@saastemly/voidcommerce 0.17.0 → 0.18.0

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-4jz1448c.js";
+} from "./index-3j6jtjmk.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -32,6 +32,7 @@ import {
   declaredSecretNames,
   encryptInto,
   envSummary,
+  findGh,
   getVariable,
   ghAuth,
   ignoresKeyFile,
@@ -45,13 +46,14 @@ import {
   publicKeyFor,
   repoSlug,
   run,
+  run1 as run2,
   secretNames,
   secretsCommand,
   setSecret,
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-negctpws.js";
+} from "./index-khzk6a9z.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -68,9 +70,9 @@ import {
 } from "./index-0v6na3yp.js";
 
 // src/deploy/index.ts
-import color2 from "picocolors";
-import { existsSync } from "node:fs";
-import { join as join2 } from "node:path";
+import color3 from "picocolors";
+import { existsSync as existsSync2 } from "node:fs";
+import { join as join3 } from "node:path";
 
 // src/deploy/link.ts
 import { rmSync } from "node:fs";
@@ -224,6 +226,106 @@ async function linkCommand(project, args) {
   return 0;
 }
 
+// src/deploy/publish.ts
+import { existsSync } from "node:fs";
+import { join as join2 } from "node:path";
+import color2 from "picocolors";
+async function publishCommand(project, args) {
+  const p = await import("@clack/prompts");
+  const root = project.root;
+  const gh = findGh();
+  p.intro(color2.bgCyan(color2.black(" vc publish ")));
+  const auth = await ghAuth(root);
+  if (!auth.ok || !gh) {
+    p.cancel(auth.reason ?? "the GitHub CLI is not installed. https://cli.github.com");
+    return 1;
+  }
+  if (!existsSync(join2(root, ".git"))) {
+    p.cancel(`${root} is not a git repository. \`git init\` first, and commit what you have.`);
+    return 1;
+  }
+  let slug = await repoSlug(root);
+  if (slug) {
+    p.log.info(`${slug} already exists — using it`);
+  } else {
+    const suggested = project.manifest.shop.domain.split(".")[0] ?? "shop";
+    const name = await p.text({
+      message: "Repository name",
+      initialValue: suggested,
+      validate: (value) => /^[A-Za-z0-9._-]+$/.test(value.trim()) ? undefined : "letters, digits, dot, dash or underscore"
+    });
+    if (p.isCancel(name)) {
+      p.cancel("nothing was created.");
+      return 1;
+    }
+    const visibility = await p.select({
+      message: "Visibility",
+      options: [
+        { value: "--private", label: "Private", hint: "the key that opens your secrets is readable to anyone with access" },
+        { value: "--public", label: "Public", hint: "only if this shop keeps no secrets at all" }
+      ],
+      initialValue: "--private"
+    });
+    if (p.isCancel(visibility)) {
+      p.cancel("nothing was created.");
+      return 1;
+    }
+    const spinner2 = p.spinner();
+    spinner2.start(`creating ${String(name)}`);
+    const created = await run(gh, ["repo", "create", String(name).trim(), "--source=.", String(visibility)], root);
+    if (created.code !== 0) {
+      spinner2.stop(`${color2.red("✗")} could not create it`);
+      p.cancel(created.out.trim().split(`
+`).slice(-2).join(" "));
+      return 1;
+    }
+    slug = await repoSlug(root);
+    spinner2.stop(`${color2.green("✓")} ${slug ?? String(name)} created, and set as origin`);
+  }
+  p.log.step("giving the repository what the deploy needs");
+  const linked = await linkCommand(project, args);
+  if (linked !== 0) {
+    p.cancel("the repository exists but is not configured, so a push would not deploy. Fix the above and run `vc publish` again.");
+    return 1;
+  }
+  const dirty = (await run("git", ["status", "--porcelain"], root)).out.trim();
+  if (dirty) {
+    const staged = await run("git", ["add", "-A"], root);
+    const committed = await run("git", ["commit", "-m", "vc publish: link this shop to its repository"], root);
+    if (staged.code !== 0 || committed.code !== 0) {
+      p.cancel(`could not commit the changes vc link made:
+${committed.out.trim().split(`
+`).slice(-3).join(`
+`)}`);
+      return 1;
+    }
+    p.log.success(`${color2.green("✓")} committed what linking changed`);
+  }
+  const branch = (await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], root)).out.trim() || "main";
+  const spinner = p.spinner();
+  spinner.start(`pushing ${branch}`);
+  const pushed = await run("git", ["push", "-u", "origin", `${branch}:main`], root);
+  if (pushed.code !== 0) {
+    spinner.stop(`${color2.red("✗")} the push failed`);
+    p.cancel(pushed.out.trim().split(`
+`).slice(-4).join(`
+`));
+    return 1;
+  }
+  spinner.stop(`${color2.green("✓")} pushed to main`);
+  p.outro([
+    `${color2.bold("Published.")} The deploy is running now.`,
+    "",
+    `  ${color2.cyan(`https://github.com/${slug}/actions`)}`,
+    "",
+    `  From here ${color2.cyan("git push")} is the whole loop. \`vc\` is only needed to`,
+    `  change a secret (${color2.cyan("vc secrets set KEY")}) or read one back`,
+    `  (${color2.cyan("vc keys --restore")}).`
+  ].join(`
+`));
+  return 0;
+}
+
 // src/deploy/index.ts
 async function deployCommand(args) {
   const own = new Set(["--cloudflare", "--provision", "--force"]);
@@ -247,12 +349,12 @@ async function deployCommand(args) {
   const check = await preflight(project, "void");
   printPreflight(project, check, "void");
   if (!check.ready && check.remote !== null && !args.includes("--force")) {
-    console.error(`${color2.red("✗")} refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force.
+    console.error(`${color3.red("✗")} refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force.
 `);
     return 1;
   }
   if (!check.ready && check.remote === null) {
-    console.log(color2.dim(`Secrets could not be verified here; void's own deploy gate is the next check.
+    console.log(color3.dim(`Secrets could not be verified here; void's own deploy gate is the next check.
 `));
   }
   return runVoid(["deploy", ...voids], project.appDir);
@@ -270,7 +372,7 @@ async function preflightCommand(args) {
     return result.ready ? 0 : 1;
   const pending = await uncommittedMigrations(project.root);
   if (pending.length > 0) {
-    console.error(`${color2.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:
+    console.error(`${color3.red("✗")} ${pending.length} migration file${pending.length === 1 ? " is" : "s are"} not committed:
 ` + `    ${pending.join(`
     `)}
 
