auto-save: 2026-06-21T18:53:00 (7 files) — .gitignore registry.json registry.json.bak.20260507-122845 routes.json.bak-1779124119 routes.json.bak.20260505-fanout

74dfa6288a0bba772911166e5dffdfc906d035c8 · 2026-06-21 18:53:02 -0700 · Steve Abrams
Files touched

M .gitignore
A .postbubbe-rotation-RESOLVED
A DW-ADMIN-ROTATION-RUNBOOK-2026-06-19.sh
M registry.json
D registry.json.bak.20260507-122845
D routes.json.bak-1779124119
D routes.json.bak.20260505-fanout
Diff

commit 74dfa6288a0bba772911166e5dffdfc906d035c8
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Jun 21 18:53:02 2026 -0700

    auto-save: 2026-06-21T18:53:00 (7 files) — .gitignore registry.json registry.json.bak.20260507-122845 routes.json.bak-1779124119 routes.json.bak.20260505-fanout
---
 .gitignore                              |    2 +
 .postbubbe-rotation-RESOLVED            |    2 +
 DW-ADMIN-ROTATION-RUNBOOK-2026-06-19.sh |  283 +++++++
 registry.json                           |  144 +++-
 registry.json.bak.20260507-122845       |  534 -------------
 routes.json.bak-1779124119              | 1234 -------------------------------
 routes.json.bak.20260505-fanout         |  535 --------------
 7 files changed, 428 insertions(+), 2306 deletions(-)

diff --git a/.gitignore b/.gitignore
index 55cb7b6..8c841b4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,3 +41,5 @@ tmp/
 *~
 copy-of-*
 *.over-narrowed-*
+gmc-sa-*.json
+gmc-sa-146735262.json
diff --git a/.postbubbe-rotation-RESOLVED b/.postbubbe-rotation-RESOLVED
new file mode 100644
index 0000000..7f26d65
--- /dev/null
+++ b/.postbubbe-rotation-RESOLVED
@@ -0,0 +1,2 @@
+RESOLVED 2026-06-12 08:37:00
+rotated: 
diff --git a/DW-ADMIN-ROTATION-RUNBOOK-2026-06-19.sh b/DW-ADMIN-ROTATION-RUNBOOK-2026-06-19.sh
new file mode 100644
index 0000000..7305669
--- /dev/null
+++ b/DW-ADMIN-ROTATION-RUNBOOK-2026-06-19.sh
@@ -0,0 +1,283 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  DW-ADMIN ROTATION RUNBOOK  —  2026-06-19
+# =============================================================================
+#
+#  HARD RULE:  STEVE RUNS THIS.  THE AGENT (VP Security) EXECUTED NOTHING.
+#  ----------------------------------------------------------------------
+#  This file was AUTHORED by the security officer from read-only verification.
+#  Zero ALTER ROLE, zero ssh-mutate, zero fan, zero pm2, zero flag-clear ran.
+#  Every block below is a paste you (Steve) execute by hand, step by step,
+#  reading the VERIFY GATE after each step and STOPPING if it does not pass.
+#
+#  DO NOT pipe this whole file into a shell. It is STEP-GATED on purpose.
+#  Source/paste ONE step, read its verify output, then proceed to the next.
+#
+#  >>> RUN THIS IN A NON-LOGGING SHELL <<<
+#      The new password must never hit shell history. Start a clean shell:
+#          set +o history          # zsh/bash: stop appending to history NOW
+#      …or run the whole session in a subshell and clear history after:
+#          fc -p; <do work>; fc -P            # zsh
+#      At the very end:  unset NEWPW  (Step 4 verify reminds you).
+#
+# -----------------------------------------------------------------------------
+#  WHY THIS RUNBOOK EXISTS (ground truth from read-only verification)
+# -----------------------------------------------------------------------------
+#   * dw_admin rotation is NOT verifiably complete.
+#   * The canonical fan key PG_DW_ADMIN_PASSWORD does NOT exist in the secrets
+#     registry / .env / routes.json — so cli.js has NEVER fanned dw_admin.
+#     (The DSN_REWRITE map in cli.js DOES already know the key:
+#        PG_DW_ADMIN_PASSWORD -> { dsn:'DATABASE_URL', user:'dw_admin' }
+#      but with no routes.json entry there are no destinations to write to.)
+#   * Old credential 'DW2024SecurePass' is STILL LIVE in 4 local .env.local
+#     DATABASE_URL DSNs (all 127.0.0.1 / LOCAL Mac2 Postgres):
+#         ~/Projects/Norma/.env.local                       (db: sdcc)
+#         ~/Projects/StudentLoanTracker/.env.local          (db: dw_unified)
+#         ~/Projects/ClawCoder/.env.local                   (db: clawcoder)
+#         ~/Projects/Designer-Wallcoverings/DW-Programming/ImportNewSkufromURL/.env.local (db: dw_unified)
+#     …plus ~45 hardcoded source refs (the secret-strip backlog — DO-LAST).
+#   * Prod (Kamatera) compromised flag = a HARDCODED literal at
+#         ~/cncp-starter/server.js:3936   out.prod = { status: 'compromised' }
+#     (DO-LAST — clear only after 2–4 verify clean.)
+#   * Prod app DSN fan-out is SSH-manual (ROTATION-PRESTAGE.md step 3b).
+#   * ROLLBACK SOURCE = the OLD password lives on prod ONLY in
+#         /root/.pm2/dump.pm2     (NOT in any .env, NOT in the secrets registry)
+#
+# -----------------------------------------------------------------------------
+#  ROLLBACK SUMMARY (if anything FATALs after a new-pw ALTER)
+# -----------------------------------------------------------------------------
+#   Revert the role to the OLD pw that prod apps still expect. The OLD pw is
+#   recoverable from /root/.pm2/dump.pm2 on Kamatera (the DATABASE_URL inside a
+#   pm2 env block). Re-ALTER dw_admin back to that OLD pw via the same
+#   stdin-piped pattern (NEVER -c), then pm2 restart. Detailed one-liner is in
+#   Step 4 (4R). Local Mac2 rollback = re-ALTER local role to OLD pw the same
+#   way. Because every step is verify-gated, you roll back the SINGLE step that
+#   failed, not the whole sequence.
+#
+# -----------------------------------------------------------------------------
+#  PRE-FLIGHT CHECKLIST  (Step 1 — read-only, safe to run as-is)
+# -----------------------------------------------------------------------------
+#  Run Step 1 first. All three must be GREEN before you mint anything.
+# =============================================================================
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  STEP 1 — PRE-FLIGHT  (read-only; nothing mutates)
+# ─────────────────────────────────────────────────────────────────────────────
+#  1a. Kamatera reachable over the canonical ssh alias?
+#  1b. dump.pm2 (the OLD-pw rollback source) present + non-empty on prod?
+#  1c. A CURRENT dw_unified pg_dump exists as a safety net (NOT 0-byte/stale)?
+#
+#  PASTE:
+:
+ssh my-server 'echo "ssh OK as $(whoami)@$(hostname)"' \
+  && ssh my-server 'ls -l /root/.pm2/dump.pm2 && test -s /root/.pm2/dump.pm2 && echo "dump.pm2 PRESENT+nonempty"' \
+  && ssh my-server 'ls -lt /root/backups/db/*dw_unified*.{dump,sql,sql.gz} 2>/dev/null | head -3; echo "(confirm newest is today-ish and NOT 0 bytes)"'
+#  NOTE (verified 2026-06-19): dumps live in /root/backups/db/ (the daily 03:00
+#  nightly writes dw_unified_YYYY-MM-DD_0300.dump there; newest verified ~1.49GB).
+#
+#  VERIFY GATE 1:  All three lines printed, dump.pm2 is non-empty, and a fresh
+#  dw_unified dump exists. If ANY is missing — STOP. Do not mint a new pw with
+#  no rollback source and no safety-net dump. (If the dump is stale, take one
+#  first:  ssh my-server "sudo -u postgres pg_dump -Fc dw_unified > /root/backups/db/dw_unified-$(date +%F).dump" )
+# ═════════════════════════════════════════════════════════════════════════════
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  STEP 2 — MINT NEWPW + ALTER ROLE on BOTH prod AND local Mac2
+# ─────────────────────────────────────────────────────────────────────────────
+#  Secret hygiene baked in:
+#   * NEWPW minted into a shell var at runtime — never typed, never a literal.
+#   * Only last4 ever printed:  ${NEWPW: -4}
+#   * Every ALTER is PIPED OVER STDIN (printf | ssh "sudo -u postgres psql"),
+#     NOT psql -c "…" — so the password never appears in ps/argv on Mac2 OR
+#     on the remote (an -c arg shows in the remote process table).
+#   * Connect to db 'postgres' for the prod ALTER (always present; role-level op).
+#   * VERIFY by opening a FRESH connection with the NEW pw. NEVER probe the old
+#     pw — a failed auth with the old credential trips security-monitor.sh.
+#
+#  PASTE (2a — mint; prints last4 only):
+:
+NEWPW="$(openssl rand -base64 30 | tr -d '/+=' | cut -c1-28)"
+echo "NEWPW minted, last4=${NEWPW: -4}  (full value is in the shell var ONLY)"
+#
+#  PASTE (2b — ALTER on PROD via ssh, stdin-piped, no -c, connect db=postgres):
+:
+printf "ALTER ROLE dw_admin WITH PASSWORD '%s';\n" "$NEWPW" \
+  | ssh my-server "sudo -u postgres psql -d postgres -v ON_ERROR_STOP=1 -q -f -" \
+  && echo "PROD ALTER applied (last4=${NEWPW: -4})"
+#
+#  PASTE (2c — ALTER on LOCAL Mac2, stdin-piped, no -c):
+:
+printf "ALTER ROLE dw_admin WITH PASSWORD '%s';\n" "$NEWPW" \
+  | psql -d postgres -v ON_ERROR_STOP=1 -q -f - \
+  && echo "LOCAL Mac2 ALTER applied (last4=${NEWPW: -4})"
+#
+#  VERIFY GATE 2 — prove the NEW pw works with a fresh connection on EACH.
