@saastemly/voidcommerce 0.5.0 → 0.6.0

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-5m3t0zfc.js";
+} from "./index-f1wds190.js";
 import {
   PRIVATE_KEY_VAR,
   SECRETS_FILE,
@@ -42,14 +42,15 @@ import {
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-b9b4dawy.js";
+} from "./index-2qt2yh3z.js";
 import {
   LAYOUTS,
+  oneOrigin,
   readManifest,
   validate,
   writeManifest,
   zoneOf
-} from "./index-pz6m2hkm.js";
+} from "./index-xx5p4b8d.js";
 import {
   GROUPS
 } from "./index-844b3qn9.js";
@@ -436,6 +437,7 @@ ${color3.dim(`Included: ${required.map((choice) => choice.label).join(", ")}`)}`
 async function runWizard(existing, layout) {
   const monorepo = layout === "monorepo";
   const frontend = layout !== "app";
+  const onPages = !oneOrigin(layout);
   const shop = unwrap(await p.group({
     name: () => p.text({
       message: "Shop name",
@@ -492,7 +494,7 @@ async function runWizard(existing, layout) {
       initialValue: existing?.shop.locale ?? "",
       validate: (value) => /^[a-z]{2}(-[A-Z]{2})?$/.test(value.trim()) ? undefined : "like da, or en-GB."
     }),
-    ...frontend ? {
+    ...onPages ? {
       pagesHost: () => p.text({
         message: `GitHub Pages host ${color3.dim("— where the storefront is published; leave blank if you serve the branch elsewhere")}`,
         placeholder: "northwind.github.io",
@@ -523,7 +525,7 @@ ${color3.dim("The generated storefront and panel. Strict has no custom code to h
       locale: shop.locale.trim(),
       taxRegistered: shop.taxRegistered === "yes",
       zone: shop.zone?.trim().toLowerCase() || undefined,
-      pagesHost: frontend ? shop.pagesHost?.trim().toLowerCase() || undefined : undefined
+      pagesHost: onPages ? shop.pagesHost?.trim().toLowerCase() || undefined : undefined
     },
     chosen
   };
@@ -611,7 +613,7 @@ async function init(args) {
   } else {
     const parts = [
       ["api", "the D1 starter — this is the worker"],
-      ["frontend", "Static Pages — this is prerendered for GitHub Pages"]
+      ["frontend", "the storefront — prerendered and served from the worker's own assets"]
     ];
     for (const [dir, starter] of parts) {
       const target = join(root, dir);

package/dist/generate/frontend.d.ts

@@ -1,4 +1,4 @@
-import type { Manifest } from "../manifest";
+import { type Manifest } from "../manifest";
 /**
  * The storefront: a static Void site that talks to the worker over HTTP.
  *

package/dist/{index-b9b4dawy.js → index-2qt2yh3z.js}

@@ -3,7 +3,7 @@ import {
   hasFrontend,
   isApex,
   zone
-} from "./index-pz6m2hkm.js";
+} from "./index-xx5p4b8d.js";
 import {
   __require,
   __toESM
@@ -368,7 +368,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-b91c72zp.js");
+    const { publicKeyFor } = await import("./keys-qwvt324e.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {

package/dist/{index-5m3t0zfc.js → index-f1wds190.js}

@@ -9,19 +9,20 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-b9b4dawy.js";
+} from "./index-2qt2yh3z.js";
 import {
   MANIFEST_FILE,
   has,
   hasFrontend,
   isSingleApp,
+  oneOrigin,
   packagesOf,
   readManifest,
   specifier,
   workerHosts,
   writeManifest,
   zone
-} from "./index-pz6m2hkm.js";
+} from "./index-xx5p4b8d.js";
 import {
   CHOICES
 } from "./index-844b3qn9.js";
@@ -363,6 +364,22 @@ var camel = (id) => id.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 var FRONTEND_OUT = "dist/client";
 var FRONTEND_BRANCH = "frontend-static";
 function renderFrontendApiTs(manifest) {
+  if (oneOrigin(manifest.layout)) {
+    return `import { createAuthClient } from "better-auth/react";
+import { commerceClient } from "@saastemly/better-commerce/client";
+
+/**
+ * The one client the storefront talks through.
+ *
+ * SAME ORIGIN. One worker serves this page and the API it calls, so there is
+ * no address to configure, nothing to bake at build time, and nothing that
+ * can point at the wrong place. Cookies are first-party, so no SameSite=None
+ * and no CORS preflight on any request.
+ */
+export const API_ORIGIN = "";
+export const api = createAuthClient({ plugins: [commerceClient()] });
+`;
+  }
   return `/// <reference types="vite/client" />
 import { createAuthClient } from "better-auth/react";
 import { commerceClient } from "@saastemly/better-commerce/client";
@@ -383,6 +400,13 @@ export const api = createAuthClient({ baseURL: API_ORIGIN, plugins: [commerceCli
 `;
 }
 function renderFrontendEnvProduction(manifest) {
+  if (oneOrigin(manifest.layout)) {
+    return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
+#
+# The API is same-origin, so there is no VITE_API_ORIGIN: one worker serves
+# this storefront and the endpoints it calls.
+`;
+  }
   return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
 VITE_API_ORIGIN=https://api.${manifest.shop.domain}
 `;
@@ -506,9 +530,8 @@ function renderFrontendWorkflow(manifest, dir) {
 # Generated by \`vc init\` from voidcommerce.json.
 #
 # Builds the storefront and force-pushes the prerendered tree to
-# \`${FRONTEND_BRANCH}\`. Point GitHub Pages (or Cloudflare Pages) at that branch
-# and a push here is a live storefront. The worker deploys separately, from
-# \`void-dist\`.
+# \`${FRONTEND_BRANCH}\`, which GitHub Pages serves. The worker deploys
+# separately, from deploy.yml.
 on:
   push:
     branches: [main, master]
@@ -1310,7 +1333,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.5.0",
+  version: "0.6.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1775,6 +1798,14 @@ That is the deploy. GitHub Actions regenerates the app from
 database and queue if they are not there, applies the migrations, and deploys
 the worker with this repository's secrets attached.
 
