@saastemly/voidcommerce 0.2.1 → 0.3.0

package/dist/index.js

@@ -57,7 +57,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-xdsp97e4.js";
+} from "./index-84wq4qp8.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -1,4 +1,4 @@
-import { deployCommand, deployHelp, preflightCommand, preflightHelp } from "./deploy/index";
+import { deployCommand, deployHelp, preflightCommand, preflightHelp, secretsCliCommand, secretsHelp } from "./deploy/index";
 import { distCommand, distHelp } from "./dist";
 import { importCommand, importHelp } from "./import";
 import { fullHelp, initHelp, version } from "./help";
@@ -38,6 +38,7 @@ export const EXTENDED: Record<string, Extended> = {
 	import: { run: importCommand, help: importHelp },
 	deploy: { run: deployCommand, help: deployHelp },
 	preflight: { run: preflightCommand, help: preflightHelp },
+	secrets: { run: secretsCliCommand, help: secretsHelp },
 	dev: { run: appScript("dev"), help: appScriptHelp("dev") },
 	build: { run: appScript("build"), help: appScriptHelp("build") },
 	preview: { run: appScript("preview"), help: appScriptHelp("preview") },

package/src/deploy/cloudflare.ts

@@ -6,6 +6,7 @@ import { hasFrontend, workerHosts, writeManifest } from "../manifest";
 import type { Project } from "../project";
 import { parseJsonc, upsertJsonc } from "./jsonc";
 import { preflight, printPreflight } from "./preflight";
+import { SECRETS_FILE, decryptSecrets } from "./secrets";
 import { ensureD1, ensureQueue, findWrangler, whoami, wrangler } from "./wrangler";
 
 /**
@@ -25,7 +26,9 @@ import { ensureD1, ensureQueue, findWrangler, whoami, wrangler } from "./wrangle
  *      secret-class key and every `unset` is removed from dist/ssr/wrangler.json
  *      before it is uploaded; the worker reads those from `wrangler secret`.
  *   6. apply the committed migrations to the remote D1
- *   7. wrangler deploy, on exactly the config that was scrubbed
+ *   7. decrypt the repository's own secrets, if it keeps any
+ *   8. wrangler deploy, on exactly the config that was scrubbed, carrying
+ *      those secrets up with the version
  */
 
 export interface CloudflareOptions {
@@ -153,9 +156,28 @@ export async function deployCloudflare(project: Project, opts: CloudflareOptions
 	const migrated = await wrangler(bin, ["d1", "migrations", "apply", emittedD1.database_name, "--remote"], app, true);
 	if (migrated.code !== 0) return fail(`applying migrations failed (exit ${migrated.code}); nothing was deployed.`);
 
-	// 7. deploy exactly what was scrubbed.
+	/**
+	 * 7. Secrets, from the repository, in the same operation as the deploy.
+	 *
+	 * `--secrets-file` applies ADDITIVELY: a secret this file does not name is
+	 * left alone rather than deleted, so a shop that sets one by hand does not
+	 * lose it the next time this runs. The plaintext exists only as a
+	 * 0600 temp file for the length of the upload.
+	 */
+	const secretArgs: string[] = [];
+	let cleanupSecrets: (() => void) | undefined;
+	if (existsSync(join(project.root, SECRETS_FILE))) {
+		const decrypted = await decryptSecrets(project);
+		if ("error" in decrypted) return fail(`the repository's secrets could not be read: ${decrypted.error}`);
+		secretArgs.push("--secrets-file", decrypted.path);
+		cleanupSecrets = decrypted.cleanup;
+		console.log(`${color.green("✓")} ${decrypted.names.length} secrets from ${SECRETS_FILE}, uploaded with this version`);
+	}
+
+	// 8. deploy exactly what was scrubbed.
 	console.log("\n▸ wrangler deploy -c dist/ssr/wrangler.json");
-	const deployed = await wrangler(bin, ["deploy", "-c", join("dist", "ssr", "wrangler.json")], app, true);
+	const deployed = await wrangler(bin, ["deploy", "-c", join("dist", "ssr", "wrangler.json"), ...secretArgs], app, true);
+	cleanupSecrets?.();
 	if (deployed.code !== 0) return fail(`wrangler deploy failed (exit ${deployed.code}).`);
 
