@saastemly/voidcommerce 0.3.0 → 0.4.0

package/dist/{index-84wq4qp8.js → index-yzezvy5h.js}

@@ -11,11 +11,14 @@ import {
   workerHosts,
   writeManifest,
   zone
-} from "./index-zh3tmj08.js";
+} from "./index-pz6m2hkm.js";
 import {
-  CHOICES,
-  __require
-} from "./index-z4qazajn.js";
+  CHOICES
+} from "./index-844b3qn9.js";
+import {
+  __require,
+  __toESM
+} from "./index-0v6na3yp.js";
 
 // src/generate/auth.ts
 var VAT = {
@@ -841,6 +844,7 @@ function strictDependencies(manifest) {
   for (const name of [
     "@hono/node-server",
     "@dotenvx/dotenvx",
+    "husky",
     "@rolldown/plugin-babel",
     "@tailwindcss/vite",
     "@types/node",
@@ -1437,7 +1441,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.3.0",
+  version: "0.4.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1471,6 +1475,7 @@ var package_default = {
   },
   dependencies: {
     "@clack/prompts": "^0.11.0",
+    "@dotenvx/primitives": "^2.2.0",
     picocolors: "^1.1.1"
   },
   devDependencies: {
@@ -2478,6 +2483,8 @@ async function generateStrictRoot(root, manifest, result) {
     scripts["deploy"] ??= "vc deploy";
     scripts["import:catalog"] ??= "vc import";
     scripts["maildev"] ??= "maildev --smtp 1025 --web 1080";
+    scripts["secrets"] ??= "vc secrets";
+    scripts["prepare"] ??= "husky";
     pkg["scripts"] = scripts;
   }, result);
   await put(root, ".gitignore", `node_modules
@@ -2492,6 +2499,12 @@ dist
 .DS_Store
 `, result, "own");
   await put(root, "patches/void@0.10.13.patch", renderVoidPatch(), result, "regenerate");
+  await put(root, ".husky/pre-commit", `#!/usr/bin/env sh
+# Generated by \`vc init\`. Refuses a commit that would put a secret in the
+# clear in .env.secrets — which cannot be undone by a later commit,
+# because the value stays in the history.
+bunx vc guard
+`, result, "regenerate");
   await put(root, ".github/workflows/void-dist.yml", renderDistWorkflow(manifest), result, "regenerate");
   await put(root, "DEPLOY.md", renderDeployReadme(manifest, zone(manifest), workerHosts(manifest)), result, "regenerate");
   await put(root, ".env", renderEnvLocal(manifest), result, "own");
@@ -2856,30 +2869,167 @@ ${ran.out.trim()}`);
 }
 
 // src/deploy/preflight.ts
-import { existsSync as existsSync8, readFileSync as readFileSync3 } from "node:fs";
-import { join as join8 } from "node:path";
-import color4 from "picocolors";
+import { existsSync as existsSync9, readFileSync as readFileSync4 } from "node:fs";
+import { join as join9 } from "node:path";
+import color5 from "picocolors";
 
 // src/deploy/secrets.ts
-import { existsSync as existsSync7, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync3, writeFileSync } from "node:fs";
 import { spawn as spawn3 } from "node:child_process";
-import { delimiter as delimiter3, dirname as dirname5, join as join7 } from "node:path";
+import { delimiter as delimiter3, dirname as dirname5, join as join8 } from "node:path";
 import { tmpdir } from "node:os";
+import color4 from "picocolors";
+
+// src/deploy/keys.ts
+import { hkdfSync } from "node:crypto";
+import { existsSync as existsSync7, readFileSync as readFileSync2 } from "node:fs";
+import { join as join7 } from "node:path";
 import color3 from "picocolors";
+var INFO = "voidcommerce/dotenvx/secrets/v1";
+function apiToken() {
+  return process.env["CLOUDFLARE_API_TOKEN"] || process.env["CF_API_TOKEN"] || null;
+}
+function derivePrivateKey(token, accountId) {
+  const bytes = hkdfSync("sha256", Buffer.from(token, "utf8"), Buffer.from(accountId, "utf8"), Buffer.from(INFO), 32);
+  return Buffer.from(bytes).toString("hex");
+}
+async function publicKeyFor(privateKey) {
+  try {
+    const { derive } = await import("./index-mpr7gm6k.js").then((m)=>__toESM(m.default,1));
+    return derive(privateKey);
+  } catch {
+    return null;
+  }
+}
+function committedPublicKey(root) {
+  const path = join7(root, SECRETS_FILE);
+  if (!existsSync7(path))
+    return null;
+  const match = /^\s*DOTENV_PUBLIC_KEY_SECRETS\s*=\s*["']?([0-9a-fA-F]+)["']?/m.exec(readFileSync2(path, "utf8"));
+  return match?.[1] ?? null;
+}
+async function keyFor(manifest, root) {
+  const token = apiToken();
+  if (!token) {
+    return {
+      ok: false,
+      reason: `CLOUDFLARE_API_TOKEN is not set.
