@saastemly/voidcommerce 0.22.1 → 0.23.1

package/dist/cli.js

@@ -25,7 +25,7 @@ import {
   version,
   voidAppsIn,
   wrangler
-} from "./index-51zee2vf.js";
+} from "./index-3wftdrq5.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -40,7 +40,7 @@ import {
   run,
   secretValue,
   secretsCommand
-} from "./index-t1ggktg8.js";
+} from "./index-hvrbdp85.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -54,7 +54,10 @@ import {
   GROUPS
 } from "./index-xyjhy6kp.js";
 import"./index-6e4eh08g.js";
-import"./index-0v6na3yp.js";
+import"./index-vj6akbny.js";
+import {
+  __require
+} from "./index-0v6na3yp.js";
 
 // src/deploy/index.ts
 import color2 from "picocolors";
@@ -113,6 +116,15 @@ ${color.bold("This will destroy, on Cloudflare:")}
   console.log(`  worker    ${plan.worker}   ${color.dim(`(and its custom domain ${host})`)}`);
   console.log(plan.d1 ? `  database  ${plan.d1}   ${opts.keepData ? color.green("KEPT — --keep-data") : color.red("DELETED, with every order in it")}` : `  database  ${color.dim("none recorded")}`);
   console.log(plan.queues.length ? `  queues    ${plan.queues.join(", ")}` : `  queues    ${color.dim("none recorded")}`);
+  if (opts.github) {
+    const { repoSlug } = await import("./github-km752pz0.js");
+    const slug = await repoSlug(project.root);
+    console.log(slug ? `
+${color.bold("And on GitHub:")}
+
+  repository  ${slug}   ${color.red("DELETED — code, history, issues, and the encryption key variable")}` : `
+  repository  ${color.dim("none — there is nothing to delete")}`);
+  }
   console.log("");
   if (opts.dryRun) {
     console.log(color.dim(`--dry-run: nothing was touched.
@@ -121,9 +133,9 @@ ${color.bold("This will destroy, on Cloudflare:")}
   }
   if (!opts.confirm) {
     return fail(`refusing to destroy anything without --confirm.
-` + `  This is not reversible: D1 has no undo, and the orders go with it.
+  This is not reversible: D1 has no undo, and the orders go with it.
 
-` + `  ${color.cyan(`vc teardown --cloudflare --confirm ${project.manifest.shop.domain}`)}`);
+  ${color.cyan(`vc teardown --cloudflare --confirm ${project.manifest.shop.domain}`)}`);
   }
   console.log(`▸ wrangler delete (${plan.worker})`);
   const deleted = await wrangler(bin, ["delete", "--name", plan.worker, "--force"], app);
@@ -162,12 +174,76 @@ ${dropped.out.trim().split(`
     }
     console.log(`${color.green("✓")} the database id is out of wrangler.jsonc and the manifest, so the next deploy provisions afresh`);
   }
+  if (opts.github) {
+    const code = await teardownRepository(project, opts);
+    if (code !== 0)
+      return code;
+  }
   console.log(`
 ${color.bold("Torn down.")} ${color.dim(`The shop's secrets are untouched in ${SECRETS_FILE} — this removed infrastructure, not configuration.`)}
-` + `  Push again, or ${color.cyan("vc deploy --cloudflare --provision")}, and it rebuilds.
+  Push again, or ${color.cyan("vc deploy --cloudflare --provision")}, and it rebuilds.
 `);
   return 0;
 }
+async function teardownRepository(project, opts) {
+  const root = project.root;
+  const { ghAuth, findGh, getVariable, repoSlug, run: run2 } = await import("./github-km752pz0.js");
+  const { LOCAL_KEY_FILE: LOCAL_KEY_FILE2, localPrivateKey, ignoresKeyFile: ignoresKeyFile2 } = await import("./keys-adh7e74k.js");
+  const { PRIVATE_KEY_VAR: PRIVATE_KEY_VAR2 } = await import("./secrets-f2xvf5t3.js");
+  const gh = findGh();
+  const auth = await ghAuth(root);
+  if (!gh || !auth.ok)
+    return fail(auth.reason ?? "the GitHub CLI is not installed.");
+  const slug = await repoSlug(root);
+  if (!slug) {
+    console.log(color.dim("! no GitHub repository here — nothing to delete."));
+    return 0;
+  }
+  if (!localPrivateKey(root)) {
+    const remote = await getVariable(root, PRIVATE_KEY_VAR2);
+    if (remote) {
+      if (!ignoresKeyFile2(root)) {
+        return fail(`${LOCAL_KEY_FILE2} is not gitignored, so the key cannot be rescued here. Add it to .gitignore first.`);
+      }
+      writeFileSync(join(root, LOCAL_KEY_FILE2), `${PRIVATE_KEY_VAR2}="${remote}"
+`, { mode: 384 });
+      console.log(`${color.green("✓")} key pulled back into ${LOCAL_KEY_FILE2} before the repository goes`);
+    } else if (declaredHasEncrypted(root)) {
+      return fail(`${slug} has no ${PRIVATE_KEY_VAR2} and there is no ${LOCAL_KEY_FILE2} here,
+  but ${SECRETS_FILE} holds encrypted values. Deleting the repository would
+  make them permanently unreadable. Find the key first, or clear the file.`);
+    }
+  } else {
+    console.log(color.dim(`= ${LOCAL_KEY_FILE2} is already here, so the key survives the deletion`));
+  }
+  console.log(`▸ gh repo delete ${slug}`);
+  const deleted = await run2(gh, ["repo", "delete", slug, "--yes"], root);
+  if (deleted.code !== 0) {
+    if (/delete_repo|scope/i.test(deleted.out)) {
+      return fail(`gh cannot delete repositories: its token has no \`delete_repo\` scope.
+
+  ${color.cyan("gh auth refresh -s delete_repo")}
+
+` + `  That scope is not granted by default, deliberately — it is the one that
+` + "  destroys work rather than resources.");
+    }
+    return fail(`could not delete ${slug}:
+${deleted.out.trim().split(`
+`).slice(-3).join(`
+`)}`);
+  }
+  console.log(`${color.green("✓")} ${slug} deleted`);
+  const removed = await run2("git", ["remote", "remove", "origin"], root);
+  if (removed.code === 0)
+    console.log(`${color.green("✓")} origin removed, so the next publish starts from nothing`);
+  return 0;
+}
+function declaredHasEncrypted(root) {
+  const path = join(root, SECRETS_FILE);
+  if (!existsSync(path))
+    return false;
+  return /^\s*[A-Z][A-Z0-9_]*\s*=\s*["']?encrypted:/m.test(readFileSync(path, "utf8"));
+}
 
