@saastemly/voidcommerce 0.10.0 → 0.12.0

package/dist/catalog.js

@@ -14,7 +14,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-mnb7fz2t.js";
+} from "./index-7xwcv2cj.js";
 import"./index-0v6na3yp.js";
 export {
   UI,

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-mb1p1rh0.js";
+} from "./index-g0p3kk0f.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -50,7 +50,7 @@ import {
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-vhsq8jpy.js";
+} from "./index-a279r74m.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -58,10 +58,10 @@ import {
   validate,
   writeManifest,
   zoneOf
-} from "./index-tjy6yygc.js";
+} from "./index-ym88atwf.js";
 import {
   GROUPS
-} from "./index-mnb7fz2t.js";
+} from "./index-7xwcv2cj.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -85,6 +85,8 @@ var SCOPES = [
   ["Account · Workers R2 Storage: Edit", "product images"],
   ["Account · Account Settings: Read", "confirm which account this is"],
   ["Zone · Workers Routes: Edit", "answer on your domain"],
+  ["Zone · Zone: Read", "confirm the domain's zone is on this account"],
+  ["Zone · DNS: Read", "notice a hostname that already answers, before taking it over"],
   ["User · User Details: Read", "wrangler asks at startup"]
 ];
 async function linkCommand(project, args) {

package/dist/deploy/github.d.ts

@@ -30,6 +30,8 @@
  * @see https://developers.cloudflare.com/workers/ci-cd/external-cicd/github-actions/
  * @see https://github.com/cloudflare/workers-sdk/discussions/11434
  */
+/** The Cloudflare token, from wherever wrangler itself would read it. */
+export declare function apiToken(): string | null;
 export interface GhAuth {
     /** Logged in, with a token that can write repository secrets. */
     ok: boolean;

package/dist/deploy/zone.d.ts

@@ -0,0 +1,51 @@
+/**
+ * "Same zone": the shop's DNS zone is on the SAME Cloudflare account as the
+ * worker — and checking that it really is.
+ *
+ * ── Why this is worth a check rather than a sentence ─────────────────────
+ *
+ * Everything about the deploy rests on it. A Worker custom domain is a
+ * record Cloudflare writes in its own zone, so it works only when the zone
+ * is on the account the token belongs to. Cloudflare's own words: *"You
+ * cannot create a Custom Domain on a hostname with an existing CNAME DNS
+ * record or on a zone you do not own."* Until now that was a line in
+ * DEPLOY.md and nothing verified it, so getting it wrong surfaced as a
+ * wrangler error in the middle of a deploy that had already created a
+ * database.
+ *
+ * ── And the failure that is worse than an error ──────────────────────────
+ *
+ * Wrangler resolves a conflicting hostname interactively — it asks whether
+ * to move the record onto this script. In CI there is nobody to ask, and it
+ * does not fail: its own source sets
+ *
+ *     override_existing_origin = true
+ *     override_existing_dns_record = true
+ *
+ * whenever stdout is not a TTY. So a hostname already serving something
+ * else — another worker, a real site — is taken over silently, by a push.
+ * That is not a thing to discover afterwards, so this refuses first.
+ *
+ * ── What it deliberately does not do ─────────────────────────────────────
+ *
+ * It writes nothing. `cloudflare-samezone` needs no DNS records and no
+ * second credential: the worker's hostname is a custom domain Cloudflare
+ * creates itself, the storefront rides in that same worker, and Cloudflare
+ * Email writes its own SPF, DKIM and DMARC when the domain is onboarded.
+ * The value here is the precondition, not the plumbing.
+ */
+export interface ZoneCheck {
+    ok: boolean;
+    /** What to tell the operator. Empty when everything is as it should be. */
+    problems: string[];
+    notes: string[];
+}
+/**
+ * Is `zone` on this account, and is `hostname` free to become a custom domain?
+ *
+ * `accountId` is optional: without it any zone the token can see counts,
+ * which is the right answer for a token scoped to one account anyway.
+ */
+export declare function checkSameZone(token: string, zone: string, hostname: string, accountId?: string): Promise<ZoneCheck>;
+/** Print a check, in the shape the rest of the deploy uses. */
+export declare function printZoneCheck(check: ZoneCheck, zone: string): void;

package/dist/generate/env.d.ts

@@ -3,6 +3,16 @@ import { type Manifest, has } from "../manifest";
 export declare function allEnvKeys(manifest: Manifest): EnvKey[];
 export declare function renderEnvTs(manifest: Manifest): string;
 export declare function renderEnvExample(manifest: Manifest): string;
+/**
+ * Keys whose value is the MANIFEST'S to decide, not the operator's.
+ *
+ * These are the shop's identity. Preserving whatever was already on disk is
+ * right for a credential and wrong for these: a shop copied from another one
+ * kept `SHOP_DOMAIN=tshirt.test` and an EMAIL_FROM at the wrong domain, which
+ * is how a storefront ends up quietly addressing the wrong business. If you
+ * want a different domain, change the manifest — that is what it is for.
+ */
+export declare const MANIFEST_OWNED_ENV: Set<string>;
 export declare function renderEnvLocal(manifest: Manifest): string;
 export declare function renderEnvProduction(manifest: Manifest): string;
 /** So the generator can say what it decided. */