+  The key is derived from it, so there is nothing to derive from. Note that
+` + "  `wrangler login` does NOT set one — this scheme needs an API token, from\n" + "  My Profile → API Tokens."
+    };
+  }
+  const accountId = manifest.cloudflare?.accountId || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
+  if (!accountId) {
+    return {
+      ok: false,
+      reason: "the account is not pinned, and it salts the derivation.\n  Run `vc deploy --cloudflare --provision` once, or set CLOUDFLARE_ACCOUNT_ID."
+    };
+  }
+  const privateKey = derivePrivateKey(token, accountId);
+  const publicKey = await publicKeyFor(privateKey);
+  if (!publicKey) {
+    return { ok: false, reason: "@dotenvx/dotenvx is not installed here, so a key cannot be derived. `bun add -d @dotenvx/dotenvx`" };
+  }
+  const committed = committedPublicKey(root);
+  if (!committed)
+    return { ok: true, privateKey, publicKey, fresh: true };
+  if (committed.toLowerCase() !== publicKey.toLowerCase()) {
+    return {
+      ok: false,
+      reason: `this token does not derive the key ${SECRETS_FILE} was encrypted under.
+
+  encrypted under:  ${committed.slice(0, 16)}…
+` + `  this token gives: ${publicKey.slice(0, 16)}…
+
+` + `  That is one of three things, and all of them are the same fix:
+` + `    · the token was rotated since the secrets were encrypted
+` + `    · this is a different admin's token
+` + `    · CLOUDFLARE_ACCOUNT_ID is not the account they were encrypted for
+
+` + `  If you still have the ORIGINAL token, \`vc keys rotate\` re-encrypts
+  everything under the new one. If you do not, the values are unrecoverable
+  and must be entered again.`
+    };
+  }
+  return { ok: true, privateKey, publicKey, fresh: false };
+}
+async function keysCommand(manifest, root, args) {
+  if (args.includes("--rotate"))
+    return rotate(manifest, root);
+  const state = await keyFor(manifest, root);
+  console.log(`
+The key is DERIVED from CLOUDFLARE_API_TOKEN, salted with the account id.`);
+  console.log(color3.dim(`Nothing is stored, so nothing can leak — and nothing can be recovered.
+`));
+  if (!state.ok) {
+    console.error(`${color3.red("✗")} ${state.reason}
+`);
+    return 1;
+  }
+  console.log(`  derives public key  ${state.publicKey.slice(0, 20)}…`);
+  console.log(state.fresh ? `  ${color3.dim(`${SECRETS_FILE} does not exist yet, so there is nothing to check against`)}` : `  ${color3.green("✓")} matches what ${SECRETS_FILE} was encrypted under`);
+  console.log(color3.yellow(`
+! Rotating this API token makes every secret in ${SECRETS_FILE} unreadable.
+  Run \`vc keys --rotate\` with the NEW token exported and the old one in
+  CLOUDFLARE_API_TOKEN_OLD, BEFORE the old one stops working.
+`));
+  return 0;
+}
+async function rotate(manifest, root) {
+  const oldToken = process.env["CLOUDFLARE_API_TOKEN_OLD"];
+  const newToken = apiToken();
+  if (!oldToken || !newToken) {
+    console.error(`
+vc: rotation needs BOTH tokens:
+  CLOUDFLARE_API_TOKEN_OLD=<the one the secrets were encrypted under>
+  CLOUDFLARE_API_TOKEN=<the new one>
+
+  The old one is the only thing that can read the current values.
+`);
+    return 1;
+  }
+  const accountId = manifest.cloudflare?.accountId || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
+  if (!accountId) {
+    console.error("vc: the account is not pinned, and it salts the derivation.");
+    return 1;
+  }
+  const oldKey = derivePrivateKey(oldToken, accountId);
+  const oldPublic = await publicKeyFor(oldKey);
+  const committed = committedPublicKey(root);
+  if (committed && oldPublic && committed.toLowerCase() !== oldPublic.toLowerCase()) {
+    console.error(`
+vc: CLOUDFLARE_API_TOKEN_OLD does not derive the key ${SECRETS_FILE} was encrypted under either.
+`);
+    return 1;
+  }
+  console.log(`
+Rotation is a decrypt with the old key and an encrypt with the new one.
+Run these two, in this order, from ${root}:
+
+  ${color3.cyan(`DOTENV_PRIVATE_KEY_SECRETS=<old> bunx dotenvx decrypt -f ${SECRETS_FILE}`)}
+  ${color3.cyan(`bunx dotenvx encrypt -f ${SECRETS_FILE}`)}   ${color3.dim("# under the new derived key")}
+
+` + color3.dim(`vc does not run them for you: the middle state is your secrets in
+plaintext on disk, and that is a moment to be deliberate about.
