@saastemly/voidcommerce 0.17.0 → 0.19.0

package/dist/{index-negctpws.js → index-68m1eg3f.js}

@@ -77,24 +77,6 @@ async function repoSlug(cwd) {
   const slug = viewed.out.trim();
   return /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
 }
-async function setSecret(cwd, name, value) {
-  const gh = findGh();
-  if (!gh)
-    return { ok: false, error: "gh is not installed" };
-  const result = await run(gh, ["secret", "set", name], cwd, value);
-  return result.code === 0 ? { ok: true } : { ok: false, error: result.out.trim().split(`
-`).slice(-2).join(" ") };
-}
-async function secretNames(cwd) {
-  const gh = findGh();
-  if (!gh)
-    return new Set;
-  const listed = await run(gh, ["secret", "list", "--json", "name", "-q", ".[].name"], cwd);
-  if (listed.code !== 0)
-    return new Set;
-  return new Set(listed.out.split(`
-`).map((line) => line.trim()).filter(Boolean));
-}
 async function setVariable(cwd, name, value) {
   const gh = findGh();
   if (!gh)
@@ -123,31 +105,6 @@ async function variableNames(cwd) {
   return new Set(listed.out.split(`
 `).map((line) => line.trim()).filter(Boolean));
 }
-async function verifyCloudflareToken(token) {
-  try {
-    const response = await fetch("https://api.cloudflare.com/client/v4/user/tokens/verify", {
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    const body = await response.json();
-    if (body.success && body.result?.status === "active")
-      return { ok: true, detail: "active" };
-    const message = body.errors?.[0]?.message ?? `HTTP ${response.status}`;
-    return { ok: false, detail: message };
-  } catch (error) {
-    return { ok: false, detail: `could not reach the Cloudflare API: ${String(error)}` };
-  }
-}
-async function cloudflareAccounts(token) {
-  try {
-    const response = await fetch("https://api.cloudflare.com/client/v4/accounts?per_page=50", {
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    const body = await response.json();
-    return body.success && Array.isArray(body.result) ? body.result.map((a) => ({ id: a.id, name: a.name })) : [];
-  } catch {
-    return [];
-  }
-}
 
 // src/deploy/secrets.ts
 import { existsSync as existsSync2, readFileSync, writeFileSync } from "node:fs";
@@ -158,6 +115,16 @@ import color from "picocolors";
 
 // src/generate/env.ts
 var BASE = [
+  {
+    key: "CLOUDFLARE_API_TOKEN",
+    breaks: "nothing deploys: no worker, no database, no migrations",
+    where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token"
+  },
+  {
+    key: "CLOUDFLARE_ACCOUNT_ID",
+    breaks: "wrangler cannot tell which account to deploy into, and refuses rather than guessing",
+    where: "the Cloudflare dashboard sidebar, or `vc secrets set` it after the first provision"
+  },
   {
     key: "SHOP_DOMAIN",
     breaks: "everything derived from it is wrong at once — no public origin, the storefront rejected as untrusted, no DNS records",
@@ -403,18 +370,19 @@ async function decryptSecrets(project) {
   const root = project.root;
   if (!existsSync2(join2(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const privateKey = process.env[PRIVATE_KEY_VAR];
+  const { localPrivateKey } = await import("./keys-e6w5dcxx.js");
+  const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
   if (!privateKey) {
     return {
       error: `${PRIVATE_KEY_VAR} is not set, so ${SECRETS_FILE} cannot be decrypted here.
-` + `  That is the normal state on a laptop: the key lives in GitHub Actions and
-` + `  only the deploy uses it. Push, and the workflow does this step.
-` + `  To deploy by hand anyway, export the key for one command.`
+  That is the normal state on a laptop: the key lives in GitHub Actions and
+  only the deploy uses it. Push, and the workflow does this step.
+  To deploy by hand anyway, export the key for one command.`
     };
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-w65kbdp6.js");
+    const { publicKeyFor } = await import("./keys-e6w5dcxx.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -633,6 +601,18 @@ cancelled; nothing changed.
   }
   return String(answer);
 }
+async function secretValue(project, name) {
+  const decrypted = await decryptSecrets(project);
+  if ("error" in decrypted)
+    return null;
+  try {
+    const match = new RegExp(`^\\\\s*${name}\\\\s*=\\\\s*(.*)$`, "m").exec(readFileSync(decrypted.path, "utf8"));
+    const value = match?.[1]?.trim().replace(/^['"]|['"]$/g, "") ?? "";
+    return value && value !== "unset" ? value : null;
+  } finally {
+    decrypted.cleanup();
+  }
+}
 async function encryptInto(root, publicKey, name, value) {
   const { encrypt } = await import("./index-mpr7gm6k.js").then((m)=>__toESM(m.default,1));
   let ciphertext;
@@ -995,4 +975,4 @@ ${color2.green("✓")} re-keyed under ${made.publicKey.slice(0, 20)}… and ${PR
   return 0;
 }
 
