@saastemly/voidcommerce 0.16.1 → 0.18.0

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-w0c96dxv.js";
+} from "./index-3j6jtjmk.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -32,6 +32,8 @@ import {
   declaredSecretNames,
   encryptInto,
   envSummary,
+  findGh,
+  getVariable,
   ghAuth,
   ignoresKeyFile,
   initSecrets,
@@ -44,13 +46,14 @@ import {
   publicKeyFor,
   repoSlug,
   run,
+  run1 as run2,
   secretNames,
   secretsCommand,
   setSecret,
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-s8se0x2d.js";
+} from "./index-khzk6a9z.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -67,9 +70,9 @@ import {
 } from "./index-0v6na3yp.js";
 
 // src/deploy/index.ts
-import color2 from "picocolors";
-import { existsSync } from "node:fs";
-import { join as join2 } from "node:path";
+import color3 from "picocolors";
+import { existsSync as existsSync2 } from "node:fs";
+import { join as join3 } from "node:path";
 
 // src/deploy/link.ts
 import { rmSync } from "node:fs";
@@ -118,16 +121,23 @@ async function linkCommand(project, args) {
   } else {
     const parked = localPrivateKey(root);
     if (parked) {
-      const sent = await setSecret(root, PRIVATE_KEY_VAR, parked);
+      const sent = await setVariable(root, PRIVATE_KEY_VAR, parked);
       if (!sent.ok) {
-        p.cancel(`GitHub refused the secret: ${sent.error ?? "unknown error"}`);
+        p.cancel(`GitHub refused the variable: ${sent.error ?? "unknown error"}`);
         return 1;
       }
       const publicKey = await publicKeyFor(parked);
       if (publicKey)
         committedPublicKeyInto(root, publicKey);
-      rmSync(join(root, LOCAL_KEY_FILE), { force: true });
-      p.log.success(`${color.green("✓")} the key waiting in ${LOCAL_KEY_FILE} moved to GitHub, and the file deleted`);
+      const readBack = await getVariable(root, PRIVATE_KEY_VAR);
+      if (readBack !== parked) {
+        p.log.warn(`${color.yellow("!")} ${PRIVATE_KEY_VAR} was written to ${slug} but could not be read back,
+  so ${LOCAL_KEY_FILE} has been LEFT IN PLACE. It is currently the only copy
+` + "  of the key that opens this shop — do not delete it until `vc keys --restore` works.");
+      } else {
+        rmSync(join(root, LOCAL_KEY_FILE), { force: true });
+        p.log.success(`${color.green("✓")} the key moved to ${slug} and ${LOCAL_KEY_FILE} deleted — verified readable, so \`vc keys --restore\` can bring it back`);
+      }
     } else {
       const made = await provisionKey(project);
       if (!made.ok) {
@@ -216,6 +226,106 @@ async function linkCommand(project, args) {
   return 0;
 }
 
