@saastemly/voidcommerce 0.5.0 → 0.7.0

package/dist/catalog.js

@@ -14,7 +14,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-844b3qn9.js";
+} from "./index-mnb7fz2t.js";
 import"./index-0v6na3yp.js";
 export {
   UI,

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   runVoid,
   version,
   voidAppsIn
-} from "./index-5m3t0zfc.js";
+} from "./index-85m0qkmg.js";
 import {
   PRIVATE_KEY_VAR,
   SECRETS_FILE,
@@ -42,17 +42,18 @@ import {
   setVariable,
   variableNames,
   verifyCloudflareToken
-} from "./index-b9b4dawy.js";
+} from "./index-6w8rwtsh.js";
 import {
   LAYOUTS,
+  oneOrigin,
   readManifest,
   validate,
   writeManifest,
   zoneOf
-} from "./index-pz6m2hkm.js";
+} from "./index-tjy6yygc.js";
 import {
   GROUPS
-} from "./index-844b3qn9.js";
+} from "./index-mnb7fz2t.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -436,6 +437,7 @@ ${color3.dim(`Included: ${required.map((choice) => choice.label).join(", ")}`)}`
 async function runWizard(existing, layout) {
   const monorepo = layout === "monorepo";
   const frontend = layout !== "app";
+  const onPages = !oneOrigin(layout);
   const shop = unwrap(await p.group({
     name: () => p.text({
       message: "Shop name",
@@ -492,7 +494,7 @@ async function runWizard(existing, layout) {
       initialValue: existing?.shop.locale ?? "",
       validate: (value) => /^[a-z]{2}(-[A-Z]{2})?$/.test(value.trim()) ? undefined : "like da, or en-GB."
     }),
-    ...frontend ? {
+    ...onPages ? {
       pagesHost: () => p.text({
         message: `GitHub Pages host ${color3.dim("— where the storefront is published; leave blank if you serve the branch elsewhere")}`,
         placeholder: "northwind.github.io",
@@ -523,7 +525,7 @@ ${color3.dim("The generated storefront and panel. Strict has no custom code to h
       locale: shop.locale.trim(),
       taxRegistered: shop.taxRegistered === "yes",
       zone: shop.zone?.trim().toLowerCase() || undefined,
-      pagesHost: frontend ? shop.pagesHost?.trim().toLowerCase() || undefined : undefined
+      pagesHost: onPages ? shop.pagesHost?.trim().toLowerCase() || undefined : undefined
     },
     chosen
   };
@@ -611,7 +613,7 @@ async function init(args) {
   } else {
     const parts = [
       ["api", "the D1 starter — this is the worker"],
-      ["frontend", "Static Pages — this is prerendered for GitHub Pages"]
+      ["frontend", "the storefront — prerendered and served from the worker's own assets"]
     ];
     for (const [dir, starter] of parts) {
       const target = join(root, dir);

package/dist/generate/auth.d.ts

@@ -1,2 +1,15 @@
 import { type Manifest } from "../manifest";
+/**
+ * Carriers with a provider behind them, and whether each needs `lib/shipping.ts`.
+ *
+ * Exported because `generate/index.ts` has to know which shops get that file,
+ * and a second hand-maintained list of carrier ids WILL drift from this one —
+ * it already did: adding Royal Mail here left the file ungenerated, so the
+ * generated `auth.ts` imported a price table that did not exist.
+ *
+ * The token needs nothing: no origin, no tariff. Everything else needs one or
+ * the other, so the rule is simply "any carrier but the token".
+ */
+export declare const WIRED_CARRIERS: readonly ["royal-mail", "dhl-express", "shippo", "easypost", "ups", "fedex", "nft"];
+export declare const needsShippingConfig: (id: string) => boolean;
 export declare function renderAuthTs(manifest: Manifest): string;

package/dist/generate/frontend.d.ts

@@ -1,4 +1,4 @@
-import type { Manifest } from "../manifest";
+import { type Manifest } from "../manifest";
 /**
  * The storefront: a static Void site that talks to the worker over HTTP.
  *

package/dist/{index-b9b4dawy.js → index-6w8rwtsh.js}

@@ -3,7 +3,7 @@ import {
   hasFrontend,
   isApex,
   zone
-} from "./index-pz6m2hkm.js";
+} from "./index-tjy6yygc.js";
 import {
   __require,
   __toESM
@@ -368,7 +368,7 @@ async function decryptSecrets(project) {
   }
   const expected = committedPublicKey(root);
   if (expected) {
-    const { publicKeyFor } = await import("./keys-b91c72zp.js");
+    const { publicKeyFor } = await import("./keys-92tcdjrc.js");
     const derived = await publicKeyFor(privateKey);
     if (derived && derived.toLowerCase() !== expected.toLowerCase()) {
       return {

package/dist/{index-5m3t0zfc.js → index-85m0qkmg.js}

@@ -9,22 +9,23 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-b9b4dawy.js";
+} from "./index-6w8rwtsh.js";
 import {
   MANIFEST_FILE,
   has,
   hasFrontend,
   isSingleApp,
+  oneOrigin,
   packagesOf,
   readManifest,
   specifier,
   workerHosts,
   writeManifest,
   zone
-} from "./index-pz6m2hkm.js";
+} from "./index-tjy6yygc.js";
 import {
   CHOICES
-} from "./index-844b3qn9.js";
+} from "./index-mnb7fz2t.js";
 import {
   __require
 } from "./index-0v6na3yp.js";
@@ -47,10 +48,17 @@ var VAT = {
   PL: { rate: 2300, name: "VAT" }
 };
 var social = (manifest, id, envPrefix) => has(manifest, id) ? `			${id}: { clientId: must(env, "${envPrefix}_CLIENT_ID"), clientSecret: must(env, "${envPrefix}_CLIENT_SECRET") },` : null;
+var WIRED_CARRIERS = ["royal-mail", "dhl-express", "shippo", "easypost", "ups", "fedex", "nft"];
+var needsShippingConfig = (id) => WIRED_CARRIERS.includes(id) && id !== "nft";
 function renderAuthTs(manifest) {
   const { shop } = manifest;
   const lines = [];
   const CARRIER_CALLS = {
+    "royal-mail": {
+      label: "Royal Mail",
+      call: `royalMailProvider({ apiKey: must(env, "CLICK_DROP_AUTH_KEY"), services: royalMailServices, currency: "${shop.currency}", carrierName: "Royal Mail" })`,
+      import: `import { royalMailProvider } from "@saastemly/better-commerce/providers/royal-mail";`
+    },
     "dhl-express": {
       label: "DHL Express",
       call: `dhlExpressProvider({ apiKey: must(env, "DHL_API_KEY"), apiSecret: must(env, "DHL_API_SECRET"), accountNumber: must(env, "DHL_ACCOUNT_NUMBER"), from: shipFrom })`,
@@ -85,8 +93,12 @@ import { mintProvider, destinationFor } from "./lib/mint.ts";`
   };
   const carriers = Object.keys(CARRIER_CALLS).filter((id) => has(manifest, id));
   const carrierImports = carriers.map((id) => CARRIER_CALLS[id].import);
-  if (carriers.some((id) => id !== "nft"))
-    carrierImports.push(`import { shipFrom } from "./lib/shipping.ts";`);
+  const shipping = [
+    ...carriers.some((id) => id !== "nft" && id !== "royal-mail") ? ["shipFrom"] : [],
+    ...carriers.includes("royal-mail") ? ["royalMailServices"] : []
+  ];
+  if (shipping.length > 0)
+    carrierImports.push(`import { ${shipping.join(", ")} } from "./lib/shipping.ts";`);
   const wantsNft = has(manifest, "nft");
   const carrierFulfillment = carriers.length ? `, deliveryFulfillment([${carriers.map((id) => CARRIER_CALLS[id].call).join(", ")}])` : "";
   const nftDefault = carriers.length ? `, defaultProvider: "delivery:${carriers.join("+")}"` : "";
@@ -363,6 +375,22 @@ var camel = (id) => id.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 var FRONTEND_OUT = "dist/client";
 var FRONTEND_BRANCH = "frontend-static";
 function renderFrontendApiTs(manifest) {
+  if (oneOrigin(manifest.layout)) {
+    return `import { createAuthClient } from "better-auth/react";
+import { commerceClient } from "@saastemly/better-commerce/client";
+
+/**
+ * The one client the storefront talks through.
+ *
+ * SAME ORIGIN. One worker serves this page and the API it calls, so there is
+ * no address to configure, nothing to bake at build time, and nothing that
+ * can point at the wrong place. Cookies are first-party, so no SameSite=None
+ * and no CORS preflight on any request.
+ */
+export const API_ORIGIN = "";
+export const api = createAuthClient({ plugins: [commerceClient()] });
+`;
+  }
   return `/// <reference types="vite/client" />
 import { createAuthClient } from "better-auth/react";
 import { commerceClient } from "@saastemly/better-commerce/client";
@@ -383,6 +411,13 @@ export const api = createAuthClient({ baseURL: API_ORIGIN, plugins: [commerceCli
 `;
 }
 function renderFrontendEnvProduction(manifest) {
+  if (oneOrigin(manifest.layout)) {
+    return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
+#
+# The API is same-origin, so there is no VITE_API_ORIGIN: one worker serves
+# this storefront and the endpoints it calls.
+`;
+  }
   return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
 VITE_API_ORIGIN=https://api.${manifest.shop.domain}
 `;
@@ -506,9 +541,8 @@ function renderFrontendWorkflow(manifest, dir) {
 # Generated by \`vc init\` from voidcommerce.json.
 #
 # Builds the storefront and force-pushes the prerendered tree to
-# \`${FRONTEND_BRANCH}\`. Point GitHub Pages (or Cloudflare Pages) at that branch
-# and a push here is a live storefront. The worker deploys separately, from
-# \`void-dist\`.
+# \`${FRONTEND_BRANCH}\`, which GitHub Pages serves. The worker deploys
+# separately, from deploy.yml.
 on:
   push:
     branches: [main, master]
@@ -1310,7 +1344,7 @@ import color from "picocolors";
 // package.json
 var package_default = {
   name: "@saastemly/voidcommerce",
-  version: "0.5.0",
+  version: "0.7.0",
   description: "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   type: "module",
   license: "MIT",
@@ -1775,6 +1809,14 @@ That is the deploy. GitHub Actions regenerates the app from
 database and queue if they are not there, applies the migrations, and deploys
 the worker with this repository's secrets attached.
 