-export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, ghAuth, repoSlug, setSecret, secretNames, setVariable, getVariable, variableNames, verifyCloudflareToken, cloudflareAccounts, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, committedPublicKeyInto, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, initSecrets, encryptInto };
+export { allEnvKeys, renderEnvTs, renderEnvExample, MANIFEST_OWNED_ENV, renderEnvLocal, renderEnvProduction, envSummary, apiToken, LOCAL_KEY_FILE, localPrivateKey, committedPublicKey, generateKeypair, publicKeyFor, keyState, provisionKey, ignoresKeyFile, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, run2 as run, declaredSecretNames, unsetSecretNames, plaintextSecretNames, plaintextSecretEntries, decryptSecrets, secretsCommand, secretValue, encryptInto };

package/dist/{index-4jz1448c.js → index-y4dk27kf.js}

@@ -11,8 +11,9 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs,
+  secretValue,
   unsetSecretNames
-} from "./index-negctpws.js";
+} from "./index-68m1eg3f.js";
 import {
   MANIFEST_FILE,
   has,
@@ -1379,7 +1380,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.17.0",
+  version: "0.19.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1717,14 +1718,13 @@ function renderDistWorkflow(manifest) {
 # Cloudflare. The check runs FIRST and on its own: nothing is built, created
 # or replaced for a shop that is not ready.
 #
-# The credentials come from the repository, set once by \`vc link\`:
+# ONE thing is configured outside the repository:
 #
-#   secrets.CLOUDFLARE_API_TOKEN        deploys, and creates D1 + the queue
-#   vars.${PRIVATE_KEY_VAR}      opens ${SECRETS_FILE} (a VARIABLE, so it can be read back)
-#   vars.CLOUDFLARE_ACCOUNT_ID          which account (an id, not a credential)
+#   vars.${PRIVATE_KEY_VAR}   the key that opens ${SECRETS_FILE}
 #
-# Nothing here needs a Cloudflare dashboard visit and nothing needs wrangler
-# on your machine. See DEPLOY.md.
+# Everything else — including the Cloudflare token and account id — is an
+# ordinary secret in that file, encrypted and committed, so it travels with
+# the push. See DEPLOY.md.
 on:
   push:
     branches: [main, master]
@@ -1815,8 +1815,8 @@ jobs:
       name: production
       url: https://${manifest.shop.domain}
     env:
-      CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
-      CLOUDFLARE_ACCOUNT_ID: \${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      # The only thing this deploy is given. The Cloudflare credentials are
+      # read out of .env.secrets, which this key opens.
       ${PRIVATE_KEY_VAR}: \${{ vars.${PRIVATE_KEY_VAR} }}
     steps:
       - uses: actions/checkout@v6
@@ -1830,19 +1830,15 @@ jobs:
       # that is what makes a new laptop or a second person possible — but
       # GitHub only masks SECRETS in logs automatically. Registering it with
       # ::add-mask:: buys back the redaction without giving up recovery.
-      - name: Are the credentials here?
+      - name: Is the key here?
         run: |
           set -euo pipefail
-          if [ -n "\${${PRIVATE_KEY_VAR}:-}" ]; then
-            echo "::add-mask::\${${PRIVATE_KEY_VAR}}"
-          fi
-          missing=""
-          [ -n "\${CLOUDFLARE_API_TOKEN:-}" ] || missing="$missing CLOUDFLARE_API_TOKEN"
-          [ -n "\${${PRIVATE_KEY_VAR}:-}" ] || missing="$missing ${PRIVATE_KEY_VAR}"
-          if [ -n "$missing" ]; then
-            echo "::error::this repository has no$missing. Run 'vc link' once, from a checkout."
+          if [ -z "\${${PRIVATE_KEY_VAR}:-}" ]; then
+            echo "::error::this repository has no ${PRIVATE_KEY_VAR} variable, so .env.secrets cannot be opened and nothing can deploy."
+            echo "Set it once, from a checkout: gh variable set ${PRIVATE_KEY_VAR}"
             exit 1
           fi
+          echo "::add-mask::\${${PRIVATE_KEY_VAR}}"
 
