frontpage-host 0.1.14 → 0.1.15

package/AGENTS.md

@@ -109,7 +109,7 @@ Sites are Astro 6 + Tailwind v4. More detail: `frontpage help site-building` or
 ## Modules & articles
 
 - Forms: `data-fp-form` markup in pages + `frontpage modules` for enable/config. No submit JS / honeypot / `action`.
-- Wizard / connect-once modules (payments/shop/ordering/google_reviews): after building gated markup, `frontpage modules request-setup <key> --reason "…"` once — owner finishes in the **editor status bar** (CLI cannot show it). Auto-active modules (forms/callbar/…) need markup, not request-setup. Typed settings: `frontpage modules callbar|forms|booking|signups get|set` (forms set needs `--instance`; do not target `default`). `frontpage modules <key>` prints that key's CLI usage (exit 2). Index: https://frontpage.host/developers/modules
+- Wizard / connect-once modules (payments/shop/ordering): `frontpage modules <key> connect` opens the browser (Stripe or Square). Finish there, then `status`. `--no-open` for CI. `request-setup` remains valid when you want the **editor amber bar** instead. payments and shop share one Stripe account. Auto-active modules (forms/callbar/…) need markup, not request-setup. Typed settings: `frontpage modules callbar|forms|booking|signups get|set` (forms set needs `--instance`; do not target `default`). `frontpage modules <key>` prints that key's CLI usage (exit 2). Index: https://frontpage.host/developers/modules · payments/shop/ordering pages under /developers/modules/<key>
 - Google reviews: platform nodes only (`data-fp-google-reviews` / `data-fp-google-ask` + required `data-fp-requires="google_reviews"`). `data-layout` is `feed` (default), `badge`, or `link`. Never invent stars, quotes, a 1–10, or a Maps URL. Do not pick a Place ID via Autocomplete and do not write `placeId` through `modules config`. Owner-supplied Place ID / Maps URL: `frontpage modules google_reviews connect --place-id …` or `--maps-url …` (server resolves + seeds). Curation: `list-reviews`, `hide --id`, `show --id`, `set-stars`, `set-sort`, `set-weight`, `reset-weights`, `refresh`, `disconnect`. Usage: `frontpage modules google_reviews`. Docs: https://frontpage.host/developers/modules/google-reviews. Ask-widget scores: `frontpage inbox google_reviews`.
 - Articles: `frontpage articles …` for lifecycle; bodies via sync under `content/` or `articles content get|set`. Section landing is an owned `src/pages/<section>/index.astro`.
 - Migrate a folder into Articles: prefer `frontpage prompt "migrate … into articles"` — do not invent a mass delete+write migration.

package/dist/commands/modules.js

@@ -5,6 +5,7 @@ import { emitUsage } from "../runtime.js";
 import { formatModuleUsage, formatModulesIndex, isCliModuleAction, isDocumentedModuleKey, isGenericModuleVerb, } from "../modules/commands.js";
 import { runGoogleReviews } from "../modules/google_reviews.js";
 import { isTypedConfigCliKey, runTypedConfig } from "../modules/typed_config.js";
+import { isOauthCliKey, runOauthHandoff } from "../modules/oauth.js";
 /** Drop --site so we can print local usage without resolving a checkout. */
 function positionalArgs(args) {
     const rest = [];
@@ -46,6 +47,9 @@ export async function runModules(args) {
                 if (isTypedConfigCliKey(peekedKey)) {
                     return await runTypedConfig(peekedKey, slug, peekedAction, extraFlags);
                 }
+                if (isOauthCliKey(peekedKey)) {
+                    return await runOauthHandoff(peekedKey, slug, peekedAction, extraFlags);
+                }
             }
             if (!isGenericModuleVerb(peekedAction)) {
                 return emitUsage("modules", `${formatModuleUsage(peekedKey)}\n\nUnknown action "${peekedAction}". Not in this CLI yet — use Modules or the editor.`);

