@saastemly/voidcommerce 0.2.2 → 0.4.0

package/dist/{index-sbchkpa6.js → index-yzezvy5h.js}

@@ -11,11 +11,14 @@ import {
   workerHosts,
   writeManifest,
   zone
-} from "./index-zh3tmj08.js";
+} from "./index-pz6m2hkm.js";
 import {
-  CHOICES,
-  __require
-} from "./index-z4qazajn.js";
+  CHOICES
+} from "./index-844b3qn9.js";
+import {
+  __require,
+  __toESM
+} from "./index-0v6na3yp.js";
 
 // src/generate/auth.ts
 var VAT = {
@@ -840,6 +843,8 @@ function strictDependencies(manifest) {
   const devDependencies = {};
   for (const name of [
     "@hono/node-server",
+    "@dotenvx/dotenvx",
+    "husky",
     "@rolldown/plugin-babel",
     "@tailwindcss/vite",
     "@types/node",
@@ -1436,7 +1441,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.2.2",
+  version: "0.4.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1470,6 +1475,7 @@ var package_default = {
   },
   dependencies: {
     "@clack/prompts": "^0.11.0",
+    "@dotenvx/primitives": "^2.2.0",
     picocolors: "^1.1.1"
   },
   devDependencies: {
@@ -1492,6 +1498,7 @@ var EXTENDED_ROWS = [
   ["vc dev | build | preview", "the app's own script, run where the app is — api/ for a monorepo, .vc/app for strict"],
   ["vc dist", "the deployable app as a self-contained tree — what the void-dist branch carries"],
   ["vc import", "push data/ and content/ into the running shop, as the shop itself — an upsert, safe on every deploy"],
+  ["vc secrets", "the shop's secrets, encrypted and committed — one key where the deploy runs, instead of one wrangler secret put per value"],
   ["vc preflight", "is the shop ready to advertise on? every required key, and what breaks without it"],
   ["vc deploy", "preflight, then void deploy; or --cloudflare: wrangler, your own account, no Void login"]
 ];
@@ -1721,7 +1728,7 @@ async function distCommand(args) {
     appPkg["patchedDependencies"] = rootPkg["patchedDependencies"];
   await writeFile(appPkgPath, `${JSON.stringify(appPkg, null, 2)}
 `, "utf8");
-  for (const file of ["bun.lock", "bun.lockb", "package-lock.json", "pnpm-lock.yaml"]) {
+  for (const file of ["bun.lock", "bun.lockb", "package-lock.json", "pnpm-lock.yaml", ".env.secrets"]) {
     const source = join3(project.root, file);
     if (existsSync3(source))
       await cp(source, join3(target, file));
@@ -1876,13 +1883,27 @@ and \`voidcommerce.json\` so every later generate carries the real ids.
 
 ### 3. The secrets
 
+They live in the repository, encrypted:
+
 \`\`\`sh
-vc preflight --cloudflare
+vc secrets --init                       # every required key, as \`unset\`
+# put the real values in, then
+bunx dotenvx encrypt -f .env.secrets    # ciphertext; commit this
 \`\`\`
 
-lists every required key, says what breaks without it, and prints the
-\`wrangler secret put\` line. On a Worker that has never been deployed, setting
-the first secret is what creates it.
+\`.env.secrets\` is committed and \`.env.keys\` is not. The deploy decrypts it and
+hands the values to \`wrangler deploy --secrets-file\`, which stores them as
+real Worker secrets — not as plaintext \`vars\`, which anyone with dashboard
+access can read.
+
+That turns one \`wrangler secret put\` per value into one build variable, set
+once in step 5. It also means the shop rebuilds from a checkout.
+
+**Know the tradeoff.** Ciphertext in git is permanent: if the private key ever
+leaks, every secret in the history is readable, including ones you rotated.
+\`wrangler secret put\` does not have that property, and stays available for
+anything you would rather never commit. \`vc preflight\` counts a secret the
+repository declares as present, and refuses any value committed in the clear.
 
 ### 4. An API token the build can use
 
@@ -1917,9 +1938,20 @@ the \`wrangler.jsonc\` at the root directory, or the build fails.
 | branch | \`${DIST_BRANCH}\` |
 | root directory | \`/\` |
 | build command | \`bun install && bunx void prepare && bunx vp build\` |
-| deploy command | \`bunx wrangler d1 migrations apply DB --remote && bunx wrangler deploy -c dist/ssr/wrangler.json\` |
+| deploy command | see below |
+| build variable | \`DOTENV_PRIVATE_KEY_SECRETS\`, marked as a secret — the one value that is not in the repository |
 | API token | the one from step 4 |
 
+The deploy command, on one line:
+
+\`\`\`sh
+bunx dotenvx decrypt -f .env.secrets --stdout > .vc-secrets.env && bunx wrangler d1 migrations apply DB --remote && bunx wrangler deploy -c dist/ssr/wrangler.json --secrets-file .vc-secrets.env
+\`\`\`
+
+Plain \`sh\`, so it does not rely on process substitution. The decrypted file
+exists only inside the build sandbox, and \`--secrets-file\` applies additively:
+a secret it does not name is left alone rather than deleted.