+#  (Uses PGPASSWORD only for these probe sub-shells; never echoes the value.)
+#  PASTE (2v):
+:
+echo "--- prod new-pw probe ---"
+ssh my-server "PGPASSWORD='$NEWPW' psql -h 127.0.0.1 -U dw_admin -d dw_unified -tAc 'select current_user, 1'" \
+  && echo "PROD new-pw: OK"
+echo "--- local new-pw probe ---"
+PGPASSWORD="$NEWPW" psql -h 127.0.0.1 -U dw_admin -d dw_unified -tAc "select current_user, 1" \
+  && echo "LOCAL new-pw: OK"
+#
+#  VERIFY GATE 2:  BOTH probes return  dw_admin|1  and print "OK". If either
+#  fails — STOP. Do NOT proceed to fan-out; the DB and the DSNs would diverge.
+#  (Roll back the side that failed via Step 4's 4R pattern with the OLD pw.)
+# ═════════════════════════════════════════════════════════════════════════════
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  STEP 3 — REGISTER fan key PG_DW_ADMIN_PASSWORD + fan to LOCAL .env.local DSNs
+# ─────────────────────────────────────────────────────────────────────────────
+#  This is the repair that has NEVER run for dw_admin. cli.js already has the
+#  DSN_REWRITE entry; it just has NO routes.json destinations, so first you
+#  MUST add the routes.json entry, THEN register the key so the fan can write.
+#
+#  3-PRE — ADD THE MISSING routes.json ENTRY (it does not exist today).
+#  Open ~/Projects/secrets-manager/routes.json and add this under "services":
+#  ───────────────────────────────────────────────────────────────────────────
+#    "PG_DW_ADMIN_PASSWORD": {
+#      "label": "Postgres dw_admin role password (local Mac2 + prod via 3b)",
+#      "destinations": [
+#        { "type": "env_file", "path": "~/Projects/Norma/.env.local" },
+#        { "type": "env_file", "path": "~/Projects/StudentLoanTracker/.env.local" },
+#        { "type": "env_file", "path": "~/Projects/ClawCoder/.env.local" },
+#        { "type": "env_file", "path": "~/Projects/Designer-Wallcoverings/DW-Programming/ImportNewSkufromURL/.env.local" }
+#      ]
+#    }
+#  ───────────────────────────────────────────────────────────────────────────
+#  NOTE: no per-dest "dsn" is needed — cli.js's DSN_REWRITE map already maps
+#  PG_DW_ADMIN_PASSWORD -> { dsn:'DATABASE_URL', user:'dw_admin' }, so each
+#  env_file dest gets its DATABASE_URL password surgically rewritten (the rest
+#  of the DSN — host/port/db/user — is preserved). All 4 are LOCAL 127.0.0.1.
+#  The Desktop copy (~/Desktop/site-factory.env) is NOT a destination — it was
+#  RETIRED 2026-06-11 (DTD verdict A); cli.js no longer fans to it. Do not add
+#  it back. The master ~/Projects/secrets-manager/.env IS written by the fan.
+#
+#  PASTE (3a — sanity that the JSON still parses after your edit):
+:
+node -e 'JSON.parse(require("fs").readFileSync(process.env.HOME+"/Projects/secrets-manager/routes.json","utf8")); console.log("routes.json parses OK")'
+#
+#  PASTE (3b — register + fan the key, value over STDIN, never in argv):
+:
+printf "PG_DW_ADMIN_PASSWORD=%s\n" "$NEWPW" \
+  | node ~/Projects/secrets-manager/cli.js import-paste
+#  (import-paste reads KEY=VALUE from stdin → writes master .env, then fans to
+#   the 4 env_file destinations, surgically rewriting each DATABASE_URL pw.
+#   If a labeled key is required and import-paste balks, the equivalent is:
+#     node ~/Projects/secrets-manager/cli.js add PG_DW_ADMIN_PASSWORD  — and
+#     paste the value when prompted, so it still never lands in argv/history.)
+#
+#  VERIFY GATE 3 — the 4 DSNs now carry the NEW last4 and ZERO old pw remain.
+#  PASTE (3v):
+:
+echo "--- new last4 should appear in all 4 DATABASE_URL DSNs ---"
+for f in ~/Projects/Norma/.env.local \
+         ~/Projects/StudentLoanTracker/.env.local \
+         ~/Projects/ClawCoder/.env.local \
+         "$HOME/Projects/Designer-Wallcoverings/DW-Programming/ImportNewSkufromURL/.env.local"; do
+  grep -q "DATABASE_URL" "$f" \
+    && printf "%s -> dsn-pw-last4=%s\n" "$f" \
+       "$(grep -m1 DATABASE_URL "$f" | sed -E 's#.*://[^:]+:([^@]+)@.*#\1#' | tail -c 5)"
+done
+echo "--- there must be NO remaining DW2024SecurePass in the 4 files ---"
+grep -l "DW2024SecurePass" \
+  ~/Projects/Norma/.env.local \
+  ~/Projects/StudentLoanTracker/.env.local \
+  ~/Projects/ClawCoder/.env.local \
+  "$HOME/Projects/Designer-Wallcoverings/DW-Programming/ImportNewSkufromURL/.env.local" \
+  2>/dev/null && echo "!! OLD PW STILL PRESENT — STOP" || echo "clean: no DW2024SecurePass in the 4 .env.local"
+#
+#  VERIFY GATE 3:  all 4 DSNs show the NEW last4 (matches ${NEWPW: -4}) AND the
+#  "clean: no DW2024SecurePass" line printed. If any file still has the old pw,
+#  or a last4 mismatches — STOP and re-check the routes.json entry/destinations.
+# ═════════════════════════════════════════════════════════════════════════════
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  STEP 4 — PROD-SIDE MANUAL FAN (ROTATION-PRESTAGE.md step 3b) + pm2 restart
+# ─────────────────────────────────────────────────────────────────────────────
+#  The local fan (Step 3) does NOT touch prod app DSNs. Prod apps read their
+#  DATABASE_URL from pm2 env / their own .env on Kamatera. Rewrite those DSNs
+#  to the NEW pw, then pm2 restart with --update-env so the running procs pick
+#  it up. Keep the OLD-pw rollback one-liner (4R) on hand BEFORE you restart.
+#
+#  PASTE (4a — surface what prod DSNs/apps exist; READ-ONLY, decide scope):
+:
+ssh my-server 'pm2 jlist | node -e "let d=JSON.parse(require(\"fs\").readFileSync(0));for(const p of d){const u=(p.pm2_env&&p.pm2_env.DATABASE_URL)||\"\";if(u.includes(\"dw_admin\"))console.log(p.name, u.replace(/:[^:@]+@/,\":***@\"))}"'
+#  (This lists each pm2 app whose DATABASE_URL uses dw_admin, password masked.
+#   Use the output to confirm exactly which apps need the new pw. Follow the
+#   per-app DSN-rewrite procedure in ROTATION-PRESTAGE.md step 3b — rewrite the
+#   prod-side DATABASE_URL for each, value piped/edited on the box, never in a
+#   ps-visible -c/argv. This runbook intentionally does NOT auto-generate the
+#   per-app sed; do it from the masked list above so you touch only real apps.)
+#
+#  PASTE (4b — after DSNs rewritten on prod, restart with fresh env):
+:
+ssh my-server 'pm2 restart all --update-env && pm2 save'
+#
+#  VERIFY GATE 4 — fleet is online and NOT auth-failing on the new pw.
+#  PASTE (4v):
+:
+echo "--- pm2 status (expect all online, 0 fresh restarts climbing) ---"
+ssh my-server 'pm2 list'
+echo "--- look for FATAL auth / password errors in recent logs ---"
+ssh my-server 'pm2 logs --nostream --lines 40 2>/dev/null | grep -Ei "password authentication failed|FATAL.*dw_admin|role .dw_admin." || echo "no auth failures in tail"'
+#
+#  VERIFY GATE 4:  pm2 list shows all apps 'online' (no crash-loop / climbing
+#  restart counter) AND the log grep prints "no auth failures in tail". If apps
+#  are FATAL-auth crash-looping — ROLL BACK immediately with 4R below.
+#
+#  ── 4R — ROLLBACK ONE-LINER (revert role to the OLD pw apps still expect) ──
+#  The OLD pw lives in /root/.pm2/dump.pm2. Recover it, then re-ALTER the role
+#  back to it (stdin-piped, never -c), then restart. PASTE only on a FATAL:
+#    OLDPW=$(ssh my-server "grep -o 'dw_admin:[^@]*@' /root/.pm2/dump.pm2 | head -1 | sed -E 's/dw_admin:(.*)@/\1/'")
+#    printf "ALTER ROLE dw_admin WITH PASSWORD '%s';\n" "$OLDPW" \
+#      | ssh my-server "sudo -u postgres psql -d postgres -v ON_ERROR_STOP=1 -q -f -"
+#    ssh my-server 'pm2 restart all --update-env'
+#    # then revert local Mac2 the same way and unwind Step 3 (re-fan OLD pw).
