@saastemly/voidcommerce 0.19.0 → 0.20.0

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-y4dk27kf.js";
+} from "./index-07ppzmgt.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -35,7 +35,7 @@ import {
   plaintextSecretNames,
   run,
   secretsCommand
-} from "./index-68m1eg3f.js";
+} from "./index-vpcnasre.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -46,6 +46,7 @@ import {
 import {
   GROUPS
 } from "./index-xyjhy6kp.js";
+import"./index-6e4eh08g.js";
 import"./index-0v6na3yp.js";
 
 // src/deploy/index.ts
@@ -132,8 +133,8 @@ async function deployHelp() {
     ...row("CLOUDFLARE_API_TOKEN", "in the environment; the account is pinned for you when there is one", width, 2),
     ...row(PRIVATE_KEY_VAR, "to decrypt the shop's own secrets", width, 2),
     line("", width),
-    line("Normally neither is on your machine: `vc link` puts both on the GitHub", width),
-    line("repository and the workflow runs this command for you on every push.", width)
+    line("Normally neither is on your machine: both are ordinary secrets in", width),
+    line(".env.secrets, and the deploy reads them out of what you pushed.", width)
   ], width);
   if (captured)
     process.stdout.write(captured.out.replace(/\n*$/, `

package/dist/deploy/keys.d.ts

@@ -56,8 +56,8 @@ import type { Project } from "../project";
  * secrets long before anyone has made a GitHub repo to put the private half
  * on. Refusing to make a key until then would block exactly that, so
  * `vc keys --init` will write one here instead — 0600, gitignored, and
- * TEMPORARY: `vc link` uploads this key to the repository and deletes the
- * file, which is how the end state stays "no private key on disk".
+ * TEMPORARY: once the repository exists, the key is set on it as a variable
+ * and this file can go — `vc keys --restore` brings it back when needed.
  */
 export declare const LOCAL_KEY_FILE = ".env.keys";
 /** The private key parked locally, if there is one. */

package/dist/deploy/token-link.d.ts

@@ -0,0 +1,15 @@
+import type { Manifest } from "../manifest";
+/**
+ * The link, for this shop.
+ *
+ * The USER-token form, deliberately: it is the one that accepts the two
+ * user-scoped permissions wrangler wants, and account-owned tokens are
+ * documented as not taking `accountId`/`zoneId` at all. `zoneId=all` because
+ * a shop's zone is not known until the domain is on Cloudflare, and picking
+ * the wrong one is a worse failure than picking from a list.
+ */
+export declare function cloudflareTokenLink(manifest: Manifest): string;
+/** The same permissions as a table, for anyone who would rather tick them. */
+export declare function cloudflareTokenTable(): string;
+/** Markdown, for DEPLOY.md. */
+export declare function cloudflareTokenMarkdown(): string;

package/dist/generate/ci.d.ts

@@ -20,10 +20,10 @@ import type { Manifest } from "../manifest";
  * Worker that has to exist first.
  *
  * GitHub already has what is needed. A person who can push is logged into
- * `gh`, and `gh` can write repository secrets from the terminal — so
- * `vc link` puts the key and the token there in one command, and this
- * workflow spends them. Nothing is typed into a web page except the token
- * itself, once, because Cloudflare will not issue one any other way.
+ * `gh`, and `gh` can write repository variables from the terminal — so the
+ * one key that opens `.env.secrets` is set there when the key is made, and
+ * this workflow spends it. Nothing else is configured outside the
+ * repository: the Cloudflare credentials are ordinary secrets in that file.
  *
  * ── The `void-dist` branch is still built ────────────────────────────────
  *

package/dist/{index-y4dk27kf.js → index-07ppzmgt.js}

@@ -13,7 +13,7 @@ import {
   renderEnvTs,
   secretValue,
   unsetSecretNames
-} from "./index-68m1eg3f.js";
+} from "./index-vpcnasre.js";
 import {
   MANIFEST_FILE,
   has,
@@ -30,6 +30,9 @@ import {
 import {
   CHOICES
 } from "./index-xyjhy6kp.js";
+import {
+  cloudflareTokenMarkdown
+} from "./index-6e4eh08g.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -1380,7 +1383,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.19.0",
+  version: "0.20.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1859,6 +1862,7 @@ jobs:
 }
 function renderDeployReadme(manifest, zone2, hosts) {
   const worker = manifest.shop.domain.split(".")[0];
+  const TOKEN_TABLE = cloudflareTokenMarkdown();
   return `# Going live
 
 \`${manifest.shop.domain}\` on Cloudflare Workers. Generated by \`vc init\`;
@@ -1913,8 +1917,17 @@ ordinary secret in \`${SECRETS_FILE}\`: encrypted, committed, and read by the
 deploy out of what you pushed.
 