+
 The migration command names the **binding** (\`DB\`), not the database, so it
 still points at the right database if the name ever differs.
 
@@ -2451,6 +2483,8 @@ async function generateStrictRoot(root, manifest, result) {
     scripts["deploy"] ??= "vc deploy";
     scripts["import:catalog"] ??= "vc import";
     scripts["maildev"] ??= "maildev --smtp 1025 --web 1080";
+    scripts["secrets"] ??= "vc secrets";
+    scripts["prepare"] ??= "husky";
     pkg["scripts"] = scripts;
   }, result);
   await put(root, ".gitignore", `node_modules
@@ -2459,11 +2493,18 @@ async function generateStrictRoot(root, manifest, result) {
 .wrangler
 .env
 .env.local
+.env.keys
 dist
 *.tsbuildinfo
 .DS_Store
 `, result, "own");
   await put(root, "patches/void@0.10.13.patch", renderVoidPatch(), result, "regenerate");
+  await put(root, ".husky/pre-commit", `#!/usr/bin/env sh
+# Generated by \`vc init\`. Refuses a commit that would put a secret in the
+# clear in .env.secrets — which cannot be undone by a later commit,
+# because the value stays in the history.
+bunx vc guard
+`, result, "regenerate");
   await put(root, ".github/workflows/void-dist.yml", renderDistWorkflow(manifest), result, "regenerate");
   await put(root, "DEPLOY.md", renderDeployReadme(manifest, zone(manifest), workerHosts(manifest)), result, "regenerate");
   await put(root, ".env", renderEnvLocal(manifest), result, "own");
@@ -2828,16 +2869,346 @@ ${ran.out.trim()}`);
 }
 
 // src/deploy/preflight.ts
+import { existsSync as existsSync9, readFileSync as readFileSync4 } from "node:fs";
+import { join as join9 } from "node:path";
+import color5 from "picocolors";
+
+// src/deploy/secrets.ts
+import { existsSync as existsSync8, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { spawn as spawn3 } from "node:child_process";
+import { delimiter as delimiter3, dirname as dirname5, join as join8 } from "node:path";
+import { tmpdir } from "node:os";
+import color4 from "picocolors";
+
+// src/deploy/keys.ts
+import { hkdfSync } from "node:crypto";
 import { existsSync as existsSync7, readFileSync as readFileSync2 } from "node:fs";
 import { join as join7 } from "node:path";
 import color3 from "picocolors";
+var INFO = "voidcommerce/dotenvx/secrets/v1";
+function apiToken() {
+  return process.env["CLOUDFLARE_API_TOKEN"] || process.env["CF_API_TOKEN"] || null;
+}
+function derivePrivateKey(token, accountId) {
+  const bytes = hkdfSync("sha256", Buffer.from(token, "utf8"), Buffer.from(accountId, "utf8"), Buffer.from(INFO), 32);
+  return Buffer.from(bytes).toString("hex");
+}
+async function publicKeyFor(privateKey) {
+  try {
+    const { derive } = await import("./index-mpr7gm6k.js").then((m)=>__toESM(m.default,1));
+    return derive(privateKey);
+  } catch {
+    return null;
+  }
+}
+function committedPublicKey(root) {
+  const path = join7(root, SECRETS_FILE);
+  if (!existsSync7(path))
+    return null;
+  const match = /^\s*DOTENV_PUBLIC_KEY_SECRETS\s*=\s*["']?([0-9a-fA-F]+)["']?/m.exec(readFileSync2(path, "utf8"));
+  return match?.[1] ?? null;
+}
+async function keyFor(manifest, root) {
+  const token = apiToken();
+  if (!token) {
+    return {
+      ok: false,
+      reason: `CLOUDFLARE_API_TOKEN is not set.
+  The key is derived from it, so there is nothing to derive from. Note that
+` + "  `wrangler login` does NOT set one — this scheme needs an API token, from\n" + "  My Profile → API Tokens."
+    };
+  }
+  const accountId = manifest.cloudflare?.accountId || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
+  if (!accountId) {
+    return {
+      ok: false,
+      reason: "the account is not pinned, and it salts the derivation.\n  Run `vc deploy --cloudflare --provision` once, or set CLOUDFLARE_ACCOUNT_ID."
+    };
+  }
+  const privateKey = derivePrivateKey(token, accountId);
+  const publicKey = await publicKeyFor(privateKey);
+  if (!publicKey) {
+    return { ok: false, reason: "@dotenvx/dotenvx is not installed here, so a key cannot be derived. `bun add -d @dotenvx/dotenvx`" };
+  }
+  const committed = committedPublicKey(root);
+  if (!committed)
+    return { ok: true, privateKey, publicKey, fresh: true };
+  if (committed.toLowerCase() !== publicKey.toLowerCase()) {
+    return {
+      ok: false,
+      reason: `this token does not derive the key ${SECRETS_FILE} was encrypted under.
