@saastemly/voidcommerce 0.19.1 → 0.20.0

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-tk46w7yn.js";
+} from "./index-07ppzmgt.js";
 import {
   LOCAL_KEY_FILE,
   PRIVATE_KEY_VAR,
@@ -35,7 +35,7 @@ import {
   plaintextSecretNames,
   run,
   secretsCommand
-} from "./index-hsc97bf2.js";
+} from "./index-vpcnasre.js";
 import {
   LAYOUTS,
   oneOrigin,
@@ -46,6 +46,7 @@ import {
 import {
   GROUPS
 } from "./index-xyjhy6kp.js";
+import"./index-6e4eh08g.js";
 import"./index-0v6na3yp.js";
 
 // src/deploy/index.ts

package/dist/deploy/token-link.d.ts

@@ -0,0 +1,15 @@
+import type { Manifest } from "../manifest";
+/**
+ * The link, for this shop.
+ *
+ * The USER-token form, deliberately: it is the one that accepts the two
+ * user-scoped permissions wrangler wants, and account-owned tokens are
+ * documented as not taking `accountId`/`zoneId` at all. `zoneId=all` because
+ * a shop's zone is not known until the domain is on Cloudflare, and picking
+ * the wrong one is a worse failure than picking from a list.
+ */
+export declare function cloudflareTokenLink(manifest: Manifest): string;
+/** The same permissions as a table, for anyone who would rather tick them. */
+export declare function cloudflareTokenTable(): string;
+/** Markdown, for DEPLOY.md. */
+export declare function cloudflareTokenMarkdown(): string;

package/dist/{index-tk46w7yn.js → index-07ppzmgt.js}

@@ -13,7 +13,7 @@ import {
   renderEnvTs,
   secretValue,
   unsetSecretNames
-} from "./index-hsc97bf2.js";
+} from "./index-vpcnasre.js";
 import {
   MANIFEST_FILE,
   has,
@@ -30,6 +30,9 @@ import {
 import {
   CHOICES
 } from "./index-xyjhy6kp.js";
+import {
+  cloudflareTokenMarkdown
+} from "./index-6e4eh08g.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -1380,7 +1383,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.19.1",
+  version: "0.20.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1859,6 +1862,7 @@ jobs:
 }
 function renderDeployReadme(manifest, zone2, hosts) {
   const worker = manifest.shop.domain.split(".")[0];
+  const TOKEN_TABLE = cloudflareTokenMarkdown();
   return `# Going live
 
 \`${manifest.shop.domain}\` on Cloudflare Workers. Generated by \`vc init\`;
@@ -1913,8 +1917,17 @@ ordinary secret in \`${SECRETS_FILE}\`: encrypted, committed, and read by the
 deploy out of what you pushed.
 
 The token itself has to be fetched by a person, once, because there is no
-OIDC between GitHub and Cloudflare and nothing else can issue one. Create it
-at **My Profile → API Tokens → Create Token → Custom token**:
+OIDC between GitHub and Cloudflare and nothing else can issue one. You do
+not have to find the permissions yourself:
+
+\`\`\`sh
+vc secrets set CLOUDFLARE_API_TOKEN
+\`\`\`
+
+prints a Cloudflare link with all of them **already selected**, then takes
+the token. It opens your own dashboard and the value is shown only to you.
+
+${TOKEN_TABLE}
 
 ### The zone
 

package/dist/index-6e4eh08g.js

@@ -0,0 +1,35 @@
+// src/deploy/token-link.ts
+var PERMISSIONS = [
+  ["Workers Scripts: Edit", "workers_scripts", "edit", "deploy the worker"],
+  ["D1: Edit", "d1", "edit", "create the database and apply migrations"],
+  ["Queues: Edit", "queues", "edit", "create the order queue"],
+  ["Workers KV Storage: Edit", "workers_kv_storage", "edit", "sessions and caches"],
+  ["Workers R2 Storage: Edit", "workers_r2", "edit", "product images"],
+  ["Account Settings: Read", "account_settings", "read", "confirm which account this is"],
+  ["Zone: Read", "zone", "read", "confirm the domain's zone is on this account"],
+  ["DNS: Read", "dns", "read", "notice a hostname that already answers"],
+  ["Workers Routes: Edit", "workers_routes", "edit", "answer on your domain"],
+  ["User Details: Read", "user_details", "read", "wrangler asks at startup"],
+  ["Memberships: Read", "memberships", "read", "the same"]
+];
+function cloudflareTokenLink(manifest) {
+  const groups = PERMISSIONS.map(([, key, type]) => ({ key, type }));
+  const params = new URLSearchParams({
+    permissionGroupKeys: JSON.stringify(groups),
+    accountId: "*",
+    zoneId: "all",
+    name: `${manifest.shop.domain} deploy`
+  });
+  return `https://dash.cloudflare.com/profile/api-tokens?${params.toString()}`;
+}
+function cloudflareTokenTable() {
+  const width = Math.max(...PERMISSIONS.map(([label]) => label.length));
+  return PERMISSIONS.map(([label, , , why]) => `  ${label.padEnd(width)}  ${why}`).join(`
+`);
+}
+function cloudflareTokenMarkdown() {
+  return ["| permission | for |", "|---|---|", ...PERMISSIONS.map(([label, , , why]) => `| ${label} | ${why} |`)].join(`
+`);
+}
+
+export { cloudflareTokenLink, cloudflareTokenTable, cloudflareTokenMarkdown };