 // src/deploy/index.ts
 async function deployCommand(args) {
@@ -428,6 +504,7 @@ vc: --confirm needs this shop's domain, exactly:
   return teardownCloudflare(project, {
     confirm: confirmed,
     keepData: args.includes("--keep-data"),
+    github: args.includes("--github"),
     dryRun: args.includes("--dry-run")
   });
 }
@@ -440,6 +517,7 @@ async function teardownHelp() {
     ...row("vc teardown --cloudflare --dry-run", "list what would be destroyed, touch nothing", width, 2),
     ...row("vc teardown --cloudflare --confirm <domain>", "do it", width, 2),
     ...row("--keep-data", "leave the D1 database alone", width, 2),
+    ...row("--github", "delete the GitHub repository too, so the next publish is from nothing", width, 2),
     line("", width),
     line(color2.bold("Read this first"), width),
     line("D1 deletion has NO UNDO. Every order, customer and address in the", width),
@@ -448,6 +526,13 @@ async function teardownHelp() {
     line("So --confirm takes the shop's DOMAIN, not `y`: a `y` is muscle memory,", width),
     line("and typing the domain is what stops this running in the wrong shop.", width),
     line("", width),
+    line("--github is separate and opt-in because the blast radius differs in", width),
+    line("kind: Cloudflare holds nothing that cannot be rebuilt from the", width),
+    line("repository, and the repository is what everything is rebuilt FROM. It", width),
+    line("also pulls the encryption key back onto disk BEFORE deleting, because", width),
+    line("that key lives as a repository variable — delete the repository with no", width),
+    line("local copy and every encrypted value is unreadable forever.", width),
+    line("", width),
     line("It is idempotent — deleting what is already gone is success — and it", width),
     line("clears the recorded database id, because `wrangler deploy` FAILS on a", width),
     line("dangling id rather than making a new database. Secrets are untouched:", width),

package/dist/deploy/teardown.d.ts

@@ -33,6 +33,14 @@ export interface TeardownOptions {
     confirm: boolean;
     /** Keep the D1 database — the one thing that holds data nobody can recreate. */
     keepData: boolean;
+    /**
+     * Delete the GitHub repository too, so `git publish from scratch` really
+     * is from scratch. Opt-in and separate from the Cloudflare teardown,
+     * because the blast radius is different in kind: Cloudflare holds nothing
+     * that cannot be rebuilt from the repository, and the repository is the
+     * thing everything is rebuilt FROM.
+     */
+    github: boolean;
     dryRun: boolean;
 }
 interface WranglerConfig {

package/dist/github-km752pz0.js

@@ -0,0 +1,29 @@
+import {
+  apiToken,
+  cloudflareAccounts,
+  findGh,
+  getVariable,
+  ghAuth,
+  repoSlug,
+  run,
+  secretNames,
+  setSecret,
+  setVariable,
+  variableNames,
+  verifyCloudflareToken
+} from "./index-vj6akbny.js";
+import"./index-0v6na3yp.js";
+export {
+  verifyCloudflareToken,
+  variableNames,
+  setVariable,
+  setSecret,
+  secretNames,
+  run,
+  repoSlug,
+  ghAuth,
+  getVariable,
+  findGh,
+  cloudflareAccounts,
+  apiToken
+};

package/dist/{index-51zee2vf.js → index-3wftdrq5.js}

@@ -3,7 +3,6 @@ import {
   PRIVATE_KEY_VAR,
   SECRETS_FILE,
   allEnvKeys,
-  apiToken,
   declaredSecretNames,
   decryptSecrets,
   plaintextSecretNames,
@@ -13,7 +12,7 @@ import {
   renderEnvTs,
   secretValue,
   unsetSecretNames
-} from "./index-t1ggktg8.js";
+} from "./index-hvrbdp85.js";
 import {
   MANIFEST_FILE,
   has,
@@ -33,6 +32,9 @@ import {
 import {
   cloudflareTokenMarkdown
 } from "./index-6e4eh08g.js";
+import {
+  apiToken
+} from "./index-vj6akbny.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -1383,7 +1385,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.22.1",
+  version: "0.23.1",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",

package/dist/{index-t1ggktg8.js → index-hvrbdp85.js}

@@ -5,111 +5,27 @@ import {
   oneOrigin,
   zone
 } from "./index-30y19qz5.js";
+import {
+  getVariable,
+  ghAuth,
+  repoSlug,
+  setVariable,
+  variableNames
+} from "./index-vj6akbny.js";
 import {
   __require,
   __toESM
 } from "./index-0v6na3yp.js";
 