+
+  encrypted under:  ${committed.slice(0, 16)}…
+` + `  this token gives: ${publicKey.slice(0, 16)}…
+
+` + `  That is one of three things, and all of them are the same fix:
+` + `    · the token was rotated since the secrets were encrypted
+` + `    · this is a different admin's token
+` + `    · CLOUDFLARE_ACCOUNT_ID is not the account they were encrypted for
+
+` + `  If you still have the ORIGINAL token, \`vc keys rotate\` re-encrypts
+  everything under the new one. If you do not, the values are unrecoverable
+  and must be entered again.`
+    };
+  }
+  return { ok: true, privateKey, publicKey, fresh: false };
+}
+async function keysCommand(manifest, root, args) {
+  if (args.includes("--rotate"))
+    return rotate(manifest, root);
+  const state = await keyFor(manifest, root);
+  console.log(`
+The key is DERIVED from CLOUDFLARE_API_TOKEN, salted with the account id.`);
+  console.log(color3.dim(`Nothing is stored, so nothing can leak — and nothing can be recovered.
+`));
+  if (!state.ok) {
+    console.error(`${color3.red("✗")} ${state.reason}
+`);
+    return 1;
+  }
+  console.log(`  derives public key  ${state.publicKey.slice(0, 20)}…`);
+  console.log(state.fresh ? `  ${color3.dim(`${SECRETS_FILE} does not exist yet, so there is nothing to check against`)}` : `  ${color3.green("✓")} matches what ${SECRETS_FILE} was encrypted under`);
+  console.log(color3.yellow(`
+! Rotating this API token makes every secret in ${SECRETS_FILE} unreadable.
+  Run \`vc keys --rotate\` with the NEW token exported and the old one in
+  CLOUDFLARE_API_TOKEN_OLD, BEFORE the old one stops working.
+`));
+  return 0;
+}
+async function rotate(manifest, root) {
+  const oldToken = process.env["CLOUDFLARE_API_TOKEN_OLD"];
+  const newToken = apiToken();
+  if (!oldToken || !newToken) {
+    console.error(`
+vc: rotation needs BOTH tokens:
+  CLOUDFLARE_API_TOKEN_OLD=<the one the secrets were encrypted under>
+  CLOUDFLARE_API_TOKEN=<the new one>
+
+  The old one is the only thing that can read the current values.
+`);
+    return 1;
+  }
+  const accountId = manifest.cloudflare?.accountId || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
+  if (!accountId) {
+    console.error("vc: the account is not pinned, and it salts the derivation.");
+    return 1;
+  }
+  const oldKey = derivePrivateKey(oldToken, accountId);
+  const oldPublic = await publicKeyFor(oldKey);
+  const committed = committedPublicKey(root);
+  if (committed && oldPublic && committed.toLowerCase() !== oldPublic.toLowerCase()) {
+    console.error(`
+vc: CLOUDFLARE_API_TOKEN_OLD does not derive the key ${SECRETS_FILE} was encrypted under either.
+`);
+    return 1;
+  }
+  console.log(`
+Rotation is a decrypt with the old key and an encrypt with the new one.
+Run these two, in this order, from ${root}:
+
+  ${color3.cyan(`DOTENV_PRIVATE_KEY_SECRETS=<old> bunx dotenvx decrypt -f ${SECRETS_FILE}`)}
+  ${color3.cyan(`bunx dotenvx encrypt -f ${SECRETS_FILE}`)}   ${color3.dim("# under the new derived key")}
+
+` + color3.dim(`vc does not run them for you: the middle state is your secrets in
+plaintext on disk, and that is a moment to be deliberate about.
+`));
+  return 0;
+}
+
+// src/deploy/secrets.ts
+var SECRETS_FILE = ".env.secrets";
+var PRIVATE_KEY_VAR = "DOTENV_PRIVATE_KEY_SECRETS";
+function findDotenvx(from) {
+  let dir = from;
+  for (;; ) {
+    const local = join8(dir, "node_modules", ".bin", "dotenvx");
+    if (existsSync8(local))
+      return local;
+    const parent = dirname5(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return (process.env["PATH"] ?? "").split(delimiter3).filter(Boolean).some((entry) => existsSync8(join8(entry, "dotenvx"))) ? "dotenvx" : null;
+}
+function run(cmd, args, cwd, env = {}) {
+  return new Promise((resolve) => {
+    const child = spawn3(cmd, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, ...env } });
+    let out = "";
+    child.stdout.on("data", (chunk) => {
+      out += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      out += chunk;
+    });
+    child.on("error", (error) => resolve({ code: 1, out: String(error) }));
+    child.on("exit", (code) => resolve({ code: code ?? 1, out }));
+  });
+}
+function declaredSecretNames(root) {
+  const path = join8(root, SECRETS_FILE);
+  if (!existsSync8(path))
+    return new Set;
+  const names = new Set;
+  for (const line2 of readFileSync3(path, "utf8").split(`
+`)) {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(line2);
+    if (match && !match[1].startsWith("DOTENV_"))
+      names.add(match[1]);
+  }
+  return names;
+}
+function plaintextSecretNames(root) {
+  const path = join8(root, SECRETS_FILE);
+  if (!existsSync8(path))
+    return [];
+  const bare = [];
+  for (const line2 of readFileSync3(path, "utf8").split(`
+`)) {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line2);
+    if (!match || match[1].startsWith("DOTENV_"))
+      continue;
+    const value = match[2].trim().replace(/^['"]|['"]$/g, "");
