@saastemly/voidcommerce 0.18.0 → 0.19.0

package/dist/cli.js

@@ -21,312 +21,37 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-3j6jtjmk.js";
+} from "./index-y4dk27kf.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
   SECRETS_FILE,
-  cloudflareAccounts,
   committedPublicKey,
-  committedPublicKeyInto,
-  declaredSecretNames,
   encryptInto,
   envSummary,
-  findGh,
-  getVariable,
-  ghAuth,
   ignoresKeyFile,
-  initSecrets,
-  keyState,
   keysCommand,
-  localPrivateKey,
   plaintextSecretEntries,
   plaintextSecretNames,
-  provisionKey,
-  publicKeyFor,
-  repoSlug,
   run,
-  run1 as run2,
-  secretNames,
-  secretsCommand,
-  setSecret,
-  setVariable,
-  variableNames,
-  verifyCloudflareToken
-} from "./index-khzk6a9z.js";
+  secretsCommand
+} from "./index-68m1eg3f.js";
 import {
   LAYOUTS,
   oneOrigin,
   readManifest,
   validate,
-  writeManifest,
   zoneOf
 } from "./index-30y19qz5.js";
 import {
   GROUPS
 } from "./index-xyjhy6kp.js";
-import {
-  __require
-} from "./index-0v6na3yp.js";
+import"./index-0v6na3yp.js";
 
 // src/deploy/index.ts
-import color3 from "picocolors";
-import { existsSync as existsSync2 } from "node:fs";
-import { join as join3 } from "node:path";
-
-// src/deploy/link.ts
-import { rmSync } from "node:fs";
-import { join } from "node:path";
 import color from "picocolors";
-var TOKEN_SECRET = "CLOUDFLARE_API_TOKEN";
-var ACCOUNT_VAR = "CLOUDFLARE_ACCOUNT_ID";
-var SCOPES = [
-  ["Account · Workers Scripts: Edit", "deploy the worker"],
-  ["Account · D1: Edit", "create the database and apply migrations"],
-  ["Account · Queues: Edit", "create the order queue"],
-  ["Account · Workers KV Storage: Edit", "sessions and caches"],
-  ["Account · Workers R2 Storage: Edit", "product images"],
-  ["Account · Account Settings: Read", "confirm which account this is"],
-  ["Zone · Workers Routes: Edit", "answer on your domain"],
-  ["Zone · Zone: Read", "confirm the domain's zone is on this account"],
-  ["Zone · DNS: Read", "notice a hostname that already answers, before taking it over"],
-  ["User · User Details: Read", "wrangler asks at startup"]
-];
-async function linkCommand(project, args) {
-  const p = await import("@clack/prompts");
-  const root = project.root;
-  const relink = args.includes("--force");
-  p.intro(color.bgCyan(color.black(" vc link ")));
-  const auth = await ghAuth(root);
-  if (!auth.ok) {
-    p.cancel(auth.reason ?? "gh is unavailable");
-    return 1;
-  }
-  const slug = await repoSlug(root);
-  if (!slug) {
-    p.cancel(`this checkout has no GitHub repository, and everything below is stored on one.
-
-    ${color.cyan("gh repo create --source=. --private --push")}
-
-  then run \`vc link\` again.`);
-    return 1;
-  }
-  p.log.success(`${color.green("✓")} ${slug}, as ${auth.user ?? "you"}`);
-  const keys = await keyState(project);
-  if (keys.inGitHub && !relink) {
-    p.log.info(`${PRIVATE_KEY_VAR} is already set — leaving it alone (--force replaces it, which orphans ${SECRETS_FILE})`);
-  } else if (keys.inGitHub && relink) {
-    p.log.warn(`--force: replacing ${PRIVATE_KEY_VAR} makes every value in ${SECRETS_FILE} unreadable. Use \`vc keys --rotate\` to re-encrypt instead.`);
-    return 1;
-  } else {
-    const parked = localPrivateKey(root);
-    if (parked) {
-      const sent = await setVariable(root, PRIVATE_KEY_VAR, parked);
-      if (!sent.ok) {
-        p.cancel(`GitHub refused the variable: ${sent.error ?? "unknown error"}`);
-        return 1;
-      }
-      const publicKey = await publicKeyFor(parked);
-      if (publicKey)
-        committedPublicKeyInto(root, publicKey);
-      const readBack = await getVariable(root, PRIVATE_KEY_VAR);
-      if (readBack !== parked) {
-        p.log.warn(`${color.yellow("!")} ${PRIVATE_KEY_VAR} was written to ${slug} but could not be read back,
-  so ${LOCAL_KEY_FILE} has been LEFT IN PLACE. It is currently the only copy
-` + "  of the key that opens this shop — do not delete it until `vc keys --restore` works.");
-      } else {
-        rmSync(join(root, LOCAL_KEY_FILE), { force: true });
-        p.log.success(`${color.green("✓")} the key moved to ${slug} and ${LOCAL_KEY_FILE} deleted — verified readable, so \`vc keys --restore\` can bring it back`);
-      }
-    } else {
-      const made = await provisionKey(project);
-      if (!made.ok) {
-        p.cancel(made.reason);
-        return 1;
-      }
-      committedPublicKeyInto(root, made.publicKey);
-      p.log.success(`${color.green("✓")} ${PRIVATE_KEY_VAR} generated and stored on GitHub; public half in ${SECRETS_FILE}`);
-    }
-  }
-  const existing = await secretNames(root);
-  if (existing.has(TOKEN_SECRET) && !relink) {
-    p.log.info(`${TOKEN_SECRET} is already set — pass --force to replace it`);
-  } else {
-    p.log.step(`A Cloudflare API token, from ${color.cyan("https://dash.cloudflare.com/profile/api-tokens")} → Create Token → Custom token`);
-    console.log(SCOPES.map(([scope, why]) => `      ${scope.padEnd(38)} ${color.dim(why)}`).join(`
-`));
-    console.log(color.dim(`
-      The token Cloudflare generates for its own Workers Builds will NOT do:
-      it has no D1 and no Queues permission, so it cannot create the database.