+`));
+  return 0;
+}
+
+// src/deploy/secrets.ts
 var SECRETS_FILE = ".env.secrets";
 var PRIVATE_KEY_VAR = "DOTENV_PRIVATE_KEY_SECRETS";
 function findDotenvx(from) {
   let dir = from;
   for (;; ) {
-    const local = join7(dir, "node_modules", ".bin", "dotenvx");
-    if (existsSync7(local))
+    const local = join8(dir, "node_modules", ".bin", "dotenvx");
+    if (existsSync8(local))
       return local;
     const parent = dirname5(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  return (process.env["PATH"] ?? "").split(delimiter3).filter(Boolean).some((entry) => existsSync7(join7(entry, "dotenvx"))) ? "dotenvx" : null;
+  return (process.env["PATH"] ?? "").split(delimiter3).filter(Boolean).some((entry) => existsSync8(join8(entry, "dotenvx"))) ? "dotenvx" : null;
 }
 function run(cmd, args, cwd, env = {}) {
   return new Promise((resolve) => {
@@ -2896,11 +3046,11 @@ function run(cmd, args, cwd, env = {}) {
   });
 }
 function declaredSecretNames(root) {
-  const path = join7(root, SECRETS_FILE);
-  if (!existsSync7(path))
+  const path = join8(root, SECRETS_FILE);
+  if (!existsSync8(path))
     return new Set;
   const names = new Set;
-  for (const line2 of readFileSync2(path, "utf8").split(`
+  for (const line2 of readFileSync3(path, "utf8").split(`
 `)) {
     const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(line2);
     if (match && !match[1].startsWith("DOTENV_"))
@@ -2909,11 +3059,11 @@ function declaredSecretNames(root) {
   return names;
 }
 function plaintextSecretNames(root) {
-  const path = join7(root, SECRETS_FILE);
-  if (!existsSync7(path))
+  const path = join8(root, SECRETS_FILE);
+  if (!existsSync8(path))
     return [];
   const bare = [];
-  for (const line2 of readFileSync2(path, "utf8").split(`
+  for (const line2 of readFileSync3(path, "utf8").split(`
 `)) {
     const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line2);
     if (!match || match[1].startsWith("DOTENV_"))
@@ -2926,25 +3076,24 @@ function plaintextSecretNames(root) {
 }
 async function decryptSecrets(project) {
   const root = project.root;
-  if (!existsSync7(join7(root, SECRETS_FILE)))
+  if (!existsSync8(join8(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
   const dotenvx = findDotenvx(root);
   if (!dotenvx)
     return { error: "dotenvx is not installed. `bun add -d @dotenvx/dotenvx`" };
-  if (!process.env[PRIVATE_KEY_VAR] && !existsSync7(join7(root, ".env.keys"))) {
-    return {
-      error: `${PRIVATE_KEY_VAR} is not set and there is no .env.keys here.
-  It is the one value that stays out of the repository; set it where the deploy runs.`
-    };
-  }
-  const result = await run(dotenvx, ["decrypt", "-f", SECRETS_FILE, "--stdout"], root);
+  const key = await keyFor(project.manifest, root);
+  if (!key.ok)
+    return { error: key.reason };
+  const result = await run(dotenvx, ["decrypt", "-f", SECRETS_FILE, "--stdout"], root, {
+    [PRIVATE_KEY_VAR]: key.privateKey
+  });
   if (result.code !== 0)
     return { error: `dotenvx could not decrypt ${SECRETS_FILE}: ${result.out.trim().split(`
 `).slice(-2).join(" ")}` };
   const lines = result.out.split(`
 `).filter((line2) => /^\s*[A-Z][A-Z0-9_]*\s*=/.test(line2) && !line2.trimStart().startsWith("DOTENV_"));
   const names = lines.map((line2) => line2.slice(0, line2.indexOf("=")).trim());
-  const path = join7(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
+  const path = join8(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
   writeFileSync(path, `${lines.join(`
 `)}
 `, { mode: 384 });
@@ -2966,9 +3115,9 @@ async function secretsCommand(project, args) {
   const bare = plaintextSecretNames(root);
   if (args.includes("--init"))
     return initSecrets(project);
-  if (!existsSync7(join7(root, SECRETS_FILE))) {
+  if (!existsSync8(join8(root, SECRETS_FILE))) {
     console.log(`
-${color3.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,
+${color4.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,
 ` + `which means the shop cannot be rebuilt from a checkout.