+**One worker serves everything.** The storefront is prerendered and folded
+into the worker's own static assets, so \`${manifest.shop.domain}\` answers with
+the shop, the admin panel and the API from a single origin. Cloudflare creates
+the hostname's DNS record and certificate itself, because it is a Worker
+custom domain. There is nothing to configure in any dashboard, no second
+branch to keep in step, and no CORS — the storefront's requests are
+first-party.
+
 You do not need wrangler on your machine, and you do not need to be logged
 into it. You do not need to open the Cloudflare dashboard after the one step
 below.
@@ -1914,7 +1956,7 @@ export function check(present: Map<string, string | undefined>): Requirement[] {
 
 // src/generate/support.ts
 function renderDomainTs(layout) {
-  const derive = layout === "app" ? `	// One app: the worker IS the site. No separate API host, and no other
+  const derive = layout !== "monorepo" ? `	// One origin: the worker IS the site. No separate API host, and no other
 	// origin to trust. It answers on www too, but only at a zone's apex —
 	// www.shop.example.com is not a name anybody types.
 	const hosts = apex ? [host, www] : [host];
@@ -1925,7 +1967,7 @@ function renderDomainTs(layout) {
   return `/**
  * The shop's domain, and everything derived from it.
  *
- * One variable. \`SHOP_DOMAIN\` gives ${layout === "app" ? "the worker's hostnames" : `api.<domain> for the worker and the
+ * One variable. \`SHOP_DOMAIN\` gives ${layout !== "monorepo" ? "the worker's hostnames" : `api.<domain> for the worker and the
  * storefront's origins`}, the app's public origin, and the
  * CORS and CSRF allow-list. They were four settings that had to agree and
  * nothing checked that they did.
@@ -1968,11 +2010,13 @@ export const GITHUB_PAGES_AAAA = ["2606:50c0:8000::153", "2606:50c0:8001::153",
 /**
  * The storefront's records. DNS-only, never proxied: GitHub issues the
  * certificate itself and validates by reaching the origin. The API hostname
- * is NOT here — it is a Cloudflare custom domain in wrangler.jsonc.${layout === "app" ? `
- * One app has no storefront elsewhere, so this is always empty.` : ""}
+ * is NOT here — it is a Cloudflare custom domain in wrangler.jsonc.${layout !== "monorepo" ? `
+ * One worker serves the storefront, so this is always empty.` : ""}
  */
 export function storefrontRecords(domain: ShopDomain, pagesHost: string) {
-	if (!pagesHost${layout === "app" ? " || domain.frontendOrigins.length === 0" : ""}) return [];
+	// Empty whenever one worker serves the storefront: Cloudflare creates the
+	// hostname's record and certificate itself for a custom domain.
+	if (!pagesHost || domain.frontendOrigins.length === 0) return [];
 	// The record's name is relative to the zone: "@" at the apex, otherwise the
 	// labels in front of it.
 	const name = domain.apex ? "@" : domain.host.slice(0, -(domain.zone.length + 1));
@@ -2148,13 +2192,18 @@ export async function destinationFor(orderId: string): Promise<string | null> {
 `;
 }
 function renderShippingTs(manifest) {
-  return `import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";
-
+  const royalMail = has(manifest, "royal-mail");
+  const origin = ["dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
+  const imports = [
+    ...origin ? [`import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";`] : [],
+    ...royalMail ? [`import type { RoyalMailService } from "@saastemly/better-commerce/providers/royal-mail";`] : []
+  ];
+  const originBlock = `
 /**
  * The address every parcel is quoted and shipped FROM.
  *
- * TODO VERIFY: this is a placeholder. A carrier quotes against it, and DHL
- * refuses a shipment whose origin has no \`name\` and \`phone\`.
+ * TODO VERIFY: this is a placeholder. A carrier quotes against it, and most
+ * refuse a shipment whose origin has no \`name\` and \`phone\`.
  */
 export const shipFrom: DeliveryAddress = {
 	name: "${manifest.shop.name}",
@@ -2165,6 +2214,9 @@ export const shipFrom: DeliveryAddress = {
 	phone: "TODO VERIFY: +44…",
 };
 `;
+  return `${imports.join(`
+`)}
+${origin ? originBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
 }
 function renderErpTs() {
   return `import { businessCentralProvider } from "@saastemly/better-commerce/providers/business-central";
@@ -2193,6 +2245,44 @@ export const erpFulfillment = (currency: string): FulfillmentProvider =>
 	}).fulfillment();
 `;
 }
+var ROYAL_MAIL_SERVICES = () => `
+/**
+ * What this shop charges for Royal Mail, by total parcel weight.
+ *
+ * TODO VERIFY: every \`amount\` below is a placeholder in pence. Replace them
+ * with your own OBA rate card — Click & Drop → Settings → Shipping services
+ * lists exactly which services your account has, and the codes here must be
+ * among them. Service codes are account-specific: the published list is from
+ * 2021 and Royal Mail warn that "available services are unique to your OBA
+ * account and individual service agreements".
+ *
+ * The band whose \`maxGrams\` first covers the parcel wins, so order does not
+ * matter. A parcel heavier than every band gets no rate at all rather than a
+ * wrong one, and Click & Drop refuses anything over 30 kg.
+ */
+export const royalMailServices: RoyalMailService[] = [
+	{
+		code: "TPN24",
+		name: "Tracked 24",
+		estimatedDays: 1,
+		bands: [
+			{ maxGrams: 1000, amount: 0 /* TODO VERIFY */ },
+			{ maxGrams: 2000, amount: 0 /* TODO VERIFY */ },
+			{ maxGrams: 5000, amount: 0 /* TODO VERIFY */ },
+		],
+	},
+	{
+		code: "TPS48",
+		name: "Tracked 48",
+		estimatedDays: 2,
+		bands: [
+			{ maxGrams: 1000, amount: 0 /* TODO VERIFY */ },
+			{ maxGrams: 2000, amount: 0 /* TODO VERIFY */ },
+			{ maxGrams: 5000, amount: 0 /* TODO VERIFY */ },
+		],
+	},
+];
+`;
 