 	const domain = project.manifest.shop.domain;

package/src/deploy/index.ts

@@ -4,6 +4,7 @@ import { findProject } from "../project";
 import { captureVoid, runVoid } from "../void";
 import { deployCloudflare } from "./cloudflare";
 import { preflight, printPreflight } from "./preflight";
+import { PRIVATE_KEY_VAR, SECRETS_FILE, secretsCommand } from "./secrets";
 
 /**
  * `vc deploy` extends `void deploy`: vc's preflight first, then void's
@@ -99,3 +100,37 @@ export async function preflightHelp(): Promise<number> {
 	);
 	return 0;
 }
+
+/** `vc secrets` — what the repository declares, and whether it is encrypted. */
+export async function secretsCliCommand(args: string[]): Promise<number> {
+	const project = await findProject();
+	if (!project) {
+		console.error("vc: no voidcommerce.json here.");
+		return 1;
+	}
+	return secretsCommand(project, args);
+}
+
+export async function secretsHelp(): Promise<number> {
+	const width = 80;
+	console.log(
+		box("vc secrets", [
+			line(`Secrets that live in the repository, encrypted, in ${SECRETS_FILE}.`, width),
+			line("", width),
+			...row("vc secrets", "what this shop needs, and whether it is declared and encrypted", width, 2),
+			...row("vc secrets --init", `write ${SECRETS_FILE} with every required key as \`unset\``, width, 2),
+			...row(`dotenvx set KEY '…' -f ${SECRETS_FILE}`, "set one, without decrypting the file", width, 2),
+			...row(`dotenvx encrypt -f ${SECRETS_FILE}`, "encrypt anything still in the clear", width, 2),
+			line("", width),
+			line("The file is COMMITTED: values are ciphertext, key names are not, so a", width),
+			line("diff shows which secret changed without showing what it changed to.", width),
+			line(`The private key stays out — .env.keys locally, and ${PRIVATE_KEY_VAR}`, width),
+			line("as one build variable where the deploy runs.", width),
+			line("", width),
+			line("Tradeoff worth knowing: ciphertext in git is permanent, so a leaked key", width),
+			line("exposes rotated secrets too. `wrangler secret put` does not have that", width),
+			line("property, and stays available for anything you would rather keep out.", width),
+		], width),
+	);
+	return 0;
+}

package/src/deploy/preflight.ts

@@ -7,6 +7,7 @@ import { workerHosts } from "../manifest";
 import type { Project } from "../project";
 import { captureVoid } from "../void";
 import { parseJsonc } from "./jsonc";
+import { SECRETS_FILE, declaredSecretNames, plaintextSecretNames } from "./secrets";
 import { findWrangler, secretNames } from "./wrangler";
 
 /**
@@ -28,6 +29,8 @@ export interface Preflight {
 	remote: Set<string> | null;
 	missing: EnvKey[];
 	routeProblem: string | null;
+	/** Names in `.env.secrets` whose value was committed unencrypted. */
+	bareSecrets: string[];
 	ready: boolean;
 }
 
@@ -86,12 +89,29 @@ export async function preflight(project: Project, source: SecretSource): Promise
 	}
 	for (const name of remote ?? []) present.set(name, "<secret>");
 