package/dist/{index-mnb7fz2t.js → index-7xwcv2cj.js}

@@ -525,15 +525,20 @@ var EMAIL = {
 var DNS = {
   id: "dns",
   title: "DNS",
-  intro: "So the deploy writes the zone's records, not a person in a registrar's UI. The worker's own hostname is a Cloudflare custom domain and needs no record here; the mail sender's do.",
+  intro: "Where the shop's domain lives, and whether the deploy may touch it. The worker's own hostname is a Cloudflare custom domain and needs no record here — Cloudflare writes that one itself.",
   kind: "select",
   choices: [
+    {
+      id: "cloudflare-samezone",
+      label: "Cloudflare, same account",
+      hint: "the zone is on the same Cloudflare account as the worker — the deploy checks that before it changes anything, and needs no extra credential",
+      recommended: true
+    },
     {
       id: "cloudflare",
-      label: "Cloudflare",
-      hint: "the zone the shop's domain is in — the deploy writes the mail records so confirmations are not spam",
+      label: "Cloudflare, another account or a second zone",
+      hint: "a separate DNS token, for a zone the worker's own token cannot see — the deploy writes the mail records so confirmations are not spam",
       packages: ["@saastemly/better-dns"],
-      recommended: true,
       env: [
         { key: "CLOUDFLARE_DNS_TOKEN", breaks: "the storefront records are never written; the domain does not reach the shop", where: "a token with Zone:DNS:Edit and Zone:Zone:Read" }
       ]

package/dist/{index-vhsq8jpy.js → index-a279r74m.js}

@@ -4,7 +4,7 @@ import {
   isApex,
   oneOrigin,
   zone
-} from "./index-tjy6yygc.js";
+} from "./index-ym88atwf.js";
 import {
   __require,
   __toESM
@@ -19,6 +19,9 @@ import color2 from "picocolors";
 import { spawn } from "node:child_process";
 import { delimiter, join } from "node:path";
 import { existsSync } from "node:fs";
+function apiToken() {
+  return process.env["CLOUDFLARE_API_TOKEN"] || process.env["CF_API_TOKEN"] || null;
+}
 var REPO_SCOPE = "repo";
 function findGh() {
   for (const entry of (process.env["PATH"] ?? "").split(delimiter).filter(Boolean)) {
@@ -233,6 +236,7 @@ function renderEnvExample(manifest) {
   ].join(`
 `);
 }
+var MANIFEST_OWNED_ENV = new Set(["SHOP_DOMAIN", "SHOP_ZONE", "EMAIL_FROM", "GITHUB_PAGES_HOST"]);
 function renderEnvLocal(manifest) {
   const keys = allEnvKeys(manifest);
   const local = {
@@ -385,7 +389,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-2q3qzntw.js");
+    const { publicKeyFor } = await import("./keys-px5maaj1.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -912,4 +916,4 @@ ${color2.green("✓")} re-keyed under ${made.publicKey.slice(0, 20)}… and ${PR
   return 0;
 }
 
-export { allEnvKeys, renderEnvTs, renderEnvExample, renderEnvLocal, renderEnvProduction, envSummary, ghAuth, repoSlug, setSecret, secretNames, setVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };
+export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, ghAuth, repoSlug, setSecret, secretNames, setVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };

package/dist/{index-mb1p1rh0.js → index-g0p3kk0f.js}

@@ -1,7 +1,9 @@
 import {
+  MANIFEST_OWNED_ENV,
   PRIVATE_KEY_VAR,
   SECRETS_FILE,
   allEnvKeys,
+  apiToken,
   declaredSecretNames,
   decryptSecrets,
   plaintextSecretNames,
@@ -9,7 +11,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-vhsq8jpy.js";
+} from "./index-a279r74m.js";
 import {
   MANIFEST_FILE,
   has,
@@ -22,10 +24,10 @@ import {
   workerHosts,
   writeManifest,
   zone
-} from "./index-tjy6yygc.js";
+} from "./index-ym88atwf.js";
 import {
   CHOICES
-} from "./index-mnb7fz2t.js";
+} from "./index-7xwcv2cj.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -1370,7 +1372,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.10.0",
+  version: "0.12.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1884,6 +1886,8 @@ Create the token at **My Profile → API Tokens → Create Token → Custom toke
 | Account | Workers R2 Storage: Edit | product images |
 | Account | Account Settings: Read | confirming which account |
 | Zone | Workers Routes: Edit (${zone2}) | answering on your domain |
+| Zone | Zone: Read (${zone2}) | confirming the zone is on this account |
+| Zone | DNS: Read (${zone2}) | noticing a hostname that already answers |
 | User | User Details: Read, Memberships: Read | wrangler asks at startup |
 