 // src/generate/index.ts
 async function exists(path) {
@@ -2281,7 +2371,7 @@ async function generateApi(root, dir, manifest, result, opts) {
   if (has(manifest, "nft")) {
     await put(root, at("lib/mint.ts"), renderMintTs(), result, own);
   }
-  if (["dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id))) {
+  if (WIRED_CARRIERS.some((id) => needsShippingConfig(id) && has(manifest, id))) {
     await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, own);
   }
   if (has(manifest, "business-central")) {
@@ -2338,7 +2428,11 @@ async function generateFrontend(root, dir, manifest, result) {
   await put(root, at("void.json"), renderFrontendVoidJson(), result, "own");
   await put(root, at("tsconfig.json"), renderFrontendTsconfig(), result, "own");
   await put(root, at("pages/index.tsx"), renderStorefrontPage(manifest), result, "own");
-  await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+  if (oneOrigin(manifest.layout)) {
+    await retire(root, ".github/workflows/frontend-static.yml", result);
+  } else {
+    await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+  }
   if (dir === "")
     return;
   await mergeJson(root, at("package.json"), { name: `${manifest.shop.domain.split(".")[0]}-frontend`, type: "module", private: true }, (pkg) => {
@@ -2440,8 +2534,13 @@ async function generateStrictApp(root, dir, manifest, result) {
   await put(root, at("db/seed.ts"), renderDbSeed(), result, gen);
   await put(root, at("pages/layout.tsx"), renderLayoutTsx(), result, gen);
   await put(root, at("pages/app.css"), renderAppCss(), result, gen);
-  await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
-  await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+  if (!oneOrigin(manifest.layout) || isSingleApp(manifest.layout)) {
+    await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
+    await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+  } else {
+    await retire(root, at("pages/index.server.ts"), result);
+    await retire(root, at("pages/index.tsx"), result);
+  }
   await put(root, at("pages/api-dashboard/index.tsx"), renderDashboardPage(manifest), result, gen);
   await put(root, at("pages/api-dashboard/index.server.ts"), CLIENT_ONLY, result, gen);
   await put(root, at("pages/sign-in/index.tsx"), renderSignInPage(manifest), result, gen);
@@ -2909,7 +3008,7 @@ ${color3.red("NOT ready to go live.")}
 }
 
 // src/deploy/cloudflare.ts
-import { existsSync as existsSync8, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync as existsSync8, mkdirSync, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync } from "node:fs";
 import { dirname as dirname5, join as join8 } from "node:path";
 import color4 from "picocolors";
 var fail = (message) => {
@@ -2999,11 +3098,32 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const builder = findBuilder(app);
   if (!builder)
     return fail("no build tool: neither vite-plus nor vite is installed.");
+  const merging = oneOrigin(project.manifest.layout) && !isSingleApp(project.manifest.layout);
+  if (merging) {
+    console.log(`
+▸ ${builder.label} ${color4.dim("(the storefront)")}`);
+    const storefront = await wrangler(builder.cmd, ["build"], project.root, true);
+    if (storefront.code !== 0)
+      return fail(`the storefront build failed (exit ${storefront.code}).`);
+  }
   console.log(`
-▸ ${builder.label}`);
+▸ ${builder.label}${merging ? color4.dim(" (the worker)") : ""}`);
   const built = await wrangler(builder.cmd, ["build"], app, true);
   if (built.code !== 0)
     return fail(`the build failed (exit ${built.code}).`);
+  if (merging) {
+    const from = join8(project.root, "dist", "client");
+    const into = join8(app, "dist", "client");
+    if (!existsSync8(from))
+      return fail(`the storefront build emitted no ${from} — is the root a Void app with output "static"?`);
+    if (!existsSync8(into))
+      return fail(`the worker build emitted no ${into}; there is nothing to merge into.`);
+    const merged = mergeTree(from, into, new Set([".vite"]));
+    if (!existsSync8(join8(into, "index.html"))) {
+      return fail("the storefront produced no index.html, so the shop has no front page.");
+    }
+    console.log(`${color4.green("✓")} folded ${merged} storefront file${merged === 1 ? "" : "s"} into the worker's assets`);
+  }
   const emittedPath = join8(app, "dist", "ssr", "wrangler.json");
   if (!existsSync8(emittedPath))
     return fail(`the build emitted no ${emittedPath} — is this a Void app on the Cloudflare target?`);
@@ -3046,10 +3166,28 @@ ${who.accounts.map((a) => `    ${a.id}  ${a.name}`).join(`
   const url = `https://${workerHosts(project.manifest)[0]}`;
   console.log(`
 ${color4.green("Live:")} ${url}`);
-  if (hasFrontend(project.manifest.layout))
+  if (hasFrontend(project.manifest.layout) && !oneOrigin(project.manifest.layout)) {
     console.log(color4.dim("The storefront deploys itself from GitHub Actions on push."));
+  }
   return 0;
 }
+function mergeTree(from, into, skip) {
+  let count = 0;
+  for (const entry of readdirSync2(from, { withFileTypes: true })) {
+    if (skip.has(entry.name))
+      continue;
+    const source = join8(from, entry.name);
+    const target = join8(into, entry.name);
+    if (entry.isDirectory()) {
+      mkdirSync(target, { recursive: true });
+      count += mergeTree(source, target, skip);
+    } else {
+      copyFileSync(source, target);
+      count += 1;
+    }
+  }
+  return count;
+}
 
 // src/import.ts
 import { readFile as readFile3 } from "node:fs/promises";

package/dist/{index-844b3qn9.js → index-mnb7fz2t.js}

@@ -446,7 +446,18 @@ var CARRIERS = {
     { id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
     { id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
     { id: "usps", label: "USPS", hint: "US domestic post — the cheapest way to ship a small parcel inside the US", env: [{ key: "USPS_CLIENT_ID", breaks: "USPS rates are not quoted" }, { key: "USPS_CLIENT_SECRET", breaks: "the same" }] },
-    { id: "royal-mail", label: "Royal Mail", hint: "UK post, for a shop whose customers are mostly in Britain", env: [{ key: "ROYAL_MAIL_CLIENT_ID", breaks: "Royal Mail rates are not quoted" }] },
+    {
+      id: "royal-mail",
+      label: "Royal Mail (Click & Drop)",
+      hint: "UK post. Needs an OBA business account — Click & Drop generates labels through the API only for those. Prices come from your own tariff table, because no Royal Mail API quotes rates",
+      env: [
+        {
+          key: "CLICK_DROP_AUTH_KEY",
+          breaks: "no label and no tracking number: orders are created in Click & Drop but never despatched",
+          where: "Click & Drop → Settings → Integrations → Click & Drop API"
+        }
+      ]
+    },
     { id: "aramex", label: "Aramex", hint: "the carrier to reach the Gulf and wider Middle East reliably", env: [{ key: "ARAMEX_API_KEY", breaks: "Aramex rates are not quoted" }] },
     { id: "doordash-drive", label: "DoorDash Drive", hint: "same-day local delivery", env: [{ key: "DOORDASH_DEVELOPER_ID", breaks: "DoorDash is not offered" }] },
     { id: "stuart", label: "Stuart", hint: "same-day courier, Europe", env: [{ key: "STUART_CLIENT_ID", breaks: "Stuart is not offered" }] },

package/dist/{index-pz6m2hkm.js → index-tjy6yygc.js}

@@ -1,7 +1,7 @@
 import {
   CHOICES,
   GROUPS
-} from "./index-844b3qn9.js";
+} from "./index-mnb7fz2t.js";
 