 // src/deploy/keys.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 import color2 from "picocolors";
 
-// src/deploy/github.ts
-import { spawn } from "node:child_process";
-import { delimiter, join } from "node:path";
-import { existsSync } from "node:fs";
-function apiToken() {
-  return process.env["CLOUDFLARE_API_TOKEN"] || process.env["CF_API_TOKEN"] || null;
-}
-var REPO_SCOPE = "repo";
-function findGh() {
-  for (const entry of (process.env["PATH"] ?? "").split(delimiter).filter(Boolean)) {
-    if (existsSync(join(entry, "gh")))
-      return join(entry, "gh");
-  }
-  return null;
-}
-function run(cmd, args, cwd, stdin) {
-  return new Promise((resolve) => {
-    const child = spawn(cmd, args, { cwd, stdio: ["pipe", "pipe", "pipe"] });
-    let out = "";
-    child.stdout?.on("data", (chunk) => {
-      out += chunk;
-    });
-    child.stderr?.on("data", (chunk) => {
-      out += chunk;
-    });
-    child.on("error", (error) => resolve({ code: 1, out: String(error) }));
-    child.on("exit", (code) => resolve({ code: code ?? 1, out }));
-    child.stdin?.end(stdin ?? "");
-  });
-}
-async function ghAuth(cwd) {
-  const gh = findGh();
-  if (!gh) {
-    return { ok: false, reason: "the GitHub CLI is not installed. https://cli.github.com — then `gh auth login`." };
-  }
-  const status = await run(gh, ["auth", "status"], cwd);
-  if (status.code !== 0) {
-    return { ok: false, reason: "gh is not logged in. Run `gh auth login`." };
-  }
-  const user = /Logged in to \S+ account (\S+)/.exec(status.out)?.[1];
-  const scopes = /Token scopes: (.+)/.exec(status.out)?.[1]?.split(",").map((scope) => scope.trim().replace(/^'|'$/g, ""));
-  if (scopes && !scopes.includes(REPO_SCOPE)) {
-    return {
-      ok: false,
-      user,
-      scopes,
-      reason: `gh is logged in as ${user ?? "you"} but its token lacks the \`${REPO_SCOPE}\` scope, which writing repository secrets needs.
-  Run \`gh auth refresh -s ${REPO_SCOPE}\`.`
-    };
-  }
-  return { ok: true, user, scopes };
-}
-async function repoSlug(cwd) {
-  const gh = findGh();
-  if (!gh)
-    return null;
-  const viewed = await run(gh, ["repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner"], cwd);
-  if (viewed.code !== 0)
-    return null;
-  const slug = viewed.out.trim();
-  return /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
-}
-async function setVariable(cwd, name, value) {
-  const gh = findGh();
-  if (!gh)
-    return { ok: false, error: "gh is not installed" };
-  const result = await run(gh, ["variable", "set", name, "--body", value], cwd);
-  return result.code === 0 ? { ok: true } : { ok: false, error: result.out.trim().split(`
-`).slice(-2).join(" ") };
-}
-async function getVariable(cwd, name) {
-  const gh = findGh();
-  if (!gh)
-    return null;
-  const got = await run(gh, ["variable", "get", name, "--json", "value", "-q", ".value"], cwd);
-  if (got.code !== 0)
-    return null;
-  const value = got.out.trim();
-  return value.length > 0 ? value : null;
-}
-async function variableNames(cwd) {
-  const gh = findGh();
-  if (!gh)
-    return new Set;
-  const listed = await run(gh, ["variable", "list", "--json", "name", "-q", ".[].name"], cwd);
-  if (listed.code !== 0)
-    return new Set;
-  return new Set(listed.out.split(`
-`).map((line) => line.trim()).filter(Boolean));
-}
-
 // src/deploy/secrets.ts
-import { existsSync as existsSync2, readFileSync, writeFileSync } from "node:fs";
-import { spawn as spawn2 } from "node:child_process";
-import { delimiter as delimiter2, dirname, join as join2 } from "node:path";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { delimiter, dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import color from "picocolors";
 