       - run: bun install --frozen-lockfile
 
@@ -1896,49 +1892,29 @@ You do not need wrangler on your machine, and you do not need to be logged
 into it. You do not need to open the Cloudflare dashboard after the one step
 below.
 
-## Once, before the first push
+## Once, to start
 
 \`\`\`sh
-gh repo create --source=. --private --push   # if there is no repo yet
-vc link
+gh repo create --source=. --private     # or make it in the browser
+vc secrets --init                       # writes the key onto the repository
+vc secrets set CLOUDFLARE_API_TOKEN     # and every other key it lists
+git push -u origin main
 \`\`\`
 
-\`vc link\` does three things and stores all of them on the GitHub repository:
-
-| what | where | why |
-|---|---|---|
-| \`${PRIVATE_KEY_VAR}\` | repository **variable** | opens \`${SECRETS_FILE}\`. A variable, not a secret, so you can get it back — see below |
-| \`CLOUDFLARE_API_TOKEN\` | repository **secret** | deploys, and creates D1 and the queue |
-| \`CLOUDFLARE_ACCOUNT_ID\` | repository **variable** | which account. An identifier, not a credential |
-
-It will ask you to paste a Cloudflare API token. That is the only manual step
-in the whole setup, and it is worth saying exactly why it cannot be removed:
-
-> **GitHub cannot mint a Cloudflare credential.** There is no OIDC or workload
-> identity federation between them — the feature request has been open since
-> 2025 with no commitment, and Cloudflare's own CI guidance still says to store
-> a token in your CI provider's secrets. The Cloudflare GitHub App does not
-> help either: it grants *Cloudflare* access to your *repository*, not the
-> reverse. Something has to authorise creating a database in your account, and
-> only Cloudflare can issue that authorisation.
-
-Create the token at **My Profile → API Tokens → Create Token → Custom token**:
-
-| scope | permission | for |
-|---|---|---|
-| Account | Workers Scripts: Edit | deploying the worker |
-| Account | D1: Edit | creating the database, applying migrations |
-| Account | Queues: Edit | the order queue |
-| Account | Workers KV Storage: Edit | sessions and caches |
-| Account | Workers R2 Storage: Edit | product images |
-| Account | Account Settings: Read | confirming which account |
-| Zone | Workers Routes: Edit (${zone2}) | answering on your domain |
-| Zone | Zone: Read (${zone2}) | confirming the zone is on this account |
-| Zone | DNS: Read (${zone2}) | noticing a hostname that already answers |
-| User | User Details: Read, Memberships: Read | wrangler asks at startup |
-
-The token Cloudflare generates for its own Workers Builds will **not** do: it
-has no D1 and no Queues permission, so it cannot create this shop's database.
+That push is the deploy, and every push after it.
+
+**Exactly one thing lives outside the repository**: \`${PRIVATE_KEY_VAR}\`, a
+repository variable holding the key that opens \`${SECRETS_FILE}\`. It is set
+for you the moment the key is made, as long as the repository already exists
+— which is why the repository comes first above.
+
+Everything else, including the Cloudflare token and account id, is an
+ordinary secret in \`${SECRETS_FILE}\`: encrypted, committed, and read by the
+deploy out of what you pushed.
+
+The token itself has to be fetched by a person, once, because there is no
+OIDC between GitHub and Cloudflare and nothing else can issue one. Create it
+at **My Profile → API Tokens → Create Token → Custom token**:
 
