@saastemly/voidcommerce 0.18.0 → 0.19.0

package/src/generate/ci.ts

@@ -47,14 +47,13 @@ export function renderDistWorkflow(manifest: Manifest): string {
 # Cloudflare. The check runs FIRST and on its own: nothing is built, created
 # or replaced for a shop that is not ready.
 #
-# The credentials come from the repository, set once by \`vc link\`:
+# ONE thing is configured outside the repository:
 #
-#   secrets.CLOUDFLARE_API_TOKEN        deploys, and creates D1 + the queue
-#   vars.${PRIVATE_KEY_VAR}      opens ${SECRETS_FILE} (a VARIABLE, so it can be read back)
-#   vars.CLOUDFLARE_ACCOUNT_ID          which account (an id, not a credential)
+#   vars.${PRIVATE_KEY_VAR}   the key that opens ${SECRETS_FILE}
 #
-# Nothing here needs a Cloudflare dashboard visit and nothing needs wrangler
-# on your machine. See DEPLOY.md.
+# Everything else — including the Cloudflare token and account id — is an
+# ordinary secret in that file, encrypted and committed, so it travels with
+# the push. See DEPLOY.md.
 on:
   push:
     branches: [main, master]
@@ -145,8 +144,8 @@ jobs:
       name: production
       url: https://${manifest.shop.domain}
     env:
-      CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
-      CLOUDFLARE_ACCOUNT_ID: \${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      # The only thing this deploy is given. The Cloudflare credentials are
+      # read out of .env.secrets, which this key opens.
       ${PRIVATE_KEY_VAR}: \${{ vars.${PRIVATE_KEY_VAR} }}
     steps:
       - uses: actions/checkout@v6
@@ -160,19 +159,15 @@ jobs:
       # that is what makes a new laptop or a second person possible — but
       # GitHub only masks SECRETS in logs automatically. Registering it with
       # ::add-mask:: buys back the redaction without giving up recovery.
-      - name: Are the credentials here?
+      - name: Is the key here?
         run: |
           set -euo pipefail
-          if [ -n "\${${PRIVATE_KEY_VAR}:-}" ]; then
-            echo "::add-mask::\${${PRIVATE_KEY_VAR}}"
-          fi
-          missing=""
-          [ -n "\${CLOUDFLARE_API_TOKEN:-}" ] || missing="$missing CLOUDFLARE_API_TOKEN"
-          [ -n "\${${PRIVATE_KEY_VAR}:-}" ] || missing="$missing ${PRIVATE_KEY_VAR}"
-          if [ -n "$missing" ]; then
-            echo "::error::this repository has no$missing. Run 'vc link' once, from a checkout."
+          if [ -z "\${${PRIVATE_KEY_VAR}:-}" ]; then
+            echo "::error::this repository has no ${PRIVATE_KEY_VAR} variable, so .env.secrets cannot be opened and nothing can deploy."
+            echo "Set it once, from a checkout: gh variable set ${PRIVATE_KEY_VAR}"
             exit 1
           fi
+          echo "::add-mask::\${${PRIVATE_KEY_VAR}}"
 
       - run: bun install --frozen-lockfile
 
@@ -231,53 +226,26 @@ below.
 ## Once, to start
 
 \`\`\`sh
-vc publish
+gh repo create --source=. --private     # or make it in the browser
+vc secrets --init                       # writes the key onto the repository
+vc secrets set CLOUDFLARE_API_TOKEN     # and every other key it lists
+git push -u origin main
 \`\`\`
 
