@saastemly/voidcommerce 0.4.0 → 0.5.0

package/dist/index-b9b4dawy.js

@@ -0,0 +1,797 @@
+import {
+  envKeysOf,
+  hasFrontend,
+  isApex,
+  zone
+} from "./index-pz6m2hkm.js";
+import {
+  __require,
+  __toESM
+} from "./index-0v6na3yp.js";
+
+// src/deploy/keys.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+import color2 from "picocolors";
+
+// src/deploy/github.ts
+import { spawn } from "node:child_process";
+import { delimiter, join } from "node:path";
+import { existsSync } from "node:fs";
+var REPO_SCOPE = "repo";
+function findGh() {
+  for (const entry of (process.env["PATH"] ?? "").split(delimiter).filter(Boolean)) {
+    if (existsSync(join(entry, "gh")))
+      return join(entry, "gh");
+  }
+  return null;
+}
+function run(cmd, args, cwd, stdin) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, { cwd, stdio: ["pipe", "pipe", "pipe"] });
+    let out = "";
+    child.stdout?.on("data", (chunk) => {
+      out += chunk;
+    });
+    child.stderr?.on("data", (chunk) => {
+      out += chunk;
+    });
+    child.on("error", (error) => resolve({ code: 1, out: String(error) }));
+    child.on("exit", (code) => resolve({ code: code ?? 1, out }));
+    child.stdin?.end(stdin ?? "");
+  });
+}
+async function ghAuth(cwd) {
+  const gh = findGh();
+  if (!gh) {
+    return { ok: false, reason: "the GitHub CLI is not installed. https://cli.github.com — then `gh auth login`." };
+  }
+  const status = await run(gh, ["auth", "status"], cwd);
+  if (status.code !== 0) {
+    return { ok: false, reason: "gh is not logged in. Run `gh auth login`." };
+  }
+  const user = /Logged in to \S+ account (\S+)/.exec(status.out)?.[1];
+  const scopes = /Token scopes: (.+)/.exec(status.out)?.[1]?.split(",").map((scope) => scope.trim().replace(/^'|'$/g, ""));
+  if (scopes && !scopes.includes(REPO_SCOPE)) {
+    return {
+      ok: false,
+      user,
+      scopes,
+      reason: `gh is logged in as ${user ?? "you"} but its token lacks the \`${REPO_SCOPE}\` scope, which writing repository secrets needs.
+  Run \`gh auth refresh -s ${REPO_SCOPE}\`.`
+    };
+  }
+  return { ok: true, user, scopes };
+}
+async function repoSlug(cwd) {
+  const gh = findGh();
+  if (!gh)
+    return null;
+  const viewed = await run(gh, ["repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner"], cwd);
+  if (viewed.code !== 0)
+    return null;
+  const slug = viewed.out.trim();
+  return /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+}
+async function setSecret(cwd, name, value) {
+  const gh = findGh();
+  if (!gh)
+    return { ok: false, error: "gh is not installed" };
+  const result = await run(gh, ["secret", "set", name], cwd, value);
+  return result.code === 0 ? { ok: true } : { ok: false, error: result.out.trim().split(`
+`).slice(-2).join(" ") };
+}
+async function secretNames(cwd) {
+  const gh = findGh();
+  if (!gh)
+    return new Set;
+  const listed = await run(gh, ["secret", "list", "--json", "name", "-q", ".[].name"], cwd);
+  if (listed.code !== 0)
+    return new Set;
+  return new Set(listed.out.split(`
+`).map((line) => line.trim()).filter(Boolean));
+}
+async function setVariable(cwd, name, value) {
+  const gh = findGh();
+  if (!gh)
+    return { ok: false, error: "gh is not installed" };
+  const result = await run(gh, ["variable", "set", name, "--body", value], cwd);
+  return result.code === 0 ? { ok: true } : { ok: false, error: result.out.trim().split(`
+`).slice(-2).join(" ") };
+}
+async function variableNames(cwd) {
+  const gh = findGh();
+  if (!gh)
+    return new Set;
+  const listed = await run(gh, ["variable", "list", "--json", "name", "-q", ".[].name"], cwd);
+  if (listed.code !== 0)
+    return new Set;
+  return new Set(listed.out.split(`
+`).map((line) => line.trim()).filter(Boolean));