+#
+#  ── CLEANUP (run once Step 4 verifies clean) ──
+#  PASTE:
+:
+unset NEWPW
+echo "NEWPW unset. If you used 'set +o history', you may re-enable history now."
+#  Also: delete THIS runbook when done (see footer) — it is secret-adjacent.
+# ═════════════════════════════════════════════════════════════════════════════
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  STEP 5 — DO-LAST (stub): secret-strip the ~45 hardcoded refs
+# ─────────────────────────────────────────────────────────────────────────────
+#  ONLY after Steps 2–4 verify clean. Strip the ~45 source/doc refs that still
+#  contain DW2024SecurePass (env-first, no rotation, no deploy).
+#     →  use the `secret-strip` skill  (Skill: secret-strip)  on ~/Projects
+#  Find current refs first:  grep -rl "DW2024SecurePass" ~/Projects
+#  (Not expanded here — this is hygiene, not part of the live rotation.)
+# ─────────────────────────────────────────────────────────────────────────────
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  STEP 6 — DO-LAST (stub): clear the compromised flag + remaining open creds
+# ─────────────────────────────────────────────────────────────────────────────
+#  ONLY after 2–5 verify clean. The Kamatera "compromised" status is a
+#  HARDCODED literal — edit it from compromised to clean once rotation is done:
+#     →  ~/cncp-starter/server.js : 3936     out.prod = { status: 'compromised' }
+#  Then address any other still-open creds surfaced during the strip.
+#  (Not expanded — gate behind a fully-verified rotation.)
+# ─────────────────────────────────────────────────────────────────────────────
+
+
+# =============================================================================
+#  WHEN DONE:  rm THIS FILE — do NOT git-commit it.
+#  ----------------------------------------------------------------------------
+#  This .sh is secret-adjacent (it scaffolds a live-credential rotation). The
+#  repo's .gitignore already excludes .env* but does NOT exclude *.sh, so this
+#  file is git-trackable — never `git add` it. After a clean rotation:
+#       rm ~/Projects/secrets-manager/DW-ADMIN-ROTATION-RUNBOOK-2026-06-19.sh
+#  (or move it out of the repo entirely). Prefer rm over commit.
+# =============================================================================
diff --git a/registry.json b/registry.json
index 75c3bdb..1186e92 100644
--- a/registry.json
+++ b/registry.json
@@ -186,14 +186,13 @@
       ]
     },
     "GEMINI_API_KEY": {
-      "digest": "k720:4295091b",
+      "digest": "-mvA:8de08c8a",
       "label": "Google Gemini API Key",
-      "last_updated": "2026-05-02T15:34:58.966Z",
+      "last_updated": "2026-06-12T20:29:58.727Z",
       "validated": true,
       "verify_status": 200,
       "written_to": [
         "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
         "/Users/stevestudio2/Projects/Letsbegin/.env.local",
         "/Users/stevestudio2/Projects/Bertha/kalshi-dash/.env",
         "/Users/stevestudio2/.claude/skills/ai-analyzer/.env",
@@ -750,6 +749,145 @@
         "/Users/stevestudio2/Projects/wallco-ai/.env",
         "/Users/stevestudio2/Projects/animate-museum-posts/.env"
       ]
+    },
+    "WALLCO_AI_BACKUP_20260529_PASSPHRASE": {
+      "digest": "IFSK:805dbb57",
+      "label": "WALLCO_AI_BACKUP_20260529_PASSPHRASE",
+      "last_updated": "2026-05-29T15:19:39.700Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env",
+        "/Users/stevestudio2/Desktop/site-factory.env"
+      ]
+    },
+    "WALLCO_AI_ADMIN_TOKEN": {
+      "digest": "497b:4db9d5d3",
+      "label": "WALLCO_AI_ADMIN_TOKEN",
+      "last_updated": "2026-05-29T15:26:36.538Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env",
+        "/Users/stevestudio2/Desktop/site-factory.env"
+      ]
+    },
+    "GRANT_AUTH_USERNAME": {
+      "digest": "dmin:8c6976e5",
+      "label": "GRANT_AUTH_USERNAME",
+      "last_updated": "2026-06-01T21:01:37.731Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env",
+        "/Users/stevestudio2/Desktop/site-factory.env"
+      ]
+    },
+    "GRANT_AUTH_PASSWORD": {
+      "digest": "4aJh:7405eb02",
+      "label": "GRANT_AUTH_PASSWORD",
+      "last_updated": "2026-06-01T21:01:37.733Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env",
+        "/Users/stevestudio2/Desktop/site-factory.env"
+      ]
+    },
+    "DW_ADMIN_PG_PASSWORD": {
+      "digest": "fWdg:1e3383c0",
+      "label": "DW_ADMIN_PG_PASSWORD",
+      "last_updated": "2026-06-04T05:00:20.392Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env",
+        "/Users/stevestudio2/Desktop/site-factory.env"
+      ]
+    },
+    "KAMATERA_ORIGIN_IP": {
+      "digest": ".125:81cca1f1",
+      "label": "KAMATERA_ORIGIN_IP",
+      "last_updated": "2026-06-11T17:24:46.007Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env"
+      ]
+    },
+    "ANTHROPIC_API_KEY": {
+      "digest": "7AAA:798d801c",
+      "label": "Anthropic API Key",
+      "last_updated": "2026-06-11T17:24:46.281Z",
+      "validated": true,
+      "verify_status": 400,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env",
+        "/Users/stevestudio2/Projects/Letsbegin/.env.local",
+        "/Users/stevestudio2/Projects/dear-bubbe-nextjs/.env"
+      ]
+    },
+    "META_ACCESS_TOKEN": {
+      "digest": "c8ZD:f65864d4",
+      "label": "META_ACCESS_TOKEN",
+      "last_updated": "2026-06-15T19:04:39.146Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env",
+        "/Users/stevestudio2/Projects/marketing-command-center/.env"
+      ]
+    },
+    "DW_ADMIN_DB_PASSWORD": {
+      "digest": "22WF:7397bbbe",
+      "label": "DW_ADMIN_DB_PASSWORD",
+      "last_updated": "2026-06-16T16:55:26.256Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env"
+      ]
+    },
+    "SHOPIFY_DRAFT_TOKEN": {
+      "digest": "a43b:50f4d28f",
+      "label": "Shopify Admin token (full access incl. write_draft_orders) — DW mural PDP custom-size checkout",
+      "last_updated": "2026-06-18T15:12:46.754Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env",
+        "/Users/stevestudio2/Projects/designerwallcoverings/.env"
+      ]
+    },
+    "SLACK_BOT_TOKEN": {
+      "digest": "OlqR:20464325",
+      "label": "SLACK_BOT_TOKEN",
+      "last_updated": "2026-06-21T21:24:38.100Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env"
+      ]
+    },
+    "SLACK_TEAM_ID": {
+      "digest": "1G7J:db7ace49",
+      "label": "SLACK_TEAM_ID",
+      "last_updated": "2026-06-21T21:24:38.137Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env"
+      ]
+    },
+    "SLACK_REPORTS_CHANNEL": {
+      "digest": "ADND:80e3aeab",
+      "label": "SLACK_REPORTS_CHANNEL",
+      "last_updated": "2026-06-21T23:43:19.588Z",
+      "validated": false,
+      "verify_status": null,
+      "written_to": [
+        "/Users/stevestudio2/Projects/secrets-manager/.env"
+      ]
     }
   }
 }
\ No newline at end of file
diff --git a/registry.json.bak.20260507-122845 b/registry.json.bak.20260507-122845
deleted file mode 100644
index 9aef80a..0000000
--- a/registry.json.bak.20260507-122845
+++ /dev/null
@@ -1,534 +0,0 @@
-{
-  "_comment": "Registry of every secret. Values themselves never appear here — only digests + destinations. Updated by cli.js.",
-  "secrets": {
-    "DPLA_API_KEY": {
-      "digest": "ecd5:7d670175",
-      "label": "Digital Public Library of America API Key",
-      "last_updated": "2026-04-30T18:23:59.835Z",
-      "validated": true,
-      "verify_status": 200,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/wholivedthere/.env",
-        "/Users/stevestudio2/Projects/claimmyaddress/.env",
-        "/Users/stevestudio2/Projects/bubbesblock/.env",
-        "/Users/stevestudio2/.claude/skills/la-research-agent/.env"
-      ]
-    },
-    "GODADDY_API_KEY": {
-      "digest": "acsF:96974d0c",
-      "label": "GoDaddy API Key",
-      "last_updated": "2026-04-30T18:50:35.250Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/.claude.json#mcpServers.domain-suite.env.GODADDY_API_KEY"
-      ]
-    },
-    "GODADDY_API_SECRET": {
-      "digest": "Vnej:31492271",
-      "label": "GoDaddy API Secret",
-      "last_updated": "2026-04-30T18:50:40.119Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/.claude.json#mcpServers.domain-suite.env.GODADDY_API_SECRET"
-      ]
-    },
-    "BROWSERBASE_API_KEY": {
-      "digest": "lOB8:e5e8c875",
-      "label": "Browserbase API Key",
-      "last_updated": "2026-04-30T18:50:42.047Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/.claude/skills/browserbase/.env"
-      ]
-    },
-    "BROWSERBASE_PROJECT_ID": {
-      "digest": "c840:29be6dca",
-      "label": "Browserbase Project ID",
-      "last_updated": "2026-04-30T18:50:43.778Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/.claude/skills/browserbase/.env"
-      ]
-    },
-    "CLOUDFLARE_API_TOKEN": {
-      "digest": "lYcL:951aa6d7",
-      "label": "Cloudflare API Token",
-      "last_updated": "2026-04-30T18:50:52.016Z",
-      "validated": true,
-      "verify_status": 200,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/site-factory/.env",
-        "/Users/stevestudio2/.claude/skills/cloudflare-manager/.env",
-        "/Users/stevestudio2/.claude/skills/setup-domains/.env",
-        "/Users/stevestudio2/.claude/skills/domain-setup/.env"
-      ]
-    },
-    "ANTHROPIC_API_KEY": {
-      "digest": "7AAA:798d801c",
-      "label": "Anthropic API Key",
-      "last_updated": "2026-04-30T18:52:00.895Z",
-      "validated": true,
-      "verify_status": 400,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/Letsbegin/.env.local",
-        "/Users/stevestudio2/Projects/dear-bubbe-nextjs/.env"
-      ]
-    },