-`));
-    const token = await p.password({
-      message: "Paste it (nothing is written to disk)",
-      validate: (input) => input && input.length >= 20 ? undefined : "that is too short to be a Cloudflare token"
-    });
-    if (p.isCancel(token)) {
-      p.cancel("nothing was stored.");
-      return 1;
-    }
-    const spinner = p.spinner();
-    spinner.start("asking Cloudflare whether that token is real");
-    const verified = await verifyCloudflareToken(String(token));
-    if (!verified.ok) {
-      spinner.stop(`${color.red("✗")} Cloudflare rejected it: ${verified.detail}`);
-      p.cancel("nothing was stored.");
-      return 1;
-    }
-    const accounts = await cloudflareAccounts(String(token));
-    spinner.stop(`${color.green("✓")} the token is active and sees ${accounts.length} account${accounts.length === 1 ? "" : "s"}`);
-    let accountId = project.manifest.cloudflare?.accountId ?? "";
-    if (accounts.length === 1) {
-      accountId = accounts[0].id;
-      p.log.info(`account "${accounts[0].name}"`);
-    } else if (accounts.length > 1) {
-      const picked = await p.select({
-        message: "Which account is this shop in?",
-        options: accounts.map((account) => ({ value: account.id, label: account.name, hint: account.id }))
-      });
-      if (p.isCancel(picked)) {
-        p.cancel("nothing was stored.");
-        return 1;
-      }
-      accountId = String(picked);
-    }
-    const stored = await setSecret(root, TOKEN_SECRET, String(token));
-    if (!stored.ok) {
-      p.cancel(`GitHub refused the secret: ${stored.error ?? "unknown error"}`);
-      return 1;
-    }
-    p.log.success(`${color.green("✓")} ${TOKEN_SECRET} stored on ${slug}`);
-    if (accountId) {
-      const varred = await setVariable(root, ACCOUNT_VAR, accountId);
-      if (varred.ok)
-        p.log.success(`${color.green("✓")} ${ACCOUNT_VAR} set as a repository variable`);
-      project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId };
-      await writeManifest(root, project.manifest);
-    }
-  }
-  if (declaredSecretNames(root).size === 0) {
-    p.log.step(`writing ${SECRETS_FILE}`);
-    await initSecrets(project);
-  }
-  const secrets = await secretNames(root);
-  const vars = await variableNames(root);
-  p.outro([
-    `${color.bold("Ready.")} From here, ${color.cyan("git push")} is the deploy.`,
-    "",
-    `  ${secrets.has(PRIVATE_KEY_VAR) ? color.green("✓") : color.red("✗")} ${PRIVATE_KEY_VAR}   ${color.dim("reads the shop's secrets")}`,
-    `  ${secrets.has(TOKEN_SECRET) ? color.green("✓") : color.red("✗")} ${TOKEN_SECRET}      ${color.dim("deploys to Cloudflare")}`,
-    `  ${vars.has(ACCOUNT_VAR) ? color.green("✓") : color.dim("·")} ${ACCOUNT_VAR}     ${color.dim("which account")}`,
-    "",
-    `  Set the shop's own secrets with ${color.cyan("vc secrets set KEY")} — that needs no`,
-    `  credential at all, because encryption uses the public key in the repository.`
-  ].join(`
-`));
-  return 0;
-}
-
-// src/deploy/publish.ts
 import { existsSync } from "node:fs";
-import { join as join2 } from "node:path";
-import color2 from "picocolors";
-async function publishCommand(project, args) {
-  const p = await import("@clack/prompts");
-  const root = project.root;
-  const gh = findGh();
-  p.intro(color2.bgCyan(color2.black(" vc publish ")));
-  const auth = await ghAuth(root);
-  if (!auth.ok || !gh) {
-    p.cancel(auth.reason ?? "the GitHub CLI is not installed. https://cli.github.com");
-    return 1;
-  }
-  if (!existsSync(join2(root, ".git"))) {
-    p.cancel(`${root} is not a git repository. \`git init\` first, and commit what you have.`);
-    return 1;
-  }
-  let slug = await repoSlug(root);
-  if (slug) {
-    p.log.info(`${slug} already exists — using it`);
-  } else {
-    const suggested = project.manifest.shop.domain.split(".")[0] ?? "shop";
-    const name = await p.text({
-      message: "Repository name",
