@saastemly/voidcommerce 0.13.0 → 0.15.0

package/dist/catalog.js

@@ -14,7 +14,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   UI,

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-ze4z3n5q.js";
+} from "./index-jycz3x3g.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -50,7 +50,7 @@ import {
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-cxse24q6.js";
+} from "./index-s8se0x2d.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -58,10 +58,10 @@ import {
   validate,
   writeManifest,
   zoneOf
-} from "./index-727eybzt.js";
+} from "./index-30y19qz5.js";
 import {
   GROUPS
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -255,11 +255,31 @@ async function preflightCommand(args) {
     console.error("vc: no voidcommerce.json here.");
     return 1;
   }
-  const source = args.includes("--cloudflare") ? "wrangler" : "void";
+  const source = args.includes("--repo") ? "repository" : args.includes("--cloudflare") ? "wrangler" : "void";
   const result = await preflight(project, source);
   printPreflight(project, result, source);
+  if (source !== "repository")
+    return result.ready ? 0 : 1;
+  const pending = await uncommittedMigrations(project.root);
+  if (pending.length > 0) {
+    console.error(`${color2.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:
+` + `    ${pending.join(`
+    `)}
+
+` + `  The deploy applies what is in the repository. Commit these, or the
+` + `  schema the shop runs on is not the one you tested.
+`);
+    return 1;
+  }
   return result.ready ? 0 : 1;
 }
+async function uncommittedMigrations(root) {
+  const status = await run("git", ["status", "--porcelain", "--", "migrations"], root);
+  if (status.code !== 0)
+    return [];
+  return status.out.split(`
+`).map((line2) => line2.trim()).filter(Boolean).map((line2) => line2.replace(/^\S+\s+/, ""));
+}
 async function deployHelp() {
   const captured = await captureVoid(["deploy", "--help"]);
   const width = 80;

package/dist/deploy/preflight.d.ts

@@ -21,7 +21,16 @@ export interface Preflight {
     bareSecrets: string[];
     ready: boolean;
 }
-export type SecretSource = "wrangler" | "void";
+/**
+ * Where a secret's presence is established.
+ *
+ * `repository` asks only what is committed, and is the right question before
+ * a PUSH: the deploy happens off this machine from what was pushed, so a
+ * check that needs local credentials is checking the wrong thing. It is also
+ * the only mode that works on a machine which has none — which, if config is
+ * properly in the environment, is every machine.
+ */
+export type SecretSource = "wrangler" | "void" | "repository";
 /** Keys committed in .env.production — safe values only, by construction. */
 export declare function productionEnv(appDir: string): Map<string, string>;
 /** The worker's hostnames must be what the layout says. */

package/dist/deploy/secrets.d.ts

@@ -66,6 +66,16 @@ export declare function committedPublicKeyInto(root: string, publicKey: string):
  * can say "all five are declared" on a machine that cannot read any of them.
  */
 export declare function declaredSecretNames(root: string): Set<string>;
+/**
+ * Declared names whose value is still the `unset` placeholder.
+ *
+ * Readable WITHOUT the key, because `unset` is plaintext — which is what
+ * lets a push-time gate tell "this shop has a Stripe key" from "this shop
+ * has a line that says STRIPE_SECRET_KEY". Preflight used to count the
+ * second as present, so a shop could pass every check and then fail to take
+ * money in production.
+ */
+export declare function unsetSecretNames(root: string): string[];
 /** Is a declared value actually encrypted, or was it committed in the clear? */
 export declare function plaintextSecretNames(root: string): string[];
 /**

package/dist/{index-727eybzt.js → index-30y19qz5.js}

@@ -1,7 +1,7 @@
 import {
   CHOICES,
   GROUPS
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 
 // src/manifest.ts
 import { readFile, writeFile } from "node:fs/promises";