 The token Cloudflare generates for its own Workers Builds will **not** do: it
@@ -2344,6 +2348,8 @@ async function putEnv(root, file, rendered, result) {
     const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line2);
     if (!match)
       return line2;
+    if (MANIFEST_OWNED_ENV.has(match[1]))
+      return line2;
     const had = existing.get(match[1]);
     return had !== undefined && had !== "" && had !== "unset" ? `${match[1]}=${had}` : line2;
   }).join(`
@@ -3077,10 +3083,84 @@ ${color3.red("NOT ready to go live.")}
 // src/deploy/cloudflare.ts
 import { copyFileSync, existsSync as existsSync8, mkdirSync, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync } from "node:fs";
 import { dirname as dirname5, join as join8 } from "node:path";
+import color5 from "picocolors";
+
+// src/deploy/zone.ts
 import color4 from "picocolors";
+async function cf(token, path) {
+  try {
+    const response = await fetch(`https://api.cloudflare.com/client/v4${path}`, {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    const body = await response.json();
+    if (!body.success) {
+      const first = body.errors?.[0];
+      return { ok: false, error: first?.message ? `${first.message}${first.code ? ` (${first.code})` : ""}` : `HTTP ${response.status}` };
+    }
+    return { ok: true, result: body.result };
+  } catch (error) {
+    return { ok: false, error: `could not reach the Cloudflare API: ${String(error)}` };
+  }
+}
+async function checkSameZone(token, zone2, hostname, accountId) {
+  const problems = [];
+  const notes = [];
+  const zones = await cf(token, `/zones?name=${encodeURIComponent(zone2)}`);
+  if (!zones.ok) {
+    return {
+      ok: true,
+      problems: [],
+      notes: [`the zone could not be checked: ${zones.error}. Add ${color4.cyan("Zone → Zone: Read")} to the API token to have this verified.`]
+    };
+  }
+  const found = zones.result.find((entry) => entry.name.toLowerCase() === zone2.toLowerCase());
+  if (!found) {
+    problems.push(`the zone ${color4.bold(zone2)} is not on this Cloudflare account.
+` + `    A Worker custom domain is a record Cloudflare writes in its own zone, so a
+` + `    domain hosted anywhere else cannot have one. Move the zone to this account,
+` + "    or point the shop at a domain that is already on it.");
+    return { ok: false, problems, notes };
+  }
+  if (accountId && found.account?.id && found.account.id !== accountId) {
+    problems.push(`${color4.bold(zone2)} is on Cloudflare, but under a different account (${found.account.name ?? found.account.id})
+` + "    than the one this worker deploys to. The custom domain would be refused.");
+    return { ok: false, problems, notes };
+  }
+  if (found.status !== "active") {
+    notes.push(`${zone2} is on this account but its status is "${found.status}" — a custom domain needs an active zone.`);
+  }
+  const records = await cf(token, `/zones/${found.id}/dns_records?name.exact=${encodeURIComponent(hostname)}`);
+  if (!records.ok) {
+    notes.push(`existing records for ${hostname} could not be listed: ${records.error}. Add ${color4.cyan("Zone → DNS: Read")} to have this checked.`);
+    return { ok: problems.length === 0, problems, notes };
+  }
+  const foreign = records.result.filter((record) => !(record.proxied && (record.content === "100::" || record.content === "192.0.2.1")));
+  if (foreign.length > 0) {
+    problems.push(`${color4.bold(hostname)} already has ${foreign.length} DNS record${foreign.length === 1 ? "" : "s"}:
+` + foreign.map((record) => `      ${record.type.padEnd(6)} ${record.content}`).join(`
+`) + `
+` + `    Deploying would take the hostname over. Wrangler asks about this at a
+` + `    terminal, but in CI it is not a prompt — it overrides the record silently.
+` + "    Delete them first if the hostname really is meant to be this shop's.");
+  }
+  return { ok: problems.length === 0, problems, notes };
+}
+function printZoneCheck(check, zone2) {
+  for (const note of check.notes)
+    console.log(`${color4.yellow("!")} ${note}`);
+  if (check.ok) {
+    if (check.notes.length === 0)
+      console.log(`${color4.green("✓")} ${zone2} is on this Cloudflare account, and the hostname is free`);
+    return;
+  }
+  for (const problem of check.problems)
+    console.error(`${color4.red("✗")} ${problem}`);
+}
+
+// src/deploy/cloudflare.ts
 var fail = (message) => {
   console.error(`
-${color4.red("✗")} ${message}
+${color5.red("✗")} ${message}
 `);
   return 1;
 };
@@ -3120,7 +3200,7 @@ async function deployCloudflare(project, opts) {
 ${who.raw.trim().split(`
 `).slice(-4).join(`
 `)}`);
-  console.log(`${color4.green("✓")} wrangler is logged in`);
+  console.log(`${color5.green("✓")} wrangler is logged in`);
   let config = readConfig(configPath);
   let accountId = config.account_id || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
   if (!accountId) {
@@ -3129,19 +3209,32 @@ ${who.raw.trim().split(`
       writeFileSync(configPath, upsertJsonc(readFileSync3(configPath, "utf8"), "account_id", accountId));
       project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId };
       await writeManifest(project.root, project.manifest);
-      console.log(`${color4.green("✓")} pinned the account "${who.accounts[0].name}" in wrangler.jsonc`);