+}
+async function verifyCloudflareToken(token) {
+  try {
+    const response = await fetch("https://api.cloudflare.com/client/v4/user/tokens/verify", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    const body = await response.json();
+    if (body.success && body.result?.status === "active")
+      return { ok: true, detail: "active" };
+    const message = body.errors?.[0]?.message ?? `HTTP ${response.status}`;
+    return { ok: false, detail: message };
+  } catch (error) {
+    return { ok: false, detail: `could not reach the Cloudflare API: ${String(error)}` };
+  }
+}
+async function cloudflareAccounts(token) {
+  try {
+    const response = await fetch("https://api.cloudflare.com/client/v4/accounts?per_page=50", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    const body = await response.json();
+    return body.success && Array.isArray(body.result) ? body.result.map((a) => ({ id: a.id, name: a.name })) : [];
+  } catch {
+    return [];
+  }
+}
+
+// src/deploy/secrets.ts
+import { existsSync as existsSync2, readFileSync, writeFileSync } from "node:fs";
+import { spawn as spawn2 } from "node:child_process";
+import { delimiter as delimiter2, dirname, join as join2 } from "node:path";
+import { tmpdir } from "node:os";
+import color from "picocolors";
+
+// src/generate/env.ts
+var BASE = [
+  {
+    key: "SHOP_DOMAIN",
+    breaks: "everything derived from it is wrong at once — no public origin, the storefront rejected as untrusted, no DNS records",
+    plaintext: true
+  },
+  {
+    key: "COMMERCE_CRON_SECRET",
+    breaks: "the scheduler cannot authenticate, so every background job stops",
+    where: "openssl rand -base64 32"
+  },
+  {
+    key: "COMMERCE_WEBHOOK_SECRET",
+    breaks: "payment webhooks cannot be verified, so no order ever becomes paid",
+    where: "the payment provider's dashboard"
+  },
+  {
+    key: "SHIPPING_DOMESTIC_MINOR",
+    breaks: "delivery is quoted at nothing, and every order loses the carrier cost",
+    plaintext: true,
+    dev: "4900",
+    where: "your carrier agreement, in minor units ex VAT"
+  },
+  {
+    key: "SHIPPING_FREE_FROM_MINOR",
+    breaks: "the free-delivery threshold is undefined",
+    plaintext: true,
+    dev: "100000"
+  }
+];
+function allEnvKeys(manifest) {
+  const keys = [...BASE, ...envKeysOf(manifest)];
+  if (!isApex(manifest)) {
+    keys.splice(1, 0, {
+      key: "SHOP_ZONE",
+      breaks: "DNS records are written to the wrong zone, or to none",
+      plaintext: true
+    });
+  }
+  if (hasFrontend(manifest.layout) && manifest.shop.pagesHost) {
+    keys.splice(1, 0, {
+      key: "GITHUB_PAGES_HOST",
+      breaks: "the www record has nothing to point at",
+      plaintext: true
+    });
+  }
+  return keys;
+}
+var NUMERIC = new Set(["SHIPPING_DOMESTIC_MINOR", "SHIPPING_FREE_FROM_MINOR"]);
+function renderEnvTs(manifest) {
+  const keys = allEnvKeys(manifest);
+  const lines = keys.map((key) => {
+    const helper = NUMERIC.has(key.key) ? "number()" : "string()";
+    const doc = [`	/** ${key.breaks}${key.where ? ` — from: ${key.where}` : ""} */`];
+    return `${doc.join(`
+`)}
+	${key.key}: ${helper},`;
+  });
+  return `import { defineEnv, number, string } from "void/env";
+
+/**
+ * Every env key the app reads. All of them are REQUIRED.
+ *
+ * Generated by \`vc init\` from voidcommerce.json — edit the manifest and
+ * regenerate rather than editing this by hand.
+ *
+ * Nothing is optional: an integration this shop supports is one the
+ * deployment sets up. No key has a default, because a default is compiled
+ * into the worker's vars and shadows the real secret. Locally, the literal
+ * value \`unset\` is the one documented way to say "I do not have this yet",
+ * and \`vc preflight\` refuses it.
