@saastemly/voidcommerce 0.12.0 → 0.14.0

package/dist/catalog.js

@@ -14,7 +14,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-7xwcv2cj.js";
+} from "./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   UI,

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-g0p3kk0f.js";
+} from "./index-jvsednjr.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -50,7 +50,7 @@ import {
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-a279r74m.js";
+} from "./index-paeg95y4.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -58,10 +58,10 @@ import {
   validate,
   writeManifest,
   zoneOf
-} from "./index-ym88atwf.js";
+} from "./index-30y19qz5.js";
 import {
   GROUPS
-} from "./index-7xwcv2cj.js";
+} from "./index-xyjhy6kp.js";
 import {
   __require
 } from "./index-0v6na3yp.js";

package/dist/generate/auth.d.ts

@@ -10,6 +10,6 @@ import { type Manifest } from "../manifest";
  * The token needs nothing: no origin, no tariff. Everything else needs one or
  * the other, so the rule is simply "any carrier but the token".
  */
-export declare const WIRED_CARRIERS: readonly ["royal-mail", "dhl-express", "shippo", "easypost", "ups", "fedex", "nft"];
+export declare const WIRED_CARRIERS: readonly ["parcel2go", "royal-mail", "dhl-express", "shippo", "easypost", "ups", "fedex", "nft"];
 export declare const needsShippingConfig: (id: string) => boolean;
 export declare function renderAuthTs(manifest: Manifest): string;

package/dist/{index-ym88atwf.js → index-30y19qz5.js}

@@ -1,7 +1,7 @@
 import {
   CHOICES,
   GROUPS
-} from "./index-7xwcv2cj.js";
+} from "./index-xyjhy6kp.js";
 
 // src/manifest.ts
 import { readFile, writeFile } from "node:fs/promises";