@@ -282,7 +384,7 @@ async function preflightCommand(args) {
   return result.ready ? 0 : 1;
 }
 async function uncommittedMigrations(root) {
-  const status = await run("git", ["status", "--porcelain", "--", "migrations"], root);
+  const status = await run2("git", ["status", "--porcelain", "--", "migrations"], root);
   if (status.code !== 0)
     return [];
   return status.out.split(`
@@ -295,13 +397,13 @@ async function deployHelp() {
     line("vc's preflight — every required key set, the hostnames right — then", width),
     line("void deploy, untouched. Or, with --cloudflare, your own account via wrangler.", width),
     line("", width),
-    line(color2.bold("Usage"), width),
+    line(color3.bold("Usage"), width),
     ...row("vc deploy [void's flags]", "preflight, then void deploy — the Void platform, void's login", width, 2),
     ...row("vc deploy --cloudflare", "wrangler, your Cloudflare account, no Void login: preflight, build, scrub baked secrets, migrate D1, deploy", width, 2),
     ...row("vc deploy --cloudflare --provision", "first time: create the D1 database and the queue, record them", width, 2),
     ...row("vc deploy --cloudflare --force", "deploy a shop preflight says is not ready — deliberately", width, 2),
     line("", width),
-    line(color2.bold("Needs, for --cloudflare"), width),
+    line(color3.bold("Needs, for --cloudflare"), width),
     ...row("CLOUDFLARE_API_TOKEN", "in the environment; the account is pinned for you when there is one", width, 2),
     ...row(PRIVATE_KEY_VAR, "to decrypt the shop's own secrets", width, 2),
     line("", width),
@@ -397,9 +499,9 @@ async function guardCommand() {
   if (!project)
     return 0;
   const root = project.root;
-  if (existsSync(join2(root, LOCAL_KEY_FILE)) && !ignoresKeyFile(root)) {
+  if (existsSync2(join3(root, LOCAL_KEY_FILE)) && !ignoresKeyFile(root)) {
     console.error(`
-${color2.red("✗ refusing the commit")}: ${LOCAL_KEY_FILE} exists and is NOT gitignored.
+${color3.red("✗ refusing the commit")}: ${LOCAL_KEY_FILE} exists and is NOT gitignored.
 
 ` + `  It holds the private key that opens every secret in this repository.
 ` + `  Add ${LOCAL_KEY_FILE} to .gitignore before committing anything.
@@ -412,24 +514,24 @@ ${color2.red("✗ refusing the commit")}: ${LOCAL_KEY_FILE} exists and is NOT gi
   const publicKey = committedPublicKey(root);
   if (!publicKey) {
     console.error(`
-${color2.red("✗ refusing the commit")}: ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE} ${bare.length === 1 ? "is" : "are"} in the clear, and there is no key to encrypt ${bare.length === 1 ? "it" : "them"} with.
+${color3.red("✗ refusing the commit")}: ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE} ${bare.length === 1 ? "is" : "are"} in the clear, and there is no key to encrypt ${bare.length === 1 ? "it" : "them"} with.
 
 ` + `    ${bare.map((entry) => entry.name).join(`
     `)}
 
-` + `  ${color2.cyan("vc keys --init")}  makes one — no GitHub repository needed yet.
+` + `  ${color3.cyan("vc keys --init")}  makes one — no GitHub repository needed yet.
 