+ */
+export default defineEnv({
+${lines.join(`
+`)}
+});
+`;
+}
+function renderEnvExample(manifest) {
+  const keys = allEnvKeys(manifest);
+  return [
+    "# Every key is required. Copy to .env for local development.",
+    "# `unset` is the one value that reads as absent — for a credential you do not have yet.",
+    "",
+    ...keys.map((key) => `${key.key}=${key.dev ?? (key.plaintext ? "" : "unset")}`),
+    ""
+  ].join(`
+`);
+}
+function renderEnvLocal(manifest) {
+  const keys = allEnvKeys(manifest);
+  const local = {
+    SHOP_DOMAIN: `${manifest.shop.domain.split(".")[0]}.test`,
+    GITHUB_PAGES_HOST: manifest.shop.pagesHost ?? "",
+    SHOP_ZONE: zone(manifest),
+    COMMERCE_CRON_SECRET: "dev-cron-secret-not-for-production",
+    COMMERCE_WEBHOOK_SECRET: "whsec_dev_secret",
+    SYSTEM_API_KEY: "dev-system-key-0123456789abcdefghijklmnopqrstuvwxyz",
+    EMAIL_FROM: `"${manifest.shop.name} <noreply@${manifest.shop.domain}>"`
+  };
+  return [
+    "# Local development. Gitignored; .env.example documents every key.",
+    "",
+    ...keys.map((key) => `${key.key}=${local[key.key] ?? key.dev ?? "unset"}`),
+    ...hasFrontend(manifest.layout) ? ["", "# The storefront, reaching the worker. Start the worker first.", "VITE_API_ORIGIN=http://localhost:5173"] : [],
+    ""
+  ].join(`
+`);
+}
+function renderEnvProduction(manifest) {
+  const keys = allEnvKeys(manifest).filter((key) => key.plaintext);
+  const values = {
+    SHOP_DOMAIN: manifest.shop.domain,
+    GITHUB_PAGES_HOST: manifest.shop.pagesHost ?? "",
+    SHOP_ZONE: zone(manifest),
+    EMAIL_FROM: `"${manifest.shop.name} <noreply@${manifest.shop.domain}>"`,
+    ADYEN_ENVIRONMENT: "live",
+    BC_ENVIRONMENT: "production"
+  };
+  return [
+    "# Production values that are NOT secrets.",
+    "#",
+    "# On `void deploy --backend cloudflare` every .env* file is baked into the",
+    "# worker's vars as PLAINTEXT, so this holds only values safe to commit. Every",
+    "# credential is `wrangler secret put <NAME>` instead.",
+    "",
+    ...keys.map((key) => `${key.key}=${values[key.key] ?? key.dev ?? ""}`),
+    ""
+  ].join(`
+`);
+}
+function envSummary(manifest) {
+  const keys = allEnvKeys(manifest);
+  return {
+    secrets: keys.filter((key) => !key.plaintext).map((key) => key.key),
+    plaintext: keys.filter((key) => key.plaintext).map((key) => key.key)
+  };
+}
+
+// src/deploy/secrets.ts
+var SECRETS_FILE = ".env.secrets";
+var PRIVATE_KEY_VAR = "DOTENV_PRIVATE_KEY_SECRETS";
+function findDotenvx(from) {
+  let dir = from;
+  for (;; ) {
+    const local = join2(dir, "node_modules", ".bin", "dotenvx");
+    if (existsSync2(local))
+      return local;
+    const parent = dirname(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return (process.env["PATH"] ?? "").split(delimiter2).filter(Boolean).some((entry) => existsSync2(join2(entry, "dotenvx"))) ? "dotenvx" : null;
+}
+function run2(cmd, args, cwd, env = {}) {
+  return new Promise((resolve) => {
+    const child = spawn2(cmd, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, ...env } });
+    let out = "";
+    child.stdout.on("data", (chunk) => {
+      out += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      out += chunk;
+    });
+    child.on("error", (error) => resolve({ code: 1, out: String(error) }));
+    child.on("exit", (code) => resolve({ code: code ?? 1, out }));
+  });
+}
+function committedPublicKeyInto(root, publicKey) {
+  const path = join2(root, SECRETS_FILE);
+  const line = `DOTENV_PUBLIC_KEY_SECRETS="${publicKey}"`;
+  if (!existsSync2(path)) {
+    writeFileSync(path, `${line}
+`, { mode: 384 });
+    return;
+  }
+  const body = readFileSync(path, "utf8");