package/dist/{index-g0p3kk0f.js → index-jvsednjr.js}

@@ -11,7 +11,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-a279r74m.js";
+} from "./index-paeg95y4.js";
 import {
   MANIFEST_FILE,
   has,
@@ -24,10 +24,10 @@ import {
   workerHosts,
   writeManifest,
   zone
-} from "./index-ym88atwf.js";
+} from "./index-30y19qz5.js";
 import {
   CHOICES
-} from "./index-7xwcv2cj.js";
+} from "./index-xyjhy6kp.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -50,12 +50,17 @@ var VAT = {
   PL: { rate: 2300, name: "VAT" }
 };
 var social = (manifest, id, envPrefix) => has(manifest, id) ? `			${id}: { clientId: must(env, "${envPrefix}_CLIENT_ID"), clientSecret: must(env, "${envPrefix}_CLIENT_SECRET") },` : null;
-var WIRED_CARRIERS = ["royal-mail", "dhl-express", "shippo", "easypost", "ups", "fedex", "nft"];
+var WIRED_CARRIERS = ["parcel2go", "royal-mail", "dhl-express", "shippo", "easypost", "ups", "fedex", "nft"];
 var needsShippingConfig = (id) => WIRED_CARRIERS.includes(id) && id !== "nft";
 function renderAuthTs(manifest) {
   const { shop } = manifest;
   const lines = [];
   const CARRIER_CALLS = {
+    parcel2go: {
+      label: "Parcel2Go",
+      call: `parcel2goProvider({ clientId: must(env, "PARCEL2GO_CLIENT_ID"), clientSecret: must(env, "PARCEL2GO_CLIENT_SECRET"), from: shipFrom, customer: parcel2goCustomer, currency: "${shop.currency}" })`,
+      import: `import { parcel2goProvider } from "@saastemly/better-commerce/providers/parcel2go";`
+    },
     "royal-mail": {
       label: "Royal Mail",
       call: `royalMailProvider({ apiKey: must(env, "CLICK_DROP_AUTH_KEY"), services: royalMailServices, currency: "${shop.currency}", carrierName: "Royal Mail" })`,
@@ -97,7 +102,8 @@ import { mintProvider, destinationFor } from "./lib/mint.ts";`
   const carrierImports = carriers.map((id) => CARRIER_CALLS[id].import);
   const shipping = [
     ...carriers.some((id) => id !== "nft" && id !== "royal-mail") ? ["shipFrom"] : [],
-    ...carriers.includes("royal-mail") ? ["royalMailServices"] : []
+    ...carriers.includes("royal-mail") ? ["royalMailServices"] : [],
+    ...carriers.includes("parcel2go") ? ["parcel2goCustomer"] : []
   ];
   if (shipping.length > 0)
     carrierImports.push(`import { ${shipping.join(", ")} } from "./lib/shipping.ts";`);
@@ -1372,7 +1378,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.12.0",
+  version: "0.14.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -2223,30 +2229,60 @@ export async function destinationFor(orderId: string): Promise<string | null> {
 }
 function renderShippingTs(manifest) {
   const royalMail = has(manifest, "royal-mail");
-  const origin = ["dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
+  const parcel2go = has(manifest, "parcel2go");
+  const origin = ["parcel2go", "dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
   const imports = [
+    ...origin || parcel2go ? [`import { env } from "void/env";`] : [],
     ...origin ? [`import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";`] : [],
     ...royalMail ? [`import type { RoyalMailService } from "@saastemly/better-commerce/providers/royal-mail";`] : []
   ];
-  const originBlock = `
+  const header = `
 /**
- * The address every parcel is quoted and shipped FROM.
+ * Where parcels come FROM, and who the carrier account belongs to.
+ *
+ * These are CONFIG, not code: they vary per deploy, they are nobody's
+ * business but this shop's, and hard-coding them here would mean a fresh
+ * clone of this repository shipped somebody else's address. So they come
+ * from the environment — declared in env.ts, encrypted in .env.secrets, and
+ * set with \`vc secrets set\`.
  *
- * TODO VERIFY: this is a placeholder. A carrier quotes against it, and most
- * refuse a shipment whose origin has no \`name\` and \`phone\`.
+ * This file's job is to read them and fail loudly when one is missing, which
+ * is the difference between a shop that refuses to quote and a shop that
+ * quotes against the wrong postcode and loses money on every order.
  */
+const must = (key: string): string => {
+	const value = (env as Record<string, unknown>)[key];
+	if (typeof value !== "string" || !value || value === "unset") {
+		throw new Error(\`shipping: \${key} is not set — \\\`vc secrets set \${key}\\\`\`);
+	}
+	return value;
+};
+`;
+  const originBlock = `
+/** The address every parcel is quoted against, and the door a courier is sent to. */
 export const shipFrom: DeliveryAddress = {
-	name: "${manifest.shop.name}",
-	line1: "TODO VERIFY: street",
-	city: "TODO VERIFY: town",
-	postalCode: "TODO VERIFY",
+	name: must("SHIP_FROM_NAME"),
+	line1: must("SHIP_FROM_LINE1"),
+	city: must("SHIP_FROM_CITY"),
+	postalCode: must("SHIP_FROM_POSTCODE"),
 	country: "${manifest.shop.country}",
-	phone: "TODO VERIFY: +44…",
+	phone: must("SHIP_FROM_PHONE"),
+};
+`;
+  const parcel2goBlock = `
+/**
+ * Who the Parcel2Go account belongs to — the ACCOUNT holder, not the buyer.
+ * Parcel2Go books a courier for a named person and rejects an order without.
+ */
+export const parcel2goCustomer = {
+	email: must("PARCEL2GO_CUSTOMER_EMAIL"),
+	forename: must("PARCEL2GO_CUSTOMER_FORENAME"),
+	surname: must("PARCEL2GO_CUSTOMER_SURNAME"),
 };
 `;
   return `${imports.join(`
 `)}
-${origin ? originBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
+${origin || parcel2go ? header : ""}${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
 }
 function renderErpTs() {
   return `import { businessCentralProvider } from "@saastemly/better-commerce/providers/business-central";
@@ -2437,7 +2473,7 @@ async function generateApi(root, dir, manifest, result, opts) {
     await put(root, at("lib/mint.ts"), renderMintTs(), result, own);
   }
   if (WIRED_CARRIERS.some((id) => needsShippingConfig(id) && has(manifest, id))) {
-    await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, own);
+    await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, "regenerate");
   }
   if (has(manifest, "business-central")) {
     await put(root, at("lib/erp.ts"), renderErpTs(), result, own);