+      console.log(`${color5.green("✓")} pinned the account "${who.accounts[0].name}" in wrangler.jsonc`);
     } else {
       return fail(`the account is not pinned and wrangler sees ${who.accounts.length}. Set account_id in wrangler.jsonc to one of:
 ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
 `)}`);
     }
   }
+  if (has(project.manifest, "cloudflare-samezone")) {
+    const token = apiToken();
+    if (token) {
+      const shopZone = zone(project.manifest);
+      const check2 = await checkSameZone(token, shopZone, workerHosts(project.manifest)[0], accountId);
+      printZoneCheck(check2, shopZone);
+      if (!check2.ok && !opts.force) {
+        return fail("the zone is not ready for this shop. Fix the above, or pass --force to deploy anyway.");
+      }
+    } else {
+      console.log(color5.dim("! CLOUDFLARE_API_TOKEN is not set here, so the zone could not be checked."));
+    }
+  }
   const check = await preflight(project, "wrangler");
   printPreflight(project, check, "wrangler");
   if (!check.ready) {
     if (!opts.force)
       return fail("refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force for a deliberate partial deploy.");
-    console.error(color4.yellow(`--force: deploying a shop that is NOT ready for customers.
+    console.error(color5.yellow(`--force: deploying a shop that is NOT ready for customers.
 `));
   }
   const worker = config.name || project.manifest.shop.domain.split(".")[0];
@@ -3155,12 +3248,12 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
     writeFileSync(configPath, upsertJsonc(readFileSync3(configPath, "utf8"), "d1_databases", [entry]));
     project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId, d1: { name: db.name, id: db.uuid } };
     await writeManifest(project.root, project.manifest);
-    console.log(`${color4.green("✓")} D1 "${db.name}" recorded in wrangler.jsonc and voidcommerce.json`);
+    console.log(`${color5.green("✓")} D1 "${db.name}" recorded in wrangler.jsonc and voidcommerce.json`);
     config = readConfig(configPath);
   }
   if (opts.provision) {
     await ensureQueue(bin, app, "commerce");
-    console.log(`${color4.green("✓")} queue "commerce"`);
+    console.log(`${color5.green("✓")} queue "commerce"`);
   }
   const builder = findBuilder(app);
   if (!builder)
@@ -3168,13 +3261,13 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const merging = oneOrigin(project.manifest.layout) && !isSingleApp(project.manifest.layout);
   if (merging) {
     console.log(`
-▸ ${builder.label} ${color4.dim("(the storefront)")}`);
+▸ ${builder.label} ${color5.dim("(the storefront)")}`);
     const storefront = await wrangler(builder.cmd, ["build"], project.root, true);
     if (storefront.code !== 0)
       return fail(`the storefront build failed (exit ${storefront.code}).`);
   }
   console.log(`
-▸ ${builder.label}${merging ? color4.dim(" (the worker)") : ""}`);
+▸ ${builder.label}${merging ? color5.dim(" (the worker)") : ""}`);
   const built = await wrangler(builder.cmd, ["build"], app, true);
   if (built.code !== 0)
     return fail(`the build failed (exit ${built.code}).`);
@@ -3189,7 +3282,7 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
     if (!existsSync8(join8(into, "index.html"))) {
       return fail("the storefront produced no index.html, so the shop has no front page.");
     }
-    console.log(`${color4.green("✓")} folded ${merged} storefront file${merged === 1 ? "" : "s"} into the worker's assets`);
+    console.log(`${color5.green("✓")} folded ${merged} storefront file${merged === 1 ? "" : "s"} into the worker's assets`);
   }
   const emittedPath = join8(app, "dist", "ssr", "wrangler.json");
   if (!existsSync8(emittedPath))
@@ -3207,7 +3300,7 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   if (!emittedD1 || emittedD1.database_id === "local")
     return fail("the emitted config still carries a placeholder D1 id; wrangler.jsonc's DB binding was not picked up by the build.");
   writeFileSync(emittedPath, JSON.stringify(emitted, null, 2));
-  console.log(`${color4.green("✓")} scrubbed ${scrubbed.length} baked value${scrubbed.length === 1 ? "" : "s"} from the worker's vars${scrubbed.length ? `: ${scrubbed.join(", ")}` : ""}`);
+  console.log(`${color5.green("✓")} scrubbed ${scrubbed.length} baked value${scrubbed.length === 1 ? "" : "s"} from the worker's vars${scrubbed.length ? `: ${scrubbed.join(", ")}` : ""}`);
   console.log(`
 ▸ wrangler d1 migrations apply ${emittedD1.database_name} --remote`);
   const migrated = await wrangler(bin, ["d1", "migrations", "apply", emittedD1.database_name, "--remote"], app, true);
@@ -3221,7 +3314,7 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
       return fail(`the repository's secrets could not be read: ${decrypted.error}`);
     secretArgs.push("--secrets-file", decrypted.path);
     cleanupSecrets = decrypted.cleanup;
-    console.log(`${color4.green("✓")} ${decrypted.names.length} secrets from ${SECRETS_FILE}, uploaded with this version`);
+    console.log(`${color5.green("✓")} ${decrypted.names.length} secrets from ${SECRETS_FILE}, uploaded with this version`);
   }
   console.log(`
 ▸ wrangler deploy -c dist/ssr/wrangler.json`);
@@ -3232,9 +3325,9 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const domain = project.manifest.shop.domain;
   const url = `https://${workerHosts(project.manifest)[0]}`;