-One command: it creates the repository, gives it what the deploy needs, and
-pushes — and the push is the deploy. After it, \`git push\` is the whole loop.
-
-Two of the three things it sets need nothing from you. The encryption key vc
-already holds; the account id is in \`voidcommerce.json\`. It asks only for a
-Cloudflare API token, because there is no OIDC between GitHub and Cloudflare
-and only a person can fetch one from the dashboard.
-
-It stores three things on the GitHub repository:
-
-| what | where | why |
-|---|---|---|
-| \`${PRIVATE_KEY_VAR}\` | repository **variable** | opens \`${SECRETS_FILE}\`. A variable, not a secret, so you can get it back — see below |
-| \`CLOUDFLARE_API_TOKEN\` | repository **secret** | deploys, and creates D1 and the queue |
-| \`CLOUDFLARE_ACCOUNT_ID\` | repository **variable** | which account. An identifier, not a credential |
-
-It will ask you to paste a Cloudflare API token. That is the only manual step
-in the whole setup, and it is worth saying exactly why it cannot be removed:
-
-> **GitHub cannot mint a Cloudflare credential.** There is no OIDC or workload
-> identity federation between them — the feature request has been open since
-> 2025 with no commitment, and Cloudflare's own CI guidance still says to store
-> a token in your CI provider's secrets. The Cloudflare GitHub App does not
-> help either: it grants *Cloudflare* access to your *repository*, not the
-> reverse. Something has to authorise creating a database in your account, and
-> only Cloudflare can issue that authorisation.
-
-Create the token at **My Profile → API Tokens → Create Token → Custom token**:
-
-| scope | permission | for |
-|---|---|---|
-| Account | Workers Scripts: Edit | deploying the worker |
-| Account | D1: Edit | creating the database, applying migrations |
-| Account | Queues: Edit | the order queue |
-| Account | Workers KV Storage: Edit | sessions and caches |
-| Account | Workers R2 Storage: Edit | product images |
-| Account | Account Settings: Read | confirming which account |
-| Zone | Workers Routes: Edit (${zone}) | answering on your domain |
-| Zone | Zone: Read (${zone}) | confirming the zone is on this account |
-| Zone | DNS: Read (${zone}) | noticing a hostname that already answers |
-| User | User Details: Read, Memberships: Read | wrangler asks at startup |
-
-The token Cloudflare generates for its own Workers Builds will **not** do: it
-has no D1 and no Queues permission, so it cannot create this shop's database.
+That push is the deploy, and every push after it.
+
+**Exactly one thing lives outside the repository**: \`${PRIVATE_KEY_VAR}\`, a
+repository variable holding the key that opens \`${SECRETS_FILE}\`. It is set
+for you the moment the key is made, as long as the repository already exists
+— which is why the repository comes first above.
+
+Everything else, including the Cloudflare token and account id, is an
+ordinary secret in \`${SECRETS_FILE}\`: encrypted, committed, and read by the
+deploy out of what you pushed.
+
+The token itself has to be fetched by a person, once, because there is no
+OIDC between GitHub and Cloudflare and nothing else can issue one. Create it
+at **My Profile → API Tokens → Create Token → Custom token**:
 
 ### The zone
 

package/src/generate/env.ts

@@ -13,6 +13,28 @@ import { type Manifest, envKeysOf, has, hasFrontend, isApex, zone , oneOrigin} f
 
 /** Keys every shop has, whatever else was chosen. */
 const BASE: EnvKey[] = [
+	/**
+	 * The Cloudflare credentials are ORDINARY SECRETS, deliberately.
+	 *
+	 * They used to be set on the GitHub repository by a `vc link` step, which
+	 * existed only because they were treated as special. They are not: they
+	 * are two more values this shop needs, they belong in `.env.secrets` with
+	 * everything else, and they are set the same way — `vc secrets set`.
+	 *
+	 * That leaves exactly ONE thing that has to be configured outside the
+	 * repository: the key that opens `.env.secrets`. Everything else, the
+	 * deploy reads out of what was pushed.
+	 */
+	{
+		key: "CLOUDFLARE_API_TOKEN",
+		breaks: "nothing deploys: no worker, no database, no migrations",
+		where: "dash.cloudflare.com/profile/api-tokens → Create Token → Custom token",
+	},
+	{
+		key: "CLOUDFLARE_ACCOUNT_ID",
+		breaks: "wrangler cannot tell which account to deploy into, and refuses rather than guessing",
+		where: "the Cloudflare dashboard sidebar, or `vc secrets set` it after the first provision",
+	},
 	{
 		key: "SHOP_DOMAIN",
 		breaks: "everything derived from it is wrong at once — no public origin, the storefront rejected as untrusted, no DNS records",

