# Configure environment and secrets for SvelteKit

Configure environment variables and secrets for a SvelteKit app on Ample. Values passed with --env or --env-file are stored encrypted and injected at runtime; the platform never prints them and ample.toml declares only variable names. The fixture proves delivery by reporting whether the secret is set without echoing it.

## Prerequisites
- Code that reads configuration from the process environment
- The secret values at hand for --env or an env file
- An Ample account token with servers:write

## Workflow Steps
1. **Declare, do not commit**  
   In ample.toml declare SMTP_KEY = { secret = true } style entries; never put literal secrets in the manifest.

2. **Pass values on deploy**  
   Use --env KEY=value (repeatable) or --env-file .env.production; values are encrypted at rest and reused on redeploys.  
   Command: `ample deploy . --name <your-app-name> --public --env CANARY_SECRET=...`

3. **Confirm without echoing**  
   Expose a route (/config) that reports secret=set or secret=missing, never the value.

4. **Verify**  
   Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.  
   Command: `ample logs <your-app-name> --kind build`

## Examples
- **SvelteKit secret probe canary**  
   `/config reports secret=set for an --env value delivered encrypted.`  
   Source Reference: `tests/deploy-canaries/sveltekit-postgres-app`

## Success Checks
- The app sees the configured variable without exposing it.  
  - Kind: `http_get`  
  - Path: `/config`  
  - Expect: `secret=set`

## Limitations
- Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.
- Region, compliance attestations and request-duration limits are unknown and not claimed.
- Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.
- Plain env in the API request is rejected; only the encrypted path is supported.
- Rotating a secret requires a redeploy with the new value.

## Cost Estimate
- **Currency**: USD  
- **Monthly Amount**: 5.0  
- **Basis**: Size prices from pricing.toml (loaded by the API) at build revision 1ac5595375130d45290090e82ed0f554ccd45405-dirty  
  - Components:  
    - Name: `app server`  
      Size: `s-1vcpu-1gb`  
      Quantity: 1.0  
      Monthly Amount: 5.0  
  
**Note**: Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.