+**One worker serves everything.** The storefront is prerendered and folded
+into the worker's own static assets, so \`${manifest.shop.domain}\` answers with
+the shop, the admin panel and the API from a single origin. Cloudflare creates
+the hostname's DNS record and certificate itself, because it is a Worker
+custom domain. There is nothing to configure in any dashboard, no second
+branch to keep in step, and no CORS — the storefront's requests are
+first-party.
+
 You do not need wrangler on your machine, and you do not need to be logged
 into it. You do not need to open the Cloudflare dashboard after the one step
 below.
@@ -1914,7 +1945,7 @@ export function check(present: Map<string, string | undefined>): Requirement[] {
 
 // src/generate/support.ts
 function renderDomainTs(layout) {
-  const derive = layout === "app" ? `	// One app: the worker IS the site. No separate API host, and no other
+  const derive = layout !== "monorepo" ? `	// One origin: the worker IS the site. No separate API host, and no other
 	// origin to trust. It answers on www too, but only at a zone's apex —
 	// www.shop.example.com is not a name anybody types.
 	const hosts = apex ? [host, www] : [host];
@@ -1925,7 +1956,7 @@ function renderDomainTs(layout) {
   return `/**
  * The shop's domain, and everything derived from it.
  *
- * One variable. \`SHOP_DOMAIN\` gives ${layout === "app" ? "the worker's hostnames" : `api.<domain> for the worker and the
+ * One variable. \`SHOP_DOMAIN\` gives ${layout !== "monorepo" ? "the worker's hostnames" : `api.<domain> for the worker and the
  * storefront's origins`}, the app's public origin, and the
  * CORS and CSRF allow-list. They were four settings that had to agree and
  * nothing checked that they did.
@@ -1968,11 +1999,13 @@ export const GITHUB_PAGES_AAAA = ["2606:50c0:8000::153", "2606:50c0:8001::153",
 /**
  * The storefront's records. DNS-only, never proxied: GitHub issues the
  * certificate itself and validates by reaching the origin. The API hostname
- * is NOT here — it is a Cloudflare custom domain in wrangler.jsonc.${layout === "app" ? `
- * One app has no storefront elsewhere, so this is always empty.` : ""}
+ * is NOT here — it is a Cloudflare custom domain in wrangler.jsonc.${layout !== "monorepo" ? `
+ * One worker serves the storefront, so this is always empty.` : ""}
  */
 export function storefrontRecords(domain: ShopDomain, pagesHost: string) {
-	if (!pagesHost${layout === "app" ? " || domain.frontendOrigins.length === 0" : ""}) return [];
+	// Empty whenever one worker serves the storefront: Cloudflare creates the
+	// hostname's record and certificate itself for a custom domain.
+	if (!pagesHost || domain.frontendOrigins.length === 0) return [];
 	// The record's name is relative to the zone: "@" at the apex, otherwise the
 	// labels in front of it.
 	const name = domain.apex ? "@" : domain.host.slice(0, -(domain.zone.length + 1));
@@ -2338,7 +2371,11 @@ async function generateFrontend(root, dir, manifest, result) {
   await put(root, at("void.json"), renderFrontendVoidJson(), result, "own");
   await put(root, at("tsconfig.json"), renderFrontendTsconfig(), result, "own");
   await put(root, at("pages/index.tsx"), renderStorefrontPage(manifest), result, "own");
-  await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+  if (oneOrigin(manifest.layout)) {
+    await retire(root, ".github/workflows/frontend-static.yml", result);
+  } else {
+    await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+  }
   if (dir === "")
     return;
   await mergeJson(root, at("package.json"), { name: `${manifest.shop.domain.split(".")[0]}-frontend`, type: "module", private: true }, (pkg) => {
@@ -2440,8 +2477,13 @@ async function generateStrictApp(root, dir, manifest, result) {
   await put(root, at("db/seed.ts"), renderDbSeed(), result, gen);
   await put(root, at("pages/layout.tsx"), renderLayoutTsx(), result, gen);
   await put(root, at("pages/app.css"), renderAppCss(), result, gen);
-  await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
-  await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+  if (!oneOrigin(manifest.layout) || isSingleApp(manifest.layout)) {
+    await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
+    await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+  } else {
+    await retire(root, at("pages/index.server.ts"), result);
+    await retire(root, at("pages/index.tsx"), result);
+  }
   await put(root, at("pages/api-dashboard/index.tsx"), renderDashboardPage(manifest), result, gen);
   await put(root, at("pages/api-dashboard/index.server.ts"), CLIENT_ONLY, result, gen);
   await put(root, at("pages/sign-in/index.tsx"), renderSignInPage(manifest), result, gen);
@@ -2909,7 +2951,7 @@ ${color3.red("NOT ready to go live.")}
 }
 