package/dist/deploy/link.d.ts

@@ -1,2 +0,0 @@
-import type { Project } from "../project";
-export declare function linkCommand(project: Project, args: string[]): Promise<number>;

package/dist/deploy/publish.d.ts

@@ -1,32 +0,0 @@
-import type { Project } from "../project";
-/**
- * `vc publish` — make the repository, give it what it needs, push.
- *
- * ── Why this exists ──────────────────────────────────────────────────────
- *
- * The goal was always "publishing to GitHub is the deploy". `vc link` sat in
- * front of that as a separate step, and it is worth being exact about what
- * it was actually for, because two of its three jobs never needed a person:
- *
- *   DOTENV_PRIVATE_KEY_SECRETS   vc already holds it — automatic
- *   CLOUDFLARE_ACCOUNT_ID        it is in the manifest — automatic
- *   CLOUDFLARE_API_TOKEN         exists only in Cloudflare's dashboard
- *
- * Only the third needs a human, and it cannot be removed: there is no OIDC
- * or workload identity federation from GitHub to the Cloudflare API, so
- * something has to carry a token across, and only a person can fetch one.
- * Everything else is ceremony that a command can do.
- *
- * So this is the one command. It creates the repository, sets all three,
- * and pushes — and the push is what deploys. After it, `git push` is the
- * whole loop forever, and `vc` is only needed to read or change a secret.
- *
- * ── The order matters ────────────────────────────────────────────────────
- *
- * The repository is created WITHOUT pushing, the credentials go on, and only
- * then does the push happen. `gh repo create --push` would put main there
- * first, which starts a deploy against a repository that has no key and no
- * token — a red run, an email, and a shop that did not deploy, for no
- * reason other than doing two things in the wrong order.
- */
-export declare function publishCommand(project: Project, args: string[]): Promise<number>;