 ### The zone
 
@@ -3293,6 +3269,18 @@ async function deployCloudflare(project, opts) {
   const configPath = join8(app, "wrangler.jsonc");
   if (!existsSync8(configPath))
     return fail("wrangler.jsonc is missing — `vc generate` writes it.");
+  if (!process.env["CLOUDFLARE_API_TOKEN"]) {
+    const fromRepo = await secretValue(project, "CLOUDFLARE_API_TOKEN");
+    if (fromRepo) {
+      process.env["CLOUDFLARE_API_TOKEN"] = fromRepo;
+      console.log(`${color5.green("✓")} Cloudflare credentials read from ${SECRETS_FILE}`);
+    }
+  }
+  if (!process.env["CLOUDFLARE_ACCOUNT_ID"]) {
+    const fromRepo = await secretValue(project, "CLOUDFLARE_ACCOUNT_ID");
+    if (fromRepo)
+      process.env["CLOUDFLARE_ACCOUNT_ID"] = fromRepo;
+  }
   const bin = findWrangler(app);
   if (!bin)
     return fail("wrangler is not installed. `bun add -d wrangler`, then `wrangler login`.");

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-4jz1448c.js";
+} from "./index-y4dk27kf.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-negctpws.js";
+} from "./index-68m1eg3f.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,

package/dist/{keys-w65kbdp6.js → keys-e6w5dcxx.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-negctpws.js";
+} from "./index-68m1eg3f.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -4,8 +4,6 @@ import {
 	guardCommand,
 	keysCliCommand,
 	keysHelp,
-	linkCliCommand,
-	linkHelp,
 	preflightCommand,
 	preflightHelp,
 	secretsCliCommand,
@@ -52,7 +50,6 @@ export const EXTENDED: Record<string, Extended> = {
 	preflight: { run: preflightCommand, help: preflightHelp },
 	secrets: { run: secretsCliCommand, help: secretsHelp },
 	keys: { run: keysCliCommand, help: keysHelp },
-	link: { run: linkCliCommand, help: linkHelp },
 	// Called by the generated pre-commit hook; exit code is the interface.
 	guard: { run: guardCommand, help: async () => guardCommand() },
 	dev: { run: appScript("dev"), help: appScriptHelp("dev") },

package/src/deploy/cloudflare.ts

@@ -8,7 +8,7 @@ import { parseJsonc, upsertJsonc } from "./jsonc";
 import { apiToken } from "./github";
 import { preflight, printPreflight } from "./preflight";
 import { checkSameZone, printZoneCheck } from "./zone";
-import { SECRETS_FILE, decryptSecrets } from "./secrets";
+import { SECRETS_FILE, decryptSecrets, secretValue } from "./secrets";
 import { ensureD1, ensureQueue, findWrangler, whoami, wrangler } from "./wrangler";
 
 /**
@@ -77,6 +77,28 @@ export async function deployCloudflare(project: Project, opts: CloudflareOptions
 	const configPath = join(app, "wrangler.jsonc");
 	if (!existsSync(configPath)) return fail("wrangler.jsonc is missing — `vc generate` writes it.");
 
+	/**
+	 * 0. The Cloudflare credentials, out of the repository.
+	 *
+	 * They are ordinary secrets in `.env.secrets`, so a deploy needs nothing
+	 * in its environment except the key that opens that file. This is what
+	 * makes a push the whole deploy: everything else travelled with it.
+	 *
+	 * An environment variable still wins, for the person running this by hand
+	 * against a different account.
+	 */
+	if (!process.env["CLOUDFLARE_API_TOKEN"]) {
+		const fromRepo = await secretValue(project, "CLOUDFLARE_API_TOKEN");
+		if (fromRepo) {
+			process.env["CLOUDFLARE_API_TOKEN"] = fromRepo;
+			console.log(`${color.green("✓")} Cloudflare credentials read from ${SECRETS_FILE}`);
+		}
+	}
+	if (!process.env["CLOUDFLARE_ACCOUNT_ID"]) {
+		const fromRepo = await secretValue(project, "CLOUDFLARE_ACCOUNT_ID");
+		if (fromRepo) process.env["CLOUDFLARE_ACCOUNT_ID"] = fromRepo;
+	}
+
 	// 1. wrangler, logged in, account pinned.
 	const bin = findWrangler(app);
 	if (!bin) return fail("wrangler is not installed. `bun add -d wrangler`, then `wrangler login`.");

package/src/deploy/index.ts

@@ -8,7 +8,6 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { PRIVATE_KEY_VAR, SECRETS_FILE, encryptInto, plaintextSecretEntries, plaintextSecretNames, run, secretsCommand } from "./secrets";
 import { LOCAL_KEY_FILE, committedPublicKey, ignoresKeyFile, keysCommand } from "./keys";
-import { linkCommand } from "./link";
 