 // src/deploy/cloudflare.ts
-import { existsSync as existsSync8, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync as existsSync8, mkdirSync, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync } from "node:fs";
 import { dirname as dirname5, join as join8 } from "node:path";
 import color4 from "picocolors";
 var fail = (message) => {
@@ -2999,11 +3041,32 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const builder = findBuilder(app);
   if (!builder)
     return fail("no build tool: neither vite-plus nor vite is installed.");
+  const merging = oneOrigin(project.manifest.layout) && !isSingleApp(project.manifest.layout);
+  if (merging) {
+    console.log(`
+▸ ${builder.label} ${color4.dim("(the storefront)")}`);
+    const storefront = await wrangler(builder.cmd, ["build"], project.root, true);
+    if (storefront.code !== 0)
+      return fail(`the storefront build failed (exit ${storefront.code}).`);
+  }
   console.log(`
-▸ ${builder.label}`);
+▸ ${builder.label}${merging ? color4.dim(" (the worker)") : ""}`);
   const built = await wrangler(builder.cmd, ["build"], app, true);
   if (built.code !== 0)
     return fail(`the build failed (exit ${built.code}).`);
+  if (merging) {
+    const from = join8(project.root, "dist", "client");
+    const into = join8(app, "dist", "client");
+    if (!existsSync8(from))
+      return fail(`the storefront build emitted no ${from} — is the root a Void app with output "static"?`);
+    if (!existsSync8(into))
+      return fail(`the worker build emitted no ${into}; there is nothing to merge into.`);
+    const merged = mergeTree(from, into, new Set([".vite"]));
+    if (!existsSync8(join8(into, "index.html"))) {
+      return fail("the storefront produced no index.html, so the shop has no front page.");
+    }
+    console.log(`${color4.green("✓")} folded ${merged} storefront file${merged === 1 ? "" : "s"} into the worker's assets`);
+  }
   const emittedPath = join8(app, "dist", "ssr", "wrangler.json");
   if (!existsSync8(emittedPath))
     return fail(`the build emitted no ${emittedPath} — is this a Void app on the Cloudflare target?`);
@@ -3046,10 +3109,28 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const url = `https://${workerHosts(project.manifest)[0]}`;
   console.log(`
 ${color4.green("Live:")} ${url}`);
-  if (hasFrontend(project.manifest.layout))
+  if (hasFrontend(project.manifest.layout) && !oneOrigin(project.manifest.layout)) {
     console.log(color4.dim("The storefront deploys itself from GitHub Actions on push."));
+  }
   return 0;
 }
+function mergeTree(from, into, skip) {
+  let count = 0;
+  for (const entry of readdirSync2(from, { withFileTypes: true })) {
+    if (skip.has(entry.name))
+      continue;
+    const source = join8(from, entry.name);
+    const target = join8(into, entry.name);
+    if (entry.isDirectory()) {
+      mkdirSync(target, { recursive: true });
+      count += mergeTree(source, target, skip);
+    } else {
+      copyFileSync(source, target);
+      count += 1;
+    }
+  }
+  return count;
+}
 
 // src/import.ts
 import { readFile as readFile3 } from "node:fs/promises";

package/dist/{index-pz6m2hkm.js → index-xx5p4b8d.js}

@@ -21,11 +21,12 @@ var LAYOUTS = [
   {
     id: "strict",
     label: "Strict (experimental)",
-    hint: "the root IS the storefront, sharing one package.json; the worker is generated under .vc/app from the manifest and never hand-edited"
+    hint: "the root IS the storefront, sharing one package.json; the worker is generated under .vc/app and serves the storefront from its own assets — one origin, one deploy"
   }
 ];
 var isSingleApp = (layout) => layout === "app";
 var hasFrontend = (layout) => layout !== "app";
+var oneOrigin = (layout) => layout !== "monorepo";
 var TWO_LABEL_SUFFIXES = new Set(["co", "com", "net", "org", "ac", "gov", "edu", "or", "ne", "in"]);
 function zoneOf(domain) {
   const labels = domain.trim().toLowerCase().replace(/\.$/, "").split(".");
@@ -42,7 +43,7 @@ function isApex(manifest) {
 }
 function workerHosts(manifest) {
   const { domain } = manifest.shop;
-  if (!isSingleApp(manifest.layout))
+  if (!oneOrigin(manifest.layout))
     return [`api.${domain}`];
   return isApex(manifest) ? [domain, `www.${domain}`] : [domain];
 }
@@ -163,10 +164,10 @@ function validate(manifest) {
   if (dns.includes("simply")) {
     problems.push(`DNS at Simply.com cannot host ${workerHosts(manifest)[0]} — a Worker custom domain is created by Cloudflare, in a zone on Cloudflare`);
   }
-  if (hasFrontend(manifest.layout) && manifest.shop.pagesHost && !/^[a-z0-9-]+\.github\.io$/i.test(manifest.shop.pagesHost)) {
+  if (!oneOrigin(manifest.layout) && manifest.shop.pagesHost && !/^[a-z0-9-]+\.github\.io$/i.test(manifest.shop.pagesHost)) {
     problems.push(`Pages host "${manifest.shop.pagesHost}" should be <owner>.github.io`);
   }
   return problems;
 }
 
