@saastemly/voidcommerce 0.19.0 → 0.19.1

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-y4dk27kf.js";
+} from "./index-tk46w7yn.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -35,7 +35,7 @@ import {
   plaintextSecretNames,
   run,
   secretsCommand
-} from "./index-68m1eg3f.js";
+} from "./index-hsc97bf2.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -132,8 +132,8 @@ async function deployHelp() {
     ...row("CLOUDFLARE_API_TOKEN", "in the environment; the account is pinned for you when there is one", width, 2),
     ...row(PRIVATE_KEY_VAR, "to decrypt the shop's own secrets", width, 2),
     line("", width),
-    line("Normally neither is on your machine: `vc link` puts both on the GitHub", width),
-    line("repository and the workflow runs this command for you on every push.", width)
+    line("Normally neither is on your machine: both are ordinary secrets in", width),
+    line(".env.secrets, and the deploy reads them out of what you pushed.", width)
   ], width);
   if (captured)
     process.stdout.write(captured.out.replace(/\n*$/, `

package/dist/deploy/keys.d.ts

@@ -56,8 +56,8 @@ import type { Project } from "../project";
  * secrets long before anyone has made a GitHub repo to put the private half
  * on. Refusing to make a key until then would block exactly that, so
  * `vc keys --init` will write one here instead — 0600, gitignored, and
- * TEMPORARY: `vc link` uploads this key to the repository and deletes the
- * file, which is how the end state stays "no private key on disk".
+ * TEMPORARY: once the repository exists, the key is set on it as a variable
+ * and this file can go — `vc keys --restore` brings it back when needed.
  */
 export declare const LOCAL_KEY_FILE = ".env.keys";
 /** The private key parked locally, if there is one. */

package/dist/generate/ci.d.ts

@@ -20,10 +20,10 @@ import type { Manifest } from "../manifest";
  * Worker that has to exist first.
  *
  * GitHub already has what is needed. A person who can push is logged into
- * `gh`, and `gh` can write repository secrets from the terminal — so
- * `vc link` puts the key and the token there in one command, and this
- * workflow spends them. Nothing is typed into a web page except the token
- * itself, once, because Cloudflare will not issue one any other way.
+ * `gh`, and `gh` can write repository variables from the terminal — so the
+ * one key that opens `.env.secrets` is set there when the key is made, and
+ * this workflow spends it. Nothing else is configured outside the
+ * repository: the Cloudflare credentials are ordinary secrets in that file.
  *
  * ── The `void-dist` branch is still built ────────────────────────────────
  *

package/dist/{index-68m1eg3f.js → index-hsc97bf2.js}

@@ -370,7 +370,7 @@ async function decryptSecrets(project) {
   const root = project.root;
   if (!existsSync2(join2(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const { localPrivateKey } = await import("./keys-e6w5dcxx.js");
+  const { localPrivateKey } = await import("./keys-knmqsqz1.js");
   const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
   if (!privateKey) {
     return {
@@ -382,7 +382,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-e6w5dcxx.js");
+    const { publicKeyFor } = await import("./keys-knmqsqz1.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -852,10 +852,10 @@ Secrets are encrypted with a public key that is COMMITTED, and read with a`);
   console.log(`private key that lives only in GitHub Actions.
 `);
   const hasFile = existsSync3(join3(project.root, SECRETS_FILE));
-  const publicNote = state.publicKey ? `${state.publicKey.slice(0, 20)}… in ${SECRETS_FILE}` : color2.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc link\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
+  const publicNote = state.publicKey ? `${state.publicKey.slice(0, 20)}… in ${SECRETS_FILE}` : color2.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc keys --init\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
   console.log(`  ${state.publicKey ? color2.green("✓") : color2.dim("·")} public key   ${publicNote}`);
   const parked = localPrivateKey(project.root) !== null;
-  console.log(`  ${state.inGitHub || parked ? color2.green("✓") : color2.red("✗")} private key  ${state.inGitHub ? `${PRIVATE_KEY_VAR} is set on ${state.slug}` : parked ? color2.yellow(`waiting in ${LOCAL_KEY_FILE} — \`vc link\` moves it to GitHub and deletes it`) : state.slug ? color2.red(`not set on ${state.slug} — \`vc keys --init\``) : color2.dim("no key yet — `vc keys --init`")}`);
+  console.log(`  ${state.inGitHub || parked ? color2.green("✓") : color2.red("✗")} private key  ${state.inGitHub ? `${PRIVATE_KEY_VAR} is set on ${state.slug}` : parked ? color2.yellow(`waiting in ${LOCAL_KEY_FILE} — create the repository, then \`vc keys --init\` puts it there`) : state.slug ? color2.red(`not set on ${state.slug} — \`vc keys --init\``) : color2.dim("no key yet — `vc keys --init`")}`);
   if (state.mismatch) {
     console.error(`
 ${color2.red("✗")} ${state.mismatch}
@@ -893,8 +893,8 @@ vc: ${made.reason}
 ${color2.green("✓")} key made; public half in ${SECRETS_FILE}, private half waiting in ${LOCAL_KEY_FILE}
 