 /**
  * `vc deploy` extends `void deploy`: vc's preflight first, then void's
@@ -307,37 +306,7 @@ export async function guardCommand(): Promise<number> {
 	return 0;
 }
 
-/** `vc link` — GitHub holds the credentials; this is what puts them there. */
-export async function linkCliCommand(args: string[]): Promise<number> {
-	const project = await findProject();
-	if (!project) {
-		console.error("vc: no voidcommerce.json here.");
-		return 1;
-	}
-	return linkCommand(project, args);
-}
 
-export async function linkHelp(): Promise<number> {
-	const width = 80;
-	console.log(
-		box("vc link", [
-			line("Put this shop's credentials on its GitHub repository, once, so that", width),
-			line("every deploy after this is a `git push`.", width),
-			line("", width),
-			...row("vc link", "store the encryption key and the Cloudflare token on the repository", width, 2),
-			...row("vc link --force", "replace what is already there", width, 2),
-			line("", width),
-			line(color.bold("What it stores, and where"), width),
-			...row(PRIVATE_KEY_VAR, "a repository SECRET. A key already waiting locally is MOVED here and the local copy deleted", width, 2),
-			...row("CLOUDFLARE_API_TOKEN", "a repository SECRET, checked against the Cloudflare API before it is stored", width, 2),
-			...row("CLOUDFLARE_ACCOUNT_ID", "a repository VARIABLE — an identifier, not a credential", width, 2),
-			line("", width),
-			line(color.bold("Why one token still has to be typed"), width),
-			line("GitHub cannot mint a Cloudflare credential. There is no OIDC federation", width),
-			line("between them, and the Cloudflare GitHub App runs the other way: it grants", width),
-			line("Cloudflare access to your repository, not your repository access to", width),
-			line("Cloudflare. So it is typed once, here, and never stored on this machine.", width),
-		], width),
-	);
-	return 0;
-}
+
+
+

package/src/deploy/secrets.ts

@@ -202,7 +202,12 @@ export async function decryptSecrets(project: Project): Promise<DecryptedSecrets
 	// The private key comes from the environment, which in the normal case is
 	// GitHub Actions injecting the repository secret. A laptop has no reason
 	// to hold it, so a missing one is explained rather than treated as a fault.
-	const privateKey = process.env[PRIVATE_KEY_VAR];
+	// The environment first — that is CI, where the repository variable is
+	// injected — then a key parked locally by `vc keys --init` or restored by
+	// `vc keys --restore`. Reading only the environment made a local deploy
+	// fail while the key sat in a file two lines away.
+	const { localPrivateKey } = await import("./keys");
+	const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
 	if (!privateKey) {
 		return {
 			error:
@@ -443,6 +448,27 @@ async function readValue(name: string, breaks?: string, where?: string): Promise
 }
 
 
+/**
+ * One value out of `.env.secrets`, by name.
+ *
+ * How the deploy gets its Cloudflare credentials without anyone having put
+ * them in the environment: they are ordinary secrets in the committed file,
+ * so the deploy reads them out of what was pushed. Returns null rather than
+ * throwing — a caller that cannot decrypt has an env var to fall back on,
+ * and a better error to give than this one.
+ */
+export async function secretValue(project: Project, name: string): Promise<string | null> {
+	const decrypted = await decryptSecrets(project);
+	if ("error" in decrypted) return null;
+	try {
+		const match = new RegExp(`^\\\\s*${name}\\\\s*=\\\\s*(.*)$`, "m").exec(readFileSync(decrypted.path, "utf8"));
+		const value = match?.[1]?.trim().replace(/^['"]|['"]$/g, "") ?? "";
+		return value && value !== "unset" ? value : null;
+	} finally {
+		decrypted.cleanup();
+	}
+}
+
 /**
  * Encrypt one value into `.env.secrets`, in process.
  *

