fix stripe image build

scripts/apply-env-secret-overrides.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  apply-env-secret-overrides.sh <env-file> <KEY> [KEY...]
+
+For each KEY, this script reads KEY_B64 from the environment, base64-decodes it,
+and upserts KEY=<decoded value> in <env-file>. Empty KEY_B64 values are ignored.
+EOF
+}
+
+if [[ $# -lt 2 ]]; then
+  usage >&2
+  exit 1
+fi
+
+env_file="$1"
+shift
+
+if [[ ! -f "${env_file}" ]]; then
+  echo "Missing env file: ${env_file}" >&2
+  exit 1
+fi
+
+upsert_env_value() {
+  local key="$1"
+  local value="$2"
+  local tmp_file
+
+  tmp_file="$(mktemp "${env_file}.tmp.XXXXXX")"
+  awk -v key="${key}" -v value="${value}" '
+    BEGIN {
+      updated = 0
+    }
+    /^[[:space:]]*#/ || index($0, "=") == 0 {
+      print
+      next
+    }
+    {
+      name = $1
+      sub(/=.*/, "", name)
+      sub(/^[[:space:]]*export[[:space:]]+/, "", name)
+      gsub(/^[[:space:]]+|[[:space:]]+$/, "", name)
+      if (name == key) {
+        print key "=" value
+        updated = 1
+        next
+      }
+      print
+    }
+    END {
+      if (!updated) {
+        print key "=" value
+      }
+    }
+  ' "${env_file}" > "${tmp_file}"
+
+  mv "${tmp_file}" "${env_file}"
+}
+
+for key in "$@"; do
+  encoded_var="${key}_B64"
+  encoded_value="${!encoded_var:-}"
+
+  if [[ -z "${encoded_value}" ]]; then
+    continue
+  fi
+
+  if ! decoded_value="$(printf '%s' "${encoded_value}" | base64 -d)"; then
+    echo "Invalid base64 value in ${encoded_var}" >&2
+    exit 1
+  fi
+
+  upsert_env_value "${key}" "${decoded_value}"
+done

scripts/docker-prod-common.sh

@@ -228,8 +228,8 @@ validate_prod_env_file() {
     exit 1
   fi
 
-  if [[ "${stripe_api_key}" != sk_* && "${stripe_api_key}" != rk_* ]]; then
-    echo "Invalid STRIPE_API_KEY in ${ENV_FILE}. It must start with sk_ or rk_." >&2
+  if [[ "${stripe_api_key}" != sk_live_* && "${stripe_api_key}" != rk_live_* ]]; then
+    echo "Invalid STRIPE_API_KEY in ${ENV_FILE}. It must start with sk_live_ or rk_live_ for production billing." >&2
     exit 1
   fi