@@ -272,19 +188,19 @@ var PRIVATE_KEY_VAR = "DOTENV_PRIVATE_KEY_SECRETS";
 function findDotenvx(from) {
   let dir = from;
   for (;; ) {
-    const local = join2(dir, "node_modules", ".bin", "dotenvx");
-    if (existsSync2(local))
+    const local = join(dir, "node_modules", ".bin", "dotenvx");
+    if (existsSync(local))
       return local;
     const parent = dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  return (process.env["PATH"] ?? "").split(delimiter2).filter(Boolean).some((entry) => existsSync2(join2(entry, "dotenvx"))) ? "dotenvx" : null;
+  return (process.env["PATH"] ?? "").split(delimiter).filter(Boolean).some((entry) => existsSync(join(entry, "dotenvx"))) ? "dotenvx" : null;
 }
-function run2(cmd, args, cwd, env = {}) {
+function run(cmd, args, cwd, env = {}) {
   return new Promise((resolve) => {
-    const child = spawn2(cmd, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, ...env } });
+    const child = spawn(cmd, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, ...env } });
     let out = "";
     child.stdout.on("data", (chunk) => {
       out += chunk;
@@ -297,9 +213,9 @@ function run2(cmd, args, cwd, env = {}) {
   });
 }
 function committedPublicKeyInto(root, publicKey) {
-  const path = join2(root, SECRETS_FILE);
+  const path = join(root, SECRETS_FILE);
   const line = `DOTENV_PUBLIC_KEY_SECRETS="${publicKey}"`;
-  if (!existsSync2(path)) {
+  if (!existsSync(path)) {
     writeFileSync(path, `${line}
 `, { mode: 384 });
     return;
@@ -309,8 +225,8 @@ function committedPublicKeyInto(root, publicKey) {
 ${body}`);
 }
 function declaredSecretNames(root) {
-  const path = join2(root, SECRETS_FILE);
-  if (!existsSync2(path))
+  const path = join(root, SECRETS_FILE);
+  if (!existsSync(path))
     return new Set;
   const names = new Set;
   for (const line of readFileSync(path, "utf8").split(`
@@ -322,8 +238,8 @@ function declaredSecretNames(root) {
   return names;
 }
 function unsetSecretNames(root) {
-  const path = join2(root, SECRETS_FILE);
-  if (!existsSync2(path))
+  const path = join(root, SECRETS_FILE);
+  if (!existsSync(path))
     return [];
   const out = [];
   for (const line of readFileSync(path, "utf8").split(`
@@ -337,8 +253,8 @@ function unsetSecretNames(root) {
   return out;
 }
 function plaintextSecretNames(root) {
-  const path = join2(root, SECRETS_FILE);
-  if (!existsSync2(path))
+  const path = join(root, SECRETS_FILE);
+  if (!existsSync(path))
     return [];
   const bare = [];
   for (const line of readFileSync(path, "utf8").split(`
@@ -353,8 +269,8 @@ function plaintextSecretNames(root) {
   return bare;
 }
 function plaintextSecretEntries(root) {
-  const path = join2(root, SECRETS_FILE);
-  if (!existsSync2(path))
+  const path = join(root, SECRETS_FILE);
+  if (!existsSync(path))
     return [];
   const out = [];
   for (const line of readFileSync(path, "utf8").split(`
@@ -370,9 +286,9 @@ function plaintextSecretEntries(root) {
 }
 async function decryptSecrets(project) {
   const root = project.root;
-  if (!existsSync2(join2(root, SECRETS_FILE)))
+  if (!existsSync(join(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const { localPrivateKey } = await import("./keys-1h4zpvd7.js");
+  const { localPrivateKey } = await import("./keys-adh7e74k.js");
   const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
   if (!privateKey) {
     return {
@@ -384,7 +300,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-1h4zpvd7.js");
+    const { publicKeyFor } = await import("./keys-adh7e74k.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -398,7 +314,7 @@ async function decryptSecrets(project) {
   const dotenvx = findDotenvx(root);
   if (!dotenvx)
     return { error: "dotenvx is not installed. `bun add -d @dotenvx/dotenvx`" };
-  const result = await run2(dotenvx, ["decrypt", "-f", SECRETS_FILE, "--stdout"], root, {
+  const result = await run(dotenvx, ["decrypt", "-f", SECRETS_FILE, "--stdout"], root, {
     [PRIVATE_KEY_VAR]: privateKey
   });
   if (result.code !== 0)
@@ -412,7 +328,7 @@ async function decryptSecrets(project) {
     return !deployOnly.has(line.slice(0, line.indexOf("=")).trim());
   });
   const names = lines.map((line) => line.slice(0, line.indexOf("=")).trim());
-  const path = join2(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
+  const path = join(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
   writeFileSync(path, `${lines.join(`
 `)}
 `, { mode: 384 });
@@ -440,7 +356,7 @@ async function secretsCommand(project, args) {
     return syncSecrets(project, args.includes("--prune"));
   if (args.includes("--adopt"))
     return adoptSecrets(project, args.includes("--confirm"));
-  if (!existsSync2(join2(root, SECRETS_FILE))) {
+  if (!existsSync(join(root, SECRETS_FILE))) {
     console.log(`
 ${color.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,
 which means the shop cannot be rebuilt from a checkout.
@@ -480,8 +396,8 @@ ${color.green("✓")} every secret this shop needs is declared and encrypted.
   return 0;
 }
 async function initSecrets(project) {
-  const path = join2(project.root, SECRETS_FILE);
-  if (existsSync2(path) && declaredSecretNames(project.root).size > 0) {
+  const path = join(project.root, SECRETS_FILE);
+  if (existsSync(path) && declaredSecretNames(project.root).size > 0) {
     console.error(`vc: ${SECRETS_FILE} already declares secrets; not overwriting it.
   \`vc secrets set KEY\` changes one.`);
     return 1;
@@ -542,7 +458,7 @@ vc: "${name}" is not a key name — they are SHOUTING_SNAKE_CASE.
 `);
     return 1;
   }
-  if (!existsSync2(join2(root, SECRETS_FILE))) {
+  if (!existsSync(join(root, SECRETS_FILE))) {
     console.error(`
 vc: no ${SECRETS_FILE} yet. \`vc secrets --init\` writes one.
 `);
@@ -645,7 +561,7 @@ async function encryptInto(root, publicKey, name, value) {
   if (looksWrong) {
     return { ok: false, error: `refusing to write ${name} — the result does not look encrypted.` };
   }
-  upsertLine(join2(root, SECRETS_FILE), name, ciphertext);