+    if (value && value !== "unset" && !value.startsWith("encrypted:"))
+      bare.push(match[1]);
+  }
+  return bare;
+}
+async function decryptSecrets(project) {
+  const root = project.root;
+  if (!existsSync8(join8(root, SECRETS_FILE)))
+    return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
+  const dotenvx = findDotenvx(root);
+  if (!dotenvx)
+    return { error: "dotenvx is not installed. `bun add -d @dotenvx/dotenvx`" };
+  const key = await keyFor(project.manifest, root);
+  if (!key.ok)
+    return { error: key.reason };
+  const result = await run(dotenvx, ["decrypt", "-f", SECRETS_FILE, "--stdout"], root, {
+    [PRIVATE_KEY_VAR]: key.privateKey
+  });
+  if (result.code !== 0)
+    return { error: `dotenvx could not decrypt ${SECRETS_FILE}: ${result.out.trim().split(`
+`).slice(-2).join(" ")}` };
+  const lines = result.out.split(`
+`).filter((line2) => /^\s*[A-Z][A-Z0-9_]*\s*=/.test(line2) && !line2.trimStart().startsWith("DOTENV_"));
+  const names = lines.map((line2) => line2.slice(0, line2.indexOf("=")).trim());
+  const path = join8(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
+  writeFileSync(path, `${lines.join(`
+`)}
+`, { mode: 384 });
+  return {
+    path,
+    names,
+    cleanup: () => {
+      try {
+        writeFileSync(path, "", { mode: 384 });
+        __require("node:fs").unlinkSync(path);
+      } catch {}
+    }
+  };
+}
+async function secretsCommand(project, args) {
+  const root = project.root;
+  const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+  const declared = declaredSecretNames(root);
+  const bare = plaintextSecretNames(root);
+  if (args.includes("--init"))
+    return initSecrets(project);
+  if (!existsSync8(join8(root, SECRETS_FILE))) {
+    console.log(`
+${color4.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,
+` + `which means the shop cannot be rebuilt from a checkout.
+
+` + `  vc secrets --init    write one, with every required key as \`unset\`
+`);
+    return 1;
+  }
+  console.log(`
+${SECRETS_FILE} — committed, encrypted, and read by \`vc deploy --cloudflare\`
+`);
+  for (const key of required) {
+    const state = declared.has(key.key) ? color4.green("declared") : color4.red("MISSING ");
+    console.log(`  ${state}  ${key.key}`);
+  }
+  const extra = [...declared].filter((name) => !required.some((key) => key.key === name));
+  for (const name of extra)
+    console.log(`  ${color4.dim("extra   ")}  ${name} ${color4.dim("— not required by this shop")}`);
+  if (bare.length > 0) {
+    console.log(`
+${color4.red("✗")} ${bare.length} value${bare.length === 1 ? " is" : "s are"} committed IN THE CLEAR: ${bare.join(", ")}
+` + `  Run \`dotenvx encrypt -f ${SECRETS_FILE}\` before committing again.
+`);
+    return 1;
+  }
+  const missing = required.filter((key) => !declared.has(key.key));
+  if (missing.length > 0) {
+    console.log(`
+${color4.red("✗")} ${missing.length} required secret${missing.length === 1 ? "" : "s"} not declared.
+` + `  dotenvx set ${missing[0].key} '…' -f ${SECRETS_FILE}
+`);
+    return 1;
+  }
+  console.log(`
+${color4.green("✓")} every secret this shop needs is declared and encrypted.
+`);
+  return 0;
+}
+async function initSecrets(project) {
+  const path = join8(project.root, SECRETS_FILE);
+  if (existsSync8(path)) {
+    console.error(`vc: ${SECRETS_FILE} already exists; not overwriting it.`);
+    return 1;
+  }
+  const key = await keyFor(project.manifest, project.root);
+  if (!key.ok) {
+    console.error(`
+vc: ${key.reason}
+`);
+    return 1;
+  }
+  const required = allEnvKeys(project.manifest).filter((key2) => !key2.plaintext);
+  const body = [
+    "# Secrets, encrypted, and COMMITTED.",
+    "#",
+    "# Values are ciphertext; the key names are readable so a diff shows WHICH",
+    "# secret changed without showing what it changed to. `unset` is the",
+    "# documented placeholder and preflight refuses it.",
+    "#",
+    "# The private key is DERIVED from CLOUDFLARE_API_TOKEN, salted with the",
+    "# account id — it is stored nowhere, so there is no .env.keys to leak.",
+    "#",
+    "# The cost of that: rotating the token makes every value below",
+    "# permanently unreadable. `vc keys --rotate` re-encrypts while you still",
+    "# have the old token; after that there is no recovery.",
+    "",
+    `DOTENV_PUBLIC_KEY_SECRETS="${key.publicKey}"`,
+    "",
+    ...required.flatMap((key2) => [`# ${key2.breaks}${key2.where ? ` — from: ${key2.where}` : ""}`, `${key2.key}=unset`, ""])
+  ].join(`
+`);
+  writeFileSync(path, body, { mode: 384 });
+  console.log(`
+${color4.green("+")} ${SECRETS_FILE} — ${required.length} keys, all \`unset\`, under the key this token derives
+
+` + `Next:
+` + `  1. put the real values in, then
+` + `  2. ${color4.cyan(`bunx dotenvx encrypt -f ${SECRETS_FILE}`)}
+` + `  3. commit it — there is no key file to keep out
+
+` + color4.yellow(`! Rotating CLOUDFLARE_API_TOKEN makes these unreadable. \`vc keys\` explains.