+	/**
+	 * A secret the REPOSITORY declares counts as present, because the deploy
+	 * uploads it. The names are readable without the key — dotenvx encrypts
+	 * values, not keys — so this works on a machine that cannot decrypt.
+	 */
+	for (const name of declaredSecretNames(project.root)) present.set(name, "<in the repository>");
+
 	const missing = allEnvKeys(project.manifest).filter((key) => {
 		const value = present.get(key.key);
 		return value === undefined || value === "" || value === UNSET;
 	});
 	const problem = routeProblem(project);
-	return { present, remote, missing, routeProblem: problem, ready: missing.length === 0 && problem === null };
+	// A value committed in the clear is worse than a missing one: it is a
+	// leak that looks like it is working.
+	const bare = plaintextSecretNames(project.root);
+	return {
+		present,
+		remote,
+		missing,
+		routeProblem: problem,
+		bareSecrets: bare,
+		ready: missing.length === 0 && problem === null && bare.length === 0,
+	};
 }
 
 /** Print the report a person can act on. */
@@ -120,6 +140,12 @@ export function printPreflight(project: Project, result: Preflight, source: Secr
 	if (result.routeProblem) {
 		console.log(`${color.red("✗")} the worker's hostname\n    ${result.routeProblem}\n`);
 	}
+	if (result.bareSecrets.length > 0) {
+		console.log(
+			`${color.red("✗")} committed in the clear in ${SECRETS_FILE}: ${result.bareSecrets.join(", ")}\n` +
+				`    Run \`dotenvx encrypt -f ${SECRETS_FILE}\` — and treat those values as burned.\n`,
+		);
+	}
 	for (const key of result.missing) {
 		console.log(`${color.red("✗")} ${key.key}`);
 		console.log(`    ${key.breaks}`);
@@ -128,8 +154,17 @@ export function printPreflight(project: Project, result: Preflight, source: Secr
 	}
 	const secrets = result.missing.filter((key) => !key.plaintext);
 	if (secrets.length > 0) {
-		console.log(source === "wrangler" ? "Set each secret on the worker (this also creates the draft worker on a first deploy):" : "Set each secret on the project:");
-		for (const key of secrets) console.log(`  ${source === "wrangler" ? "wrangler secret put" : "void secret put"} ${key.key}`);
+		const inRepo = existsSync(join(project.root, SECRETS_FILE));
+		console.log(
+			inRepo
+				? `Put each in ${SECRETS_FILE}, which the deploy uploads:`
+				: source === "wrangler"
+					? "Set each secret on the worker (this also creates the draft worker on a first deploy):"
+					: "Set each secret on the project:",
+		);
+		for (const key of secrets) {
+			console.log(inRepo ? `  dotenvx set ${key.key} '…' -f ${SECRETS_FILE}` : `  ${source === "wrangler" ? "wrangler secret put" : "void secret put"} ${key.key}`);
+		}
 	}
 	const plain = result.missing.filter((key) => key.plaintext);
 	if (plain.length > 0) console.log(`Values safe to commit go in .env.production: ${plain.map((k) => k.key).join(", ")}`);