+  upsertLine(join(root, SECRETS_FILE), name, ciphertext);
   return { ok: true };
 }
 function upsertLine(path, name, value) {
@@ -657,8 +573,8 @@ function upsertLine(path, name, value) {
 }
 async function syncSecrets(project, prune) {
   const root = project.root;
-  const path = join2(root, SECRETS_FILE);
-  if (!existsSync2(path)) {
+  const path = join(root, SECRETS_FILE);
+  if (!existsSync(path)) {
     console.error(`
 vc: no ${SECRETS_FILE} yet. \`vc secrets --init\` writes one.
 `);
@@ -725,14 +641,14 @@ ${color.green("✓")} every secret this shop needs is already declared.
 }
 async function adoptSecrets(project, confirmed) {
   const root = project.root;
-  const path = join2(root, SECRETS_FILE);
-  if (!existsSync2(path)) {
+  const path = join(root, SECRETS_FILE);
+  if (!existsSync(path)) {
     console.error(`
 vc: no ${SECRETS_FILE} here — \`vc secrets --init\` starts a fresh one.
 `);
     return 1;
   }
-  const { localPrivateKey, publicKeyFor, generateKeypair } = await import("./keys-1h4zpvd7.js");
+  const { localPrivateKey, publicKeyFor, generateKeypair } = await import("./keys-adh7e74k.js");
   const current = committedPublicKey(root);
   const mine = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root);
   if (mine && current && (await publicKeyFor(mine))?.toLowerCase() === current.toLowerCase()) {
@@ -776,7 +692,7 @@ ${color.bold("Adopting this shop would:")}
   }).join(`
 `);
   writeFileSync(path, body);
-  writeFileSync(join2(root, ".env.keys"), `${PRIVATE_KEY_VAR}="${pair.privateKey}"
+  writeFileSync(join(root, ".env.keys"), `${PRIVATE_KEY_VAR}="${pair.privateKey}"
 `, { mode: 384 });
   console.log(`
 ${color.green("✓")} adopted: a new key, and ${declared.length} value${declared.length === 1 ? "" : "s"} reset to \`unset\`
@@ -796,15 +712,15 @@ ${required.slice(0, 4).map((key) => `  ${color.cyan(`vc secrets set ${key.key}`)
 // src/deploy/keys.ts
 var LOCAL_KEY_FILE = ".env.keys";
 function localPrivateKey(root) {
-  const path = join3(root, LOCAL_KEY_FILE);
-  if (!existsSync3(path))
+  const path = join2(root, LOCAL_KEY_FILE);
+  if (!existsSync2(path))
     return null;
   const match = new RegExp(`^\\s*${PRIVATE_KEY_VAR}\\s*=\\s*["']?([0-9a-fA-F]+)["']?`, "m").exec(readFileSync2(path, "utf8"));
   return match?.[1] ?? null;
 }
 function committedPublicKey(root) {
-  const path = join3(root, SECRETS_FILE);
-  if (!existsSync3(path))
+  const path = join2(root, SECRETS_FILE);
+  if (!existsSync2(path))
     return null;
   const match = /^\s*DOTENV_PUBLIC_KEY_SECRETS\s*=\s*["']?([0-9a-fA-F]+)["']?/m.exec(readFileSync2(path, "utf8"));
   return match?.[1] ?? null;
@@ -865,13 +781,13 @@ async function provisionKey(project) {
   would publish the key that opens every secret in the repository.`
     };
   }
-  writeFileSync2(join3(project.root, LOCAL_KEY_FILE), `${PRIVATE_KEY_VAR}="${pair.privateKey}"
+  writeFileSync2(join2(project.root, LOCAL_KEY_FILE), `${PRIVATE_KEY_VAR}="${pair.privateKey}"
 `, { mode: 384 });
   return { ok: true, publicKey: pair.publicKey, parked: true };
 }
 function ignoresKeyFile(root) {
-  const path = join3(root, ".gitignore");
-  if (!existsSync3(path))
+  const path = join2(root, ".gitignore");
+  if (!existsSync2(path))
     return false;
   return readFileSync2(path, "utf8").split(`
 `).map((line) => line.trim()).some((line) => line === LOCAL_KEY_FILE || line === `/${LOCAL_KEY_FILE}` || line === ".env.keys*" || line === ".env*");
@@ -920,7 +836,7 @@ vc: ${LOCAL_KEY_FILE} is not gitignored here, and this would write the key into
 `);
     return 1;
   }
-  writeFileSync2(join3(project.root, LOCAL_KEY_FILE), `${PRIVATE_KEY_VAR}="${key}"
+  writeFileSync2(join2(project.root, LOCAL_KEY_FILE), `${PRIVATE_KEY_VAR}="${key}"
 `, { mode: 384 });
   console.log(`
 ${color2.green("✓")} key restored from ${slug} into ${LOCAL_KEY_FILE}
@@ -940,7 +856,7 @@ async function keysCommand(project, args) {
 Secrets are encrypted with a public key that is COMMITTED, and read with a`);
   console.log(`private key that lives only in GitHub Actions.
 `);
-  const hasFile = existsSync3(join3(project.root, SECRETS_FILE));
+  const hasFile = existsSync2(join2(project.root, SECRETS_FILE));
   const publicNote = state.publicKey ? `${state.publicKey.slice(0, 20)}… in ${SECRETS_FILE}` : color2.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc keys --init\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
   console.log(`  ${state.publicKey ? color2.green("✓") : color2.dim("·")} public key   ${publicNote}`);
   const parked = localPrivateKey(project.root) !== null;
@@ -976,7 +892,7 @@ vc: ${made.reason}
 `);
     return 1;
   }
-  const fresh = !existsSync3(join3(project.root, SECRETS_FILE));
+  const fresh = !existsSync2(join2(project.root, SECRETS_FILE));
   committedPublicKeyInto(project.root, made.publicKey);
   console.log(made.parked ? `
 ${color2.green("✓")} key made; public half in ${SECRETS_FILE}, private half waiting in ${LOCAL_KEY_FILE}
@@ -1027,7 +943,7 @@ vc: ${state.mismatch}
     console.error("vc: dotenvx is not installed here. `bun add -d @dotenvx/dotenvx`");
     return 1;
   }
-  const decrypted = await run2(dotenvx, ["decrypt", "-f", SECRETS_FILE], project.root, { [PRIVATE_KEY_VAR]: old });
+  const decrypted = await run(dotenvx, ["decrypt", "-f", SECRETS_FILE], project.root, { [PRIVATE_KEY_VAR]: old });
   if (decrypted.code !== 0) {
     console.error(`
 vc: could not decrypt ${SECRETS_FILE}: ${decrypted.out.trim().split(`
@@ -1046,7 +962,7 @@ vc: ${made.reason}
     return 1;
   }
   committedPublicKeyInto(project.root, made.publicKey);
-  const encrypted = await run2(dotenvx, ["encrypt", "-f", SECRETS_FILE], project.root);
+  const encrypted = await run(dotenvx, ["encrypt", "-f", SECRETS_FILE], project.root);
   if (encrypted.code !== 0) {
     console.error(`
 vc: re-encryption failed: ${encrypted.out.trim().split(`
@@ -1064,4 +980,4 @@ ${color2.green("✓")} re-keyed under ${made.publicKey.slice(0, 20)}… and ${PR
   return 0;
 }
 
