@saastemly/voidcommerce 0.13.0 → 0.14.0

package/dist/catalog.js

@@ -14,7 +14,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   UI,

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-ze4z3n5q.js";
+} from "./index-jvsednjr.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -50,7 +50,7 @@ import {
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-cxse24q6.js";
+} from "./index-paeg95y4.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -58,10 +58,10 @@ import {
   validate,
   writeManifest,
   zoneOf
-} from "./index-727eybzt.js";
+} from "./index-30y19qz5.js";
 import {
   GROUPS
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 import {
   __require
 } from "./index-0v6na3yp.js";

package/dist/{index-727eybzt.js → index-30y19qz5.js}

@@ -1,7 +1,7 @@
 import {
   CHOICES,
   GROUPS
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 
 // src/manifest.ts
 import { readFile, writeFile } from "node:fs/promises";

package/dist/{index-ze4z3n5q.js → index-jvsednjr.js}

@@ -11,7 +11,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-cxse24q6.js";
+} from "./index-paeg95y4.js";
 import {
   MANIFEST_FILE,
   has,
@@ -24,10 +24,10 @@ import {
   workerHosts,
   writeManifest,
   zone
-} from "./index-727eybzt.js";
+} from "./index-30y19qz5.js";
 import {
   CHOICES
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -1378,7 +1378,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.13.0",
+  version: "0.14.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -2232,44 +2232,57 @@ function renderShippingTs(manifest) {
   const parcel2go = has(manifest, "parcel2go");
   const origin = ["parcel2go", "dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
   const imports = [
+    ...origin || parcel2go ? [`import { env } from "void/env";`] : [],
     ...origin ? [`import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";`] : [],
     ...royalMail ? [`import type { RoyalMailService } from "@saastemly/better-commerce/providers/royal-mail";`] : []
   ];
-  const originBlock = `
+  const header = `
 /**
- * The address every parcel is quoted and shipped FROM.
+ * Where parcels come FROM, and who the carrier account belongs to.
+ *
+ * These are CONFIG, not code: they vary per deploy, they are nobody's
+ * business but this shop's, and hard-coding them here would mean a fresh
+ * clone of this repository shipped somebody else's address. So they come
+ * from the environment — declared in env.ts, encrypted in .env.secrets, and
+ * set with \`vc secrets set\`.
  *
- * TODO VERIFY: this is a placeholder. A carrier quotes against it, and most
- * refuse a shipment whose origin has no \`name\` and \`phone\`.
+ * This file's job is to read them and fail loudly when one is missing, which
+ * is the difference between a shop that refuses to quote and a shop that
+ * quotes against the wrong postcode and loses money on every order.
  */
+const must = (key: string): string => {
+	const value = (env as Record<string, unknown>)[key];
+	if (typeof value !== "string" || !value || value === "unset") {
+		throw new Error(\`shipping: \${key} is not set — \\\`vc secrets set \${key}\\\`\`);
+	}
+	return value;
+};
+`;
+  const originBlock = `
+/** The address every parcel is quoted against, and the door a courier is sent to. */
 export const shipFrom: DeliveryAddress = {
-	name: "${manifest.shop.name}",
-	line1: "TODO VERIFY: street",
-	city: "TODO VERIFY: town",
-	postalCode: "TODO VERIFY",
+	name: must("SHIP_FROM_NAME"),
+	line1: must("SHIP_FROM_LINE1"),
+	city: must("SHIP_FROM_CITY"),
+	postalCode: must("SHIP_FROM_POSTCODE"),
 	country: "${manifest.shop.country}",
-	phone: "TODO VERIFY: +44…",
+	phone: must("SHIP_FROM_PHONE"),
 };
 `;
   const parcel2goBlock = `
 /**
- * Who the Parcel2Go account belongs to.
- *
- * Every order carries it: Parcel2Go books a courier to come to a real person
- * at a real door, and needs to know whose door. This is the ACCOUNT holder,
- * not the buyer — the buyer's details ride on the parcel.
- *
- * TODO VERIFY: these are placeholders.
+ * Who the Parcel2Go account belongs to — the ACCOUNT holder, not the buyer.
+ * Parcel2Go books a courier for a named person and rejects an order without.
  */
 export const parcel2goCustomer = {
-	email: "TODO VERIFY: the email on your Parcel2Go account",
-	forename: "TODO VERIFY",
-	surname: "TODO VERIFY",
+	email: must("PARCEL2GO_CUSTOMER_EMAIL"),
+	forename: must("PARCEL2GO_CUSTOMER_FORENAME"),
+	surname: must("PARCEL2GO_CUSTOMER_SURNAME"),
 };
 `;
   return `${imports.join(`
 `)}
-${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
+${origin || parcel2go ? header : ""}${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
 }
 function renderErpTs() {
   return `import { businessCentralProvider } from "@saastemly/better-commerce/providers/business-central";
@@ -2460,7 +2473,7 @@ async function generateApi(root, dir, manifest, result, opts) {
     await put(root, at("lib/mint.ts"), renderMintTs(), result, own);
   }
   if (WIRED_CARRIERS.some((id) => needsShippingConfig(id) && has(manifest, id))) {
-    await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, own);
+    await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, "regenerate");
   }
   if (has(manifest, "business-central")) {
     await put(root, at("lib/erp.ts"), renderErpTs(), result, own);