package/src/deploy/link.ts

@@ -1,220 +0,0 @@
-import { rmSync } from "node:fs";
-import { join } from "node:path";
-import color from "picocolors";
-import { writeManifest } from "../manifest";
-import type { Project } from "../project";
-import { cloudflareAccounts, getVariable, ghAuth, repoSlug, secretNames, setSecret, setVariable, variableNames, verifyCloudflareToken } from "./github";
-import { LOCAL_KEY_FILE, keyState, localPrivateKey, provisionKey, publicKeyFor } from "./keys";
-import { PRIVATE_KEY_VAR, SECRETS_FILE, committedPublicKeyInto, declaredSecretNames, initSecrets } from "./secrets";
-
-/**
- * `vc link` — the one manual step, done once, from the terminal.
- *
- * ── What this is for ─────────────────────────────────────────────────────
- *
- * The goal is that publishing to GitHub is the whole deploy. Everything
- * else in voidcommerce gets there: the app is generated from the manifest,
- * the secrets are committed as ciphertext, the workflow builds and deploys.
- * One thing cannot be automated away, and it is worth being exact about
- * why.
- *
- * **GitHub cannot mint a Cloudflare credential.** There is no OIDC or
- * workload identity federation between them — the feature request has sat
- * unanswered since 2025, and Cloudflare's own CI guidance still says to
- * store an API token in your CI provider's secrets. The Cloudflare GitHub
- * App does not help: it grants Cloudflare access to the repository, not the
- * repository access to Cloudflare. Something has to authorise creating a
- * database in someone's account, and only Cloudflare can issue that.
- *
- * So exactly one token is typed, once. This command takes it, checks it
- * against the Cloudflare API before trusting it, and puts it in GitHub's
- * encrypted secrets — never on disk, never in a shell profile, never in
- * `~/.wrangler`. After that, `git push` is the deploy, forever.
- *
- * ── What it deliberately does not do ─────────────────────────────────────
- *
- * It does not create the token. That would need a token. The dashboard is
- * the only place a first one can come from, so this prints exactly which
- * permissions to tick and waits.
- */
-
-const TOKEN_SECRET = "CLOUDFLARE_API_TOKEN";
-const ACCOUNT_VAR = "CLOUDFLARE_ACCOUNT_ID";
-
-/** The scopes the deploy actually uses, and why each one is there. */
-const SCOPES: Array<[string, string]> = [
-	["Account · Workers Scripts: Edit", "deploy the worker"],
-	["Account · D1: Edit", "create the database and apply migrations"],
-	["Account · Queues: Edit", "create the order queue"],
-	["Account · Workers KV Storage: Edit", "sessions and caches"],
-	["Account · Workers R2 Storage: Edit", "product images"],
-	["Account · Account Settings: Read", "confirm which account this is"],
-	["Zone · Workers Routes: Edit", "answer on your domain"],
-	["Zone · Zone: Read", "confirm the domain's zone is on this account"],
-	["Zone · DNS: Read", "notice a hostname that already answers, before taking it over"],
-	["User · User Details: Read", "wrangler asks at startup"],
-];
-
-export async function linkCommand(project: Project, args: string[]): Promise<number> {
-	const p = await import("@clack/prompts");
-	const root = project.root;
-	const relink = args.includes("--force");
-
-	p.intro(color.bgCyan(color.black(" vc link ")));
-