+`));
+  return 0;
+}
+
+// src/deploy/preflight.ts
 var UNSET = "unset";
 function productionEnv(appDir) {
   const out = new Map;
-  const path = join7(appDir, ".env.production");
-  if (!existsSync7(path))
+  const path = join9(appDir, ".env.production");
+  if (!existsSync9(path))
     return out;
-  for (const line2 of readFileSync2(path, "utf8").split(`
+  for (const line2 of readFileSync4(path, "utf8").split(`
 `)) {
     const match = /^\s*([A-Z0-9_]+)\s*=\s*(.*)$/.exec(line2);
     if (!match)
@@ -2862,12 +3233,12 @@ async function voidSecretNames(appDir) {
   return names;
 }
 function routeProblem(project) {
-  const path = join7(project.appDir, "wrangler.jsonc");
-  if (!existsSync7(path))
+  const path = join9(project.appDir, "wrangler.jsonc");
+  if (!existsSync9(path))
     return "wrangler.jsonc is missing";
   let routes = [];
   try {
-    routes = parseJsonc(readFileSync2(path, "utf8")).routes ?? [];
+    routes = parseJsonc(readFileSync4(path, "utf8")).routes ?? [];
   } catch {
     return "wrangler.jsonc cannot be parsed";
   }
@@ -2887,17 +3258,27 @@ async function preflight(project, source) {
   }
   for (const name of remote ?? [])
     present.set(name, "<secret>");
+  for (const name of declaredSecretNames(project.root))
+    present.set(name, "<in the repository>");
   const missing = allEnvKeys(project.manifest).filter((key) => {
     const value = present.get(key.key);
     return value === undefined || value === "" || value === UNSET;
   });
   const problem = routeProblem(project);
-  return { present, remote, missing, routeProblem: problem, ready: missing.length === 0 && problem === null };
+  const bare = plaintextSecretNames(project.root);
+  return {
+    present,
+    remote,
+    missing,
+    routeProblem: problem,
+    bareSecrets: bare,
+    ready: missing.length === 0 && problem === null && bare.length === 0
+  };
 }
 function printPreflight(project, result, source) {
   const keys = allEnvKeys(project.manifest);
   if (result.remote === null) {
-    console.log(color3.dim(source === "wrangler" ? `Could not read the worker's secrets — not deployed yet, or wrangler is not logged in.
+    console.log(color5.dim(source === "wrangler" ? `Could not read the worker's secrets — not deployed yet, or wrangler is not logged in.
 Anything not in .env.production is reported as missing.
 ` : `Could not read the project's secrets from Void — not logged in, or no linked project.
 Anything not in .env.production is reported as missing.
@@ -2907,34 +3288,41 @@ Anything not in .env.production is reported as missing.
   for (const key of keys) {
     const value = result.present.get(key.key);
     const set = value !== undefined && value !== "" && value !== UNSET;
-    console.log(`  ${set ? color3.green("set  ") : color3.dim("unset")}  ${key.key}${key.plaintext ? color3.dim("  (plaintext)") : ""}`);
+    console.log(`  ${set ? color5.green("set  ") : color5.dim("unset")}  ${key.key}${key.plaintext ? color5.dim("  (plaintext)") : ""}`);
   }
   if (result.ready) {
     console.log(`
-${color3.green("Ready to go live.")}
+${color5.green("Ready to go live.")}
 `);
     return;
   }
   console.log(`
-${color3.red("NOT ready to go live.")}
+${color5.red("NOT ready to go live.")}
 `);
   if (result.routeProblem) {
-    console.log(`${color3.red("✗")} the worker's hostname
+    console.log(`${color5.red("✗")} the worker's hostname
     ${result.routeProblem}
+`);
+  }
+  if (result.bareSecrets.length > 0) {
+    console.log(`${color5.red("✗")} committed in the clear in ${SECRETS_FILE}: ${result.bareSecrets.join(", ")}
+` + `    Run \`dotenvx encrypt -f ${SECRETS_FILE}\` — and treat those values as burned.