package/dist/{index-ze4z3n5q.js → index-jycz3x3g.js}

@@ -10,8 +10,9 @@ import {
   renderEnvExample,
   renderEnvLocal,
   renderEnvProduction,
-  renderEnvTs
-} from "./index-cxse24q6.js";
+  renderEnvTs,
+  unsetSecretNames
+} from "./index-s8se0x2d.js";
 import {
   MANIFEST_FILE,
   has,
@@ -24,10 +25,10 @@ import {
   workerHosts,
   writeManifest,
   zone
-} from "./index-727eybzt.js";
+} from "./index-30y19qz5.js";
 import {
   CHOICES
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -1378,7 +1379,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.13.0",
+  version: "0.15.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -2232,44 +2233,57 @@ function renderShippingTs(manifest) {
   const parcel2go = has(manifest, "parcel2go");
   const origin = ["parcel2go", "dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
   const imports = [
+    ...origin || parcel2go ? [`import { env } from "void/env";`] : [],
     ...origin ? [`import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";`] : [],
     ...royalMail ? [`import type { RoyalMailService } from "@saastemly/better-commerce/providers/royal-mail";`] : []
   ];
-  const originBlock = `
+  const header = `
 /**
- * The address every parcel is quoted and shipped FROM.
+ * Where parcels come FROM, and who the carrier account belongs to.
+ *
+ * These are CONFIG, not code: they vary per deploy, they are nobody's
+ * business but this shop's, and hard-coding them here would mean a fresh
+ * clone of this repository shipped somebody else's address. So they come
+ * from the environment — declared in env.ts, encrypted in .env.secrets, and
+ * set with \`vc secrets set\`.
  *
- * TODO VERIFY: this is a placeholder. A carrier quotes against it, and most
- * refuse a shipment whose origin has no \`name\` and \`phone\`.
+ * This file's job is to read them and fail loudly when one is missing, which
+ * is the difference between a shop that refuses to quote and a shop that
+ * quotes against the wrong postcode and loses money on every order.
  */
+const must = (key: string): string => {
+	const value = (env as Record<string, unknown>)[key];
+	if (typeof value !== "string" || !value || value === "unset") {
+		throw new Error(\`shipping: \${key} is not set — \\\`vc secrets set \${key}\\\`\`);
+	}
+	return value;
+};
+`;
+  const originBlock = `
+/** The address every parcel is quoted against, and the door a courier is sent to. */
 export const shipFrom: DeliveryAddress = {
-	name: "${manifest.shop.name}",
-	line1: "TODO VERIFY: street",
-	city: "TODO VERIFY: town",
-	postalCode: "TODO VERIFY",
+	name: must("SHIP_FROM_NAME"),
+	line1: must("SHIP_FROM_LINE1"),
+	city: must("SHIP_FROM_CITY"),
+	postalCode: must("SHIP_FROM_POSTCODE"),
 	country: "${manifest.shop.country}",
-	phone: "TODO VERIFY: +44…",
+	phone: must("SHIP_FROM_PHONE"),
 };
 `;
   const parcel2goBlock = `
 /**
- * Who the Parcel2Go account belongs to.
- *
- * Every order carries it: Parcel2Go books a courier to come to a real person
- * at a real door, and needs to know whose door. This is the ACCOUNT holder,
- * not the buyer — the buyer's details ride on the parcel.
- *
- * TODO VERIFY: these are placeholders.
+ * Who the Parcel2Go account belongs to — the ACCOUNT holder, not the buyer.
+ * Parcel2Go books a courier for a named person and rejects an order without.
  */
 export const parcel2goCustomer = {
-	email: "TODO VERIFY: the email on your Parcel2Go account",
-	forename: "TODO VERIFY",
-	surname: "TODO VERIFY",
+	email: must("PARCEL2GO_CUSTOMER_EMAIL"),
+	forename: must("PARCEL2GO_CUSTOMER_FORENAME"),
+	surname: must("PARCEL2GO_CUSTOMER_SURNAME"),
 };
 `;
   return `${imports.join(`
 `)}
-${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
+${origin || parcel2go ? header : ""}${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
 }
 function renderErpTs() {
   return `import { businessCentralProvider } from "@saastemly/better-commerce/providers/business-central";
@@ -2420,6 +2434,41 @@ async function link(root, file, target, result) {
   }
 }
 var sorted = (record) => Object.fromEntries(Object.entries(record).sort());
+async function generateHooks(root, result) {
+  await put(root, ".husky/pre-commit", `#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