-      initialValue: suggested,
-      validate: (value) => /^[A-Za-z0-9._-]+$/.test(value.trim()) ? undefined : "letters, digits, dot, dash or underscore"
-    });
-    if (p.isCancel(name)) {
-      p.cancel("nothing was created.");
-      return 1;
-    }
-    const visibility = await p.select({
-      message: "Visibility",
-      options: [
-        { value: "--private", label: "Private", hint: "the key that opens your secrets is readable to anyone with access" },
-        { value: "--public", label: "Public", hint: "only if this shop keeps no secrets at all" }
-      ],
-      initialValue: "--private"
-    });
-    if (p.isCancel(visibility)) {
-      p.cancel("nothing was created.");
-      return 1;
-    }
-    const spinner2 = p.spinner();
-    spinner2.start(`creating ${String(name)}`);
-    const created = await run(gh, ["repo", "create", String(name).trim(), "--source=.", String(visibility)], root);
-    if (created.code !== 0) {
-      spinner2.stop(`${color2.red("✗")} could not create it`);
-      p.cancel(created.out.trim().split(`
-`).slice(-2).join(" "));
-      return 1;
-    }
-    slug = await repoSlug(root);
-    spinner2.stop(`${color2.green("✓")} ${slug ?? String(name)} created, and set as origin`);
-  }
-  p.log.step("giving the repository what the deploy needs");
-  const linked = await linkCommand(project, args);
-  if (linked !== 0) {
-    p.cancel("the repository exists but is not configured, so a push would not deploy. Fix the above and run `vc publish` again.");
-    return 1;
-  }
-  const dirty = (await run("git", ["status", "--porcelain"], root)).out.trim();
-  if (dirty) {
-    const staged = await run("git", ["add", "-A"], root);
-    const committed = await run("git", ["commit", "-m", "vc publish: link this shop to its repository"], root);
-    if (staged.code !== 0 || committed.code !== 0) {
-      p.cancel(`could not commit the changes vc link made:
-${committed.out.trim().split(`
-`).slice(-3).join(`
-`)}`);
-      return 1;
-    }
-    p.log.success(`${color2.green("✓")} committed what linking changed`);
-  }
-  const branch = (await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], root)).out.trim() || "main";
-  const spinner = p.spinner();
-  spinner.start(`pushing ${branch}`);
-  const pushed = await run("git", ["push", "-u", "origin", `${branch}:main`], root);
-  if (pushed.code !== 0) {
-    spinner.stop(`${color2.red("✗")} the push failed`);
-    p.cancel(pushed.out.trim().split(`
-`).slice(-4).join(`
-`));
-    return 1;
-  }
-  spinner.stop(`${color2.green("✓")} pushed to main`);
-  p.outro([
-    `${color2.bold("Published.")} The deploy is running now.`,
-    "",
-    `  ${color2.cyan(`https://github.com/${slug}/actions`)}`,
-    "",
-    `  From here ${color2.cyan("git push")} is the whole loop. \`vc\` is only needed to`,
-    `  change a secret (${color2.cyan("vc secrets set KEY")}) or read one back`,
-    `  (${color2.cyan("vc keys --restore")}).`
-  ].join(`
-`));
-  return 0;
-}
-
-// src/deploy/index.ts
+import { join } from "node:path";
 async function deployCommand(args) {
   const own = new Set(["--cloudflare", "--provision", "--force"]);
   const cloudflare = args.includes("--cloudflare");
@@ -349,12 +74,12 @@ async function deployCommand(args) {
   const check = await preflight(project, "void");
   printPreflight(project, check, "void");
   if (!check.ready && check.remote !== null && !args.includes("--force")) {
-    console.error(`${color3.red("✗")} refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force.
+    console.error(`${color.red("✗")} refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force.
 `);
     return 1;
   }
   if (!check.ready && check.remote === null) {
-    console.log(color3.dim(`Secrets could not be verified here; void's own deploy gate is the next check.
+    console.log(color.dim(`Secrets could not be verified here; void's own deploy gate is the next check.