-export { MANIFEST_FILE, LAYOUTS, isSingleApp, hasFrontend, zoneOf, zone, isApex, workerHosts, withRequired, has, chosenIn, envKeysOf, OWN_PACKAGES, specifier, packagesOf, readManifest, writeManifest, validate };
+export { MANIFEST_FILE, LAYOUTS, isSingleApp, hasFrontend, oneOrigin, zoneOf, zone, isApex, workerHosts, withRequired, has, chosenIn, envKeysOf, OWN_PACKAGES, specifier, packagesOf, readManifest, writeManifest, validate };

package/dist/index.js

@@ -51,7 +51,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-5m3t0zfc.js";
+} from "./index-f1wds190.js";
 import {
   allEnvKeys,
   envSummary,
@@ -59,7 +59,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-b9b4dawy.js";
+} from "./index-2qt2yh3z.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -70,6 +70,7 @@ import {
   hasFrontend,
   isApex,
   isSingleApp,
+  oneOrigin,
   packagesOf,
   readManifest,
   specifier,
@@ -79,7 +80,7 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-pz6m2hkm.js";
+} from "./index-xx5p4b8d.js";
 import {
   AUTH_PLUGINS,
   CARRIERS,
@@ -147,6 +148,7 @@ export {
   parseWhoAmI,
   parseJsonc,
   packagesOf,
+  oneOrigin,
   isSingleApp,
   isApex,
   importCommand,

package/dist/{keys-b91c72zp.js → keys-qwvt324e.js}

@@ -5,8 +5,8 @@ import {
   keysCommand,
   provisionKey,
   publicKeyFor
-} from "./index-b9b4dawy.js";
-import"./index-pz6m2hkm.js";
+} from "./index-2qt2yh3z.js";
+import"./index-xx5p4b8d.js";
 import"./index-844b3qn9.js";
 import"./index-0v6na3yp.js";
 export {

package/dist/manifest.d.ts

@@ -24,9 +24,10 @@ export declare const MANIFEST_FILE = "voidcommerce.json";
  *   strict    EXPERIMENTAL. A monorepo turned inside out. The REPOSITORY
  *             ROOT is the storefront — its package.json, its pages, yours to
  *             edit — and the worker is generated underneath it at .vc/app
- *             from the manifest, gitignored, never hand-edited. Hosted the
- *             way a monorepo is: the worker on api.<domain>, the storefront
- *             on <domain>.
+ *             from the manifest, gitignored, never hand-edited. ONE worker
+ *             serves both at <domain>: the storefront's prerendered tree is
+ *             folded into the worker's assets at build time, so there is one
+ *             origin, one deploy, and one certificate Cloudflare issues.
  *
  * The first question, because it decides where `void init` runs and what
  * the domain means. It cannot change after init: moving files is not a
@@ -47,8 +48,26 @@ export declare const LAYOUTS: Array<{
  * storefront on the domain itself.
  */
 export declare const isSingleApp: (layout: Layout) => boolean;
-/** Does this layout carry a storefront of its own, and so a second origin to trust? */
+/** Does this layout carry a storefront of its own, in the repository? */
 export declare const hasFrontend: (layout: Layout) => boolean;
+/**
+ * Does ONE worker serve both the storefront and the API?
+ *
+ * `app` always did — it generates its storefront into the worker. `strict`
+ * now does too: the root's prerendered tree is merged into the worker's own
+ * assets directory at build time, so there is one origin, one hostname, one
+ * deploy, and one certificate that Cloudflare issues itself.
+ *
+ * That deletes the whole GitHub Pages half — the A/AAAA records, the CNAME
+ * file, the base-path rewriting — and with it a trap worth naming: GitHub
+ * treats any Cloudflare IP as ineligible for a certificate, so a proxied
+ * record silently stops issuance AND renewal about ninety days later, while
+ * GitHub's own health check still reports green.
+ *
+ * `monorepo` keeps the split, because there the frontend is a separate app
+ * that a person may well want hosted separately.
+ */
+export declare const oneOrigin: (layout: Layout) => boolean;
 /** The zone a hostname most likely belongs to: the registrable domain. */
 export declare function zoneOf(domain: string): string;
 /** The zone this shop's records go in. */
@@ -88,7 +107,10 @@ export interface Manifest {
          * default that is safe to assume.
          */
         taxRegistered?: boolean | undefined;
-        /** `saastemly.github.io` — the monorepo's frontend lives on GitHub Pages; the www record points here. */
+        /**
+         * `saastemly.github.io` — only a MONOREPO has a storefront on GitHub
+         * Pages. In `app` and `strict` the worker serves it, so this is unused.
+         */
         pagesHost?: string | undefined;
     };
     /** Chosen ids from each group, keyed by group id. */

package/dist/manifest.js

@@ -8,6 +8,7 @@ import {
   hasFrontend,
   isApex,
   isSingleApp,
+  oneOrigin,
   packagesOf,
   readManifest,
   specifier,
@@ -17,7 +18,7 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-pz6m2hkm.js";
+} from "./index-xx5p4b8d.js";
 import"./index-844b3qn9.js";
 import"./index-0v6na3yp.js";
 export {
@@ -30,6 +31,7 @@ export {
   specifier,
   readManifest,
   packagesOf,
+  oneOrigin,
   isSingleApp,
   isApex,
   hasFrontend,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/deploy/cloudflare.ts