package/dist/{index-hsc97bf2.js → index-vpcnasre.js}

@@ -370,7 +370,7 @@ async function decryptSecrets(project) {
   const root = project.root;
   if (!existsSync2(join2(root, SECRETS_FILE)))
     return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const { localPrivateKey } = await import("./keys-knmqsqz1.js");
+  const { localPrivateKey } = await import("./keys-fbw9fdby.js");
   const privateKey = process.env[PRIVATE_KEY_VAR] || localPrivateKey(root) || "";
   if (!privateKey) {
     return {
@@ -382,7 +382,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-knmqsqz1.js");
+    const { publicKeyFor } = await import("./keys-fbw9fdby.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {
@@ -548,6 +548,17 @@ vc: ${SECRETS_FILE} has no DOTENV_PUBLIC_KEY_SECRETS, so there is nothing to enc
     return 1;
   }
   const known = allEnvKeys(project.manifest).find((key) => key.key === name);
+  if (name === "CLOUDFLARE_API_TOKEN") {
+    const { cloudflareTokenLink, cloudflareTokenTable } = await import("./token-link-wxpp5xzp.js");
+    console.log(`
+${color.bold("Open this — the permissions are already selected:")}
+
+  ${color.cyan(cloudflareTokenLink(project.manifest))}
+
+${color.dim("It opens your own dashboard; the token is shown only to you. What it grants:")}
+${color.dim(cloudflareTokenTable())}
+`);
+  }
   const value = await readValue(name, known?.breaks, known?.where);
   if (value === null)
     return 1;

package/dist/index.js

@@ -52,7 +52,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-tk46w7yn.js";
+} from "./index-07ppzmgt.js";
 import {
   allEnvKeys,
   envSummary,
@@ -60,7 +60,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-hsc97bf2.js";
+} from "./index-vpcnasre.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -99,6 +99,7 @@ import {
   TAX,
   UI
 } from "./index-xyjhy6kp.js";
+import"./index-6e4eh08g.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,

package/dist/{keys-knmqsqz1.js → keys-fbw9fdby.js}

@@ -8,7 +8,7 @@ import {
   localPrivateKey,
   provisionKey,
   publicKeyFor
-} from "./index-hsc97bf2.js";
+} from "./index-vpcnasre.js";
 import"./index-30y19qz5.js";
 import"./index-xyjhy6kp.js";
 import"./index-0v6na3yp.js";

package/dist/token-link-wxpp5xzp.js

@@ -0,0 +1,11 @@
+import {
+  cloudflareTokenLink,
+  cloudflareTokenMarkdown,
+  cloudflareTokenTable
+} from "./index-6e4eh08g.js";
+import"./index-0v6na3yp.js";
+export {
+  cloudflareTokenTable,
+  cloudflareTokenMarkdown,
+  cloudflareTokenLink
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/deploy/secrets.ts

@@ -405,6 +405,21 @@ export async function setSecretValue(project: Project, args: string[]): Promise<
 	// A known key gets its consequence shown, so a person setting one knows
 	// what it is for without leaving the terminal.
 	const known = allEnvKeys(project.manifest).find((key) => key.key === name);
+
+	// The one key whose "where" is ten checkboxes in a dashboard. Cloudflare
+	// takes the permissions as URL parameters, so this opens the form with all
+	// of them already ticked — which removes the failure where one missed row
+	// yields a token that authenticates and then fails mid-deploy.
+	if (name === "CLOUDFLARE_API_TOKEN") {
+		const { cloudflareTokenLink, cloudflareTokenTable } = await import("./token-link");
+		console.log(
+			`\n${color.bold("Open this — the permissions are already selected:")}\n\n` +
+				`  ${color.cyan(cloudflareTokenLink(project.manifest))}\n\n` +
+				`${color.dim("It opens your own dashboard; the token is shown only to you. What it grants:")}\n` +
+				`${color.dim(cloudflareTokenTable())}\n`,
+		);
+	}
+
 	const value = await readValue(name, known?.breaks, known?.where);
 	if (value === null) return 1;
 

package/src/deploy/token-link.ts

@@ -0,0 +1,76 @@
+import type { Manifest } from "../manifest";
+
+/**
+ * A Cloudflare dashboard link that opens the token form already filled in.
+ *
+ * ── Why this is worth having ─────────────────────────────────────────────
+ *
+ * Fetching an API token is the one step of this whole system that a person
+ * has to do by hand, and it was the worst-designed one: a table of ten
+ * permissions to find and tick, in two different scopes, where a single
+ * missed row produces a token that authenticates fine and then fails
+ * halfway through a deploy with a permissions error nobody can place.
+ *
+ * Cloudflare's dashboard accepts `permissionGroupKeys` — a JSON array of
+ * `{key, type}` — and opens Create Token with exactly those selected. So the
+ * ten rows become one link, and the failure mode goes away.
+ *
+ * @see https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/
+ *
+ * ── On the keys below ────────────────────────────────────────────────────
+ *
+ * They are not guessable and a wrong one is silently dropped, which would
+ * produce a link that looks right and grants less than it claims. Every one
+ * was checked against the dashboard's own permission-group registry AND
+ * against links Cloudflare itself ships in its documentation — the Workers
+ * template, the DNS templates, the Prometheus link. None came from a
+ * third-party repository guessing at them, and several public repositories
+ * do guess: `account`, `user`, `workers`, `pages` match nothing at all.
+ */
+
+/** `[label, key, type, why]` — the why is what a person reads when it fails. */
+const PERMISSIONS: Array<[string, string, string, string]> = [
+	["Workers Scripts: Edit", "workers_scripts", "edit", "deploy the worker"],
+	["D1: Edit", "d1", "edit", "create the database and apply migrations"],
+	["Queues: Edit", "queues", "edit", "create the order queue"],
+	["Workers KV Storage: Edit", "workers_kv_storage", "edit", "sessions and caches"],
+	["Workers R2 Storage: Edit", "workers_r2", "edit", "product images"],
+	["Account Settings: Read", "account_settings", "read", "confirm which account this is"],
+	["Zone: Read", "zone", "read", "confirm the domain's zone is on this account"],
+	["DNS: Read", "dns", "read", "notice a hostname that already answers"],
+	["Workers Routes: Edit", "workers_routes", "edit", "answer on your domain"],
+	["User Details: Read", "user_details", "read", "wrangler asks at startup"],
+	["Memberships: Read", "memberships", "read", "the same"],
+];
+
+/**
+ * The link, for this shop.
+ *
+ * The USER-token form, deliberately: it is the one that accepts the two
+ * user-scoped permissions wrangler wants, and account-owned tokens are
+ * documented as not taking `accountId`/`zoneId` at all. `zoneId=all` because
+ * a shop's zone is not known until the domain is on Cloudflare, and picking
+ * the wrong one is a worse failure than picking from a list.
+ */
+export function cloudflareTokenLink(manifest: Manifest): string {
+	const groups = PERMISSIONS.map(([, key, type]) => ({ key, type }));
+	const params = new URLSearchParams({
+		permissionGroupKeys: JSON.stringify(groups),
+		accountId: "*",
+		zoneId: "all",
+		// So a person with several tokens can tell later which shop this was for.
+		name: `${manifest.shop.domain} deploy`,
+	});
+	return `https://dash.cloudflare.com/profile/api-tokens?${params.toString()}`;
+}
+
+/** The same permissions as a table, for anyone who would rather tick them. */
+export function cloudflareTokenTable(): string {
+	const width = Math.max(...PERMISSIONS.map(([label]) => label.length));
+	return PERMISSIONS.map(([label, , , why]) => `  ${label.padEnd(width)}  ${why}`).join("\n");
+}
+
+/** Markdown, for DEPLOY.md. */
+export function cloudflareTokenMarkdown(): string {
+	return ["| permission | for |", "|---|---|", ...PERMISSIONS.map(([label, , , why]) => `| ${label} | ${why} |`)].join("\n");
+}

package/src/generate/ci.ts

@@ -1,6 +1,7 @@
 import { DIST_BRANCH, DIST_DIR } from "../dist";
 import type { Manifest } from "../manifest";
 import { PRIVATE_KEY_VAR, SECRETS_FILE } from "../deploy/secrets";
+import { cloudflareTokenMarkdown } from "../deploy/token-link";
 
 /**
  * The workflow that turns a push into a live shop.
@@ -190,6 +191,7 @@ jobs:
 /** What a person still has to do once, and why each thing cannot be done for them. */
 export function renderDeployReadme(manifest: Manifest, zone: string, hosts: string[]): string {
 	const worker = manifest.shop.domain.split(".")[0];
+	const TOKEN_TABLE = cloudflareTokenMarkdown();
 	return `# Going live
 
 \`${manifest.shop.domain}\` on Cloudflare Workers. Generated by \`vc init\`;
@@ -244,8 +246,17 @@ ordinary secret in \`${SECRETS_FILE}\`: encrypted, committed, and read by the
 deploy out of what you pushed.
 
 The token itself has to be fetched by a person, once, because there is no
-OIDC between GitHub and Cloudflare and nothing else can issue one. Create it
-at **My Profile → API Tokens → Create Token → Custom token**:
+OIDC between GitHub and Cloudflare and nothing else can issue one. You do
+not have to find the permissions yourself:
+
+\`\`\`sh
+vc secrets set CLOUDFLARE_API_TOKEN
+\`\`\`
+
+prints a Cloudflare link with all of them **already selected**, then takes
+the token. It opens your own dashboard and the value is shown only to you.
+
+${TOKEN_TABLE}
 
 ### The zone