-` + color2.dim(`  Committing a secret in the clear cannot be undone by a later commit;
+` + color3.dim(`  Committing a secret in the clear cannot be undone by a later commit;
   the value stays in the history and must be treated as burned.
 `));
     return 1;
   }
-  const staged = (await run("git", ["diff", "--cached", "--name-only", "--", SECRETS_FILE], root)).out.trim().length > 0;
+  const staged = (await run2("git", ["diff", "--cached", "--name-only", "--", SECRETS_FILE], root)).out.trim().length > 0;
   for (const entry of bare) {
     const sealed = await encryptInto(root, publicKey, entry.name, entry.value);
     if (!sealed.ok) {
       console.error(`
-${color2.red("✗ refusing the commit")}: ${sealed.error}
+${color3.red("✗ refusing the commit")}: ${sealed.error}
 `);
       return 1;
     }
@@ -437,23 +539,23 @@ ${color2.red("✗ refusing the commit")}: ${sealed.error}
   const left = plaintextSecretNames(root);
   if (left.length > 0) {
     console.error(`
-${color2.red("✗ refusing the commit")}: ${left.join(", ")} could not be encrypted.
+${color3.red("✗ refusing the commit")}: ${left.join(", ")} could not be encrypted.
 `);
     return 1;
   }
   if (staged) {
-    const added = await run("git", ["add", "--", SECRETS_FILE], root);
+    const added = await run2("git", ["add", "--", SECRETS_FILE], root);
     if (added.code !== 0) {
       console.error(`
-${color2.red("✗ refusing the commit")}: ${SECRETS_FILE} was encrypted but could not be re-staged,
+${color3.red("✗ refusing the commit")}: ${SECRETS_FILE} was encrypted but could not be re-staged,
 ` + `  so the commit would still carry the plaintext you staged. \`git add ${SECRETS_FILE}\`.
 `);
       return 1;
     }
   }
   console.log(`
-${color2.green("✓")} encrypted ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE}${staged ? " and re-staged it" : ""}: ${bare.map((entry) => entry.name).join(", ")}
-` + color2.dim(`  Encryption needs only the public key, so this needs no credential.
+${color3.green("✓")} encrypted ${bare.length} value${bare.length === 1 ? "" : "s"} in ${SECRETS_FILE}${staged ? " and re-staged it" : ""}: ${bare.map((entry) => entry.name).join(", ")}
+` + color3.dim(`  Encryption needs only the public key, so this needs no credential.
 `));
   return 0;
 }
@@ -474,12 +576,12 @@ async function linkHelp() {
     ...row("vc link", "store the encryption key and the Cloudflare token on the repository", width, 2),
     ...row("vc link --force", "replace what is already there", width, 2),
     line("", width),
-    line(color2.bold("What it stores, and where"), width),
+    line(color3.bold("What it stores, and where"), width),
     ...row(PRIVATE_KEY_VAR, "a repository SECRET. A key already waiting locally is MOVED here and the local copy deleted", width, 2),
     ...row("CLOUDFLARE_API_TOKEN", "a repository SECRET, checked against the Cloudflare API before it is stored", width, 2),
     ...row("CLOUDFLARE_ACCOUNT_ID", "a repository VARIABLE — an identifier, not a credential", width, 2),
     line("", width),
-    line(color2.bold("Why one token still has to be typed"), width),
+    line(color3.bold("Why one token still has to be typed"), width),
     line("GitHub cannot mint a Cloudflare credential. There is no OIDC federation", width),
     line("between them, and the Cloudflare GitHub App runs the other way: it grants", width),
     line("Cloudflare access to your repository, not your repository access to", width),
@@ -487,16 +589,49 @@ async function linkHelp() {
   ], width));
   return 0;
 }
+async function publishCliCommand(args) {
+  const project = await findProject();
+  if (!project) {
+    console.error("vc: no voidcommerce.json here.");
+    return 1;
+  }
+  return publishCommand(project, args);
+}
+async function publishHelp() {
+  const width = 80;
+  console.log(box("vc publish", [
+    line("Create this shop's GitHub repository, give it what the deploy needs,", width),
+    line("and push. The push IS the deploy. Run once; after that, `git push`.", width),
+    line("", width),
+    ...row("vc publish", "create the repository, set the credentials, push main", width, 2),
+    line("", width),
+    line(color3.bold("What it does for you"), width),
+    ...row("the encryption key", "vc already holds it — set with no input from you", width, 2),
+    ...row("the account id", "read from voidcommerce.json", width, 2),
+    ...row("the Cloudflare token", "the one thing it has to ask for", width, 2),
+    line("", width),
+    line(color3.bold("Why the token cannot be automated away"), width),
+    line("There is no OIDC between GitHub and Cloudflare, so something must carry", width),
+    line("a token across, and only a person can fetch one from the dashboard. It", width),
+    line("is asked for once, checked against the Cloudflare API, and stored on the", width),
+    line("repository — never on this machine.", width),
+    line("", width),
+    line("The repository is created WITHOUT pushing, then configured, then pushed.", width),
+    line("Pushing first would start a deploy against a repository that has no key", width),
+    line("and no token: a red run, for no reason but the wrong order.", width)
+  ], width));
+  return 0;
+}
 
 // src/init.ts
 import * as p2 from "@clack/prompts";
 import { mkdir } from "node:fs/promises";
-import { basename, join as join3 } from "node:path";
-import color4 from "picocolors";
+import { basename, join as join4 } from "node:path";
+import color5 from "picocolors";
 