 The token itself has to be fetched by a person, once, because there is no
-OIDC between GitHub and Cloudflare and nothing else can issue one. Create it
-at **My Profile → API Tokens → Create Token → Custom token**:
+OIDC between GitHub and Cloudflare and nothing else can issue one. You do
+not have to find the permissions yourself:
+
+\`\`\`sh
+vc secrets set CLOUDFLARE_API_TOKEN
+\`\`\`
+
+prints a Cloudflare link with all of them **already selected**, then takes
+the token. It opens your own dashboard and the value is shown only to you.
+
+${TOKEN_TABLE}
 
 ### The zone
 
@@ -1987,7 +2000,8 @@ Point Workers Builds at the \`${DIST_BRANCH}\` branch — it is a plain Void app
 a committed lockfile. The Worker must be named \`${worker}\`, matching the \`name\`
 in its \`wrangler.jsonc\`. You will need to set \`${PRIVATE_KEY_VAR}\` as a
 build secret in the dashboard, and replace the auto-generated API token with
-one that has D1 and Queues. That is the path \`vc link\` exists to avoid.
+one that has D1 and Queues — three dashboard visits, which is exactly what
+the GitHub Actions path above exists to avoid.
 `;
 }
 

package/dist/index-6e4eh08g.js

@@ -0,0 +1,35 @@
+// src/deploy/token-link.ts
+var PERMISSIONS = [
+  ["Workers Scripts: Edit", "workers_scripts", "edit", "deploy the worker"],
+  ["D1: Edit", "d1", "edit", "create the database and apply migrations"],
+  ["Queues: Edit", "queues", "edit", "create the order queue"],
+  ["Workers KV Storage: Edit", "workers_kv_storage", "edit", "sessions and caches"],
+  ["Workers R2 Storage: Edit", "workers_r2", "edit", "product images"],
+  ["Account Settings: Read", "account_settings", "read", "confirm which account this is"],
+  ["Zone: Read", "zone", "read", "confirm the domain's zone is on this account"],
+  ["DNS: Read", "dns", "read", "notice a hostname that already answers"],
+  ["Workers Routes: Edit", "workers_routes", "edit", "answer on your domain"],
+  ["User Details: Read", "user_details", "read", "wrangler asks at startup"],
+  ["Memberships: Read", "memberships", "read", "the same"]
+];
+function cloudflareTokenLink(manifest) {
+  const groups = PERMISSIONS.map(([, key, type]) => ({ key, type }));
+  const params = new URLSearchParams({
+    permissionGroupKeys: JSON.stringify(groups),
+    accountId: "*",
+    zoneId: "all",
+    name: `${manifest.shop.domain} deploy`
+  });
+  return `https://dash.cloudflare.com/profile/api-tokens?${params.toString()}`;
+}
+function cloudflareTokenTable() {
+  const width = Math.max(...PERMISSIONS.map(([label]) => label.length));
+  return PERMISSIONS.map(([label, , , why]) => `  ${label.padEnd(width)}  ${why}`).join(`
+`);
+}
+function cloudflareTokenMarkdown() {
+  return ["| permission | for |", "|---|---|", ...PERMISSIONS.map(([label, , , why]) => `| ${label} | ${why} |`)].join(`
+`);
+}
+
+export { cloudflareTokenLink, cloudflareTokenTable, cloudflareTokenMarkdown };