package/dist/{index-a279r74m.js → index-paeg95y4.js}

@@ -4,7 +4,7 @@ import {
   isApex,
   oneOrigin,
   zone
-} from "./index-ym88atwf.js";
+} from "./index-30y19qz5.js";
 import {
   __require,
   __toESM
@@ -389,7 +389,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-px5maaj1.js");
+    const { publicKeyFor } = await import("./keys-nntc65pq.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {

package/dist/{index-7xwcv2cj.js → index-xyjhy6kp.js}

@@ -440,11 +440,70 @@ var CARRIERS = {
   intro: "Live rates at checkout, quoted per carrier. Flat-rate shipping needs none of these.",
   kind: "multiselect",
   choices: [
-    { id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [{ key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }] },
-    { id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [{ key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }] },
-    { id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [{ key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" }, { key: "UPS_CLIENT_SECRET", breaks: "the same" }, { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }] },
-    { id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
-    { id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
+    {
+      id: "parcel2go",
+      label: "Parcel2Go — a courier collects from your door",
+      hint: "the only one here a private individual can use end to end: live prices, a collection booked by API, and label-free services where the driver brings it. No business account, no volume minimum, no monthly fee",
+      recommended: true,
+      env: [
+        { key: "PARCEL2GO_CLIENT_ID", breaks: "no rates are quoted and no collection is ever booked", where: "parcel2go.com/myaccount/api → Client Credentials" },
+        { key: "PARCEL2GO_CLIENT_SECRET", breaks: "the same — and Parcel2Go will not show it twice, so keep it when you make it", where: "you choose this value when creating the credentials" },
+        { key: "PARCEL2GO_CUSTOMER_EMAIL", breaks: "Parcel2Go rejects every order: it books a courier for a named person and will not accept one without", where: "the email on your Parcel2Go account" },
+        { key: "PARCEL2GO_CUSTOMER_FORENAME", breaks: "the same" },
+        { key: "PARCEL2GO_CUSTOMER_SURNAME", breaks: "the same" },
+        { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+        { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+        { key: "SHIP_FROM_CITY", breaks: "the same" },
+        { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+        { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" }
+      ]
+    },
+    { id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }
+    ] },
+    { id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }
+    ] },
+    { id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" },
+      { key: "UPS_CLIENT_SECRET", breaks: "the same" },
+      { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }
+    ] },
+    { id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" },
+      { key: "FEDEX_CLIENT_SECRET", breaks: "the same" },
+      { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }
+    ] },
+    { id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "DHL_API_KEY", breaks: "DHL rates are not quoted" },
+      { key: "DHL_API_SECRET", breaks: "the same" },
+      { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }
+    ] },
     { id: "usps", label: "USPS", hint: "US domestic post — the cheapest way to ship a small parcel inside the US", env: [{ key: "USPS_CLIENT_ID", breaks: "USPS rates are not quoted" }, { key: "USPS_CLIENT_SECRET", breaks: "the same" }] },
     {
       id: "royal-mail",

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-g0p3kk0f.js";
+} from "./index-jvsednjr.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-a279r74m.js";
+} from "./index-paeg95y4.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -81,7 +81,7 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-ym88atwf.js";
+} from "./index-30y19qz5.js";
 import {
   AUTH_PLUGINS,
   CARRIERS,
@@ -98,7 +98,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-7xwcv2cj.js";
+} from "./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/dist/{keys-px5maaj1.js → keys-nntc65pq.js}

@@ -8,9 +8,9 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-a279r74m.js";
-import"./index-ym88atwf.js";
-import"./index-7xwcv2cj.js";
+} from "./index-paeg95y4.js";
+import"./index-30y19qz5.js";
+import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   publicKeyFor,

package/dist/manifest.js

@@ -18,8 +18,8 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-ym88atwf.js";
-import"./index-7xwcv2cj.js";
+} from "./index-30y19qz5.js";
+import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/catalog.ts