 // src/manifest.ts
 import { readFile, writeFile } from "node:fs/promises";
@@ -21,11 +21,12 @@ var LAYOUTS = [
   {
     id: "strict",
     label: "Strict (experimental)",
-    hint: "the root IS the storefront, sharing one package.json; the worker is generated under .vc/app from the manifest and never hand-edited"
+    hint: "the root IS the storefront, sharing one package.json; the worker is generated under .vc/app and serves the storefront from its own assets — one origin, one deploy"
   }
 ];
 var isSingleApp = (layout) => layout === "app";
 var hasFrontend = (layout) => layout !== "app";
+var oneOrigin = (layout) => layout !== "monorepo";
 var TWO_LABEL_SUFFIXES = new Set(["co", "com", "net", "org", "ac", "gov", "edu", "or", "ne", "in"]);
 function zoneOf(domain) {
   const labels = domain.trim().toLowerCase().replace(/\.$/, "").split(".");
@@ -42,7 +43,7 @@ function isApex(manifest) {
 }
 function workerHosts(manifest) {
   const { domain } = manifest.shop;
-  if (!isSingleApp(manifest.layout))
+  if (!oneOrigin(manifest.layout))
     return [`api.${domain}`];
   return isApex(manifest) ? [domain, `www.${domain}`] : [domain];
 }
@@ -163,10 +164,10 @@ function validate(manifest) {
   if (dns.includes("simply")) {
     problems.push(`DNS at Simply.com cannot host ${workerHosts(manifest)[0]} — a Worker custom domain is created by Cloudflare, in a zone on Cloudflare`);
   }
-  if (hasFrontend(manifest.layout) && manifest.shop.pagesHost && !/^[a-z0-9-]+\.github\.io$/i.test(manifest.shop.pagesHost)) {
+  if (!oneOrigin(manifest.layout) && manifest.shop.pagesHost && !/^[a-z0-9-]+\.github\.io$/i.test(manifest.shop.pagesHost)) {
     problems.push(`Pages host "${manifest.shop.pagesHost}" should be <owner>.github.io`);
   }
   return problems;
 }
 
-export { MANIFEST_FILE, LAYOUTS, isSingleApp, hasFrontend, zoneOf, zone, isApex, workerHosts, withRequired, has, chosenIn, envKeysOf, OWN_PACKAGES, specifier, packagesOf, readManifest, writeManifest, validate };
+export { MANIFEST_FILE, LAYOUTS, isSingleApp, hasFrontend, oneOrigin, zoneOf, zone, isApex, workerHosts, withRequired, has, chosenIn, envKeysOf, OWN_PACKAGES, specifier, packagesOf, readManifest, writeManifest, validate };

package/dist/index.js

@@ -51,7 +51,7 @@ import {
   routeProblem,
   strictDependencies,
   upsertJsonc
-} from "./index-5m3t0zfc.js";
+} from "./index-85m0qkmg.js";
 import {
   allEnvKeys,
   envSummary,
@@ -59,7 +59,7 @@ import {
   renderEnvLocal,
   renderEnvProduction,
   renderEnvTs
-} from "./index-b9b4dawy.js";
+} from "./index-6w8rwtsh.js";
 import {
   LAYOUTS,
   MANIFEST_FILE,
@@ -70,6 +70,7 @@ import {
   hasFrontend,
   isApex,
   isSingleApp,
+  oneOrigin,
   packagesOf,
   readManifest,
   specifier,
@@ -79,7 +80,7 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-pz6m2hkm.js";
+} from "./index-tjy6yygc.js";
 import {
   AUTH_PLUGINS,
   CARRIERS,
@@ -96,7 +97,7 @@ import {
   SIGN_IN,
   TAX,
   UI
-} from "./index-844b3qn9.js";
+} from "./index-mnb7fz2t.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,
@@ -147,6 +148,7 @@ export {
   parseWhoAmI,
   parseJsonc,
   packagesOf,
+  oneOrigin,
   isSingleApp,
   isApex,
   importCommand,

package/dist/{keys-b91c72zp.js → keys-92tcdjrc.js}

@@ -5,9 +5,9 @@ import {
   keysCommand,
   provisionKey,
   publicKeyFor
-} from "./index-b9b4dawy.js";
-import"./index-pz6m2hkm.js";
-import"./index-844b3qn9.js";
+} from "./index-6w8rwtsh.js";
+import"./index-tjy6yygc.js";
+import"./index-mnb7fz2t.js";
 import"./index-0v6na3yp.js";
 export {
   publicKeyFor,

package/dist/manifest.d.ts

@@ -24,9 +24,10 @@ export declare const MANIFEST_FILE = "voidcommerce.json";
  *   strict    EXPERIMENTAL. A monorepo turned inside out. The REPOSITORY
  *             ROOT is the storefront — its package.json, its pages, yours to
  *             edit — and the worker is generated underneath it at .vc/app
- *             from the manifest, gitignored, never hand-edited. Hosted the
- *             way a monorepo is: the worker on api.<domain>, the storefront
- *             on <domain>.
+ *             from the manifest, gitignored, never hand-edited. ONE worker
+ *             serves both at <domain>: the storefront's prerendered tree is
+ *             folded into the worker's assets at build time, so there is one
+ *             origin, one deploy, and one certificate Cloudflare issues.
  *
  * The first question, because it decides where `void init` runs and what
  * the domain means. It cannot change after init: moving files is not a
@@ -47,8 +48,26 @@ export declare const LAYOUTS: Array<{
  * storefront on the domain itself.
  */
 export declare const isSingleApp: (layout: Layout) => boolean;
-/** Does this layout carry a storefront of its own, and so a second origin to trust? */
+/** Does this layout carry a storefront of its own, in the repository? */
 export declare const hasFrontend: (layout: Layout) => boolean;
+/**
+ * Does ONE worker serve both the storefront and the API?
+ *
+ * `app` always did — it generates its storefront into the worker. `strict`
+ * now does too: the root's prerendered tree is merged into the worker's own
+ * assets directory at build time, so there is one origin, one hostname, one
+ * deploy, and one certificate that Cloudflare issues itself.
+ *
+ * That deletes the whole GitHub Pages half — the A/AAAA records, the CNAME
+ * file, the base-path rewriting — and with it a trap worth naming: GitHub
+ * treats any Cloudflare IP as ineligible for a certificate, so a proxied
+ * record silently stops issuance AND renewal about ninety days later, while
+ * GitHub's own health check still reports green.
+ *
+ * `monorepo` keeps the split, because there the frontend is a separate app
+ * that a person may well want hosted separately.
+ */
+export declare const oneOrigin: (layout: Layout) => boolean;
 /** The zone a hostname most likely belongs to: the registrable domain. */
 export declare function zoneOf(domain: string): string;
 /** The zone this shop's records go in. */
@@ -88,7 +107,10 @@ export interface Manifest {
          * default that is safe to assume.
          */
         taxRegistered?: boolean | undefined;
-        /** `saastemly.github.io` — the monorepo's frontend lives on GitHub Pages; the www record points here. */
+        /**
+         * `saastemly.github.io` — only a MONOREPO has a storefront on GitHub
+         * Pages. In `app` and `strict` the worker serves it, so this is unused.
+         */
         pagesHost?: string | undefined;
     };
     /** Chosen ids from each group, keyed by group id. */

package/dist/manifest.js

@@ -8,6 +8,7 @@ import {
   hasFrontend,
   isApex,
   isSingleApp,
+  oneOrigin,
   packagesOf,
   readManifest,
   specifier,
@@ -17,8 +18,8 @@ import {
   writeManifest,
   zone,
   zoneOf
-} from "./index-pz6m2hkm.js";
-import"./index-844b3qn9.js";
+} from "./index-tjy6yygc.js";
+import"./index-mnb7fz2t.js";
 import"./index-0v6na3yp.js";
 export {
   zoneOf,
@@ -30,6 +31,7 @@ export {
   specifier,
   readManifest,
   packagesOf,
+  oneOrigin,
   isSingleApp,
   isApex,
   hasFrontend,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saastemly/voidcommerce",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Void, with a shop in it. `vc init` walks you through Better Auth, betterCommerce and every plugin; everything else passes through to `void`.",
   "type": "module",
   "license": "MIT",