 `));
   }
   return runVoid(["deploy", ...voids], project.appDir);
@@ -372,7 +97,7 @@ async function preflightCommand(args) {
     return result.ready ? 0 : 1;
   const pending = await uncommittedMigrations(project.root);
   if (pending.length > 0) {
-    console.error(`${color3.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:
+    console.error(`${color.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:
 ` + `    ${pending.join(`
     `)}
 
@@ -384,7 +109,7 @@ async function preflightCommand(args) {
   return result.ready ? 0 : 1;
 }
 async function uncommittedMigrations(root) {
-  const status = await run2("git", ["status", "--porcelain", "--", "migrations"], root);
+  const status = await run("git", ["status", "--porcelain", "--", "migrations"], root);
   if (status.code !== 0)
     return [];
   return status.out.split(`
@@ -397,13 +122,13 @@ async function deployHelp() {
     line("vc's preflight — every required key set, the hostnames right — then", width),
     line("void deploy, untouched. Or, with --cloudflare, your own account via wrangler.", width),
     line("", width),
-    line(color3.bold("Usage"), width),
+    line(color.bold("Usage"), width),
     ...row("vc deploy [void's flags]", "preflight, then void deploy — the Void platform, void's login", width, 2),
     ...row("vc deploy --cloudflare", "wrangler, your Cloudflare account, no Void login: preflight, build, scrub baked secrets, migrate D1, deploy", width, 2),
     ...row("vc deploy --cloudflare --provision", "first time: create the D1 database and the queue, record them", width, 2),
     ...row("vc deploy --cloudflare --force", "deploy a shop preflight says is not ready — deliberately", width, 2),
     line("", width),
-    line(color3.bold("Needs, for --cloudflare"), width),
+    line(color.bold("Needs, for --cloudflare"), width),
     ...row("CLOUDFLARE_API_TOKEN", "in the environment; the account is pinned for you when there is one", width, 2),
     ...row(PRIVATE_KEY_VAR, "to decrypt the shop's own secrets", width, 2),
     line("", width),
@@ -499,9 +224,9 @@ async function guardCommand() {
   if (!project)
     return 0;
   const root = project.root;
-  if (existsSync2(join3(root, LOCAL_KEY_FILE)) && !ignoresKeyFile(root)) {
+  if (existsSync(join(root, LOCAL_KEY_FILE)) && !ignoresKeyFile(root)) {
     console.error(`
-${color3.red("✗ refusing the commit")}: ${LOCAL_KEY_FILE} exists and is NOT gitignored.
+${color.red("✗ refusing the commit")}: ${LOCAL_KEY_FILE} exists and is NOT gitignored.
 
 ` + `  It holds the private key that opens every secret in this repository.
 ` + `  Add ${LOCAL_KEY_FILE} to .gitignore before committing anything.
@@ -514,24 +239,24 @@ ${color3.red("✗ refusing the commit")}: ${LOCAL_KEY_FILE} exists and is NOT gi
   const publicKey = committedPublicKey(root);
   if (!publicKey) {
     console.error(`
-${color3.red("✗ refusing the commit")}: ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE} ${bare.length === 1 ? "is" : "are"} in the clear, and there is no key to encrypt ${bare.length === 1 ? "it" : "them"} with.
+${color.red("✗ refusing the commit")}: ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE} ${bare.length === 1 ? "is" : "are"} in the clear, and there is no key to encrypt ${bare.length === 1 ? "it" : "them"} with.
 
 ` + `    ${bare.map((entry) => entry.name).join(`
     `)}
 
-` + `  ${color3.cyan("vc keys --init")}  makes one — no GitHub repository needed yet.
+` + `  ${color.cyan("vc keys --init")}  makes one — no GitHub repository needed yet.
 
-` + color3.dim(`  Committing a secret in the clear cannot be undone by a later commit;
+` + color.dim(`  Committing a secret in the clear cannot be undone by a later commit;
   the value stays in the history and must be treated as burned.
 `));
     return 1;
   }
-  const staged = (await run2("git", ["diff", "--cached", "--name-only", "--", SECRETS_FILE], root)).out.trim().length > 0;
+  const staged = (await run("git", ["diff", "--cached", "--name-only", "--", SECRETS_FILE], root)).out.trim().length > 0;
   for (const entry of bare) {
     const sealed = await encryptInto(root, publicKey, entry.name, entry.value);
     if (!sealed.ok) {
       console.error(`
-${color3.red("✗ refusing the commit")}: ${sealed.error}
+${color.red("✗ refusing the commit")}: ${sealed.error}
 `);
       return 1;
     }
@@ -539,99 +264,36 @@ ${color3.red("✗ refusing the commit")}: ${sealed.error}
   const left = plaintextSecretNames(root);
   if (left.length > 0) {
     console.error(`
-${color3.red("✗ refusing the commit")}: ${left.join(", ")} could not be encrypted.
+${color.red("✗ refusing the commit")}: ${left.join(", ")} could not be encrypted.
 `);
     return 1;
   }
   if (staged) {
-    const added = await run2("git", ["add", "--", SECRETS_FILE], root);
+    const added = await run("git", ["add", "--", SECRETS_FILE], root);
     if (added.code !== 0) {
       console.error(`
-${color3.red("✗ refusing the commit")}: ${SECRETS_FILE} was encrypted but could not be re-staged,
+${color.red("✗ refusing the commit")}: ${SECRETS_FILE} was encrypted but could not be re-staged,
 ` + `  so the commit would still carry the plaintext you staged. \`git add ${SECRETS_FILE}\`.
 `);
       return 1;
     }
   }
   console.log(`
-${color3.green("✓")} encrypted ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE}${staged ? " and re-staged it" : ""}: ${bare.map((entry) => entry.name).join(", ")}
-` + color3.dim(`  Encryption needs only the public key, so this needs no credential.