 // src/wizard.ts
 import * as p from "@clack/prompts";
-import color3 from "picocolors";
+import color4 from "picocolors";
 var bail = () => {
   p.cancel("Nothing was written.");
   process.exit(0);
@@ -518,8 +653,8 @@ async function askGroup(group2, previous, alsoRequired = []) {
   const required = group2.choices.filter((choice) => requiredIds.has(choice.id));
   const optional = group2.choices.filter((choice) => !requiredIds.has(choice.id));
   const message = group2.title + (group2.intro ? `
-${color3.dim(group2.intro)}` : "") + (required.length ? `
-${color3.dim(`Included: ${required.map((choice) => choice.label).join(", ")}`)}` : "");
+${color4.dim(group2.intro)}` : "") + (required.length ? `
+${color4.dim(`Included: ${required.map((choice) => choice.label).join(", ")}`)}` : "");
   if (optional.length === 0) {
     p.log.info(message);
     return required.map((choice) => choice.id);
@@ -550,7 +685,7 @@ async function runWizard(existing, layout) {
       validate: (value) => value.trim() ? undefined : "A shop has a name."
     }),
     domain: () => p.text({
-      message: `Domain ${color3.dim(monorepo ? "— the storefront; api.<domain> is the worker; the CORS list and DNS records derive from it" : "— the shop answers here; the worker's custom domain")}`,
+      message: `Domain ${color4.dim(monorepo ? "— the storefront; api.<domain> is the worker; the CORS list and DNS records derive from it" : "— the shop answers here; the worker's custom domain")}`,
       placeholder: "northwind.com",
       initialValue: existing?.shop.domain ?? "",
       validate: (value) => /^[a-z0-9-]+(\.[a-z0-9-]+)+\.[a-z]{2,}$|^[a-z0-9-]+\.[a-z]{2,}$/i.test(value.trim()) ? undefined : "A hostname, like northwind.com or shop.northwind.com."
@@ -561,7 +696,7 @@ async function runWizard(existing, layout) {
       if (!domain || domain === guess)
         return Promise.resolve(undefined);
       return p.text({
-        message: `DNS zone ${color3.dim(`— ${domain} lives inside it; records go here, and this zone must be on your DNS provider`)}`,
+        message: `DNS zone ${color4.dim(`— ${domain} lives inside it; records go here, and this zone must be on your DNS provider`)}`,
         placeholder: guess,
         initialValue: existing?.shop.zone ?? guess,
         validate: (value) => {
@@ -573,13 +708,13 @@ async function runWizard(existing, layout) {
       });
     },
     country: () => p.text({
-      message: `Country ${color3.dim("— sets the declared VAT rate and the default region")}`,
+      message: `Country ${color4.dim("— sets the declared VAT rate and the default region")}`,
       placeholder: "US",
       initialValue: existing?.shop.country ?? "",
       validate: (value) => /^[A-Za-z]{2}$/.test(value.trim()) ? undefined : "ISO-3166 alpha-2, like DK."
     }),
     taxRegistered: () => p.select({
-      message: `Registered to charge tax? ${color3.dim("— a business below its registration threshold must NOT add tax to a price, and one above it must")}`,
+      message: `Registered to charge tax? ${color4.dim("— a business below its registration threshold must NOT add tax to a price, and one above it must")}`,
       options: [
         { value: "no", label: "Not registered", hint: "prices are what the customer pays; no tax is added. The common case for a new shop" },
         { value: "yes", label: "Registered", hint: "the country's standard rate is declared and added" }
@@ -593,14 +728,14 @@ async function runWizard(existing, layout) {
       validate: (value) => /^[A-Za-z]{3}$/.test(value.trim()) ? undefined : "ISO-4217, like dkk."
     }),
     locale: () => p.text({
-      message: `Locale ${color3.dim("— the language of emails and launch content")}`,
+      message: `Locale ${color4.dim("— the language of emails and launch content")}`,
       placeholder: "en",
       initialValue: existing?.shop.locale ?? "",
       validate: (value) => /^[a-z]{2}(-[A-Z]{2})?$/.test(value.trim()) ? undefined : "like da, or en-GB."
     }),
     ...onPages ? {
       pagesHost: () => p.text({
-        message: `GitHub Pages host ${color3.dim("— where the storefront is published; leave blank if you serve the branch elsewhere")}`,
+        message: `GitHub Pages host ${color4.dim("— where the storefront is published; leave blank if you serve the branch elsewhere")}`,
         placeholder: "northwind.github.io",
         initialValue: existing?.shop.pagesHost ?? "",
         validate: (value) => !value.trim() || /^[a-z0-9-]+\.github\.io$/i.test(value.trim()) ? undefined : "<owner>.github.io, or blank"
@@ -611,7 +746,7 @@ async function runWizard(existing, layout) {
   for (const group2 of GROUPS) {
     if (group2.id === "ui" && layout === "strict") {
       p.log.info(`${group2.title}
-${color3.dim("The generated storefront and panel. Strict has no custom code to host anything else.")}`);
+${color4.dim("The generated storefront and panel. Strict has no custom code to host anything else.")}`);
       chosen[group2.id] = ["admin"];
       continue;
     }
@@ -636,14 +771,14 @@ ${color3.dim("The generated storefront and panel. Strict has no custom code to h
 }
 function summarise(manifest) {
   const lines = [
-    `${color3.dim("Layout".padEnd(34))} ${LAYOUTS.find((l) => l.id === manifest.layout)?.label ?? manifest.layout}`
+    `${color4.dim("Layout".padEnd(34))} ${LAYOUTS.find((l) => l.id === manifest.layout)?.label ?? manifest.layout}`
   ];
   for (const group2 of GROUPS) {
     const ids = manifest.chosen[group2.id] ?? [];
     if (ids.length === 0)
       continue;
     const labels = ids.map((id) => group2.choices.find((choice) => choice.id === id)?.label ?? id).join(", ");
-    lines.push(`${color3.dim(group2.title.padEnd(34))} ${labels}`);
+    lines.push(`${color4.dim(group2.title.padEnd(34))} ${labels}`);
   }
   return lines.join(`
 `);
@@ -684,10 +819,10 @@ async function init(args) {
   if (flags.voids.length > 0)
     return runVoid(["init", ...flags.voids]);
   let root = process.cwd();
-  p2.intro(color4.bgCyan(color4.black(" voidcommerce ")));
+  p2.intro(color5.bgCyan(color5.black(" voidcommerce ")));
   const existing = await readManifest(root);
   if (existing) {
-    p2.log.info(`Found ${color4.cyan("voidcommerce.json")} for ${color4.bold(existing.shop.name)} — answers are pre-filled; the layout (${existing.layout}) is fixed.`);