 ` + color2.yellow(`  ${LOCAL_KEY_FILE} is TEMPORARY. It is gitignored, but it is the one file that
-  opens every secret in this shop. \`vc link\` moves it onto the GitHub
-` + `  repository and deletes it — do that as soon as the repository exists.
+  opens every secret in this shop. Once the repository exists it is set
+  there as a variable, and this file can go.
 `) + (fresh ? `
   Next: ${color2.cyan("vc secrets --init")} fills in the keys this shop needs.
 ` : "") : `

package/dist/{index-y4dk27kf.js → index-tk46w7yn.js}

@@ -13,7 +13,7 @@ import {
   renderEnvTs,
   secretValue,
   unsetSecretNames
-} from "./index-68m1eg3f.js";
+} from "./index-hsc97bf2.js";
 import {
   MANIFEST_FILE,
   has,
@@ -1380,7 +1380,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.19.0",
+  version: "0.19.1",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1987,7 +1987,8 @@ Point Workers Builds at the \`${DIST_BRANCH}\` branch — it is a plain Void app
 a committed lockfile. The Worker must be named \`${worker}\`, matching the \`name\`
 in its \`wrangler.jsonc\`. You will need to set \`${PRIVATE_KEY_VAR}\` as a
 build secret in the dashboard, and replace the auto-generated API token with
-one that has D1 and Queues. That is the path \`vc link\` exists to avoid.
+one that has D1 and Queues — three dashboard visits, which is exactly what
+the GitHub Actions path above exists to avoid.
 `;
 }
 

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-y4dk27kf.js";
+} from "./index-tk46w7yn.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-68m1eg3f.js";
+} from "./index-hsc97bf2.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/dist/{keys-e6w5dcxx.js → keys-knmqsqz1.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-68m1eg3f.js";
+} from "./index-hsc97bf2.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/deploy/index.ts

@@ -115,8 +115,8 @@ export async function deployHelp(): Promise<number> {
 		...row("CLOUDFLARE_API_TOKEN", "in the environment; the account is pinned for you when there is one", width, 2),
 		...row(PRIVATE_KEY_VAR, "to decrypt the shop's own secrets", width, 2),
 		line("", width),
-		line("Normally neither is on your machine: `vc link` puts both on the GitHub", width),
-		line("repository and the workflow runs this command for you on every push.", width),
+		line("Normally neither is on your machine: both are ordinary secrets in", width),
+		line(".env.secrets, and the deploy reads them out of what you pushed.", width),
 	], width);
 	if (captured) process.stdout.write(captured.out.replace(/\n*$/, "\n"));
 	console.log(ours);

package/src/deploy/keys.ts

@@ -63,8 +63,8 @@ import { PRIVATE_KEY_VAR, SECRETS_FILE, committedPublicKeyInto, findDotenvx, run
  * secrets long before anyone has made a GitHub repo to put the private half
  * on. Refusing to make a key until then would block exactly that, so
  * `vc keys --init` will write one here instead — 0600, gitignored, and
- * TEMPORARY: `vc link` uploads this key to the repository and deletes the
- * file, which is how the end state stays "no private key on disk".
+ * TEMPORARY: once the repository exists, the key is set on it as a variable
+ * and this file can go — `vc keys --restore` brings it back when needed.
  */
 export const LOCAL_KEY_FILE = ".env.keys";
 