@@ -513,11 +513,59 @@ export const CARRIERS: Group = {
 	intro: "Live rates at checkout, quoted per carrier. Flat-rate shipping needs none of these.",
 	kind: "multiselect",
 	choices: [
-		{ id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [{ key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }] },
-		{ id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [{ key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }] },
-		{ id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [{ key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" }, { key: "UPS_CLIENT_SECRET", breaks: "the same" }, { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }] },
-		{ id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
-		{ id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
+		{
+			id: "parcel2go",
+			label: "Parcel2Go — a courier collects from your door",
+			hint: "the only one here a private individual can use end to end: live prices, a collection booked by API, and label-free services where the driver brings it. No business account, no volume minimum, no monthly fee",
+			recommended: true,
+			env: [
+				{ key: "PARCEL2GO_CLIENT_ID", breaks: "no rates are quoted and no collection is ever booked", where: "parcel2go.com/myaccount/api → Client Credentials" },
+				{ key: "PARCEL2GO_CLIENT_SECRET", breaks: "the same — and Parcel2Go will not show it twice, so keep it when you make it", where: "you choose this value when creating the credentials" },
+				{ key: "PARCEL2GO_CUSTOMER_EMAIL", breaks: "Parcel2Go rejects every order: it books a courier for a named person and will not accept one without", where: "the email on your Parcel2Go account" },
+				{ key: "PARCEL2GO_CUSTOMER_FORENAME", breaks: "the same" },
+				{ key: "PARCEL2GO_CUSTOMER_SURNAME", breaks: "the same" },
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			],
+		},
+		{ id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }] },
+		{ id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }] },
+		{ id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" }, { key: "UPS_CLIENT_SECRET", breaks: "the same" }, { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }] },
+		{ id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
+		{ id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
 		{ id: "usps", label: "USPS", hint: "US domestic post — the cheapest way to ship a small parcel inside the US", env: [{ key: "USPS_CLIENT_ID", breaks: "USPS rates are not quoted" }, { key: "USPS_CLIENT_SECRET", breaks: "the same" }] },
 		{
 			id: "royal-mail",

package/src/generate/auth.ts

@@ -60,7 +60,7 @@ const social = (manifest: Manifest, id: string, envPrefix: string) =>
  * The token needs nothing: no origin, no tariff. Everything else needs one or
  * the other, so the rule is simply "any carrier but the token".
  */
-export const WIRED_CARRIERS = ["royal-mail", "dhl-express", "shippo", "easypost", "ups", "fedex", "nft"] as const;
+export const WIRED_CARRIERS = ["parcel2go", "royal-mail", "dhl-express", "shippo", "easypost", "ups", "fedex", "nft"] as const;
 export const needsShippingConfig = (id: string): boolean => WIRED_CARRIERS.includes(id as never) && id !== "nft";
 
 export function renderAuthTs(manifest: Manifest): string {
@@ -82,6 +82,13 @@ export function renderAuthTs(manifest: Manifest): string {
 	const CARRIER_CALLS: Record<string, { call: string; label: string; import: string }> = {
 		// Every real carrier needs the ORIGIN it ships from, which is shop data
 		// rather than a credential — so it lives in an owned lib/shipping.ts.
+		parcel2go: {
+			label: "Parcel2Go",
+			// `from` is the collection address: Parcel2Go requires one on every
+			// order, because a courier is being sent to it.
+			call: `parcel2goProvider({ clientId: must(env, "PARCEL2GO_CLIENT_ID"), clientSecret: must(env, "PARCEL2GO_CLIENT_SECRET"), from: shipFrom, customer: parcel2goCustomer, currency: "${shop.currency}" })`,
+			import: `import { parcel2goProvider } from "@saastemly/better-commerce/providers/parcel2go";`,
+		},
 		"royal-mail": {
 			label: "Royal Mail",
 			// No `from`: Click & Drop posts from the account's registered
@@ -133,6 +140,7 @@ export function renderAuthTs(manifest: Manifest): string {
 	const shipping = [
 		...(carriers.some((id) => id !== "nft" && id !== "royal-mail") ? ["shipFrom"] : []),
 		...(carriers.includes("royal-mail") ? ["royalMailServices"] : []),
+		...(carriers.includes("parcel2go") ? ["parcel2goCustomer"] : []),
 	];
 	if (shipping.length > 0) carrierImports.push(`import { ${shipping.join(", ")} } from "./lib/shipping.ts";`);
 	const wantsNft = has(manifest, "nft");