+${color.green("✓")} encrypted ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE}${staged ? " and re-staged it" : ""}: ${bare.map((entry) => entry.name).join(", ")}
+` + color.dim(`  Encryption needs only the public key, so this needs no credential.
 `));
   return 0;
 }
-async function linkCliCommand(args) {
-  const project = await findProject();
-  if (!project) {
-    console.error("vc: no voidcommerce.json here.");
-    return 1;
-  }
-  return linkCommand(project, args);
-}
-async function linkHelp() {
-  const width = 80;
-  console.log(box("vc link", [
-    line("Put this shop's credentials on its GitHub repository, once, so that", width),
-    line("every deploy after this is a `git push`.", width),
-    line("", width),
-    ...row("vc link", "store the encryption key and the Cloudflare token on the repository", width, 2),
-    ...row("vc link --force", "replace what is already there", width, 2),
-    line("", width),
-    line(color3.bold("What it stores, and where"), width),
-    ...row(PRIVATE_KEY_VAR, "a repository SECRET. A key already waiting locally is MOVED here and the local copy deleted", width, 2),
-    ...row("CLOUDFLARE_API_TOKEN", "a repository SECRET, checked against the Cloudflare API before it is stored", width, 2),
-    ...row("CLOUDFLARE_ACCOUNT_ID", "a repository VARIABLE — an identifier, not a credential", width, 2),
-    line("", width),
-    line(color3.bold("Why one token still has to be typed"), width),
-    line("GitHub cannot mint a Cloudflare credential. There is no OIDC federation", width),
-    line("between them, and the Cloudflare GitHub App runs the other way: it grants", width),
-    line("Cloudflare access to your repository, not your repository access to", width),
-    line("Cloudflare. So it is typed once, here, and never stored on this machine.", width)
-  ], width));
-  return 0;
-}
-async function publishCliCommand(args) {
-  const project = await findProject();
-  if (!project) {
-    console.error("vc: no voidcommerce.json here.");
-    return 1;
-  }
-  return publishCommand(project, args);
-}
-async function publishHelp() {
-  const width = 80;
-  console.log(box("vc publish", [
-    line("Create this shop's GitHub repository, give it what the deploy needs,", width),
-    line("and push. The push IS the deploy. Run once; after that, `git push`.", width),
-    line("", width),
-    ...row("vc publish", "create the repository, set the credentials, push main", width, 2),
-    line("", width),
-    line(color3.bold("What it does for you"), width),
-    ...row("the encryption key", "vc already holds it — set with no input from you", width, 2),
-    ...row("the account id", "read from voidcommerce.json", width, 2),
-    ...row("the Cloudflare token", "the one thing it has to ask for", width, 2),
-    line("", width),
-    line(color3.bold("Why the token cannot be automated away"), width),
-    line("There is no OIDC between GitHub and Cloudflare, so something must carry", width),
-    line("a token across, and only a person can fetch one from the dashboard. It", width),
-    line("is asked for once, checked against the Cloudflare API, and stored on the", width),
-    line("repository — never on this machine.", width),
-    line("", width),
-    line("The repository is created WITHOUT pushing, then configured, then pushed.", width),
-    line("Pushing first would start a deploy against a repository that has no key", width),
-    line("and no token: a red run, for no reason but the wrong order.", width)
-  ], width));
-  return 0;
-}
 
 // src/init.ts
 import * as p2 from "@clack/prompts";
 import { mkdir } from "node:fs/promises";
-import { basename, join as join4 } from "node:path";
-import color5 from "picocolors";
+import { basename, join as join2 } from "node:path";
+import color3 from "picocolors";
 
 // src/wizard.ts
 import * as p from "@clack/prompts";
-import color4 from "picocolors";
+import color2 from "picocolors";
 var bail = () => {
   p.cancel("Nothing was written.");
   process.exit(0);
@@ -653,8 +315,8 @@ async function askGroup(group2, previous, alsoRequired = []) {
   const required = group2.choices.filter((choice) => requiredIds.has(choice.id));
   const optional = group2.choices.filter((choice) => !requiredIds.has(choice.id));
   const message = group2.title + (group2.intro ? `
-${color4.dim(group2.intro)}` : "") + (required.length ? `
-${color4.dim(`Included: ${required.map((choice) => choice.label).join(", ")}`)}` : "");
+${color2.dim(group2.intro)}` : "") + (required.length ? `
+${color2.dim(`Included: ${required.map((choice) => choice.label).join(", ")}`)}` : "");
   if (optional.length === 0) {
     p.log.info(message);
     return required.map((choice) => choice.id);
@@ -685,7 +347,7 @@ async function runWizard(existing, layout) {
       validate: (value) => value.trim() ? undefined : "A shop has a name."