+  writeFileSync(path, /^\s*DOTENV_PUBLIC_KEY_SECRETS\s*=.*$/m.test(body) ? body.replace(/^\s*DOTENV_PUBLIC_KEY_SECRETS\s*=.*$/m, line) : `${line}
+${body}`);
+}
+function declaredSecretNames(root) {
+  const path = join2(root, SECRETS_FILE);
+  if (!existsSync2(path))
+    return new Set;
+  const names = new Set;
+  for (const line of readFileSync(path, "utf8").split(`
+`)) {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(line);
+    if (match && !match[1].startsWith("DOTENV_"))
+      names.add(match[1]);
+  }
+  return names;
+}
+function plaintextSecretNames(root) {
+  const path = join2(root, SECRETS_FILE);
+  if (!existsSync2(path))
+    return [];
+  const bare = [];
+  for (const line of readFileSync(path, "utf8").split(`
+`)) {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!match || match[1].startsWith("DOTENV_"))
+      continue;
+    const value = match[2].trim().replace(/^['"]|['"]$/g, "");
+    if (value && value !== "unset" && !value.startsWith("encrypted:"))
+      bare.push(match[1]);
+  }
+  return bare;
+}
+async function decryptSecrets(project) {
+  const root = project.root;
+  if (!existsSync2(join2(root, SECRETS_FILE)))
+    return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
+  const privateKey = process.env[PRIVATE_KEY_VAR];
+  if (!privateKey) {
+    return {
+      error: `${PRIVATE_KEY_VAR} is not set, so ${SECRETS_FILE} cannot be decrypted here.
+` + `  That is the normal state on a laptop: the key lives in GitHub Actions and
+` + `  only the deploy uses it. Push, and the workflow does this step.
+` + `  To deploy by hand anyway, export the key for one command.`
+    };
+  }
+  const expected = committedPublicKey(root);
+  if (expected) {
+    const { publicKeyFor } = await import("./keys-b91c72zp.js");
+    const derived = await publicKeyFor(privateKey);
+    if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
+      return {
+        error: `${PRIVATE_KEY_VAR} does not open this repository.
+  it derives:       ${derived.slice(0, 16)}…
+` + `  encrypted under:  ${expected.slice(0, 16)}…
+` + `  It belongs to a different shop, or the repository has been re-keyed since.`
+      };
+    }
+  }
+  const dotenvx = findDotenvx(root);
+  if (!dotenvx)
+    return { error: "dotenvx is not installed. `bun add -d @dotenvx/dotenvx`" };
+  const result = await run2(dotenvx, ["decrypt", "-f", SECRETS_FILE, "--stdout"], root, {
+    [PRIVATE_KEY_VAR]: privateKey
+  });
+  if (result.code !== 0)
+    return { error: `dotenvx could not decrypt ${SECRETS_FILE}: ${result.out.trim().split(`
+`).slice(-2).join(" ")}` };
+  const lines = result.out.split(`
+`).filter((line) => /^\s*[A-Z][A-Z0-9_]*\s*=/.test(line) && !line.trimStart().startsWith("DOTENV_"));
+  const names = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
+  const path = join2(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
+  writeFileSync(path, `${lines.join(`
+`)}
+`, { mode: 384 });
+  return {
+    path,
+    names,
+    cleanup: () => {
+      try {
+        writeFileSync(path, "", { mode: 384 });
+        __require("node:fs").unlinkSync(path);
+      } catch {}
+    }
+  };
+}
+async function secretsCommand(project, args) {
+  const root = project.root;
+  const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+  const declared = declaredSecretNames(root);
+  const bare = plaintextSecretNames(root);
+  if (args.includes("--init"))
+    return initSecrets(project);
+  if (args[0] === "set")
+    return setSecretValue(project, args.slice(1));
+  if (!existsSync2(join2(root, SECRETS_FILE))) {
+    console.log(`
+${color.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,
+which means the shop cannot be rebuilt from a checkout.