package/src/catalog.ts

@@ -519,7 +519,18 @@ export const CARRIERS: Group = {
 		{ id: "fedex", label: "FedEx", hint: "your own FedEx account, for negotiated rates an aggregator cannot see", env: [{ key: "FEDEX_CLIENT_ID", breaks: "FedEx rates are not quoted" }, { key: "FEDEX_CLIENT_SECRET", breaks: "the same" }, { key: "FEDEX_ACCOUNT_NUMBER", breaks: "FedEx has no account to bill the transport to" }] },
 		{ id: "dhl-express", label: "DHL Express", hint: "international express, and the one worth having for a shop that posts abroad", env: [{ key: "DHL_API_KEY", breaks: "DHL rates are not quoted" }, { key: "DHL_API_SECRET", breaks: "the same" }, { key: "DHL_ACCOUNT_NUMBER", breaks: "DHL has no account to bill the transport to" }] },
 		{ id: "usps", label: "USPS", hint: "US domestic post — the cheapest way to ship a small parcel inside the US", env: [{ key: "USPS_CLIENT_ID", breaks: "USPS rates are not quoted" }, { key: "USPS_CLIENT_SECRET", breaks: "the same" }] },
-		{ id: "royal-mail", label: "Royal Mail", hint: "UK post, for a shop whose customers are mostly in Britain", env: [{ key: "ROYAL_MAIL_CLIENT_ID", breaks: "Royal Mail rates are not quoted" }] },
+		{
+			id: "royal-mail",
+			label: "Royal Mail (Click & Drop)",
+			hint: "UK post. Needs an OBA business account — Click & Drop generates labels through the API only for those. Prices come from your own tariff table, because no Royal Mail API quotes rates",
+			env: [
+				{
+					key: "CLICK_DROP_AUTH_KEY",
+					breaks: "no label and no tracking number: orders are created in Click & Drop but never despatched",
+					where: "Click & Drop → Settings → Integrations → Click & Drop API",
+				},
+			],
+		},
 		{ id: "aramex", label: "Aramex", hint: "the carrier to reach the Gulf and wider Middle East reliably", env: [{ key: "ARAMEX_API_KEY", breaks: "Aramex rates are not quoted" }] },
 		{ id: "doordash-drive", label: "DoorDash Drive", hint: "same-day local delivery", env: [{ key: "DOORDASH_DEVELOPER_ID", breaks: "DoorDash is not offered" }] },
 		{ id: "stuart", label: "Stuart", hint: "same-day courier, Europe", env: [{ key: "STUART_CLIENT_ID", breaks: "Stuart is not offered" }] },

package/src/deploy/cloudflare.ts

@@ -1,8 +1,8 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import color from "picocolors";
 import { allEnvKeys } from "../generate/env";
-import { hasFrontend, workerHosts, writeManifest } from "../manifest";
+import { hasFrontend, isSingleApp, oneOrigin, workerHosts, writeManifest } from "../manifest";
 import type { Project } from "../project";
 import { parseJsonc, upsertJsonc } from "./jsonc";
 import { preflight, printPreflight } from "./preflight";
@@ -130,10 +130,46 @@ export async function deployCloudflare(project: Project, opts: CloudflareOptions
 	// 4. build.
 	const builder = findBuilder(app);
 	if (!builder) return fail("no build tool: neither vite-plus nor vite is installed.");
-	console.log(`\n▸ ${builder.label}`);
+
+	// In strict the STOREFRONT is a second Void app, at the repository root,
+	// and it has to be built first: its prerendered tree is folded into the
+	// worker's assets below, and the worker's build is what emits the config
+	// that names that directory.
+	const merging = oneOrigin(project.manifest.layout) && !isSingleApp(project.manifest.layout);
+	if (merging) {
+		console.log(`\n▸ ${builder.label} ${color.dim("(the storefront)")}`);
+		const storefront = await wrangler(builder.cmd, ["build"], project.root, true);
+		if (storefront.code !== 0) return fail(`the storefront build failed (exit ${storefront.code}).`);
+	}
+
+	console.log(`\n▸ ${builder.label}${merging ? color.dim(" (the worker)") : ""}`);
 	const built = await wrangler(builder.cmd, ["build"], app, true);
 	if (built.code !== 0) return fail(`the build failed (exit ${built.code}).`);
 
+	// 4b. Fold the storefront into the worker's assets.
+	//
+	// Void's worker already serves static assets: it runs first for every
+	// request and calls `env.ASSETS.fetch` only when its own router 404s. So
+	// the storefront's prerendered files land in the same directory and are
+	// reached by exactly that fallback — no routing rules, no second origin.
+	//
+	// Filenames are content-hashed, so the two trees merge without collision.
+	// `.vite/manifest.json` is the one exception and is build metadata that
+	// should never be uploaded at all.
+	if (merging) {
+		const from = join(project.root, "dist", "client");
+		const into = join(app, "dist", "client");
+		if (!existsSync(from)) return fail(`the storefront build emitted no ${from} — is the root a Void app with output "static"?`);
+		if (!existsSync(into)) return fail(`the worker build emitted no ${into}; there is nothing to merge into.`);
+		const merged = mergeTree(from, into, new Set([".vite"]));
+		// The worker owns "/" only if it has a page for it. It must not, or the
+		// shop's front door is unreachable — so this is checked, not assumed.
+		if (!existsSync(join(into, "index.html"))) {
+			return fail("the storefront produced no index.html, so the shop has no front page.");
+		}
+		console.log(`${color.green("✓")} folded ${merged} storefront file${merged === 1 ? "" : "s"} into the worker's assets`);
+	}
+
 	// 5. scrub.
 	const emittedPath = join(app, "dist", "ssr", "wrangler.json");
 	if (!existsSync(emittedPath)) return fail(`the build emitted no ${emittedPath} — is this a Void app on the Cloudflare target?`);
@@ -183,6 +219,34 @@ export async function deployCloudflare(project: Project, opts: CloudflareOptions
 	const domain = project.manifest.shop.domain;
 	const url = `https://${workerHosts(project.manifest)[0]}`;
 	console.log(`\n${color.green("Live:")} ${url}`);
-	if (hasFrontend(project.manifest.layout)) console.log(color.dim("The storefront deploys itself from GitHub Actions on push."));
+	if (hasFrontend(project.manifest.layout) && !oneOrigin(project.manifest.layout)) {
+		console.log(color.dim("The storefront deploys itself from GitHub Actions on push."));
+	}
 	return 0;
 }
+
+
+/**
+ * Copy one built tree over another, skipping named directories.
+ *
+ * Deliberately additive rather than a replace: the worker's own client
+ * bundles are already in the target and must survive. Returns how many files
+ * were written, so the deploy can say so rather than claiming success
+ * silently.
+ */
+function mergeTree(from: string, into: string, skip: Set<string>): number {
+	let count = 0;
+	for (const entry of readdirSync(from, { withFileTypes: true })) {
+		if (skip.has(entry.name)) continue;
+		const source = join(from, entry.name);
+		const target = join(into, entry.name);
+		if (entry.isDirectory()) {
+			mkdirSync(target, { recursive: true });
+			count += mergeTree(source, target, skip);
+		} else {
+			copyFileSync(source, target);
+			count += 1;
+		}
+	}
+	return count;
+}

package/src/generate/auth.ts

@@ -49,6 +49,20 @@ const social = (manifest: Manifest, id: string, envPrefix: string) =>
 		? `			${id}: { clientId: must(env, "${envPrefix}_CLIENT_ID"), clientSecret: must(env, "${envPrefix}_CLIENT_SECRET") },`
 		: null;
 