 
 ` + `  vc secrets --init    write one, with every required key as \`unset\`
@@ -2979,15 +3128,15 @@ ${color3.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`
 ${SECRETS_FILE} — committed, encrypted, and read by \`vc deploy --cloudflare\`
 `);
   for (const key of required) {
-    const state = declared.has(key.key) ? color3.green("declared") : color3.red("MISSING ");
+    const state = declared.has(key.key) ? color4.green("declared") : color4.red("MISSING ");
     console.log(`  ${state}  ${key.key}`);
   }
   const extra = [...declared].filter((name) => !required.some((key) => key.key === name));
   for (const name of extra)
-    console.log(`  ${color3.dim("extra   ")}  ${name} ${color3.dim("— not required by this shop")}`);
+    console.log(`  ${color4.dim("extra   ")}  ${name} ${color4.dim("— not required by this shop")}`);
   if (bare.length > 0) {
     console.log(`
-${color3.red("✗")} ${bare.length} value${bare.length === 1 ? " is" : "s are"} committed IN THE CLEAR: ${bare.join(", ")}
+${color4.red("✗")} ${bare.length} value${bare.length === 1 ? " is" : "s are"} committed IN THE CLEAR: ${bare.join(", ")}
 ` + `  Run \`dotenvx encrypt -f ${SECRETS_FILE}\` before committing again.
 `);
     return 1;
@@ -2995,23 +3144,30 @@ ${color3.red("✗")} ${bare.length} value${bare.length === 1 ? " is" : "s are"}
   const missing = required.filter((key) => !declared.has(key.key));
   if (missing.length > 0) {
     console.log(`
-${color3.red("✗")} ${missing.length} required secret${missing.length === 1 ? "" : "s"} not declared.
+${color4.red("✗")} ${missing.length} required secret${missing.length === 1 ? "" : "s"} not declared.
 ` + `  dotenvx set ${missing[0].key} '…' -f ${SECRETS_FILE}
 `);
     return 1;
   }
   console.log(`
-${color3.green("✓")} every secret this shop needs is declared and encrypted.
+${color4.green("✓")} every secret this shop needs is declared and encrypted.
 `);
   return 0;
 }
 async function initSecrets(project) {
-  const path = join7(project.root, SECRETS_FILE);
-  if (existsSync7(path)) {
+  const path = join8(project.root, SECRETS_FILE);
+  if (existsSync8(path)) {
     console.error(`vc: ${SECRETS_FILE} already exists; not overwriting it.`);
     return 1;
   }
-  const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+  const key = await keyFor(project.manifest, project.root);
+  if (!key.ok) {
+    console.error(`
+vc: ${key.reason}
+`);
+    return 1;
+  }
+  const required = allEnvKeys(project.manifest).filter((key2) => !key2.plaintext);
   const body = [
     "# Secrets, encrypted, and COMMITTED.",
     "#",
@@ -3019,22 +3175,29 @@ async function initSecrets(project) {
     "# secret changed without showing what it changed to. `unset` is the",
     "# documented placeholder and preflight refuses it.",
     "#",
-    "# The private key stays out of the repository. It lives in .env.keys",
-    "# locally (gitignored) and as one build variable where the deploy runs.",
+    "# The private key is DERIVED from CLOUDFLARE_API_TOKEN, salted with the",
+    "# account id — it is stored nowhere, so there is no .env.keys to leak.",
+    "#",
+    "# The cost of that: rotating the token makes every value below",
+    "# permanently unreadable. `vc keys --rotate` re-encrypts while you still",
+    "# have the old token; after that there is no recovery.",
     "",
-    ...required.flatMap((key) => [`# ${key.breaks}${key.where ? ` — from: ${key.where}` : ""}`, `${key.key}=unset`, ""])
+    `DOTENV_PUBLIC_KEY_SECRETS="${key.publicKey}"`,
+    "",
+    ...required.flatMap((key2) => [`# ${key2.breaks}${key2.where ? ` — from: ${key2.where}` : ""}`, `${key2.key}=unset`, ""])
   ].join(`
 `);
   writeFileSync(path, body, { mode: 384 });
   console.log(`
-${color3.green("+")} ${SECRETS_FILE} — ${required.length} keys, all \`unset\`
+${color4.green("+")} ${SECRETS_FILE} — ${required.length} keys, all \`unset\`, under the key this token derives
 
 ` + `Next:
 ` + `  1. put the real values in, then
-` + `  2. ${color3.cyan(`dotenvx encrypt -f ${SECRETS_FILE}`)}
-` + `  3. commit ${SECRETS_FILE}; never commit .env.keys
-` + `  4. set ${PRIVATE_KEY_VAR} where the deploy runs
-`);
+` + `  2. ${color4.cyan(`bunx dotenvx encrypt -f ${SECRETS_FILE}`)}
+` + `  3. commit it — there is no key file to keep out
+
+` + color4.yellow(`! Rotating CLOUDFLARE_API_TOKEN makes these unreadable. \`vc keys\` explains.