package/src/generate/ci.ts

@@ -47,14 +47,13 @@ export function renderDistWorkflow(manifest: Manifest): string {
 # Cloudflare. The check runs FIRST and on its own: nothing is built, created
 # or replaced for a shop that is not ready.
 #
-# The credentials come from the repository, set once by \`vc link\`:
+# ONE thing is configured outside the repository:
 #
-#   secrets.CLOUDFLARE_API_TOKEN        deploys, and creates D1 + the queue
-#   vars.${PRIVATE_KEY_VAR}      opens ${SECRETS_FILE} (a VARIABLE, so it can be read back)
-#   vars.CLOUDFLARE_ACCOUNT_ID          which account (an id, not a credential)
+#   vars.${PRIVATE_KEY_VAR}   the key that opens ${SECRETS_FILE}
 #
-# Nothing here needs a Cloudflare dashboard visit and nothing needs wrangler
-# on your machine. See DEPLOY.md.
+# Everything else — including the Cloudflare token and account id — is an
+# ordinary secret in that file, encrypted and committed, so it travels with
+# the push. See DEPLOY.md.
 on:
   push:
     branches: [main, master]
@@ -145,8 +144,8 @@ jobs:
       name: production
       url: https://${manifest.shop.domain}
     env:
-      CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
-      CLOUDFLARE_ACCOUNT_ID: \${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      # The only thing this deploy is given. The Cloudflare credentials are
+      # read out of .env.secrets, which this key opens.
       ${PRIVATE_KEY_VAR}: \${{ vars.${PRIVATE_KEY_VAR} }}
     steps:
       - uses: actions/checkout@v6
@@ -160,19 +159,15 @@ jobs:
       # that is what makes a new laptop or a second person possible — but
       # GitHub only masks SECRETS in logs automatically. Registering it with
       # ::add-mask:: buys back the redaction without giving up recovery.
-      - name: Are the credentials here?
+      - name: Is the key here?
         run: |
           set -euo pipefail
-          if [ -n "\${${PRIVATE_KEY_VAR}:-}" ]; then
-            echo "::add-mask::\${${PRIVATE_KEY_VAR}}"
-          fi
-          missing=""
-          [ -n "\${CLOUDFLARE_API_TOKEN:-}" ] || missing="$missing CLOUDFLARE_API_TOKEN"
-          [ -n "\${${PRIVATE_KEY_VAR}:-}" ] || missing="$missing ${PRIVATE_KEY_VAR}"
-          if [ -n "$missing" ]; then
-            echo "::error::this repository has no$missing. Run 'vc link' once, from a checkout."
+          if [ -z "\${${PRIVATE_KEY_VAR}:-}" ]; then
+            echo "::error::this repository has no ${PRIVATE_KEY_VAR} variable, so .env.secrets cannot be opened and nothing can deploy."
+            echo "Set it once, from a checkout: gh variable set ${PRIVATE_KEY_VAR}"
             exit 1
           fi
+          echo "::add-mask::\${${PRIVATE_KEY_VAR}}"
 
       - run: bun install --frozen-lockfile
 
@@ -228,49 +223,29 @@ You do not need wrangler on your machine, and you do not need to be logged
 into it. You do not need to open the Cloudflare dashboard after the one step
 below.
 
-## Once, before the first push
+## Once, to start
 
 \`\`\`sh
-gh repo create --source=. --private --push   # if there is no repo yet
-vc link
+gh repo create --source=. --private     # or make it in the browser
+vc secrets --init                       # writes the key onto the repository
+vc secrets set CLOUDFLARE_API_TOKEN     # and every other key it lists
+git push -u origin main
 \`\`\`
 