   console.log(`
-${color4.green("Live:")} ${url}`);
+${color5.green("Live:")} ${url}`);
   if (hasFrontend(project.manifest.layout) && !oneOrigin(project.manifest.layout)) {
-    console.log(color4.dim("The storefront deploys itself from GitHub Actions on push."));
+    console.log(color5.dim("The storefront deploys itself from GitHub Actions on push."));
   }
   return 0;
 }
@@ -3260,7 +3353,7 @@ function mergeTree(from, into, skip) {
 import { readFile as readFile3 } from "node:fs/promises";
 import { existsSync as existsSync9 } from "node:fs";
 import { join as join9 } from "node:path";
-import color5 from "picocolors";
+import color6 from "picocolors";
 function describe(counts) {
   if (!counts)
     return "";
@@ -3327,25 +3420,25 @@ async function importCommand(args) {
   }
   const { url, how } = resolveTarget(project, args);
   if (!dry)
-    console.log(`${color5.dim("→")} ${url} ${color5.dim(`(${how})`)}
+    console.log(`${color6.dim("→")} ${url} ${color6.dim(`(${how})`)}
 `);
   if (!dry) {
     let whoami2;
     try {
       whoami2 = await fetch(`${url}/api/auth/system/whoami`, { headers: { "x-system-key": key } });
     } catch (error) {
-      console.error(`${color5.red("✗")} could not reach ${url}: ${error instanceof Error ? error.message : String(error)}
+      console.error(`${color6.red("✗")} could not reach ${url}: ${error instanceof Error ? error.message : String(error)}
 ` + `  Is the shop running? \`vc dev\` serves it locally; --local points here.
 `);
       return 1;
     }
     if (!whoami2.ok) {
-      console.error(`${color5.red("✗")} the shop refused the system key (HTTP ${whoami2.status}).
+      console.error(`${color6.red("✗")} the shop refused the system key (HTTP ${whoami2.status}).
 ` + `  Is SYSTEM_API_KEY the one this deployment was given?
 `);
       return 1;
     }
-    console.log(`${color5.green("✓")} authenticated as the system identity`);
+    console.log(`${color6.green("✓")} authenticated as the system identity`);
   }
   const root = project.root;
   const products = await readJson(join9(root, "data", "catalog.json"));
@@ -3354,14 +3447,14 @@ async function importCommand(args) {
   const posts = has(project.manifest, "blogs") ? await readJson(join9(root, "content", "posts.json")) : null;
   if (!products && !faqs?.length && !posts?.length) {
     console.log(`
-${color5.yellow("Nothing to import.")} data/catalog.json is absent and the content files are empty.
+${color6.yellow("Nothing to import.")} data/catalog.json is absent and the content files are empty.
 ` + `Products go in data/catalog.json as a JSON array; \`vc import --dry-run\` checks it without pushing.
 `);
     return 0;
   }
   if (dry) {
     console.log(`
-${color5.dim("--dry-run: nothing was pushed.")}`);
+${color6.dim("--dry-run: nothing was pushed.")}`);
     console.log(`  ${products?.length ?? 0} products, ${categories?.length ?? 0} categories`);
     console.log(`  ${faqs?.length ?? 0} FAQ entries, ${posts?.length ?? 0} posts
 `);
@@ -3377,15 +3470,15 @@ ${color5.dim("--dry-run: nothing was pushed.")}`);
     });
     if (result.ok) {
       const report = result.body.report ?? {};
-      console.log(`${color5.green("✓")} products:   ${describe(report.products)}`);
+      console.log(`${color6.green("✓")} products:   ${describe(report.products)}`);
       if (report.categories)
-        console.log(`${color5.green("✓")} categories: ${describe(report.categories)}`);
+        console.log(`${color6.green("✓")} categories: ${describe(report.categories)}`);
       if (report.prices)
-        console.log(`${color5.green("✓")} prices:     ${describe(report.prices)}`);
+        console.log(`${color6.green("✓")} prices:     ${describe(report.prices)}`);
       if (report.addons)
-        console.log(`${color5.green("✓")} addons:     ${describe(report.addons)}`);
+        console.log(`${color6.green("✓")} addons:     ${describe(report.addons)}`);
     } else {
-      console.error(`${color5.red("✗")} catalogue: ${result.body.error ?? `HTTP ${result.status}`}`);
+      console.error(`${color6.red("✗")} catalogue: ${result.body.error ?? `HTTP ${result.status}`}`);
       failed = true;
     }
   }
@@ -3397,20 +3490,20 @@ ${color5.dim("--dry-run: nothing was pushed.")}`);
       continue;
     const result = await post(`${url}${path}`, key, { entries: rows, posts: rows });
     if (result.ok) {
-      console.log(`${color5.green("✓")} ${label}: ${describe(result.body)}`);
+      console.log(`${color6.green("✓")} ${label}: ${describe(result.body)}`);
     } else {
-      console.error(`${color5.red("✗")} ${label}: ${result.body.error ?? `HTTP ${result.status}`}`);
+      console.error(`${color6.red("✗")} ${label}: ${result.body.error ?? `HTTP ${result.status}`}`);
       failed = true;
     }
   }
   if (failed) {
     console.error(`
-${color5.red("Some of it did not land.")} The import is an upsert, so fixing the cause and running it again is safe.
+${color6.red("Some of it did not land.")} The import is an upsert, so fixing the cause and running it again is safe.
 `);
     return 1;
   }
   console.log(`
-${color5.green("Imported.")} It is an upsert, so running it again costs one pass and changes nothing.
+${color6.green("Imported.")} It is an upsert, so running it again costs one pass and changes nothing.
 `);
   return 0;
 }