-    "STRIPE_SECRET_KEY": {
-      "digest": "8LQ0:fe981600",
-      "label": "Stripe Secret Key",
-      "last_updated": "2026-05-01T06:23:30.081Z",
-      "validated": true,
-      "verify_status": 200,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/site-factory/.env",
-        "/Users/stevestudio2/Projects/site-factory/sites/wholivedthere.com/app/.env.local",
-        "/Users/stevestudio2/Projects/site-factory/sites/bubbesblock.com/app/.env.local",
-        "/Users/stevestudio2/Projects/site-factory/sites/claimmyaddress.com/app/.env.local",
-        "/Users/stevestudio2/Projects/lawyer-directory-builder/.env",
-        "/Users/stevestudio2/Projects/professional-directory/.env"
-      ]
-    },
-    "STRIPE_PUBLISHABLE_KEY": {
-      "digest": "wzmV:944477ab",
-      "label": "Stripe Publishable Key",
-      "last_updated": "2026-05-01T06:23:48.697Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/site-factory/.env",
-        "/Users/stevestudio2/Projects/site-factory/sites/wholivedthere.com/app/.env.local",
-        "/Users/stevestudio2/Projects/site-factory/sites/bubbesblock.com/app/.env.local",
-        "/Users/stevestudio2/Projects/site-factory/sites/claimmyaddress.com/app/.env.local",
-        "/Users/stevestudio2/Projects/lawyer-directory-builder/.env",
-        "/Users/stevestudio2/Projects/professional-directory/.env"
-      ]
-    },
-    "ELEVENLABS_API_KEY": {
-      "digest": "365a:7f1a7de6",
-      "label": "ElevenLabs Voice Synthesis API Key",
-      "last_updated": "2026-05-06T21:37:52.553Z",
-      "validated": true,
-      "verify_status": 200,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/dear-bubbe-nextjs/.env.local",
-        "ssh:root@45.61.58.125:/root/Projects/dear-bubbe-nextjs/.env.local"
-      ]
-    },
-    "OPENAI_API_KEY": {
-      "digest": "FYwA:8ad69c60",
-      "label": "OpenAI API Key",
-      "last_updated": "2026-05-01T05:54:19.819Z",
-      "validated": true,
-      "verify_status": 200,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/dear-bubbe-nextjs/.env.local",
-        "ssh:root@45.61.58.125:/root/Projects/dear-bubbe-nextjs/.env.local"
-      ]
-    },
-    "LAWYER_DIRECTORY_ADMIN_PASSWORD": {
-      "digest": "drfo:4d084bc5",
-      "label": "LAWYER_DIRECTORY_ADMIN_PASSWORD",
-      "last_updated": "2026-05-01T05:55:55.887Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "ADMIN_KEY": {
-      "digest": "ncuo:0ef5973a",
-      "label": "ADMIN_KEY",
-      "last_updated": "2026-05-02T06:23:40.535Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_TIER_WEBHOOK_SECRET": {
-      "digest": "Styd:882d3909",
-      "label": "Stripe Tier-Subscription Webhook Signing Secret (Counsel & Bar Lawyer Pro $29/mo)",
-      "last_updated": "2026-05-02T14:34:01.676Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/lawyer-directory-builder/.env"
-      ]
-    },
-    "STRIPE_PRICE_LAWYER_PRO_MONTHLY": {
-      "digest": "cn1m:766a0822",
-      "label": "Stripe Price ID (public): Counsel & Bar Lawyer Pro $29/mo recurring",
-      "last_updated": "2026-05-02T15:27:15.670Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/lawyer-directory-builder/.env"
-      ]
-    },
-    "GEMINI_API_KEY": {
-      "digest": "k720:4295091b",
-      "label": "Google Gemini API Key",
-      "last_updated": "2026-05-02T15:34:58.966Z",
-      "validated": true,
-      "verify_status": 200,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/Letsbegin/.env.local",
-        "/Users/stevestudio2/Projects/Bertha/kalshi-dash/.env",
-        "/Users/stevestudio2/.claude/skills/ai-analyzer/.env",
-        "/Users/stevestudio2/.claude/skills/enrich-ai-tags/.env"
-      ]
-    },
-    "CLOUDFLARE_ACCOUNT_ID": {
-      "digest": "b1c3:2beb4f25",
-      "label": "CLOUDFLARE_ACCOUNT_ID",
-      "last_updated": "2026-05-02T15:49:51.136Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "MOONSHOT_API_KEY": {
-      "digest": "XiYg:b579d15d",
-      "label": "Moonshot AI / Kimi K2 API Key",
-      "last_updated": "2026-05-03T18:02:00.806Z",
-      "validated": true,
-      "verify_status": 200,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/claude-codex-meeting/.env",
-        "/Users/stevestudio2/.claude/skills/claude-codex/.env"
-      ]
-    },
-    "SMB_BUILDER_ADMIN_TOKEN": {
-      "digest": "LW2g:83fe2ef1",
-      "label": "SMB_BUILDER_ADMIN_TOKEN",
-      "last_updated": "2026-05-04T06:20:37.081Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "FOURSQUARE_PORTAL_PASSWORD": {
-      "digest": "B8Lw:ef931f63",
-      "label": "FOURSQUARE_PORTAL_PASSWORD",
-      "last_updated": "2026-05-05T02:31:28.289Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "BRAVE_SEARCH_API_KEY": {
-      "digest": "RaPY:700093d6",
-      "label": "Brave Search API (Web)",
-      "last_updated": "2026-05-05T16:35:28.194Z",
-      "validated": true,
-      "verify_status": 200,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/_ventura-recon/.env"
-      ]
-    },
-    "PURELYMAIL_API_TOKEN": {
-      "digest": "8941:4aad735a",
-      "label": "PurelyMail API Token",
-      "last_updated": "2026-05-05T19:32:32.949Z",
-      "validated": true,
-      "verify_status": 200,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/site-factory/.env",
-        "/Users/stevestudio2/Projects/ventura-corridor/.env",
-        "/Users/stevestudio2/Projects/purelymail-mcp/.env",
-        "/Users/stevestudio2/.claude.json#mcpServers.purelymail.env.PURELYMAIL_API_TOKEN"
-      ]
-    },
-    "GRANT_APP_DB_PASSWORD": {
-      "digest": "XnAD:4ab19dd0",
-      "label": "GRANT_APP_DB_PASSWORD",
-      "last_updated": "2026-05-06T00:40:58.290Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "FREDDY_APP_DB_PASSWORD": {
-      "digest": "HXFr:1a5bec1b",
-      "label": "FREDDY_APP_DB_PASSWORD",
-      "last_updated": "2026-05-06T01:16:44.236Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "PATTY_APP_DB_PASSWORD": {
-      "digest": "kFg8:5dd746ce",
-      "label": "PATTY_APP_DB_PASSWORD",
-      "last_updated": "2026-05-06T01:18:38.007Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "POPPY_SESSION_SECRET": {
-      "digest": "d5ae:776b130c",
-      "label": "POPPY_SESSION_SECRET",
-      "last_updated": "2026-05-06T02:07:11.092Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "LINKEDIN_CLIENT_ID": {
-      "digest": "brc3:0fc72fb0",
-      "label": "LinkedIn OAuth Client ID — \"For Claude - 5-6-26\" app, bound to Designer Wallcoverings Page",
-      "last_updated": "2026-05-06T16:58:45.348Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/NationalPaperHangers/.env"
-      ]
-    },
-    "LINKEDIN_CLIENT_SECRET": {
-      "digest": "aA==:b14f96fb",
-      "label": "LinkedIn OAuth Client Secret — \"For Claude - 5-6-26\" app, bound to Designer Wallcoverings Page",
-      "last_updated": "2026-05-06T16:58:45.350Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env",
-        "/Users/stevestudio2/Projects/NationalPaperHangers/.env"
-      ]
-    },
-    "INFO_VENTURACLAW_PASSWORD": {
-      "digest": "gclo:f811f350",
-      "label": "INFO_VENTURACLAW_PASSWORD",
-      "last_updated": "2026-05-06T17:11:24.980Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "INFO_VENTURACLAW_COM_PASSWORD": {
-      "digest": "yClk:b1af4d98",
-      "label": "INFO_VENTURACLAW_COM_PASSWORD",
-      "last_updated": "2026-05-06T18:06:43.875Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "VENTURACLAW_ADMIN_PASSWORD": {
-      "digest": "zJdw:ea12fb20",
-      "label": "VENTURACLAW_ADMIN_PASSWORD",
-      "last_updated": "2026-05-06T19:14:22.955Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "VENTURACLAW_DEMO_PASSWORD": {
-      "digest": "jm9n:d2d935cb",
-      "label": "VENTURACLAW_DEMO_PASSWORD",
-      "last_updated": "2026-05-06T19:14:22.956Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "INFO_NATIONALPAPERHANGERS_COM_PASSWORD": {
-      "digest": "nfo!:3e438ad2",
-      "label": "INFO_NATIONALPAPERHANGERS_COM_PASSWORD",
-      "last_updated": "2026-05-06T20:17:22.985Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_NPH_WEBHOOK_SECRET": {
-      "digest": "xF8E:6c227cc4",
-      "label": "STRIPE_NPH_WEBHOOK_SECRET",
-      "last_updated": "2026-05-06T21:47:14.948Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_PRICE_PRO_MONTH": {
-      "digest": "hDvn:eff9d560",
-      "label": "STRIPE_PRICE_PRO_MONTH",
-      "last_updated": "2026-05-06T21:47:14.981Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_PRICE_PRO_YEAR": {
-      "digest": "D2ll:52ba2714",
-      "label": "STRIPE_PRICE_PRO_YEAR",
-      "last_updated": "2026-05-06T21:47:15.013Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_PRICE_SIGNATURE_MONTH": {
-      "digest": "KWdO:398e0346",
-      "label": "STRIPE_PRICE_SIGNATURE_MONTH",
-      "last_updated": "2026-05-06T21:47:15.046Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_PRICE_SIGNATURE_YEAR": {
-      "digest": "raja:4aeb380d",
-      "label": "STRIPE_PRICE_SIGNATURE_YEAR",
-      "last_updated": "2026-05-06T21:47:15.079Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_PRICE_ENTERPRISE_MONTH": {
-      "digest": "g84X:0b754600",
-      "label": "STRIPE_PRICE_ENTERPRISE_MONTH",
-      "last_updated": "2026-05-06T21:47:15.112Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "VCL_KAMATERA_PG_PASSWORD": {
-      "digest": "f4de:73ff66aa",
-      "label": "VCL_KAMATERA_PG_PASSWORD",
-      "last_updated": "2026-05-06T23:25:09.149Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_VCL_WEBHOOK_SECRET": {
-      "digest": "L8sU:4cfc2f5f",
-      "label": "STRIPE_VCL_WEBHOOK_SECRET",
-      "last_updated": "2026-05-06T23:38:56.170Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_PRICE_VCL_STARTER_MONTH": {