 `);
   }
   for (const key of result.missing) {
-    console.log(`${color3.red("✗")} ${key.key}`);
+    console.log(`${color5.red("✗")} ${key.key}`);
     console.log(`    ${key.breaks}`);
     if (key.where)
-      console.log(`    ${color3.dim(`from: ${key.where}`)}`);
+      console.log(`    ${color5.dim(`from: ${key.where}`)}`);
     console.log("");
   }
   const secrets = result.missing.filter((key) => !key.plaintext);
   if (secrets.length > 0) {
-    console.log(source === "wrangler" ? "Set each secret on the worker (this also creates the draft worker on a first deploy):" : "Set each secret on the project:");
-    for (const key of secrets)
-      console.log(`  ${source === "wrangler" ? "wrangler secret put" : "void secret put"} ${key.key}`);
+    const inRepo = existsSync9(join9(project.root, SECRETS_FILE));
+    console.log(inRepo ? `Put each in ${SECRETS_FILE}, which the deploy uploads:` : source === "wrangler" ? "Set each secret on the worker (this also creates the draft worker on a first deploy):" : "Set each secret on the project:");
+    for (const key of secrets) {
+      console.log(inRepo ? `  dotenvx set ${key.key} '…' -f ${SECRETS_FILE}` : `  ${source === "wrangler" ? "wrangler secret put" : "void secret put"} ${key.key}`);
+    }
   }
   const plain = result.missing.filter((key) => key.plaintext);
   if (plain.length > 0)
@@ -2943,17 +3331,17 @@ ${color3.red("NOT ready to go live.")}
 }
 
 // src/deploy/cloudflare.ts
-import { existsSync as existsSync8, readFileSync as readFileSync3, writeFileSync } from "node:fs";
-import { dirname as dirname5, join as join8 } from "node:path";
-import color4 from "picocolors";
+import { existsSync as existsSync10, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname6, join as join10 } from "node:path";
+import color6 from "picocolors";
 var fail = (message) => {
   console.error(`
-${color4.red("✗")} ${message}
+${color6.red("✗")} ${message}
 `);
   return 1;
 };
 function readConfig(path) {
-  return parseJsonc(readFileSync3(path, "utf8"));
+  return parseJsonc(readFileSync5(path, "utf8"));
 }
 function findBuilder(from) {
   let dir = from;
@@ -2962,11 +3350,11 @@ function findBuilder(from) {
       ["vp", "vp build"],
       ["vite", "vite build"]
     ]) {
-      const path = join8(dir, "node_modules", ".bin", bin);
-      if (existsSync8(path))
+      const path = join10(dir, "node_modules", ".bin", bin);
+      if (existsSync10(path))
         return { cmd: path, label };
     }
-    const parent = dirname5(dir);
+    const parent = dirname6(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -2974,8 +3362,8 @@ function findBuilder(from) {
 }
 async function deployCloudflare(project, opts) {
   const app = project.appDir;
-  const configPath = join8(app, "wrangler.jsonc");
-  if (!existsSync8(configPath))
+  const configPath = join10(app, "wrangler.jsonc");
+  if (!existsSync10(configPath))
     return fail("wrangler.jsonc is missing — `vc generate` writes it.");
   const bin = findWrangler(app);
   if (!bin)
@@ -2988,16 +3376,16 @@ async function deployCloudflare(project, opts) {
 ${who.raw.trim().split(`
 `).slice(-4).join(`
 `)}`);
-  console.log(`${color4.green("✓")} wrangler is logged in`);
+  console.log(`${color6.green("✓")} wrangler is logged in`);
   let config = readConfig(configPath);
   let accountId = config.account_id || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
   if (!accountId) {
     if (who.accounts.length === 1) {
       accountId = who.accounts[0].id;
-      writeFileSync(configPath, upsertJsonc(readFileSync3(configPath, "utf8"), "account_id", accountId));
+      writeFileSync2(configPath, upsertJsonc(readFileSync5(configPath, "utf8"), "account_id", accountId));
       project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId };
       await writeManifest(project.root, project.manifest);
-      console.log(`${color4.green("✓")} pinned the account "${who.accounts[0].name}" in wrangler.jsonc`);
+      console.log(`${color6.green("✓")} pinned the account "${who.accounts[0].name}" in wrangler.jsonc`);
     } else {
       return fail(`the account is not pinned and wrangler sees ${who.accounts.length}. Set account_id in wrangler.jsonc to one of:
 ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
@@ -3009,7 +3397,7 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   if (!check.ready) {
     if (!opts.force)
       return fail("refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force for a deliberate partial deploy.");
-    console.error(color4.yellow(`--force: deploying a shop that is NOT ready for customers.
+    console.error(color6.yellow(`--force: deploying a shop that is NOT ready for customers.