-	// 1. gh, logged in, scoped.
-	const auth = await ghAuth(root);
-	if (!auth.ok) {
-		p.cancel(auth.reason ?? "gh is unavailable");
-		return 1;
-	}
-	const slug = await repoSlug(root);
-	if (!slug) {
-		p.cancel(
-			"this checkout has no GitHub repository, and everything below is stored on one.\n\n" +
-				`    ${color.cyan("gh repo create --source=. --private --push")}\n\n` +
-				"  then run `vc link` again.",
-		);
-		return 1;
-	}
-	p.log.success(`${color.green("✓")} ${slug}, as ${auth.user ?? "you"}`);
-
-	// 2. The encryption key. Generated here, stored on the repository, never on disk.
-	const keys = await keyState(project);
-	if (keys.inGitHub && !relink) {
-		p.log.info(`${PRIVATE_KEY_VAR} is already set — leaving it alone (--force replaces it, which orphans ${SECRETS_FILE})`);
-	} else if (keys.inGitHub && relink) {
-		p.log.warn(`--force: replacing ${PRIVATE_KEY_VAR} makes every value in ${SECRETS_FILE} unreadable. Use \`vc keys --rotate\` to re-encrypt instead.`);
-		return 1;
-	} else {
-		// A key parked by `vc keys --init` before this repository existed is
-		// ADOPTED, not replaced: it may already have encrypted the whole shop.
-		const parked = localPrivateKey(root);
-		if (parked) {
-			const sent = await setVariable(root, PRIVATE_KEY_VAR, parked);
-			if (!sent.ok) {
-				p.cancel(`GitHub refused the variable: ${sent.error ?? "unknown error"}`);
-				return 1;
-			}
-			const publicKey = await publicKeyFor(parked);
-			if (publicKey) committedPublicKeyInto(root, publicKey);
-
-			// READ IT BACK before deleting the only other copy. "The write
-			// returned success" is not the same claim as "the key can be
-			// recovered", and it is the second one this file is about to bet
-			// the shop on. If it cannot be read, the local copy stays.
-			const readBack = await getVariable(root, PRIVATE_KEY_VAR);
-			if (readBack !== parked) {
-				p.log.warn(
-					`${color.yellow("!")} ${PRIVATE_KEY_VAR} was written to ${slug} but could not be read back,\n` +
-						`  so ${LOCAL_KEY_FILE} has been LEFT IN PLACE. It is currently the only copy\n` +
-						"  of the key that opens this shop — do not delete it until `vc keys --restore` works.",
-				);
-			} else {
-				rmSync(join(root, LOCAL_KEY_FILE), { force: true });
-				p.log.success(
-					`${color.green("✓")} the key moved to ${slug} and ${LOCAL_KEY_FILE} deleted — verified readable, so \`vc keys --restore\` can bring it back`,
-				);
-			}
-		} else {
-			const made = await provisionKey(project);
-			if (!made.ok) {
-				p.cancel(made.reason);
-				return 1;
-			}
-			committedPublicKeyInto(root, made.publicKey);
-			p.log.success(`${color.green("✓")} ${PRIVATE_KEY_VAR} generated and stored on GitHub; public half in ${SECRETS_FILE}`);
-		}
-	}
-
-	// 3. The Cloudflare token — the one thing that cannot be derived.
-	const existing = await secretNames(root);
-	if (existing.has(TOKEN_SECRET) && !relink) {
-		p.log.info(`${TOKEN_SECRET} is already set — pass --force to replace it`);
-	} else {
-		p.log.step(`A Cloudflare API token, from ${color.cyan("https://dash.cloudflare.com/profile/api-tokens")} → Create Token → Custom token`);
-		console.log(SCOPES.map(([scope, why]) => `      ${scope.padEnd(38)} ${color.dim(why)}`).join("\n"));
-		console.log(
-			color.dim(
