feat(cloudflare): inject build-time secrets into wrangler image_vars

Adds scripts/cloudflare-build.sh — a deploy wrapper that:
  1. Reads R2 + Turbo secrets from the Cloudflare Workers Build env
     (the dashboard's 'Build configuration → Variables and Secrets').
  2. Renders a wrangler.deploy.jsonc by overlaying those secrets onto
     wrangler.jsonc's image_vars block.
  3. Hands off to 'npx wrangler deploy --config wrangler.deploy.jsonc'.
  4. Cleans up the rendered file in an EXIT trap so secrets don't outlive
     the build.

Why this is needed:
  - wrangler image_vars passes string values literally — there is no
    ${VAR} interpolation against the build env.
  - Cloudflare Workers Builds does NOT auto-forward dashboard env vars
    to docker --build-arg. They're only available to the build script
    itself ('npx wrangler deploy').
  - So the only way to surface dashboard secrets to the docker build is
    to compose a wrangler config at build time that has the values
    inlined into image_vars.

Setup needed in Cloudflare dashboard:
  - Workers & Pages → primalprinting → Settings → Build configuration:
      Build command:  pnpm install --frozen-lockfile && bash scripts/cloudflare-build.sh
      Deploy command: (leave empty — script handles the deploy)
  - Variables and Secrets — keep the existing Secrets:
      R2_S3_ENDPOINT, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, TURBO_TOKEN

The rendered wrangler.deploy.jsonc is gitignored (would contain plaintext
secrets if accidentally committed).

Locally verified:
  - Missing required vars → script exits 1 with a clear error message.
  - All vars set → image_vars correctly merged, secrets masked in logs.

Author: choden-dev

.gitignore

@@ -55,6 +55,9 @@ terraform/crash.log
 
 # Cloudflare
 .wrangler
+# Build-time rendered config — generated by scripts/cloudflare-build.sh,
+# contains plaintext secrets, must never be committed.
+wrangler.deploy.jsonc
 