+// src/deploy/publish.ts
+import { existsSync } from "node:fs";
+import { join as join2 } from "node:path";
+import color2 from "picocolors";
+async function publishCommand(project, args) {
+  const p = await import("@clack/prompts");
+  const root = project.root;
+  const gh = findGh();
+  p.intro(color2.bgCyan(color2.black(" vc publish ")));
+  const auth = await ghAuth(root);
+  if (!auth.ok || !gh) {
+    p.cancel(auth.reason ?? "the GitHub CLI is not installed. https://cli.github.com");
+    return 1;
+  }
+  if (!existsSync(join2(root, ".git"))) {
+    p.cancel(`${root} is not a git repository. \`git init\` first, and commit what you have.`);
+    return 1;
+  }
+  let slug = await repoSlug(root);
+  if (slug) {
+    p.log.info(`${slug} already exists — using it`);
+  } else {
+    const suggested = project.manifest.shop.domain.split(".")[0] ?? "shop";
+    const name = await p.text({
+      message: "Repository name",
+      initialValue: suggested,
+      validate: (value) => /^[A-Za-z0-9._-]+$/.test(value.trim()) ? undefined : "letters, digits, dot, dash or underscore"
+    });
+    if (p.isCancel(name)) {
+      p.cancel("nothing was created.");
+      return 1;
+    }
+    const visibility = await p.select({
+      message: "Visibility",
+      options: [
+        { value: "--private", label: "Private", hint: "the key that opens your secrets is readable to anyone with access" },
+        { value: "--public", label: "Public", hint: "only if this shop keeps no secrets at all" }
+      ],
+      initialValue: "--private"
+    });
+    if (p.isCancel(visibility)) {
+      p.cancel("nothing was created.");
+      return 1;
+    }
+    const spinner2 = p.spinner();
+    spinner2.start(`creating ${String(name)}`);
+    const created = await run(gh, ["repo", "create", String(name).trim(), "--source=.", String(visibility)], root);
+    if (created.code !== 0) {
+      spinner2.stop(`${color2.red("✗")} could not create it`);
+      p.cancel(created.out.trim().split(`
+`).slice(-2).join(" "));
+      return 1;
+    }
+    slug = await repoSlug(root);
+    spinner2.stop(`${color2.green("✓")} ${slug ?? String(name)} created, and set as origin`);
+  }
+  p.log.step("giving the repository what the deploy needs");
+  const linked = await linkCommand(project, args);
+  if (linked !== 0) {
+    p.cancel("the repository exists but is not configured, so a push would not deploy. Fix the above and run `vc publish` again.");
+    return 1;
+  }
+  const dirty = (await run("git", ["status", "--porcelain"], root)).out.trim();
+  if (dirty) {
+    const staged = await run("git", ["add", "-A"], root);
+    const committed = await run("git", ["commit", "-m", "vc publish: link this shop to its repository"], root);
+    if (staged.code !== 0 || committed.code !== 0) {
+      p.cancel(`could not commit the changes vc link made:
+${committed.out.trim().split(`
+`).slice(-3).join(`
+`)}`);
+      return 1;
+    }
+    p.log.success(`${color2.green("✓")} committed what linking changed`);
+  }
+  const branch = (await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], root)).out.trim() || "main";
+  const spinner = p.spinner();
+  spinner.start(`pushing ${branch}`);
+  const pushed = await run("git", ["push", "-u", "origin", `${branch}:main`], root);
+  if (pushed.code !== 0) {
+    spinner.stop(`${color2.red("✗")} the push failed`);
+    p.cancel(pushed.out.trim().split(`
+`).slice(-4).join(`
+`));
+    return 1;
+  }
+  spinner.stop(`${color2.green("✓")} pushed to main`);
+  p.outro([
+    `${color2.bold("Published.")} The deploy is running now.`,
+    "",
+    `  ${color2.cyan(`https://github.com/${slug}/actions`)}`,
+    "",
+    `  From here ${color2.cyan("git push")} is the whole loop. \`vc\` is only needed to`,
+    `  change a secret (${color2.cyan("vc secrets set KEY")}) or read one back`,
+    `  (${color2.cyan("vc keys --restore")}).`
+  ].join(`
+`));
+  return 0;
+}
+
 // src/deploy/index.ts
 async function deployCommand(args) {
   const own = new Set(["--cloudflare", "--provision", "--force"]);
@@ -239,12 +349,12 @@ async function deployCommand(args) {
   const check = await preflight(project, "void");
   printPreflight(project, check, "void");
   if (!check.ready && check.remote !== null && !args.includes("--force")) {
-    console.error(`${color2.red("✗")} refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force.
+    console.error(`${color3.red("✗")} refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force.
 `);
     return 1;
   }
   if (!check.ready && check.remote === null) {
-    console.log(color2.dim(`Secrets could not be verified here; void's own deploy gate is the next check.
+    console.log(color3.dim(`Secrets could not be verified here; void's own deploy gate is the next check.
 `));
   }
   return runVoid(["deploy", ...voids], project.appDir);
@@ -262,7 +372,7 @@ async function preflightCommand(args) {
     return result.ready ? 0 : 1;
   const pending = await uncommittedMigrations(project.root);
   if (pending.length > 0) {
-    console.error(`${color2.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:
+    console.error(`${color3.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:
 ` + `    ${pending.join(`
     `)}
 