package/src/generate/index.ts

@@ -248,7 +248,11 @@ async function generateApi(root: string, dir: string, manifest: Manifest, result
 	// against, or a price table. The list lives with the carriers themselves so
 	// it cannot drift from them.
 	if (WIRED_CARRIERS.some((id) => needsShippingConfig(id) && has(manifest, id))) {
-		await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, own);
+		// REGENERATED, not owned. It used to carry the shop's address as
+		// constants, which made it config and so nobody's to overwrite. Now it
+		// only READS that config from the environment, so it is ordinary code
+		// and should receive fixes like any other generated file.
+		await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, "regenerate");
 	}
 	if (has(manifest, "business-central")) {
 		await put(root, at("lib/erp.ts"), renderErpTs(), result, own);

package/src/generate/support.ts

@@ -275,33 +275,65 @@ export async function destinationFor(orderId: string): Promise<string | null> {
  */
 export function renderShippingTs(manifest: Manifest): string {
 	const royalMail = has(manifest, "royal-mail");
+	const parcel2go = has(manifest, "parcel2go");
 	// Royal Mail posts from the address registered on the Click & Drop account,
 	// so an origin here would be ignored. Only carriers that QUOTE need one.
-	const origin = ["dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
+	const origin = ["parcel2go", "dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
 
 	const imports = [
+		...(origin || parcel2go ? [`import { env } from "void/env";`] : []),
 		...(origin ? [`import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";`] : []),
 		...(royalMail ? [`import type { RoyalMailService } from "@saastemly/better-commerce/providers/royal-mail";`] : []),
 	];
 
-	const originBlock = `
+	const header = `
 /**
- * The address every parcel is quoted and shipped FROM.
+ * Where parcels come FROM, and who the carrier account belongs to.
+ *
+ * These are CONFIG, not code: they vary per deploy, they are nobody's
+ * business but this shop's, and hard-coding them here would mean a fresh
+ * clone of this repository shipped somebody else's address. So they come
+ * from the environment — declared in env.ts, encrypted in .env.secrets, and
+ * set with \`vc secrets set\`.
  *
- * TODO VERIFY: this is a placeholder. A carrier quotes against it, and most
- * refuse a shipment whose origin has no \`name\` and \`phone\`.
+ * This file's job is to read them and fail loudly when one is missing, which
+ * is the difference between a shop that refuses to quote and a shop that
+ * quotes against the wrong postcode and loses money on every order.
  */
+const must = (key: string): string => {
+	const value = (env as Record<string, unknown>)[key];
+	if (typeof value !== "string" || !value || value === "unset") {
+		throw new Error(\`shipping: \${key} is not set — \\\`vc secrets set \${key}\\\`\`);
+	}
+	return value;
+};
+`;
+
+	const originBlock = `
+/** The address every parcel is quoted against, and the door a courier is sent to. */
 export const shipFrom: DeliveryAddress = {
-	name: "${manifest.shop.name}",
-	line1: "TODO VERIFY: street",
-	city: "TODO VERIFY: town",
-	postalCode: "TODO VERIFY",
+	name: must("SHIP_FROM_NAME"),
+	line1: must("SHIP_FROM_LINE1"),
+	city: must("SHIP_FROM_CITY"),
+	postalCode: must("SHIP_FROM_POSTCODE"),
 	country: "${manifest.shop.country}",
-	phone: "TODO VERIFY: +44…",
+	phone: must("SHIP_FROM_PHONE"),
+};
+`;
+
+	const parcel2goBlock = `
+/**
+ * Who the Parcel2Go account belongs to — the ACCOUNT holder, not the buyer.
+ * Parcel2Go books a courier for a named person and rejects an order without.
+ */
+export const parcel2goCustomer = {
+	email: must("PARCEL2GO_CUSTOMER_EMAIL"),
+	forename: must("PARCEL2GO_CUSTOMER_FORENAME"),
+	surname: must("PARCEL2GO_CUSTOMER_SURNAME"),
 };
 `;
 
-	return `${imports.join("\n")}\n${origin ? originBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
+	return `${imports.join("\n")}\n${origin || parcel2go ? header : ""}${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
 }
 
 export function renderErpTs(): string {