+# file so the COMMIT carries the ciphertext rather than what you staged.
+# Encryption needs only the public key in that file, so this needs no
+# credential and works on a fresh clone.
+#
+# It refuses only when it cannot fix the problem itself: no key yet
+# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
+# committed in the clear cannot be un-committed — the value stays in the
+# history and has to be treated as burned.
+bunx vc guard
+`, result, "regenerate");
+  await put(root, ".husky/pre-push", `#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Pushing main deploys this shop, so the same checks the deploy would make
+# run here first — where you can read the error and fix it, rather than in a
+# build log after the shop is already updating.
+#
+# Needs no credentials: it reads only what is committed.
+# To push anyway, deliberately: git push --no-verify
+
+while read -r _local_ref _local_sha remote_ref _remote_sha; do
+  case "$remote_ref" in
+    refs/heads/main|refs/heads/master)
+      echo "vc: main is the deploy branch — checking what you are about to publish"
+      bunx vc preflight --repo || exit 1
+      ;;
+  esac
+done
+`, result, "regenerate");
+}
 async function generate(root, manifest) {
   const result = { written: [], kept: [], retired: [], packages: packagesOf(manifest) };
   await writeManifest(root, manifest);
@@ -2440,6 +2489,7 @@ async function generate(root, manifest) {
       await generateStrictApp(root, STRICT_APP, manifest, result);
       break;
   }
+  await generateHooks(root, result);
   return result;
 }
 async function generateApi(root, dir, manifest, result, opts) {
@@ -2460,7 +2510,7 @@ async function generateApi(root, dir, manifest, result, opts) {
     await put(root, at("lib/mint.ts"), renderMintTs(), result, own);
   }
   if (WIRED_CARRIERS.some((id) => needsShippingConfig(id) && has(manifest, id))) {
-    await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, own);
+    await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, "regenerate");
   }
   if (has(manifest, "business-central")) {
     await put(root, at("lib/erp.ts"), renderErpTs(), result, own);
@@ -2588,20 +2638,6 @@ dist
 .DS_Store
 `, result, "own");
   await put(root, "patches/void@0.10.13.patch", renderVoidPatch(), result, "regenerate");
-  await put(root, ".husky/pre-commit", `#!/usr/bin/env sh
-# Generated by \`vc init\`.
-#
-# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
-# file so the COMMIT carries the ciphertext rather than what you staged.
-# Encryption needs only the public key in that file, so this needs no
-# credential and works on a fresh clone.
-#
-# It refuses only when it cannot fix the problem itself: no key yet
-# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
-# committed in the clear cannot be un-committed — the value stays in the
-# history and has to be treated as burned.
-bunx vc guard
-`, result, "regenerate");
   await put(root, ".github/workflows/deploy.yml", renderDistWorkflow(manifest), result, "regenerate");
   await retire(root, ".github/workflows/void-dist.yml", result);
   await put(root, "DEPLOY.md", renderDeployReadme(manifest, zone(manifest), workerHosts(manifest)), result, "regenerate");
@@ -3023,7 +3059,9 @@ function routeProblem(project) {
 async function preflight(project, source) {
   const present = productionEnv(project.appDir);
   let remote = null;
-  if (source === "wrangler") {
+  if (source === "repository") {
+    remote = null;
+  } else if (source === "wrangler") {
     const bin = findWrangler(project.appDir);
     remote = bin ? await secretNames(bin, project.appDir) : null;
   } else {
@@ -3031,8 +3069,11 @@ async function preflight(project, source) {
   }
   for (const name of remote ?? [])
     present.set(name, "<secret>");
-  for (const name of declaredSecretNames(project.root))
-    present.set(name, "<in the repository>");
+  const stillUnset = new Set(unsetSecretNames(project.root));
+  for (const name of declaredSecretNames(project.root)) {
+    if (!stillUnset.has(name))
+      present.set(name, "<in the repository>");
+  }
   const missing = allEnvKeys(project.manifest).filter((key) => {
     const value = present.get(key.key);
     return value === undefined || value === "" || value === UNSET;

