fix: streamline deploy button configuration

Avoid prompting for optional default provider credentials, generate JWT secrets during deployment, and expose the Artifacts beta feature flag.

Author: karishnu

.dev.vars.example

@@ -3,10 +3,9 @@
 #ENVIRONMENT="prod" # Options: dev, staging, prod
 
 # Feature flags
-# Cloudflare Artifacts filesystem backend for SpaceDO (closed beta). Disabled
-# unless set to "true". In deployed environments this is managed from the
-# Cloudflare dashboard (not committed); set it here only for local dev.
-#ENABLE_ARTIFACTS="true"
+# Cloudflare Artifacts filesystem backend for SpaceDO. This feature is in closed beta;
+# enable it only if Cloudflare has granted your account access.
+ENABLE_ARTIFACTS="false"
 
 # Cloudflare Credentials (Required for manual deployment via `bun run deploy`)
 # These are automatically provided when using "Deploy to Cloudflare" button
@@ -20,7 +19,7 @@
 # Provider specific secrets:
 #ANTHROPIC_API_KEY=""
 #OPENAI_API_KEY=""
-GOOGLE_AI_STUDIO_API_KEY=""
+#GOOGLE_AI_STUDIO_API_KEY=""
 #OPENROUTER_API_KEY="default" 
 #GROQ_API_KEY="default" 
 
@@ -37,7 +36,8 @@ GOOGLE_AI_STUDIO_API_KEY=""
 # GITHUB_EXPORTER_CLIENT_ID=""
 
 # Secrets for various internal services of this platform
-JWT_SECRET="" 
+# JWT_SECRET is generated automatically during Deploy to Cloudflare.
+#JWT_SECRET=""
 
 # AI Gateway URL Override (Leave as-is if not going to set it)
 #CLOUDFLARE_AI_GATEWAY_URL=""

scripts/deploy.ts

@@ -14,6 +14,7 @@
  */
 
 import { execSync } from 'child_process';
+import { randomBytes } from 'crypto';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
@@ -1770,6 +1771,7 @@ class CloudflareDeploymentManager {
 			'JWT_SECRET',
 			'SENTRY_DSN',
 			'AI_PROXY_JWT_SECRET',
+			'ENABLE_ARTIFACTS',
 			'MAX_SANDBOX_INSTANCES',
 			'CUSTOM_DOMAIN',
 			'CUSTOM_PREVIEW_DOMAIN',
@@ -1779,6 +1781,11 @@ class CloudflareDeploymentManager {
 			'PLATFORM_MODEL_PROVIDERS',
 		];
 
+		const generatedJwtSecret = process.env.JWT_SECRET ? undefined : randomBytes(64).toString('base64url');
+		if (generatedJwtSecret) {
+			console.log('🔐 Generated JWT_SECRET for this deployment');
+		}
+
 		const prodVarsContent: string[] = [
 			'# Production environment variables for Cloudflare Orange Build',
 			'# Generated automatically during deployment',
@@ -1788,7 +1795,7 @@ class CloudflareDeploymentManager {
 
 		// Add environment variables that are set
 		secretVars.forEach((varName) => {
-			let value = process.env[varName];
+			let value = varName === 'JWT_SECRET' ? generatedJwtSecret : process.env[varName];
 
 			// Apply fallback logic for CLOUDFLARE_AI_GATEWAY_TOKEN
 			if (varName === 'CLOUDFLARE_AI_GATEWAY_TOKEN' && (!value || value === '')) {