-      "digest": "53YX:d741657a",
-      "label": "STRIPE_PRICE_VCL_STARTER_MONTH",
-      "last_updated": "2026-05-06T23:38:56.203Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_PRICE_VCL_STANDARD_MONTH": {
-      "digest": "BEPC:1c4b822e",
-      "label": "STRIPE_PRICE_VCL_STANDARD_MONTH",
-      "last_updated": "2026-05-06T23:38:56.237Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    },
-    "STRIPE_PRICE_VCL_PREMIER_MONTH": {
-      "digest": "h0Es:7a66ea0d",
-      "label": "STRIPE_PRICE_VCL_PREMIER_MONTH",
-      "last_updated": "2026-05-06T23:38:56.270Z",
-      "validated": false,
-      "verify_status": null,
-      "written_to": [
-        "/Users/stevestudio2/Projects/secrets-manager/.env",
-        "/Users/stevestudio2/Desktop/site-factory.env"
-      ]
-    }
-  }
-}
\ No newline at end of file
diff --git a/routes.json.bak-1779124119 b/routes.json.bak-1779124119
deleted file mode 100644
index 0b64e60..0000000
--- a/routes.json.bak-1779124119
+++ /dev/null
@@ -1,1234 +0,0 @@
-{
-  "_comment": "Per-secret routing table. Each entry: master + extra destinations. Master is implicit at ~/Projects/secrets-manager/.env + ~/Desktop/site-factory.env.",
-  "services": {
-    "GOOGLE_PLACES_API_KEY": {
-      "label": "Google Places API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://maps.googleapis.com/maps/api/place/findplacefromtext/json?input=Tito%27s+Tacos+Culver+City&inputtype=textquery&fields=place_id&key=__VALUE__",
-        "auth": "querystring"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/restaurant-directory/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/professional-directory/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/animals/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        }
-      ]
-    },
-    "BRAVE_SEARCH_API_KEY": {
-      "label": "Brave Search API (Web)",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.search.brave.com/res/v1/web/search?q=test&count=1",
-        "auth": "header",
-        "headerName": "X-Subscription-Token"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/_ventura-recon/.env"
-        }
-      ]
-    },
-    "MOONSHOT_API_KEY": {
-      "label": "Moonshot AI / Kimi K2 API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.moonshot.ai/v1/models",
-        "auth": "bearer"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/claude-codex-meeting/.env"
-        },
-        {
-          "type": "skill",
-          "name": "claude-codex"
-        }
-      ]
-    },
-    "CLOUDFLARE_API_TOKEN": {
-      "label": "Cloudflare API Token",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.cloudflare.com/client/v4/user/tokens/verify",
-        "auth": "bearer"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "skill",
-          "name": "cloudflare-manager"
-        },
-        {
-          "type": "skill",
-          "name": "setup-domains"
-        },
-        {
-          "type": "skill",
-          "name": "domain-setup"
-        }
-      ]
-    },
-    "STRIPE_SECRET_KEY": {
-      "label": "Stripe Secret Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.stripe.com/v1/balance",
-        "auth": "basic-sk"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "site_local",
-          "domains": [
-            "wholivedthere.com",
-            "bubbesblock.com",
-            "claimmyaddress.com"
-          ]
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/professional-directory/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-claw-leads/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/ventura-claw-leads/.env"
-        }
-      ]
-    },
-    "STRIPE_PUBLISHABLE_KEY": {
-      "label": "Stripe Publishable Key",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "site_local",
-          "domains": [
-            "wholivedthere.com",
-            "bubbesblock.com",
-            "claimmyaddress.com"
-          ]
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/professional-directory/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-claw-leads/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/ventura-claw-leads/.env"
-        }
-      ]
-    },
-    "STRIPE_WEBHOOK_SECRET": {
-      "label": "Stripe Webhook Signing Secret",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "site_local",
-          "domains": [
-            "wholivedthere.com",
-            "bubbesblock.com",
-            "claimmyaddress.com"
-          ]
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        }
-      ]
-    },
-    "STRIPE_TIER_WEBHOOK_SECRET": {
-      "label": "Stripe Tier-Subscription Webhook Signing Secret (Counsel & Bar Lawyer Pro $29/mo)",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_LAWYER_PRO_MONTHLY": {
-      "label": "Stripe Price ID (public): Counsel & Bar Lawyer Pro $29/mo recurring",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        }
-      ]
-    },
-    "STRIPE_VCL_WEBHOOK_SECRET": {
-      "label": "Stripe webhook signing secret — VCL endpoint we_1TUF1Y63uNmiRsMbNr1kLu52",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-claw-leads/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/ventura-claw-leads/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_VCL_STARTER_MONTH": {
-      "label": "Stripe Price ID — VCL Starter $49/mo",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-claw-leads/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/ventura-claw-leads/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_VCL_STANDARD_MONTH": {
-      "label": "Stripe Price ID — VCL Standard $99/mo",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-claw-leads/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/ventura-claw-leads/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_VCL_PREMIER_MONTH": {
-      "label": "Stripe Price ID — VCL Premier $199/mo",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-claw-leads/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/ventura-claw-leads/.env"
-        }
-      ]
-    },
-    "HEYGEN_API_KEY": {
-      "label": "HeyGen API key — talking-head avatar video render (used by session-debrief skill)",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.heygen.com/v1/voice.list",
-        "auth": "header",
-        "headerName": "x-api-key"
-      },
-      "destinations": [
-        {
-          "type": "skill",
-          "path": "~/.claude/skills/session-debrief/.env"
-        },
-        {
-          "type": "skill",
-          "path": "~/.claude/skills/reviewed-demo-video/.env"
-        }
-      ]
-    },
-    "INFO_VENTURACLAW_COM_PASSWORD": {
-      "label": "Purelymail mailbox password — info@venturaclaw.com (used by Ventura Claw Leads + the existing ventura-claw app)",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-claw-leads/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/ventura-claw-leads/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-claw/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/ventura-claw/.env"
-        }
-      ]
-    },
-    "INFO_NATIONALPAPERHANGERS_COM_PASSWORD": {
-      "label": "Purelymail mailbox password — info@nationalpaperhangers.com",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "STRIPE_NPH_WEBHOOK_SECRET": {
-      "label": "Stripe Webhook Signing Secret — NPH endpoint we_1TUDHV63uNmiRsMbRJea7EqU",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_PRO_MONTH": {
-      "label": "Stripe Price ID — NPH Pro $39/mo",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_PRO_YEAR": {
-      "label": "Stripe Price ID — NPH Pro $399/yr",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_SIGNATURE_MONTH": {
-      "label": "Stripe Price ID — NPH Signature $149/mo",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_SIGNATURE_YEAR": {
-      "label": "Stripe Price ID — NPH Signature $1500/yr",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_ENTERPRISE_MONTH": {
-      "label": "Stripe Price ID — NPH Enterprise $399/mo",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "VERCEL_TOKEN": {
-      "label": "Vercel API Token",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.vercel.com/v2/user",
-        "auth": "bearer"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        }
-      ]
-    },
-    "PURELYMAIL_API_TOKEN": {
-      "label": "PurelyMail API Token",
-      "verify": {
-        "method": "POST",
-        "url": "https://purelymail.com/api/v0/listDomains",
-        "auth": "header",
-        "headerName": "Purelymail-Api-Token",
-        "body": "{}",
-        "bodyMustContain": "^\\s*\\{\\s*\"type\"\\s*:\\s*\"success\"",
-        "bodyMustNotContain": "\"type\"\\s*:\\s*\"error\""
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-corridor/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/purelymail-mcp/.env"
-        },
-        {
-          "type": "mcp",
-          "server": "purelymail",
-          "key": "PURELYMAIL_API_TOKEN"
-        }
-      ]
-    },
-    "GODADDY_API_KEY": {
-      "label": "GoDaddy API Key",
-      "destinations": [
-        {
-          "type": "mcp",
-          "server": "domain-suite",
-          "key": "GODADDY_API_KEY"
-        }
-      ]
-    },
-    "GODADDY_API_SECRET": {
-      "label": "GoDaddy API Secret",
-      "destinations": [
-        {
-          "type": "mcp",
-          "server": "domain-suite",
-          "key": "GODADDY_API_SECRET"
-        }
-      ]
-    },
-    "BROWSERBASE_API_KEY": {
-      "label": "Browserbase API Key",
-      "destinations": [
-        {
-          "type": "skill",
-          "name": "browserbase"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/Designer-Wallcoverings/DW-Websites/abrams-report/.env"
-        },
