+  const root = project.root;
+  const path = join2(root, SECRETS_FILE);
+  if (!existsSync2(path)) {
+    console.error(`
+vc: no ${SECRETS_FILE} here — \`vc secrets --init\` starts a fresh one.
+`);
+    return 1;
+  }
+  const { localPrivateKey, publicKeyFor, generateKeypair } = await import("./keys-mewxnkwg.js");
+  const current = committedPublicKey(root);
+  const mine = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root);
+  if (mine && current && (await publicKeyFor(mine))?.toLowerCase() === current.toLowerCase()) {
+    console.error(`
+vc: you already hold the key to this shop, so this is not a fork.
+  Adopting would replace the key and blank every value you can currently read.
+  If that is really what you want, remove the key first.
+`);
+    return 1;
+  }
+  const declared = [...declaredSecretNames(root)];
+  if (!confirmed) {
+    console.log(`
+${color.bold("Adopting this shop would:")}
+
+` + `  · make a NEW encryption key, replacing the one in ${SECRETS_FILE}
+` + `  · reset ${declared.length} value${declared.length === 1 ? "" : "s"} to \`unset\`
+
+` + `  The current values cannot be read here anyway — they belong to whoever
+` + `  set them. This makes that explicit rather than leaving their ciphertext
+  sitting in a shop you now own.
+
+  ${color.cyan("vc secrets --adopt --confirm")}
+`);
+    return 1;
+  }
+  const pair = await generateKeypair();
+  if (!pair) {
+    console.error("vc: @dotenvx/dotenvx is not installed here.");
+    return 1;
+  }
+  const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+  const body = readFileSync(path, "utf8").split(`
+`).map((line) => {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(line);
+    if (!match)
+      return line;
+    if (match[1] === "DOTENV_PUBLIC_KEY_SECRETS")
+      return `DOTENV_PUBLIC_KEY_SECRETS="${pair.publicKey}"`;
+    return `${match[1]}=unset`;
+  }).join(`
+`);
+  writeFileSync(path, body);
+  writeFileSync(join2(root, ".env.keys"), `${PRIVATE_KEY_VAR}="${pair.privateKey}"
+`, { mode: 384 });
+  console.log(`
+${color.green("✓")} adopted: a new key, and ${declared.length} value${declared.length === 1 ? "" : "s"} reset to \`unset\`
+${color.green("+")} .env.keys holds the new private key — gitignored, and yours
+
+` + `Now set what this shop needs:
+${required.slice(0, 4).map((key) => `  ${color.cyan(`vc secrets set ${key.key}`)}`).join(`
+`)}
+` + (required.length > 4 ? `  ${color.dim(`…and ${required.length - 4} more — \`vc secrets\` lists them`)}
+` : "") + color.yellow(`
+! The previous owner's ciphertext is still in git history. It is unreadable
+  without their key, but a fresh repository is cleaner than a fork.
+`));
+  return 0;
+}
 
 // src/deploy/keys.ts
 var LOCAL_KEY_FILE = ".env.keys";

package/dist/{index-tk46w7yn.js → index-pghh8nnq.js}

@@ -13,7 +13,7 @@ import {
   renderEnvTs,
   secretValue,
   unsetSecretNames
-} from "./index-hsc97bf2.js";
+} from "./index-940vpkwa.js";
 import {
   MANIFEST_FILE,
   has,
@@ -30,6 +30,9 @@ import {
 import {
   CHOICES
 } from "./index-xyjhy6kp.js";
+import {
+  cloudflareTokenMarkdown
+} from "./index-6e4eh08g.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -1380,7 +1383,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.19.1",
+  version: "0.21.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1859,6 +1862,7 @@ jobs:
 }
 function renderDeployReadme(manifest, zone2, hosts) {
   const worker = manifest.shop.domain.split(".")[0];
+  const TOKEN_TABLE = cloudflareTokenMarkdown();
   return `# Going live
 
 \`${manifest.shop.domain}\` on Cloudflare Workers. Generated by \`vc init\`;
@@ -1913,8 +1917,17 @@ ordinary secret in \`${SECRETS_FILE}\`: encrypted, committed, and read by the
 deploy out of what you pushed.
 