+
+  vc secrets --init    write one, with every required key as \`unset\`
+`);
+    return 1;
+  }
+  console.log(`
+${SECRETS_FILE} — committed, encrypted, and read by \`vc deploy --cloudflare\`
+`);
+  for (const key of required) {
+    const state = declared.has(key.key) ? color.green("declared") : color.red("MISSING ");
+    console.log(`  ${state}  ${key.key}`);
+  }
+  const extra = [...declared].filter((name) => !required.some((key) => key.key === name));
+  for (const name of extra)
+    console.log(`  ${color.dim("extra   ")}  ${name} ${color.dim("— not required by this shop")}`);
+  if (bare.length > 0) {
+    console.log(`
+${color.red("✗")} ${bare.length} value${bare.length === 1 ? " is" : "s are"} committed IN THE CLEAR: ${bare.join(", ")}
+  Run \`dotenvx encrypt -f ${SECRETS_FILE}\` before committing again.
+`);
+    return 1;
+  }
+  const missing = required.filter((key) => !declared.has(key.key));
+  if (missing.length > 0) {
+    console.log(`
+${color.red("✗")} ${missing.length} required secret${missing.length === 1 ? "" : "s"} not declared.
+  dotenvx set ${missing[0].key} '…' -f ${SECRETS_FILE}
+`);
+    return 1;
+  }
+  console.log(`
+${color.green("✓")} every secret this shop needs is declared and encrypted.
+`);
+  return 0;
+}
+async function initSecrets(project) {
+  const path = join2(project.root, SECRETS_FILE);
+  if (existsSync2(path) && declaredSecretNames(project.root).size > 0) {
+    console.error(`vc: ${SECRETS_FILE} already declares secrets; not overwriting it.
+  \`vc secrets set KEY\` changes one.`);
+    return 1;
+  }
+  const existing = committedPublicKey(project.root);
+  const made = existing ? { ok: true, publicKey: existing } : await provisionKey(project);
+  if (!made.ok) {
+    console.error(`
+vc: ${made.reason}
+`);
+    return 1;
+  }
+  const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
+  const body = [
+    "# Secrets, encrypted, and COMMITTED.",
+    "#",
+    "# Values are ciphertext; the key names are readable so a diff shows WHICH",
+    "# secret changed without showing what it changed to. `unset` is the",
+    "# documented placeholder and preflight refuses it.",
+    "#",
+    "# Setting a value needs NO credential: dotenvx encrypts with the public key",
+    "# below, which is right here in the repository. Only the deploy decrypts,",
+    "# and the private key for that lives in GitHub Actions.",
+    "#",
+    "# `vc secrets set KEY` is the way to change one — it reads the value from",
+    "# the terminal, so it never reaches a command line where `ps` would show it.",
+    "",
+    `DOTENV_PUBLIC_KEY_SECRETS="${made.publicKey}"`,
+    "",
+    ...required.flatMap((key) => [`# ${key.breaks}${key.where ? ` — from: ${key.where}` : ""}`, `${key.key}=unset`, ""])
+  ].join(`
+`);
+  writeFileSync(path, body, { mode: 384 });
+  console.log(`
+${color.green("+")} ${SECRETS_FILE} — ${required.length} keys, all \`unset\`
+${existing ? color.dim(`= ${PRIVATE_KEY_VAR} was already on GitHub; reused it`) : `${color.green("+")} ${PRIVATE_KEY_VAR} stored on GitHub; the public key is in the file`}
+
+Next:
+${required.map((key) => `  ${color.cyan(`vc secrets set ${key.key}`)}`).join(`
+`)}
+
+then commit ${SECRETS_FILE}. There is no key file to keep out of git.