-export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, secretValue, encryptInto };
+export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, findDotenvx, run, committedPublicKeyInto, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, setSecretValue, secretValue, encryptInto };

package/dist/index-vj6akbny.js

@@ -0,0 +1,135 @@
+// src/deploy/github.ts
+import { spawn } from "node:child_process";
+import { delimiter, join } from "node:path";
+import { existsSync } from "node:fs";
+function apiToken() {
+  return process.env["CLOUDFLARE_API_TOKEN"] || process.env["CF_API_TOKEN"] || null;
+}
+var REPO_SCOPE = "repo";
+function findGh() {
+  for (const entry of (process.env["PATH"] ?? "").split(delimiter).filter(Boolean)) {
+    if (existsSync(join(entry, "gh")))
+      return join(entry, "gh");
+  }
+  return null;
+}
+function run(cmd, args, cwd, stdin) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, { cwd, stdio: ["pipe", "pipe", "pipe"] });
+    let out = "";
+    child.stdout?.on("data", (chunk) => {
+      out += chunk;
+    });
+    child.stderr?.on("data", (chunk) => {
+      out += chunk;
+    });
+    child.on("error", (error) => resolve({ code: 1, out: String(error) }));
+    child.on("exit", (code) => resolve({ code: code ?? 1, out }));
+    child.stdin?.end(stdin ?? "");
+  });
+}
+async function ghAuth(cwd) {
+  const gh = findGh();
+  if (!gh) {
+    return { ok: false, reason: "the GitHub CLI is not installed. https://cli.github.com — then `gh auth login`." };
+  }
+  const status = await run(gh, ["auth", "status"], cwd);
+  if (status.code !== 0) {
+    return { ok: false, reason: "gh is not logged in. Run `gh auth login`." };
+  }
+  const user = /Logged in to \S+ account (\S+)/.exec(status.out)?.[1];
+  const scopes = /Token scopes: (.+)/.exec(status.out)?.[1]?.split(",").map((scope) => scope.trim().replace(/^'|'$/g, ""));
+  if (scopes && !scopes.includes(REPO_SCOPE)) {
+    return {
+      ok: false,
+      user,
+      scopes,
+      reason: `gh is logged in as ${user ?? "you"} but its token lacks the \`${REPO_SCOPE}\` scope, which writing repository secrets needs.
+  Run \`gh auth refresh -s ${REPO_SCOPE}\`.`
+    };
+  }
+  return { ok: true, user, scopes };
+}
+async function repoSlug(cwd) {
+  const gh = findGh();
+  if (!gh)
+    return null;
+  const viewed = await run(gh, ["repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner"], cwd);
+  if (viewed.code !== 0)
+    return null;
+  const slug = viewed.out.trim();
+  return /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+}
+async function setSecret(cwd, name, value) {
+  const gh = findGh();
+  if (!gh)
+    return { ok: false, error: "gh is not installed" };
+  const result = await run(gh, ["secret", "set", name], cwd, value);
+  return result.code === 0 ? { ok: true } : { ok: false, error: result.out.trim().split(`
+`).slice(-2).join(" ") };
+}
+async function secretNames(cwd) {
+  const gh = findGh();
+  if (!gh)
+    return new Set;
+  const listed = await run(gh, ["secret", "list", "--json", "name", "-q", ".[].name"], cwd);
+  if (listed.code !== 0)
+    return new Set;
+  return new Set(listed.out.split(`
+`).map((line) => line.trim()).filter(Boolean));
+}
+async function setVariable(cwd, name, value) {
+  const gh = findGh();
+  if (!gh)
+    return { ok: false, error: "gh is not installed" };
+  const result = await run(gh, ["variable", "set", name, "--body", value], cwd);
+  return result.code === 0 ? { ok: true } : { ok: false, error: result.out.trim().split(`
+`).slice(-2).join(" ") };
+}
+async function getVariable(cwd, name) {
+  const gh = findGh();
+  if (!gh)
+    return null;
+  const got = await run(gh, ["variable", "get", name, "--json", "value", "-q", ".value"], cwd);
+  if (got.code !== 0)
+    return null;
+  const value = got.out.trim();
+  return value.length > 0 ? value : null;
+}
+async function variableNames(cwd) {
+  const gh = findGh();
+  if (!gh)
+    return new Set;
+  const listed = await run(gh, ["variable", "list", "--json", "name", "-q", ".[].name"], cwd);
+  if (listed.code !== 0)
+    return new Set;
+  return new Set(listed.out.split(`
+`).map((line) => line.trim()).filter(Boolean));
+}
+async function verifyCloudflareToken(token) {
+  try {
+    const response = await fetch("https://api.cloudflare.com/client/v4/user/tokens/verify", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    const body = await response.json();
+    if (body.success && body.result?.status === "active")
+      return { ok: true, detail: "active" };
+    const message = body.errors?.[0]?.message ?? `HTTP ${response.status}`;
+    return { ok: false, detail: message };
+  } catch (error) {
+    return { ok: false, detail: `could not reach the Cloudflare API: ${String(error)}` };
+  }
+}
+async function cloudflareAccounts(token) {
+  try {
+    const response = await fetch("https://api.cloudflare.com/client/v4/accounts?per_page=50", {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    const body = await response.json();
+    return body.success && Array.isArray(body.result) ? body.result.map((a) => ({ id: a.id, name: a.name })) : [];
+  } catch {
+    return [];
+  }
+}
+
+export { apiToken, findGh, run, ghAuth, repoSlug, setSecret, secretNames, setVariable, getVariable, variableNames, verifyCloudflareToken, cloudflareAccounts };