-\`vc link\` does three things and stores all of them on the GitHub repository:
-
-| what | where | why |
-|---|---|---|
-| \`${PRIVATE_KEY_VAR}\` | repository **variable** | opens \`${SECRETS_FILE}\`. A variable, not a secret, so you can get it back — see below |
-| \`CLOUDFLARE_API_TOKEN\` | repository **secret** | deploys, and creates D1 and the queue |
-| \`CLOUDFLARE_ACCOUNT_ID\` | repository **variable** | which account. An identifier, not a credential |
-
-It will ask you to paste a Cloudflare API token. That is the only manual step
-in the whole setup, and it is worth saying exactly why it cannot be removed:
-
-> **GitHub cannot mint a Cloudflare credential.** There is no OIDC or workload
-> identity federation between them — the feature request has been open since
-> 2025 with no commitment, and Cloudflare's own CI guidance still says to store
-> a token in your CI provider's secrets. The Cloudflare GitHub App does not
-> help either: it grants *Cloudflare* access to your *repository*, not the
-> reverse. Something has to authorise creating a database in your account, and
-> only Cloudflare can issue that authorisation.
-
-Create the token at **My Profile → API Tokens → Create Token → Custom token**:
-
-| scope | permission | for |
-|---|---|---|
-| Account | Workers Scripts: Edit | deploying the worker |
-| Account | D1: Edit | creating the database, applying migrations |
-| Account | Queues: Edit | the order queue |
-| Account | Workers KV Storage: Edit | sessions and caches |
-| Account | Workers R2 Storage: Edit | product images |
-| Account | Account Settings: Read | confirming which account |
-| Zone | Workers Routes: Edit (${zone}) | answering on your domain |
-| Zone | Zone: Read (${zone}) | confirming the zone is on this account |
-| Zone | DNS: Read (${zone}) | noticing a hostname that already answers |
-| User | User Details: Read, Memberships: Read | wrangler asks at startup |
-
-The token Cloudflare generates for its own Workers Builds will **not** do: it
-has no D1 and no Queues permission, so it cannot create this shop's database.
+That push is the deploy, and every push after it.
+
+**Exactly one thing lives outside the repository**: \`${PRIVATE_KEY_VAR}\`, a
+repository variable holding the key that opens \`${SECRETS_FILE}\`. It is set
+for you the moment the key is made, as long as the repository already exists
+— which is why the repository comes first above.
+
+Everything else, including the Cloudflare token and account id, is an
+ordinary secret in \`${SECRETS_FILE}\`: encrypted, committed, and read by the
+deploy out of what you pushed.
+
+The token itself has to be fetched by a person, once, because there is no
+OIDC between GitHub and Cloudflare and nothing else can issue one. Create it
+at **My Profile → API Tokens → Create Token → Custom token**:
 
 ### The zone
 

package/src/generate/env.ts

@@ -13,6 +13,28 @@ import { type Manifest, envKeysOf, has, hasFrontend, isApex, zone , oneOrigin} f
 
 /** Keys every shop has, whatever else was chosen. */
 const BASE: EnvKey[] = [
+	/**
+	 * The Cloudflare credentials are ORDINARY SECRETS, deliberately.
+	 *
+	 * They used to be set on the GitHub repository by a `vc link` step, which
+	 * existed only because they were treated as special. They are not: they
+	 * are two more values this shop needs, they belong in `.env.secrets` with
+	 * everything else, and they are set the same way — `vc secrets set`.
+	 *
+	 * That leaves exactly ONE thing that has to be configured outside the
+	 * repository: the key that opens `.env.secrets`. Everything else, the
+	 * deploy reads out of what was pushed.
+	 */
+	{
+		key: "CLOUDFLARE_API_TOKEN",
+		breaks: "nothing deploys: no worker, no database, no migrations",
+		where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token",
+	},
+	{
+		key: "CLOUDFLARE_ACCOUNT_ID",
+		breaks: "wrangler cannot tell which account to deploy into, and refuses rather than guessing",
+		where: "the Cloudflare dashboard sidebar, or `vc secrets set` it after the first provision",
+	},
 	{
 		key: "SHOP_DOMAIN",
 		breaks: "everything derived from it is wrong at once — no public origin, the storefront rejected as untrusted, no DNS records",

package/dist/deploy/link.d.ts

@@ -1,2 +0,0 @@
-import type { Project } from "../project";
-export declare function linkCommand(project: Project, args: string[]): Promise<number>;