 `));
   }
   const worker = config.name || project.manifest.shop.domain.split(".")[0];
@@ -3020,15 +3408,15 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
       return fail("the D1 database is not provisioned. Run once with --provision to create it and record its id.");
     const db = await ensureD1(bin, app, `${worker}-db`);
     const entry = { binding: "DB", database_name: db.name, database_id: db.uuid, migrations_dir: "./db/migrations" };
-    writeFileSync(configPath, upsertJsonc(readFileSync3(configPath, "utf8"), "d1_databases", [entry]));
+    writeFileSync2(configPath, upsertJsonc(readFileSync5(configPath, "utf8"), "d1_databases", [entry]));
     project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId, d1: { name: db.name, id: db.uuid } };
     await writeManifest(project.root, project.manifest);
-    console.log(`${color4.green("✓")} D1 "${db.name}" recorded in wrangler.jsonc and voidcommerce.json`);
+    console.log(`${color6.green("✓")} D1 "${db.name}" recorded in wrangler.jsonc and voidcommerce.json`);
     config = readConfig(configPath);
   }
   if (opts.provision) {
     await ensureQueue(bin, app, "commerce");
-    console.log(`${color4.green("✓")} queue "commerce"`);
+    console.log(`${color6.green("✓")} queue "commerce"`);
   }
   const builder = findBuilder(app);
   if (!builder)
@@ -3038,10 +3426,10 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const built = await wrangler(builder.cmd, ["build"], app, true);
   if (built.code !== 0)
     return fail(`the build failed (exit ${built.code}).`);
-  const emittedPath = join8(app, "dist", "ssr", "wrangler.json");
-  if (!existsSync8(emittedPath))
+  const emittedPath = join10(app, "dist", "ssr", "wrangler.json");
+  if (!existsSync10(emittedPath))
     return fail(`the build emitted no ${emittedPath} — is this a Void app on the Cloudflare target?`);
-  const emitted = JSON.parse(readFileSync3(emittedPath, "utf8"));
+  const emitted = JSON.parse(readFileSync5(emittedPath, "utf8"));
   const secretKeys = new Set(allEnvKeys(project.manifest).filter((key) => !key.plaintext).map((key) => key.key));
   const scrubbed = [];
   for (const [key, value] of Object.entries(emitted.vars ?? {})) {
@@ -3053,32 +3441,43 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const emittedD1 = emitted.d1_databases?.find((db) => db.binding === "DB");
   if (!emittedD1 || emittedD1.database_id === "local")
     return fail("the emitted config still carries a placeholder D1 id; wrangler.jsonc's DB binding was not picked up by the build.");
-  writeFileSync(emittedPath, JSON.stringify(emitted, null, 2));
-  console.log(`${color4.green("✓")} scrubbed ${scrubbed.length} baked value${scrubbed.length === 1 ? "" : "s"} from the worker's vars${scrubbed.length ? `: ${scrubbed.join(", ")}` : ""}`);
+  writeFileSync2(emittedPath, JSON.stringify(emitted, null, 2));
+  console.log(`${color6.green("✓")} scrubbed ${scrubbed.length} baked value${scrubbed.length === 1 ? "" : "s"} from the worker's vars${scrubbed.length ? `: ${scrubbed.join(", ")}` : ""}`);
   console.log(`
 ▸ wrangler d1 migrations apply ${emittedD1.database_name} --remote`);
   const migrated = await wrangler(bin, ["d1", "migrations", "apply", emittedD1.database_name, "--remote"], app, true);
   if (migrated.code !== 0)
     return fail(`applying migrations failed (exit ${migrated.code}); nothing was deployed.`);
+  const secretArgs = [];
+  let cleanupSecrets;
+  if (existsSync10(join10(project.root, SECRETS_FILE))) {
+    const decrypted = await decryptSecrets(project);
+    if ("error" in decrypted)
+      return fail(`the repository's secrets could not be read: ${decrypted.error}`);
+    secretArgs.push("--secrets-file", decrypted.path);
+    cleanupSecrets = decrypted.cleanup;
+    console.log(`${color6.green("✓")} ${decrypted.names.length} secrets from ${SECRETS_FILE}, uploaded with this version`);
+  }
   console.log(`
 ▸ wrangler deploy -c dist/ssr/wrangler.json`);
-  const deployed = await wrangler(bin, ["deploy", "-c", join8("dist", "ssr", "wrangler.json")], app, true);
+  const deployed = await wrangler(bin, ["deploy", "-c", join10("dist", "ssr", "wrangler.json"), ...secretArgs], app, true);
+  cleanupSecrets?.();
   if (deployed.code !== 0)
     return fail(`wrangler deploy failed (exit ${deployed.code}).`);
   const domain = project.manifest.shop.domain;
   const url = `https://${workerHosts(project.manifest)[0]}`;
   console.log(`
-${color4.green("Live:")} ${url}`);
+${color6.green("Live:")} ${url}`);
   if (hasFrontend(project.manifest.layout))
-    console.log(color4.dim("The storefront deploys itself from GitHub Actions on push."));
+    console.log(color6.dim("The storefront deploys itself from GitHub Actions on push."));
   return 0;
 }
 
 // src/import.ts
 import { readFile as readFile3 } from "node:fs/promises";
-import { existsSync as existsSync9 } from "node:fs";
-import { join as join9 } from "node:path";
-import color5 from "picocolors";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join11 } from "node:path";
+import color7 from "picocolors";
 function describe(counts) {
   if (!counts)
     return "";
@@ -3117,7 +3516,7 @@ async function post(url, key, body) {
   return { ok: response.ok, status: response.status, body: { ...parsed, error: parsed.error ?? parsed.message } };
 }
 async function readJson(path) {
-  if (!existsSync9(path))
+  if (!existsSync11(path))
     return null;
   try {
     return JSON.parse(await readFile3(path, "utf8"));
@@ -3145,41 +3544,41 @@ async function importCommand(args) {
   }
   const { url, how } = resolveTarget(project, args);
   if (!dry)
-    console.log(`${color5.dim("→")} ${url} ${color5.dim(`(${how})`)}
+    console.log(`${color7.dim("→")} ${url} ${color7.dim(`(${how})`)}
 `);
   if (!dry) {
     let whoami2;
     try {
       whoami2 = await fetch(`${url}/api/auth/system/whoami`, { headers: { "x-system-key": key } });
     } catch (error) {
-      console.error(`${color5.red("✗")} could not reach ${url}: ${error instanceof Error ? error.message : String(error)}
+      console.error(`${color7.red("✗")} could not reach ${url}: ${error instanceof Error ? error.message : String(error)}
 ` + `  Is the shop running? \`vc dev\` serves it locally; --local points here.