package/src/deploy/secrets.ts

@@ -0,0 +1,244 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { delimiter, dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+import color from "picocolors";
+import { allEnvKeys } from "../generate/env";
+import type { Project } from "../project";
+
+/**
+ * Secrets that live in the repository, encrypted.
+ *
+ * ── The problem this solves ──────────────────────────────────────────────
+ *
+ * A shop's secrets were set by hand, one `wrangler secret put` at a time,
+ * on a machine that happened to have them. Nothing in the repository said
+ * what the values WERE, only what they were called, so the shop could not
+ * be rebuilt from a checkout and a new deploy target needed somebody to
+ * remember. That is the last manual step between "push" and "live".
+ *
+ * dotenvx closes it. `.env.secrets` holds ciphertext and a public key, and
+ * it is COMMITTED: the key names are readable, the values are not, and a
+ * diff shows when a secret changed without showing what it changed to. The
+ * private key is the one thing that stays out — a single value, set once
+ * where the deploy runs.
+ *
+ * ── Why the values still become worker SECRETS ───────────────────────────
+ *
+ * The lazy version of this would decrypt at build time and let the values
+ * land in the worker's `vars`. That undoes the thing we built the scrub
+ * step for: `vars` are plaintext in the deployed configuration and readable
+ * by anyone with dashboard access. So the plaintext exists only inside the
+ * build, in a temp file, and goes up through `wrangler deploy
+ * --secrets-file`, which stores them as real secrets and — importantly —
+ * applies ADDITIVELY, so a secret this file does not name is left alone
+ * rather than deleted.
+ *
+ * ── The tradeoff, stated ─────────────────────────────────────────────────
+ *
+ * Ciphertext in git is permanent. If the private key ever leaks, every
+ * secret in the history is readable, including ones that were rotated —
+ * which is not true of `wrangler secret put`, where a rotation genuinely
+ * retires the old value. Rotating the dotenvx key re-encrypts the present,
+ * not the past. That is the price of a shop that rebuilds from a checkout,
+ * and it should be a decision rather than a surprise.
+ */
+
+export const SECRETS_FILE = ".env.secrets";
+export const PRIVATE_KEY_VAR = "DOTENV_PRIVATE_KEY_SECRETS";
+
+/** dotenvx, from the project's own install rather than a global one. */
+export function findDotenvx(from: string): string | null {
+	let dir = from;
+	for (;;) {
+		const local = join(dir, "node_modules", ".bin", "dotenvx");
+		if (existsSync(local)) return local;
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return (process.env["PATH"] ?? "")
+		.split(delimiter)
+		.filter(Boolean)
+		.some((entry) => existsSync(join(entry, "dotenvx")))
+		? "dotenvx"
+		: null;
+}
+
+function run(cmd: string, args: string[], cwd: string, env: Record<string, string> = {}): Promise<{ code: number; out: string }> {
+	return new Promise((resolve) => {
+		const child = spawn(cmd, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, ...env } });
+		let out = "";
+		child.stdout.on("data", (chunk) => {
+			out += chunk;
+		});
+		child.stderr.on("data", (chunk) => {
+			out += chunk;
+		});
+		child.on("error", (error) => resolve({ code: 1, out: String(error) }));
+		child.on("exit", (code) => resolve({ code: code ?? 1, out }));
+	});
+}
+
+/**
+ * The names a `.env.secrets` declares, read WITHOUT decrypting.
+ *
+ * dotenvx leaves keys in plaintext and encrypts only values, so preflight
+ * can say "all five are declared" on a machine that cannot read any of them.
+ */
+export function declaredSecretNames(root: string): Set<string> {
+	const path = join(root, SECRETS_FILE);
+	if (!existsSync(path)) return new Set();
+	const names = new Set<string>();
+	for (const line of readFileSync(path, "utf8").split("\n")) {
+		const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(line);
+		if (match && !match[1]!.startsWith("DOTENV_")) names.add(match[1]!);
+	}
+	return names;
+}
+
+/** Is a declared value actually encrypted, or was it committed in the clear? */
+export function plaintextSecretNames(root: string): string[] {
+	const path = join(root, SECRETS_FILE);
+	if (!existsSync(path)) return [];
+	const bare: string[] = [];
+	for (const line of readFileSync(path, "utf8").split("\n")) {
+		const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+		if (!match || match[1]!.startsWith("DOTENV_")) continue;
+		const value = match[2]!.trim().replace(/^['"]|['"]$/g, "");
+		// `unset` is the documented placeholder, not a leak.
+		if (value && value !== "unset" && !value.startsWith("encrypted:")) bare.push(match[1]!);
+	}
+	return bare;
+}
+
+export interface DecryptedSecrets {
+	/** A temp file in `.env` format, for `wrangler deploy --secrets-file`. */
+	path: string;
+	names: string[];
+	cleanup: () => void;
+}
+
+/**
+ * Decrypt into a temp file the deploy can hand to wrangler.
+ *
+ * Written to disk rather than piped because that is what `--secrets-file`