+    p2.log.info(`Found ${color5.cyan("voidcommerce.json")} for ${color5.bold(existing.shop.name)} — answers are pre-filled; the layout (${existing.layout}) is fixed.`);
     if (flags.layout && flags.layout !== existing.layout) {
       p2.log.error(`This shop is laid out as "${existing.layout}". The layout cannot change after init — moving files is not a regeneration.`);
       return 1;
@@ -695,10 +830,10 @@ async function init(args) {
   }
   const layout = existing?.layout ?? flags.layout ?? await askLayout();
   if (layout === "strict") {
-    p2.log.step(`Strict: the app will be generated under ${color4.cyan(".vc/app")} — nothing there is yours to edit.`);
+    p2.log.step(`Strict: the app will be generated under ${color5.cyan(".vc/app")} — nothing there is yours to edit.`);
   } else if (layout === "app") {
     if (!isVoidApp(root)) {
-      p2.log.step(`No Void app here yet — ${color4.cyan("void init")} first, then the shop.`);
+      p2.log.step(`No Void app here yet — ${color5.cyan("void init")} first, then the shop.`);
       const before = new Set(voidAppsIn(root));
       const code = await runVoid(["init"]);
       if (code !== 0)
@@ -711,7 +846,7 @@ async function init(args) {
         }
         root = created[0];
         process.chdir(root);
-        p2.log.step(`Continuing in ${color4.cyan(`${basename(root)}/`)}`);
+        p2.log.step(`Continuing in ${color5.cyan(`${basename(root)}/`)}`);
       }
     }
   } else {
@@ -720,11 +855,11 @@ async function init(args) {
       ["frontend", "the storefront — prerendered and served from the worker's own assets"]
     ];
     for (const [dir, starter] of parts) {
-      const target = join3(root, dir);
+      const target = join4(root, dir);
       if (isVoidApp(target))
         continue;
       await mkdir(target, { recursive: true });
-      p2.log.step(`${color4.cyan("void init")} in ${color4.cyan(`${dir}/`)} — choose ${starter}.`);
+      p2.log.step(`${color5.cyan("void init")} in ${color5.cyan(`${dir}/`)} — choose ${starter}.`);
       const code = await runVoid(["init"], target);
       if (code !== 0)
         return code;
@@ -742,7 +877,7 @@ async function init(args) {
   if (problems.length > 0) {
     p2.log.error("These answers contradict each other:");
     for (const problem of problems)
-      p2.log.message(`  ${color4.red("✗")} ${problem}`);
+      p2.log.message(`  ${color5.red("✗")} ${problem}`);
     p2.cancel("Nothing was written.");
     return 1;
   }
@@ -758,16 +893,16 @@ async function init(args) {
   spinner2.stop("Generated");
   const { secrets, plaintext } = envSummary(manifest);
   p2.note([
-    ...result.written.map((file) => `${color4.green("+")} ${file}`),
-    ...result.kept.map((file) => `${color4.dim("=")} ${file} ${color4.dim("(kept — yours)")}`),
-    ...result.retired.map((file) => `${color4.red("-")} ${file} ${color4.dim("(retired — no longer generated)")}`)
+    ...result.written.map((file) => `${color5.green("+")} ${file}`),
+    ...result.kept.map((file) => `${color5.dim("=")} ${file} ${color5.dim("(kept — yours)")}`),
+    ...result.retired.map((file) => `${color5.red("-")} ${file} ${color5.dim("(retired — no longer generated)")}`)
   ].join(`
 `), "Files");
   p2.note([
-    `${color4.bold(String(secrets.length))} secrets  ${color4.dim("→ wrangler secret put <NAME>")}`,
+    `${color5.bold(String(secrets.length))} secrets  ${color5.dim("→ wrangler secret put <NAME>")}`,
     ...secrets.map((key) => `  ${key}`),
     "",
-    `${color4.bold(String(plaintext.length))} plaintext ${color4.dim("→ .env.production, already written")}`,
+    `${color5.bold(String(plaintext.length))} plaintext ${color5.dim("→ .env.production, already written")}`,
     ...plaintext.map((key) => `  ${key}`)
   ].join(`
 `), "Before going live");
@@ -777,21 +912,21 @@ async function init(args) {
       return code;
   }
   const next = layout === "app" ? [
-    `  ${color4.cyan("bun install")}`,
-    `  ${color4.cyan("bun run maildev")}      ${color4.dim("local inbox at http://localhost:1080")}`,
-    `  ${color4.cyan("vc dev")}`,
-    `  ${color4.cyan("vc preflight")}        ${color4.dim("what is still missing, and why it matters")}`
+    `  ${color5.cyan("bun install")}`,
+    `  ${color5.cyan("bun run maildev")}      ${color5.dim("local inbox at http://localhost:1080")}`,
+    `  ${color5.cyan("vc dev")}`,
+    `  ${color5.cyan("vc preflight")}        ${color5.dim("what is still missing, and why it matters")}`
   ] : layout === "strict" ? [
-    `  ${color4.cyan("bun install")}`,
-    `  ${color4.cyan("vc generate")}         ${color4.dim("the app under .vc/app, void's artifacts, the migrations")}`,
-    `  ${color4.cyan("bun run maildev")}      ${color4.dim("local inbox at http://localhost:1080")}`,
-    `  ${color4.cyan("vc dev")}               ${color4.dim("runs in .vc/app")}`
+    `  ${color5.cyan("bun install")}`,
+    `  ${color5.cyan("vc generate")}         ${color5.dim("the app under .vc/app, void's artifacts, the migrations")}`,
+    `  ${color5.cyan("bun run maildev")}      ${color5.dim("local inbox at http://localhost:1080")}`,
+    `  ${color5.cyan("vc dev")}               ${color5.dim("runs in .vc/app")}`
   ] : [
-    `  ${color4.cyan("bun install")}          ${color4.dim("one install for both workspaces")}`,
-    `  ${color4.cyan("bun run maildev")}      ${color4.dim("local inbox at http://localhost:1080")}`,
-    `  ${color4.cyan("bun run dev:api")}      ${color4.dim("the worker, with the panel")}`,
-    `  ${color4.cyan("bun run dev:frontend")} ${color4.dim("the storefront, against the local API")}`,
-    `  ${color4.cyan("bun run preflight")}    ${color4.dim("what is still missing, and why it matters")}`
+    `  ${color5.cyan("bun install")}          ${color5.dim("one install for both workspaces")}`,
+    `  ${color5.cyan("bun run maildev")}      ${color5.dim("local inbox at http://localhost:1080")}`,
+    `  ${color5.cyan("bun run dev:api")}      ${color5.dim("the worker, with the panel")}`,
+    `  ${color5.cyan("bun run dev:frontend")} ${color5.dim("the storefront, against the local API")}`,
+    `  ${color5.cyan("bun run preflight")}    ${color5.dim("what is still missing, and why it matters")}`
   ];
   p2.outro(["Next:", ...next].join(`
 `));
@@ -800,7 +935,7 @@ async function init(args) {
 