-				`\n      The token Cloudflare generates for its own Workers Builds will NOT do:\n` +
-					`      it has no D1 and no Queues permission, so it cannot create the database.\n`,
-			),
-		);
-
-		const token = await p.password({
-			message: "Paste it (nothing is written to disk)",
-			validate: (input) => (input && input.length >= 20 ? undefined : "that is too short to be a Cloudflare token"),
-		});
-		if (p.isCancel(token)) {
-			p.cancel("nothing was stored.");
-			return 1;
-		}
-
-		const spinner = p.spinner();
-		spinner.start("asking Cloudflare whether that token is real");
-		const verified = await verifyCloudflareToken(String(token));
-		if (!verified.ok) {
-			spinner.stop(`${color.red("✗")} Cloudflare rejected it: ${verified.detail}`);
-			p.cancel("nothing was stored.");
-			return 1;
-		}
-		const accounts = await cloudflareAccounts(String(token));
-		spinner.stop(`${color.green("✓")} the token is active and sees ${accounts.length} account${accounts.length === 1 ? "" : "s"}`);
-
-		let accountId = project.manifest.cloudflare?.accountId ?? "";
-		if (accounts.length === 1) {
-			accountId = accounts[0]!.id;
-			p.log.info(`account "${accounts[0]!.name}"`);
-		} else if (accounts.length > 1) {
-			const picked = await p.select({
-				message: "Which account is this shop in?",
-				options: accounts.map((account) => ({ value: account.id, label: account.name, hint: account.id })),
-			});
-			if (p.isCancel(picked)) {
-				p.cancel("nothing was stored.");
-				return 1;
-			}
-			accountId = String(picked);
-		}
-
-		const stored = await setSecret(root, TOKEN_SECRET, String(token));
-		if (!stored.ok) {
-			p.cancel(`GitHub refused the secret: ${stored.error ?? "unknown error"}`);
-			return 1;
-		}
-		p.log.success(`${color.green("✓")} ${TOKEN_SECRET} stored on ${slug}`);
-
-		if (accountId) {
-			// A VARIABLE, not a secret: an account id is an identifier, and a
-			// readable one is easier to debug in a workflow log.
-			const varred = await setVariable(root, ACCOUNT_VAR, accountId);
-			if (varred.ok) p.log.success(`${color.green("✓")} ${ACCOUNT_VAR} set as a repository variable`);
-			project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId };
-			await writeManifest(root, project.manifest);
-		}
-	}
-
-	// 4. The shop's own secrets, so `vc link` leaves a repository that is
-	// ready rather than one that is half-configured.
-	if (declaredSecretNames(root).size === 0) {
-		p.log.step(`writing ${SECRETS_FILE}`);
-		await initSecrets(project);
-	}
-
-	// 5. What is left.
-	const secrets = await secretNames(root);
-	const vars = await variableNames(root);
-	p.outro(
-		[
-			`${color.bold("Ready.")} From here, ${color.cyan("git push")} is the deploy.`,
-			"",
-			`  ${secrets.has(PRIVATE_KEY_VAR) ? color.green("✓") : color.red("✗")} ${PRIVATE_KEY_VAR}   ${color.dim("reads the shop's secrets")}`,
-			`  ${secrets.has(TOKEN_SECRET) ? color.green("✓") : color.red("✗")} ${TOKEN_SECRET}      ${color.dim("deploys to Cloudflare")}`,
-			`  ${vars.has(ACCOUNT_VAR) ? color.green("✓") : color.dim("·")} ${ACCOUNT_VAR}     ${color.dim("which account")}`,
-			"",
-			`  Set the shop's own secrets with ${color.cyan("vc secrets set KEY")} — that needs no`,
-			`  credential at all, because encryption uses the public key in the repository.`,
-		].join("\n"),
-	);
-	return 0;
-}