 # Turbo
 .turbo

scripts/cloudflare-build.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# scripts/cloudflare-build.sh
+#
+# Cloudflare Workers Builds entrypoint.
+#
+# Why this script exists:
+#   - The Dockerfile build step needs build-time access to R2 credentials
+#     and a Turborepo Remote Cache token so it can:
+#       1. Mirror static assets to R2 (`pnpm build:headless`)
+#       2. Hit the remote build cache (Turbo)
+#   - These are sensitive values that must not be committed to the repo.
+#   - wrangler's `image_vars` field passes string values *literally* (no
+#     `${VAR}` interpolation against the build env), and Cloudflare does
+#     not auto-forward dashboard env vars as docker `--build-arg`s either.
+#   - So we need a build wrapper that reads secrets from the build env
+#     (Cloudflare dashboard → Build configuration → Variables and Secrets)
+#     and merges them into `image_vars` at deploy time, in memory.
+#
+# How it works:
+#   1. Validate the required secret env vars are present.
+#   2. Generate a deploy-time wrangler config by overlaying the secrets
+#      onto wrangler.jsonc's `image_vars`.
+#   3. Hand off to `wrangler deploy` with the temporary config.
+#   4. Clean up the temp file in a trap so secrets don't outlive the build.
+#
+# Required env vars (set as **Secrets** in Cloudflare dashboard →
+# Workers → primalprinting → Settings → Build configuration →
+# Variables and Secrets):
+#   - R2_S3_ENDPOINT
+#   - R2_ACCESS_KEY_ID
+#   - R2_SECRET_ACCESS_KEY
+#
+# Optional:
+#   - TURBO_TOKEN  (enables Turborepo Remote Cache; build still works without)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+SOURCE_CONFIG="${REPO_ROOT}/wrangler.jsonc"
+DEPLOY_CONFIG="${REPO_ROOT}/wrangler.deploy.jsonc"
+
+cleanup() {
+	# Always wipe the rendered config — it contains plaintext secrets.
+	rm -f "${DEPLOY_CONFIG}"
+}
+trap cleanup EXIT INT TERM
+
+REQUIRED_SECRETS=(
+	"R2_S3_ENDPOINT"
+	"R2_ACCESS_KEY_ID"
+	"R2_SECRET_ACCESS_KEY"
+)
+
+missing=()
+for var in "${REQUIRED_SECRETS[@]}"; do
+	if [ -z "${!var:-}" ]; then
+		missing+=("${var}")
+	fi
+done
+if [ ${#missing[@]} -gt 0 ]; then
+	echo "✗ scripts/cloudflare-build.sh: missing required env vars:" >&2
+	for var in "${missing[@]}"; do
+		echo "    - ${var}" >&2
+	done
+	echo "" >&2
+	echo "  Set these as Secrets in Cloudflare dashboard:" >&2
+	echo "    Workers & Pages → primalprinting → Settings →" >&2
+	echo "    Build configuration → Variables and Secrets" >&2
+	exit 1
+fi
+
+# ── Render deploy-time wrangler config ────────────────────────────────────
+# Use Node (already on PATH from the build env) to safely merge JSON
+# without depending on `jq`. Logic:
+#   - Read wrangler.jsonc (jsonc-aware: strip /* */ and // comments).
+#   - Locate the first containers[] entry.
+#   - Overlay secret values from the build env onto its `image_vars` map.
+#   - Re-serialize as plain JSON (wrangler accepts both .jsonc and .json).
+#   - Write with mode 0600 so other build-host users can't read secrets.
+echo "→ Rendering deploy-time wrangler config with secrets injected"
+
+SOURCE_CONFIG="${SOURCE_CONFIG}" DEPLOY_CONFIG="${DEPLOY_CONFIG}" node - <<'NODE_SCRIPT'
+const fs = require("node:fs");
+
+const SOURCE = process.env.SOURCE_CONFIG;
+const DEST = process.env.DEPLOY_CONFIG;
+
+// Minimal JSONC stripper — handles /* */ and // comments while preserving
+// strings and backslash escapes. Sufficient for our own config file.
+function stripJsonc(input) {
+	let out = "";
+	let i = 0;
+	const n = input.length;
+	while (i < n) {
+		const c = input[i];
+		const next = input[i + 1];
+		if (c === '"') {
+			out += c;
+			i++;
+			while (i < n) {
+				const cc = input[i];
+				out += cc;
+				if (cc === "\\" && i + 1 < n) { out += input[i + 1]; i += 2; continue; }
+				if (cc === '"') { i++; break; }
+				i++;
+			}
+			continue;
+		}
+		if (c === "/" && next === "/") {
+			while (i < n && input[i] !== "\n") i++;
+			continue;
+		}
+		if (c === "/" && next === "*") {
+			i += 2;
+			while (i < n && !(input[i] === "*" && input[i + 1] === "/")) i++;
+			i += 2;
+			continue;
+		}
+		out += c;
+		i++;
+	}
+	return out.replace(/,(\s*[}\]])/g, "$1");
+}
+
+const config = JSON.parse(stripJsonc(fs.readFileSync(SOURCE, "utf8")));
+
+if (!Array.isArray(config.containers) || config.containers.length === 0) {
+	console.error("✗ wrangler.jsonc has no containers[] entry to inject into");
+	process.exit(1);
+}
+const container = config.containers[0];
+container.image_vars = {
+	...(container.image_vars ?? {}),
+	R2_S3_ENDPOINT: process.env.R2_S3_ENDPOINT,
+	R2_ACCESS_KEY_ID: process.env.R2_ACCESS_KEY_ID,
+	R2_SECRET_ACCESS_KEY: process.env.R2_SECRET_ACCESS_KEY,
+	...(process.env.TURBO_TOKEN ? { TURBO_TOKEN: process.env.TURBO_TOKEN } : {}),
+};
+
+fs.writeFileSync(DEST, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
+
+const SECRET_KEYS = new Set([
+	"R2_ACCESS_KEY_ID",
+	"R2_SECRET_ACCESS_KEY",
+	"TURBO_TOKEN",
+]);
+console.log("  • image_vars merged:");
+for (const [k, v] of Object.entries(container.image_vars)) {
+	console.log("    -", k, "=", SECRET_KEYS.has(k) ? (v ? "<set>" : "<unset>") : v);
+}
+NODE_SCRIPT
+
+# ── Hand off to wrangler ──────────────────────────────────────────────────
+echo "→ Running wrangler deploy with rendered config"
+exec npx wrangler deploy --config "${DEPLOY_CONFIG}"