 // src/regenerate.ts
 import * as p3 from "@clack/prompts";
-import color5 from "picocolors";
+import color6 from "picocolors";
 async function generateCommand() {
   const project = await findProject();
   if (!project) {
@@ -816,9 +951,9 @@ async function generateCommand() {
   }
   const result = await generate(project.root, project.manifest);
   p3.log.step([
-    ...result.written.map((file) => `${color5.green("+")} ${file}`),
-    ...result.kept.map((file) => `${color5.dim("=")} ${file} ${color5.dim("(kept)")}`),
-    ...result.retired.map((file) => `${color5.red("-")} ${file} ${color5.dim("(retired — no longer generated)")}`)
+    ...result.written.map((file) => `${color6.green("+")} ${file}`),
+    ...result.kept.map((file) => `${color6.dim("=")} ${file} ${color6.dim("(kept)")}`),
+    ...result.retired.map((file) => `${color6.red("-")} ${file} ${color6.dim("(retired — no longer generated)")}`)
   ].join(`
 `));
   return project.manifest.layout === "strict" ? finishStrict(project.root) : 0;
@@ -837,8 +972,8 @@ async function generateHelp() {
 }
 
 // src/scripts.ts
-import { existsSync as existsSync2, readFileSync } from "node:fs";
-import { join as join4, relative } from "node:path";
+import { existsSync as existsSync3, readFileSync } from "node:fs";
+import { join as join5, relative } from "node:path";
 function appScript(name) {
   return async (args) => {
     const project = await findProject();
@@ -847,8 +982,8 @@ function appScript(name) {
     const code = await ensureGenerated(project);
     if (code !== 0)
       return code;
-    const pkgPath = join4(project.appDir, "package.json");
-    const scripts = existsSync2(pkgPath) ? JSON.parse(readFileSync(pkgPath, "utf8")).scripts ?? {} : {};
+    const pkgPath = join5(project.appDir, "package.json");
+    const scripts = existsSync3(pkgPath) ? JSON.parse(readFileSync(pkgPath, "utf8")).scripts ?? {} : {};
     if (!scripts[name]) {
       console.error(`vc: ${relative(process.cwd(), pkgPath) || "package.json"} has no "${name}" script — void init writes one.`);
       return 1;
@@ -884,6 +1019,7 @@ var EXTENDED = {
   secrets: { run: secretsCliCommand, help: secretsHelp },
   keys: { run: keysCliCommand, help: keysHelp },
   link: { run: linkCliCommand, help: linkHelp },
+  publish: { run: publishCliCommand, help: publishHelp },
   guard: { run: guardCommand, help: async () => guardCommand() },
   dev: { run: appScript("dev"), help: appScriptHelp("dev") },
   build: { run: appScript("build"), help: appScriptHelp("build") },

package/dist/deploy/index.d.ts

@@ -46,3 +46,6 @@ export declare function guardCommand(): Promise<number>;
 /** `vc link` — GitHub holds the credentials; this is what puts them there. */
 export declare function linkCliCommand(args: string[]): Promise<number>;
 export declare function linkHelp(): Promise<number>;
+/** `vc publish` — create the repository, configure it, push. The push deploys. */
+export declare function publishCliCommand(args: string[]): Promise<number>;
+export declare function publishHelp(): Promise<number>;

package/dist/deploy/publish.d.ts

@@ -0,0 +1,32 @@
+import type { Project } from "../project";
+/**
+ * `vc publish` — make the repository, give it what it needs, push.
+ *
+ * ── Why this exists ──────────────────────────────────────────────────────
+ *
+ * The goal was always "publishing to GitHub is the deploy". `vc link` sat in
+ * front of that as a separate step, and it is worth being exact about what
+ * it was actually for, because two of its three jobs never needed a person:
+ *
+ *   DOTENV_PRIVATE_KEY_SECRETS   vc already holds it — automatic
+ *   CLOUDFLARE_ACCOUNT_ID        it is in the manifest — automatic
+ *   CLOUDFLARE_API_TOKEN         exists only in Cloudflare's dashboard
+ *
+ * Only the third needs a human, and it cannot be removed: there is no OIDC
+ * or workload identity federation from GitHub to the Cloudflare API, so
+ * something has to carry a token across, and only a person can fetch one.
+ * Everything else is ceremony that a command can do.
+ *
+ * So this is the one command. It creates the repository, sets all three,
+ * and pushes — and the push is what deploys. After it, `git push` is the
+ * whole loop forever, and `vc` is only needed to read or change a secret.
+ *
+ * ── The order matters ────────────────────────────────────────────────────
+ *
+ * The repository is created WITHOUT pushing, the credentials go on, and only
+ * then does the push happen. `gh repo create --push` would put main there
+ * first, which starts a deploy against a repository that has no key and no
+ * token — a red run, an email, and a shop that did not deploy, for no
+ * reason other than doing two things in the wrong order.
+ */
+export declare function publishCommand(project: Project, args: string[]): Promise<number>;

package/dist/{index-4jz1448c.js → index-3j6jtjmk.js}

@@ -12,7 +12,7 @@ import {
   renderEnvProduction,
   renderEnvTs,
   unsetSecretNames
-} from "./index-negctpws.js";
+} from "./index-khzk6a9z.js";
 import {
   MANIFEST_FILE,
   has,
@@ -1379,7 +1379,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.17.0",
+  version: "0.18.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1896,14 +1896,21 @@ You do not need wrangler on your machine, and you do not need to be logged
 into it. You do not need to open the Cloudflare dashboard after the one step
 below.
 