     }),
     domain: () => p.text({
-      message: `Domain ${color4.dim(monorepo ? "— the storefront; api.<domain> is the worker; the CORS list and DNS records derive from it" : "— the shop answers here; the worker's custom domain")}`,
+      message: `Domain ${color2.dim(monorepo ? "— the storefront; api.<domain> is the worker; the CORS list and DNS records derive from it" : "— the shop answers here; the worker's custom domain")}`,
       placeholder: "northwind.com",
       initialValue: existing?.shop.domain ?? "",
       validate: (value) => /^[a-z0-9-]+(\.[a-z0-9-]+)+\.[a-z]{2,}$|^[a-z0-9-]+\.[a-z]{2,}$/i.test(value.trim()) ? undefined : "A hostname, like northwind.com or shop.northwind.com."
@@ -696,7 +358,7 @@ async function runWizard(existing, layout) {
       if (!domain || domain === guess)
         return Promise.resolve(undefined);
       return p.text({
-        message: `DNS zone ${color4.dim(`— ${domain} lives inside it; records go here, and this zone must be on your DNS provider`)}`,
+        message: `DNS zone ${color2.dim(`— ${domain} lives inside it; records go here, and this zone must be on your DNS provider`)}`,
         placeholder: guess,
         initialValue: existing?.shop.zone ?? guess,
         validate: (value) => {
@@ -708,13 +370,13 @@ async function runWizard(existing, layout) {
       });
     },
     country: () => p.text({
-      message: `Country ${color4.dim("— sets the declared VAT rate and the default region")}`,
+      message: `Country ${color2.dim("— sets the declared VAT rate and the default region")}`,
       placeholder: "US",
       initialValue: existing?.shop.country ?? "",
       validate: (value) => /^[A-Za-z]{2}$/.test(value.trim()) ? undefined : "ISO-3166 alpha-2, like DK."
     }),
     taxRegistered: () => p.select({
-      message: `Registered to charge tax? ${color4.dim("— a business below its registration threshold must NOT add tax to a price, and one above it must")}`,
+      message: `Registered to charge tax? ${color2.dim("— a business below its registration threshold must NOT add tax to a price, and one above it must")}`,
       options: [
         { value: "no", label: "Not registered", hint: "prices are what the customer pays; no tax is added. The common case for a new shop" },
         { value: "yes", label: "Registered", hint: "the country's standard rate is declared and added" }
@@ -728,14 +390,14 @@ async function runWizard(existing, layout) {
       validate: (value) => /^[A-Za-z]{3}$/.test(value.trim()) ? undefined : "ISO-4217, like dkk."
     }),
     locale: () => p.text({
-      message: `Locale ${color4.dim("— the language of emails and launch content")}`,
+      message: `Locale ${color2.dim("— the language of emails and launch content")}`,
       placeholder: "en",
       initialValue: existing?.shop.locale ?? "",
       validate: (value) => /^[a-z]{2}(-[A-Z]{2})?$/.test(value.trim()) ? undefined : "like da, or en-GB."
     }),
     ...onPages ? {
       pagesHost: () => p.text({
-        message: `GitHub Pages host ${color4.dim("— where the storefront is published; leave blank if you serve the branch elsewhere")}`,
+        message: `GitHub Pages host ${color2.dim("— where the storefront is published; leave blank if you serve the branch elsewhere")}`,
         placeholder: "northwind.github.io",
         initialValue: existing?.shop.pagesHost ?? "",
         validate: (value) => !value.trim() || /^[a-z0-9-]+\.github\.io$/i.test(value.trim()) ? undefined : "<owner>.github.io, or blank"
@@ -746,7 +408,7 @@ async function runWizard(existing, layout) {
   for (const group2 of GROUPS) {
     if (group2.id === "ui" && layout === "strict") {
       p.log.info(`${group2.title}
-${color4.dim("The generated storefront and panel. Strict has no custom code to host anything else.")}`);
+${color2.dim("The generated storefront and panel. Strict has no custom code to host anything else.")}`);
       chosen[group2.id] = ["admin"];
       continue;
     }
@@ -771,14 +433,14 @@ ${color4.dim("The generated storefront and panel. Strict has no custom code to h
 }
 function summarise(manifest) {
   const lines = [
-    `${color4.dim("Layout".padEnd(34))} ${LAYOUTS.find((l) => l.id === manifest.layout)?.label ?? manifest.layout}`
+    `${color2.dim("Layout".padEnd(34))} ${LAYOUTS.find((l) => l.id === manifest.layout)?.label ?? manifest.layout}`
   ];
   for (const group2 of GROUPS) {
     const ids = manifest.chosen[group2.id] ?? [];
     if (ids.length === 0)
       continue;
     const labels = ids.map((id) => group2.choices.find((choice) => choice.id === id)?.label ?? id).join(", ");
-    lines.push(`${color4.dim(group2.title.padEnd(34))} ${labels}`);
+    lines.push(`${color2.dim(group2.title.padEnd(34))} ${labels}`);