+/**
+ * Carriers with a provider behind them, and whether each needs `lib/shipping.ts`.
+ *
+ * Exported because `generate/index.ts` has to know which shops get that file,
+ * and a second hand-maintained list of carrier ids WILL drift from this one —
+ * it already did: adding Royal Mail here left the file ungenerated, so the
+ * generated `auth.ts` imported a price table that did not exist.
+ *
+ * The token needs nothing: no origin, no tariff. Everything else needs one or
+ * the other, so the rule is simply "any carrier but the token".
+ */
+export const WIRED_CARRIERS = ["royal-mail", "dhl-express", "shippo", "easypost", "ups", "fedex", "nft"] as const;
+export const needsShippingConfig = (id: string): boolean => WIRED_CARRIERS.includes(id as never) && id !== "nft";
+
 export function renderAuthTs(manifest: Manifest): string {
 	const { shop } = manifest;
 	const lines: Line[] = [];
@@ -68,6 +82,14 @@ export function renderAuthTs(manifest: Manifest): string {
 	const CARRIER_CALLS: Record<string, { call: string; label: string; import: string }> = {
 		// Every real carrier needs the ORIGIN it ships from, which is shop data
 		// rather than a credential — so it lives in an owned lib/shipping.ts.
+		"royal-mail": {
+			label: "Royal Mail",
+			// No `from`: Click & Drop posts from the account's registered
+			// address, so an origin here would be ignored. `services` is the
+			// price table in lib/shipping.ts, because nothing quotes Royal Mail.
+			call: `royalMailProvider({ apiKey: must(env, "CLICK_DROP_AUTH_KEY"), services: royalMailServices, currency: "${shop.currency}", carrierName: "Royal Mail" })`,
+			import: `import { royalMailProvider } from "@saastemly/better-commerce/providers/royal-mail";`,
+		},
 		"dhl-express": {
 			label: "DHL Express",
 			call: `dhlExpressProvider({ apiKey: must(env, "DHL_API_KEY"), apiSecret: must(env, "DHL_API_SECRET"), accountNumber: must(env, "DHL_ACCOUNT_NUMBER"), from: shipFrom })`,
@@ -101,8 +123,18 @@ export function renderAuthTs(manifest: Manifest): string {
 	};
 	const carriers = Object.keys(CARRIER_CALLS).filter((id) => has(manifest, id));
 	const carrierImports = carriers.map((id) => CARRIER_CALLS[id]!.import);
-	// The token needs no origin; every other carrier does.
-	if (carriers.some((id) => id !== "nft")) carrierImports.push(`import { shipFrom } from "./lib/shipping.ts";`);
+	// One import from lib/shipping.ts, naming only what is actually used —
+	// an unused binding is a type error in a shop with `noUnusedLocals`.
+	//
+	// The token needs no origin. Royal Mail needs no origin either: Click &
+	// Drop posts from the address registered on the account, so a `from` here
+	// would be silently ignored. It needs the price table instead, because
+	// nothing quotes Royal Mail.
+	const shipping = [
+		...(carriers.some((id) => id !== "nft" && id !== "royal-mail") ? ["shipFrom"] : []),
+		...(carriers.includes("royal-mail") ? ["royalMailServices"] : []),
+	];
+	if (shipping.length > 0) carrierImports.push(`import { ${shipping.join(", ")} } from "./lib/shipping.ts";`);
 	const wantsNft = has(manifest, "nft");
 	// One bridge for every carrier: which ships is decided by whose rate the
 	// buyer paid for, so a token order mints and a parcel order posts.

package/src/generate/ci.ts

@@ -176,6 +176,14 @@ That is the deploy. GitHub Actions regenerates the app from
 database and queue if they are not there, applies the migrations, and deploys
 the worker with this repository's secrets attached.
 
+**One worker serves everything.** The storefront is prerendered and folded
+into the worker's own static assets, so \`${manifest.shop.domain}\` answers with
+the shop, the admin panel and the API from a single origin. Cloudflare creates
+the hostname's DNS record and certificate itself, because it is a Worker
+custom domain. There is nothing to configure in any dashboard, no second
+branch to keep in step, and no CORS — the storefront's requests are
+first-party.
+
 You do not need wrangler on your machine, and you do not need to be logged
 into it. You do not need to open the Cloudflare dashboard after the one step
 below.

package/src/generate/frontend.ts

@@ -1,4 +1,4 @@
-import type { Manifest } from "../manifest";
+import { type Manifest, oneOrigin } from "../manifest";
 
 /**
  * The storefront: a static Void site that talks to the worker over HTTP.
@@ -24,6 +24,22 @@ export const FRONTEND_OUT = "dist/client";
 export const FRONTEND_BRANCH = "frontend-static";
 
 export function renderFrontendApiTs(manifest: Manifest): string {
+	if (oneOrigin(manifest.layout)) {
+		return `import { createAuthClient } from "better-auth/react";
+import { commerceClient } from "@saastemly/better-commerce/client";
+
+/**
+ * The one client the storefront talks through.
+ *
+ * SAME ORIGIN. One worker serves this page and the API it calls, so there is
+ * no address to configure, nothing to bake at build time, and nothing that
+ * can point at the wrong place. Cookies are first-party, so no SameSite=None
+ * and no CORS preflight on any request.
+ */
+export const API_ORIGIN = "";
+export const api = createAuthClient({ plugins: [commerceClient()] });
+`;
+	}
 	return `/// <reference types="vite/client" />
 import { createAuthClient } from "better-auth/react";
 import { commerceClient } from "@saastemly/better-commerce/client";
@@ -45,6 +61,13 @@ export const api = createAuthClient({ baseURL: API_ORIGIN, plugins: [commerceCli
 }
 
 export function renderFrontendEnvProduction(manifest: Manifest): string {
+	if (oneOrigin(manifest.layout)) {
+		return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
+#
+# The API is same-origin, so there is no VITE_API_ORIGIN: one worker serves
+# this storefront and the endpoints it calls.
+`;
+	}
 	return `# Baked into the storefront build. Generated by \`vc init\` from voidcommerce.json.
 VITE_API_ORIGIN=https://api.${manifest.shop.domain}
 `;
@@ -183,9 +206,8 @@ export function renderFrontendWorkflow(manifest: Manifest, dir: string): string
 # Generated by \`vc init\` from voidcommerce.json.
 #
 # Builds the storefront and force-pushes the prerendered tree to
-# \`${FRONTEND_BRANCH}\`. Point GitHub Pages (or Cloudflare Pages) at that branch
-# and a push here is a live storefront. The worker deploys separately, from
-# \`void-dist\`.
+# \`${FRONTEND_BRANCH}\`, which GitHub Pages serves. The worker deploys
+# separately, from deploy.yml.
 on:
   push:
     branches: [main, master]

package/src/generate/index.ts

@@ -2,8 +2,8 @@ import { cp, mkdir, readFile, readdir, rm, symlink, writeFile } from "node:fs/pr
 import { existsSync, lstatSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { CHOICES } from "../catalog";
-import { MANIFEST_FILE, type Manifest, has, isSingleApp, packagesOf, specifier, workerHosts, writeManifest, zone } from "../manifest";
-import { renderAuthTs } from "./auth";
+import { MANIFEST_FILE, type Manifest, has, isSingleApp, oneOrigin, packagesOf, specifier, workerHosts, writeManifest, zone } from "../manifest";
+import { renderAuthTs, WIRED_CARRIERS, needsShippingConfig } from "./auth";
 import {
 	envSummary,
 	renderEnvExample,
@@ -189,8 +189,10 @@ async function generateApi(root: string, dir: string, manifest: Manifest, result
 	if (has(manifest, "nft")) {
 		await put(root, at("lib/mint.ts"), renderMintTs(), result, own);
 	}
-	// Any carrier but the token quotes against an origin, which is shop data.
-	if (["dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id))) {
+	// Any carrier but the token needs shop data of its own — an origin to quote
+	// against, or a price table. The list lives with the carriers themselves so
+	// it cannot drift from them.
+	if (WIRED_CARRIERS.some((id) => needsShippingConfig(id) && has(manifest, id))) {
 		await put(root, at("lib/shipping.ts"), renderShippingTs(manifest), result, own);
 	}
 	if (has(manifest, "business-central")) {
@@ -255,7 +257,7 @@ async function generateApi(root: string, dir: string, manifest: Manifest, result
 	);
 }
 
-/** The static storefront on GitHub Pages. Only in a monorepo. */
+/** The storefront: served by the worker in strict, by GitHub Pages in a monorepo. */
 async function generateFrontend(root: string, dir: string, manifest: Manifest, result: GenerateResult) {
 	const at = (file: string) => join(dir, file);
 