package/dist/{index-cxse24q6.js → index-s8se0x2d.js}

@@ -4,7 +4,7 @@ import {
   isApex,
   oneOrigin,
   zone
-} from "./index-727eybzt.js";
+} from "./index-30y19qz5.js";
 import {
   __require,
   __toESM
@@ -342,6 +342,21 @@ function declaredSecretNames(root) {
   }
   return names;
 }
+function unsetSecretNames(root) {
+  const path = join2(root, SECRETS_FILE);
+  if (!existsSync2(path))
+    return [];
+  const out = [];
+  for (const line of readFileSync(path, "utf8").split(`
+`)) {
+    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!match || match[1].startsWith("DOTENV_"))
+      continue;
+    if (match[2].trim().replace(/^['"]|['"]$/g, "") === "unset")
+      out.push(match[1]);
+  }
+  return out;
+}
 function plaintextSecretNames(root) {
   const path = join2(root, SECRETS_FILE);
   if (!existsSync2(path))
@@ -389,7 +404,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-9efk9rdz.js");
+    const { publicKeyFor } = await import("./keys-6neyajsv.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -916,4 +931,4 @@ ${color2.green("✓")} re-keyed under ${made.publicKey.slice(0, 20)}… and ${PR
   return 0;
 }
 
-export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, ghAuth, repoSlug, setSecret, secretNames, setVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };
+export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, ghAuth, repoSlug, setSecret, secretNames, setVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };

package/dist/{index-0je92d88.js → index-xyjhy6kp.js}

@@ -447,14 +447,63 @@ var CARRIERS = {
       recommended: true,
       env: [
         { key: "PARCEL2GO_CLIENT_ID", breaks: "no rates are quoted and no collection is ever booked", where: "parcel2go.com/myaccount/api → Client Credentials" },
-        { key: "PARCEL2GO_CLIENT_SECRET", breaks: "the same — and Parcel2Go will not show it twice, so keep it when you make it", where: "you choose this value when creating the credentials" }
+        { key: "PARCEL2GO_CLIENT_SECRET", breaks: "the same — and Parcel2Go will not show it twice, so keep it when you make it", where: "you choose this value when creating the credentials" },
+        { key: "PARCEL2GO_CUSTOMER_EMAIL", breaks: "Parcel2Go rejects every order: it books a courier for a named person and will not accept one without", where: "the email on your Parcel2Go account" },
+        { key: "PARCEL2GO_CUSTOMER_FORENAME", breaks: "the same" },
+        { key: "PARCEL2GO_CUSTOMER_SURNAME", breaks: "the same" },
+        { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+        { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+        { key: "SHIP_FROM_CITY", breaks: "the same" },
+        { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+        { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" }
       ]
     },
-    { id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [{ key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }] },
-    { id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [{ key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }] },
-    { id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [{ key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" }, { key: "UPS_CLIENT_SECRET", breaks: "the same" }, { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }] },
-    { id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
-    { id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
+    { id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }
+    ] },
+    { id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }
+    ] },
+    { id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" },
+      { key: "UPS_CLIENT_SECRET", breaks: "the same" },
+      { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }
+    ] },
+    { id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" },
+      { key: "FEDEX_CLIENT_SECRET", breaks: "the same" },
+      { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }
+    ] },
+    { id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [
+      { key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+      { key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+      { key: "SHIP_FROM_CITY", breaks: "the same" },
+      { key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+      { key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+      { key: "DHL_API_KEY", breaks: "DHL rates are not quoted" },
+      { key: "DHL_API_SECRET", breaks: "the same" },
+      { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }
+    ] },
     { id: "usps", label: "USPS", hint: "US domestic post — the cheapest way to ship a small parcel inside the US", env: [{ key: "USPS_CLIENT_ID", breaks: "USPS rates are not quoted" }, { key: "USPS_CLIENT_SECRET", breaks: "the same" }] },
     {
       id: "royal-mail",

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-ze4z3n5q.js";
+} from "./index-jycz3x3g.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-cxse24q6.js";
+} from "./index-s8se0x2d.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -81,7 +81,7 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-727eybzt.js";
+} from "./index-30y19qz5.js";
 import {
   AUTH_PLUGINS,
   CARRIERS,
@@ -98,7 +98,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-0je92d88.js";
+} from "./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/dist/{keys-9efk9rdz.js → keys-6neyajsv.js}

@@ -8,9 +8,9 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-cxse24q6.js";
-import"./index-727eybzt.js";
-import"./index-0je92d88.js";
+} from "./index-s8se0x2d.js";
+import"./index-30y19qz5.js";
+import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   publicKeyFor,

package/dist/manifest.js

@@ -18,8 +18,8 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-727eybzt.js";
-import"./index-0je92d88.js";
+} from "./index-30y19qz5.js";
+import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/catalog.ts