 The token itself has to be fetched by a person, once, because there is no
-OIDC between GitHub and Cloudflare and nothing else can issue one. Create it
-at **My Profile → API Tokens → Create Token → Custom token**:
+OIDC between GitHub and Cloudflare and nothing else can issue one. You do
+not have to find the permissions yourself:
+
+\`\`\`sh
+vc secrets set CLOUDFLARE_API_TOKEN
+\`\`\`
+
+prints a Cloudflare link with all of them **already selected**, then takes
+the token. It opens your own dashboard and the value is shown only to you.
+
+${TOKEN_TABLE}
 
 ### The zone
 
@@ -3617,4 +3630,4 @@ async function importHelp() {
   return 0;
 }
 
-export { renderAuthTs, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderFrontendViteConfig, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, parseWhoAmI, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };
+export { renderAuthTs, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderFrontendViteConfig, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, wrangler, parseWhoAmI, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-tk46w7yn.js";
+} from "./index-pghh8nnq.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-hsc97bf2.js";
+} from "./index-940vpkwa.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -99,6 +99,7 @@ import {
   TAX,
   UI
 } from "./index-xyjhy6kp.js";
+import"./index-6e4eh08g.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/dist/{keys-knmqsqz1.js → keys-mewxnkwg.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-hsc97bf2.js";
+} from "./index-940vpkwa.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/dist/token-link-wxpp5xzp.js

@@ -0,0 +1,11 @@
+import {
+  cloudflareTokenLink,
+  cloudflareTokenMarkdown,
+  cloudflareTokenTable
+} from "./index-6e4eh08g.js";
+import"./index-0v6na3yp.js";
+export {
+  cloudflareTokenTable,
+  cloudflareTokenMarkdown,
+  cloudflareTokenLink
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.19.1",
+  "version": "0.21.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -8,6 +8,8 @@ import {
 	preflightHelp,
 	secretsCliCommand,
 	secretsHelp,
+	teardownCliCommand,
+	teardownHelp,
 } from "./deploy/index";
 import { distCommand, distHelp } from "./dist";
 import { importCommand, importHelp } from "./import";
@@ -50,6 +52,7 @@ export const EXTENDED: Record<string, Extended> = {
 	preflight: { run: preflightCommand, help: preflightHelp },
 	secrets: { run: secretsCliCommand, help: secretsHelp },
 	keys: { run: keysCliCommand, help: keysHelp },
+	teardown: { run: teardownCliCommand, help: teardownHelp },
 	// Called by the generated pre-commit hook; exit code is the interface.
 	guard: { run: guardCommand, help: async () => guardCommand() },
 	dev: { run: appScript("dev"), help: appScriptHelp("dev") },

package/src/deploy/index.ts

@@ -8,6 +8,7 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { PRIVATE_KEY_VAR, SECRETS_FILE, encryptInto, plaintextSecretEntries, plaintextSecretNames, run, secretsCommand } from "./secrets";
 import { LOCAL_KEY_FILE, committedPublicKey, ignoresKeyFile, keysCommand } from "./keys";
+import { teardownCloudflare } from "./teardown";
 
 /**
  * `vc deploy` extends `void deploy`: vc's preflight first, then void's
@@ -310,3 +311,66 @@ export async function guardCommand(): Promise<number> {
 
 
 