@@ -274,7 +384,7 @@ async function preflightCommand(args) {
   return result.ready ? 0 : 1;
 }
 async function uncommittedMigrations(root) {
-  const status = await run("git", ["status", "--porcelain", "--", "migrations"], root);
+  const status = await run2("git", ["status", "--porcelain", "--", "migrations"], root);
   if (status.code !== 0)
     return [];
   return status.out.split(`
@@ -287,13 +397,13 @@ async function deployHelp() {
     line("vc's preflight — every required key set, the hostnames right — then", width),
     line("void deploy, untouched. Or, with --cloudflare, your own account via wrangler.", width),
     line("", width),
-    line(color2.bold("Usage"), width),
+    line(color3.bold("Usage"), width),
     ...row("vc deploy [void's flags]", "preflight, then void deploy — the Void platform, void's login", width, 2),
     ...row("vc deploy --cloudflare", "wrangler, your Cloudflare account, no Void login: preflight, build, scrub baked secrets, migrate D1, deploy", width, 2),
     ...row("vc deploy --cloudflare --provision", "first time: create the D1 database and the queue, record them", width, 2),
     ...row("vc deploy --cloudflare --force", "deploy a shop preflight says is not ready — deliberately", width, 2),
     line("", width),
-    line(color2.bold("Needs, for --cloudflare"), width),
+    line(color3.bold("Needs, for --cloudflare"), width),
     ...row("CLOUDFLARE_API_TOKEN", "in the environment; the account is pinned for you when there is one", width, 2),
     ...row(PRIVATE_KEY_VAR, "to decrypt the shop's own secrets", width, 2),
     line("", width),
@@ -372,10 +482,15 @@ async function keysHelp() {
     line("A contributor with only a clone can rotate the Stripe key and cannot read", width),
     line("the one already there. Only the deploy decrypts.", width),
     line("", width),
-    line("GitHub will not hand a secret back once set, so re-keying without a local", width),
-    line("copy means entering the values again. That is the right trade: a key worth", width),
-    line("rotating is a key that may have leaked, and leaked values need replacing", width),
-    line("at the source anyway.", width)
+    line("The key is a repository VARIABLE, not a secret. GitHub secrets are", width),
+    line("write-only — `gh secret` has no read command — so a key kept there is", width),
+    line("gone the moment your local copy is, and every encrypted value with it.", width),
+    line("As a variable it can be read back, which is what makes a new machine or", width),
+    line("a second person possible: `vc keys --restore`.", width),
+    line("", width),
+    line("So anyone who can READ the repository can decrypt its secrets. Keep it", width),
+    line("private. That access list is also how you share: a collaborator can", width),
+    line("restore the key, and removing them removes their access.", width)
   ], width));
   return 0;
 }
@@ -384,9 +499,9 @@ async function guardCommand() {
   if (!project)
     return 0;
   const root = project.root;
-  if (existsSync(join2(root, LOCAL_KEY_FILE)) && !ignoresKeyFile(root)) {
+  if (existsSync2(join3(root, LOCAL_KEY_FILE)) && !ignoresKeyFile(root)) {
     console.error(`
-${color2.red("✗ refusing the commit")}: ${LOCAL_KEY_FILE} exists and is NOT gitignored.
+${color3.red("✗ refusing the commit")}: ${LOCAL_KEY_FILE} exists and is NOT gitignored.
 
 ` + `  It holds the private key that opens every secret in this repository.
 ` + `  Add ${LOCAL_KEY_FILE} to .gitignore before committing anything.
@@ -399,24 +514,24 @@ ${color2.red("✗ refusing the commit")}: ${LOCAL_KEY_FILE} exists and is NOT gi
   const publicKey = committedPublicKey(root);
   if (!publicKey) {
     console.error(`
-${color2.red("✗ refusing the commit")}: ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE} ${bare.length === 1 ? "is" : "are"} in the clear, and there is no key to encrypt ${bare.length === 1 ? "it" : "them"} with.
+${color3.red("✗ refusing the commit")}: ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE} ${bare.length === 1 ? "is" : "are"} in the clear, and there is no key to encrypt ${bare.length === 1 ? "it" : "them"} with.
 
 ` + `    ${bare.map((entry) => entry.name).join(`
     `)}
 
-` + `  ${color2.cyan("vc keys --init")}  makes one — no GitHub repository needed yet.
+` + `  ${color3.cyan("vc keys --init")}  makes one — no GitHub repository needed yet.
 