@@ -521,13 +521,51 @@ export const CARRIERS: Group = {
 			env: [
 				{ key: "PARCEL2GO_CLIENT_ID", breaks: "no rates are quoted and no collection is ever booked", where: "parcel2go.com/myaccount/api → Client Credentials" },
 				{ key: "PARCEL2GO_CLIENT_SECRET", breaks: "the same — and Parcel2Go will not show it twice, so keep it when you make it", where: "you choose this value when creating the credentials" },
+				{ key: "PARCEL2GO_CUSTOMER_EMAIL", breaks: "Parcel2Go rejects every order: it books a courier for a named person and will not accept one without", where: "the email on your Parcel2Go account" },
+				{ key: "PARCEL2GO_CUSTOMER_FORENAME", breaks: "the same" },
+				{ key: "PARCEL2GO_CUSTOMER_SURNAME", breaks: "the same" },
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
 			],
 		},
-		{ id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [{ key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }] },
-		{ id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [{ key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }] },
-		{ id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [{ key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" }, { key: "UPS_CLIENT_SECRET", breaks: "the same" }, { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }] },
-		{ id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
-		{ id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
+		{ id: "shippo", label: "Shippo", hint: "many carriers through one API", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "SHIPPO_API_TOKEN", breaks: "calculated rates fall back to flat" }] },
+		{ id: "easypost", label: "EasyPost", hint: "the same, US-leaning", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "EASYPOST_API_KEY", breaks: "calculated rates fall back to flat" }] },
+		{ id: "ups", label: "UPS", hint: "your own UPS account, for negotiated rates an aggregator cannot see", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "UPS_CLIENT_ID", breaks: "UPS rates are not quoted" }, { key: "UPS_CLIENT_SECRET", breaks: "the same" }, { key: "UPS_ACCOUNT_NUMBER", breaks: "UPS has no account to bill the transport to" }] },
+		{ id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
+		{ id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [
+				{ key: "SHIP_FROM_NAME", breaks: "a courier has no one to ask for at the door, and most carriers refuse an origin with no name" },
+				{ key: "SHIP_FROM_LINE1", breaks: "the courier is sent to an incomplete address" },
+				{ key: "SHIP_FROM_CITY", breaks: "the same" },
+				{ key: "SHIP_FROM_POSTCODE", breaks: "every rate is quoted against the wrong place, so every order is mispriced" },
+				{ key: "SHIP_FROM_PHONE", breaks: "a driver who cannot find the door has no one to ring" },
+			{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
 		{ id: "usps", label: "USPS", hint: "US domestic post — the cheapest way to ship a small parcel inside the US", env: [{ key: "USPS_CLIENT_ID", breaks: "USPS rates are not quoted" }, { key: "USPS_CLIENT_SECRET", breaks: "the same" }] },
 		{
 			id: "royal-mail",

package/src/deploy/index.ts

@@ -61,12 +61,40 @@ export async function preflightCommand(args: string[]): Promise<number> {
 		console.error("vc: no voidcommerce.json here.");
 		return 1;
 	}
-	const source = args.includes("--cloudflare") ? "wrangler" : "void";
+	const source = args.includes("--repo") ? "repository" : args.includes("--cloudflare") ? "wrangler" : "void";
 	const result = await preflight(project, source);
 	printPreflight(project, result, source);
+	if (source !== "repository") return result.ready ? 0 : 1;
+
+	// A repository check is a check on what will be PUSHED, so it also asks
+	// the question CI would ask and cannot answer any earlier: is there a
+	// migration that was generated and never committed? Applied under a fresh
+	// name on the next run, against tables that already exist, it fails the
+	// deploy — and it fails it after the shop is already down for the update.
+	const pending = await uncommittedMigrations(project.root);
+	if (pending.length > 0) {
+		console.error(
+			`${color.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:\n` +
+				`    ${pending.join("\n    ")}\n\n` +
+				"  The deploy applies what is in the repository. Commit these, or the\n" +
+				"  schema the shop runs on is not the one you tested.\n",
+		);
+		return 1;
+	}
 	return result.ready ? 0 : 1;
 }
 