+ * takes, and removed by `cleanup()` whatever happens next.
+ */
+export async function decryptSecrets(project: Project): Promise<DecryptedSecrets | { error: string }> {
+	const root = project.root;
+	if (!existsSync(join(root, SECRETS_FILE))) return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
+
+	const dotenvx = findDotenvx(root);
+	if (!dotenvx) return { error: "dotenvx is not installed. `bun add -d @dotenvx/dotenvx`" };
+	if (!process.env[PRIVATE_KEY_VAR] && !existsSync(join(root, ".env.keys"))) {
+		return {
+			error: `${PRIVATE_KEY_VAR} is not set and there is no .env.keys here.\n  It is the one value that stays out of the repository; set it where the deploy runs.`,
+		};
+	}
+
+	const result = await run(dotenvx, ["decrypt", "-f", SECRETS_FILE, "--stdout"], root);
+	if (result.code !== 0) return { error: `dotenvx could not decrypt ${SECRETS_FILE}: ${result.out.trim().split("\n").slice(-2).join(" ")}` };
+
+	// Keep only the shop's own keys: dotenvx echoes the public key back, and
+	// it has no business being a worker secret.
+	const lines = result.out
+		.split("\n")
+		.filter((line) => /^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) && !line.trimStart().startsWith("DOTENV_"));
+	const names = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
+
+	const path = join(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
+	writeFileSync(path, `${lines.join("\n")}\n`, { mode: 0o600 });
+	return {
+		path,
+		names,
+		cleanup: () => {
+			try {
+				writeFileSync(path, "", { mode: 0o600 });
+				// Overwrite before unlinking: the plaintext existed on disk and
+				// should stop existing there promptly.
+				require("node:fs").unlinkSync(path);
+			} catch {
+				// Already gone, or never written. Nothing to do.
+			}
+		},
+	};
+}
+
+/** `vc secrets` — what the repository declares, and whether it is readable here. */
+export async function secretsCommand(project: Project, args: string[]): Promise<number> {
+	const root = project.root;
+	const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+	const declared = declaredSecretNames(root);
+	const bare = plaintextSecretNames(root);
+
+	if (args.includes("--init")) return initSecrets(project);
+
+	if (!existsSync(join(root, SECRETS_FILE))) {
+		console.log(
+			`\n${color.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,\n` +
+				`which means the shop cannot be rebuilt from a checkout.\n\n` +
+				`  vc secrets --init    write one, with every required key as \`unset\`\n`,
+		);
+		return 1;
+	}
+
+	console.log(`\n${SECRETS_FILE} — committed, encrypted, and read by \`vc deploy --cloudflare\`\n`);
+	for (const key of required) {
+		const state = declared.has(key.key) ? color.green("declared") : color.red("MISSING ");
+		console.log(`  ${state}  ${key.key}`);
+	}
+	const extra = [...declared].filter((name) => !required.some((key) => key.key === name));
+	for (const name of extra) console.log(`  ${color.dim("extra   ")}  ${name} ${color.dim("— not required by this shop")}`);
+
+	if (bare.length > 0) {
+		console.log(
+			`\n${color.red("✗")} ${bare.length} value${bare.length === 1 ? " is" : "s are"} committed IN THE CLEAR: ${bare.join(", ")}\n` +
+				`  Run \`dotenvx encrypt -f ${SECRETS_FILE}\` before committing again.\n`,
+		);
+		return 1;
+	}
+	const missing = required.filter((key) => !declared.has(key.key));
+	if (missing.length > 0) {
+		console.log(
+			`\n${color.red("✗")} ${missing.length} required secret${missing.length === 1 ? "" : "s"} not declared.\n` +
+				`  dotenvx set ${missing[0]!.key} '…' -f ${SECRETS_FILE}\n`,
+		);
+		return 1;
+	}
+	console.log(`\n${color.green("✓")} every secret this shop needs is declared and encrypted.\n`);
+	return 0;
+}
+
+/** Write a `.env.secrets` with every required key as the `unset` sentinel. */
+async function initSecrets(project: Project): Promise<number> {
+	const path = join(project.root, SECRETS_FILE);
+	if (existsSync(path)) {
+		console.error(`vc: ${SECRETS_FILE} already exists; not overwriting it.`);
+		return 1;
+	}
+	const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+	const body = [
+		"# Secrets, encrypted, and COMMITTED.",
+		"#",
+		"# Values are ciphertext; the key names are readable so a diff shows WHICH",
+		"# secret changed without showing what it changed to. `unset` is the",
+		"# documented placeholder and preflight refuses it.",
+		"#",
+		"# The private key stays out of the repository. It lives in .env.keys",
+		"# locally (gitignored) and as one build variable where the deploy runs.",
+		"",
+		...required.flatMap((key) => [`# ${key.breaks}${key.where ? ` — from: ${key.where}` : ""}`, `${key.key}=unset`, ""]),
+	].join("\n");
+	writeFileSync(path, body, { mode: 0o600 });
+
+	console.log(
+		`\n${color.green("+")} ${SECRETS_FILE} — ${required.length} keys, all \`unset\`\n\n` +
+			`Next:\n` +
+			`  1. put the real values in, then\n` +
+			`  2. ${color.cyan(`dotenvx encrypt -f ${SECRETS_FILE}`)}\n` +
+			`  3. commit ${SECRETS_FILE}; never commit .env.keys\n` +
+			`  4. set ${PRIVATE_KEY_VAR} where the deploy runs\n`,
+	);
+	return 0;
+}