   }
   return lines.join(`
 `);
@@ -819,10 +481,10 @@ async function init(args) {
   if (flags.voids.length > 0)
     return runVoid(["init", ...flags.voids]);
   let root = process.cwd();
-  p2.intro(color5.bgCyan(color5.black(" voidcommerce ")));
+  p2.intro(color3.bgCyan(color3.black(" voidcommerce ")));
   const existing = await readManifest(root);
   if (existing) {
-    p2.log.info(`Found ${color5.cyan("voidcommerce.json")} for ${color5.bold(existing.shop.name)} — answers are pre-filled; the layout (${existing.layout}) is fixed.`);
+    p2.log.info(`Found ${color3.cyan("voidcommerce.json")} for ${color3.bold(existing.shop.name)} — answers are pre-filled; the layout (${existing.layout}) is fixed.`);
     if (flags.layout && flags.layout !== existing.layout) {
       p2.log.error(`This shop is laid out as "${existing.layout}". The layout cannot change after init — moving files is not a regeneration.`);
       return 1;
@@ -830,10 +492,10 @@ async function init(args) {
   }
   const layout = existing?.layout ?? flags.layout ?? await askLayout();
   if (layout === "strict") {
-    p2.log.step(`Strict: the app will be generated under ${color5.cyan(".vc/app")} — nothing there is yours to edit.`);
+    p2.log.step(`Strict: the app will be generated under ${color3.cyan(".vc/app")} — nothing there is yours to edit.`);
   } else if (layout === "app") {
     if (!isVoidApp(root)) {
-      p2.log.step(`No Void app here yet — ${color5.cyan("void init")} first, then the shop.`);
+      p2.log.step(`No Void app here yet — ${color3.cyan("void init")} first, then the shop.`);
       const before = new Set(voidAppsIn(root));
       const code = await runVoid(["init"]);
       if (code !== 0)
@@ -846,7 +508,7 @@ async function init(args) {
         }
         root = created[0];
         process.chdir(root);
-        p2.log.step(`Continuing in ${color5.cyan(`${basename(root)}/`)}`);
+        p2.log.step(`Continuing in ${color3.cyan(`${basename(root)}/`)}`);
       }
     }
   } else {
@@ -855,11 +517,11 @@ async function init(args) {
       ["frontend", "the storefront — prerendered and served from the worker's own assets"]
     ];
     for (const [dir, starter] of parts) {
-      const target = join4(root, dir);
+      const target = join2(root, dir);
       if (isVoidApp(target))
         continue;
       await mkdir(target, { recursive: true });
-      p2.log.step(`${color5.cyan("void init")} in ${color5.cyan(`${dir}/`)} — choose ${starter}.`);
+      p2.log.step(`${color3.cyan("void init")} in ${color3.cyan(`${dir}/`)} — choose ${starter}.`);
       const code = await runVoid(["init"], target);
       if (code !== 0)
         return code;
@@ -877,7 +539,7 @@ async function init(args) {
   if (problems.length > 0) {
     p2.log.error("These answers contradict each other:");
     for (const problem of problems)
-      p2.log.message(`  ${color5.red("✗")} ${problem}`);
+      p2.log.message(`  ${color3.red("✗")} ${problem}`);
     p2.cancel("Nothing was written.");
     return 1;
   }
@@ -893,16 +555,16 @@ async function init(args) {
   spinner2.stop("Generated");
   const { secrets, plaintext } = envSummary(manifest);
   p2.note([
-    ...result.written.map((file) => `${color5.green("+")} ${file}`),
-    ...result.kept.map((file) => `${color5.dim("=")} ${file} ${color5.dim("(kept — yours)")}`),
-    ...result.retired.map((file) => `${color5.red("-")} ${file} ${color5.dim("(retired — no longer generated)")}`)
+    ...result.written.map((file) => `${color3.green("+")} ${file}`),
+    ...result.kept.map((file) => `${color3.dim("=")} ${file} ${color3.dim("(kept — yours)")}`),
+    ...result.retired.map((file) => `${color3.red("-")} ${file} ${color3.dim("(retired — no longer generated)")}`)
   ].join(`
 `), "Files");
   p2.note([
-    `${color5.bold(String(secrets.length))} secrets  ${color5.dim("→ wrangler secret put <NAME>")}`,
+    `${color3.bold(String(secrets.length))} secrets  ${color3.dim("→ wrangler secret put <NAME>")}`,
     ...secrets.map((key) => `  ${key}`),
     "",
-    `${color5.bold(String(plaintext.length))} plaintext ${color5.dim("→ .env.production, already written")}`,
+    `${color3.bold(String(plaintext.length))} plaintext ${color3.dim("→ .env.production, already written")}`,
     ...plaintext.map((key) => `  ${key}`)
   ].join(`
 `), "Before going live");
@@ -912,21 +574,21 @@ async function init(args) {
       return code;
   }
   const next = layout === "app" ? [
-    `  ${color5.cyan("bun install")}`,
-    `  ${color5.cyan("bun run maildev")}      ${color5.dim("local inbox at http://localhost:1080")}`,
-    `  ${color5.cyan("vc dev")}`,
-    `  ${color5.cyan("vc preflight")}        ${color5.dim("what is still missing, and why it matters")}`