-` + color2.dim(`  Committing a secret in the clear cannot be undone by a later commit;
+` + color3.dim(`  Committing a secret in the clear cannot be undone by a later commit;
   the value stays in the history and must be treated as burned.
 `));
     return 1;
   }
-  const staged = (await run("git", ["diff", "--cached", "--name-only", "--", SECRETS_FILE], root)).out.trim().length > 0;
+  const staged = (await run2("git", ["diff", "--cached", "--name-only", "--", SECRETS_FILE], root)).out.trim().length > 0;
   for (const entry of bare) {
     const sealed = await encryptInto(root, publicKey, entry.name, entry.value);
     if (!sealed.ok) {
       console.error(`
-${color2.red("✗ refusing the commit")}: ${sealed.error}
+${color3.red("✗ refusing the commit")}: ${sealed.error}
 `);
       return 1;
     }
@@ -424,23 +539,23 @@ ${color2.red("✗ refusing the commit")}: ${sealed.error}
   const left = plaintextSecretNames(root);
   if (left.length > 0) {
     console.error(`
-${color2.red("✗ refusing the commit")}: ${left.join(", ")} could not be encrypted.
+${color3.red("✗ refusing the commit")}: ${left.join(", ")} could not be encrypted.
 `);
     return 1;
   }
   if (staged) {
-    const added = await run("git", ["add", "--", SECRETS_FILE], root);
+    const added = await run2("git", ["add", "--", SECRETS_FILE], root);
     if (added.code !== 0) {
       console.error(`
-${color2.red("✗ refusing the commit")}: ${SECRETS_FILE} was encrypted but could not be re-staged,
+${color3.red("✗ refusing the commit")}: ${SECRETS_FILE} was encrypted but could not be re-staged,
 ` + `  so the commit would still carry the plaintext you staged. \`git add ${SECRETS_FILE}\`.
 `);
       return 1;
     }
   }
   console.log(`
-${color2.green("✓")} encrypted ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE}${staged ? " and re-staged it" : ""}: ${bare.map((entry) => entry.name).join(", ")}
-` + color2.dim(`  Encryption needs only the public key, so this needs no credential.
+${color3.green("✓")} encrypted ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE}${staged ? " and re-staged it" : ""}: ${bare.map((entry) => entry.name).join(", ")}
+` + color3.dim(`  Encryption needs only the public key, so this needs no credential.
 `));
   return 0;
 }
@@ -461,12 +576,12 @@ async function linkHelp() {
     ...row("vc link", "store the encryption key and the Cloudflare token on the repository", width, 2),
     ...row("vc link --force", "replace what is already there", width, 2),
     line("", width),
-    line(color2.bold("What it stores, and where"), width),
+    line(color3.bold("What it stores, and where"), width),
     ...row(PRIVATE_KEY_VAR, "a repository SECRET. A key already waiting locally is MOVED here and the local copy deleted", width, 2),
     ...row("CLOUDFLARE_API_TOKEN", "a repository SECRET, checked against the Cloudflare API before it is stored", width, 2),
     ...row("CLOUDFLARE_ACCOUNT_ID", "a repository VARIABLE — an identifier, not a credential", width, 2),
     line("", width),
-    line(color2.bold("Why one token still has to be typed"), width),
+    line(color3.bold("Why one token still has to be typed"), width),
     line("GitHub cannot mint a Cloudflare credential. There is no OIDC federation", width),
     line("between them, and the Cloudflare GitHub App runs the other way: it grants", width),
     line("Cloudflare access to your repository, not your repository access to", width),
@@ -474,16 +589,49 @@ async function linkHelp() {
   ], width));
   return 0;
 }
+async function publishCliCommand(args) {
+  const project = await findProject();
+  if (!project) {
+    console.error("vc: no voidcommerce.json here.");
+    return 1;
+  }
+  return publishCommand(project, args);
+}
+async function publishHelp() {
+  const width = 80;
+  console.log(box("vc publish", [
+    line("Create this shop's GitHub repository, give it what the deploy needs,", width),
+    line("and push. The push IS the deploy. Run once; after that, `git push`.", width),
+    line("", width),
+    ...row("vc publish", "create the repository, set the credentials, push main", width, 2),
+    line("", width),
+    line(color3.bold("What it does for you"), width),
+    ...row("the encryption key", "vc already holds it — set with no input from you", width, 2),
+    ...row("the account id", "read from voidcommerce.json", width, 2),
+    ...row("the Cloudflare token", "the one thing it has to ask for", width, 2),
+    line("", width),
+    line(color3.bold("Why the token cannot be automated away"), width),
+    line("There is no OIDC between GitHub and Cloudflare, so something must carry", width),
+    line("a token across, and only a person can fetch one from the dashboard. It", width),
+    line("is asked for once, checked against the Cloudflare API, and stored on the", width),
+    line("repository — never on this machine.", width),
+    line("", width),
+    line("The repository is created WITHOUT pushing, then configured, then pushed.", width),
+    line("Pushing first would start a deploy against a repository that has no key", width),
+    line("and no token: a red run, for no reason but the wrong order.", width)
+  ], width));
+  return 0;
+}
 