+`));
   return 0;
 }
 
@@ -3042,10 +3205,10 @@ ${color3.green("+")} ${SECRETS_FILE} — ${required.length} keys, all \`unset\`
 var UNSET = "unset";
 function productionEnv(appDir) {
   const out = new Map;
-  const path = join8(appDir, ".env.production");
-  if (!existsSync8(path))
+  const path = join9(appDir, ".env.production");
+  if (!existsSync9(path))
     return out;
-  for (const line2 of readFileSync3(path, "utf8").split(`
+  for (const line2 of readFileSync4(path, "utf8").split(`
 `)) {
     const match = /^\s*([A-Z0-9_]+)\s*=\s*(.*)$/.exec(line2);
     if (!match)
@@ -3070,12 +3233,12 @@ async function voidSecretNames(appDir) {
   return names;
 }
 function routeProblem(project) {
-  const path = join8(project.appDir, "wrangler.jsonc");
-  if (!existsSync8(path))
+  const path = join9(project.appDir, "wrangler.jsonc");
+  if (!existsSync9(path))
     return "wrangler.jsonc is missing";
   let routes = [];
   try {
-    routes = parseJsonc(readFileSync3(path, "utf8")).routes ?? [];
+    routes = parseJsonc(readFileSync4(path, "utf8")).routes ?? [];
   } catch {
     return "wrangler.jsonc cannot be parsed";
   }
@@ -3115,7 +3278,7 @@ async function preflight(project, source) {
 function printPreflight(project, result, source) {
   const keys = allEnvKeys(project.manifest);
   if (result.remote === null) {
-    console.log(color4.dim(source === "wrangler" ? `Could not read the worker's secrets — not deployed yet, or wrangler is not logged in.
+    console.log(color5.dim(source === "wrangler" ? `Could not read the worker's secrets — not deployed yet, or wrangler is not logged in.
 Anything not in .env.production is reported as missing.
 ` : `Could not read the project's secrets from Void — not logged in, or no linked project.
 Anything not in .env.production is reported as missing.
@@ -3125,37 +3288,37 @@ Anything not in .env.production is reported as missing.
   for (const key of keys) {
     const value = result.present.get(key.key);
     const set = value !== undefined && value !== "" && value !== UNSET;
-    console.log(`  ${set ? color4.green("set  ") : color4.dim("unset")}  ${key.key}${key.plaintext ? color4.dim("  (plaintext)") : ""}`);
+    console.log(`  ${set ? color5.green("set  ") : color5.dim("unset")}  ${key.key}${key.plaintext ? color5.dim("  (plaintext)") : ""}`);
   }
   if (result.ready) {
     console.log(`
-${color4.green("Ready to go live.")}
+${color5.green("Ready to go live.")}
 `);
     return;
   }
   console.log(`
-${color4.red("NOT ready to go live.")}
+${color5.red("NOT ready to go live.")}
 `);
   if (result.routeProblem) {
-    console.log(`${color4.red("✗")} the worker's hostname
+    console.log(`${color5.red("✗")} the worker's hostname
     ${result.routeProblem}
 `);
   }
   if (result.bareSecrets.length > 0) {
-    console.log(`${color4.red("✗")} committed in the clear in ${SECRETS_FILE}: ${result.bareSecrets.join(", ")}
+    console.log(`${color5.red("✗")} committed in the clear in ${SECRETS_FILE}: ${result.bareSecrets.join(", ")}
 ` + `    Run \`dotenvx encrypt -f ${SECRETS_FILE}\` — and treat those values as burned.
 `);
   }
   for (const key of result.missing) {
-    console.log(`${color4.red("✗")} ${key.key}`);
+    console.log(`${color5.red("✗")} ${key.key}`);
     console.log(`    ${key.breaks}`);
     if (key.where)
-      console.log(`    ${color4.dim(`from: ${key.where}`)}`);
+      console.log(`    ${color5.dim(`from: ${key.where}`)}`);
     console.log("");
   }
   const secrets = result.missing.filter((key) => !key.plaintext);
   if (secrets.length > 0) {
-    const inRepo = existsSync8(join8(project.root, SECRETS_FILE));
+    const inRepo = existsSync9(join9(project.root, SECRETS_FILE));
     console.log(inRepo ? `Put each in ${SECRETS_FILE}, which the deploy uploads:` : source === "wrangler" ? "Set each secret on the worker (this also creates the draft worker on a first deploy):" : "Set each secret on the project:");
     for (const key of secrets) {
       console.log(inRepo ? `  dotenvx set ${key.key} '…' -f ${SECRETS_FILE}` : `  ${source === "wrangler" ? "wrangler secret put" : "void secret put"} ${key.key}`);
@@ -3168,17 +3331,17 @@ ${color4.red("NOT ready to go live.")}
 }
 
 // src/deploy/cloudflare.ts
-import { existsSync as existsSync9, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, join as join9 } from "node:path";
-import color5 from "picocolors";
+import { existsSync as existsSync10, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname6, join as join10 } from "node:path";
+import color6 from "picocolors";
 var fail = (message) => {
   console.error(`
-${color5.red("✗")} ${message}