+`);
+  return 0;
+}
+async function setSecretValue(project, args) {
+  const root = project.root;
+  const name = args.find((arg) => !arg.startsWith("-"));
+  if (!name) {
+    console.error(`
+vc: which secret? \`vc secrets set STRIPE_SECRET_KEY\`
+`);
+    return 1;
+  }
+  if (!/^[A-Z][A-Z0-9_]*$/.test(name)) {
+    console.error(`
+vc: "${name}" is not a key name — they are SHOUTING_SNAKE_CASE.
+`);
+    return 1;
+  }
+  if (!existsSync2(join2(root, SECRETS_FILE))) {
+    console.error(`
+vc: no ${SECRETS_FILE} yet. \`vc secrets --init\` writes one.
+`);
+    return 1;
+  }
+  const publicKey = committedPublicKey(root);
+  if (!publicKey) {
+    console.error(`
+vc: ${SECRETS_FILE} has no DOTENV_PUBLIC_KEY_SECRETS, so there is nothing to encrypt to.
+  \`vc keys --init\` makes a key and puts the public half here.
+`);
+    return 1;
+  }
+  const known = allEnvKeys(project.manifest).find((key) => key.key === name);
+  const value = await readValue(name, known?.breaks, known?.where);
+  if (value === null)
+    return 1;
+  const written = await encryptInto(root, publicKey, name, value);
+  if (!written.ok) {
+    console.error(`
+vc: ${written.error}
+`);
+    return 1;
+  }
+  const stillBare = plaintextSecretNames(root).includes(name);
+  if (stillBare) {
+    console.error(`
+${color.red("✗")} ${name} was written in the CLEAR — the public key did not encrypt it.
+  Do not commit. Check DOTENV_PUBLIC_KEY_SECRETS in ${SECRETS_FILE}.
+`);
+    return 1;
+  }
+  console.log(`
+${color.green("✓")} ${name} encrypted into ${SECRETS_FILE}. Commit it.
+`);
+  return 0;
+}
+async function readValue(name, breaks, where) {
+  if (!process.stdin.isTTY) {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+      chunks.push(chunk);
+    const piped = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+    if (!piped) {
+      console.error(`
+vc: nothing on stdin to set ${name} to.
+`);
+      return null;
+    }
+    return piped;
+  }
+  const p = await import("@clack/prompts");
+  if (breaks)
+    console.log(`
+${color.dim(breaks)}${where ? color.dim(` — from: ${where}`) : ""}`);
+  const answer = await p.password({
+    message: name,
+    validate: (input) => input && input.length > 0 ? undefined : "a secret with no value is not a secret"
+  });
+  if (p.isCancel(answer)) {
+    console.log(color.dim(`
+cancelled; nothing changed.
+`));
+    return null;
+  }
+  return String(answer);
+}
+async function encryptInto(root, publicKey, name, value) {
+  const { encrypt } = await import("./index-mpr7gm6k.js").then((m)=>__toESM(m.default,1));
+  let ciphertext;
+  try {
+    ciphertext = encrypt(publicKey, value);
+  } catch (error) {
+    return { ok: false, error: `could not encrypt to the key in ${SECRETS_FILE}: ${String(error)}` };
+  }
+  const looksWrong = !ciphertext.startsWith("encrypted:") || ciphertext === value || value.length >= 12 && ciphertext.includes(value);
+  if (looksWrong) {
+    return { ok: false, error: `refusing to write ${name} — the result does not look encrypted.` };
+  }
+  upsertLine(join2(root, SECRETS_FILE), name, ciphertext);
+  return { ok: true };
+}
+function upsertLine(path, name, value) {
+  const body = readFileSync(path, "utf8");
+  const pattern = new RegExp(`^\\s*${name}\\s*=.*$`, "m");
+  writeFileSync(path, pattern.test(body) ? body.replace(pattern, `${name}=${value}`) : `${body.replace(/\n*$/, `
+`)}${name}=${value}
+`);
+}
+
+// src/deploy/keys.ts
+function committedPublicKey(root) {
+  const path = join3(root, SECRETS_FILE);
+  if (!existsSync3(path))
+    return null;
+  const match = /^\s*DOTENV_PUBLIC_KEY_SECRETS\s*=\s*["']?([0-9a-fA-F]+)["']?/m.exec(readFileSync2(path, "utf8"));
+  return match?.[1] ?? null;