 // src/init.ts
 import * as p2 from "@clack/prompts";
 import { mkdir } from "node:fs/promises";
-import { basename, join as join3 } from "node:path";
-import color4 from "picocolors";
+import { basename, join as join4 } from "node:path";
+import color5 from "picocolors";
 
 // src/wizard.ts
 import * as p from "@clack/prompts";
-import color3 from "picocolors";
+import color4 from "picocolors";
 var bail = () => {
   p.cancel("Nothing was written.");
   process.exit(0);
@@ -505,8 +653,8 @@ async function askGroup(group2, previous, alsoRequired = []) {
   const required = group2.choices.filter((choice) => requiredIds.has(choice.id));
   const optional = group2.choices.filter((choice) => !requiredIds.has(choice.id));
   const message = group2.title + (group2.intro ? `
-${color3.dim(group2.intro)}` : "") + (required.length ? `
-${color3.dim(`Included: ${required.map((choice) => choice.label).join(", ")}`)}` : "");
+${color4.dim(group2.intro)}` : "") + (required.length ? `
+${color4.dim(`Included: ${required.map((choice) => choice.label).join(", ")}`)}` : "");
   if (optional.length === 0) {
     p.log.info(message);
     return required.map((choice) => choice.id);
@@ -537,7 +685,7 @@ async function runWizard(existing, layout) {
       validate: (value) => value.trim() ? undefined : "A shop has a name."
     }),
     domain: () => p.text({
-      message: `Domain ${color3.dim(monorepo ? "— the storefront; api.<domain> is the worker; the CORS list and DNS records derive from it" : "— the shop answers here; the worker's custom domain")}`,
+      message: `Domain ${color4.dim(monorepo ? "— the storefront; api.<domain> is the worker; the CORS list and DNS records derive from it" : "— the shop answers here; the worker's custom domain")}`,
       placeholder: "northwind.com",
       initialValue: existing?.shop.domain ?? "",
       validate: (value) => /^[a-z0-9-]+(\.[a-z0-9-]+)+\.[a-z]{2,}$|^[a-z0-9-]+\.[a-z]{2,}$/i.test(value.trim()) ? undefined : "A hostname, like northwind.com or shop.northwind.com."
@@ -548,7 +696,7 @@ async function runWizard(existing, layout) {
       if (!domain || domain === guess)
         return Promise.resolve(undefined);
       return p.text({
-        message: `DNS zone ${color3.dim(`— ${domain} lives inside it; records go here, and this zone must be on your DNS provider`)}`,
+        message: `DNS zone ${color4.dim(`— ${domain} lives inside it; records go here, and this zone must be on your DNS provider`)}`,
         placeholder: guess,
         initialValue: existing?.shop.zone ?? guess,
         validate: (value) => {
@@ -560,13 +708,13 @@ async function runWizard(existing, layout) {
       });
     },
     country: () => p.text({
-      message: `Country ${color3.dim("— sets the declared VAT rate and the default region")}`,
+      message: `Country ${color4.dim("— sets the declared VAT rate and the default region")}`,
       placeholder: "US",
       initialValue: existing?.shop.country ?? "",
       validate: (value) => /^[A-Za-z]{2}$/.test(value.trim()) ? undefined : "ISO-3166 alpha-2, like DK."
     }),
     taxRegistered: () => p.select({
-      message: `Registered to charge tax? ${color3.dim("— a business below its registration threshold must NOT add tax to a price, and one above it must")}`,
+      message: `Registered to charge tax? ${color4.dim("— a business below its registration threshold must NOT add tax to a price, and one above it must")}`,
       options: [
         { value: "no", label: "Not registered", hint: "prices are what the customer pays; no tax is added. The common case for a new shop" },
         { value: "yes", label: "Registered", hint: "the country's standard rate is declared and added" }
@@ -580,14 +728,14 @@ async function runWizard(existing, layout) {
       validate: (value) => /^[A-Za-z]{3}$/.test(value.trim()) ? undefined : "ISO-4217, like dkk."
     }),
     locale: () => p.text({
-      message: `Locale ${color3.dim("— the language of emails and launch content")}`,
+      message: `Locale ${color4.dim("— the language of emails and launch content")}`,
       placeholder: "en",
       initialValue: existing?.shop.locale ?? "",
       validate: (value) => /^[a-z]{2}(-[A-Z]{2})?$/.test(value.trim()) ? undefined : "like da, or en-GB."
     }),
     ...onPages ? {
       pagesHost: () => p.text({