+
+
+/**
+ * `vc teardown` — destroy this shop's Cloudflare infrastructure.
+ *
+ * The confirmation is the shop's DOMAIN, not `y`. A `y` is muscle memory;
+ * typing `devprints.saastemly.com` is not, and this deletes a database that
+ * has no undo.
+ */
+export async function teardownCliCommand(args: string[]): Promise<number> {
+	const project = await findProject();
+	if (!project) {
+		console.error("vc: no voidcommerce.json here.");
+		return 1;
+	}
+	if (!args.includes("--cloudflare")) {
+		console.error("vc: teardown only knows how to undo a Cloudflare deploy. `vc teardown --cloudflare`.");
+		return 1;
+	}
+	const typed = args[args.indexOf("--confirm") + 1];
+	const confirmed = args.includes("--confirm") && typed === project.manifest.shop.domain;
+	if (args.includes("--confirm") && !confirmed) {
+		console.error(
+			`\nvc: --confirm needs this shop's domain, exactly:\n\n` +
+				`    vc teardown --cloudflare --confirm ${project.manifest.shop.domain}\n\n` +
+				`  You typed ${typed ? `"${typed}"` : "nothing"}. Naming the shop is the check — it is\n` +
+				"  what stops this running in the wrong directory.\n",
+		);
+		return 1;
+	}
+	return teardownCloudflare(project, {
+		confirm: confirmed,
+		keepData: args.includes("--keep-data"),
+		dryRun: args.includes("--dry-run"),
+	});
+}
+
+export async function teardownHelp(): Promise<number> {
+	const width = 80;
+	console.log(
+		box("vc teardown", [
+			line("Destroy this shop's Cloudflare infrastructure, so the whole", width),
+			line("publish-to-live flow can be proved again from nothing.", width),
+			line("", width),
+			...row("vc teardown --cloudflare --dry-run", "list what would be destroyed, touch nothing", width, 2),
+			...row("vc teardown --cloudflare --confirm <domain>", "do it", width, 2),
+			...row("--keep-data", "leave the D1 database alone", width, 2),
+			line("", width),
+			line(color.bold("Read this first"), width),
+			line("D1 deletion has NO UNDO. Every order, customer and address in the", width),
+			line("database goes with it, and there is no snapshot unless you took one.", width),
+			line("", width),
+			line("So --confirm takes the shop's DOMAIN, not `y`: a `y` is muscle memory,", width),
+			line("and typing the domain is what stops this running in the wrong shop.", width),
+			line("", width),
+			line("It is idempotent — deleting what is already gone is success — and it", width),
+			line("clears the recorded database id, because `wrangler deploy` FAILS on a", width),
+			line("dangling id rather than making a new database. Secrets are untouched:", width),
+			line("this removes infrastructure, not configuration.", width),
+		], width),
+	);
+	return 0;
+}

package/src/deploy/secrets.ts

@@ -277,6 +277,7 @@ export async function secretsCommand(project: Project, args: string[]): Promise<
 	if (args.includes("--init")) return initSecrets(project);
 	if (args[0] === "set") return setSecretValue(project, args.slice(1));
 	if (args.includes("--sync")) return syncSecrets(project, args.includes("--prune"));
+	if (args.includes("--adopt")) return adoptSecrets(project, args.includes("--confirm"));
 
 	if (!existsSync(join(root, SECRETS_FILE))) {
 		console.log(
@@ -405,6 +406,21 @@ export async function setSecretValue(project: Project, args: string[]): Promise<
 	// A known key gets its consequence shown, so a person setting one knows
 	// what it is for without leaving the terminal.
 	const known = allEnvKeys(project.manifest).find((key) => key.key === name);
+
+	// The one key whose "where" is ten checkboxes in a dashboard. Cloudflare
+	// takes the permissions as URL parameters, so this opens the form with all
+	// of them already ticked — which removes the failure where one missed row
+	// yields a token that authenticates and then fails mid-deploy.
+	if (name === "CLOUDFLARE_API_TOKEN") {
+		const { cloudflareTokenLink, cloudflareTokenTable } = await import("./token-link");
+		console.log(
+			`\n${color.bold("Open this — the permissions are already selected:")}\n\n` +
+				`  ${color.cyan(cloudflareTokenLink(project.manifest))}\n\n` +
+				`${color.dim("It opens your own dashboard; the token is shown only to you. What it grants:")}\n` +
+				`${color.dim(cloudflareTokenTable())}\n`,
+		);
+	}
+
 	const value = await readValue(name, known?.breaks, known?.where);
 	if (value === null) return 1;
 