-        {
-          "type": "project",
-          "path": "/Users/stevestudio2/Projects/abrams-report/.env"
-        }
-      ]
-    },
-    "BROWSERBASE_PROJECT_ID": {
-      "label": "Browserbase Project ID",
-      "destinations": [
-        {
-          "type": "skill",
-          "name": "browserbase"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/Designer-Wallcoverings/DW-Websites/abrams-report/.env"
-        },
-        {
-          "type": "project",
-          "path": "/Users/stevestudio2/Projects/abrams-report/.env"
-        }
-      ]
-    },
-    "ANTHROPIC_API_KEY": {
-      "label": "Anthropic API Key",
-      "verify": {
-        "method": "POST",
-        "url": "https://api.anthropic.com/v1/messages",
-        "auth": "x-api-key",
-        "body": "{\"model\":\"claude-haiku-4-5\",\"max_tokens\":1,\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/Letsbegin/.env.local"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/dear-bubbe-nextjs/.env"
-        }
-      ]
-    },
-    "OPENAI_API_KEY": {
-      "label": "OpenAI API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.openai.com/v1/models",
-        "auth": "bearer"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/dear-bubbe-nextjs/.env.local"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/dear-bubbe-nextjs/.env.local"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/animals/.env"
-        }
-      ]
-    },
-    "GEMINI_API_KEY": {
-      "label": "Google Gemini API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://generativelanguage.googleapis.com/v1beta/models?key={value}",
-        "auth": "url"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/Letsbegin/.env.local"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/Bertha/kalshi-dash/.env"
-        },
-        {
-          "type": "skill",
-          "name": "ai-analyzer"
-        },
-        {
-          "type": "skill",
-          "name": "enrich-ai-tags"
-        }
-      ]
-    },
-    "GOOGLE_GENERATIVE_AI_API_KEY": {
-      "label": "Google Generative AI API Key (alias of GEMINI_API_KEY)",
-      "verify": {
-        "method": "GET",
-        "url": "https://generativelanguage.googleapis.com/v1beta/models?key={value}",
-        "auth": "url"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/Letsbegin/.env.local"
-        }
-      ]
-    },
-    "SHOPIFY_ADMIN_TOKEN": {
-      "label": "Shopify Admin API Access Token",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "/Users/stevestudio2/Projects/Designer-Wallcoverings/shopify/.env"
-        },
-        {
-          "type": "project",
-          "path": "/Users/stevestudio2/Projects/Designer-Wallcoverings/.env"
-        },
-        {
-          "type": "project",
-          "path": "/Users/stevestudio2/Projects/Designer-Wallcoverings/DW-Websites/LosAngelesFabrics/.env"
-        }
-      ]
-    },
-    "SHOPIFY_API_KEY": {
-      "label": "Shopify API Key",
-      "destinations": []
-    },
-    "RESEND_API_KEY": {
-      "label": "Resend API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.resend.com/domains",
-        "auth": "bearer"
-      },
-      "destinations": []
-    },
-    "STRIPE_RESTRICTED_KEY": {
-      "label": "Stripe Restricted Key (site-factory)",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.stripe.com/v1/balance",
-        "auth": "basic-sk"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        }
-      ]
-    },
-    "DPLA_API_KEY": {
-      "label": "Digital Public Library of America API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.dp.la/v2/items?api_key={value}&q=test&page_size=1",
-        "auth": "url"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/wholivedthere/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/claimmyaddress/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/bubbesblock/.env"
-        },
-        {
-          "type": "skill",
-          "name": "la-research-agent"
-        }
-      ]
-    },
-    "GEMINI_API_KEY_RALPH": {
-      "label": "Google Gemini API Key (dedicated to Letsbegin Ralph runner)",
-      "verify": {
-        "method": "GET",
-        "url": "https://generativelanguage.googleapis.com/v1beta/models?key={value}",
-        "auth": "url"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/Letsbegin/.env.local"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/Letsbegin/.env.local"
-        }
-      ]
-    },
-    "ELEVENLABS_API_KEY": {
-      "label": "ElevenLabs Voice Synthesis API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.elevenlabs.io/v1/user",
-        "auth": "header",
-        "headerName": "xi-api-key"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/dear-bubbe-nextjs/.env.local"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/dear-bubbe-nextjs/.env.local"
-        }
-      ]
-    },
-    "NEXT_PUBLIC_GOOGLE_MAPS_API_KEY": {
-      "label": "Google Maps JavaScript API Key (browser-exposed; needs HTTP-referrer restrictions)",
-      "verify": {
-        "method": "GET",
-        "url": "https://maps.googleapis.com/maps/api/streetview/metadata?location=34.05,-118.25&key={value}",
-        "success": "json.status === \"OK\" || json.status === \"ZERO_RESULTS\"",
-        "note": "Validates by hitting Street View Static API metadata endpoint; OK or ZERO_RESULTS both prove the key is enabled and unexpired."
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/stayclaim/.env.local"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/wholivedthere/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/claimmyaddress/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/bubbesblock/.env"
-        },
-        {
-          "type": "remote",
-          "host": "root@45.61.58.125",
-          "path": "/root/public-projects/pastdoor/.env.local"
-        },
-        {
-          "type": "remote",
-          "host": "root@45.61.58.125",
-          "path": "/root/public-projects/pastdoor/.env.production"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/jill-website/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-bus-3d/.env",
-          "alias": "GOOGLE_MAPS_API_KEY"
-        }
-      ]
-    },
-    "LINKEDIN_CLIENT_ID": {
-      "label": "LinkedIn OAuth Client ID — \"For Claude - 5-6-26\" app, bound to Designer Wallcoverings Page",
-      "_note": "No verify endpoint — LinkedIn requires the ID+SECRET pair to validate, and the CLI verifies one key at a time. Manual probe via POST /oauth/v2/accessToken with a fake code expects 'invalid_request: authorization code not found' = creds OK.",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "remote",
-          "host": "root@45.61.58.125",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "LINKEDIN_CLIENT_SECRET": {
-      "label": "LinkedIn OAuth Client Secret — \"For Claude - 5-6-26\" app, bound to Designer Wallcoverings Page",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "remote",
-          "host": "root@45.61.58.125",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "NPH_GOOGLE_OAUTH_CLIENT_ID": {
-      "label": "Google OAuth Client ID — buyer sign-in on National Paper Hangers",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "remote",
-          "host": "root@45.61.58.125",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "NPH_GOOGLE_OAUTH_CLIENT_SECRET": {
-      "label": "Google OAuth Client Secret — buyer sign-in on National Paper Hangers",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/NationalPaperHangers/.env"
-        },
-        {
-          "type": "remote",
-          "host": "root@45.61.58.125",
-          "path": "/root/Projects/NationalPaperHangers/.env"
-        }
-      ]
-    },
-    "GEORGE_AUTH": {
-      "label": "George Gmail Basic Auth (DW microsite leads)",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/1800swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/1890swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/1900swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/1920swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/1930swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/1940swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/1950swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/1960swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/1970swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/1980swallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/agedwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/apartmentwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/architecturalwallcoverings/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/blockprintedwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/contractwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/corkwallcovering/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/embroideredwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/fabricwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/glitterwalls/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/greenwallcoverings/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/handcraftedwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/healthcarewallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/hospitalitywallcoverings/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/hospitalitywallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/hotelwallcoverings/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/jutewallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/linenwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/madagascarwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/metallicwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/micawallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/museumwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/mylarwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/naturalwallcoverings/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/pastelwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/raffiawallcoverings/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/raffiawalls/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/recycledwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/restaurantwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/restorationwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/retrowalls/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/saloonwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/screenprintedwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/selfadhesivewallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/silkwallcoverings/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/silkwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/silverleafwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/stringwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/suedewallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/textilewallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/vinylwallpaper/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/wallpapersback/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/wallsandfabrics/.env"