package/dist/{index-tjy6yygc.js → index-ym88atwf.js}

@@ -1,7 +1,7 @@
 import {
   CHOICES,
   GROUPS
-} from "./index-mnb7fz2t.js";
+} from "./index-7xwcv2cj.js";
 
 // src/manifest.ts
 import { readFile, writeFile } from "node:fs/promises";

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-mb1p1rh0.js";
+} from "./index-g0p3kk0f.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-vhsq8jpy.js";
+} from "./index-a279r74m.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -81,7 +81,7 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-tjy6yygc.js";
+} from "./index-ym88atwf.js";
 import {
   AUTH_PLUGINS,
   CARRIERS,
@@ -98,7 +98,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-mnb7fz2t.js";
+} from "./index-7xwcv2cj.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/dist/{keys-2q3qzntw.js → keys-px5maaj1.js}

@@ -8,9 +8,9 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-vhsq8jpy.js";
-import"./index-tjy6yygc.js";
-import"./index-mnb7fz2t.js";
+} from "./index-a279r74m.js";
+import"./index-ym88atwf.js";
+import"./index-7xwcv2cj.js";
 import"./index-0v6na3yp.js";
 export {
   publicKeyFor,

package/dist/manifest.js

@@ -18,8 +18,8 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-tjy6yygc.js";
-import"./index-mnb7fz2t.js";
+} from "./index-ym88atwf.js";
+import"./index-7xwcv2cj.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/catalog.ts

@@ -605,15 +605,20 @@ export const EMAIL: Group = {
 export const DNS: Group = {
 	id: "dns",
 	title: "DNS",
-	intro: "So the deploy writes the zone's records, not a person in a registrar's UI. The worker's own hostname is a Cloudflare custom domain and needs no record here; the mail sender's do.",
+	intro: "Where the shop's domain lives, and whether the deploy may touch it. The worker's own hostname is a Cloudflare custom domain and needs no record here — Cloudflare writes that one itself.",
 	kind: "select",
 	choices: [
+		{
+			id: "cloudflare-samezone",
+			label: "Cloudflare, same account",
+			hint: "the zone is on the same Cloudflare account as the worker — the deploy checks that before it changes anything, and needs no extra credential",
+			recommended: true,
+		},
 		{
 			id: "cloudflare",
-			label: "Cloudflare",
-			hint: "the zone the shop's domain is in — the deploy writes the mail records so confirmations are not spam",
+			label: "Cloudflare, another account or a second zone",
+			hint: "a separate DNS token, for a zone the worker's own token cannot see — the deploy writes the mail records so confirmations are not spam",
 			packages: ["@saastemly/better-dns"],
-			recommended: true,
 			env: [
 				{ key: "CLOUDFLARE_DNS_TOKEN", breaks: "the storefront records are never written; the domain does not reach the shop", where: "a token with Zone:DNS:Edit and Zone:Zone:Read" },
 			],

package/src/deploy/cloudflare.ts

@@ -2,10 +2,12 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFi
 import { dirname, join } from "node:path";
 import color from "picocolors";
 import { allEnvKeys } from "../generate/env";
-import { hasFrontend, isSingleApp, oneOrigin, workerHosts, writeManifest } from "../manifest";
+import { has, hasFrontend, isSingleApp, oneOrigin, workerHosts, writeManifest, zone } from "../manifest";
 import type { Project } from "../project";
 import { parseJsonc, upsertJsonc } from "./jsonc";
+import { apiToken } from "./github";
 import { preflight, printPreflight } from "./preflight";
+import { checkSameZone, printZoneCheck } from "./zone";
 import { SECRETS_FILE, decryptSecrets } from "./secrets";
 import { ensureD1, ensureQueue, findWrangler, whoami, wrangler } from "./wrangler";
 
@@ -99,6 +101,23 @@ export async function deployCloudflare(project: Project, opts: CloudflareOptions
 		}
 	}
 
+	// 1b. Same zone. Before anything is created, because the answer decides
+	// whether the hostname can work at all — and because a conflicting record
+	// would be taken over silently by the deploy below.
+	if (has(project.manifest, "cloudflare-samezone")) {
+		const token = apiToken();
+		if (token) {
+			const shopZone = zone(project.manifest);
+			const check = await checkSameZone(token, shopZone, workerHosts(project.manifest)[0]!, accountId);
+			printZoneCheck(check, shopZone);
+			if (!check.ok && !opts.force) {
+				return fail("the zone is not ready for this shop. Fix the above, or pass --force to deploy anyway.");
+			}
+		} else {
+			console.log(color.dim("! CLOUDFLARE_API_TOKEN is not set here, so the zone could not be checked."));
+		}
+	}
+
 	// 2. preflight.
 	const check = await preflight(project, "wrangler");
 	printPreflight(project, check, "wrangler");

package/src/deploy/github.ts

@@ -35,6 +35,11 @@ import { existsSync } from "node:fs";
  * @see https://github.com/cloudflare/workers-sdk/discussions/11434
  */
 