package/src/dist.ts

@@ -120,7 +120,9 @@ export async function distCommand(args: string[]): Promise<number> {
 
 	// The patches the pins refer to, and the lockfile, so the install is the
 	// one that was tested rather than whatever resolves today.
-	for (const file of ["bun.lock", "bun.lockb", "package-lock.json", "pnpm-lock.yaml"]) {
+	// The encrypted secrets travel with the app: they are ciphertext, and the
+	// branch Cloudflare builds is where the deploy command reads them.
+	for (const file of ["bun.lock", "bun.lockb", "package-lock.json", "pnpm-lock.yaml", ".env.secrets"]) {
 		const source = join(project.root, file);
 		if (existsSync(source)) await cp(source, join(target, file));
 	}

package/src/generate/ci.ts

@@ -137,13 +137,27 @@ and \`voidcommerce.json\` so every later generate carries the real ids.
 
 ### 3. The secrets
 
+They live in the repository, encrypted:
+
 \`\`\`sh
-vc preflight --cloudflare
+vc secrets --init                       # every required key, as \`unset\`
+# put the real values in, then
+bunx dotenvx encrypt -f .env.secrets    # ciphertext; commit this
 \`\`\`
 
-lists every required key, says what breaks without it, and prints the
-\`wrangler secret put\` line. On a Worker that has never been deployed, setting
-the first secret is what creates it.
+\`.env.secrets\` is committed and \`.env.keys\` is not. The deploy decrypts it and
+hands the values to \`wrangler deploy --secrets-file\`, which stores them as
+real Worker secrets — not as plaintext \`vars\`, which anyone with dashboard
+access can read.
+
+That turns one \`wrangler secret put\` per value into one build variable, set
+once in step 5. It also means the shop rebuilds from a checkout.
+
+**Know the tradeoff.** Ciphertext in git is permanent: if the private key ever
+leaks, every secret in the history is readable, including ones you rotated.
+\`wrangler secret put\` does not have that property, and stays available for
+anything you would rather never commit. \`vc preflight\` counts a secret the
+repository declares as present, and refuses any value committed in the clear.
 