package/dist/{index-68m1eg3f.js → index-vpcnasre.js}

@@ -370,7 +370,7 @@ async function decryptSecrets(project) {
   const root = project.root;
   if (!existsSync2(join2(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const { localPrivateKey } = await import("./keys-e6w5dcxx.js");
+  const { localPrivateKey } = await import("./keys-fbw9fdby.js");
   const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
   if (!privateKey) {
     return {
@@ -382,7 +382,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-e6w5dcxx.js");
+    const { publicKeyFor } = await import("./keys-fbw9fdby.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -548,6 +548,17 @@ vc: ${SECRETS_FILE} has no DOTENV_PUBLIC_KEY_SECRETS, so there is nothing to enc
     return 1;
   }
   const known = allEnvKeys(project.manifest).find((key) => key.key === name);
+  if (name === "CLOUDFLARE_API_TOKEN") {
+    const { cloudflareTokenLink, cloudflareTokenTable } = await import("./token-link-wxpp5xzp.js");
+    console.log(`
+${color.bold("Open this — the permissions are already selected:")}
+
+  ${color.cyan(cloudflareTokenLink(project.manifest))}
+
+${color.dim("It opens your own dashboard; the token is shown only to you. What it grants:")}
+${color.dim(cloudflareTokenTable())}
+`);
+  }
   const value = await readValue(name, known?.breaks, known?.where);
   if (value === null)
     return 1;
@@ -852,10 +863,10 @@ Secrets are encrypted with a public key that is COMMITTED, and read with a`);
   console.log(`private key that lives only in GitHub Actions.
 `);
   const hasFile = existsSync3(join3(project.root, SECRETS_FILE));
-  const publicNote = state.publicKey ? `${state.publicKey.slice(0, 20)}… in ${SECRETS_FILE}` : color2.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc link\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
+  const publicNote = state.publicKey ? `${state.publicKey.slice(0, 20)}… in ${SECRETS_FILE}` : color2.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc keys --init\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
   console.log(`  ${state.publicKey ? color2.green("✓") : color2.dim("·")} public key   ${publicNote}`);
   const parked = localPrivateKey(project.root) !== null;
-  console.log(`  ${state.inGitHub || parked ? color2.green("✓") : color2.red("✗")} private key  ${state.inGitHub ? `${PRIVATE_KEY_VAR} is set on ${state.slug}` : parked ? color2.yellow(`waiting in ${LOCAL_KEY_FILE} — \`vc link\` moves it to GitHub and deletes it`) : state.slug ? color2.red(`not set on ${state.slug} — \`vc keys --init\``) : color2.dim("no key yet — `vc keys --init`")}`);
+  console.log(`  ${state.inGitHub || parked ? color2.green("✓") : color2.red("✗")} private key  ${state.inGitHub ? `${PRIVATE_KEY_VAR} is set on ${state.slug}` : parked ? color2.yellow(`waiting in ${LOCAL_KEY_FILE} — create the repository, then \`vc keys --init\` puts it there`) : state.slug ? color2.red(`not set on ${state.slug} — \`vc keys --init\``) : color2.dim("no key yet — `vc keys --init`")}`);
   if (state.mismatch) {
     console.error(`
 ${color2.red("✗")} ${state.mismatch}
@@ -893,8 +904,8 @@ vc: ${made.reason}
 ${color2.green("✓")} key made; public half in ${SECRETS_FILE}, private half waiting in ${LOCAL_KEY_FILE}
 
 ` + color2.yellow(`  ${LOCAL_KEY_FILE} is TEMPORARY. It is gitignored, but it is the one file that
-  opens every secret in this shop. \`vc link\` moves it onto the GitHub
-` + `  repository and deletes it — do that as soon as the repository exists.
+  opens every secret in this shop. Once the repository exists it is set
+  there as a variable, and this file can go.
 `) + (fresh ? `
   Next: ${color2.cyan("vc secrets --init")} fills in the keys this shop needs.
 ` : "") : `

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-y4dk27kf.js";
+} from "./index-07ppzmgt.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-68m1eg3f.js";
+} from "./index-vpcnasre.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -99,6 +99,7 @@ import {
   TAX,
   UI
 } from "./index-xyjhy6kp.js";
+import"./index-6e4eh08g.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/dist/{keys-e6w5dcxx.js → keys-fbw9fdby.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-68m1eg3f.js";
+} from "./index-vpcnasre.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/dist/token-link-wxpp5xzp.js

@@ -0,0 +1,11 @@
+import {
+  cloudflareTokenLink,
+  cloudflareTokenMarkdown,
+  cloudflareTokenTable
+} from "./index-6e4eh08g.js";
+import"./index-0v6na3yp.js";
+export {
+  cloudflareTokenTable,
+  cloudflareTokenMarkdown,
+  cloudflareTokenLink
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/deploy/index.ts