-        }
-      ]
-    }
-  },
-  "leak_patterns": [
-    {
-      "name": "stripe-live-secret",
-      "regex": "sk_live_[A-Za-z0-9]{20,}"
-    },
-    {
-      "name": "purelymail-token",
-      "regex": "PURELYMAIL_API_TOKEN\\s*=\\s*[A-Za-z0-9_-]{20,}"
-    },
-    {
-      "name": "stripe-test-secret",
-      "regex": "sk_test_[A-Za-z0-9]{20,}"
-    },
-    {
-      "name": "stripe-publishable",
-      "regex": "pk_live_[A-Za-z0-9]{20,}"
-    },
-    {
-      "name": "browserbase",
-      "regex": "bb_live_[A-Za-z0-9]+"
-    },
-    {
-      "name": "google-api-key",
-      "regex": "AIza[0-9A-Za-z_-]{35}"
-    },
-    {
-      "name": "google-oauth-access",
-      "regex": "ya29\\.[A-Za-z0-9_-]{20,}"
-    },
-    {
-      "name": "github-pat",
-      "regex": "ghp_[A-Za-z0-9]{36}"
-    },
-    {
-      "name": "github-fine-grained",
-      "regex": "github_pat_[A-Za-z0-9_]{60,}"
-    },
-    {
-      "name": "slack-bot",
-      "regex": "xox[baprs]-[A-Za-z0-9-]{10,}"
-    },
-    {
-      "name": "openai-key",
-      "regex": "sk-[A-Za-z0-9]{40,}"
-    },
-    {
-      "name": "anthropic-key",
-      "regex": "sk-ant-[A-Za-z0-9_-]{50,}"
-    },
-    {
-      "name": "cf-token-40hex",
-      "regex": "(?:cloudflare|cf_token|dns_cloudflare_api_token)[^A-Za-z0-9]+([A-Za-z0-9_-]{40})"
-    }
-  ],
-  "CLOUDFLARE_ACCOUNT_ID": [
-    "/Users/stevestudio2/.claude/skills/domain-check/.env",
-    "/Users/stevestudio2/.claude/skills/domain-dns-setup/.env",
-    "/Users/stevestudio2/.claude/skills/domain-email-setup/.env",
-    "/Users/stevestudio2/.claude/skills/domain-full-setup/.env",
-    "/Users/stevestudio2/.claude/skills/domain-register/.env",
-    "/Users/stevestudio2/.claude/skills/domain-setup/.env",
-    "/Users/stevestudio2/.claude/skills/setup-domains/.env"
-  ],
-  "SMB_BUILDER_ADMIN_TOKEN": {
-    "destinations": [
-      {
-        "type": "env_file",
-        "path": "/Users/stevestudio2/Projects/small-business-builder/.env",
-        "key": "ADMIN_TOKEN"
-      }
-    ]
-  },
-  "SHOPIFY_ORDERS_TOKEN": {
-    "label": "Shopify Admin token (orders+products scope, weekend-report1-1 Partner app)",
-    "destinations": [
-      {
-        "type": "skill",
-        "path": "/Users/stevestudio2/.claude/skills/weekend-csv-products/.env"
-      }
-    ]
-  },
-  "SPOONFLOWER_EMAIL": {
-    "env_files": [
-      "/Users/stevestudio2/Projects/resize-it/.env",
-      "/Users/stevestudio2/Projects/wallco-ai/.env"
-    ]
-  },
-  "SPOONFLOWER_PASSWORD": {
-    "env_files": [
-      "/Users/stevestudio2/Projects/resize-it/.env",
-      "/Users/stevestudio2/Projects/wallco-ai/.env"
-    ]
-  },
-  "GOOGLE_DRIVE_CLIENT_ID": {
-    "description": "Google Drive OAuth Client ID — TSD photo-import-cli desktop app",
-    "destinations": [
-      {
-        "type": "env-file",
-        "path": "/Users/stevestudio2/Projects/thesetdecorator/.env"
-      }
-    ]
-  },
-  "GOOGLE_DRIVE_CLIENT_SECRET": {
-    "description": "Google Drive OAuth Client Secret — TSD photo-import-cli",
-    "destinations": [
-      {
-        "type": "env-file",
-        "path": "/Users/stevestudio2/Projects/thesetdecorator/.env"
-      }
-    ]
-  },
-  "GOOGLE_DRIVE_REFRESH_TOKEN": {
-    "description": "Google Drive OAuth refresh token — read-only scope, owned by steveabramsdesigns@gmail.com",
-    "destinations": [
-      {
-        "type": "env-file",
-        "path": "/Users/stevestudio2/Projects/thesetdecorator/.env"
-      }
-    ]
-  },
-  "OPENAI_API_KEY": {
-    "label": "OPENAI_API_KEY",
-    "destinations": [
-      "/Users/stevestudio2/Projects/holdforme/.env"
-    ]
-  },
-  "ELEVENLABS_API_KEY": {
-    "label": "ELEVENLABS_API_KEY",
-    "destinations": [
-      "/Users/stevestudio2/Projects/holdforme/.env"
-    ]
-  },
-  "TWILIO_ACCOUNT_SID": {
-    "label": "TWILIO_ACCOUNT_SID",
-    "destinations": [
-      "/Users/stevestudio2/Projects/holdforme/.env"
-    ]
-  },
-  "TWILIO_AUTH_TOKEN": {
-    "label": "TWILIO_AUTH_TOKEN",
-    "destinations": [
-      "/Users/stevestudio2/Projects/holdforme/.env"
-    ]
-  },
-  "TWILIO_PHONE_NUMBER": {
-    "label": "TWILIO_PHONE_NUMBER",
-    "destinations": [
-      "/Users/stevestudio2/Projects/holdforme/.env"
-    ]
-  },
-  "TMDB_API_KEY": {
-    "label": "TMDB v3 API key — asseeninmovies Phase B drain (6.46M-stub queue)",
-    "verify": {
-      "method": "GET",
-      "url": "https://api.themoviedb.org/3/authentication?api_key=__VALUE__",
-      "auth": "querystring",
-      "expect": "success"
-    },
-    "destinations": [
-      "/Users/stevestudio2/Projects/asseeninmovies/.env"
-    ]
-  },
-  "TMDB_READ_ACCESS_TOKEN": {
-    "label": "TMDB v4 read-access token (bearer) — alt to v3 api_key",
-    "verify": {
-      "method": "GET",
-      "url": "https://api.themoviedb.org/3/authentication",
-      "auth": "bearer",
-      "expect": "success"
-    },
-    "destinations": [
-      "/Users/stevestudio2/Projects/asseeninmovies/.env"
-    ]
-  },
-  "VAPI_API_KEY": {
-    "label": "VAPI_API_KEY",
-    "destinations": [
-      "/Users/stevestudio2/Projects/holdforme/.env",
-      "remote:kamatera:/root/public-projects/butlr/.env"
-    ]
-  },
-  "VAPI_PUBLIC_KEY": {
-    "label": "VAPI_PUBLIC_KEY",
-    "destinations": [
-      "/Users/stevestudio2/Projects/holdforme/.env",
-      "remote:kamatera:/root/public-projects/butlr/.env"
-    ]
-  }
-}
\ No newline at end of file
diff --git a/routes.json.bak.20260505-fanout b/routes.json.bak.20260505-fanout
deleted file mode 100644
index 568e99d..0000000
--- a/routes.json.bak.20260505-fanout
+++ /dev/null
@@ -1,535 +0,0 @@
-{
-  "_comment": "Per-secret routing table. Each entry: master + extra destinations. Master is implicit at ~/Projects/secrets-manager/.env + ~/Desktop/site-factory.env.",
-  "services": {
-    "BRAVE_SEARCH_API_KEY": {
-      "label": "Brave Search API (Web)",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.search.brave.com/res/v1/web/search?q=test&count=1",
-        "auth": "header",
-        "headerName": "X-Subscription-Token"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/_ventura-recon/.env"
-        }
-      ]
-    },
-    "MOONSHOT_API_KEY": {
-      "label": "Moonshot AI / Kimi K2 API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.moonshot.ai/v1/models",
-        "auth": "bearer"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/claude-codex-meeting/.env"
-        },
-        {
-          "type": "skill",
-          "name": "claude-codex"
-        }
-      ]
-    },
-    "CLOUDFLARE_API_TOKEN": {
-      "label": "Cloudflare API Token",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.cloudflare.com/client/v4/user/tokens/verify",
-        "auth": "bearer"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "skill",
-          "name": "cloudflare-manager"
-        },
-        {
-          "type": "skill",
-          "name": "setup-domains"
-        },
-        {
-          "type": "skill",
-          "name": "domain-setup"
-        }
-      ]
-    },
-    "STRIPE_SECRET_KEY": {
-      "label": "Stripe Secret Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.stripe.com/v1/balance",
-        "auth": "basic-sk"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "site_local",
-          "domains": [
-            "wholivedthere.com",
-            "bubbesblock.com",
-            "claimmyaddress.com"
-          ]
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/professional-directory/.env"
-        }
-      ]
-    },
-    "STRIPE_PUBLISHABLE_KEY": {
-      "label": "Stripe Publishable Key",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "site_local",
-          "domains": [
-            "wholivedthere.com",
-            "bubbesblock.com",
-            "claimmyaddress.com"
-          ]
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/professional-directory/.env"
-        }
-      ]
-    },
-    "STRIPE_WEBHOOK_SECRET": {
-      "label": "Stripe Webhook Signing Secret",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "site_local",
-          "domains": [
-            "wholivedthere.com",
-            "bubbesblock.com",
-            "claimmyaddress.com"
-          ]
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        }
-      ]
-    },
-    "STRIPE_TIER_WEBHOOK_SECRET": {