+}
+async function generateKeypair() {
+  try {
+    const { keypair } = await import("./index-mpr7gm6k.js").then((m)=>__toESM(m.default,1));
+    return keypair();
+  } catch {
+    return null;
+  }
+}
+async function publicKeyFor(privateKey) {
+  try {
+    const { derive } = await import("./index-mpr7gm6k.js").then((m)=>__toESM(m.default,1));
+    return derive(privateKey);
+  } catch {
+    return null;
+  }
+}
+async function keyState(project) {
+  const publicKey = committedPublicKey(project.root);
+  const slug = await repoSlug(project.root);
+  const names = slug ? await secretNames(project.root) : new Set;
+  const localKey = process.env[PRIVATE_KEY_VAR] ?? null;
+  let mismatch;
+  if (localKey && publicKey) {
+    const derived = await publicKeyFor(localKey);
+    if (derived && derived.toLowerCase() !== publicKey.toLowerCase()) {
+      mismatch = `${PRIVATE_KEY_VAR} in your environment derives ${derived.slice(0, 16)}…, but ${SECRETS_FILE} was encrypted under ${publicKey.slice(0, 16)}…`;
+    }
+  }
+  return { publicKey, inGitHub: names.has(PRIVATE_KEY_VAR), slug, localKey, mismatch };
+}
+async function provisionKey(project) {
+  const auth = await ghAuth(project.root);
+  if (!auth.ok)
+    return { ok: false, reason: auth.reason ?? "gh is unavailable" };
+  const slug = await repoSlug(project.root);
+  if (!slug) {
+    return {
+      ok: false,
+      reason: `this checkout has no GitHub repository yet, and the key is stored on the repository.
+  Create one first:
+
+    gh repo create --source=. --private --push
+`
+    };
+  }
+  const pair = await generateKeypair();
+  if (!pair)
+    return { ok: false, reason: "@dotenvx/dotenvx is not installed here. `bun add -d @dotenvx/dotenvx`" };
+  const sent = await setSecret(project.root, PRIVATE_KEY_VAR, pair.privateKey);
+  if (!sent.ok)
+    return { ok: false, reason: `GitHub refused the secret: ${sent.error ?? "unknown error"}` };
+  return { ok: true, publicKey: pair.publicKey };
+}
+async function keysCommand(project, args) {
+  if (args.includes("--rotate"))
+    return rotate(project);
+  if (args.includes("--init"))
+    return initKey(project);
+  const state = await keyState(project);
+  console.log(`
+Secrets are encrypted with a public key that is COMMITTED, and read with a`);
+  console.log(`private key that lives only in GitHub Actions.
+`);
+  const hasFile = existsSync3(join3(project.root, SECRETS_FILE));
+  const publicNote = state.publicKey ? `${state.publicKey.slice(0, 20)}… in ${SECRETS_FILE}` : color2.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc link\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
+  console.log(`  ${state.publicKey ? color2.green("✓") : color2.dim("·")} public key   ${publicNote}`);
+  console.log(`  ${state.inGitHub ? color2.green("✓") : color2.red("✗")} private key  ${state.inGitHub ? `${PRIVATE_KEY_VAR} is set on ${state.slug}` : state.slug ? color2.red(`not set on ${state.slug} — \`vc keys --init\``) : color2.dim("no GitHub repository yet")}`);
+  if (state.mismatch) {
+    console.error(`
+${color2.red("✗")} ${state.mismatch}
+  Unset it, or point it at the right repository.
+`);
+    return 1;
+  }
+  console.log(color2.dim(`
+Adding or changing a secret needs NO credential — encryption uses the public
+` + `key in the repository. Only the deploy decrypts, and only GitHub Actions can.
+`));
+  if (!state.inGitHub && state.slug)
+    return 1;
+  return 0;
+}
+async function initKey(project) {
+  const state = await keyState(project);
+  if (state.inGitHub && state.publicKey) {
+    console.error(`
+vc: ${project.root} already has a key: ${PRIVATE_KEY_VAR} on ${state.slug}, public ${state.publicKey.slice(0, 16)}….