+/** The Cloudflare token, from wherever wrangler itself would read it. */
+export function apiToken(): string | null {
+	return process.env["CLOUDFLARE_API_TOKEN"] || process.env["CF_API_TOKEN"] || null;
+}
+
 export interface GhAuth {
 	/** Logged in, with a token that can write repository secrets. */
 	ok: boolean;

package/src/deploy/link.ts

@@ -50,6 +50,8 @@ const SCOPES: Array<[string, string]> = [
 	["Account · Workers R2 Storage: Edit", "product images"],
 	["Account · Account Settings: Read", "confirm which account this is"],
 	["Zone · Workers Routes: Edit", "answer on your domain"],
+	["Zone · Zone: Read", "confirm the domain's zone is on this account"],
+	["Zone · DNS: Read", "notice a hostname that already answers, before taking it over"],
 	["User · User Details: Read", "wrangler asks at startup"],
 ];
 

package/src/deploy/zone.ts

@@ -0,0 +1,147 @@
+import color from "picocolors";
+
+/**
+ * "Same zone": the shop's DNS zone is on the SAME Cloudflare account as the
+ * worker — and checking that it really is.
+ *
+ * ── Why this is worth a check rather than a sentence ─────────────────────
+ *
+ * Everything about the deploy rests on it. A Worker custom domain is a
+ * record Cloudflare writes in its own zone, so it works only when the zone
+ * is on the account the token belongs to. Cloudflare's own words: *"You
+ * cannot create a Custom Domain on a hostname with an existing CNAME DNS
+ * record or on a zone you do not own."* Until now that was a line in
+ * DEPLOY.md and nothing verified it, so getting it wrong surfaced as a
+ * wrangler error in the middle of a deploy that had already created a
+ * database.
+ *
+ * ── And the failure that is worse than an error ──────────────────────────
+ *
+ * Wrangler resolves a conflicting hostname interactively — it asks whether
+ * to move the record onto this script. In CI there is nobody to ask, and it
+ * does not fail: its own source sets
+ *
+ *     override_existing_origin = true
+ *     override_existing_dns_record = true
+ *
+ * whenever stdout is not a TTY. So a hostname already serving something
+ * else — another worker, a real site — is taken over silently, by a push.
+ * That is not a thing to discover afterwards, so this refuses first.
+ *
+ * ── What it deliberately does not do ─────────────────────────────────────
+ *
+ * It writes nothing. `cloudflare-samezone` needs no DNS records and no
+ * second credential: the worker's hostname is a custom domain Cloudflare
+ * creates itself, the storefront rides in that same worker, and Cloudflare
+ * Email writes its own SPF, DKIM and DMARC when the domain is onboarded.
+ * The value here is the precondition, not the plumbing.
+ */
+
+export interface ZoneCheck {
+	ok: boolean;
+	/** What to tell the operator. Empty when everything is as it should be. */
+	problems: string[];
+	notes: string[];
+}
+
+interface CfZone {
+	id: string;
+	name: string;
+	status: string;
+	account?: { id?: string; name?: string };
+}
+
+async function cf<T>(token: string, path: string): Promise<{ ok: true; result: T } | { ok: false; error: string }> {
+	try {
+		const response = await fetch(`https://api.cloudflare.com/client/v4${path}`, {
+			headers: { Authorization: `Bearer ${token}` },
+		});
+		const body = (await response.json()) as { success?: boolean; result?: T; errors?: Array<{ message?: string; code?: number }> };
+		if (!body.success) {
+			const first = body.errors?.[0];
+			return { ok: false, error: first?.message ? `${first.message}${first.code ? ` (${first.code})` : ""}` : `HTTP ${response.status}` };
+		}
+		return { ok: true, result: body.result as T };
+	} catch (error) {
+		return { ok: false, error: `could not reach the Cloudflare API: ${String(error)}` };
+	}
+}
+
+/**
+ * Is `zone` on this account, and is `hostname` free to become a custom domain?
+ *
+ * `accountId` is optional: without it any zone the token can see counts,
+ * which is the right answer for a token scoped to one account anyway.
+ */
+export async function checkSameZone(token: string, zone: string, hostname: string, accountId?: string): Promise<ZoneCheck> {
+	const problems: string[] = [];
+	const notes: string[] = [];
+
+	const zones = await cf<CfZone[]>(token, `/zones?name=${encodeURIComponent(zone)}`);
+	if (!zones.ok) {
+		// A token without Zone:Read cannot answer the question. That is a gap
+		// in the check, not a failed shop, so it is reported and not fatal.
+		return {
+			ok: true,
+			problems: [],
+			notes: [`the zone could not be checked: ${zones.error}. Add ${color.cyan("Zone → Zone: Read")} to the API token to have this verified.`],
+		};
+	}
+
+	const found = zones.result.find((entry) => entry.name.toLowerCase() === zone.toLowerCase());
+	if (!found) {
+		problems.push(
+			`the zone ${color.bold(zone)} is not on this Cloudflare account.\n` +
+				"    A Worker custom domain is a record Cloudflare writes in its own zone, so a\n" +
+				"    domain hosted anywhere else cannot have one. Move the zone to this account,\n" +
+				"    or point the shop at a domain that is already on it.",
+		);
+		return { ok: false, problems, notes };
+	}
+	if (accountId && found.account?.id && found.account.id !== accountId) {
+		problems.push(
+			`${color.bold(zone)} is on Cloudflare, but under a different account (${found.account.name ?? found.account.id})\n` +
+				"    than the one this worker deploys to. The custom domain would be refused.",
+		);
+		return { ok: false, problems, notes };
+	}
+	if (found.status !== "active") {
+		notes.push(`${zone} is on this account but its status is "${found.status}" — a custom domain needs an active zone.`);
+	}
+
+	// The silent-takeover check. A record already answering for this hostname
+	// is somebody's, and in CI wrangler would move it without asking.
+	const records = await cf<Array<{ id: string; type: string; name: string; content: string; proxied?: boolean }>>(
+		token,
+		`/zones/${found.id}/dns_records?name.exact=${encodeURIComponent(hostname)}`,
+	);
+	if (!records.ok) {
+		notes.push(`existing records for ${hostname} could not be listed: ${records.error}. Add ${color.cyan("Zone → DNS: Read")} to have this checked.`);
+		return { ok: problems.length === 0, problems, notes };
+	}
+	// A Worker custom domain shows up as a proxied AAAA/A at 100:: — that is
+	// this shop's own record from a previous deploy, not a conflict.
+	const foreign = records.result.filter((record) => !(record.proxied && (record.content === "100::" || record.content === "192.0.2.1")));
+	if (foreign.length > 0) {
+		problems.push(
+			`${color.bold(hostname)} already has ${foreign.length} DNS record${foreign.length === 1 ? "" : "s"}:\n` +
+				foreign.map((record) => `      ${record.type.padEnd(6)} ${record.content}`).join("\n") +
+				"\n" +
+				"    Deploying would take the hostname over. Wrangler asks about this at a\n" +
+				"    terminal, but in CI it is not a prompt — it overrides the record silently.\n" +
+				"    Delete them first if the hostname really is meant to be this shop's.",
+		);
+	}
+
+	return { ok: problems.length === 0, problems, notes };
+}
+
+/** Print a check, in the shape the rest of the deploy uses. */
+export function printZoneCheck(check: ZoneCheck, zone: string): void {
+	for (const note of check.notes) console.log(`${color.yellow("!")} ${note}`);
+	if (check.ok) {
+		if (check.notes.length === 0) console.log(`${color.green("✓")} ${zone} is on this Cloudflare account, and the hostname is free`);
+		return;
+	}
+	for (const problem of check.problems) console.error(`${color.red("✗")} ${problem}`);
+}