-        message: `GitHub Pages host ${color3.dim("— where the storefront is published; leave blank if you serve the branch elsewhere")}`,
+        message: `GitHub Pages host ${color4.dim("— where the storefront is published; leave blank if you serve the branch elsewhere")}`,
         placeholder: "northwind.github.io",
         initialValue: existing?.shop.pagesHost ?? "",
         validate: (value) => !value.trim() || /^[a-z0-9-]+\.github\.io$/i.test(value.trim()) ? undefined : "<owner>.github.io, or blank"
@@ -598,7 +746,7 @@ async function runWizard(existing, layout) {
   for (const group2 of GROUPS) {
     if (group2.id === "ui" && layout === "strict") {
       p.log.info(`${group2.title}
-${color3.dim("The generated storefront and panel. Strict has no custom code to host anything else.")}`);
+${color4.dim("The generated storefront and panel. Strict has no custom code to host anything else.")}`);
       chosen[group2.id] = ["admin"];
       continue;
     }
@@ -623,14 +771,14 @@ ${color3.dim("The generated storefront and panel. Strict has no custom code to h
 }
 function summarise(manifest) {
   const lines = [
-    `${color3.dim("Layout".padEnd(34))} ${LAYOUTS.find((l) => l.id === manifest.layout)?.label ?? manifest.layout}`
+    `${color4.dim("Layout".padEnd(34))} ${LAYOUTS.find((l) => l.id === manifest.layout)?.label ?? manifest.layout}`
   ];
   for (const group2 of GROUPS) {
     const ids = manifest.chosen[group2.id] ?? [];
     if (ids.length === 0)
       continue;
     const labels = ids.map((id) => group2.choices.find((choice) => choice.id === id)?.label ?? id).join(", ");
-    lines.push(`${color3.dim(group2.title.padEnd(34))} ${labels}`);
+    lines.push(`${color4.dim(group2.title.padEnd(34))} ${labels}`);
   }
   return lines.join(`
 `);
@@ -671,10 +819,10 @@ async function init(args) {
   if (flags.voids.length > 0)
     return runVoid(["init", ...flags.voids]);
   let root = process.cwd();
-  p2.intro(color4.bgCyan(color4.black(" voidcommerce ")));
+  p2.intro(color5.bgCyan(color5.black(" voidcommerce ")));
   const existing = await readManifest(root);
   if (existing) {
-    p2.log.info(`Found ${color4.cyan("voidcommerce.json")} for ${color4.bold(existing.shop.name)} — answers are pre-filled; the layout (${existing.layout}) is fixed.`);
+    p2.log.info(`Found ${color5.cyan("voidcommerce.json")} for ${color5.bold(existing.shop.name)} — answers are pre-filled; the layout (${existing.layout}) is fixed.`);
     if (flags.layout && flags.layout !== existing.layout) {
       p2.log.error(`This shop is laid out as "${existing.layout}". The layout cannot change after init — moving files is not a regeneration.`);
       return 1;
@@ -682,10 +830,10 @@ async function init(args) {
   }
   const layout = existing?.layout ?? flags.layout ?? await askLayout();
   if (layout === "strict") {
-    p2.log.step(`Strict: the app will be generated under ${color4.cyan(".vc/app")} — nothing there is yours to edit.`);
+    p2.log.step(`Strict: the app will be generated under ${color5.cyan(".vc/app")} — nothing there is yours to edit.`);
   } else if (layout === "app") {
     if (!isVoidApp(root)) {
-      p2.log.step(`No Void app here yet — ${color4.cyan("void init")} first, then the shop.`);
+      p2.log.step(`No Void app here yet — ${color5.cyan("void init")} first, then the shop.`);
       const before = new Set(voidAppsIn(root));
       const code = await runVoid(["init"]);
       if (code !== 0)
@@ -698,7 +846,7 @@ async function init(args) {
         }
         root = created[0];
         process.chdir(root);
-        p2.log.step(`Continuing in ${color4.cyan(`${basename(root)}/`)}`);
+        p2.log.step(`Continuing in ${color5.cyan(`${basename(root)}/`)}`);
       }
     }
   } else {
@@ -707,11 +855,11 @@ async function init(args) {
       ["frontend", "the storefront — prerendered and served from the worker's own assets"]
     ];
     for (const [dir, starter] of parts) {
-      const target = join3(root, dir);
+      const target = join4(root, dir);
       if (isVoidApp(target))
         continue;
       await mkdir(target, { recursive: true });
-      p2.log.step(`${color4.cyan("void init")} in ${color4.cyan(`${dir}/`)} — choose ${starter}.`);
+      p2.log.step(`${color5.cyan("void init")} in ${color5.cyan(`${dir}/`)} — choose ${starter}.`);