@@ -1,8 +1,8 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import color from "picocolors";
 import { allEnvKeys } from "../generate/env";
-import { hasFrontend, workerHosts, writeManifest } from "../manifest";
+import { hasFrontend, isSingleApp, oneOrigin, workerHosts, writeManifest } from "../manifest";
 import type { Project } from "../project";
 import { parseJsonc, upsertJsonc } from "./jsonc";
 import { preflight, printPreflight } from "./preflight";
@@ -130,10 +130,46 @@ export async function deployCloudflare(project: Project, opts: CloudflareOptions
 	// 4. build.
 	const builder = findBuilder(app);
 	if (!builder) return fail("no build tool: neither vite-plus nor vite is installed.");
-	console.log(`\n▸ ${builder.label}`);
+
+	// In strict the STOREFRONT is a second Void app, at the repository root,
+	// and it has to be built first: its prerendered tree is folded into the
+	// worker's assets below, and the worker's build is what emits the config
+	// that names that directory.
+	const merging = oneOrigin(project.manifest.layout) && !isSingleApp(project.manifest.layout);
+	if (merging) {
+		console.log(`\n▸ ${builder.label} ${color.dim("(the storefront)")}`);
+		const storefront = await wrangler(builder.cmd, ["build"], project.root, true);
+		if (storefront.code !== 0) return fail(`the storefront build failed (exit ${storefront.code}).`);
+	}
+
+	console.log(`\n▸ ${builder.label}${merging ? color.dim(" (the worker)") : ""}`);
 	const built = await wrangler(builder.cmd, ["build"], app, true);
 	if (built.code !== 0) return fail(`the build failed (exit ${built.code}).`);
 
+	// 4b. Fold the storefront into the worker's assets.
+	//
+	// Void's worker already serves static assets: it runs first for every
+	// request and calls `env.ASSETS.fetch` only when its own router 404s. So
+	// the storefront's prerendered files land in the same directory and are
+	// reached by exactly that fallback — no routing rules, no second origin.
+	//
+	// Filenames are content-hashed, so the two trees merge without collision.
+	// `.vite/manifest.json` is the one exception and is build metadata that
+	// should never be uploaded at all.
+	if (merging) {
+		const from = join(project.root, "dist", "client");
+		const into = join(app, "dist", "client");
+		if (!existsSync(from)) return fail(`the storefront build emitted no ${from} — is the root a Void app with output "static"?`);
+		if (!existsSync(into)) return fail(`the worker build emitted no ${into}; there is nothing to merge into.`);
+		const merged = mergeTree(from, into, new Set([".vite"]));
+		// The worker owns "/" only if it has a page for it. It must not, or the
+		// shop's front door is unreachable — so this is checked, not assumed.
+		if (!existsSync(join(into, "index.html"))) {
+			return fail("the storefront produced no index.html, so the shop has no front page.");
+		}
+		console.log(`${color.green("✓")} folded ${merged} storefront file${merged === 1 ? "" : "s"} into the worker's assets`);
+	}
+
 	// 5. scrub.
 	const emittedPath = join(app, "dist", "ssr", "wrangler.json");
 	if (!existsSync(emittedPath)) return fail(`the build emitted no ${emittedPath} — is this a Void app on the Cloudflare target?`);
@@ -183,6 +219,34 @@ export async function deployCloudflare(project: Project, opts: CloudflareOptions
 	const domain = project.manifest.shop.domain;
 	const url = `https://${workerHosts(project.manifest)[0]}`;
 	console.log(`\n${color.green("Live:")} ${url}`);
-	if (hasFrontend(project.manifest.layout)) console.log(color.dim("The storefront deploys itself from GitHub Actions on push."));
+	if (hasFrontend(project.manifest.layout) && !oneOrigin(project.manifest.layout)) {
+		console.log(color.dim("The storefront deploys itself from GitHub Actions on push."));
+	}
 	return 0;
 }
+
+
+/**
+ * Copy one built tree over another, skipping named directories.
+ *
+ * Deliberately additive rather than a replace: the worker's own client
+ * bundles are already in the target and must survive. Returns how many files
+ * were written, so the deploy can say so rather than claiming success
+ * silently.
+ */
+function mergeTree(from: string, into: string, skip: Set<string>): number {
+	let count = 0;
+	for (const entry of readdirSync(from, { withFileTypes: true })) {
+		if (skip.has(entry.name)) continue;
+		const source = join(from, entry.name);
+		const target = join(into, entry.name);
+		if (entry.isDirectory()) {
+			mkdirSync(target, { recursive: true });
+			count += mergeTree(source, target, skip);
+		} else {
+			copyFileSync(source, target);
+			count += 1;
+		}
+	}
+	return count;
+}

package/src/generate/ci.ts

@@ -176,6 +176,14 @@ That is the deploy. GitHub Actions regenerates the app from
 database and queue if they are not there, applies the migrations, and deploys
 the worker with this repository's secrets attached.
 