package/src/generate/ci.ts

@@ -225,6 +225,8 @@ Create the token at **My Profile → API Tokens → Create Token → Custom toke
 | Account | Workers R2 Storage: Edit | product images |
 | Account | Account Settings: Read | confirming which account |
 | Zone | Workers Routes: Edit (${zone}) | answering on your domain |
+| Zone | Zone: Read (${zone}) | confirming the zone is on this account |
+| Zone | DNS: Read (${zone}) | noticing a hostname that already answers |
 | User | User Details: Read, Memberships: Read | wrangler asks at startup |
 
 The token Cloudflare generates for its own Workers Builds will **not** do: it

package/src/generate/env.ts

@@ -105,6 +105,17 @@ export function renderEnvExample(manifest: Manifest): string {
 	].join("\n");
 }
 
+/**
+ * Keys whose value is the MANIFEST'S to decide, not the operator's.
+ *
+ * These are the shop's identity. Preserving whatever was already on disk is
+ * right for a credential and wrong for these: a shop copied from another one
+ * kept `SHOP_DOMAIN=tshirt.test` and an EMAIL_FROM at the wrong domain, which
+ * is how a storefront ends up quietly addressing the wrong business. If you
+ * want a different domain, change the manifest — that is what it is for.
+ */
+export const MANIFEST_OWNED_ENV = new Set(["SHOP_DOMAIN", "SHOP_ZONE", "EMAIL_FROM", "GITHUB_PAGES_HOST"]);
+
 export function renderEnvLocal(manifest: Manifest): string {
 	const keys = allEnvKeys(manifest);
 	const local: Record<string, string> = {

package/src/generate/index.ts

@@ -8,6 +8,7 @@ import {
 	envSummary,
 	renderEnvExample,
 	renderEnvLocal,
+	MANIFEST_OWNED_ENV,
 	renderEnvProduction,
 	renderEnvTs,
 } from "./env";
@@ -128,6 +129,9 @@ async function putEnv(root: string, file: string, rendered: string, result: Gene
 		.map((line) => {
 			const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
 			if (!match) return line;
+			// The shop's identity is the manifest's to decide; a value carried
+			// over from a shop this one was copied from is not a preference.
+			if (MANIFEST_OWNED_ENV.has(match[1]!)) return line;
 			const had = existing.get(match[1]!);
 			// A real value the operator set beats the template's placeholder.
 			// `unset` and empty are placeholders, not answers.