-      "label": "Stripe Tier-Subscription Webhook Signing Secret (Counsel & Bar Lawyer Pro $29/mo)",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        }
-      ]
-    },
-    "STRIPE_PRICE_LAWYER_PRO_MONTHLY": {
-      "label": "Stripe Price ID (public): Counsel & Bar Lawyer Pro $29/mo recurring",
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/lawyer-directory-builder/.env"
-        }
-      ]
-    },
-    "VERCEL_TOKEN": {
-      "label": "Vercel API Token",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.vercel.com/v2/user",
-        "auth": "bearer"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        }
-      ]
-    },
-    "PURELYMAIL_API_TOKEN": {
-      "label": "PurelyMail API Token",
-      "verify": {
-        "method": "POST",
-        "url": "https://purelymail.com/api/v0/listDomains",
-        "auth": "header",
-        "headerName": "Purelymail-Api-Token",
-        "body": "{}",
-        "bodyMustContain": "^\\s*\\{\\s*\"type\"\\s*:\\s*\"success\"",
-        "bodyMustNotContain": "\"type\"\\s*:\\s*\"error\""
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/ventura-corridor/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/purelymail-mcp/.env"
-        },
-        {
-          "type": "mcp",
-          "server": "purelymail",
-          "key": "PURELYMAIL_API_TOKEN"
-        }
-      ]
-    },
-    "GODADDY_API_KEY": {
-      "label": "GoDaddy API Key",
-      "destinations": [
-        {
-          "type": "mcp",
-          "server": "domain-suite",
-          "key": "GODADDY_API_KEY"
-        }
-      ]
-    },
-    "GODADDY_API_SECRET": {
-      "label": "GoDaddy API Secret",
-      "destinations": [
-        {
-          "type": "mcp",
-          "server": "domain-suite",
-          "key": "GODADDY_API_SECRET"
-        }
-      ]
-    },
-    "BROWSERBASE_API_KEY": {
-      "label": "Browserbase API Key",
-      "destinations": [
-        {
-          "type": "skill",
-          "name": "browserbase"
-        }
-      ]
-    },
-    "BROWSERBASE_PROJECT_ID": {
-      "label": "Browserbase Project ID",
-      "destinations": [
-        {
-          "type": "skill",
-          "name": "browserbase"
-        }
-      ]
-    },
-    "ANTHROPIC_API_KEY": {
-      "label": "Anthropic API Key",
-      "verify": {
-        "method": "POST",
-        "url": "https://api.anthropic.com/v1/messages",
-        "auth": "x-api-key",
-        "body": "{\"model\":\"claude-haiku-4-5\",\"max_tokens\":1,\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/Letsbegin/.env.local"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/dear-bubbe-nextjs/.env"
-        }
-      ]
-    },
-    "OPENAI_API_KEY": {
-      "label": "OpenAI API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.openai.com/v1/models",
-        "auth": "bearer"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/dear-bubbe-nextjs/.env.local"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/dear-bubbe-nextjs/.env.local"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/animals/.env"
-        }
-      ]
-    },
-    "GEMINI_API_KEY": {
-      "label": "Google Gemini API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://generativelanguage.googleapis.com/v1beta/models?key={value}",
-        "auth": "url"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/Letsbegin/.env.local"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/Bertha/kalshi-dash/.env"
-        },
-        {
-          "type": "skill",
-          "name": "ai-analyzer"
-        },
-        {
-          "type": "skill",
-          "name": "enrich-ai-tags"
-        }
-      ]
-    },
-    "GOOGLE_GENERATIVE_AI_API_KEY": {
-      "label": "Google Generative AI API Key (alias of GEMINI_API_KEY)",
-      "verify": {
-        "method": "GET",
-        "url": "https://generativelanguage.googleapis.com/v1beta/models?key={value}",
-        "auth": "url"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/Letsbegin/.env.local"
-        }
-      ]
-    },
-    "SHOPIFY_ADMIN_TOKEN": {
-      "label": "Shopify Admin API Access Token",
-      "destinations": []
-    },
-    "SHOPIFY_API_KEY": {
-      "label": "Shopify API Key",
-      "destinations": []
-    },
-    "RESEND_API_KEY": {
-      "label": "Resend API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.resend.com/domains",
-        "auth": "bearer"
-      },
-      "destinations": []
-    },
-    "STRIPE_RESTRICTED_KEY": {
-      "label": "Stripe Restricted Key (site-factory)",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.stripe.com/v1/balance",
-        "auth": "basic-sk"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/site-factory/.env"
-        }
-      ]
-    },
-    "DPLA_API_KEY": {
-      "label": "Digital Public Library of America API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.dp.la/v2/items?api_key={value}&q=test&page_size=1",
-        "auth": "url"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/wholivedthere/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/claimmyaddress/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/bubbesblock/.env"
-        },
-        {
-          "type": "skill",
-          "name": "la-research-agent"
-        }
-      ]
-    },
-    "GEMINI_API_KEY_RALPH": {
-      "label": "Google Gemini API Key (dedicated to Letsbegin Ralph runner)",
-      "verify": {
-        "method": "GET",
-        "url": "https://generativelanguage.googleapis.com/v1beta/models?key={value}",
-        "auth": "url"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/Letsbegin/.env.local"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/Letsbegin/.env.local"
-        }
-      ]
-    },
-    "ELEVENLABS_API_KEY": {
-      "label": "ElevenLabs Voice Synthesis API Key",
-      "verify": {
-        "method": "GET",
-        "url": "https://api.elevenlabs.io/v1/user",
-        "auth": "header",
-        "headerName": "xi-api-key"
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/dear-bubbe-nextjs/.env.local"
-        },
-        {
-          "type": "project",
-          "host": "45.61.58.125",
-          "user": "root",
-          "path": "/root/Projects/dear-bubbe-nextjs/.env.local"
-        }
-      ]
-    },
-    "NEXT_PUBLIC_GOOGLE_MAPS_API_KEY": {
-      "label": "Google Maps JavaScript API Key (browser-exposed; needs HTTP-referrer restrictions)",
-      "verify": {
-        "method": "GET",
-        "url": "https://maps.googleapis.com/maps/api/streetview/metadata?location=34.05,-118.25&key={value}",
-        "success": "json.status === \"OK\" || json.status === \"ZERO_RESULTS\"",
-        "note": "Validates by hitting Street View Static API metadata endpoint; OK or ZERO_RESULTS both prove the key is enabled and unexpired."
-      },
-      "destinations": [
-        {
-          "type": "project",
-          "path": "~/Projects/stayclaim/.env.local"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/wholivedthere/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/claimmyaddress/.env"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/bubbesblock/.env"
-        },
-        {
-          "type": "remote",
-          "host": "root@45.61.58.125",
-          "path": "/root/public-projects/pastdoor/.env.local"
-        },
-        {
-          "type": "remote",
-          "host": "root@45.61.58.125",
-          "path": "/root/public-projects/pastdoor/.env.production"
-        },
-        {
-          "type": "project",
-          "path": "~/Projects/jill-website/.env"
-        }
-      ]
-    }
-  },
-  "leak_patterns": [
-    {
-      "name": "stripe-live-secret",
-      "regex": "sk_live_[A-Za-z0-9]{20,}"
-    },
-    {
-      "name": "purelymail-token",
-      "regex": "PURELYMAIL_API_TOKEN\\s*=\\s*[A-Za-z0-9_-]{20,}"
-    },
-    {
-      "name": "stripe-test-secret",
-      "regex": "sk_test_[A-Za-z0-9]{20,}"
-    },
-    {
-      "name": "stripe-publishable",
-      "regex": "pk_live_[A-Za-z0-9]{20,}"
-    },
-    {
-      "name": "browserbase",
-      "regex": "bb_live_[A-Za-z0-9]+"
-    },
-    {
-      "name": "google-api-key",
-      "regex": "AIza[0-9A-Za-z_-]{35}"
-    },
-    {
-      "name": "google-oauth-access",
-      "regex": "ya29\\.[A-Za-z0-9_-]{20,}"
-    },
-    {
-      "name": "github-pat",
-      "regex": "ghp_[A-Za-z0-9]{36}"
-    },
-    {
-      "name": "github-fine-grained",
-      "regex": "github_pat_[A-Za-z0-9_]{60,}"
-    },
-    {
-      "name": "slack-bot",
-      "regex": "xox[baprs]-[A-Za-z0-9-]{10,}"
-    },
-    {
-      "name": "openai-key",
-      "regex": "sk-[A-Za-z0-9]{40,}"
-    },
-    {
-      "name": "anthropic-key",
-      "regex": "sk-ant-[A-Za-z0-9_-]{50,}"
-    },
-    {
-      "name": "cf-token-40hex",
-      "regex": "(?:cloudflare|cf_token|dns_cloudflare_api_token)[^A-Za-z0-9]+([A-Za-z0-9_-]{40})"
-    }
-  ],
-  "CLOUDFLARE_ACCOUNT_ID": [
-    "/Users/stevestudio2/.claude/skills/domain-check/.env",
-    "/Users/stevestudio2/.claude/skills/domain-dns-setup/.env",
-    "/Users/stevestudio2/.claude/skills/domain-email-setup/.env",
-    "/Users/stevestudio2/.claude/skills/domain-full-setup/.env",
-    "/Users/stevestudio2/.claude/skills/domain-register/.env",
-    "/Users/stevestudio2/.claude/skills/domain-setup/.env",
-    "/Users/stevestudio2/.claude/skills/setup-domains/.env"
-  ],
-  "SMB_BUILDER_ADMIN_TOKEN": {
-    "destinations": [
-      {
-        "type": "env_file",
-        "path": "/Users/stevestudio2/Projects/small-business-builder/.env",
-        "key": "ADMIN_TOKEN"
-      }
-    ]
-  }
-}
\ No newline at end of file
← 7fe7f4e Reconcile ROTATION-CHECKLIST against 2026-06-21 read-only ve · back to Secrets Manager · auto-save: 2026-06-21T19:01:26 (1 files) — CF-TOKEN-LEAK-ROT af4923b →