@@ -583,3 +599,84 @@ async function syncSecrets(project: Project, prune: boolean): Promise<number> {
 	}
 	return 0;
 }
+
+
+/**
+ * `vc secrets --adopt` — take this shop over as a different person.
+ *
+ * The fork case. Somebody clones a shop, and every value in `.env.secrets`
+ * belongs to whoever set it: their Stripe key, their Cloudflare token, their
+ * home address. They cannot read any of it — the private key is not theirs —
+ * but the ciphertext is right there, and the shop would deploy into somebody
+ * else's account if the key ever leaked.
+ *
+ * So this cuts the connection: a NEW keypair, every value back to `unset`,
+ * and the old public key replaced. What was encrypted to the old key stays
+ * in git history and is now unreadable by anyone here, which is the point —
+ * the new owner starts with a shop that has their secrets or none.
+ *
+ * It refuses when the current key IS readable here, because then this is not
+ * a fork, it is somebody about to destroy their own values by accident.
+ */
+async function adoptSecrets(project: Project, confirmed: boolean): Promise<number> {
+	const root = project.root;
+	const path = join(root, SECRETS_FILE);
+	if (!existsSync(path)) {
+		console.error(`\nvc: no ${SECRETS_FILE} here — \`vc secrets --init\` starts a fresh one.\n`);
+		return 1;
+	}
+
+	const { localPrivateKey, publicKeyFor, generateKeypair } = await import("./keys");
+	const current = committedPublicKey(root);
+	const mine = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root);
+	if (mine && current && (await publicKeyFor(mine))?.toLowerCase() === current.toLowerCase()) {
+		console.error(
+			`\nvc: you already hold the key to this shop, so this is not a fork.\n` +
+				`  Adopting would replace the key and blank every value you can currently read.\n` +
+				`  If that is really what you want, remove the key first.\n`,
+		);
+		return 1;
+	}
+
+	const declared = [...declaredSecretNames(root)];
+	if (!confirmed) {
+		console.log(
+			`\n${color.bold("Adopting this shop would:")}\n\n` +
+				`  · make a NEW encryption key, replacing the one in ${SECRETS_FILE}\n` +
+				`  · reset ${declared.length} value${declared.length === 1 ? "" : "s"} to \`unset\`\n\n` +
+				`  The current values cannot be read here anyway — they belong to whoever\n` +
+				`  set them. This makes that explicit rather than leaving their ciphertext\n` +
+				`  sitting in a shop you now own.\n\n` +
+				`  ${color.cyan("vc secrets --adopt --confirm")}\n`,
+		);
+		return 1;
+	}
+
+	const pair = await generateKeypair();
+	if (!pair) {
+		console.error("vc: @dotenvx/dotenvx is not installed here.");
+		return 1;
+	}
+	const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+	const body = readFileSync(path, "utf8")
+		.split("\n")
+		.map((line) => {
+			const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(line);
+			if (!match) return line;
+			if (match[1] === "DOTENV_PUBLIC_KEY_SECRETS") return `DOTENV_PUBLIC_KEY_SECRETS="${pair.publicKey}"`;
+			return `${match[1]}=unset`;
+		})
+		.join("\n");
+	writeFileSync(path, body);
+	writeFileSync(join(root, ".env.keys"), `${PRIVATE_KEY_VAR}="${pair.privateKey}"\n`, { mode: 0o600 });
+
+	console.log(
+		`\n${color.green("✓")} adopted: a new key, and ${declared.length} value${declared.length === 1 ? "" : "s"} reset to \`unset\`\n` +
+			`${color.green("+")} .env.keys holds the new private key — gitignored, and yours\n\n` +
+			`Now set what this shop needs:\n` +
+			`${required.slice(0, 4).map((key) => `  ${color.cyan(`vc secrets set ${key.key}`)}`).join("\n")}\n` +
+			(required.length > 4 ? `  ${color.dim(`…and ${required.length - 4} more — \`vc secrets\` lists them`)}\n` : "") +
+			color.yellow(`\n! The previous owner's ciphertext is still in git history. It is unreadable\n  without their key, but a fresh repository is cleaner than a fork.\n`),
+	);
+	return 0;
+}