+${color6.red("✗")} ${message}
 `);
   return 1;
 };
 function readConfig(path) {
-  return parseJsonc(readFileSync4(path, "utf8"));
+  return parseJsonc(readFileSync5(path, "utf8"));
 }
 function findBuilder(from) {
   let dir = from;
@@ -3187,8 +3350,8 @@ function findBuilder(from) {
       ["vp", "vp build"],
       ["vite", "vite build"]
     ]) {
-      const path = join9(dir, "node_modules", ".bin", bin);
-      if (existsSync9(path))
+      const path = join10(dir, "node_modules", ".bin", bin);
+      if (existsSync10(path))
         return { cmd: path, label };
     }
     const parent = dirname6(dir);
@@ -3199,8 +3362,8 @@ function findBuilder(from) {
 }
 async function deployCloudflare(project, opts) {
   const app = project.appDir;
-  const configPath = join9(app, "wrangler.jsonc");
-  if (!existsSync9(configPath))
+  const configPath = join10(app, "wrangler.jsonc");
+  if (!existsSync10(configPath))
     return fail("wrangler.jsonc is missing — `vc generate` writes it.");
   const bin = findWrangler(app);
   if (!bin)
@@ -3213,16 +3376,16 @@ async function deployCloudflare(project, opts) {
 ${who.raw.trim().split(`
 `).slice(-4).join(`
 `)}`);
-  console.log(`${color5.green("✓")} wrangler is logged in`);
+  console.log(`${color6.green("✓")} wrangler is logged in`);
   let config = readConfig(configPath);
   let accountId = config.account_id || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
   if (!accountId) {
     if (who.accounts.length === 1) {
       accountId = who.accounts[0].id;
-      writeFileSync2(configPath, upsertJsonc(readFileSync4(configPath, "utf8"), "account_id", accountId));
+      writeFileSync2(configPath, upsertJsonc(readFileSync5(configPath, "utf8"), "account_id", accountId));
       project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId };
       await writeManifest(project.root, project.manifest);
-      console.log(`${color5.green("✓")} pinned the account "${who.accounts[0].name}" in wrangler.jsonc`);
+      console.log(`${color6.green("✓")} pinned the account "${who.accounts[0].name}" in wrangler.jsonc`);
     } else {
       return fail(`the account is not pinned and wrangler sees ${who.accounts.length}. Set account_id in wrangler.jsonc to one of:
 ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
@@ -3234,7 +3397,7 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   if (!check.ready) {
     if (!opts.force)
       return fail("refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force for a deliberate partial deploy.");
-    console.error(color5.yellow(`--force: deploying a shop that is NOT ready for customers.
+    console.error(color6.yellow(`--force: deploying a shop that is NOT ready for customers.
 `));
   }
   const worker = config.name || project.manifest.shop.domain.split(".")[0];
@@ -3245,15 +3408,15 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
       return fail("the D1 database is not provisioned. Run once with --provision to create it and record its id.");
     const db = await ensureD1(bin, app, `${worker}-db`);
     const entry = { binding: "DB", database_name: db.name, database_id: db.uuid, migrations_dir: "./db/migrations" };
-    writeFileSync2(configPath, upsertJsonc(readFileSync4(configPath, "utf8"), "d1_databases", [entry]));
+    writeFileSync2(configPath, upsertJsonc(readFileSync5(configPath, "utf8"), "d1_databases", [entry]));
     project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId, d1: { name: db.name, id: db.uuid } };
     await writeManifest(project.root, project.manifest);
-    console.log(`${color5.green("✓")} D1 "${db.name}" recorded in wrangler.jsonc and voidcommerce.json`);
+    console.log(`${color6.green("✓")} D1 "${db.name}" recorded in wrangler.jsonc and voidcommerce.json`);
     config = readConfig(configPath);
   }
   if (opts.provision) {
     await ensureQueue(bin, app, "commerce");
-    console.log(`${color5.green("✓")} queue "commerce"`);
+    console.log(`${color6.green("✓")} queue "commerce"`);
   }
   const builder = findBuilder(app);
   if (!builder)
@@ -3263,10 +3426,10 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const built = await wrangler(builder.cmd, ["build"], app, true);
   if (built.code !== 0)
     return fail(`the build failed (exit ${built.code}).`);
-  const emittedPath = join9(app, "dist", "ssr", "wrangler.json");
-  if (!existsSync9(emittedPath))
+  const emittedPath = join10(app, "dist", "ssr", "wrangler.json");
+  if (!existsSync10(emittedPath))
     return fail(`the build emitted no ${emittedPath} — is this a Void app on the Cloudflare target?`);
-  const emitted = JSON.parse(readFileSync4(emittedPath, "utf8"));