@@ -115,8 +115,8 @@ export async function deployHelp(): Promise<number> {
 		...row("CLOUDFLARE_API_TOKEN", "in the environment; the account is pinned for you when there is one", width, 2),
 		...row(PRIVATE_KEY_VAR, "to decrypt the shop's own secrets", width, 2),
 		line("", width),
-		line("Normally neither is on your machine: `vc link` puts both on the GitHub", width),
-		line("repository and the workflow runs this command for you on every push.", width),
+		line("Normally neither is on your machine: both are ordinary secrets in", width),
+		line(".env.secrets, and the deploy reads them out of what you pushed.", width),
 	], width);
 	if (captured) process.stdout.write(captured.out.replace(/\n*$/, "\n"));
 	console.log(ours);

package/src/deploy/keys.ts

@@ -63,8 +63,8 @@ import { PRIVATE_KEY_VAR, SECRETS_FILE, committedPublicKeyInto, findDotenvx, run
  * secrets long before anyone has made a GitHub repo to put the private half
  * on. Refusing to make a key until then would block exactly that, so
  * `vc keys --init` will write one here instead — 0600, gitignored, and
- * TEMPORARY: `vc link` uploads this key to the repository and deletes the
- * file, which is how the end state stays "no private key on disk".
+ * TEMPORARY: once the repository exists, the key is set on it as a variable
+ * and this file can go — `vc keys --restore` brings it back when needed.
  */
 export const LOCAL_KEY_FILE = ".env.keys";
 
@@ -260,7 +260,7 @@ export async function keysCommand(project: Project, args: string[]): Promise<num
 	const hasFile = existsSync(join(project.root, SECRETS_FILE));
 	const publicNote = state.publicKey
 		? `${state.publicKey.slice(0, 20)}… in ${SECRETS_FILE}`
-		: color.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc link\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
+		: color.dim(hasFile ? `${SECRETS_FILE} has no key yet — \`vc keys --init\` makes one` : `no ${SECRETS_FILE} yet — \`vc secrets --init\``);
 	console.log(`  ${state.publicKey ? color.green("✓") : color.dim("·")} public key   ${publicNote}`);
 	const parked = localPrivateKey(project.root) !== null;
 	console.log(
@@ -268,7 +268,7 @@ export async function keysCommand(project: Project, args: string[]): Promise<num
 			state.inGitHub
 				? `${PRIVATE_KEY_VAR} is set on ${state.slug}`
 				: parked
-					? color.yellow(`waiting in ${LOCAL_KEY_FILE} — \`vc link\` moves it to GitHub and deletes it`)
+					? color.yellow(`waiting in ${LOCAL_KEY_FILE} — create the repository, then \`vc keys --init\` puts it there`)
 					: state.slug
 						? color.red(`not set on ${state.slug} — \`vc keys --init\``)
 						: color.dim("no key yet — `vc keys --init`")
@@ -315,8 +315,8 @@ async function initKey(project: Project): Promise<number> {
 			? `\n${color.green("✓")} key made; public half in ${SECRETS_FILE}, private half waiting in ${LOCAL_KEY_FILE}\n\n` +
 					color.yellow(
 						`  ${LOCAL_KEY_FILE} is TEMPORARY. It is gitignored, but it is the one file that\n` +
-							`  opens every secret in this shop. \`vc link\` moves it onto the GitHub\n` +
-							"  repository and deletes it — do that as soon as the repository exists.\n",
+							`  opens every secret in this shop. Once the repository exists it is set\n` +
+							"  there as a variable, and this file can go.\n",
 					) +
 					(fresh ? `\n  Next: ${color.cyan("vc secrets --init")} fills in the keys this shop needs.\n` : "")
 			: `\n${color.green("✓")} ${PRIVATE_KEY_VAR} set on ${state.slug}; public key in ${SECRETS_FILE}\n` +

package/src/deploy/secrets.ts

@@ -318,7 +318,7 @@ export async function secretsCommand(project: Project, args: string[]): Promise<
 export async function initSecrets(project: Project): Promise<number> {
 	const path = join(project.root, SECRETS_FILE);
 