package/src/deploy/publish.ts

@@ -1,145 +0,0 @@
-import { existsSync } from "node:fs";
-import { join } from "node:path";
-import color from "picocolors";
-import type { Project } from "../project";
-import { findGh, ghAuth, repoSlug, run } from "./github";
-import { linkCommand } from "./link";
-
-/**
- * `vc publish` — make the repository, give it what it needs, push.
- *
- * ── Why this exists ──────────────────────────────────────────────────────
- *
- * The goal was always "publishing to GitHub is the deploy". `vc link` sat in
- * front of that as a separate step, and it is worth being exact about what
- * it was actually for, because two of its three jobs never needed a person:
- *
- *   DOTENV_PRIVATE_KEY_SECRETS   vc already holds it — automatic
- *   CLOUDFLARE_ACCOUNT_ID        it is in the manifest — automatic
- *   CLOUDFLARE_API_TOKEN         exists only in Cloudflare's dashboard
- *
- * Only the third needs a human, and it cannot be removed: there is no OIDC
- * or workload identity federation from GitHub to the Cloudflare API, so
- * something has to carry a token across, and only a person can fetch one.
- * Everything else is ceremony that a command can do.
- *
- * So this is the one command. It creates the repository, sets all three,
- * and pushes — and the push is what deploys. After it, `git push` is the
- * whole loop forever, and `vc` is only needed to read or change a secret.
- *
- * ── The order matters ────────────────────────────────────────────────────
- *
- * The repository is created WITHOUT pushing, the credentials go on, and only
- * then does the push happen. `gh repo create --push` would put main there
- * first, which starts a deploy against a repository that has no key and no
- * token — a red run, an email, and a shop that did not deploy, for no
- * reason other than doing two things in the wrong order.
- */
-
-export async function publishCommand(project: Project, args: string[]): Promise<number> {
-	const p = await import("@clack/prompts");
-	const root = project.root;
-	const gh = findGh();
-
-	p.intro(color.bgCyan(color.black(" vc publish ")));
-
-	const auth = await ghAuth(root);
-	if (!auth.ok || !gh) {
-		p.cancel(auth.reason ?? "the GitHub CLI is not installed. https://cli.github.com");
-		return 1;
-	}
-	if (!existsSync(join(root, ".git"))) {
-		p.cancel(`${root} is not a git repository. \`git init\` first, and commit what you have.`);
-		return 1;
-	}
-
-	// 1. The repository. Created without pushing: see above.
-	let slug = await repoSlug(root);
-	if (slug) {
-		p.log.info(`${slug} already exists — using it`);
-	} else {
-		const suggested = project.manifest.shop.domain.split(".")[0] ?? "shop";
-		const name = await p.text({
-			message: "Repository name",
-			initialValue: suggested,
-			validate: (value) => (/^[A-Za-z0-9._-]+$/.test(value.trim()) ? undefined : "letters, digits, dot, dash or underscore"),
-		});
-		if (p.isCancel(name)) {
-			p.cancel("nothing was created.");
-			return 1;
-		}
-		// PRIVATE by default and deliberately: the encryption key becomes a
-		// repository variable, so anyone who can read this repository can
-		// decrypt its secrets.
-		const visibility = await p.select({
-			message: "Visibility",
-			options: [
-				{ value: "--private", label: "Private", hint: "the key that opens your secrets is readable to anyone with access" },
-				{ value: "--public", label: "Public", hint: "only if this shop keeps no secrets at all" },
-			],
-			initialValue: "--private",
-		});
-		if (p.isCancel(visibility)) {
-			p.cancel("nothing was created.");
-			return 1;
-		}
-
-		const spinner = p.spinner();
-		spinner.start(`creating ${String(name)}`);
-		const created = await run(gh, ["repo", "create", String(name).trim(), "--source=.", String(visibility)], root);
-		if (created.code !== 0) {
-			spinner.stop(`${color.red("✗")} could not create it`);
-			p.cancel(created.out.trim().split("\n").slice(-2).join(" "));
-			return 1;
-		}
-		slug = await repoSlug(root);
-		spinner.stop(`${color.green("✓")} ${slug ?? String(name)} created, and set as origin`);
-	}
-
-	// 2. The credentials. Two are automatic; one is asked for.
-	p.log.step("giving the repository what the deploy needs");
-	const linked = await linkCommand(project, args);
-	if (linked !== 0) {
-		p.cancel("the repository exists but is not configured, so a push would not deploy. Fix the above and run `vc publish` again.");
-		return 1;
-	}
-
-	// 3. Anything `vc link` wrote — the public key, a fresh .env.secrets, the
-	// pinned account id — has to be IN the push, or the deploy reads a
-	// repository that disagrees with the one on this machine.
-	const dirty = (await run("git", ["status", "--porcelain"], root)).out.trim();
-	if (dirty) {
-		const staged = await run("git", ["add", "-A"], root);
-		const committed = await run("git", ["commit", "-m", "vc publish: link this shop to its repository"], root);
-		if (staged.code !== 0 || committed.code !== 0) {
-			p.cancel(`could not commit the changes vc link made:\n${committed.out.trim().split("\n").slice(-3).join("\n")}`);
-			return 1;
-		}
-		p.log.success(`${color.green("✓")} committed what linking changed`);
-	}
-
-	// 4. Push. This is the deploy.
-	const branch = (await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], root)).out.trim() || "main";
-	const spinner = p.spinner();
-	spinner.start(`pushing ${branch}`);
-	const pushed = await run("git", ["push", "-u", "origin", `${branch}:main`], root);
-	if (pushed.code !== 0) {
-		spinner.stop(`${color.red("✗")} the push failed`);
-		p.cancel(pushed.out.trim().split("\n").slice(-4).join("\n"));
-		return 1;
-	}
-	spinner.stop(`${color.green("✓")} pushed to main`);
-
-	p.outro(
-		[
-			`${color.bold("Published.")} The deploy is running now.`,
-			"",
-			`  ${color.cyan(`https://github.com/${slug}/actions`)}`,
-			"",
-			`  From here ${color.cyan("git push")} is the whole loop. \`vc\` is only needed to`,
-			`  change a secret (${color.cyan("vc secrets set KEY")}) or read one back`,
-			`  (${color.cyan("vc keys --restore")}).`,
-		].join("\n"),
-	);
-	return 0;
-}