       const code = await runVoid(["init"], target);
       if (code !== 0)
         return code;
@@ -729,7 +877,7 @@ async function init(args) {
   if (problems.length > 0) {
     p2.log.error("These answers contradict each other:");
     for (const problem of problems)
-      p2.log.message(`  ${color4.red("✗")} ${problem}`);
+      p2.log.message(`  ${color5.red("✗")} ${problem}`);
     p2.cancel("Nothing was written.");
     return 1;
   }
@@ -745,16 +893,16 @@ async function init(args) {
   spinner2.stop("Generated");
   const { secrets, plaintext } = envSummary(manifest);
   p2.note([
-    ...result.written.map((file) => `${color4.green("+")} ${file}`),
-    ...result.kept.map((file) => `${color4.dim("=")} ${file} ${color4.dim("(kept — yours)")}`),
-    ...result.retired.map((file) => `${color4.red("-")} ${file} ${color4.dim("(retired — no longer generated)")}`)
+    ...result.written.map((file) => `${color5.green("+")} ${file}`),
+    ...result.kept.map((file) => `${color5.dim("=")} ${file} ${color5.dim("(kept — yours)")}`),
+    ...result.retired.map((file) => `${color5.red("-")} ${file} ${color5.dim("(retired — no longer generated)")}`)
   ].join(`
 `), "Files");
   p2.note([
-    `${color4.bold(String(secrets.length))} secrets  ${color4.dim("→ wrangler secret put <NAME>")}`,
+    `${color5.bold(String(secrets.length))} secrets  ${color5.dim("→ wrangler secret put <NAME>")}`,
     ...secrets.map((key) => `  ${key}`),
     "",
-    `${color4.bold(String(plaintext.length))} plaintext ${color4.dim("→ .env.production, already written")}`,
+    `${color5.bold(String(plaintext.length))} plaintext ${color5.dim("→ .env.production, already written")}`,
     ...plaintext.map((key) => `  ${key}`)
   ].join(`
 `), "Before going live");
@@ -764,21 +912,21 @@ async function init(args) {
       return code;
   }
   const next = layout === "app" ? [
-    `  ${color4.cyan("bun install")}`,
-    `  ${color4.cyan("bun run maildev")}      ${color4.dim("local inbox at http://localhost:1080")}`,
-    `  ${color4.cyan("vc dev")}`,
-    `  ${color4.cyan("vc preflight")}        ${color4.dim("what is still missing, and why it matters")}`
+    `  ${color5.cyan("bun install")}`,
+    `  ${color5.cyan("bun run maildev")}      ${color5.dim("local inbox at http://localhost:1080")}`,
+    `  ${color5.cyan("vc dev")}`,
+    `  ${color5.cyan("vc preflight")}        ${color5.dim("what is still missing, and why it matters")}`
   ] : layout === "strict" ? [
-    `  ${color4.cyan("bun install")}`,
-    `  ${color4.cyan("vc generate")}         ${color4.dim("the app under .vc/app, void's artifacts, the migrations")}`,
-    `  ${color4.cyan("bun run maildev")}      ${color4.dim("local inbox at http://localhost:1080")}`,
-    `  ${color4.cyan("vc dev")}               ${color4.dim("runs in .vc/app")}`
+    `  ${color5.cyan("bun install")}`,
+    `  ${color5.cyan("vc generate")}         ${color5.dim("the app under .vc/app, void's artifacts, the migrations")}`,
+    `  ${color5.cyan("bun run maildev")}      ${color5.dim("local inbox at http://localhost:1080")}`,
+    `  ${color5.cyan("vc dev")}               ${color5.dim("runs in .vc/app")}`
   ] : [
-    `  ${color4.cyan("bun install")}          ${color4.dim("one install for both workspaces")}`,
-    `  ${color4.cyan("bun run maildev")}      ${color4.dim("local inbox at http://localhost:1080")}`,
-    `  ${color4.cyan("bun run dev:api")}      ${color4.dim("the worker, with the panel")}`,
-    `  ${color4.cyan("bun run dev:frontend")} ${color4.dim("the storefront, against the local API")}`,
-    `  ${color4.cyan("bun run preflight")}    ${color4.dim("what is still missing, and why it matters")}`
+    `  ${color5.cyan("bun install")}          ${color5.dim("one install for both workspaces")}`,
+    `  ${color5.cyan("bun run maildev")}      ${color5.dim("local inbox at http://localhost:1080")}`,
+    `  ${color5.cyan("bun run dev:api")}      ${color5.dim("the worker, with the panel")}`,
+    `  ${color5.cyan("bun run dev:frontend")} ${color5.dim("the storefront, against the local API")}`,
+    `  ${color5.cyan("bun run preflight")}    ${color5.dim("what is still missing, and why it matters")}`
   ];
   p2.outro(["Next:", ...next].join(`
 `));
@@ -787,7 +935,7 @@ async function init(args) {
 