@@ -265,7 +267,14 @@ async function generateFrontend(root: string, dir: string, manifest: Manifest, r
 	await put(root, at("void.json"), renderFrontendVoidJson(), result, "own");
 	await put(root, at("tsconfig.json"), renderFrontendTsconfig(), result, "own");
 	await put(root, at("pages/index.tsx"), renderStorefrontPage(manifest), result, "own");
-	await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+	// A separate publishing workflow exists only when the storefront has a
+	// separate host. In strict the worker serves it, so the branch, the
+	// workflow, the CNAME file and the base-path rewriting all go away.
+	if (oneOrigin(manifest.layout)) {
+		await retire(root, ".github/workflows/frontend-static.yml", result);
+	} else {
+		await put(root, ".github/workflows/frontend-static.yml", renderFrontendWorkflow(manifest, dir), result, "regenerate");
+	}
 
 	// A monorepo's frontend is its own workspace; strict's shares the root's
 	// one package.json, which generateStrictRoot has already written.
@@ -404,8 +413,20 @@ async function generateStrictApp(root: string, dir: string, manifest: Manifest,
 	await put(root, at("db/seed.ts"), renderDbSeed(), result, gen);
 	await put(root, at("pages/layout.tsx"), renderLayoutTsx(), result, gen);
 	await put(root, at("pages/app.css"), renderAppCss(), result, gen);
-	await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
-	await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+	// In strict the STOREFRONT owns "/": its prerendered index.html is merged
+	// into the worker's assets, and the worker reaches assets only by 404ing
+	// first. A worker index page here would shadow the shop's front door.
+	if (!oneOrigin(manifest.layout) || isSingleApp(manifest.layout)) {
+		await put(root, at("pages/index.server.ts"), renderIndexServer(), result, gen);
+		await put(root, at("pages/index.tsx"), INDEX_PAGE, result, gen);
+	} else {
+		// Deleted, not merely skipped. A shop regenerated from the older
+		// two-origin layout still has these on disk, and a leftover index page
+		// would answer "/" instead of 404ing through to the storefront — the
+		// shop would silently serve a blank redirect as its front door.
+		await retire(root, at("pages/index.server.ts"), result);
+		await retire(root, at("pages/index.tsx"), result);
+	}
 	await put(root, at("pages/api-dashboard/index.tsx"), renderDashboardPage(manifest), result, gen);
 	await put(root, at("pages/api-dashboard/index.server.ts"), CLIENT_ONLY, result, gen);
 	await put(root, at("pages/sign-in/index.tsx"), renderSignInPage(manifest), result, gen);

package/src/generate/support.ts

@@ -11,8 +11,8 @@ import { type Layout, type Manifest, has } from "../manifest";
 
 export function renderDomainTs(layout: Layout): string {
 	const derive =
-		layout === "app"
-			? `	// One app: the worker IS the site. No separate API host, and no other
+		layout !== "monorepo"
+			? `	// One origin: the worker IS the site. No separate API host, and no other
 	// origin to trust. It answers on www too, but only at a zone's apex —
 	// www.shop.example.com is not a name anybody types.
 	const hosts = apex ? [host, www] : [host];
@@ -24,7 +24,7 @@ export function renderDomainTs(layout: Layout): string {
 	return `/**
  * The shop's domain, and everything derived from it.
  *
- * One variable. \`SHOP_DOMAIN\` gives ${layout === "app" ? "the worker's hostnames" : "api.<domain> for the worker and the\n * storefront's origins"}, the app's public origin, and the
+ * One variable. \`SHOP_DOMAIN\` gives ${layout !== "monorepo" ? "the worker's hostnames" : "api.<domain> for the worker and the\n * storefront's origins"}, the app's public origin, and the
  * CORS and CSRF allow-list. They were four settings that had to agree and
  * nothing checked that they did.
  *
@@ -67,11 +67,13 @@ export const GITHUB_PAGES_AAAA = ["2606:50c0:8000::153", "2606:50c0:8001::153",
  * The storefront's records. DNS-only, never proxied: GitHub issues the
  * certificate itself and validates by reaching the origin. The API hostname
  * is NOT here — it is a Cloudflare custom domain in wrangler.jsonc.${
-	layout === "app" ? "\n * One app has no storefront elsewhere, so this is always empty." : ""
+	layout !== "monorepo" ? "\n * One worker serves the storefront, so this is always empty." : ""
 }
  */
 export function storefrontRecords(domain: ShopDomain, pagesHost: string) {
-	if (!pagesHost${layout === "app" ? " || domain.frontendOrigins.length === 0" : ""}) return [];
+	// Empty whenever one worker serves the storefront: Cloudflare creates the
+	// hostname's record and certificate itself for a custom domain.
+	if (!pagesHost || domain.frontendOrigins.length === 0) return [];
 	// The record's name is relative to the zone: "@" at the apex, otherwise the
 	// labels in front of it.
 	const name = domain.apex ? "@" : domain.host.slice(0, -(domain.zone.length + 1));
@@ -272,13 +274,22 @@ export async function destinationFor(orderId: string): Promise<string | null> {
  * deploy, so both are marked rather than left blank.
  */
 export function renderShippingTs(manifest: Manifest): string {
-	return `import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";
+	const royalMail = has(manifest, "royal-mail");
+	// Royal Mail posts from the address registered on the Click & Drop account,
+	// so an origin here would be ignored. Only carriers that QUOTE need one.
+	const origin = ["dhl-express", "shippo", "easypost", "ups", "fedex"].some((id) => has(manifest, id));
 
+	const imports = [
+		...(origin ? [`import type { DeliveryAddress } from "@saastemly/better-commerce/providers/delivery";`] : []),
+		...(royalMail ? [`import type { RoyalMailService } from "@saastemly/better-commerce/providers/royal-mail";`] : []),
+	];
+
+	const originBlock = `
 /**
  * The address every parcel is quoted and shipped FROM.
  *
- * TODO VERIFY: this is a placeholder. A carrier quotes against it, and DHL
- * refuses a shipment whose origin has no \`name\` and \`phone\`.
+ * TODO VERIFY: this is a placeholder. A carrier quotes against it, and most
+ * refuse a shipment whose origin has no \`name\` and \`phone\`.
  */
 export const shipFrom: DeliveryAddress = {
 	name: "${manifest.shop.name}",
@@ -289,6 +300,8 @@ export const shipFrom: DeliveryAddress = {
 	phone: "TODO VERIFY: +44…",
 };
 `;
+
+	return `${imports.join("\n")}\n${origin ? originBlock : ""}${royalMail ? ROYAL_MAIL_SERVICES() : ""}`;
 }
 
 export function renderErpTs(): string {
@@ -318,3 +331,56 @@ export const erpFulfillment = (currency: string): FulfillmentProvider =>
 	}).fulfillment();
 `;
 }
+
+
+/**
+ * Royal Mail's price table — YOUR prices, because nothing will quote them.
+ *
+ * This is the one carrier here that cannot be asked what postage costs. No
+ * Royal Mail API quotes rates: not Click & Drop, not Shipping V3, not
+ * anything on the developer portal. Click & Drop imports orders and prints
+ * labels; postage is charged afterwards at whatever your OBA agreement says.
+ *
+ * So the shop quotes from this table, and the table has to match the rate
+ * card on your account or you will undercharge every order and find out at
+ * the invoice. The codes below are real Royal Mail service codes; the prices
+ * are NOT — they are placeholders, in pence.
+ */
+const ROYAL_MAIL_SERVICES = (): string => `
+/**
+ * What this shop charges for Royal Mail, by total parcel weight.
+ *
+ * TODO VERIFY: every \`amount\` below is a placeholder in pence. Replace them
+ * with your own OBA rate card — Click & Drop → Settings → Shipping services
+ * lists exactly which services your account has, and the codes here must be
+ * among them. Service codes are account-specific: the published list is from
+ * 2021 and Royal Mail warn that "available services are unique to your OBA
+ * account and individual service agreements".
+ *
+ * The band whose \`maxGrams\` first covers the parcel wins, so order does not
+ * matter. A parcel heavier than every band gets no rate at all rather than a
+ * wrong one, and Click & Drop refuses anything over 30 kg.
+ */
+export const royalMailServices: RoyalMailService[] = [
+	{
+		code: "TPN24",
+		name: "Tracked 24",
+		estimatedDays: 1,
+		bands: [
+			{ maxGrams: 1000, amount: 0 /* TODO VERIFY */ },
+			{ maxGrams: 2000, amount: 0 /* TODO VERIFY */ },
+			{ maxGrams: 5000, amount: 0 /* TODO VERIFY */ },
+		],
+	},
+	{
+		code: "TPS48",
+		name: "Tracked 48",
+		estimatedDays: 2,
+		bands: [
+			{ maxGrams: 1000, amount: 0 /* TODO VERIFY */ },
+			{ maxGrams: 2000, amount: 0 /* TODO VERIFY */ },
+			{ maxGrams: 5000, amount: 0 /* TODO VERIFY */ },
+		],
+	},
+];
+`;