 ### 4. An API token the build can use
 
@@ -178,9 +192,20 @@ the \`wrangler.jsonc\` at the root directory, or the build fails.
 | branch | \`${DIST_BRANCH}\` |
 | root directory | \`/\` |
 | build command | \`bun install && bunx void prepare && bunx vp build\` |
-| deploy command | \`bunx wrangler d1 migrations apply DB --remote && bunx wrangler deploy -c dist/ssr/wrangler.json\` |
+| deploy command | see below |
+| build variable | \`DOTENV_PRIVATE_KEY_SECRETS\`, marked as a secret — the one value that is not in the repository |
 | API token | the one from step 4 |
 
+The deploy command, on one line:
+
+\`\`\`sh
+bunx dotenvx decrypt -f .env.secrets --stdout > .vc-secrets.env && bunx wrangler d1 migrations apply DB --remote && bunx wrangler deploy -c dist/ssr/wrangler.json --secrets-file .vc-secrets.env
+\`\`\`
+
+Plain \`sh\`, so it does not rely on process substitution. The decrypted file
+exists only inside the build sandbox, and \`--secrets-file\` applies additively:
+a secret it does not name is left alone rather than deleted.
+
 The migration command names the **binding** (\`DB\`), not the database, so it
 still points at the right database if the name ever differs.
 

package/src/generate/index.ts

@@ -326,7 +326,15 @@ async function generateStrictRoot(root: string, manifest: Manifest, result: Gene
 	);
 	// `.void` and `dist` are the STOREFRONT's build artifacts at the root now;
 	// `.vc` holds the generated worker and its own.
-	await put(root, ".gitignore", "node_modules\n.vc\n.void\n.wrangler\n.env\n.env.local\ndist\n*.tsbuildinfo\n.DS_Store\n", result, "own");
+	// `.env.keys` is the ONE thing that must never be committed: it is the
+	// authority to decrypt everything in `.env.secrets`, which is.
+	await put(
+		root,
+		".gitignore",
+		"node_modules\n.vc\n.void\n.wrangler\n.env\n.env.local\n.env.keys\ndist\n*.tsbuildinfo\n.DS_Store\n",
+		result,
+		"own",
+	);
 	await put(root, "patches/void@0.10.13.patch", renderVoidPatch(), result, "regenerate");
 	await put(root, ".github/workflows/void-dist.yml", renderDistWorkflow(manifest), result, "regenerate");
 	await put(root, "DEPLOY.md", renderDeployReadme(manifest, zone(manifest), workerHosts(manifest)), result, "regenerate");

package/src/generate/strict.ts

@@ -63,6 +63,9 @@ export function strictDependencies(manifest: Manifest): {
 		// The storefront at the root prerenders on the node target, whose SSR
 		// bundle imports this. Absent, a cold install builds nothing.
 		"@hono/node-server",
+		// The repository's secrets are encrypted with this; a build needs it to
+		// hand them to wrangler.
+		"@dotenvx/dotenvx",
 		"@rolldown/plugin-babel",
 		"@tailwindcss/vite",
 		"@types/node",

package/src/generate/support.ts

@@ -182,7 +182,8 @@ export const emailNotifications = (emailer: Emailer): NotificationProvider => ({
  * because the choice lives on the line, not in the catalogue.
  */
 export function renderMintTs(): string {
-	return `import { type MintProvider, recordedMint } from "@saastemly/better-commerce/plugins/nft";
+	return `import { getCurrentAuthContext } from "@better-auth/core/context";
+import { type MintProvider, recordedMint } from "@saastemly/better-commerce/plugins/nft";
 
 /**
  * Where a token comes from.

package/src/help.ts

@@ -17,6 +17,7 @@ export const EXTENDED_ROWS: Array<[command: string, summary: string]> = [
 	["vc dev | build | preview", "the app's own script, run where the app is — api/ for a monorepo, .vc/app for strict"],
 	["vc dist", "the deployable app as a self-contained tree — what the void-dist branch carries"],
 	["vc import", "push data/ and content/ into the running shop, as the shop itself — an upsert, safe on every deploy"],
+	["vc secrets", "the shop's secrets, encrypted and committed — one key where the deploy runs, instead of one wrangler secret put per value"],
 	["vc preflight", "is the shop ready to advertise on? every required key, and what breaks without it"],
 	["vc deploy", "preflight, then void deploy; or --cloudflare: wrangler, your own account, no Void login"],
 ];