 // src/regenerate.ts
 import * as p3 from "@clack/prompts";
-import color5 from "picocolors";
+import color6 from "picocolors";
 async function generateCommand() {
   const project = await findProject();
   if (!project) {
@@ -803,9 +951,9 @@ async function generateCommand() {
   }
   const result = await generate(project.root, project.manifest);
   p3.log.step([
-    ...result.written.map((file) => `${color5.green("+")} ${file}`),
-    ...result.kept.map((file) => `${color5.dim("=")} ${file} ${color5.dim("(kept)")}`),
-    ...result.retired.map((file) => `${color5.red("-")} ${file} ${color5.dim("(retired — no longer generated)")}`)
+    ...result.written.map((file) => `${color6.green("+")} ${file}`),
+    ...result.kept.map((file) => `${color6.dim("=")} ${file} ${color6.dim("(kept)")}`),
+    ...result.retired.map((file) => `${color6.red("-")} ${file} ${color6.dim("(retired — no longer generated)")}`)
   ].join(`
 `));
   return project.manifest.layout === "strict" ? finishStrict(project.root) : 0;
@@ -824,8 +972,8 @@ async function generateHelp() {
 }
 
 // src/scripts.ts
-import { existsSync as existsSync2, readFileSync } from "node:fs";
-import { join as join4, relative } from "node:path";
+import { existsSync as existsSync3, readFileSync } from "node:fs";
+import { join as join5, relative } from "node:path";
 function appScript(name) {
   return async (args) => {
     const project = await findProject();
@@ -834,8 +982,8 @@ function appScript(name) {
     const code = await ensureGenerated(project);
     if (code !== 0)
       return code;
-    const pkgPath = join4(project.appDir, "package.json");
-    const scripts = existsSync2(pkgPath) ? JSON.parse(readFileSync(pkgPath, "utf8")).scripts ?? {} : {};
+    const pkgPath = join5(project.appDir, "package.json");
+    const scripts = existsSync3(pkgPath) ? JSON.parse(readFileSync(pkgPath, "utf8")).scripts ?? {} : {};
     if (!scripts[name]) {
       console.error(`vc: ${relative(process.cwd(), pkgPath) || "package.json"} has no "${name}" script — void init writes one.`);
       return 1;
@@ -871,6 +1019,7 @@ var EXTENDED = {
   secrets: { run: secretsCliCommand, help: secretsHelp },
   keys: { run: keysCliCommand, help: keysHelp },
   link: { run: linkCliCommand, help: linkHelp },
+  publish: { run: publishCliCommand, help: publishHelp },
   guard: { run: guardCommand, help: async () => guardCommand() },
   dev: { run: appScript("dev"), help: appScriptHelp("dev") },
   build: { run: appScript("build"), help: appScriptHelp("build") },

package/dist/deploy/github.d.ts

@@ -66,6 +66,14 @@ export declare function setVariable(cwd: string, name: string, value: string): P
     ok: boolean;
     error?: string;
 }>;
+/**
+ * A variable's VALUE — the thing a secret can never give back.
+ *
+ * `gh secret` has list, set and delete and no read, by design: a GitHub
+ * secret is write-only forever, even to its owner. A variable is not, and
+ * that single difference is why the encryption key lives in one.
+ */
+export declare function getVariable(cwd: string, name: string): Promise<string | null>;
 export declare function variableNames(cwd: string): Promise<Set<string>>;
 /**
  * Ask Cloudflare whether a token is real, before it is stored anywhere.