package/src/init.ts

@@ -94,7 +94,7 @@ export async function init(args: string[]): Promise<number> {
 	} else {
 		const parts: Array<[dir: string, starter: string]> = [
 			["api", "the D1 starter — this is the worker"],
-			["frontend", "Static Pages — this is prerendered for GitHub Pages"],
+			["frontend", "the storefront — prerendered and served from the worker's own assets"],
 		];
 		for (const [dir, starter] of parts) {
 			const target = join(root, dir);

package/src/manifest.ts

@@ -30,9 +30,10 @@ export const MANIFEST_FILE = "voidcommerce.json";
  *   strict    EXPERIMENTAL. A monorepo turned inside out. The REPOSITORY
  *             ROOT is the storefront — its package.json, its pages, yours to
  *             edit — and the worker is generated underneath it at .vc/app
- *             from the manifest, gitignored, never hand-edited. Hosted the
- *             way a monorepo is: the worker on api.<domain>, the storefront
- *             on <domain>.
+ *             from the manifest, gitignored, never hand-edited. ONE worker
+ *             serves both at <domain>: the storefront's prerendered tree is
+ *             folded into the worker's assets at build time, so there is one
+ *             origin, one deploy, and one certificate Cloudflare issues.
  *
  * The first question, because it decides where `void init` runs and what
  * the domain means. It cannot change after init: moving files is not a
@@ -54,7 +55,7 @@ export const LAYOUTS: Array<{ id: Layout; label: string; hint: string }> = [
 	{
 		id: "strict",
 		label: "Strict (experimental)",
-		hint: "the root IS the storefront, sharing one package.json; the worker is generated under .vc/app from the manifest and never hand-edited",
+		hint: "the root IS the storefront, sharing one package.json; the worker is generated under .vc/app and serves the storefront from its own assets — one origin, one deploy",
 	},
 ];
 
@@ -68,9 +69,28 @@ export const LAYOUTS: Array<{ id: Layout; label: string; hint: string }> = [
  */
 export const isSingleApp = (layout: Layout): boolean => layout === "app";
 
-/** Does this layout carry a storefront of its own, and so a second origin to trust? */
+/** Does this layout carry a storefront of its own, in the repository? */
 export const hasFrontend = (layout: Layout): boolean => layout !== "app";
 
+/**
+ * Does ONE worker serve both the storefront and the API?
+ *
+ * `app` always did — it generates its storefront into the worker. `strict`
+ * now does too: the root's prerendered tree is merged into the worker's own
+ * assets directory at build time, so there is one origin, one hostname, one
+ * deploy, and one certificate that Cloudflare issues itself.
+ *
+ * That deletes the whole GitHub Pages half — the A/AAAA records, the CNAME
+ * file, the base-path rewriting — and with it a trap worth naming: GitHub
+ * treats any Cloudflare IP as ineligible for a certificate, so a proxied
+ * record silently stops issuance AND renewal about ninety days later, while
+ * GitHub's own health check still reports green.
+ *
+ * `monorepo` keeps the split, because there the frontend is a separate app
+ * that a person may well want hosted separately.
+ */
+export const oneOrigin = (layout: Layout): boolean => layout !== "monorepo";
+
 /**
  * Public suffixes whose second label is not a registrable name, so
  * `shop.example.co.uk` is a subdomain of `example.co.uk`, not of `co.uk`.
@@ -100,7 +120,9 @@ export function isApex(manifest: Manifest): boolean {
 /** Every hostname the worker answers on — the wrangler routes, in order. */
 export function workerHosts(manifest: Manifest): string[] {
 	const { domain } = manifest.shop;
-	if (!isSingleApp(manifest.layout)) return [`api.${domain}`];
+	// Only a monorepo puts the worker on its own hostname; everything else
+	// serves the shop and its API from one origin.
+	if (!oneOrigin(manifest.layout)) return [`api.${domain}`];
 	return isApex(manifest) ? [domain, `www.${domain}`] : [domain];
 }
 
@@ -145,7 +167,10 @@ export interface Manifest {
 		 * default that is safe to assume.
 		 */
 		taxRegistered?: boolean | undefined;
-		/** `saastemly.github.io` — the monorepo's frontend lives on GitHub Pages; the www record points here. */
+		/**
+		 * `saastemly.github.io` — only a MONOREPO has a storefront on GitHub
+		 * Pages. In `app` and `strict` the worker serves it, so this is unused.
+		 */
 		pagesHost?: string | undefined;
 	};
 	/** Chosen ids from each group, keyed by group id. */
@@ -296,7 +321,7 @@ export function validate(manifest: Manifest): string[] {
 			`DNS at Simply.com cannot host ${workerHosts(manifest)[0]} — a Worker custom domain is created by Cloudflare, in a zone on Cloudflare`,
 		);
 	}
-	if (hasFrontend(manifest.layout) && manifest.shop.pagesHost && !/^[a-z0-9-]+\.github\.io$/i.test(manifest.shop.pagesHost)) {
+	if (!oneOrigin(manifest.layout) && manifest.shop.pagesHost && !/^[a-z0-9-]+\.github\.io$/i.test(manifest.shop.pagesHost)) {
 		problems.push(`Pages host "${manifest.shop.pagesHost}" should be <owner>.github.io`);
 	}
 	return problems;

package/src/wizard.ts

@@ -1,7 +1,7 @@
 import * as p from "@clack/prompts";
 import color from "picocolors";
 import { GROUPS, type Group } from "./catalog";
-import { LAYOUTS, type Layout, type Manifest, zoneOf } from "./manifest";
+import { LAYOUTS, type Layout, type Manifest, zoneOf , oneOrigin} from "./manifest";
 
 /**
  * The forms.
@@ -98,6 +98,10 @@ async function askGroup(group: Group, previous: string[] | undefined, alsoRequir
 export async function runWizard(existing: Manifest | null, layout: Layout): Promise<Manifest> {
 	const monorepo = layout === "monorepo";
 	const frontend = layout !== "app";
+	// Only a monorepo publishes its storefront to GitHub Pages. In `strict`
+	// the worker serves it from its own assets, so there is no Pages host to
+	// ask for — and asking would imply a second origin that does not exist.
+	const onPages = !oneOrigin(layout);
 
 	const shop = unwrap(
 		await p.group(
@@ -171,7 +175,7 @@ export async function runWizard(existing: Manifest | null, layout: Layout): Prom
 						initialValue: existing?.shop.locale ?? "",
 						validate: (value) => (/^[a-z]{2}(-[A-Z]{2})?$/.test(value.trim()) ? undefined : "like da, or en-GB."),
 					}),
-				...(frontend
+				...(onPages
 					? {
 							pagesHost: () =>
 								p.text({
@@ -211,7 +215,7 @@ export async function runWizard(existing: Manifest | null, layout: Layout): Prom
 			locale: shop.locale.trim(),
 			taxRegistered: (shop as { taxRegistered?: string }).taxRegistered === "yes",
 			zone: (shop as { zone?: string }).zone?.trim().toLowerCase() || undefined,
-			pagesHost: frontend ? (shop as { pagesHost?: string }).pagesHost?.trim().toLowerCase() || undefined : undefined,
+			pagesHost: onPages ? (shop as { pagesHost?: string }).pagesHost?.trim().toLowerCase() || undefined : undefined,
 		},
 		chosen,
 	};