package/dist/{index-cxse24q6.js → index-paeg95y4.js}

@@ -4,7 +4,7 @@ import {
   isApex,
   oneOrigin,
   zone
-} from "./index-727eybzt.js";
+} from "./index-30y19qz5.js";
 import {
   __require,
   __toESM
@@ -389,7 +389,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-9efk9rdz.js");
+    const { publicKeyFor } = await import("./keys-nntc65pq.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {

package/dist/{index-0je92d88.js → index-xyjhy6kp.js}

@@ -447,14 +447,63 @@ var CARRIERS = {
       recommended: true,
       env: [
         { key: "PARCEL2GO_CLIENT_ID", breaks: "no rates are quoted and no collection is ever booked", where: "parcel2go.com/myaccount/api → Client Credentials" },
-        { key: "PARCEL2GO_CLIENT_SECRET", breaks: "the same — and Parcel2Go will not show it twice, so keep it when you make it", where: "you choose this value when creating the credentials" }
+        { key: "PARCEL2GO_CLIENT_SECRET", breaks: "the same — and Parcel2Go will not show it twice, so keep it when you make it", where: "you choose this value when creating the credentials" },
+        { key: "PARCEL2GO_CUSTOMER_EMAIL", breaks: "Parcel2Go rejects every order: it books a courier for a named person and will not accept one without", where: "the email on your Parcel2Go account" },
+        { key: "PARCEL2GO_CUSTOMER_FORENAME", breaks: "the same" },
+        { key: "PARCEL2GO_CUSTOMER_SURNAME", breaks: "the same" },
+        { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+        { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+        { key: "SHIP_FROM_CITY", breaks: "the same" },
+        { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+        { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" }
       ]
     },
-    { id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [{ key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }] },
-    { id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [{ key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }] },
-    { id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [{ key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" }, { key: "UPS_CLIENT_SECRET", breaks: "the same" }, { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }] },
-    { id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
-    { id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
+    { id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }
+    ] },
+    { id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }
+    ] },
+    { id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" },
+      { key: "UPS_CLIENT_SECRET", breaks: "the same" },
+      { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }
+    ] },
+    { id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" },
+      { key: "FEDEX_CLIENT_SECRET", breaks: "the same" },
+      { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }
+    ] },
+    { id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "DHL_API_KEY", breaks: "DHL rates are not quoted" },
+      { key: "DHL_API_SECRET", breaks: "the same" },
+      { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }
+    ] },
     { id: "usps", label: "USPS", hint: "US domestic post — the cheapest way to ship a small parcel inside the US", env: [{ key: "USPS_CLIENT_ID", breaks: "USPS rates are not quoted" }, { key: "USPS_CLIENT_SECRET", breaks: "the same" }] },
     {
       id: "royal-mail",

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-ze4z3n5q.js";
+} from "./index-jvsednjr.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-cxse24q6.js";
+} from "./index-paeg95y4.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -81,7 +81,7 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-727eybzt.js";
+} from "./index-30y19qz5.js";
 import {
   AUTH_PLUGINS,
   CARRIERS,
@@ -98,7 +98,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/dist/{keys-9efk9rdz.js → keys-nntc65pq.js}

@@ -8,9 +8,9 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-cxse24q6.js";
-import"./index-727eybzt.js";
-import"./index-0je92d88.js";
+} from "./index-paeg95y4.js";
+import"./index-30y19qz5.js";
+import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   publicKeyFor,

package/dist/manifest.js

@@ -18,8 +18,8 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-727eybzt.js";
-import"./index-0je92d88.js";
+} from "./index-30y19qz5.js";
+import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/catalog.ts

@@ -521,13 +521,51 @@ export const CARRIERS: Group = {
 			env: [
 				{ key: "PARCEL2GO_CLIENT_ID", breaks: "no rates are quoted and no collection is ever booked", where: "parcel2go.com/myaccount/api → Client Credentials" },
 				{ key: "PARCEL2GO_CLIENT_SECRET", breaks: "the same — and Parcel2Go will not show it twice, so keep it when you make it", where: "you choose this value when creating the credentials" },
+				{ key: "PARCEL2GO_CUSTOMER_EMAIL", breaks: "Parcel2Go rejects every order: it books a courier for a named person and will not accept one without", where: "the email on your Parcel2Go account" },
+				{ key: "PARCEL2GO_CUSTOMER_FORENAME", breaks: "the same" },
+				{ key: "PARCEL2GO_CUSTOMER_SURNAME", breaks: "the same" },
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
 			],
 		},
-		{ id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [{ key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }] },
-		{ id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [{ key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }] },
-		{ id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [{ key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" }, { key: "UPS_CLIENT_SECRET", breaks: "the same" }, { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }] },
-		{ id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
-		{ id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
+		{ id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }] },
+		{ id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }] },
+		{ id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" }, { key: "UPS_CLIENT_SECRET", breaks: "the same" }, { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }] },
+		{ id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
+		{ id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
 		{ id: "usps", label: "USPS", hint: "US domestic post — the cheapest way to ship a small parcel inside the US", env: [{ key: "USPS_CLIENT_ID", breaks: "USPS rates are not quoted" }, { key: "USPS_CLIENT_SECRET", breaks: "the same" }] },
 		{
 			id: "royal-mail",