+  const emitted = JSON.parse(readFileSync5(emittedPath, "utf8"));
   const secretKeys = new Set(allEnvKeys(project.manifest).filter((key) => !key.plaintext).map((key) => key.key));
   const scrubbed = [];
   for (const [key, value] of Object.entries(emitted.vars ?? {})) {
@@ -3279,7 +3442,7 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   if (!emittedD1 || emittedD1.database_id === "local")
     return fail("the emitted config still carries a placeholder D1 id; wrangler.jsonc's DB binding was not picked up by the build.");
   writeFileSync2(emittedPath, JSON.stringify(emitted, null, 2));
-  console.log(`${color5.green("✓")} scrubbed ${scrubbed.length} baked value${scrubbed.length === 1 ? "" : "s"} from the worker's vars${scrubbed.length ? `: ${scrubbed.join(", ")}` : ""}`);
+  console.log(`${color6.green("✓")} scrubbed ${scrubbed.length} baked value${scrubbed.length === 1 ? "" : "s"} from the worker's vars${scrubbed.length ? `: ${scrubbed.join(", ")}` : ""}`);
   console.log(`
 ▸ wrangler d1 migrations apply ${emittedD1.database_name} --remote`);
   const migrated = await wrangler(bin, ["d1", "migrations", "apply", emittedD1.database_name, "--remote"], app, true);
@@ -3287,34 +3450,34 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
     return fail(`applying migrations failed (exit ${migrated.code}); nothing was deployed.`);
   const secretArgs = [];
   let cleanupSecrets;
-  if (existsSync9(join9(project.root, SECRETS_FILE))) {
+  if (existsSync10(join10(project.root, SECRETS_FILE))) {
     const decrypted = await decryptSecrets(project);
     if ("error" in decrypted)
       return fail(`the repository's secrets could not be read: ${decrypted.error}`);
     secretArgs.push("--secrets-file", decrypted.path);
     cleanupSecrets = decrypted.cleanup;
-    console.log(`${color5.green("✓")} ${decrypted.names.length} secrets from ${SECRETS_FILE}, uploaded with this version`);
+    console.log(`${color6.green("✓")} ${decrypted.names.length} secrets from ${SECRETS_FILE}, uploaded with this version`);
   }
   console.log(`
 ▸ wrangler deploy -c dist/ssr/wrangler.json`);
-  const deployed = await wrangler(bin, ["deploy", "-c", join9("dist", "ssr", "wrangler.json"), ...secretArgs], app, true);
+  const deployed = await wrangler(bin, ["deploy", "-c", join10("dist", "ssr", "wrangler.json"), ...secretArgs], app, true);
   cleanupSecrets?.();
   if (deployed.code !== 0)
     return fail(`wrangler deploy failed (exit ${deployed.code}).`);
   const domain = project.manifest.shop.domain;
   const url = `https://${workerHosts(project.manifest)[0]}`;
   console.log(`
-${color5.green("Live:")} ${url}`);
+${color6.green("Live:")} ${url}`);
   if (hasFrontend(project.manifest.layout))
-    console.log(color5.dim("The storefront deploys itself from GitHub Actions on push."));
+    console.log(color6.dim("The storefront deploys itself from GitHub Actions on push."));
   return 0;
 }
 
 // src/import.ts
 import { readFile as readFile3 } from "node:fs/promises";
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join10 } from "node:path";
-import color6 from "picocolors";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join11 } from "node:path";
+import color7 from "picocolors";
 function describe(counts) {
   if (!counts)
     return "";
@@ -3353,7 +3516,7 @@ async function post(url, key, body) {
   return { ok: response.ok, status: response.status, body: { ...parsed, error: parsed.error ?? parsed.message } };
 }
 async function readJson(path) {
-  if (!existsSync10(path))
+  if (!existsSync11(path))
     return null;
   try {
     return JSON.parse(await readFile3(path, "utf8"));
@@ -3381,41 +3544,41 @@ async function importCommand(args) {
   }
   const { url, how } = resolveTarget(project, args);
   if (!dry)
-    console.log(`${color6.dim("→")} ${url} ${color6.dim(`(${how})`)}
+    console.log(`${color7.dim("→")} ${url} ${color7.dim(`(${how})`)}
 `);
   if (!dry) {
     let whoami2;
     try {
       whoami2 = await fetch(`${url}/api/auth/system/whoami`, { headers: { "x-system-key": key } });
     } catch (error) {
-      console.error(`${color6.red("✗")} could not reach ${url}: ${error instanceof Error ? error.message : String(error)}
+      console.error(`${color7.red("✗")} could not reach ${url}: ${error instanceof Error ? error.message : String(error)}
 ` + `  Is the shop running? \`vc dev\` serves it locally; --local points here.
 `);
       return 1;
     }
     if (!whoami2.ok) {
-      console.error(`${color6.red("✗")} the shop refused the system key (HTTP ${whoami2.status}).
+      console.error(`${color7.red("✗")} the shop refused the system key (HTTP ${whoami2.status}).