-	// `vc link` leaves a file holding nothing but the public key, so "exists"
+	// `vc keys --init` leaves a file holding nothing but the public key, so "exists"
 	// is not the same as "is already set up". Refusing on existence alone
 	// stranded anyone who linked first, which is the order the docs recommend.
 	if (existsSync(path) && declaredSecretNames(project.root).size > 0) {
@@ -405,6 +405,21 @@ export async function setSecretValue(project: Project, args: string[]): Promise<
 	// A known key gets its consequence shown, so a person setting one knows
 	// what it is for without leaving the terminal.
 	const known = allEnvKeys(project.manifest).find((key) => key.key === name);
+
+	// The one key whose "where" is ten checkboxes in a dashboard. Cloudflare
+	// takes the permissions as URL parameters, so this opens the form with all
+	// of them already ticked — which removes the failure where one missed row
+	// yields a token that authenticates and then fails mid-deploy.
+	if (name === "CLOUDFLARE_API_TOKEN") {
+		const { cloudflareTokenLink, cloudflareTokenTable } = await import("./token-link");
+		console.log(
+			`\n${color.bold("Open this — the permissions are already selected:")}\n\n` +
+				`  ${color.cyan(cloudflareTokenLink(project.manifest))}\n\n` +
+				`${color.dim("It opens your own dashboard; the token is shown only to you. What it grants:")}\n` +
+				`${color.dim(cloudflareTokenTable())}\n`,
+		);
+	}
+
 	const value = await readValue(name, known?.breaks, known?.where);
 	if (value === null) return 1;
 

package/src/deploy/token-link.ts

@@ -0,0 +1,76 @@
+import type { Manifest } from "../manifest";
+
+/**
+ * A Cloudflare dashboard link that opens the token form already filled in.
+ *
+ * ── Why this is worth having ─────────────────────────────────────────────
+ *
+ * Fetching an API token is the one step of this whole system that a person
+ * has to do by hand, and it was the worst-designed one: a table of ten
+ * permissions to find and tick, in two different scopes, where a single
+ * missed row produces a token that authenticates fine and then fails
+ * halfway through a deploy with a permissions error nobody can place.
+ *
+ * Cloudflare's dashboard accepts `permissionGroupKeys` — a JSON array of
+ * `{key, type}` — and opens Create Token with exactly those selected. So the
+ * ten rows become one link, and the failure mode goes away.
+ *
+ * @see https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/
+ *
+ * ── On the keys below ────────────────────────────────────────────────────
+ *
+ * They are not guessable and a wrong one is silently dropped, which would
+ * produce a link that looks right and grants less than it claims. Every one
+ * was checked against the dashboard's own permission-group registry AND
+ * against links Cloudflare itself ships in its documentation — the Workers
+ * template, the DNS templates, the Prometheus link. None came from a
+ * third-party repository guessing at them, and several public repositories
+ * do guess: `account`, `user`, `workers`, `pages` match nothing at all.
+ */
+
+/** `[label, key, type, why]` — the why is what a person reads when it fails. */
+const PERMISSIONS: Array<[string, string, string, string]> = [
+	["Workers Scripts: Edit", "workers_scripts", "edit", "deploy the worker"],
+	["D1: Edit", "d1", "edit", "create the database and apply migrations"],
+	["Queues: Edit", "queues", "edit", "create the order queue"],
+	["Workers KV Storage: Edit", "workers_kv_storage", "edit", "sessions and caches"],
+	["Workers R2 Storage: Edit", "workers_r2", "edit", "product images"],
+	["Account Settings: Read", "account_settings", "read", "confirm which account this is"],
+	["Zone: Read", "zone", "read", "confirm the domain's zone is on this account"],
+	["DNS: Read", "dns", "read", "notice a hostname that already answers"],
+	["Workers Routes: Edit", "workers_routes", "edit", "answer on your domain"],
+	["User Details: Read", "user_details", "read", "wrangler asks at startup"],
+	["Memberships: Read", "memberships", "read", "the same"],
+];
+
+/**
+ * The link, for this shop.
+ *
+ * The USER-token form, deliberately: it is the one that accepts the two
+ * user-scoped permissions wrangler wants, and account-owned tokens are
+ * documented as not taking `accountId`/`zoneId` at all. `zoneId=all` because
+ * a shop's zone is not known until the domain is on Cloudflare, and picking
+ * the wrong one is a worse failure than picking from a list.
+ */
+export function cloudflareTokenLink(manifest: Manifest): string {
+	const groups = PERMISSIONS.map(([, key, type]) => ({ key, type }));
+	const params = new URLSearchParams({
+		permissionGroupKeys: JSON.stringify(groups),
+		accountId: "*",
+		zoneId: "all",
+		// So a person with several tokens can tell later which shop this was for.
+		name: `${manifest.shop.domain} deploy`,
+	});
+	return `https://dash.cloudflare.com/profile/api-tokens?${params.toString()}`;
+}
+
+/** The same permissions as a table, for anyone who would rather tick them. */
+export function cloudflareTokenTable(): string {
+	const width = Math.max(...PERMISSIONS.map(([label]) => label.length));
+	return PERMISSIONS.map(([label, , , why]) => `  ${label.padEnd(width)}  ${why}`).join("\n");
+}
+
+/** Markdown, for DEPLOY.md. */
+export function cloudflareTokenMarkdown(): string {
+	return ["| permission | for |", "|---|---|", ...PERMISSIONS.map(([label, , , why]) => `| ${label} | ${why} |`)].join("\n");
+}

package/src/generate/ci.ts

@@ -1,6 +1,7 @@
 import { DIST_BRANCH, DIST_DIR } from "../dist";
 import type { Manifest } from "../manifest";
 import { PRIVATE_KEY_VAR, SECRETS_FILE } from "../deploy/secrets";
+import { cloudflareTokenMarkdown } from "../deploy/token-link";
 
 /**
  * The workflow that turns a push into a live shop.
@@ -23,10 +24,10 @@ import { PRIVATE_KEY_VAR, SECRETS_FILE } from "../deploy/secrets";
  * Worker that has to exist first.
  *
  * GitHub already has what is needed. A person who can push is logged into
- * `gh`, and `gh` can write repository secrets from the terminal — so
- * `vc link` puts the key and the token there in one command, and this
- * workflow spends them. Nothing is typed into a web page except the token
- * itself, once, because Cloudflare will not issue one any other way.
+ * `gh`, and `gh` can write repository variables from the terminal — so the
+ * one key that opens `.env.secrets` is set there when the key is made, and
+ * this workflow spends it. Nothing else is configured outside the
+ * repository: the Cloudflare credentials are ordinary secrets in that file.
  *
  * ── The `void-dist` branch is still built ────────────────────────────────
  *
@@ -190,6 +191,7 @@ jobs:
 /** What a person still has to do once, and why each thing cannot be done for them. */
 export function renderDeployReadme(manifest: Manifest, zone: string, hosts: string[]): string {
 	const worker = manifest.shop.domain.split(".")[0];
+	const TOKEN_TABLE = cloudflareTokenMarkdown();
 	return `# Going live
 
 \`${manifest.shop.domain}\` on Cloudflare Workers. Generated by \`vc init\`;
@@ -244,8 +246,17 @@ ordinary secret in \`${SECRETS_FILE}\`: encrypted, committed, and read by the
 deploy out of what you pushed.
 
 The token itself has to be fetched by a person, once, because there is no
-OIDC between GitHub and Cloudflare and nothing else can issue one. Create it
-at **My Profile → API Tokens → Create Token → Custom token**:
+OIDC between GitHub and Cloudflare and nothing else can issue one. You do
+not have to find the permissions yourself:
+
+\`\`\`sh
+vc secrets set CLOUDFLARE_API_TOKEN
+\`\`\`
+
+prints a Cloudflare link with all of them **already selected**, then takes
+the token. It opens your own dashboard and the value is shown only to you.
+
+${TOKEN_TABLE}
 
 ### The zone
 
@@ -318,6 +329,7 @@ Point Workers Builds at the \`${DIST_BRANCH}\` branch — it is a plain Void app
 a committed lockfile. The Worker must be named \`${worker}\`, matching the \`name\`
 in its \`wrangler.jsonc\`. You will need to set \`${PRIVATE_KEY_VAR}\` as a
 build secret in the dashboard, and replace the auto-generated API token with
-one that has D1 and Queues. That is the path \`vc link\` exists to avoid.
+one that has D1 and Queues — three dashboard visits, which is exactly what
+the GitHub Actions path above exists to avoid.
 `;
 }

package/src/generate/env.ts

@@ -16,8 +16,8 @@ const BASE: EnvKey[] = [
 	/**
 	 * The Cloudflare credentials are ORDINARY SECRETS, deliberately.
 	 *
-	 * They used to be set on the GitHub repository by a `vc link` step, which
-	 * existed only because they were treated as special. They are not: they
+	 * They used to be set on the GitHub repository by a separate linking step,
+	 * which existed only because they were treated as special. They are not: they
 	 * are two more values this shop needs, they belong in `.env.secrets` with
 	 * everything else, and they are set the same way — `vc secrets set`.
 	 *