doppler

Doppler is the secret store this workspace uses across every package. All package.json scripts that need env vars are wrapped in doppler run -c <config> --, and deploys pull secrets out of Doppler into the deployment target (Cloudflare Workers, Fly, GitHub Actions) instead of committing .env files.

Shell env var ordering

When a command needs both shell env vars and Doppler secrets, put the shell env vars before doppler run, never after.

# GOOD
CLOUDFLARE_ENV=preview doppler run -c preview -- vite dev
CLOUDFLARE_ENV=preview doppler run -c preview -- vite build