-## Once, before the first push
+## Once, to start
 
 \`\`\`sh
-gh repo create --source=. --private --push   # if there is no repo yet
-vc link
+vc publish
 \`\`\`
 
-\`vc link\` does three things and stores all of them on the GitHub repository:
+One command: it creates the repository, gives it what the deploy needs, and
+pushes — and the push is the deploy. After it, \`git push\` is the whole loop.
+
+Two of the three things it sets need nothing from you. The encryption key vc
+already holds; the account id is in \`voidcommerce.json\`. It asks only for a
+Cloudflare API token, because there is no OIDC between GitHub and Cloudflare
+and only a person can fetch one from the dashboard.
+
+It stores three things on the GitHub repository:
 
 | what | where | why |
 |---|---|---|

package/dist/{index-negctpws.js → index-khzk6a9z.js}

@@ -414,7 +414,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-w65kbdp6.js");
+    const { publicKeyFor } = await import("./keys-fn6wbv40.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -995,4 +995,4 @@ ${color2.green("✓")} re-keyed under ${made.publicKey.slice(0, 20)}… and ${PR
   return 0;
 }
 
-export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, ghAuth, repoSlug, setSecret, secretNames, setVariable, getVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };
+export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, findGh, run, ghAuth, repoSlug, setSecret, secretNames, setVariable, getVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run1, committedPublicKeyInto, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-4jz1448c.js";
+} from "./index-3j6jtjmk.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-negctpws.js";
+} from "./index-khzk6a9z.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/dist/{keys-w65kbdp6.js → keys-fn6wbv40.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-negctpws.js";
+} from "./index-khzk6a9z.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -6,6 +6,8 @@ import {
 	keysHelp,
 	linkCliCommand,
 	linkHelp,
+	publishCliCommand,
+	publishHelp,
 	preflightCommand,
 	preflightHelp,
 	secretsCliCommand,
@@ -53,6 +55,7 @@ export const EXTENDED: Record<string, Extended> = {
 	secrets: { run: secretsCliCommand, help: secretsHelp },
 	keys: { run: keysCliCommand, help: keysHelp },
 	link: { run: linkCliCommand, help: linkHelp },
+	publish: { run: publishCliCommand, help: publishHelp },
 	// Called by the generated pre-commit hook; exit code is the interface.
 	guard: { run: guardCommand, help: async () => guardCommand() },
 	dev: { run: appScript("dev"), help: appScriptHelp("dev") },

package/src/deploy/index.ts

@@ -9,6 +9,7 @@ import { join } from "node:path";
 import { PRIVATE_KEY_VAR, SECRETS_FILE, encryptInto, plaintextSecretEntries, plaintextSecretNames, run, secretsCommand } from "./secrets";
 import { LOCAL_KEY_FILE, committedPublicKey, ignoresKeyFile, keysCommand } from "./keys";
 import { linkCommand } from "./link";
+import { publishCommand } from "./publish";
 
 /**
  * `vc deploy` extends `void deploy`: vc's preflight first, then void's
@@ -341,3 +342,42 @@ export async function linkHelp(): Promise<number> {
 	);
 	return 0;
 }
+
+
+/** `vc publish` — create the repository, configure it, push. The push deploys. */
+export async function publishCliCommand(args: string[]): Promise<number> {
+	const project = await findProject();
+	if (!project) {
+		console.error("vc: no voidcommerce.json here.");
+		return 1;
+	}
+	return publishCommand(project, args);
+}
+
+export async function publishHelp(): Promise<number> {
+	const width = 80;
+	console.log(
+		box("vc publish", [
+			line("Create this shop's GitHub repository, give it what the deploy needs,", width),
+			line("and push. The push IS the deploy. Run once; after that, `git push`.", width),
+			line("", width),
+			...row("vc publish", "create the repository, set the credentials, push main", width, 2),
+			line("", width),
+			line(color.bold("What it does for you"), width),
+			...row("the encryption key", "vc already holds it — set with no input from you", width, 2),
+			...row("the account id", "read from voidcommerce.json", width, 2),
+			...row("the Cloudflare token", "the one thing it has to ask for", width, 2),
+			line("", width),
+			line(color.bold("Why the token cannot be automated away"), width),
+			line("There is no OIDC between GitHub and Cloudflare, so something must carry", width),
+			line("a token across, and only a person can fetch one from the dashboard. It", width),
+			line("is asked for once, checked against the Cloudflare API, and stored on the", width),
+			line("repository — never on this machine.", width),
+			line("", width),
+			line("The repository is created WITHOUT pushing, then configured, then pushed.", width),
+			line("Pushing first would start a deploy against a repository that has no key", width),
+			line("and no token: a red run, for no reason but the wrong order.", width),
+		], width),
+	);
+	return 0;
+}