@@ -260,7 +260,7 @@ export async function keysCommand(project: Project, args: string[]): Promise<num
 	const hasFile = existsSync(join(project.root, SECRETS_FILE));
 	const publicNote = state.publicKey
 		? `${state.publicKey.slice(0, 20)}… in ${SECRETS_FILE}`
-		: color.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc link\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
+		: color.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc keys --init\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
 	console.log(`  ${state.publicKey ? color.green("✓") : color.dim("·")} public key   ${publicNote}`);
 	const parked = localPrivateKey(project.root) !== null;
 	console.log(
@@ -268,7 +268,7 @@ export async function keysCommand(project: Project, args: string[]): Promise<num
 			state.inGitHub
 				? `${PRIVATE_KEY_VAR} is set on ${state.slug}`
 				: parked
-					? color.yellow(`waiting in ${LOCAL_KEY_FILE} — \`vc link\` moves it to GitHub and deletes it`)
+					? color.yellow(`waiting in ${LOCAL_KEY_FILE} — create the repository, then \`vc keys --init\` puts it there`)
 					: state.slug
 						? color.red(`not set on ${state.slug} — \`vc keys --init\``)
 						: color.dim("no key yet — `vc keys --init`")
@@ -315,8 +315,8 @@ async function initKey(project: Project): Promise<number> {
 			? `\n${color.green("✓")} key made; public half in ${SECRETS_FILE}, private half waiting in ${LOCAL_KEY_FILE}\n\n` +
 					color.yellow(
 						`  ${LOCAL_KEY_FILE} is TEMPORARY. It is gitignored, but it is the one file that\n` +
-							`  opens every secret in this shop. \`vc link\` moves it onto the GitHub\n` +
-							"  repository and deletes it — do that as soon as the repository exists.\n",
+							`  opens every secret in this shop. Once the repository exists it is set\n` +
+							"  there as a variable, and this file can go.\n",
 					) +
 					(fresh ? `\n  Next: ${color.cyan("vc secrets --init")} fills in the keys this shop needs.\n` : "")
 			: `\n${color.green("✓")} ${PRIVATE_KEY_VAR} set on ${state.slug}; public key in ${SECRETS_FILE}\n` +

package/src/deploy/secrets.ts

@@ -318,7 +318,7 @@ export async function secretsCommand(project: Project, args: string[]): Promise<
 export async function initSecrets(project: Project): Promise<number> {
 	const path = join(project.root, SECRETS_FILE);
 
-	// `vc link` leaves a file holding nothing but the public key, so "exists"
+	// `vc keys --init` leaves a file holding nothing but the public key, so "exists"
 	// is not the same as "is already set up". Refusing on existence alone
 	// stranded anyone who linked first, which is the order the docs recommend.
 	if (existsSync(path) && declaredSecretNames(project.root).size > 0) {

package/src/generate/ci.ts

@@ -23,10 +23,10 @@ import { PRIVATE_KEY_VAR, SECRETS_FILE } from "../deploy/secrets";
  * Worker that has to exist first.
  *
  * GitHub already has what is needed. A person who can push is logged into
- * `gh`, and `gh` can write repository secrets from the terminal — so
- * `vc link` puts the key and the token there in one command, and this
- * workflow spends them. Nothing is typed into a web page except the token
- * itself, once, because Cloudflare will not issue one any other way.
+ * `gh`, and `gh` can write repository variables from the terminal — so the
+ * one key that opens `.env.secrets` is set there when the key is made, and
+ * this workflow spends it. Nothing else is configured outside the
+ * repository: the Cloudflare credentials are ordinary secrets in that file.
  *
  * ── The `void-dist` branch is still built ────────────────────────────────
  *
@@ -318,6 +318,7 @@ Point Workers Builds at the \`${DIST_BRANCH}\` branch — it is a plain Void app
 a committed lockfile. The Worker must be named \`${worker}\`, matching the \`name\`
 in its \`wrangler.jsonc\`. You will need to set \`${PRIVATE_KEY_VAR}\` as a
 build secret in the dashboard, and replace the auto-generated API token with
-one that has D1 and Queues. That is the path \`vc link\` exists to avoid.
+one that has D1 and Queues — three dashboard visits, which is exactly what
+the GitHub Actions path above exists to avoid.
 `;
 }

package/src/generate/env.ts

@@ -16,8 +16,8 @@ const BASE: EnvKey[] = [
 	/**
 	 * The Cloudflare credentials are ORDINARY SECRETS, deliberately.
 	 *
-	 * They used to be set on the GitHub repository by a `vc link` step, which
-	 * existed only because they were treated as special. They are not: they
+	 * They used to be set on the GitHub repository by a separate linking step,
+	 * which existed only because they were treated as special. They are not: they
 	 * are two more values this shop needs, they belong in `.env.secrets` with
 	 * everything else, and they are set the same way — `vc secrets set`.
 	 *