+**One worker serves everything.** The storefront is prerendered and folded
+into the worker's own static assets, so \`${manifest.shop.domain}\` answers with
+the shop, the admin panel and the API from a single origin. Cloudflare creates
+the hostname's DNS record and certificate itself, because it is a Worker
+custom domain. There is nothing to configure in any dashboard, no second
+branch to keep in step, and no CORS — the storefront's requests are
+first-party.
+
 You do not need wrangler on your machine, and you do not need to be logged
 into it. You do not need to open the Cloudflare dashboard after the one step
 below.

package/src/generate/frontend.ts

@@ -1,4 +1,4 @@
-import type { Manifest } from "../manifest";
+import { type Manifest, oneOrigin } from "../manifest";
 
 /**
  * The storefront: a static Void site that talks to the worker over HTTP.
@@ -24,6 +24,22 @@ export const FRONTEND_OUT = "dist/client";
 export const FRONTEND_BRANCH = "frontend-static";
 
 export function renderFrontendApiTs(manifest: Manifest): string {
+	if (oneOrigin(manifest.layout)) {
+		return `import { createAuthClient } from "better-auth/react";
+import { commerceClient } from "@saastemly/better-commerce/client";
+
+/**
+ * The one client the storefront talks through.
+ *
+ * SAME ORIGIN. One worker serves this page and the API it calls, so there is
+ * no address to configure, nothing to bake at build time, and nothing that
+ * can point at the wrong place. Cookies are first-party, so no SameSite=None
+ * and no CORS preflight on any request.
+ */
+export const API_ORIGIN = "";
+export const api = createAuthClient({ plugins: [commerceClient()] });
+`;
+	}
 	return `/// <reference types="vite/client" />
 import { createAuthClient } from "better-auth/react";
 import { commerceClient } from "@saastemly/better-commerce/client";
@@ -45,6 +61,13 @@ export const api = createAuthClient({ baseURL: API_ORIGIN, plugins: [commerceCli
 }
 
 export function renderFrontendEnvProduction(manifest: Manifest): string {
+	if (oneOrigin(manifest.layout)) {
+		return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
+#
+# The API is same-origin, so there is no VITE_API_ORIGIN: one worker serves
+# this storefront and the endpoints it calls.
+`;
+	}
 	return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
 VITE_API_ORIGIN=https://api.${manifest.shop.domain}
 `;
@@ -183,9 +206,8 @@ export function renderFrontendWorkflow(manifest: Manifest, dir: string): string
 # Generated by \`vc init\` from voidcommerce.json.
 #
 # Builds the storefront and force-pushes the prerendered tree to
-# \`${FRONTEND_BRANCH}\`. Point GitHub Pages (or Cloudflare Pages) at that branch
-# and a push here is a live storefront. The worker deploys separately, from
-# \`void-dist\`.
+# \`${FRONTEND_BRANCH}\`, which GitHub Pages serves. The worker deploys
+# separately, from deploy.yml.
 on:
   push:
     branches: [main, master]

package/src/generate/index.ts

@@ -2,7 +2,7 @@ import { cp, mkdir, readFile, readdir, rm, symlink, writeFile } from "node:fs/pr
 import { existsSync, lstatSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { CHOICES } from "../catalog";
-import { MANIFEST_FILE, type Manifest, has, isSingleApp, packagesOf, specifier, workerHosts, writeManifest, zone } from "../manifest";
+import { MANIFEST_FILE, type Manifest, has, isSingleApp, oneOrigin, packagesOf, specifier, workerHosts, writeManifest, zone } from "../manifest";
 import { renderAuthTs } from "./auth";
 import {
 	envSummary,
@@ -255,7 +255,7 @@ async function generateApi(root: string, dir: string, manifest: Manifest, result
 	);
 }
 
-/** The static storefront on GitHub Pages. Only in a monorepo. */
+/** The storefront: served by the worker in strict, by GitHub Pages in a monorepo. */
 async function generateFrontend(root: string, dir: string, manifest: Manifest, result: GenerateResult) {
 	const at = (file: string) => join(dir, file);
 
@@ -265,7 +265,14 @@ async function generateFrontend(root: string, dir: string, manifest: Manifest, r
 	await put(root, at("void.json"), renderFrontendVoidJson(), result, "own");
 	await put(root, at("tsconfig.json"), renderFrontendTsconfig(), result, "own");
 	await put(root, at("pages/index.tsx"), renderStorefrontPage(manifest), result, "own");
-	await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+	// A separate publishing workflow exists only when the storefront has a
+	// separate host. In strict the worker serves it, so the branch, the
+	// workflow, the CNAME file and the base-path rewriting all go away.
+	if (oneOrigin(manifest.layout)) {
+		await retire(root, ".github/workflows/frontend-static.yml", result);
+	} else {
+		await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+	}
 