+` + `  Replacing it makes every value in ${SECRETS_FILE} unreadable. \`vc keys --rotate\` is the deliberate way.
+`);
+    return 1;
+  }
+  const made = await provisionKey(project);
+  if (!made.ok) {
+    console.error(`
+vc: ${made.reason}
+`);
+    return 1;
+  }
+  const fresh = !existsSync3(join3(project.root, SECRETS_FILE));
+  committedPublicKeyInto(project.root, made.publicKey);
+  console.log(`
+${color2.green("✓")} ${PRIVATE_KEY_VAR} set on ${state.slug}; public key in ${SECRETS_FILE}
+` + (fresh ? `
+  Next: ${color2.cyan("vc secrets --init")} fills in the keys this shop needs.
+` : `
+`));
+  return 0;
+}
+async function rotate(project) {
+  const state = await keyState(project);
+  const old = state.localKey;
+  if (!old) {
+    console.error(`
+vc: rotating needs the CURRENT private key, and GitHub cannot give it back —
+` + `  a secret is write-only once set, which is why it is a good place to keep one.
+
+  If you have a copy:
+    ${color2.cyan(`${PRIVATE_KEY_VAR}=<the old key> vc keys --rotate`)}
+
+  If you do not, re-key and enter the values again:
+    ${color2.cyan(`rm ${SECRETS_FILE} && vc keys --init && vc secrets --init`)}
+
+` + color2.dim(`  That is less painful than it sounds. The reason to rotate an encryption key
+` + `  is that it may have leaked — and a key that may have leaked means the VALUES
+` + `  may have leaked. Those have to be replaced at Stripe and everywhere else
+  regardless, so re-entering them is not extra work. It is the work.
+`));
+    return 1;
+  }
+  if (state.mismatch) {
+    console.error(`
+vc: ${state.mismatch}
+  That key cannot read this repository, so it cannot rotate it either.
+`);
+    return 1;
+  }
+  const dotenvx = findDotenvx(project.root);
+  if (!dotenvx) {
+    console.error("vc: dotenvx is not installed here. `bun add -d @dotenvx/dotenvx`");
+    return 1;
+  }
+  const decrypted = await run2(dotenvx, ["decrypt", "-f", SECRETS_FILE], project.root, { [PRIVATE_KEY_VAR]: old });
+  if (decrypted.code !== 0) {
+    console.error(`
+vc: could not decrypt ${SECRETS_FILE}: ${decrypted.out.trim().split(`
+`).slice(-2).join(" ")}
+`);
+    return 1;
+  }
+  const made = await provisionKey(project);
+  if (!made.ok) {
+    console.error(`
+vc: ${made.reason}
+
+` + color2.red(`  ${SECRETS_FILE} IS NOW PLAINTEXT ON DISK and must not be committed.
+`) + `  Re-encrypt under the old key to undo:  ${color2.cyan(`bunx dotenvx encrypt -f ${SECRETS_FILE}`)}
+`);
+    return 1;
+  }
+  committedPublicKeyInto(project.root, made.publicKey);
+  const encrypted = await run2(dotenvx, ["encrypt", "-f", SECRETS_FILE], project.root);
+  if (encrypted.code !== 0) {
+    console.error(`
+vc: re-encryption failed: ${encrypted.out.trim().split(`
+`).slice(-2).join(" ")}
+` + color2.red(`  ${SECRETS_FILE} IS PLAINTEXT ON DISK. Do not commit it.
+`));
+    return 1;
+  }
+  console.log(`
+${color2.green("✓")} re-keyed under ${made.publicKey.slice(0, 20)}… and ${PRIVATE_KEY_VAR} replaced on ${state.slug}
+
+  Commit ${SECRETS_FILE}. The old key reads nothing in it any more.
+` + color2.yellow(`  The old ciphertext is still in git history, and the old key still opens THAT.
+`));
+  return 0;
+}
+
+export { allEnvKeys, renderEnvTs, renderEnvExample, renderEnvLocal, renderEnvProduction, envSummary, ghAuth, repoSlug, setSecret, secretNames, setVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, committedPublicKeyInto, declaredSecretNames, plaintextSecretNames, decryptSecrets, secretsCommand, initSecrets };