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-51zee2vf.js";
+} from "./index-3wftdrq5.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-t1ggktg8.js";
+} from "./index-hvrbdp85.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -100,6 +100,7 @@ import {
   UI
 } from "./index-xyjhy6kp.js";
 import"./index-6e4eh08g.js";
+import"./index-vj6akbny.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/dist/{keys-1h4zpvd7.js → keys-adh7e74k.js}

@@ -8,9 +8,10 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-t1ggktg8.js";
+} from "./index-hvrbdp85.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
+import"./index-vj6akbny.js";
 import"./index-0v6na3yp.js";
 export {
   publicKeyFor,

package/dist/secrets-f2xvf5t3.js

@@ -0,0 +1,38 @@
+import {
+  PRIVATE_KEY_VAR,
+  SECRETS_FILE,
+  committedPublicKeyInto,
+  declaredSecretNames,
+  decryptSecrets,
+  encryptInto,
+  findDotenvx,
+  initSecrets,
+  plaintextSecretEntries,
+  plaintextSecretNames,
+  run,
+  secretValue,
+  secretsCommand,
+  setSecretValue,
+  unsetSecretNames
+} from "./index-hvrbdp85.js";
+import"./index-30y19qz5.js";
+import"./index-xyjhy6kp.js";
+import"./index-vj6akbny.js";
+import"./index-0v6na3yp.js";
+export {
+  unsetSecretNames,
+  setSecretValue,
+  secretsCommand,
+  secretValue,
+  run,
+  plaintextSecretNames,
+  plaintextSecretEntries,
+  initSecrets,
+  findDotenvx,
+  encryptInto,
+  decryptSecrets,
+  declaredSecretNames,
+  committedPublicKeyInto,
+  SECRETS_FILE,
+  PRIVATE_KEY_VAR
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.22.1",
+  "version": "0.23.1",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/deploy/index.ts

@@ -344,6 +344,7 @@ export async function teardownCliCommand(args: string[]): Promise<number> {
 	return teardownCloudflare(project, {
 		confirm: confirmed,
 		keepData: args.includes("--keep-data"),
+		github: args.includes("--github"),
 		dryRun: args.includes("--dry-run"),
 	});
 }
@@ -358,6 +359,7 @@ export async function teardownHelp(): Promise<number> {
 			...row("vc teardown --cloudflare --dry-run", "list what would be destroyed, touch nothing", width, 2),
 			...row("vc teardown --cloudflare --confirm <domain>", "do it", width, 2),
 			...row("--keep-data", "leave the D1 database alone", width, 2),
+			...row("--github", "delete the GitHub repository too, so the next publish is from nothing", width, 2),
 			line("", width),
 			line(color.bold("Read this first"), width),
 			line("D1 deletion has NO UNDO. Every order, customer and address in the", width),
@@ -366,6 +368,13 @@ export async function teardownHelp(): Promise<number> {
 			line("So --confirm takes the shop's DOMAIN, not `y`: a `y` is muscle memory,", width),
 			line("and typing the domain is what stops this running in the wrong shop.", width),
 			line("", width),
+			line("--github is separate and opt-in because the blast radius differs in", width),
+			line("kind: Cloudflare holds nothing that cannot be rebuilt from the", width),
+			line("repository, and the repository is what everything is rebuilt FROM. It", width),
+			line("also pulls the encryption key back onto disk BEFORE deleting, because", width),
+			line("that key lives as a repository variable — delete the repository with no", width),
+			line("local copy and every encrypted value is unreadable forever.", width),
+			line("", width),
 			line("It is idempotent — deleting what is already gone is success — and it", width),
 			line("clears the recorded database id, because `wrangler deploy` FAILS on a", width),
 			line("dangling id rather than making a new database. Secrets are untouched:", width),

package/src/deploy/teardown.ts

@@ -42,6 +42,14 @@ export interface TeardownOptions {
 	confirm: boolean;
 	/** Keep the D1 database — the one thing that holds data nobody can recreate. */
 	keepData: boolean;
+	/**
+	 * Delete the GitHub repository too, so `git publish from scratch` really
+	 * is from scratch. Opt-in and separate from the Cloudflare teardown,
+	 * because the blast radius is different in kind: Cloudflare holds nothing
+	 * that cannot be rebuilt from the repository, and the repository is the
+	 * thing everything is rebuilt FROM.
+	 */
+	github: boolean;
 	dryRun: boolean;
 }
 