+    `  ${color3.cyan("bun install")}`,
+    `  ${color3.cyan("bun run maildev")}      ${color3.dim("local inbox at http://localhost:1080")}`,
+    `  ${color3.cyan("vc dev")}`,
+    `  ${color3.cyan("vc preflight")}        ${color3.dim("what is still missing, and why it matters")}`
   ] : layout === "strict" ? [
-    `  ${color5.cyan("bun install")}`,
-    `  ${color5.cyan("vc generate")}         ${color5.dim("the app under .vc/app, void's artifacts, the migrations")}`,
-    `  ${color5.cyan("bun run maildev")}      ${color5.dim("local inbox at http://localhost:1080")}`,
-    `  ${color5.cyan("vc dev")}               ${color5.dim("runs in .vc/app")}`
+    `  ${color3.cyan("bun install")}`,
+    `  ${color3.cyan("vc generate")}         ${color3.dim("the app under .vc/app, void's artifacts, the migrations")}`,
+    `  ${color3.cyan("bun run maildev")}      ${color3.dim("local inbox at http://localhost:1080")}`,
+    `  ${color3.cyan("vc dev")}               ${color3.dim("runs in .vc/app")}`
   ] : [
-    `  ${color5.cyan("bun install")}          ${color5.dim("one install for both workspaces")}`,
-    `  ${color5.cyan("bun run maildev")}      ${color5.dim("local inbox at http://localhost:1080")}`,
-    `  ${color5.cyan("bun run dev:api")}      ${color5.dim("the worker, with the panel")}`,
-    `  ${color5.cyan("bun run dev:frontend")} ${color5.dim("the storefront, against the local API")}`,
-    `  ${color5.cyan("bun run preflight")}    ${color5.dim("what is still missing, and why it matters")}`
+    `  ${color3.cyan("bun install")}          ${color3.dim("one install for both workspaces")}`,
+    `  ${color3.cyan("bun run maildev")}      ${color3.dim("local inbox at http://localhost:1080")}`,
+    `  ${color3.cyan("bun run dev:api")}      ${color3.dim("the worker, with the panel")}`,
+    `  ${color3.cyan("bun run dev:frontend")} ${color3.dim("the storefront, against the local API")}`,
+    `  ${color3.cyan("bun run preflight")}    ${color3.dim("what is still missing, and why it matters")}`
   ];
   p2.outro(["Next:", ...next].join(`
 `));
@@ -935,7 +597,7 @@ async function init(args) {
 
 // src/regenerate.ts
 import * as p3 from "@clack/prompts";
-import color6 from "picocolors";
+import color4 from "picocolors";
 async function generateCommand() {
   const project = await findProject();
   if (!project) {
@@ -951,9 +613,9 @@ async function generateCommand() {
   }
   const result = await generate(project.root, project.manifest);
   p3.log.step([
-    ...result.written.map((file) => `${color6.green("+")} ${file}`),
-    ...result.kept.map((file) => `${color6.dim("=")} ${file} ${color6.dim("(kept)")}`),
-    ...result.retired.map((file) => `${color6.red("-")} ${file} ${color6.dim("(retired — no longer generated)")}`)
+    ...result.written.map((file) => `${color4.green("+")} ${file}`),
+    ...result.kept.map((file) => `${color4.dim("=")} ${file} ${color4.dim("(kept)")}`),
+    ...result.retired.map((file) => `${color4.red("-")} ${file} ${color4.dim("(retired — no longer generated)")}`)
   ].join(`
 `));
   return project.manifest.layout === "strict" ? finishStrict(project.root) : 0;
@@ -972,8 +634,8 @@ async function generateHelp() {
 }
 
 // src/scripts.ts
-import { existsSync as existsSync3, readFileSync } from "node:fs";
-import { join as join5, relative } from "node:path";
+import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { join as join3, relative } from "node:path";
 function appScript(name) {
   return async (args) => {
     const project = await findProject();
@@ -982,8 +644,8 @@ function appScript(name) {
     const code = await ensureGenerated(project);
     if (code !== 0)
       return code;
-    const pkgPath = join5(project.appDir, "package.json");
-    const scripts = existsSync3(pkgPath) ? JSON.parse(readFileSync(pkgPath, "utf8")).scripts ?? {} : {};
+    const pkgPath = join3(project.appDir, "package.json");
+    const scripts = existsSync2(pkgPath) ? JSON.parse(readFileSync(pkgPath, "utf8")).scripts ?? {} : {};
     if (!scripts[name]) {
       console.error(`vc: ${relative(process.cwd(), pkgPath) || "package.json"} has no "${name}" script — void init writes one.`);
       return 1;
@@ -1018,8 +680,6 @@ var EXTENDED = {
   preflight: { run: preflightCommand, help: preflightHelp },
   secrets: { run: secretsCliCommand, help: secretsHelp },
   keys: { run: keysCliCommand, help: keysHelp },
-  link: { run: linkCliCommand, help: linkHelp },
-  publish: { run: publishCliCommand, help: publishHelp },
   guard: { run: guardCommand, help: async () => guardCommand() },
   dev: { run: appScript("dev"), help: appScriptHelp("dev") },
   build: { run: appScript("build"), help: appScriptHelp("build") },