package/src/generate/index.ts

@@ -248,7 +248,11 @@ async function generateApi(root: string, dir: string, manifest: Manifest, result
 	// against, or a price table. The list lives with the carriers themselves so
 	// it cannot drift from them.
 	if (WIRED_CARRIERS.some((id) => needsShippingConfig(id) && has(manifest, id))) {
-		await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, own);
+		// REGENERATED, not owned. It used to carry the shop's address as
+		// constants, which made it config and so nobody's to overwrite. Now it
+		// only READS that config from the environment, so it is ordinary code
+		// and should receive fixes like any other generated file.
+		await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, "regenerate");
 	}
 	if (has(manifest, "business-central")) {
 		await put(root, at("lib/erp.ts"), renderErpTs(), result, own);

package/src/generate/support.ts

@@ -281,44 +281,59 @@ export function renderShippingTs(manifest: Manifest): string {
 	const origin = ["parcel2go", "dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
 
 	const imports = [
+		...(origin || parcel2go ? [`import { env } from "void/env";`] : []),
 		...(origin ? [`import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";`] : []),
 		...(royalMail ? [`import type { RoyalMailService } from "@saastemly/better-commerce/providers/royal-mail";`] : []),
 	];
 
-	const originBlock = `
+	const header = `
 /**
- * The address every parcel is quoted and shipped FROM.
+ * Where parcels come FROM, and who the carrier account belongs to.
+ *
+ * These are CONFIG, not code: they vary per deploy, they are nobody's
+ * business but this shop's, and hard-coding them here would mean a fresh
+ * clone of this repository shipped somebody else's address. So they come
+ * from the environment — declared in env.ts, encrypted in .env.secrets, and
+ * set with \`vc secrets set\`.
  *
- * TODO VERIFY: this is a placeholder. A carrier quotes against it, and most
- * refuse a shipment whose origin has no \`name\` and \`phone\`.
+ * This file's job is to read them and fail loudly when one is missing, which
+ * is the difference between a shop that refuses to quote and a shop that
+ * quotes against the wrong postcode and loses money on every order.
  */
+const must = (key: string): string => {
+	const value = (env as Record<string, unknown>)[key];
+	if (typeof value !== "string" || !value || value === "unset") {
+		throw new Error(\`shipping: \${key} is not set — \\\`vc secrets set \${key}\\\`\`);
+	}
+	return value;
+};
+`;
+
+	const originBlock = `
+/** The address every parcel is quoted against, and the door a courier is sent to. */
 export const shipFrom: DeliveryAddress = {
-	name: "${manifest.shop.name}",
-	line1: "TODO VERIFY: street",
-	city: "TODO VERIFY: town",
-	postalCode: "TODO VERIFY",
+	name: must("SHIP_FROM_NAME"),
+	line1: must("SHIP_FROM_LINE1"),
+	city: must("SHIP_FROM_CITY"),
+	postalCode: must("SHIP_FROM_POSTCODE"),
 	country: "${manifest.shop.country}",
-	phone: "TODO VERIFY: +44…",
+	phone: must("SHIP_FROM_PHONE"),
 };
 `;
 
 	const parcel2goBlock = `
 /**
- * Who the Parcel2Go account belongs to.
- *
- * Every order carries it: Parcel2Go books a courier to come to a real person
- * at a real door, and needs to know whose door. This is the ACCOUNT holder,
- * not the buyer — the buyer's details ride on the parcel.
- *
- * TODO VERIFY: these are placeholders.
+ * Who the Parcel2Go account belongs to — the ACCOUNT holder, not the buyer.
+ * Parcel2Go books a courier for a named person and rejects an order without.
  */
 export const parcel2goCustomer = {
-	email: "TODO VERIFY: the email on your Parcel2Go account",
-	forename: "TODO VERIFY",
-	surname: "TODO VERIFY",
+	email: must("PARCEL2GO_CUSTOMER_EMAIL"),
+	forename: must("PARCEL2GO_CUSTOMER_FORENAME"),
+	surname: must("PARCEL2GO_CUSTOMER_SURNAME"),
 };
 `;
-	return `${imports.join("\n")}\n${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
+
+	return `${imports.join("\n")}\n${origin || parcel2go ? header : ""}${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
 }
 
 export function renderErpTs(): string {