package/src/deploy/publish.ts

@@ -0,0 +1,145 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import color from "picocolors";
+import type { Project } from "../project";
+import { findGh, ghAuth, repoSlug, run } from "./github";
+import { linkCommand } from "./link";
+
+/**
+ * `vc publish` — make the repository, give it what it needs, push.
+ *
+ * ── Why this exists ──────────────────────────────────────────────────────
+ *
+ * The goal was always "publishing to GitHub is the deploy". `vc link` sat in
+ * front of that as a separate step, and it is worth being exact about what
+ * it was actually for, because two of its three jobs never needed a person:
+ *
+ *   DOTENV_PRIVATE_KEY_SECRETS   vc already holds it — automatic
+ *   CLOUDFLARE_ACCOUNT_ID        it is in the manifest — automatic
+ *   CLOUDFLARE_API_TOKEN         exists only in Cloudflare's dashboard
+ *
+ * Only the third needs a human, and it cannot be removed: there is no OIDC
+ * or workload identity federation from GitHub to the Cloudflare API, so
+ * something has to carry a token across, and only a person can fetch one.
+ * Everything else is ceremony that a command can do.
+ *
+ * So this is the one command. It creates the repository, sets all three,
+ * and pushes — and the push is what deploys. After it, `git push` is the
+ * whole loop forever, and `vc` is only needed to read or change a secret.
+ *
+ * ── The order matters ────────────────────────────────────────────────────
+ *
+ * The repository is created WITHOUT pushing, the credentials go on, and only
+ * then does the push happen. `gh repo create --push` would put main there
+ * first, which starts a deploy against a repository that has no key and no
+ * token — a red run, an email, and a shop that did not deploy, for no
+ * reason other than doing two things in the wrong order.
+ */
+
+export async function publishCommand(project: Project, args: string[]): Promise<number> {
+	const p = await import("@clack/prompts");
+	const root = project.root;
+	const gh = findGh();
+
+	p.intro(color.bgCyan(color.black(" vc publish ")));
+
+	const auth = await ghAuth(root);
+	if (!auth.ok || !gh) {
+		p.cancel(auth.reason ?? "the GitHub CLI is not installed. https://cli.github.com");
+		return 1;
+	}
+	if (!existsSync(join(root, ".git"))) {
+		p.cancel(`${root} is not a git repository. \`git init\` first, and commit what you have.`);
+		return 1;
+	}
+
+	// 1. The repository. Created without pushing: see above.
+	let slug = await repoSlug(root);
+	if (slug) {
+		p.log.info(`${slug} already exists — using it`);
+	} else {
+		const suggested = project.manifest.shop.domain.split(".")[0] ?? "shop";
+		const name = await p.text({
+			message: "Repository name",
+			initialValue: suggested,
+			validate: (value) => (/^[A-Za-z0-9._-]+$/.test(value.trim()) ? undefined : "letters, digits, dot, dash or underscore"),
+		});
+		if (p.isCancel(name)) {
+			p.cancel("nothing was created.");
+			return 1;
+		}
+		// PRIVATE by default and deliberately: the encryption key becomes a
+		// repository variable, so anyone who can read this repository can
+		// decrypt its secrets.
+		const visibility = await p.select({
+			message: "Visibility",
+			options: [
+				{ value: "--private", label: "Private", hint: "the key that opens your secrets is readable to anyone with access" },
+				{ value: "--public", label: "Public", hint: "only if this shop keeps no secrets at all" },
+			],
+			initialValue: "--private",
+		});
+		if (p.isCancel(visibility)) {
+			p.cancel("nothing was created.");
+			return 1;
+		}
+
+		const spinner = p.spinner();
+		spinner.start(`creating ${String(name)}`);
+		const created = await run(gh, ["repo", "create", String(name).trim(), "--source=.", String(visibility)], root);
+		if (created.code !== 0) {
+			spinner.stop(`${color.red("✗")} could not create it`);
+			p.cancel(created.out.trim().split("\n").slice(-2).join(" "));
+			return 1;
+		}
+		slug = await repoSlug(root);
+		spinner.stop(`${color.green("✓")} ${slug ?? String(name)} created, and set as origin`);
+	}
+
+	// 2. The credentials. Two are automatic; one is asked for.
+	p.log.step("giving the repository what the deploy needs");
+	const linked = await linkCommand(project, args);
+	if (linked !== 0) {
+		p.cancel("the repository exists but is not configured, so a push would not deploy. Fix the above and run `vc publish` again.");
+		return 1;
+	}
+
+	// 3. Anything `vc link` wrote — the public key, a fresh .env.secrets, the
+	// pinned account id — has to be IN the push, or the deploy reads a
+	// repository that disagrees with the one on this machine.
+	const dirty = (await run("git", ["status", "--porcelain"], root)).out.trim();
+	if (dirty) {
+		const staged = await run("git", ["add", "-A"], root);
+		const committed = await run("git", ["commit", "-m", "vc publish: link this shop to its repository"], root);
+		if (staged.code !== 0 || committed.code !== 0) {
+			p.cancel(`could not commit the changes vc link made:\n${committed.out.trim().split("\n").slice(-3).join("\n")}`);
+			return 1;
+		}
+		p.log.success(`${color.green("✓")} committed what linking changed`);
+	}
+
+	// 4. Push. This is the deploy.
+	const branch = (await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], root)).out.trim() || "main";
+	const spinner = p.spinner();
+	spinner.start(`pushing ${branch}`);
+	const pushed = await run("git", ["push", "-u", "origin", `${branch}:main`], root);
+	if (pushed.code !== 0) {
+		spinner.stop(`${color.red("✗")} the push failed`);
+		p.cancel(pushed.out.trim().split("\n").slice(-4).join("\n"));
+		return 1;
+	}
+	spinner.stop(`${color.green("✓")} pushed to main`);
+
+	p.outro(
+		[
+			`${color.bold("Published.")} The deploy is running now.`,
+			"",
+			`  ${color.cyan(`https://github.com/${slug}/actions`)}`,
+			"",
+			`  From here ${color.cyan("git push")} is the whole loop. \`vc\` is only needed to`,
+			`  change a secret (${color.cyan("vc secrets set KEY")}) or read one back`,
+			`  (${color.cyan("vc keys --restore")}).`,
+		].join("\n"),
+	);
+	return 0;
+}

package/src/generate/ci.ts

@@ -228,14 +228,21 @@ You do not need wrangler on your machine, and you do not need to be logged
 into it. You do not need to open the Cloudflare dashboard after the one step
 below.
 
-## Once, before the first push
+## Once, to start
 
 \`\`\`sh
-gh repo create --source=. --private --push   # if there is no repo yet
-vc link
+vc publish
 \`\`\`
 
-\`vc link\` does three things and stores all of them on the GitHub repository:
+One command: it creates the repository, gives it what the deploy needs, and
+pushes — and the push is the deploy. After it, \`git push\` is the whole loop.
+
+Two of the three things it sets need nothing from you. The encryption key vc
+already holds; the account id is in \`voidcommerce.json\`. It asks only for a
+Cloudflare API token, because there is no OIDC between GitHub and Cloudflare
+and only a person can fetch one from the dashboard.
+
+It stores three things on the GitHub repository:
 
 | what | where | why |
 |---|---|---|