 	// A monorepo's frontend is its own workspace; strict's shares the root's
 	// one package.json, which generateStrictRoot has already written.
@@ -404,8 +411,20 @@ async function generateStrictApp(root: string, dir: string, manifest: Manifest,
 	await put(root, at("db/seed.ts"), renderDbSeed(), result, gen);
 	await put(root, at("pages/layout.tsx"), renderLayoutTsx(), result, gen);
 	await put(root, at("pages/app.css"), renderAppCss(), result, gen);
-	await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
-	await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+	// In strict the STOREFRONT owns "/": its prerendered index.html is merged
+	// into the worker's assets, and the worker reaches assets only by 404ing
+	// first. A worker index page here would shadow the shop's front door.
+	if (!oneOrigin(manifest.layout) || isSingleApp(manifest.layout)) {
+		await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
+		await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+	} else {
+		// Deleted, not merely skipped. A shop regenerated from the older
+		// two-origin layout still has these on disk, and a leftover index page
+		// would answer "/" instead of 404ing through to the storefront — the
+		// shop would silently serve a blank redirect as its front door.
+		await retire(root, at("pages/index.server.ts"), result);
+		await retire(root, at("pages/index.tsx"), result);
+	}
 	await put(root, at("pages/api-dashboard/index.tsx"), renderDashboardPage(manifest), result, gen);
 	await put(root, at("pages/api-dashboard/index.server.ts"), CLIENT_ONLY, result, gen);
 	await put(root, at("pages/sign-in/index.tsx"), renderSignInPage(manifest), result, gen);

package/src/generate/support.ts

@@ -11,8 +11,8 @@ import { type Layout, type Manifest, has } from "../manifest";
 
 export function renderDomainTs(layout: Layout): string {
 	const derive =
-		layout === "app"
-			? `	// One app: the worker IS the site. No separate API host, and no other
+		layout !== "monorepo"
+			? `	// One origin: the worker IS the site. No separate API host, and no other
 	// origin to trust. It answers on www too, but only at a zone's apex —
 	// www.shop.example.com is not a name anybody types.
 	const hosts = apex ? [host, www] : [host];
@@ -24,7 +24,7 @@ export function renderDomainTs(layout: Layout): string {
 	return `/**
  * The shop's domain, and everything derived from it.
  *
- * One variable. \`SHOP_DOMAIN\` gives ${layout === "app" ? "the worker's hostnames" : "api.<domain> for the worker and the\n * storefront's origins"}, the app's public origin, and the
+ * One variable. \`SHOP_DOMAIN\` gives ${layout !== "monorepo" ? "the worker's hostnames" : "api.<domain> for the worker and the\n * storefront's origins"}, the app's public origin, and the
  * CORS and CSRF allow-list. They were four settings that had to agree and
  * nothing checked that they did.
  *
@@ -67,11 +67,13 @@ export const GITHUB_PAGES_AAAA = ["2606:50c0:8000::153", "2606:50c0:8001::153",
  * The storefront's records. DNS-only, never proxied: GitHub issues the
  * certificate itself and validates by reaching the origin. The API hostname
  * is NOT here — it is a Cloudflare custom domain in wrangler.jsonc.${
-	layout === "app" ? "\n * One app has no storefront elsewhere, so this is always empty." : ""
+	layout !== "monorepo" ? "\n * One worker serves the storefront, so this is always empty." : ""
 }
  */
 export function storefrontRecords(domain: ShopDomain, pagesHost: string) {
-	if (!pagesHost${layout === "app" ? " || domain.frontendOrigins.length === 0" : ""}) return [];
+	// Empty whenever one worker serves the storefront: Cloudflare creates the
+	// hostname's record and certificate itself for a custom domain.
+	if (!pagesHost || domain.frontendOrigins.length === 0) return [];
 	// The record's name is relative to the zone: "@" at the apex, otherwise the
 	// labels in front of it.
 	const name = domain.apex ? "@" : domain.host.slice(0, -(domain.zone.length + 1));

package/src/init.ts

@@ -94,7 +94,7 @@ export async function init(args: string[]): Promise<number> {
 	} else {
 		const parts: Array<[dir: string, starter: string]> = [
 			["api", "the D1 starter — this is the worker"],
-			["frontend", "Static Pages — this is prerendered for GitHub Pages"],
+			["frontend", "the storefront — prerendered and served from the worker's own assets"],
 		];
 		for (const [dir, starter] of parts) {
 			const target = join(root, dir);

package/src/manifest.ts

@@ -30,9 +30,10 @@ export const MANIFEST_FILE = "voidcommerce.json";
  *   strict    EXPERIMENTAL. A monorepo turned inside out. The REPOSITORY
  *             ROOT is the storefront — its package.json, its pages, yours to
  *             edit — and the worker is generated underneath it at .vc/app
- *             from the manifest, gitignored, never hand-edited. Hosted the
- *             way a monorepo is: the worker on api.<domain>, the storefront
- *             on <domain>.
+ *             from the manifest, gitignored, never hand-edited. ONE worker
+ *             serves both at <domain>: the storefront's prerendered tree is
+ *             folded into the worker's assets at build time, so there is one
+ *             origin, one deploy, and one certificate Cloudflare issues.
  *
  * The first question, because it decides where `void init` runs and what
  * the domain means. It cannot change after init: moving files is not a
@@ -54,7 +55,7 @@ export const LAYOUTS: Array<{ id: Layout; label: string; hint: string }> = [
 	{
 		id: "strict",
 		label: "Strict (experimental)",
-		hint: "the root IS the storefront, sharing one package.json; the worker is generated under .vc/app from the manifest and never hand-edited",
+		hint: "the root IS the storefront, sharing one package.json; the worker is generated under .vc/app and serves the storefront from its own assets — one origin, one deploy",
 	},
 ];
 
@@ -68,9 +69,28 @@ export const LAYOUTS: Array<{ id: Layout; label: string; hint: string }> = [
  */
 export const isSingleApp = (layout: Layout): boolean => layout === "app";
 