 `);
       return 1;
     }
     if (!whoami2.ok) {
-      console.error(`${color5.red("✗")} the shop refused the system key (HTTP ${whoami2.status}).
+      console.error(`${color7.red("✗")} the shop refused the system key (HTTP ${whoami2.status}).
 ` + `  Is SYSTEM_API_KEY the one this deployment was given?
 `);
       return 1;
     }
-    console.log(`${color5.green("✓")} authenticated as the system identity`);
+    console.log(`${color7.green("✓")} authenticated as the system identity`);
   }
   const root = project.root;
-  const products = await readJson(join9(root, "data", "catalog.json"));
-  const categories = await readJson(join9(root, "data", "categories.json"));
-  const faqs = has(project.manifest, "faqs") ? await readJson(join9(root, "content", "faqs.json")) : null;
-  const posts = has(project.manifest, "blogs") ? await readJson(join9(root, "content", "posts.json")) : null;
+  const products = await readJson(join11(root, "data", "catalog.json"));
+  const categories = await readJson(join11(root, "data", "categories.json"));
+  const faqs = has(project.manifest, "faqs") ? await readJson(join11(root, "content", "faqs.json")) : null;
+  const posts = has(project.manifest, "blogs") ? await readJson(join11(root, "content", "posts.json")) : null;
   if (!products && !faqs?.length && !posts?.length) {
     console.log(`
-${color5.yellow("Nothing to import.")} data/catalog.json is absent and the content files are empty.
+${color7.yellow("Nothing to import.")} data/catalog.json is absent and the content files are empty.
 ` + `Products go in data/catalog.json as a JSON array; \`vc import --dry-run\` checks it without pushing.
 `);
     return 0;
   }
   if (dry) {
     console.log(`
-${color5.dim("--dry-run: nothing was pushed.")}`);
+${color7.dim("--dry-run: nothing was pushed.")}`);
     console.log(`  ${products?.length ?? 0} products, ${categories?.length ?? 0} categories`);
     console.log(`  ${faqs?.length ?? 0} FAQ entries, ${posts?.length ?? 0} posts
 `);
@@ -3195,15 +3594,15 @@ ${color5.dim("--dry-run: nothing was pushed.")}`);
     });
     if (result.ok) {
       const report = result.body.report ?? {};
-      console.log(`${color5.green("✓")} products:   ${describe(report.products)}`);
+      console.log(`${color7.green("✓")} products:   ${describe(report.products)}`);
       if (report.categories)
-        console.log(`${color5.green("✓")} categories: ${describe(report.categories)}`);
+        console.log(`${color7.green("✓")} categories: ${describe(report.categories)}`);
       if (report.prices)
-        console.log(`${color5.green("✓")} prices:     ${describe(report.prices)}`);
+        console.log(`${color7.green("✓")} prices:     ${describe(report.prices)}`);
       if (report.addons)
-        console.log(`${color5.green("✓")} addons:     ${describe(report.addons)}`);
+        console.log(`${color7.green("✓")} addons:     ${describe(report.addons)}`);
     } else {
-      console.error(`${color5.red("✗")} catalogue: ${result.body.error ?? `HTTP ${result.status}`}`);
+      console.error(`${color7.red("✗")} catalogue: ${result.body.error ?? `HTTP ${result.status}`}`);
       failed = true;
     }
   }
@@ -3215,20 +3614,20 @@ ${color5.dim("--dry-run: nothing was pushed.")}`);
       continue;
     const result = await post(`${url}${path}`, key, { entries: rows, posts: rows });
     if (result.ok) {
-      console.log(`${color5.green("✓")} ${label}: ${describe(result.body)}`);
+      console.log(`${color7.green("✓")} ${label}: ${describe(result.body)}`);
     } else {
-      console.error(`${color5.red("✗")} ${label}: ${result.body.error ?? `HTTP ${result.status}`}`);
+      console.error(`${color7.red("✗")} ${label}: ${result.body.error ?? `HTTP ${result.status}`}`);
       failed = true;
     }
   }
   if (failed) {
     console.error(`
-${color5.red("Some of it did not land.")} The import is an upsert, so fixing the cause and running it again is safe.
+${color7.red("Some of it did not land.")} The import is an upsert, so fixing the cause and running it again is safe.
 `);
     return 1;
   }
   console.log(`
-${color5.green("Imported.")} It is an upsert, so running it again costs one pass and changes nothing.
+${color7.green("Imported.")} It is an upsert, so running it again costs one pass and changes nothing.
 `);
   return 0;
 }
@@ -3249,4 +3648,4 @@ async function importHelp() {
   return 0;
 }
 
-export { renderAuthTs, allEnvKeys, renderEnvTs, renderEnvExample, renderEnvLocal, renderEnvProduction, envSummary, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, parseWhoAmI, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };
+export { renderAuthTs, allEnvKeys, renderEnvTs, renderEnvExample, renderEnvLocal, renderEnvProduction, envSummary, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, parseWhoAmI, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, plaintextSecretNames, secretsCommand, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };