@saastemly/voidcommerce 0.4.0 → 0.6.0

package/dist/{index-yzezvy5h.js → index-f1wds190.js}

@@ -1,23 +1,33 @@
+import {
+  PRIVATE_KEY_VAR,
+  SECRETS_FILE,
+  allEnvKeys,
+  declaredSecretNames,
+  decryptSecrets,
+  plaintextSecretNames,
+  renderEnvExample,
+  renderEnvLocal,
+  renderEnvProduction,
+  renderEnvTs
+} from "./index-2qt2yh3z.js";
 import {
   MANIFEST_FILE,
-  envKeysOf,
   has,
   hasFrontend,
-  isApex,
   isSingleApp,
+  oneOrigin,
   packagesOf,
   readManifest,
   specifier,
   workerHosts,
   writeManifest,
   zone
-} from "./index-pz6m2hkm.js";
+} from "./index-xx5p4b8d.js";
 import {
   CHOICES
 } from "./index-844b3qn9.js";
 import {
-  __require,
-  __toESM
+  __require
 } from "./index-0v6na3yp.js";
 
 // src/generate/auth.ts
@@ -350,150 +360,26 @@ ${render("commerce").replace(/^/gm, "\t")}
 }
 var camel = (id) => id.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 
-// src/generate/env.ts
-var BASE = [
-  {
-    key: "SHOP_DOMAIN",
-    breaks: "everything derived from it is wrong at once — no public origin, the storefront rejected as untrusted, no DNS records",
-    plaintext: true
-  },
-  {
-    key: "COMMERCE_CRON_SECRET",
-    breaks: "the scheduler cannot authenticate, so every background job stops",
-    where: "openssl rand -base64 32"
-  },
-  {
-    key: "COMMERCE_WEBHOOK_SECRET",
-    breaks: "payment webhooks cannot be verified, so no order ever becomes paid",
-    where: "the payment provider's dashboard"
-  },
-  {
-    key: "SHIPPING_DOMESTIC_MINOR",
-    breaks: "delivery is quoted at nothing, and every order loses the carrier cost",
-    plaintext: true,
-    dev: "4900",
-    where: "your carrier agreement, in minor units ex VAT"
-  },
-  {
-    key: "SHIPPING_FREE_FROM_MINOR",
-    breaks: "the free-delivery threshold is undefined",
-    plaintext: true,
-    dev: "100000"
-  }
-];
-function allEnvKeys(manifest) {
-  const keys = [...BASE, ...envKeysOf(manifest)];
-  if (!isApex(manifest)) {
-    keys.splice(1, 0, {
-      key: "SHOP_ZONE",
-      breaks: "DNS records are written to the wrong zone, or to none",
-      plaintext: true
-    });
-  }
-  if (hasFrontend(manifest.layout) && manifest.shop.pagesHost) {
-    keys.splice(1, 0, {
-      key: "GITHUB_PAGES_HOST",
-      breaks: "the www record has nothing to point at",
-      plaintext: true
-    });
-  }
-  return keys;
-}
-var NUMERIC = new Set(["SHIPPING_DOMESTIC_MINOR", "SHIPPING_FREE_FROM_MINOR"]);
-function renderEnvTs(manifest) {
-  const keys = allEnvKeys(manifest);
-  const lines = keys.map((key) => {
-    const helper = NUMERIC.has(key.key) ? "number()" : "string()";
-    const doc = [`	/** ${key.breaks}${key.where ? ` — from: ${key.where}` : ""} */`];
-    return `${doc.join(`
-`)}
-	${key.key}: ${helper},`;
-  });
-  return `import { defineEnv, number, string } from "void/env";
+// src/generate/frontend.ts
+var FRONTEND_OUT = "dist/client";
+var FRONTEND_BRANCH = "frontend-static";
+function renderFrontendApiTs(manifest) {
+  if (oneOrigin(manifest.layout)) {
+    return `import { createAuthClient } from "better-auth/react";
+import { commerceClient } from "@saastemly/better-commerce/client";
 
 /**
- * Every env key the app reads. All of them are REQUIRED.
- *
- * Generated by \`vc init\` from voidcommerce.json — edit the manifest and
- * regenerate rather than editing this by hand.
+ * The one client the storefront talks through.
  *
- * Nothing is optional: an integration this shop supports is one the
- * deployment sets up. No key has a default, because a default is compiled
- * into the worker's vars and shadows the real secret. Locally, the literal
- * value \`unset\` is the one documented way to say "I do not have this yet",
- * and \`vc preflight\` refuses it.
+ * SAME ORIGIN. One worker serves this page and the API it calls, so there is
+ * no address to configure, nothing to bake at build time, and nothing that
+ * can point at the wrong place. Cookies are first-party, so no SameSite=None
+ * and no CORS preflight on any request.
  */
-export default defineEnv({
-${lines.join(`
-`)}
-});
+export const API_ORIGIN = "";
+export const api = createAuthClient({ plugins: [commerceClient()] });
 `;
-}
-function renderEnvExample(manifest) {
-  const keys = allEnvKeys(manifest);
-  return [
-    "# Every key is required. Copy to .env for local development.",
-    "# `unset` is the one value that reads as absent — for a credential you do not have yet.",
-    "",
-    ...keys.map((key) => `${key.key}=${key.dev ?? (key.plaintext ? "" : "unset")}`),
-    ""
-  ].join(`
-`);
-}
-function renderEnvLocal(manifest) {
-  const keys = allEnvKeys(manifest);
-  const local = {
-    SHOP_DOMAIN: `${manifest.shop.domain.split(".")[0]}.test`,
-    GITHUB_PAGES_HOST: manifest.shop.pagesHost ?? "",
-    SHOP_ZONE: zone(manifest),
-    COMMERCE_CRON_SECRET: "dev-cron-secret-not-for-production",
-    COMMERCE_WEBHOOK_SECRET: "whsec_dev_secret",
-    SYSTEM_API_KEY: "dev-system-key-0123456789abcdefghijklmnopqrstuvwxyz",
-    EMAIL_FROM: `"${manifest.shop.name} <noreply@${manifest.shop.domain}>"`
-  };
-  return [
-    "# Local development. Gitignored; .env.example documents every key.",
-    "",
-    ...keys.map((key) => `${key.key}=${local[key.key] ?? key.dev ?? "unset"}`),
-    ...hasFrontend(manifest.layout) ? ["", "# The storefront, reaching the worker. Start the worker first.", "VITE_API_ORIGIN=http://localhost:5173"] : [],
-    ""
-  ].join(`
-`);
-}
-function renderEnvProduction(manifest) {
-  const keys = allEnvKeys(manifest).filter((key) => key.plaintext);
-  const values = {
-    SHOP_DOMAIN: manifest.shop.domain,
-    GITHUB_PAGES_HOST: manifest.shop.pagesHost ?? "",
-    SHOP_ZONE: zone(manifest),
-    EMAIL_FROM: `"${manifest.shop.name} <noreply@${manifest.shop.domain}>"`,
-    ADYEN_ENVIRONMENT: "live",
-    BC_ENVIRONMENT: "production"
-  };
-  return [
-    "# Production values that are NOT secrets.",
-    "#",
-    "# On `void deploy --backend cloudflare` every .env* file is baked into the",
-    "# worker's vars as PLAINTEXT, so this holds only values safe to commit. Every",
-    "# credential is `wrangler secret put <NAME>` instead.",
-    "",
-    ...keys.map((key) => `${key.key}=${values[key.key] ?? key.dev ?? ""}`),
-    ""
-  ].join(`
-`);
-}
-function envSummary(manifest) {
-  const keys = allEnvKeys(manifest);
-  return {
-    secrets: keys.filter((key) => !key.plaintext).map((key) => key.key),
-    plaintext: keys.filter((key) => key.plaintext).map((key) => key.key)
-  };
-}
-
-// src/generate/frontend.ts
-var FRONTEND_OUT = "dist/client";
-var FRONTEND_BRANCH = "frontend-static";
-function renderFrontendApiTs(manifest) {
+  }
   return `/// <reference types="vite/client" />
 import { createAuthClient } from "better-auth/react";
 import { commerceClient } from "@saastemly/better-commerce/client";
@@ -514,6 +400,13 @@ export const api = createAuthClient({ baseURL: API_ORIGIN, plugins: [commerceCli
 `;
 }
 function renderFrontendEnvProduction(manifest) {
+  if (oneOrigin(manifest.layout)) {
+    return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
+#
+# The API is same-origin, so there is no VITE_API_ORIGIN: one worker serves
+# this storefront and the endpoints it calls.
+`;
+  }
   return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
 VITE_API_ORIGIN=https://api.${manifest.shop.domain}
 `;
@@ -637,9 +530,8 @@ function renderFrontendWorkflow(manifest, dir) {
 # Generated by \`vc init\` from voidcommerce.json.
 #
 # Builds the storefront and force-pushes the prerendered tree to
-# \`${FRONTEND_BRANCH}\`. Point GitHub Pages (or Cloudflare Pages) at that branch
-# and a push here is a live storefront. The worker deploys separately, from
-# \`void-dist\`.
+# \`${FRONTEND_BRANCH}\`, which GitHub Pages serves. The worker deploys
+# separately, from deploy.yml.
 on:
   push:
     branches: [main, master]
@@ -1441,7 +1333,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.4.0",
+  version: "0.6.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1639,7 +1531,7 @@ import { existsSync as existsSync5 } from "node:fs";
 import { dirname as dirname3, join as join5 } from "node:path";
 
 // src/generate/index.ts
-import { cp as cp2, mkdir as mkdir2, readFile as readFile2, readdir as readdir2, symlink, writeFile as writeFile2 } from "node:fs/promises";
+import { cp as cp2, mkdir as mkdir2, readFile as readFile2, readdir as readdir2, rm as rm2, symlink, writeFile as writeFile2 } from "node:fs/promises";
 import { existsSync as existsSync4, lstatSync } from "node:fs";
 import { dirname as dirname2, join as join4 } from "node:path";
 
@@ -1770,36 +1662,38 @@ async function distHelp() {
 
 // src/generate/ci.ts
 function renderDistWorkflow(manifest) {
-  const worker = manifest.shop.domain.split(".")[0];
-  return `name: Build the deployable app
+  return `name: Deploy the shop
 
 # Generated by \`vc init\` from voidcommerce.json.
 #
-# Every push to main regenerates the Void app from the manifest and force-pushes
-# it to \`${DIST_BRANCH}\`. Cloudflare's Workers Builds watches THAT branch and
-# deploys it, so a push here is a deploy — and no Cloudflare credential is
-# stored in GitHub.
+# A push to main regenerates the Void app from the manifest, publishes it to
+# \`${DIST_BRANCH}\` as a standalone tree, and deploys it to Cloudflare.
+#
+# The credentials come from the repository, set once by \`vc link\`:
 #
-# The Cloudflare side is configured once, in the dashboard, for the Worker
-# named \`${worker}\` (Settings → Builds). DEPLOY.md has the settings and the
-# one non-obvious part: the build's API token needs D1:Edit, which the token
-# Cloudflare generates for you does not have.
+#   secrets.CLOUDFLARE_API_TOKEN        deploys, and creates D1 + the queue
+#   secrets.${PRIVATE_KEY_VAR}   opens ${SECRETS_FILE}
+#   vars.CLOUDFLARE_ACCOUNT_ID          which account (an id, not a credential)
+#
+# Nothing here needs a Cloudflare dashboard visit and nothing needs wrangler
+# on your machine. See DEPLOY.md.
 on:
   push:
     branches: [main, master]
   workflow_dispatch:
 
-# A later push wins: an older tree must never overwrite a newer one.
+# A later push wins: an older tree must never overwrite a newer one, and two
+# deploys must never race for the same worker.
 concurrency:
-  group: ${DIST_BRANCH}-\${{ github.repository }}
+  group: deploy-\${{ github.repository }}
   cancel-in-progress: true
 
-# contents: write is what lets GITHUB_TOKEN force-push the branch. Nothing else.
 permissions:
   contents: write
 
 jobs:
-  build:
+  # ── Regenerate, and publish the standalone tree ────────────────────────
+  dist:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -1840,6 +1734,50 @@ jobs:
           git add -A
           git commit -q -m "\${{ github.sha }} — ${manifest.shop.domain}"
           git push -f "https://x-access-token:\${GITHUB_TOKEN}@github.com/\${{ github.repository }}.git" ${DIST_BRANCH}
+
+  # ── Deploy it ──────────────────────────────────────────────────────────
+  deploy:
+    needs: dist
+    runs-on: ubuntu-latest
+    environment:
+      name: production
+      url: https://${manifest.shop.domain}
+    env:
+      CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: \${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      ${PRIVATE_KEY_VAR}: \${{ secrets.${PRIVATE_KEY_VAR} }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: oven-sh/setup-bun@v2
+
+      # Checked before anything is built, so a repository that was never
+      # linked says so in five seconds rather than four minutes.
+      - name: Are the credentials here?
+        run: |
+          set -euo pipefail
+          missing=""
+          [ -n "\${CLOUDFLARE_API_TOKEN:-}" ] || missing="$missing CLOUDFLARE_API_TOKEN"
+          [ -n "\${${PRIVATE_KEY_VAR}:-}" ] || missing="$missing ${PRIVATE_KEY_VAR}"
+          if [ -n "$missing" ]; then
+            echo "::error::this repository has no$missing. Run 'vc link' once, from a checkout."
+            exit 1
+          fi
+
+      - run: bun install --frozen-lockfile
+
+      # One command: preflight, provision D1 and the queue if they are not
+      # there, build, strip the values Void bakes into the worker's plaintext
+      # vars, apply the committed migrations, and deploy with the decrypted
+      # secrets attached to the version. Provisioning is idempotent — it looks
+      # a resource up by name before creating it — so this is safe every run.
+      - name: vc deploy --cloudflare --provision
+        run: bunx vc deploy --cloudflare --provision
+
+      # An upsert, so it is safe on every deploy and costs one pass when
+      # nothing in data/ has changed. A failure here does not un-deploy a
+      # working shop, so it warns rather than failing the run.
+      - name: Push the catalogue
+        run: bunx vc import || echo "::warning::the catalogue did not import; the shop is up but its products may be stale"
 `;
 }
 function renderDeployReadme(manifest, zone2, hosts) {
@@ -1849,132 +1787,125 @@ function renderDeployReadme(manifest, zone2, hosts) {
 \`${manifest.shop.domain}\` on Cloudflare Workers. Generated by \`vc init\`;
 regenerate with \`vc generate\`.
 
-## The loop, once it is set up
-
-Push to \`main\`. GitHub Actions regenerates the app from \`voidcommerce.json\`
-and force-pushes it to \`${DIST_BRANCH}\`; Cloudflare's Workers Builds builds that
-branch and deploys it. Nothing else runs.
-
-Your secrets survive every deploy — \`wrangler deploy\` never deletes a secret.
-Plaintext \`vars\` are replaced from \`.env.production\` on each deploy, which is
-why no credential is allowed in that file.
-
-## Once, before the first push
-
-Each of these either creates something in your Cloudflare account or holds a
-credential, so none of them can live in a repository.
-
-### 1. The zone
-
-\`${zone2}\` must be on Cloudflare. A Worker custom domain is a record Cloudflare
-creates in its own zone, so a domain hosted anywhere else cannot have one. The
-worker answers on ${hosts.map((h) => `\`${h}\``).join(" and ")}.
-
-### 2. The database, the queue, and the account id
+## The loop
 
 \`\`\`sh
-vc deploy --cloudflare --provision
+git push
 \`\`\`
 
-Idempotent: it creates nothing that already exists. It pins your account id,
-creates the D1 database and the queue, and records both in \`wrangler.jsonc\`
-and \`voidcommerce.json\` so every later generate carries the real ids.
-**Commit that change.**
+That is the deploy. GitHub Actions regenerates the app from
+\`voidcommerce.json\`, publishes a standalone copy to \`${DIST_BRANCH}\`, creates the
+database and queue if they are not there, applies the migrations, and deploys
+the worker with this repository's secrets attached.
 
-### 3. The secrets
+**One worker serves everything.** The storefront is prerendered and folded
+into the worker's own static assets, so \`${manifest.shop.domain}\` answers with
+the shop, the admin panel and the API from a single origin. Cloudflare creates
+the hostname's DNS record and certificate itself, because it is a Worker
+custom domain. There is nothing to configure in any dashboard, no second
+branch to keep in step, and no CORS — the storefront's requests are
+first-party.
 
-They live in the repository, encrypted:
+You do not need wrangler on your machine, and you do not need to be logged
+into it. You do not need to open the Cloudflare dashboard after the one step
+below.
+
+## Once, before the first push
 
 \`\`\`sh
-vc secrets --init                       # every required key, as \`unset\`
-# put the real values in, then
-bunx dotenvx encrypt -f .env.secrets    # ciphertext; commit this
+gh repo create --source=. --private --push   # if there is no repo yet
+vc link
 \`\`\`
 
-\`.env.secrets\` is committed and \`.env.keys\` is not. The deploy decrypts it and
-hands the values to \`wrangler deploy --secrets-file\`, which stores them as
-real Worker secrets — not as plaintext \`vars\`, which anyone with dashboard
-access can read.
-
-That turns one \`wrangler secret put\` per value into one build variable, set
-once in step 5. It also means the shop rebuilds from a checkout.
+\`vc link\` does three things and stores all of them on the GitHub repository:
 
-**Know the tradeoff.** Ciphertext in git is permanent: if the private key ever
-leaks, every secret in the history is readable, including ones you rotated.
-\`wrangler secret put\` does not have that property, and stays available for
-anything you would rather never commit. \`vc preflight\` counts a secret the
-repository declares as present, and refuses any value committed in the clear.
+| what | where | why |
+|---|---|---|
+| \`${PRIVATE_KEY_VAR}\` | repository **secret** | opens \`${SECRETS_FILE}\`. Generated by \`vc link\`, never written to disk |
+| \`CLOUDFLARE_API_TOKEN\` | repository **secret** | deploys, and creates D1 and the queue |
+| \`CLOUDFLARE_ACCOUNT_ID\` | repository **variable** | which account. An identifier, not a credential |
 
-### 4. An API token the build can use
+It will ask you to paste a Cloudflare API token. That is the only manual step
+in the whole setup, and it is worth saying exactly why it cannot be removed:
 
-This is the one non-obvious step. Cloudflare generates an API token for
-Workers Builds automatically, and **that token has no D1 permission** — its
-scopes are Workers Scripts, KV, R2, Workers Routes and account/user reads. The
-deploy command below applies database migrations, so it needs more.
+> **GitHub cannot mint a Cloudflare credential.** There is no OIDC or workload
+> identity federation between them — the feature request has been open since
+> 2025 with no commitment, and Cloudflare's own CI guidance still says to store
+> a token in your CI provider's secrets. The Cloudflare GitHub App does not
+> help either: it grants *Cloudflare* access to your *repository*, not the
+> reverse. Something has to authorise creating a database in your account, and
+> only Cloudflare can issue that authorisation.
 
-Create a token at **My Profile → API Tokens** with:
+Create the token at **My Profile → API Tokens → Create Token → Custom token**:
 
-| scope | permission |
-|---|---|
-| Account | Workers Scripts: Edit |
-| Account | D1: Edit |
-| Account | Workers KV Storage: Edit, Workers R2 Storage: Edit |
-| Account | Queues: Edit |
-| Account | Account Settings: Read |
-| Zone | Workers Routes: Edit (${zone2}) |
-| User | User Details: Read, Memberships: Read |
+| scope | permission | for |
+|---|---|---|
+| Account | Workers Scripts: Edit | deploying the worker |
+| Account | D1: Edit | creating the database, applying migrations |
+| Account | Queues: Edit | the order queue |
+| Account | Workers KV Storage: Edit | sessions and caches |
+| Account | Workers R2 Storage: Edit | product images |
+| Account | Account Settings: Read | confirming which account |
+| Zone | Workers Routes: Edit (${zone2}) | answering on your domain |
+| User | User Details: Read, Memberships: Read | wrangler asks at startup |
 
-Then select it in the build settings below. Use the same token for every
-deploy of this Worker; permissions are whatever that token has.
+The token Cloudflare generates for its own Workers Builds will **not** do: it
+has no D1 and no Queues permission, so it cannot create this shop's database.
 
-### 5. Connect the repository
+### The zone
 
-In the Cloudflare dashboard, on the Worker named \`${worker}\`, under
-**Settings → Builds → Connect**. The Worker's name must equal the \`name\` in
-the \`wrangler.jsonc\` at the root directory, or the build fails.
+\`${zone2}\` must be on Cloudflare. A Worker custom domain is a record Cloudflare
+creates in its own zone, so a domain hosted anywhere else cannot have one. The
+worker answers on ${hosts.map((h) => `\`${h}\``).join(" and ")}.
 
-| setting | value |
-|---|---|
-| branch | \`${DIST_BRANCH}\` |
-| root directory | \`/\` |
-| build command | \`bun install && bunx void prepare && bunx vp build\` |
-| deploy command | see below |
-| build variable | \`DOTENV_PRIVATE_KEY_SECRETS\`, marked as a secret — the one value that is not in the repository |
-| API token | the one from step 4 |
+## Secrets
 
-The deploy command, on one line:
+They live in the repository, encrypted, in \`${SECRETS_FILE}\`:
 
 \`\`\`sh
-bunx dotenvx decrypt -f .env.secrets --stdout > .vc-secrets.env && bunx wrangler d1 migrations apply DB --remote && bunx wrangler deploy -c dist/ssr/wrangler.json --secrets-file .vc-secrets.env
+vc secrets set STRIPE_SECRET_KEY     # prompts; never touches your shell history
+vc secrets                           # what is set, what is missing
 \`\`\`
 
-Plain \`sh\`, so it does not rely on process substitution. The decrypted file
-exists only inside the build sandbox, and \`--secrets-file\` applies additively:
-a secret it does not name is left alone rather than deleted.
+**This needs no credential.** dotenvx is asymmetric: encryption uses the public
+key committed at the top of the file, so anyone with a clone can set or rotate
+a secret. Nobody with a clone can read one. Only the deploy decrypts, with the
+private key that lives in GitHub Actions.
 
-The migration command names the **binding** (\`DB\`), not the database, so it
-still points at the right database if the name ever differs.
+A pre-commit hook refuses a commit that would put a value in the clear, because
+that cannot be undone by a later commit — the value stays in the history.
 
-Cloudflare's build image has Bun; pin its version with a \`BUN_VERSION\` build
-variable if you ever need to. The free plan allows 3,000 build minutes a month
-and one build at a time.
+**Know the tradeoff.** Ciphertext in git is permanent: if the private key ever
+leaks, every secret in the history is readable, including ones you rotated.
+\`wrangler secret put\` does not have that property, and stays available for
+anything you would rather never commit at all.
 
-### 6. The catalogue
+## The catalogue
 
-\`vc import\` pushes \`data/\` into the running shop. It is an upsert, so it is
-safe on every deploy and costs one pass when nothing changed.
+\`vc import\` pushes \`data/\` into the running shop, and the workflow runs it on
+every deploy. It is an upsert, so it costs one pass when nothing has changed.
 
-## Without Cloudflare's build
+## Doing it by hand
 
-The same thing by hand, from a checkout of either branch:
+The same thing, from a checkout, if CI is ever not the answer:
 
 \`\`\`sh
-vc deploy --cloudflare
+export CLOUDFLARE_API_TOKEN=…
+export ${PRIVATE_KEY_VAR}=…        # only if you kept a copy
+vc deploy --cloudflare --provision
 \`\`\`
 
-which preflights, builds, strips the baked development values out of the
-worker's vars, applies the remote migrations, and deploys exactly what it
-verified.
+which preflights, provisions, builds, strips the baked development values out
+of the worker's vars, applies the remote migrations, and deploys exactly what
+it verified.
+
+## If you would rather use Cloudflare's own build
+
+Point Workers Builds at the \`${DIST_BRANCH}\` branch — it is a plain Void app with
+a committed lockfile. The Worker must be named \`${worker}\`, matching the \`name\`
+in its \`wrangler.jsonc\`. You will need to set \`${PRIVATE_KEY_VAR}\` as a
+build secret in the dashboard, and replace the auto-generated API token with
+one that has D1 and Queues. That is the path \`vc link\` exists to avoid.
 `;
 }
 
@@ -2014,7 +1945,7 @@ export function check(present: Map<string, string | undefined>): Requirement[] {
 
 // src/generate/support.ts
 function renderDomainTs(layout) {
-  const derive = layout === "app" ? `	// One app: the worker IS the site. No separate API host, and no other
+  const derive = layout !== "monorepo" ? `	// One origin: the worker IS the site. No separate API host, and no other
 	// origin to trust. It answers on www too, but only at a zone's apex —
 	// www.shop.example.com is not a name anybody types.
 	const hosts = apex ? [host, www] : [host];
@@ -2025,7 +1956,7 @@ function renderDomainTs(layout) {
   return `/**
  * The shop's domain, and everything derived from it.
  *
- * One variable. \`SHOP_DOMAIN\` gives ${layout === "app" ? "the worker's hostnames" : `api.<domain> for the worker and the
+ * One variable. \`SHOP_DOMAIN\` gives ${layout !== "monorepo" ? "the worker's hostnames" : `api.<domain> for the worker and the
  * storefront's origins`}, the app's public origin, and the
  * CORS and CSRF allow-list. They were four settings that had to agree and
  * nothing checked that they did.
@@ -2068,11 +1999,13 @@ export const GITHUB_PAGES_AAAA = ["2606:50c0:8000::153", "2606:50c0:8001::153",
 /**
  * The storefront's records. DNS-only, never proxied: GitHub issues the
  * certificate itself and validates by reaching the origin. The API hostname
- * is NOT here — it is a Cloudflare custom domain in wrangler.jsonc.${layout === "app" ? `
- * One app has no storefront elsewhere, so this is always empty.` : ""}
+ * is NOT here — it is a Cloudflare custom domain in wrangler.jsonc.${layout !== "monorepo" ? `
+ * One worker serves the storefront, so this is always empty.` : ""}
  */
 export function storefrontRecords(domain: ShopDomain, pagesHost: string) {
-	if (!pagesHost${layout === "app" ? " || domain.frontendOrigins.length === 0" : ""}) return [];
+	// Empty whenever one worker serves the storefront: Cloudflare creates the
+	// hostname's record and certificate itself for a custom domain.
+	if (!pagesHost || domain.frontendOrigins.length === 0) return [];
 	// The record's name is relative to the zone: "@" at the apex, otherwise the
 	// labels in front of it.
 	const name = domain.apex ? "@" : domain.host.slice(0, -(domain.zone.length + 1));
@@ -2313,6 +2246,13 @@ async function put(root, file, content, result, mode) {
   await writeFile2(path, content, "utf8");
   result.written.push(file);
 }
+async function retire(root, file, result) {
+  const path = join4(root, file);
+  if (!await exists(path))
+    return;
+  await rm2(path, { force: true });
+  result.retired.push(file);
+}
 async function mergeJson(root, file, fallback, mutate, result) {
   const path = join4(root, file);
   const json = await exists(path) ? JSON.parse(await readFile2(path, "utf8")) : { ...fallback };
@@ -2336,7 +2276,7 @@ async function link(root, file, target, result) {
 }
 var sorted = (record) => Object.fromEntries(Object.entries(record).sort());
 async function generate(root, manifest) {
-  const result = { written: [], kept: [], packages: packagesOf(manifest) };
+  const result = { written: [], kept: [], retired: [], packages: packagesOf(manifest) };
   await writeManifest(root, manifest);
   result.written.push(MANIFEST_FILE);
   switch (manifest.layout) {
@@ -2431,7 +2371,11 @@ async function generateFrontend(root, dir, manifest, result) {
   await put(root, at("void.json"), renderFrontendVoidJson(), result, "own");
   await put(root, at("tsconfig.json"), renderFrontendTsconfig(), result, "own");
   await put(root, at("pages/index.tsx"), renderStorefrontPage(manifest), result, "own");
-  await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+  if (oneOrigin(manifest.layout)) {
+    await retire(root, ".github/workflows/frontend-static.yml", result);
+  } else {
+    await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+  }
   if (dir === "")
     return;
   await mergeJson(root, at("package.json"), { name: `${manifest.shop.domain.split(".")[0]}-frontend`, type: "module", private: true }, (pkg) => {
@@ -2505,7 +2449,8 @@ dist
 # because the value stays in the history.
 bunx vc guard
 `, result, "regenerate");
-  await put(root, ".github/workflows/void-dist.yml", renderDistWorkflow(manifest), result, "regenerate");
+  await put(root, ".github/workflows/deploy.yml", renderDistWorkflow(manifest), result, "regenerate");
+  await retire(root, ".github/workflows/void-dist.yml", result);
   await put(root, "DEPLOY.md", renderDeployReadme(manifest, zone(manifest), workerHosts(manifest)), result, "regenerate");
   await put(root, ".env", renderEnvLocal(manifest), result, "own");
   await put(root, "data/README.md", DATA_README, result, "own");
@@ -2532,8 +2477,13 @@ async function generateStrictApp(root, dir, manifest, result) {
   await put(root, at("db/seed.ts"), renderDbSeed(), result, gen);
   await put(root, at("pages/layout.tsx"), renderLayoutTsx(), result, gen);
   await put(root, at("pages/app.css"), renderAppCss(), result, gen);
-  await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
-  await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+  if (!oneOrigin(manifest.layout) || isSingleApp(manifest.layout)) {
+    await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
+    await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+  } else {
+    await retire(root, at("pages/index.server.ts"), result);
+    await retire(root, at("pages/index.tsx"), result);
+  }
   await put(root, at("pages/api-dashboard/index.tsx"), renderDashboardPage(manifest), result, gen);
   await put(root, at("pages/api-dashboard/index.server.ts"), CLIENT_ONLY, result, gen);
   await put(root, at("pages/sign-in/index.tsx"), renderSignInPage(manifest), result, gen);
@@ -2869,346 +2819,16 @@ ${ran.out.trim()}`);
 }
 
 // src/deploy/preflight.ts
-import { existsSync as existsSync9, readFileSync as readFileSync4 } from "node:fs";
-import { join as join9 } from "node:path";
-import color5 from "picocolors";
-
-// src/deploy/secrets.ts
-import { existsSync as existsSync8, readFileSync as readFileSync3, writeFileSync } from "node:fs";
-import { spawn as spawn3 } from "node:child_process";
-import { delimiter as delimiter3, dirname as dirname5, join as join8 } from "node:path";
-import { tmpdir } from "node:os";
-import color4 from "picocolors";
-
-// src/deploy/keys.ts
-import { hkdfSync } from "node:crypto";
 import { existsSync as existsSync7, readFileSync as readFileSync2 } from "node:fs";
 import { join as join7 } from "node:path";
 import color3 from "picocolors";
-var INFO = "voidcommerce/dotenvx/secrets/v1";
-function apiToken() {
-  return process.env["CLOUDFLARE_API_TOKEN"] || process.env["CF_API_TOKEN"] || null;
-}
-function derivePrivateKey(token, accountId) {
-  const bytes = hkdfSync("sha256", Buffer.from(token, "utf8"), Buffer.from(accountId, "utf8"), Buffer.from(INFO), 32);
-  return Buffer.from(bytes).toString("hex");
-}
-async function publicKeyFor(privateKey) {
-  try {
-    const { derive } = await import("./index-mpr7gm6k.js").then((m)=>__toESM(m.default,1));
-    return derive(privateKey);
-  } catch {
-    return null;
-  }
-}
-function committedPublicKey(root) {
-  const path = join7(root, SECRETS_FILE);
-  if (!existsSync7(path))
-    return null;
-  const match = /^\s*DOTENV_PUBLIC_KEY_SECRETS\s*=\s*["']?([0-9a-fA-F]+)["']?/m.exec(readFileSync2(path, "utf8"));
-  return match?.[1] ?? null;
-}
-async function keyFor(manifest, root) {
-  const token = apiToken();
-  if (!token) {
-    return {
-      ok: false,
-      reason: `CLOUDFLARE_API_TOKEN is not set.
-  The key is derived from it, so there is nothing to derive from. Note that
-` + "  `wrangler login` does NOT set one — this scheme needs an API token, from\n" + "  My Profile → API Tokens."
-    };
-  }
-  const accountId = manifest.cloudflare?.accountId || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
-  if (!accountId) {
-    return {
-      ok: false,
-      reason: "the account is not pinned, and it salts the derivation.\n  Run `vc deploy --cloudflare --provision` once, or set CLOUDFLARE_ACCOUNT_ID."
-    };
-  }
-  const privateKey = derivePrivateKey(token, accountId);
-  const publicKey = await publicKeyFor(privateKey);
-  if (!publicKey) {
-    return { ok: false, reason: "@dotenvx/dotenvx is not installed here, so a key cannot be derived. `bun add -d @dotenvx/dotenvx`" };
-  }
-  const committed = committedPublicKey(root);
-  if (!committed)
-    return { ok: true, privateKey, publicKey, fresh: true };
-  if (committed.toLowerCase() !== publicKey.toLowerCase()) {
-    return {
-      ok: false,
-      reason: `this token does not derive the key ${SECRETS_FILE} was encrypted under.
-
-  encrypted under:  ${committed.slice(0, 16)}…
-` + `  this token gives: ${publicKey.slice(0, 16)}…
-
-` + `  That is one of three things, and all of them are the same fix:
-` + `    · the token was rotated since the secrets were encrypted
-` + `    · this is a different admin's token
-` + `    · CLOUDFLARE_ACCOUNT_ID is not the account they were encrypted for
-
-` + `  If you still have the ORIGINAL token, \`vc keys rotate\` re-encrypts
-  everything under the new one. If you do not, the values are unrecoverable
-  and must be entered again.`
-    };
-  }
-  return { ok: true, privateKey, publicKey, fresh: false };
-}
-async function keysCommand(manifest, root, args) {
-  if (args.includes("--rotate"))
-    return rotate(manifest, root);
-  const state = await keyFor(manifest, root);
-  console.log(`
-The key is DERIVED from CLOUDFLARE_API_TOKEN, salted with the account id.`);
-  console.log(color3.dim(`Nothing is stored, so nothing can leak — and nothing can be recovered.
-`));
-  if (!state.ok) {
-    console.error(`${color3.red("✗")} ${state.reason}
-`);
-    return 1;
-  }
-  console.log(`  derives public key  ${state.publicKey.slice(0, 20)}…`);
-  console.log(state.fresh ? `  ${color3.dim(`${SECRETS_FILE} does not exist yet, so there is nothing to check against`)}` : `  ${color3.green("✓")} matches what ${SECRETS_FILE} was encrypted under`);
-  console.log(color3.yellow(`
-! Rotating this API token makes every secret in ${SECRETS_FILE} unreadable.
-  Run \`vc keys --rotate\` with the NEW token exported and the old one in
-  CLOUDFLARE_API_TOKEN_OLD, BEFORE the old one stops working.
-`));
-  return 0;
-}
-async function rotate(manifest, root) {
-  const oldToken = process.env["CLOUDFLARE_API_TOKEN_OLD"];
-  const newToken = apiToken();
-  if (!oldToken || !newToken) {
-    console.error(`
-vc: rotation needs BOTH tokens:
-  CLOUDFLARE_API_TOKEN_OLD=<the one the secrets were encrypted under>
-  CLOUDFLARE_API_TOKEN=<the new one>
-
-  The old one is the only thing that can read the current values.
-`);
-    return 1;
-  }
-  const accountId = manifest.cloudflare?.accountId || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
-  if (!accountId) {
-    console.error("vc: the account is not pinned, and it salts the derivation.");
-    return 1;
-  }
-  const oldKey = derivePrivateKey(oldToken, accountId);
-  const oldPublic = await publicKeyFor(oldKey);
-  const committed = committedPublicKey(root);
-  if (committed && oldPublic && committed.toLowerCase() !== oldPublic.toLowerCase()) {
-    console.error(`
-vc: CLOUDFLARE_API_TOKEN_OLD does not derive the key ${SECRETS_FILE} was encrypted under either.
-`);
-    return 1;
-  }
-  console.log(`
-Rotation is a decrypt with the old key and an encrypt with the new one.
-Run these two, in this order, from ${root}:
-
-  ${color3.cyan(`DOTENV_PRIVATE_KEY_SECRETS=<old> bunx dotenvx decrypt -f ${SECRETS_FILE}`)}
-  ${color3.cyan(`bunx dotenvx encrypt -f ${SECRETS_FILE}`)}   ${color3.dim("# under the new derived key")}
-
-` + color3.dim(`vc does not run them for you: the middle state is your secrets in
-plaintext on disk, and that is a moment to be deliberate about.
-`));
-  return 0;
-}
-
-// src/deploy/secrets.ts
-var SECRETS_FILE = ".env.secrets";
-var PRIVATE_KEY_VAR = "DOTENV_PRIVATE_KEY_SECRETS";
-function findDotenvx(from) {
-  let dir = from;
-  for (;; ) {
-    const local = join8(dir, "node_modules", ".bin", "dotenvx");
-    if (existsSync8(local))
-      return local;
-    const parent = dirname5(dir);
-    if (parent === dir)
-      break;
-    dir = parent;
-  }
-  return (process.env["PATH"] ?? "").split(delimiter3).filter(Boolean).some((entry) => existsSync8(join8(entry, "dotenvx"))) ? "dotenvx" : null;
-}
-function run(cmd, args, cwd, env = {}) {
-  return new Promise((resolve) => {
-    const child = spawn3(cmd, args, { cwd, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, ...env } });
-    let out = "";
-    child.stdout.on("data", (chunk) => {
-      out += chunk;
-    });
-    child.stderr.on("data", (chunk) => {
-      out += chunk;
-    });
-    child.on("error", (error) => resolve({ code: 1, out: String(error) }));
-    child.on("exit", (code) => resolve({ code: code ?? 1, out }));
-  });
-}
-function declaredSecretNames(root) {
-  const path = join8(root, SECRETS_FILE);
-  if (!existsSync8(path))
-    return new Set;
-  const names = new Set;
-  for (const line2 of readFileSync3(path, "utf8").split(`
-`)) {
-    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=/.exec(line2);
-    if (match && !match[1].startsWith("DOTENV_"))
-      names.add(match[1]);
-  }
-  return names;
-}
-function plaintextSecretNames(root) {
-  const path = join8(root, SECRETS_FILE);
-  if (!existsSync8(path))
-    return [];
-  const bare = [];
-  for (const line2 of readFileSync3(path, "utf8").split(`
-`)) {
-    const match = /^\s*([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line2);
-    if (!match || match[1].startsWith("DOTENV_"))
-      continue;
-    const value = match[2].trim().replace(/^['"]|['"]$/g, "");
-    if (value && value !== "unset" && !value.startsWith("encrypted:"))
-      bare.push(match[1]);
-  }
-  return bare;
-}
-async function decryptSecrets(project) {
-  const root = project.root;
-  if (!existsSync8(join8(root, SECRETS_FILE)))
-    return { error: `${SECRETS_FILE} does not exist — \`vc secrets init\` writes one` };
-  const dotenvx = findDotenvx(root);
-  if (!dotenvx)
-    return { error: "dotenvx is not installed. `bun add -d @dotenvx/dotenvx`" };
-  const key = await keyFor(project.manifest, root);
-  if (!key.ok)
-    return { error: key.reason };
-  const result = await run(dotenvx, ["decrypt", "-f", SECRETS_FILE, "--stdout"], root, {
-    [PRIVATE_KEY_VAR]: key.privateKey
-  });
-  if (result.code !== 0)
-    return { error: `dotenvx could not decrypt ${SECRETS_FILE}: ${result.out.trim().split(`
-`).slice(-2).join(" ")}` };
-  const lines = result.out.split(`
-`).filter((line2) => /^\s*[A-Z][A-Z0-9_]*\s*=/.test(line2) && !line2.trimStart().startsWith("DOTENV_"));
-  const names = lines.map((line2) => line2.slice(0, line2.indexOf("=")).trim());
-  const path = join8(tmpdir(), `vc-secrets-${process.pid}-${Date.now()}.env`);
-  writeFileSync(path, `${lines.join(`
-`)}
-`, { mode: 384 });
-  return {
-    path,
-    names,
-    cleanup: () => {
-      try {
-        writeFileSync(path, "", { mode: 384 });
-        __require("node:fs").unlinkSync(path);
-      } catch {}
-    }
-  };
-}
-async function secretsCommand(project, args) {
-  const root = project.root;
-  const required = allEnvKeys(project.manifest).filter((key) => !key.plaintext);
-  const declared = declaredSecretNames(root);
-  const bare = plaintextSecretNames(root);
-  if (args.includes("--init"))
-    return initSecrets(project);
-  if (!existsSync8(join8(root, SECRETS_FILE))) {
-    console.log(`
-${color4.yellow("No " + SECRETS_FILE + " yet.")} Secrets are set by hand with \`wrangler secret put\`,
-` + `which means the shop cannot be rebuilt from a checkout.
-
-` + `  vc secrets --init    write one, with every required key as \`unset\`
-`);
-    return 1;
-  }
-  console.log(`
-${SECRETS_FILE} — committed, encrypted, and read by \`vc deploy --cloudflare\`
-`);
-  for (const key of required) {
-    const state = declared.has(key.key) ? color4.green("declared") : color4.red("MISSING ");
-    console.log(`  ${state}  ${key.key}`);
-  }
-  const extra = [...declared].filter((name) => !required.some((key) => key.key === name));
-  for (const name of extra)
-    console.log(`  ${color4.dim("extra   ")}  ${name} ${color4.dim("— not required by this shop")}`);
-  if (bare.length > 0) {
-    console.log(`
-${color4.red("✗")} ${bare.length} value${bare.length === 1 ? " is" : "s are"} committed IN THE CLEAR: ${bare.join(", ")}
-` + `  Run \`dotenvx encrypt -f ${SECRETS_FILE}\` before committing again.
-`);
-    return 1;
-  }
-  const missing = required.filter((key) => !declared.has(key.key));
-  if (missing.length > 0) {
-    console.log(`
-${color4.red("✗")} ${missing.length} required secret${missing.length === 1 ? "" : "s"} not declared.
-` + `  dotenvx set ${missing[0].key} '…' -f ${SECRETS_FILE}
-`);
-    return 1;
-  }
-  console.log(`
-${color4.green("✓")} every secret this shop needs is declared and encrypted.
-`);
-  return 0;
-}
-async function initSecrets(project) {
-  const path = join8(project.root, SECRETS_FILE);
-  if (existsSync8(path)) {
-    console.error(`vc: ${SECRETS_FILE} already exists; not overwriting it.`);
-    return 1;
-  }
-  const key = await keyFor(project.manifest, project.root);
-  if (!key.ok) {
-    console.error(`
-vc: ${key.reason}
-`);
-    return 1;
-  }
-  const required = allEnvKeys(project.manifest).filter((key2) => !key2.plaintext);
-  const body = [
-    "# Secrets, encrypted, and COMMITTED.",
-    "#",
-    "# Values are ciphertext; the key names are readable so a diff shows WHICH",
-    "# secret changed without showing what it changed to. `unset` is the",
-    "# documented placeholder and preflight refuses it.",
-    "#",
-    "# The private key is DERIVED from CLOUDFLARE_API_TOKEN, salted with the",
-    "# account id — it is stored nowhere, so there is no .env.keys to leak.",
-    "#",
-    "# The cost of that: rotating the token makes every value below",
-    "# permanently unreadable. `vc keys --rotate` re-encrypts while you still",
-    "# have the old token; after that there is no recovery.",
-    "",
-    `DOTENV_PUBLIC_KEY_SECRETS="${key.publicKey}"`,
-    "",
-    ...required.flatMap((key2) => [`# ${key2.breaks}${key2.where ? ` — from: ${key2.where}` : ""}`, `${key2.key}=unset`, ""])
-  ].join(`
-`);
-  writeFileSync(path, body, { mode: 384 });
-  console.log(`
-${color4.green("+")} ${SECRETS_FILE} — ${required.length} keys, all \`unset\`, under the key this token derives
-
-` + `Next:
-` + `  1. put the real values in, then
-` + `  2. ${color4.cyan(`bunx dotenvx encrypt -f ${SECRETS_FILE}`)}
-` + `  3. commit it — there is no key file to keep out
-
-` + color4.yellow(`! Rotating CLOUDFLARE_API_TOKEN makes these unreadable. \`vc keys\` explains.
-`));
-  return 0;
-}
-
-// src/deploy/preflight.ts
 var UNSET = "unset";
 function productionEnv(appDir) {
   const out = new Map;
-  const path = join9(appDir, ".env.production");
-  if (!existsSync9(path))
+  const path = join7(appDir, ".env.production");
+  if (!existsSync7(path))
     return out;
-  for (const line2 of readFileSync4(path, "utf8").split(`
+  for (const line2 of readFileSync2(path, "utf8").split(`
 `)) {
     const match = /^\s*([A-Z0-9_]+)\s*=\s*(.*)$/.exec(line2);
     if (!match)
@@ -3233,12 +2853,12 @@ async function voidSecretNames(appDir) {
   return names;
 }
 function routeProblem(project) {
-  const path = join9(project.appDir, "wrangler.jsonc");
-  if (!existsSync9(path))
+  const path = join7(project.appDir, "wrangler.jsonc");
+  if (!existsSync7(path))
     return "wrangler.jsonc is missing";
   let routes = [];
   try {
-    routes = parseJsonc(readFileSync4(path, "utf8")).routes ?? [];
+    routes = parseJsonc(readFileSync2(path, "utf8")).routes ?? [];
   } catch {
     return "wrangler.jsonc cannot be parsed";
   }
@@ -3278,7 +2898,7 @@ async function preflight(project, source) {
 function printPreflight(project, result, source) {
   const keys = allEnvKeys(project.manifest);
   if (result.remote === null) {
-    console.log(color5.dim(source === "wrangler" ? `Could not read the worker's secrets — not deployed yet, or wrangler is not logged in.
+    console.log(color3.dim(source === "wrangler" ? `Could not read the worker's secrets — not deployed yet, or wrangler is not logged in.
 Anything not in .env.production is reported as missing.
 ` : `Could not read the project's secrets from Void — not logged in, or no linked project.
 Anything not in .env.production is reported as missing.
@@ -3288,37 +2908,37 @@ Anything not in .env.production is reported as missing.
   for (const key of keys) {
     const value = result.present.get(key.key);
     const set = value !== undefined && value !== "" && value !== UNSET;
-    console.log(`  ${set ? color5.green("set  ") : color5.dim("unset")}  ${key.key}${key.plaintext ? color5.dim("  (plaintext)") : ""}`);
+    console.log(`  ${set ? color3.green("set  ") : color3.dim("unset")}  ${key.key}${key.plaintext ? color3.dim("  (plaintext)") : ""}`);
   }
   if (result.ready) {
     console.log(`
-${color5.green("Ready to go live.")}
+${color3.green("Ready to go live.")}
 `);
     return;
   }
   console.log(`
-${color5.red("NOT ready to go live.")}
+${color3.red("NOT ready to go live.")}
 `);
   if (result.routeProblem) {
-    console.log(`${color5.red("✗")} the worker's hostname
+    console.log(`${color3.red("✗")} the worker's hostname
     ${result.routeProblem}
 `);
   }
   if (result.bareSecrets.length > 0) {
-    console.log(`${color5.red("✗")} committed in the clear in ${SECRETS_FILE}: ${result.bareSecrets.join(", ")}
+    console.log(`${color3.red("✗")} committed in the clear in ${SECRETS_FILE}: ${result.bareSecrets.join(", ")}
 ` + `    Run \`dotenvx encrypt -f ${SECRETS_FILE}\` — and treat those values as burned.
 `);
   }
   for (const key of result.missing) {
-    console.log(`${color5.red("✗")} ${key.key}`);
+    console.log(`${color3.red("✗")} ${key.key}`);
     console.log(`    ${key.breaks}`);
     if (key.where)
-      console.log(`    ${color5.dim(`from: ${key.where}`)}`);
+      console.log(`    ${color3.dim(`from: ${key.where}`)}`);
     console.log("");
   }
   const secrets = result.missing.filter((key) => !key.plaintext);
   if (secrets.length > 0) {
-    const inRepo = existsSync9(join9(project.root, SECRETS_FILE));
+    const inRepo = existsSync7(join7(project.root, SECRETS_FILE));
     console.log(inRepo ? `Put each in ${SECRETS_FILE}, which the deploy uploads:` : source === "wrangler" ? "Set each secret on the worker (this also creates the draft worker on a first deploy):" : "Set each secret on the project:");
     for (const key of secrets) {
       console.log(inRepo ? `  dotenvx set ${key.key} '…' -f ${SECRETS_FILE}` : `  ${source === "wrangler" ? "wrangler secret put" : "void secret put"} ${key.key}`);
@@ -3331,17 +2951,17 @@ ${color5.red("NOT ready to go live.")}
 }
 
 // src/deploy/cloudflare.ts
-import { existsSync as existsSync10, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6, join as join10 } from "node:path";
-import color6 from "picocolors";
+import { copyFileSync, existsSync as existsSync8, mkdirSync, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync } from "node:fs";
+import { dirname as dirname5, join as join8 } from "node:path";
+import color4 from "picocolors";
 var fail = (message) => {
   console.error(`
-${color6.red("✗")} ${message}
+${color4.red("✗")} ${message}
 `);
   return 1;
 };
 function readConfig(path) {
-  return parseJsonc(readFileSync5(path, "utf8"));
+  return parseJsonc(readFileSync3(path, "utf8"));
 }
 function findBuilder(from) {
   let dir = from;
@@ -3350,11 +2970,11 @@ function findBuilder(from) {
       ["vp", "vp build"],
       ["vite", "vite build"]
     ]) {
-      const path = join10(dir, "node_modules", ".bin", bin);
-      if (existsSync10(path))
+      const path = join8(dir, "node_modules", ".bin", bin);
+      if (existsSync8(path))
         return { cmd: path, label };
     }
-    const parent = dirname6(dir);
+    const parent = dirname5(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -3362,8 +2982,8 @@ function findBuilder(from) {
 }
 async function deployCloudflare(project, opts) {
   const app = project.appDir;
-  const configPath = join10(app, "wrangler.jsonc");
-  if (!existsSync10(configPath))
+  const configPath = join8(app, "wrangler.jsonc");
+  if (!existsSync8(configPath))
     return fail("wrangler.jsonc is missing — `vc generate` writes it.");
   const bin = findWrangler(app);
   if (!bin)
@@ -3376,16 +2996,16 @@ async function deployCloudflare(project, opts) {
 ${who.raw.trim().split(`
 `).slice(-4).join(`
 `)}`);
-  console.log(`${color6.green("✓")} wrangler is logged in`);
+  console.log(`${color4.green("✓")} wrangler is logged in`);
   let config = readConfig(configPath);
   let accountId = config.account_id || process.env["CLOUDFLARE_ACCOUNT_ID"] || "";
   if (!accountId) {
     if (who.accounts.length === 1) {
       accountId = who.accounts[0].id;
-      writeFileSync2(configPath, upsertJsonc(readFileSync5(configPath, "utf8"), "account_id", accountId));
+      writeFileSync(configPath, upsertJsonc(readFileSync3(configPath, "utf8"), "account_id", accountId));
       project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId };
       await writeManifest(project.root, project.manifest);
-      console.log(`${color6.green("✓")} pinned the account "${who.accounts[0].name}" in wrangler.jsonc`);
+      console.log(`${color4.green("✓")} pinned the account "${who.accounts[0].name}" in wrangler.jsonc`);
     } else {
       return fail(`the account is not pinned and wrangler sees ${who.accounts.length}. Set account_id in wrangler.jsonc to one of:
 ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
@@ -3397,7 +3017,7 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   if (!check.ready) {
     if (!opts.force)
       return fail("refusing to deploy a shop that is not ready for customers. Fix the above, or pass --force for a deliberate partial deploy.");
-    console.error(color6.yellow(`--force: deploying a shop that is NOT ready for customers.
+    console.error(color4.yellow(`--force: deploying a shop that is NOT ready for customers.
 `));
   }
   const worker = config.name || project.manifest.shop.domain.split(".")[0];
@@ -3408,28 +3028,49 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
       return fail("the D1 database is not provisioned. Run once with --provision to create it and record its id.");
     const db = await ensureD1(bin, app, `${worker}-db`);
     const entry = { binding: "DB", database_name: db.name, database_id: db.uuid, migrations_dir: "./db/migrations" };
-    writeFileSync2(configPath, upsertJsonc(readFileSync5(configPath, "utf8"), "d1_databases", [entry]));
+    writeFileSync(configPath, upsertJsonc(readFileSync3(configPath, "utf8"), "d1_databases", [entry]));
     project.manifest.cloudflare = { ...project.manifest.cloudflare, accountId, d1: { name: db.name, id: db.uuid } };
     await writeManifest(project.root, project.manifest);
-    console.log(`${color6.green("✓")} D1 "${db.name}" recorded in wrangler.jsonc and voidcommerce.json`);
+    console.log(`${color4.green("✓")} D1 "${db.name}" recorded in wrangler.jsonc and voidcommerce.json`);
     config = readConfig(configPath);
   }
   if (opts.provision) {
     await ensureQueue(bin, app, "commerce");
-    console.log(`${color6.green("✓")} queue "commerce"`);
+    console.log(`${color4.green("✓")} queue "commerce"`);
   }
   const builder = findBuilder(app);
   if (!builder)
     return fail("no build tool: neither vite-plus nor vite is installed.");
+  const merging = oneOrigin(project.manifest.layout) && !isSingleApp(project.manifest.layout);
+  if (merging) {
+    console.log(`
+▸ ${builder.label} ${color4.dim("(the storefront)")}`);
+    const storefront = await wrangler(builder.cmd, ["build"], project.root, true);
+    if (storefront.code !== 0)
+      return fail(`the storefront build failed (exit ${storefront.code}).`);
+  }
   console.log(`
-▸ ${builder.label}`);
+▸ ${builder.label}${merging ? color4.dim(" (the worker)") : ""}`);
   const built = await wrangler(builder.cmd, ["build"], app, true);
   if (built.code !== 0)
     return fail(`the build failed (exit ${built.code}).`);
-  const emittedPath = join10(app, "dist", "ssr", "wrangler.json");
-  if (!existsSync10(emittedPath))
+  if (merging) {
+    const from = join8(project.root, "dist", "client");
+    const into = join8(app, "dist", "client");
+    if (!existsSync8(from))
+      return fail(`the storefront build emitted no ${from} — is the root a Void app with output "static"?`);
+    if (!existsSync8(into))
+      return fail(`the worker build emitted no ${into}; there is nothing to merge into.`);
+    const merged = mergeTree(from, into, new Set([".vite"]));
+    if (!existsSync8(join8(into, "index.html"))) {
+      return fail("the storefront produced no index.html, so the shop has no front page.");
+    }
+    console.log(`${color4.green("✓")} folded ${merged} storefront file${merged === 1 ? "" : "s"} into the worker's assets`);
+  }
+  const emittedPath = join8(app, "dist", "ssr", "wrangler.json");
+  if (!existsSync8(emittedPath))
     return fail(`the build emitted no ${emittedPath} — is this a Void app on the Cloudflare target?`);
-  const emitted = JSON.parse(readFileSync5(emittedPath, "utf8"));
+  const emitted = JSON.parse(readFileSync3(emittedPath, "utf8"));
   const secretKeys = new Set(allEnvKeys(project.manifest).filter((key) => !key.plaintext).map((key) => key.key));
   const scrubbed = [];
   for (const [key, value] of Object.entries(emitted.vars ?? {})) {
@@ -3441,8 +3082,8 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const emittedD1 = emitted.d1_databases?.find((db) => db.binding === "DB");
   if (!emittedD1 || emittedD1.database_id === "local")
     return fail("the emitted config still carries a placeholder D1 id; wrangler.jsonc's DB binding was not picked up by the build.");
-  writeFileSync2(emittedPath, JSON.stringify(emitted, null, 2));
-  console.log(`${color6.green("✓")} scrubbed ${scrubbed.length} baked value${scrubbed.length === 1 ? "" : "s"} from the worker's vars${scrubbed.length ? `: ${scrubbed.join(", ")}` : ""}`);
+  writeFileSync(emittedPath, JSON.stringify(emitted, null, 2));
+  console.log(`${color4.green("✓")} scrubbed ${scrubbed.length} baked value${scrubbed.length === 1 ? "" : "s"} from the worker's vars${scrubbed.length ? `: ${scrubbed.join(", ")}` : ""}`);
   console.log(`
 ▸ wrangler d1 migrations apply ${emittedD1.database_name} --remote`);
   const migrated = await wrangler(bin, ["d1", "migrations", "apply", emittedD1.database_name, "--remote"], app, true);
@@ -3450,34 +3091,52 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
     return fail(`applying migrations failed (exit ${migrated.code}); nothing was deployed.`);
   const secretArgs = [];
   let cleanupSecrets;
-  if (existsSync10(join10(project.root, SECRETS_FILE))) {
+  if (existsSync8(join8(project.root, SECRETS_FILE))) {
     const decrypted = await decryptSecrets(project);
     if ("error" in decrypted)
       return fail(`the repository's secrets could not be read: ${decrypted.error}`);
     secretArgs.push("--secrets-file", decrypted.path);
     cleanupSecrets = decrypted.cleanup;
-    console.log(`${color6.green("✓")} ${decrypted.names.length} secrets from ${SECRETS_FILE}, uploaded with this version`);
+    console.log(`${color4.green("✓")} ${decrypted.names.length} secrets from ${SECRETS_FILE}, uploaded with this version`);
   }
   console.log(`
 ▸ wrangler deploy -c dist/ssr/wrangler.json`);
-  const deployed = await wrangler(bin, ["deploy", "-c", join10("dist", "ssr", "wrangler.json"), ...secretArgs], app, true);
+  const deployed = await wrangler(bin, ["deploy", "-c", join8("dist", "ssr", "wrangler.json"), ...secretArgs], app, true);
   cleanupSecrets?.();
   if (deployed.code !== 0)
     return fail(`wrangler deploy failed (exit ${deployed.code}).`);
   const domain = project.manifest.shop.domain;
   const url = `https://${workerHosts(project.manifest)[0]}`;
   console.log(`
-${color6.green("Live:")} ${url}`);
-  if (hasFrontend(project.manifest.layout))
-    console.log(color6.dim("The storefront deploys itself from GitHub Actions on push."));
+${color4.green("Live:")} ${url}`);
+  if (hasFrontend(project.manifest.layout) && !oneOrigin(project.manifest.layout)) {
+    console.log(color4.dim("The storefront deploys itself from GitHub Actions on push."));
+  }
   return 0;
 }
+function mergeTree(from, into, skip) {
+  let count = 0;
+  for (const entry of readdirSync2(from, { withFileTypes: true })) {
+    if (skip.has(entry.name))
+      continue;
+    const source = join8(from, entry.name);
+    const target = join8(into, entry.name);
+    if (entry.isDirectory()) {
+      mkdirSync(target, { recursive: true });
+      count += mergeTree(source, target, skip);
+    } else {
+      copyFileSync(source, target);
+      count += 1;
+    }
+  }
+  return count;
+}
 
 // src/import.ts
 import { readFile as readFile3 } from "node:fs/promises";
-import { existsSync as existsSync11 } from "node:fs";
-import { join as join11 } from "node:path";
-import color7 from "picocolors";
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join9 } from "node:path";
+import color5 from "picocolors";
 function describe(counts) {
   if (!counts)
     return "";
@@ -3516,7 +3175,7 @@ async function post(url, key, body) {
   return { ok: response.ok, status: response.status, body: { ...parsed, error: parsed.error ?? parsed.message } };
 }
 async function readJson(path) {
-  if (!existsSync11(path))
+  if (!existsSync9(path))
     return null;
   try {
     return JSON.parse(await readFile3(path, "utf8"));
@@ -3544,41 +3203,41 @@ async function importCommand(args) {
   }
   const { url, how } = resolveTarget(project, args);
   if (!dry)
-    console.log(`${color7.dim("→")} ${url} ${color7.dim(`(${how})`)}
+    console.log(`${color5.dim("→")} ${url} ${color5.dim(`(${how})`)}
 `);
   if (!dry) {
     let whoami2;
     try {
       whoami2 = await fetch(`${url}/api/auth/system/whoami`, { headers: { "x-system-key": key } });
     } catch (error) {
-      console.error(`${color7.red("✗")} could not reach ${url}: ${error instanceof Error ? error.message : String(error)}
+      console.error(`${color5.red("✗")} could not reach ${url}: ${error instanceof Error ? error.message : String(error)}
 ` + `  Is the shop running? \`vc dev\` serves it locally; --local points here.
 `);
       return 1;
     }
     if (!whoami2.ok) {
-      console.error(`${color7.red("✗")} the shop refused the system key (HTTP ${whoami2.status}).
+      console.error(`${color5.red("✗")} the shop refused the system key (HTTP ${whoami2.status}).
 ` + `  Is SYSTEM_API_KEY the one this deployment was given?
 `);
       return 1;
     }
-    console.log(`${color7.green("✓")} authenticated as the system identity`);
+    console.log(`${color5.green("✓")} authenticated as the system identity`);
   }
   const root = project.root;
-  const products = await readJson(join11(root, "data", "catalog.json"));
-  const categories = await readJson(join11(root, "data", "categories.json"));
-  const faqs = has(project.manifest, "faqs") ? await readJson(join11(root, "content", "faqs.json")) : null;
-  const posts = has(project.manifest, "blogs") ? await readJson(join11(root, "content", "posts.json")) : null;
+  const products = await readJson(join9(root, "data", "catalog.json"));
+  const categories = await readJson(join9(root, "data", "categories.json"));
+  const faqs = has(project.manifest, "faqs") ? await readJson(join9(root, "content", "faqs.json")) : null;
+  const posts = has(project.manifest, "blogs") ? await readJson(join9(root, "content", "posts.json")) : null;
   if (!products && !faqs?.length && !posts?.length) {
     console.log(`
-${color7.yellow("Nothing to import.")} data/catalog.json is absent and the content files are empty.
+${color5.yellow("Nothing to import.")} data/catalog.json is absent and the content files are empty.
 ` + `Products go in data/catalog.json as a JSON array; \`vc import --dry-run\` checks it without pushing.
 `);
     return 0;
   }
   if (dry) {
     console.log(`
-${color7.dim("--dry-run: nothing was pushed.")}`);
+${color5.dim("--dry-run: nothing was pushed.")}`);
     console.log(`  ${products?.length ?? 0} products, ${categories?.length ?? 0} categories`);
     console.log(`  ${faqs?.length ?? 0} FAQ entries, ${posts?.length ?? 0} posts
 `);
@@ -3594,15 +3253,15 @@ ${color7.dim("--dry-run: nothing was pushed.")}`);
     });
     if (result.ok) {
       const report = result.body.report ?? {};
-      console.log(`${color7.green("✓")} products:   ${describe(report.products)}`);
+      console.log(`${color5.green("✓")} products:   ${describe(report.products)}`);
       if (report.categories)
-        console.log(`${color7.green("✓")} categories: ${describe(report.categories)}`);
+        console.log(`${color5.green("✓")} categories: ${describe(report.categories)}`);
       if (report.prices)
-        console.log(`${color7.green("✓")} prices:     ${describe(report.prices)}`);
+        console.log(`${color5.green("✓")} prices:     ${describe(report.prices)}`);
       if (report.addons)
-        console.log(`${color7.green("✓")} addons:     ${describe(report.addons)}`);
+        console.log(`${color5.green("✓")} addons:     ${describe(report.addons)}`);
     } else {
-      console.error(`${color7.red("✗")} catalogue: ${result.body.error ?? `HTTP ${result.status}`}`);
+      console.error(`${color5.red("✗")} catalogue: ${result.body.error ?? `HTTP ${result.status}`}`);
       failed = true;
     }
   }
@@ -3614,20 +3273,20 @@ ${color7.dim("--dry-run: nothing was pushed.")}`);
       continue;
     const result = await post(`${url}${path}`, key, { entries: rows, posts: rows });
     if (result.ok) {
-      console.log(`${color7.green("✓")} ${label}: ${describe(result.body)}`);
+      console.log(`${color5.green("✓")} ${label}: ${describe(result.body)}`);
     } else {
-      console.error(`${color7.red("✗")} ${label}: ${result.body.error ?? `HTTP ${result.status}`}`);
+      console.error(`${color5.red("✗")} ${label}: ${result.body.error ?? `HTTP ${result.status}`}`);
       failed = true;
     }
   }
   if (failed) {
     console.error(`
-${color7.red("Some of it did not land.")} The import is an upsert, so fixing the cause and running it again is safe.
+${color5.red("Some of it did not land.")} The import is an upsert, so fixing the cause and running it again is safe.
 `);
     return 1;
   }
   console.log(`
-${color7.green("Imported.")} It is an upsert, so running it again costs one pass and changes nothing.
+${color5.green("Imported.")} It is an upsert, so running it again costs one pass and changes nothing.
 `);
   return 0;
 }
@@ -3648,4 +3307,4 @@ async function importHelp() {
   return 0;
 }
 
-export { renderAuthTs, allEnvKeys, renderEnvTs, renderEnvExample, renderEnvLocal, renderEnvProduction, envSummary, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, parseWhoAmI, keysCommand, SECRETS_FILE, PRIVATE_KEY_VAR, plaintextSecretNames, secretsCommand, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };
+export { renderAuthTs, FRONTEND_BRANCH, renderFrontendApiTs, renderFrontendEnvProduction, renderStorefrontPage, renderFrontendWorkflow, runVoid, runInherit, captureVoid, isVoidApp, voidAppsIn, STRICT_APP, VOID_VERSION, strictDependencies, renderVoidPatch, renderViteConfig, renderStrictTsconfig, renderVoidJson, renderDbSchema, renderDbSeed, renderLayoutTsx, renderAppCss, renderIndexServer, INDEX_PAGE, renderDashboardPage, CLIENT_ONLY, renderSignInPage, renderAuthClient, renderContentTs, renderCron, renderQueue, renderLiveStream, renderLiveRoute, renderStrictAppPackageJson, DATA_README, BRANDING_README, MIGRATIONS_README, finishStrict, line, row, box, fullHelp, initHelp, version, findProject, ensureGenerated, DIST_DIR, DIST_BRANCH, distCommand, distHelp, renderDistWorkflow, renderDeployReadme, renderRequirementsTs, renderDomainTs, generate, parseJsonc, upsertJsonc, findWrangler, parseWhoAmI, productionEnv, routeProblem, preflight, printPreflight, deployCloudflare, importCommand, importHelp };