 ` + `  Is SYSTEM_API_KEY the one this deployment was given?
 `);
       return 1;
     }
-    console.log(`${color6.green("✓")} authenticated as the system identity`);
+    console.log(`${color7.green("✓")} authenticated as the system identity`);
   }
   const root = project.root;
-  const products = await readJson(join10(root, "data", "catalog.json"));
-  const categories = await readJson(join10(root, "data", "categories.json"));
-  const faqs = has(project.manifest, "faqs") ? await readJson(join10(root, "content", "faqs.json")) : null;
-  const posts = has(project.manifest, "blogs") ? await readJson(join10(root, "content", "posts.json")) : null;
+  const products = await readJson(join11(root, "data", "catalog.json"));
+  const categories = await readJson(join11(root, "data", "categories.json"));
+  const faqs = has(project.manifest, "faqs") ? await readJson(join11(root, "content", "faqs.json")) : null;
+  const posts = has(project.manifest, "blogs") ? await readJson(join11(root, "content", "posts.json")) : null;
   if (!products && !faqs?.length && !posts?.length) {
     console.log(`
-${color6.yellow("Nothing to import.")} data/catalog.json is absent and the content files are empty.
+${color7.yellow("Nothing to import.")} data/catalog.json is absent and the content files are empty.
 ` + `Products go in data/catalog.json as a JSON array; \`vc import --dry-run\` checks it without pushing.
 `);
     return 0;
   }
   if (dry) {
     console.log(`
-${color6.dim("--dry-run: nothing was pushed.")}`);
+${color7.dim("--dry-run: nothing was pushed.")}`);
     console.log(`  ${products?.length ?? 0} products, ${categories?.length ?? 0} categories`);
     console.log(`  ${faqs?.length ?? 0} FAQ entries, ${posts?.length ?? 0} posts
 `);
@@ -3431,15 +3594,15 @@ ${color6.dim("--dry-run: nothing was pushed.")}`);
     });
     if (result.ok) {
       const report = result.body.report ?? {};
-      console.log(`${color6.green("✓")} products:   ${describe(report.products)}`);
+      console.log(`${color7.green("✓")} products:   ${describe(report.products)}`);
       if (report.categories)
-        console.log(`${color6.green("✓")} categories: ${describe(report.categories)}`);
+        console.log(`${color7.green("✓")} categories: ${describe(report.categories)}`);
       if (report.prices)
-        console.log(`${color6.green("✓")} prices:     ${describe(report.prices)}`);
+        console.log(`${color7.green("✓")} prices:     ${describe(report.prices)}`);
       if (report.addons)
-        console.log(`${color6.green("✓")} addons:     ${describe(report.addons)}`);
+        console.log(`${color7.green("✓")} addons:     ${describe(report.addons)}`);
     } else {
-      console.error(`${color6.red("✗")} catalogue: ${result.body.error ?? `HTTP ${result.status}`}`);
+      console.error(`${color7.red("✗")} catalogue: ${result.body.error ?? `HTTP ${result.status}`}`);
       failed = true;
     }
   }
@@ -3451,20 +3614,20 @@ ${color6.dim("--dry-run: nothing was pushed.")}`);
       continue;
     const result = await post(`${url}${path}`, key, { entries: rows, posts: rows });
     if (result.ok) {
-      console.log(`${color6.green("✓")} ${label}: ${describe(result.body)}`);
+      console.log(`${color7.green("✓")} ${label}: ${describe(result.body)}`);
     } else {
-      console.error(`${color6.red("✗")} ${label}: ${result.body.error ?? `HTTP ${result.status}`}`);
+      console.error(`${color7.red("✗")} ${label}: ${result.body.error ?? `HTTP ${result.status}`}`);
       failed = true;
     }
   }
   if (failed) {
     console.error(`
-${color6.red("Some of it did not land.")} The import is an upsert, so fixing the cause and running it again is safe.
+${color7.red("Some of it did not land.")} The import is an upsert, so fixing the cause and running it again is safe.
 `);
     return 1;
   }
   console.log(`
-${color6.green("Imported.")} It is an upsert, so running it again costs one pass and changes nothing.
+${color7.green("Imported.")} It is an upsert, so running it again costs one pass and changes nothing.
 `);
   return 0;
 }
@@ -3485,4 +3648,4 @@ async function importHelp() {
   return 0;
 }
 
-export { renderAuthTs, allEnvKeys, renderEnvTs, renderEnvExample, renderEnvLocal, renderEnvProduction, envSummary, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, parseWhoAmI, SECRETS_FILE, PRIVATE_KEY_VAR, secretsCommand, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };
+export { renderAuthTs, allEnvKeys, renderEnvTs, renderEnvExample, renderEnvLocal, renderEnvProduction, envSummary, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, parseWhoAmI, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, plaintextSecretNames, secretsCommand, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };