@saastemly/voidcommerce 0.20.0 → 0.22.0

package/dist/deploy/teardown.d.ts

@@ -0,0 +1,62 @@
+import type { Project } from "../project";
+/**
+ * `vc teardown --cloudflare` — undo a deploy, so the whole thing can be
+ * proved again from nothing.
+ *
+ * ── Why this exists ──────────────────────────────────────────────────────
+ *
+ * "Push and it goes live" is a claim, and a claim nobody can re-run is a
+ * story. Provisioning is the part most likely to break — it is the only
+ * step that creates rather than replaces, it runs once per shop, and it runs
+ * against an account whose state nobody controls. Being able to destroy and
+ * do it again is what turns the claim into something testable.
+ *
+ * ── This DELETES A PRODUCTION DATABASE ───────────────────────────────────
+ *
+ * D1 deletion is not recoverable: there is no undo and no snapshot unless
+ * one was taken. Every order, customer and address in it goes. So this
+ * refuses by default, and the confirmation is TYPING THE SHOP'S DOMAIN —
+ * not `y`, because `y` is muscle memory and a domain is not.
+ *
+ * It also refuses outright when the manifest's domain does not match what
+ * the wrangler config points at, since that mismatch is the signal that you
+ * are standing in a different shop than you think.
+ *
+ * ── Idempotent, deliberately ─────────────────────────────────────────────
+ *
+ * Deleting what is already gone is success, not failure. That is what makes
+ * it usable in a loop: teardown, publish, teardown again, without a human
+ * reading each result to decide whether the next step is safe.
+ */
+export interface TeardownOptions {
+    /** Required. Without it this only ever prints what it would do. */
+    confirm: boolean;
+    /** Keep the D1 database — the one thing that holds data nobody can recreate. */
+    keepData: boolean;
+    dryRun: boolean;
+}
+interface WranglerConfig {
+    name?: string;
+    account_id?: string;
+    d1_databases?: Array<{
+        binding: string;
+        database_name: string;
+        database_id: string;
+    }>;
+    queues?: {
+        producers?: Array<{
+            queue: string;
+        }>;
+        consumers?: Array<{
+            queue: string;
+        }>;
+    };
+}
+/** What a teardown would destroy, read from the config rather than guessed. */
+export declare function teardownPlan(config: WranglerConfig, fallbackWorker: string): {
+    worker: string;
+    d1: string | null;
+    queues: string[];
+};
+export declare function teardownCloudflare(project: Project, opts: TeardownOptions): Promise<number>;
+export {};

package/dist/{index-07ppzmgt.js → index-2kqz80nx.js}

@@ -13,7 +13,7 @@ import {
   renderEnvTs,
   secretValue,
   unsetSecretNames
-} from "./index-vpcnasre.js";
+} from "./index-t1ggktg8.js";
 import {
   MANIFEST_FILE,
   has,
@@ -1383,7 +1383,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.20.0",
+  version: "0.22.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -3630,4 +3630,4 @@ async function importHelp() {
   return 0;
 }
 
-export { renderAuthTs, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderFrontendViteConfig, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, parseWhoAmI, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };
+export { renderAuthTs, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderFrontendViteConfig, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, wrangler, parseWhoAmI, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };

package/dist/{index-vpcnasre.js → index-t1ggktg8.js}

@@ -118,12 +118,14 @@ var BASE = [
   {
     key: "CLOUDFLARE_API_TOKEN",
     breaks: "nothing deploys: no worker, no database, no migrations",
-    where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token"
+    where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token",
+    deployOnly: true
   },
   {
     key: "CLOUDFLARE_ACCOUNT_ID",
     breaks: "wrangler cannot tell which account to deploy into, and refuses rather than guessing",
-    where: "the Cloudflare dashboard sidebar, or `vc secrets set` it after the first provision"
+    where: "the Cloudflare dashboard sidebar, or read from the token on first deploy",
+    deployOnly: true
   },
   {
     key: "SHOP_DOMAIN",
@@ -174,7 +176,7 @@ function allEnvKeys(manifest) {
 }
 var NUMERIC = new Set(["SHIPPING_DOMESTIC_MINOR", "SHIPPING_FREE_FROM_MINOR"]);
 function renderEnvTs(manifest) {
-  const keys = allEnvKeys(manifest);
+  const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
   const lines = keys.map((key) => {
     const helper = NUMERIC.has(key.key) ? "number()" : "string()";
     const doc = [`	/** ${key.breaks}${key.where ? ` — from: ${key.where}` : ""} */`];
@@ -203,7 +205,7 @@ ${lines.join(`
 `;
 }
 function renderEnvExample(manifest) {
-  const keys = allEnvKeys(manifest);
+  const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
   return [
     "# Every key is required. Copy to .env for local development.",
     "# `unset` is the one value that reads as absent — for a credential you do not have yet.",
@@ -215,7 +217,7 @@ function renderEnvExample(manifest) {
 }
 var MANIFEST_OWNED_ENV = new Set(["SHOP_DOMAIN", "SHOP_ZONE", "EMAIL_FROM", "GITHUB_PAGES_HOST"]);
 function renderEnvLocal(manifest) {
-  const keys = allEnvKeys(manifest);
+  const keys = allEnvKeys(manifest).filter((key) => !key.deployOnly);
   const local = {
     SHOP_DOMAIN: `${manifest.shop.domain.split(".")[0]}.test`,
     GITHUB_PAGES_HOST: manifest.shop.pagesHost ?? "",
@@ -370,7 +372,7 @@ async function decryptSecrets(project) {
   const root = project.root;
   if (!existsSync2(join2(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const { localPrivateKey } = await import("./keys-fbw9fdby.js");
+  const { localPrivateKey } = await import("./keys-1h4zpvd7.js");
   const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
   if (!privateKey) {
     return {
@@ -382,7 +384,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-fbw9fdby.js");
+    const { publicKeyFor } = await import("./keys-1h4zpvd7.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -402,8 +404,13 @@ async function decryptSecrets(project) {
   if (result.code !== 0)
     return { error: `dotenvx could not decrypt ${SECRETS_FILE}: ${result.out.trim().split(`
 `).slice(-2).join(" ")}` };
+  const deployOnly = new Set(allEnvKeys(project.manifest).filter((key) => key.deployOnly).map((key) => key.key));
   const lines = result.out.split(`
-`).filter((line) => /^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) && !line.trimStart().startsWith("DOTENV_"));
+`).filter((line) => {
+    if (!/^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) || line.trimStart().startsWith("DOTENV_"))
+      return false;
+    return !deployOnly.has(line.slice(0, line.indexOf("=")).trim());
+  });
   const names = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
   const path = join2(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
   writeFileSync(path, `${lines.join(`
@@ -431,6 +438,8 @@ async function secretsCommand(project, args) {
     return setSecretValue(project, args.slice(1));
   if (args.includes("--sync"))
     return syncSecrets(project, args.includes("--prune"));
+  if (args.includes("--adopt"))
+    return adoptSecrets(project, args.includes("--confirm"));
   if (!existsSync2(join2(root, SECRETS_FILE))) {
     console.log(`
 ${color.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,
@@ -714,6 +723,75 @@ ${color.green("✓")} every secret this shop needs is already declared.
   }
   return 0;
 }
+async function adoptSecrets(project, confirmed) {
+  const root = project.root;
+  const path = join2(root, SECRETS_FILE);
+  if (!existsSync2(path)) {
+    console.error(`
+vc: no ${SECRETS_FILE} here — \`vc secrets --init\` starts a fresh one.
+`);
+    return 1;
+  }
+  const { localPrivateKey, publicKeyFor, generateKeypair } = await import("./keys-1h4zpvd7.js");
+  const current = committedPublicKey(root);
+  const mine = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root);
+  if (mine && current && (await publicKeyFor(mine))?.toLowerCase() === current.toLowerCase()) {
+    console.error(`
+vc: you already hold the key to this shop, so this is not a fork.
+  Adopting would replace the key and blank every value you can currently read.
+  If that is really what you want, remove the key first.
+`);
+    return 1;
+  }
+  const declared = [...declaredSecretNames(root)];
+  if (!confirmed) {
+    console.log(`
+${color.bold("Adopting this shop would:")}
+
+` + `  · make a NEW encryption key, replacing the one in ${SECRETS_FILE}
+` + `  · reset ${declared.length} value${declared.length === 1 ? "" : "s"} to \`unset\`
+
+` + `  The current values cannot be read here anyway — they belong to whoever
+` + `  set them. This makes that explicit rather than leaving their ciphertext
+  sitting in a shop you now own.
+
+  ${color.cyan("vc secrets --adopt --confirm")}
+`);
+    return 1;
+  }
+  const pair = await generateKeypair();
+  if (!pair) {
+    console.error("vc: @dotenvx/dotenvx is not installed here.");
+    return 1;
+  }
+  const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+  const body = readFileSync(path, "utf8").split(`
+`).map((line) => {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(line);
+    if (!match)
+      return line;
+    if (match[1] === "DOTENV_PUBLIC_KEY_SECRETS")
+      return `DOTENV_PUBLIC_KEY_SECRETS="${pair.publicKey}"`;
+    return `${match[1]}=unset`;
+  }).join(`
+`);
+  writeFileSync(path, body);
+  writeFileSync(join2(root, ".env.keys"), `${PRIVATE_KEY_VAR}="${pair.privateKey}"
+`, { mode: 384 });
+  console.log(`
+${color.green("✓")} adopted: a new key, and ${declared.length} value${declared.length === 1 ? "" : "s"} reset to \`unset\`
+${color.green("+")} .env.keys holds the new private key — gitignored, and yours
+
+` + `Now set what this shop needs:
+${required.slice(0, 4).map((key) => `  ${color.cyan(`vc secrets set ${key.key}`)}`).join(`
+`)}
+` + (required.length > 4 ? `  ${color.dim(`…and ${required.length - 4} more — \`vc secrets\` lists them`)}
+` : "") + color.yellow(`
+! The previous owner's ciphertext is still in git history. It is unreadable
+  without their key, but a fresh repository is cleaner than a fork.
+`));
+  return 0;
+}
 
 // src/deploy/keys.ts
 var LOCAL_KEY_FILE = ".env.keys";

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-07ppzmgt.js";
+} from "./index-2kqz80nx.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-vpcnasre.js";
+} from "./index-t1ggktg8.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/dist/{keys-fbw9fdby.js → keys-1h4zpvd7.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-vpcnasre.js";
+} from "./index-t1ggktg8.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/catalog.ts

@@ -25,6 +25,19 @@ export interface EnvKey {
 	dev?: string | undefined;
 	/** Where the real value comes from. */
 	where?: string | undefined;
+	/**
+	 * Needed to DEPLOY the shop, not to run it.
+	 *
+	 * The Cloudflare credentials are the case. They belong in `.env.secrets`
+	 * so a push carries them, and preflight must insist on them — but the
+	 * worker has no business seeing one. Left unmarked they ended up in three
+	 * wrong places at once: `env.ts`, so the worker refused to boot without a
+	 * deploy token; `.env`, where wrangler read `CLOUDFLARE_ACCOUNT_ID=unset`
+	 * and addressed `accounts/unset/...`; and `--secrets-file`, which would
+	 * have uploaded the deploy credential INTO the worker for any code
+	 * running there to read.
+	 */
+	deployOnly?: boolean | undefined;
 }
 
 export interface Choice {

package/src/cli.ts

@@ -8,6 +8,8 @@ import {
 	preflightHelp,
 	secretsCliCommand,
 	secretsHelp,
+	teardownCliCommand,
+	teardownHelp,
 } from "./deploy/index";
 import { distCommand, distHelp } from "./dist";
 import { importCommand, importHelp } from "./import";
@@ -50,6 +52,7 @@ export const EXTENDED: Record<string, Extended> = {
 	preflight: { run: preflightCommand, help: preflightHelp },
 	secrets: { run: secretsCliCommand, help: secretsHelp },
 	keys: { run: keysCliCommand, help: keysHelp },
+	teardown: { run: teardownCliCommand, help: teardownHelp },
 	// Called by the generated pre-commit hook; exit code is the interface.
 	guard: { run: guardCommand, help: async () => guardCommand() },
 	dev: { run: appScript("dev"), help: appScriptHelp("dev") },

package/src/deploy/index.ts

@@ -8,6 +8,7 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { PRIVATE_KEY_VAR, SECRETS_FILE, encryptInto, plaintextSecretEntries, plaintextSecretNames, run, secretsCommand } from "./secrets";
 import { LOCAL_KEY_FILE, committedPublicKey, ignoresKeyFile, keysCommand } from "./keys";
+import { teardownCloudflare } from "./teardown";
 
 /**
  * `vc deploy` extends `void deploy`: vc's preflight first, then void's
@@ -310,3 +311,66 @@ export async function guardCommand(): Promise<number> {
 
 
 