+/** Migration files git does not have — untracked or modified. */
+async function uncommittedMigrations(root: string): Promise<string[]> {
+	const status = await run("git", ["status", "--porcelain", "--", "migrations"], root);
+	if (status.code !== 0) return [];
+	return status.out
+		.split("\n")
+		.map((line) => line.trim())
+		.filter(Boolean)
+		.map((line) => line.replace(/^\S+\s+/, ""));
+}
+
 /** void's deploy help, then what vc adds. */
 export async function deployHelp(): Promise<number> {
 	const captured = await captureVoid(["deploy", "--help"]);

package/src/deploy/preflight.ts

@@ -7,7 +7,7 @@ import { workerHosts } from "../manifest";
 import type { Project } from "../project";
 import { captureVoid } from "../void";
 import { parseJsonc } from "./jsonc";
-import { SECRETS_FILE, declaredSecretNames, plaintextSecretNames } from "./secrets";
+import { SECRETS_FILE, declaredSecretNames, plaintextSecretNames, unsetSecretNames } from "./secrets";
 import { findWrangler, secretNames } from "./wrangler";
 
 /**
@@ -34,7 +34,16 @@ export interface Preflight {
 	ready: boolean;
 }
 
-export type SecretSource = "wrangler" | "void";
+/**
+ * Where a secret's presence is established.
+ *
+ * `repository` asks only what is committed, and is the right question before
+ * a PUSH: the deploy happens off this machine from what was pushed, so a
+ * check that needs local credentials is checking the wrong thing. It is also
+ * the only mode that works on a machine which has none — which, if config is
+ * properly in the environment, is every machine.
+ */
+export type SecretSource = "wrangler" | "void" | "repository";
 
 /** Keys committed in .env.production — safe values only, by construction. */
 export function productionEnv(appDir: string): Map<string, string> {
@@ -81,7 +90,9 @@ export function routeProblem(project: Project): string | null {
 export async function preflight(project: Project, source: SecretSource): Promise<Preflight> {
 	const present = productionEnv(project.appDir);
 	let remote: Set<string> | null = null;
-	if (source === "wrangler") {
+	if (source === "repository") {
+		remote = null;
+	} else if (source === "wrangler") {
 		const bin = findWrangler(project.appDir);
 		remote = bin ? await secretNames(bin, project.appDir) : null;
 	} else {
@@ -94,7 +105,12 @@ export async function preflight(project: Project, source: SecretSource): Promise
 	 * uploads it. The names are readable without the key — dotenvx encrypts
 	 * values, not keys — so this works on a machine that cannot decrypt.
 	 */
-	for (const name of declaredSecretNames(project.root)) present.set(name, "<in the repository>");
+	const stillUnset = new Set(unsetSecretNames(project.root));
+	for (const name of declaredSecretNames(project.root)) {
+		// A name is not a value. `unset` is the documented placeholder, so a
+		// key carrying it is declared and absent at the same time.
+		if (!stillUnset.has(name)) present.set(name, "<in the repository>");
+	}
 
 	const missing = allEnvKeys(project.manifest).filter((key) => {
 		const value = present.get(key.key);

package/src/deploy/secrets.ts

@@ -126,6 +126,27 @@ export function declaredSecretNames(root: string): Set<string> {
 	return names;
 }
 
+/**
+ * Declared names whose value is still the `unset` placeholder.
+ *
+ * Readable WITHOUT the key, because `unset` is plaintext — which is what
+ * lets a push-time gate tell "this shop has a Stripe key" from "this shop
+ * has a line that says STRIPE_SECRET_KEY". Preflight used to count the
+ * second as present, so a shop could pass every check and then fail to take
+ * money in production.
+ */
+export function unsetSecretNames(root: string): string[] {
+	const path = join(root, SECRETS_FILE);
+	if (!existsSync(path)) return [];
+	const out: string[] = [];
+	for (const line of readFileSync(path, "utf8").split("\n")) {
+		const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+		if (!match || match[1]!.startsWith("DOTENV_")) continue;
+		if (match[2]!.trim().replace(/^['"]|['"]$/g, "") === "unset") out.push(match[1]!);
+	}
+	return out;
+}
+
 /** Is a declared value actually encrypted, or was it committed in the clear? */
 export function plaintextSecretNames(root: string): string[] {
 	const path = join(root, SECRETS_FILE);

package/src/generate/index.ts

@@ -195,6 +195,82 @@ async function link(root: string, file: string, target: string, result: Generate
 
 const sorted = (record: Record<string, string>) => Object.fromEntries(Object.entries(record).sort());
 