-/** Does this layout carry a storefront of its own, and so a second origin to trust? */
+/** Does this layout carry a storefront of its own, in the repository? */
 export const hasFrontend = (layout: Layout): boolean => layout !== "app";
 
+/**
+ * Does ONE worker serve both the storefront and the API?
+ *
+ * `app` always did — it generates its storefront into the worker. `strict`
+ * now does too: the root's prerendered tree is merged into the worker's own
+ * assets directory at build time, so there is one origin, one hostname, one
+ * deploy, and one certificate that Cloudflare issues itself.
+ *
+ * That deletes the whole GitHub Pages half — the A/AAAA records, the CNAME
+ * file, the base-path rewriting — and with it a trap worth naming: GitHub
+ * treats any Cloudflare IP as ineligible for a certificate, so a proxied
+ * record silently stops issuance AND renewal about ninety days later, while
+ * GitHub's own health check still reports green.
+ *
+ * `monorepo` keeps the split, because there the frontend is a separate app
+ * that a person may well want hosted separately.
+ */
+export const oneOrigin = (layout: Layout): boolean => layout !== "monorepo";
+
 /**
  * Public suffixes whose second label is not a registrable name, so
  * `shop.example.co.uk` is a subdomain of `example.co.uk`, not of `co.uk`.
@@ -100,7 +120,9 @@ export function isApex(manifest: Manifest): boolean {
 /** Every hostname the worker answers on — the wrangler routes, in order. */
 export function workerHosts(manifest: Manifest): string[] {
 	const { domain } = manifest.shop;
-	if (!isSingleApp(manifest.layout)) return [`api.${domain}`];
+	// Only a monorepo puts the worker on its own hostname; everything else
+	// serves the shop and its API from one origin.
+	if (!oneOrigin(manifest.layout)) return [`api.${domain}`];
 	return isApex(manifest) ? [domain, `www.${domain}`] : [domain];
 }
 
@@ -145,7 +167,10 @@ export interface Manifest {
 		 * default that is safe to assume.
 		 */
 		taxRegistered?: boolean | undefined;
-		/** `saastemly.github.io` — the monorepo's frontend lives on GitHub Pages; the www record points here. */
+		/**
+		 * `saastemly.github.io` — only a MONOREPO has a storefront on GitHub
+		 * Pages. In `app` and `strict` the worker serves it, so this is unused.
+		 */
 		pagesHost?: string | undefined;
 	};
 	/** Chosen ids from each group, keyed by group id. */
@@ -296,7 +321,7 @@ export function validate(manifest: Manifest): string[] {
 			`DNS at Simply.com cannot host ${workerHosts(manifest)[0]} — a Worker custom domain is created by Cloudflare, in a zone on Cloudflare`,
 		);
 	}
-	if (hasFrontend(manifest.layout) && manifest.shop.pagesHost && !/^[a-z0-9-]+\.github\.io$/i.test(manifest.shop.pagesHost)) {
+	if (!oneOrigin(manifest.layout) && manifest.shop.pagesHost && !/^[a-z0-9-]+\.github\.io$/i.test(manifest.shop.pagesHost)) {
 		problems.push(`Pages host "${manifest.shop.pagesHost}" should be <owner>.github.io`);
 	}
 	return problems;

package/src/wizard.ts

@@ -1,7 +1,7 @@
 import * as p from "@clack/prompts";
 import color from "picocolors";
 import { GROUPS, type Group } from "./catalog";
-import { LAYOUTS, type Layout, type Manifest, zoneOf } from "./manifest";
+import { LAYOUTS, type Layout, type Manifest, zoneOf , oneOrigin} from "./manifest";
 
 /**
  * The forms.
@@ -98,6 +98,10 @@ async function askGroup(group: Group, previous: string[] | undefined, alsoRequir
 export async function runWizard(existing: Manifest | null, layout: Layout): Promise<Manifest> {
 	const monorepo = layout === "monorepo";
 	const frontend = layout !== "app";
+	// Only a monorepo publishes its storefront to GitHub Pages. In `strict`
+	// the worker serves it from its own assets, so there is no Pages host to
+	// ask for — and asking would imply a second origin that does not exist.
+	const onPages = !oneOrigin(layout);
 
 	const shop = unwrap(
 		await p.group(
@@ -171,7 +175,7 @@ export async function runWizard(existing: Manifest | null, layout: Layout): Prom
 						initialValue: existing?.shop.locale ?? "",
 						validate: (value) => (/^[a-z]{2}(-[A-Z]{2})?$/.test(value.trim()) ? undefined : "like da, or en-GB."),
 					}),
-				...(frontend
+				...(onPages
 					? {
 							pagesHost: () =>
 								p.text({
@@ -211,7 +215,7 @@ export async function runWizard(existing: Manifest | null, layout: Layout): Prom
 			locale: shop.locale.trim(),
 			taxRegistered: (shop as { taxRegistered?: string }).taxRegistered === "yes",
 			zone: (shop as { zone?: string }).zone?.trim().toLowerCase() || undefined,
-			pagesHost: frontend ? (shop as { pagesHost?: string }).pagesHost?.trim().toLowerCase() || undefined : undefined,
+			pagesHost: onPages ? (shop as { pagesHost?: string }).pagesHost?.trim().toLowerCase() || undefined : undefined,
 		},
 		chosen,
 	};