+
+
+/**
+ * `vc teardown` — destroy this shop's Cloudflare infrastructure.
+ *
+ * The confirmation is the shop's DOMAIN, not `y`. A `y` is muscle memory;
+ * typing `devprints.saastemly.com` is not, and this deletes a database that
+ * has no undo.
+ */
+export async function teardownCliCommand(args: string[]): Promise<number> {
+	const project = await findProject();
+	if (!project) {
+		console.error("vc: no voidcommerce.json here.");
+		return 1;
+	}
+	if (!args.includes("--cloudflare")) {
+		console.error("vc: teardown only knows how to undo a Cloudflare deploy. `vc teardown --cloudflare`.");
+		return 1;
+	}
+	const typed = args[args.indexOf("--confirm") + 1];
+	const confirmed = args.includes("--confirm") && typed === project.manifest.shop.domain;
+	if (args.includes("--confirm") && !confirmed) {
+		console.error(
+			`\nvc: --confirm needs this shop's domain, exactly:\n\n` +
+				`    vc teardown --cloudflare --confirm ${project.manifest.shop.domain}\n\n` +
+				`  You typed ${typed ? `"${typed}"` : "nothing"}. Naming the shop is the check — it is\n` +
+				"  what stops this running in the wrong directory.\n",
+		);
+		return 1;
+	}
+	return teardownCloudflare(project, {
+		confirm: confirmed,
+		keepData: args.includes("--keep-data"),
+		dryRun: args.includes("--dry-run"),
+	});
+}
+
+export async function teardownHelp(): Promise<number> {
+	const width = 80;
+	console.log(
+		box("vc teardown", [
+			line("Destroy this shop's Cloudflare infrastructure, so the whole", width),
+			line("publish-to-live flow can be proved again from nothing.", width),
+			line("", width),
+			...row("vc teardown --cloudflare --dry-run", "list what would be destroyed, touch nothing", width, 2),
+			...row("vc teardown --cloudflare --confirm <domain>", "do it", width, 2),
+			...row("--keep-data", "leave the D1 database alone", width, 2),
+			line("", width),
+			line(color.bold("Read this first"), width),
+			line("D1 deletion has NO UNDO. Every order, customer and address in the", width),
+			line("database goes with it, and there is no snapshot unless you took one.", width),
+			line("", width),
+			line("So --confirm takes the shop's DOMAIN, not `y`: a `y` is muscle memory,", width),
+			line("and typing the domain is what stops this running in the wrong shop.", width),
+			line("", width),
+			line("It is idempotent — deleting what is already gone is success — and it", width),
+			line("clears the recorded database id, because `wrangler deploy` FAILS on a", width),
+			line("dangling id rather than making a new database. Secrets are untouched:", width),
+			line("this removes infrastructure, not configuration.", width),
+		], width),
+	);
+	return 0;
+}

package/src/deploy/secrets.ts

@@ -242,11 +242,21 @@ export async function decryptSecrets(project: Project): Promise<DecryptedSecrets
 	});
 	if (result.code !== 0) return { error: `dotenvx could not decrypt ${SECRETS_FILE}: ${result.out.trim().split("\n").slice(-2).join(" ")}` };
 
-	// Keep only the shop's own keys: dotenvx echoes the public key back, and
-	// it has no business being a worker secret.
-	const lines = result.out
-		.split("\n")
-		.filter((line) => /^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) && !line.trimStart().startsWith("DOTENV_"));
+	/**
+	 * Keep only the secrets the WORKER needs.
+	 *
+	 * dotenvx echoes its own public key back, which has no business being a
+	 * worker secret. And the deploy-only keys are the important exclusion:
+	 * `--secrets-file` uploads what it is given, so leaving CLOUDFLARE_API_TOKEN
+	 * in here would put the credential that can deploy, delete and re-create
+	 * this shop INSIDE the shop, readable by any code running in the worker.
+	 * A compromised dependency would have found it there.
+	 */
+	const deployOnly = new Set(allEnvKeys(project.manifest).filter((key) => key.deployOnly).map((key) => key.key));
+	const lines = result.out.split("\n").filter((line) => {
+		if (!/^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) || line.trimStart().startsWith("DOTENV_")) return false;
+		return !deployOnly.has(line.slice(0, line.indexOf("=")).trim());
+	});
 	const names = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
 
 	const path = join(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
@@ -277,6 +287,7 @@ export async function secretsCommand(project: Project, args: string[]): Promise<
 	if (args.includes("--init")) return initSecrets(project);
 	if (args[0] === "set") return setSecretValue(project, args.slice(1));
 	if (args.includes("--sync")) return syncSecrets(project, args.includes("--prune"));
+	if (args.includes("--adopt")) return adoptSecrets(project, args.includes("--confirm"));
 