+/**
+ * Git hooks, for every layout.
+ *
+ * They guard `.env.secrets`, which exists whatever the layout, so making
+ * them strict-only left an `app` shop able to commit a credential in the
+ * clear with nothing to stop it. Installed by husky on `bun install`, so a
+ * fresh clone is guarded without anyone remembering.
+ */
+async function generateHooks(root: string, result: GenerateResult) {
+	/**
+	 * The hook lives in `.husky/`, which is COMMITTED, so the guard travels
+	 * with the repository instead of being something each clone remembers to
+	 * install. A secret committed in the clear cannot be un-committed.
+	 */
+	await put(
+		root,
+		".husky/pre-commit",
+		`#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
+# file so the COMMIT carries the ciphertext rather than what you staged.
+# Encryption needs only the public key in that file, so this needs no
+# credential and works on a fresh clone.
+#
+# It refuses only when it cannot fix the problem itself: no key yet
+# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
+# committed in the clear cannot be un-committed — the value stays in the
+# history and has to be treated as burned.
+bunx vc guard
+`,
+		result,
+		"regenerate",
+	);
+	/**
+	 * Pushing main IS the deploy, so this is the last moment anything is
+	 * checked by someone who can read the error.
+	 *
+	 * Everything the deploy needs is in the repository — that is the whole
+	 * point of keeping config in the environment — so the check needs no
+	 * credentials and runs anywhere. It asks the questions CI cannot answer
+	 * until it is too late to matter: is every required key actually SET
+	 * rather than merely declared, is anything committed in the clear, do the
+	 * hostnames match the manifest, is a migration missing.
+	 *
+	 * Only for main. Pushing a branch is not a deploy, and gating it would
+	 * teach people to reach for --no-verify, which turns the gate off for the
+	 * push that does matter.
+	 */
+	await put(
+		root,
+		".husky/pre-push",
+		`#!/usr/bin/env sh
+# Generated by \`vc init\`.
+#
+# Pushing main deploys this shop, so the same checks the deploy would make
+# run here first — where you can read the error and fix it, rather than in a
+# build log after the shop is already updating.
+#
+# Needs no credentials: it reads only what is committed.
+# To push anyway, deliberately: git push --no-verify
+
+while read -r _local_ref _local_sha remote_ref _remote_sha; do
+  case "$remote_ref" in
+    refs/heads/main|refs/heads/master)
+      echo "vc: main is the deploy branch — checking what you are about to publish"
+      bunx vc preflight --repo || exit 1
+      ;;
+  esac
+done
+`,
+		result,
+		"regenerate",
+	);
+}
+
 export async function generate(root: string, manifest: Manifest): Promise<GenerateResult> {
 	const result: GenerateResult = { written: [], kept: [], retired: [], packages: packagesOf(manifest) };
 
@@ -218,6 +294,7 @@ export async function generate(root: string, manifest: Manifest): Promise<Genera
 			await generateStrictApp(root, STRICT_APP, manifest, result);
 			break;
 	}
+	await generateHooks(root, result);
 	return result;
 }
 
@@ -248,7 +325,11 @@ async function generateApi(root: string, dir: string, manifest: Manifest, result
 	// against, or a price table. The list lives with the carriers themselves so
 	// it cannot drift from them.
 	if (WIRED_CARRIERS.some((id) => needsShippingConfig(id) && has(manifest, id))) {
-		await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, own);
+		// REGENERATED, not owned. It used to carry the shop's address as
+		// constants, which made it config and so nobody's to overwrite. Now it
+		// only READS that config from the environment, so it is ordinary code
+		// and should receive fixes like any other generated file.
+		await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, "regenerate");
 	}
 	if (has(manifest, "business-central")) {
 		await put(root, at("lib/erp.ts"), renderErpTs(), result, own);
@@ -420,31 +501,6 @@ async function generateStrictRoot(root: string, manifest: Manifest, result: Gene
 		"own",
 	);
 	await put(root, "patches/void@0.10.13.patch", renderVoidPatch(), result, "regenerate");
-	/**
-	 * The hook lives in `.husky/`, which is COMMITTED, so the guard travels
-	 * with the repository instead of being something each clone remembers to
-	 * install. A secret committed in the clear cannot be un-committed.
-	 */
-	await put(
-		root,
-		".husky/pre-commit",
-		`#!/usr/bin/env sh
-# Generated by \`vc init\`.
-#
-# Encrypts any value sitting in the clear in .env.secrets, and re-stages the
-# file so the COMMIT carries the ciphertext rather than what you staged.
-# Encryption needs only the public key in that file, so this needs no
-# credential and works on a fresh clone.
-#
-# It refuses only when it cannot fix the problem itself: no key yet
-# (\`vc keys --init\`), or a .env.keys that is not gitignored. A secret
-# committed in the clear cannot be un-committed — the value stays in the
-# history and has to be treated as burned.
-bunx vc guard
-`,
-		result,
-		"regenerate",
-	);
 	await put(root, ".github/workflows/deploy.yml", renderDistWorkflow(manifest), result, "regenerate");
 	// Renamed when GitHub Actions took over the deploy from Cloudflare's own
 	// build. Two workflows on the same push would deploy the shop twice.