@@ -100,6 +108,17 @@ export async function teardownCloudflare(project: Project, opts: TeardownOptions
 			: `  database  ${color.dim("none recorded")}`,
 	);
 	console.log(plan.queues.length ? `  queues    ${plan.queues.join(", ")}` : `  queues    ${color.dim("none recorded")}`);
+
+	// A dry run has to show EVERYTHING it would do, or it is not a rehearsal.
+	if (opts.github) {
+		const { repoSlug } = await import("./github");
+		const slug = await repoSlug(project.root);
+		console.log(
+			slug
+				? `\n${color.bold("And on GitHub:")}\n\n  repository  ${slug}   ${color.red("DELETED — code, history, issues, and the encryption key variable")}`
+				: `\n  repository  ${color.dim("none — there is nothing to delete")}`,
+		);
+	}
 	console.log("");
 
 	if (opts.dryRun) {
@@ -167,9 +186,95 @@ export async function teardownCloudflare(project: Project, opts: TeardownOptions
 		console.log(`${color.green("✓")} the database id is out of wrangler.jsonc and the manifest, so the next deploy provisions afresh`);
 	}
 
+	if (opts.github) {
+		const code = await teardownRepository(project, opts);
+		if (code !== 0) return code;
+	}
+
 	console.log(
 		`\n${color.bold("Torn down.")} ${color.dim(`The shop's secrets are untouched in ${SECRETS_FILE} — this removed infrastructure, not configuration.`)}\n` +
 			`  Push again, or ${color.cyan("vc deploy --cloudflare --provision")}, and it rebuilds.\n`,
 	);
 	return 0;
 }
+
+
+/**
+ * Delete the GitHub repository — and rescue the key before doing it.
+ *
+ * ── The trap this exists to avoid ────────────────────────────────────────
+ *
+ * `DOTENV_PRIVATE_KEY_SECRETS` lives as a repository VARIABLE. Deleting the
+ * repository deletes it, and if the local `.env.keys` was already removed —
+ * which is the normal, recommended end state — then every value in
+ * `.env.secrets` becomes permanently unreadable the instant the repository
+ * goes. Including the Cloudflare token needed to tear Cloudflare down.
+ *
+ * A teardown that leaves you unable to rebuild is not a teardown, it is an
+ * accident. So the key is pulled back onto disk FIRST, and the repository is
+ * only deleted once it is safely there.
+ */
+async function teardownRepository(project: Project, opts: TeardownOptions): Promise<number> {
+	const root = project.root;
+	const { ghAuth, findGh, getVariable, repoSlug, run } = await import("./github");
+	const { LOCAL_KEY_FILE, localPrivateKey, ignoresKeyFile } = await import("./keys");
+	const { PRIVATE_KEY_VAR } = await import("./secrets");
+
+	const gh = findGh();
+	const auth = await ghAuth(root);
+	if (!gh || !auth.ok) return fail(auth.reason ?? "the GitHub CLI is not installed.");
+
+	const slug = await repoSlug(root);
+	if (!slug) {
+		console.log(color.dim("! no GitHub repository here — nothing to delete."));
+		return 0;
+	}
+
+	// 1. Rescue the key, before anything is destroyed.
+	if (!localPrivateKey(root)) {
+		const remote = await getVariable(root, PRIVATE_KEY_VAR);
+		if (remote) {
+			if (!ignoresKeyFile(root)) {
+				return fail(`${LOCAL_KEY_FILE} is not gitignored, so the key cannot be rescued here. Add it to .gitignore first.`);
+			}
+			writeFileSync(join(root, LOCAL_KEY_FILE), `${PRIVATE_KEY_VAR}="${remote}"\n`, { mode: 0o600 });
+			console.log(`${color.green("✓")} key pulled back into ${LOCAL_KEY_FILE} before the repository goes`);
+		} else if (declaredHasEncrypted(root)) {
+			return fail(
+				`${slug} has no ${PRIVATE_KEY_VAR} and there is no ${LOCAL_KEY_FILE} here,\n` +
+					`  but ${SECRETS_FILE} holds encrypted values. Deleting the repository would\n` +
+					"  make them permanently unreadable. Find the key first, or clear the file.",
+			);
+		}
+	} else {
+		console.log(color.dim(`= ${LOCAL_KEY_FILE} is already here, so the key survives the deletion`));
+	}
+
+	// 2. Delete it.
+	console.log(`▸ gh repo delete ${slug}`);
+	const deleted = await run(gh, ["repo", "delete", slug, "--yes"], root);
+	if (deleted.code !== 0) {
+		if (/delete_repo|scope/i.test(deleted.out)) {
+			return fail(
+				`gh cannot delete repositories: its token has no \`delete_repo\` scope.\n\n` +
+					`  ${color.cyan("gh auth refresh -s delete_repo")}\n\n` +
+					"  That scope is not granted by default, deliberately — it is the one that\n" +
+					"  destroys work rather than resources.",
+			);
+		}
+		return fail(`could not delete ${slug}:\n${deleted.out.trim().split("\n").slice(-3).join("\n")}`);
+	}
+	console.log(`${color.green("✓")} ${slug} deleted`);
+
+	// 3. Drop the remote, so `gh repo create --source=.` works cleanly next time.
+	const removed = await run("git", ["remote", "remove", "origin"], root);
+	if (removed.code === 0) console.log(`${color.green("✓")} origin removed, so the next publish starts from nothing`);
+	return 0;
+}
+
+/** Does the secrets file hold anything that would be lost with the key? */
+function declaredHasEncrypted(root: string): boolean {
+	const path = join(root, SECRETS_FILE);
+	if (!existsSync(path)) return false;
+	return /^\s*[A-Z][A-Z0-9_]*\s*=\s*["']?encrypted:/m.test(readFileSync(path, "utf8"));
+}