 	if (!existsSync(join(root, SECRETS_FILE))) {
 		console.log(
@@ -598,3 +609,84 @@ async function syncSecrets(project: Project, prune: boolean): Promise<number> {
 	}
 	return 0;
 }
+
+
+/**
+ * `vc secrets --adopt` — take this shop over as a different person.
+ *
+ * The fork case. Somebody clones a shop, and every value in `.env.secrets`
+ * belongs to whoever set it: their Stripe key, their Cloudflare token, their
+ * home address. They cannot read any of it — the private key is not theirs —
+ * but the ciphertext is right there, and the shop would deploy into somebody
+ * else's account if the key ever leaked.
+ *
+ * So this cuts the connection: a NEW keypair, every value back to `unset`,
+ * and the old public key replaced. What was encrypted to the old key stays
+ * in git history and is now unreadable by anyone here, which is the point —
+ * the new owner starts with a shop that has their secrets or none.
+ *
+ * It refuses when the current key IS readable here, because then this is not
+ * a fork, it is somebody about to destroy their own values by accident.
+ */
+async function adoptSecrets(project: Project, confirmed: boolean): Promise<number> {
+	const root = project.root;
+	const path = join(root, SECRETS_FILE);
+	if (!existsSync(path)) {
+		console.error(`\nvc: no ${SECRETS_FILE} here — \`vc secrets --init\` starts a fresh one.\n`);
+		return 1;
+	}
+
+	const { localPrivateKey, publicKeyFor, generateKeypair } = await import("./keys");
+	const current = committedPublicKey(root);
+	const mine = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root);
+	if (mine && current && (await publicKeyFor(mine))?.toLowerCase() === current.toLowerCase()) {
+		console.error(
+			`\nvc: you already hold the key to this shop, so this is not a fork.\n` +
+				`  Adopting would replace the key and blank every value you can currently read.\n` +
+				`  If that is really what you want, remove the key first.\n`,
+		);
+		return 1;
+	}
+
+	const declared = [...declaredSecretNames(root)];
+	if (!confirmed) {
+		console.log(
+			`\n${color.bold("Adopting this shop would:")}\n\n` +
+				`  · make a NEW encryption key, replacing the one in ${SECRETS_FILE}\n` +
+				`  · reset ${declared.length} value${declared.length === 1 ? "" : "s"} to \`unset\`\n\n` +
+				`  The current values cannot be read here anyway — they belong to whoever\n` +
+				`  set them. This makes that explicit rather than leaving their ciphertext\n` +
+				`  sitting in a shop you now own.\n\n` +
+				`  ${color.cyan("vc secrets --adopt --confirm")}\n`,
+		);
+		return 1;
+	}
+
+	const pair = await generateKeypair();
+	if (!pair) {
+		console.error("vc: @dotenvx/dotenvx is not installed here.");
+		return 1;
+	}
+	const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+	const body = readFileSync(path, "utf8")
+		.split("\n")
+		.map((line) => {
+			const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(line);
+			if (!match) return line;
+			if (match[1] === "DOTENV_PUBLIC_KEY_SECRETS") return `DOTENV_PUBLIC_KEY_SECRETS="${pair.publicKey}"`;
+			return `${match[1]}=unset`;
+		})
+		.join("\n");
+	writeFileSync(path, body);
+	writeFileSync(join(root, ".env.keys"), `${PRIVATE_KEY_VAR}="${pair.privateKey}"\n`, { mode: 0o600 });
+
+	console.log(
+		`\n${color.green("✓")} adopted: a new key, and ${declared.length} value${declared.length === 1 ? "" : "s"} reset to \`unset\`\n` +
+			`${color.green("+")} .env.keys holds the new private key — gitignored, and yours\n\n` +
+			`Now set what this shop needs:\n` +
+			`${required.slice(0, 4).map((key) => `  ${color.cyan(`vc secrets set ${key.key}`)}`).join("\n")}\n` +
+			(required.length > 4 ? `  ${color.dim(`…and ${required.length - 4} more — \`vc secrets\` lists them`)}\n` : "") +
+			color.yellow(`\n! The previous owner's ciphertext is still in git history. It is unreadable\n  without their key, but a fresh repository is cleaner than a fork.\n`),
+	);
+	return 0;
+}