package/src/generate/support.ts

@@ -281,44 +281,59 @@ export function renderShippingTs(manifest: Manifest): string {
 	const origin = ["parcel2go", "dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
 
 	const imports = [
+		...(origin || parcel2go ? [`import { env } from "void/env";`] : []),
 		...(origin ? [`import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";`] : []),
 		...(royalMail ? [`import type { RoyalMailService } from "@saastemly/better-commerce/providers/royal-mail";`] : []),
 	];
 
-	const originBlock = `
+	const header = `
 /**
- * The address every parcel is quoted and shipped FROM.
+ * Where parcels come FROM, and who the carrier account belongs to.
+ *
+ * These are CONFIG, not code: they vary per deploy, they are nobody's
+ * business but this shop's, and hard-coding them here would mean a fresh
+ * clone of this repository shipped somebody else's address. So they come
+ * from the environment — declared in env.ts, encrypted in .env.secrets, and
+ * set with \`vc secrets set\`.
  *
- * TODO VERIFY: this is a placeholder. A carrier quotes against it, and most
- * refuse a shipment whose origin has no \`name\` and \`phone\`.
+ * This file's job is to read them and fail loudly when one is missing, which
+ * is the difference between a shop that refuses to quote and a shop that
+ * quotes against the wrong postcode and loses money on every order.
  */
+const must = (key: string): string => {
+	const value = (env as Record<string, unknown>)[key];
+	if (typeof value !== "string" || !value || value === "unset") {
+		throw new Error(\`shipping: \${key} is not set — \\\`vc secrets set \${key}\\\`\`);
+	}
+	return value;
+};
+`;
+
+	const originBlock = `
+/** The address every parcel is quoted against, and the door a courier is sent to. */
 export const shipFrom: DeliveryAddress = {
-	name: "${manifest.shop.name}",
-	line1: "TODO VERIFY: street",
-	city: "TODO VERIFY: town",
-	postalCode: "TODO VERIFY",
+	name: must("SHIP_FROM_NAME"),
+	line1: must("SHIP_FROM_LINE1"),
+	city: must("SHIP_FROM_CITY"),
+	postalCode: must("SHIP_FROM_POSTCODE"),
 	country: "${manifest.shop.country}",
-	phone: "TODO VERIFY: +44…",
+	phone: must("SHIP_FROM_PHONE"),
 };
 `;
 
 	const parcel2goBlock = `
 /**
- * Who the Parcel2Go account belongs to.
- *
- * Every order carries it: Parcel2Go books a courier to come to a real person
- * at a real door, and needs to know whose door. This is the ACCOUNT holder,
- * not the buyer — the buyer's details ride on the parcel.
- *
- * TODO VERIFY: these are placeholders.
+ * Who the Parcel2Go account belongs to — the ACCOUNT holder, not the buyer.
+ * Parcel2Go books a courier for a named person and rejects an order without.
  */
 export const parcel2goCustomer = {
-	email: "TODO VERIFY: the email on your Parcel2Go account",
-	forename: "TODO VERIFY",
-	surname: "TODO VERIFY",
+	email: must("PARCEL2GO_CUSTOMER_EMAIL"),
+	forename: must("PARCEL2GO_CUSTOMER_FORENAME"),
+	surname: must("PARCEL2GO_CUSTOMER_SURNAME"),
 };
 `;
-	return `${imports.join("\n")}\n${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
+
+	return `${imports.join("\n")}\n${origin || parcel2go ? header : ""}${origin ? originBlock : ""}${parcel2go ? parcel2goBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
 }
 
 export function renderErpTs(): string {