package/dist/completions/generate.js

@@ -29,6 +29,10 @@ _frontpage_completions() {
         COMPREPLY=( $(compgen -W "docs request-setup enable disable archive config connect resolve status list-reviews hide show set-stars set-sort set-weight reset-weights write-review-url refresh disconnect" -- "\${cur}") )
       elif [[ \${COMP_CWORD} -ge 3 && (\${COMP_WORDS[2]} == callbar || \${COMP_WORDS[2]} == forms || \${COMP_WORDS[2]} == booking || \${COMP_WORDS[2]} == signups) ]]; then
         COMPREPLY=( $(compgen -W "docs request-setup enable disable archive config get set" -- "\${cur}") )
+      elif [[ \${COMP_CWORD} -ge 3 && (\${COMP_WORDS[2]} == payments || \${COMP_WORDS[2]} == shop) ]]; then
+        COMPREPLY=( $(compgen -W "docs request-setup enable disable archive config status connect disconnect" -- "\${cur}") )
+      elif [[ \${COMP_CWORD} -ge 3 && \${COMP_WORDS[2]} == ordering ]]; then
+        COMPREPLY=( $(compgen -W "docs request-setup enable disable archive config status connect disconnect sync" -- "\${cur}") )
       else
         COMPREPLY=( $(compgen -W "list docs request-setup enable disable archive config callbar forms booking signups payments shop ordering articles google_reviews" -- "\${cur}") )
       fi
@@ -66,6 +70,10 @@ _frontpage() {
             _values 'subcommand' docs request-setup enable disable archive config connect resolve status list-reviews hide show set-stars set-sort set-weight reset-weights write-review-url refresh disconnect
           elif [[ $words[2] == callbar || $words[2] == forms || $words[2] == booking || $words[2] == signups ]]; then
             _values 'subcommand' docs request-setup enable disable archive config get set
+          elif [[ $words[2] == payments || $words[2] == shop ]]; then
+            _values 'subcommand' docs request-setup enable disable archive config status connect disconnect
+          elif [[ $words[2] == ordering ]]; then
+            _values 'subcommand' docs request-setup enable disable archive config status connect disconnect sync
           else
             _values 'subcommand' list docs request-setup enable disable archive config callbar forms booking signups payments shop ordering articles google_reviews
           fi
@@ -94,6 +102,8 @@ export function generateFishCompletion() {
         `complete -c frontpage -n "__fish_seen_subcommand_from modules" -a "list docs request-setup enable disable archive config callbar forms booking signups payments shop ordering articles google_reviews"`,
         `complete -c frontpage -n "__fish_seen_subcommand_from modules; and __fish_seen_subcommand_from google_reviews" -a "connect resolve status list-reviews hide show set-stars set-sort set-weight reset-weights write-review-url refresh disconnect"`,
         `complete -c frontpage -n "__fish_seen_subcommand_from modules; and __fish_seen_subcommand_from callbar forms booking signups" -a "get set"`,
+        `complete -c frontpage -n "__fish_seen_subcommand_from modules; and __fish_seen_subcommand_from payments shop" -a "status connect disconnect"`,
+        `complete -c frontpage -n "__fish_seen_subcommand_from modules; and __fish_seen_subcommand_from ordering" -a "status connect disconnect sync"`,
         `complete -c frontpage -n "__fish_seen_subcommand_from extensions" -a "list docs enable disable config"`,
         `complete -c frontpage -l site -d "Site subdomain slug"`,
     ];

package/dist/modules/commands.d.ts

@@ -18,6 +18,8 @@ export type ModuleCommandDef = {
 export declare const MODULE_COMMANDS: readonly ModuleCommandDef[];
 export declare const GOOGLE_REVIEWS_CLI_ACTIONS: readonly ["connect", "resolve", "status", "list-reviews", "hide", "show", "set-stars", "set-sort", "set-weight", "reset-weights", "write-review-url", "refresh", "disconnect"];
 export declare const TYPED_CONFIG_CLI_ACTIONS: readonly ["get", "set"];
+export declare const STRIPE_OAUTH_CLI_ACTIONS: readonly ["status", "connect", "disconnect"];
+export declare const ORDERING_OAUTH_CLI_ACTIONS: readonly ["status", "connect", "disconnect", "sync"];
 export declare function isCliModuleAction(key: DocumentedModuleKey, action: string): boolean;
 export declare function isDocumentedModuleKey(raw: string): raw is DocumentedModuleKey;
 export declare function isGenericModuleVerb(raw: string): boolean;

package/dist/modules/commands.js

@@ -124,16 +124,24 @@ export const MODULE_COMMANDS = [
         name: "Payments",
         summary: "Stripe payments. Connect finishes in the browser, not the terminal.",
         genericActions: GENERIC_ACTIONS,
-        extraActions: [],
-        notYet: ["connect", "disconnect", "status"],
+        extraActions: [
+            "status",
+            "connect [--no-open]",
+            "disconnect [--yes]",
+        ],
+        notYet: [],
         examples: [
             "frontpage modules payments",
+            "frontpage modules payments status",
+            "frontpage modules payments connect --no-open",
+            "frontpage modules payments disconnect --yes",
             "frontpage modules payments docs",
             'frontpage modules payments request-setup --reason "Deposit button needs Stripe"',
         ],
         notes: [
-            "OAuth cannot finish in this CLI. Use request-setup (editor amber bar) or the Modules hub.",
-            "payments and shop share one Stripe account.",
+            "Connect opens Stripe. Finish in the browser, then re-run status. This CLI cannot complete OAuth.",
+            "payments and shop share one Stripe account — disconnect says so.",
+            "request-setup still lights the editor amber bar when you want the owner to finish there.",
         ],
     },
     {
@@ -141,16 +149,25 @@ export const MODULE_COMMANDS = [
         name: "Online store",
         summary: "Stripe shop. Shares the payments Stripe account.",
         genericActions: GENERIC_ACTIONS,
-        extraActions: [],
-        notYet: ["connect", "disconnect", "status"],
+        extraActions: [
+            "status",
+            "connect [--no-open]",
+            "disconnect [--yes]",
+        ],
+        notYet: [],
         examples: [
             "frontpage modules shop",
+            "frontpage modules shop status",
+            "frontpage modules shop connect --no-open",
+            "frontpage modules shop disconnect --yes",
             "frontpage modules shop docs",
             'frontpage modules shop request-setup --reason "You asked for a store — Stripe setup makes checkout live"',
         ],
         notes: [
-            "OAuth cannot finish in this CLI. Use request-setup (editor amber bar) or the Modules hub.",
-            "payments and shop share one Stripe account.",
+            "Connect opens Stripe. Finish in the browser, then re-run status. This CLI cannot complete OAuth.",
+            "payments and shop share one Stripe account — disconnect says so.",
+            "Shop still needs the shipping step in Modules if you have not set it.",
+            "request-setup still lights the editor amber bar when you want the owner to finish there.",
         ],
     },
     {
@@ -158,15 +175,27 @@ export const MODULE_COMMANDS = [
         name: "Online ordering",
         summary: "Square ordering. Connect finishes in the browser, not the terminal.",
         genericActions: GENERIC_ACTIONS,
-        extraActions: [],
-        notYet: ["connect", "disconnect", "sync", "status"],
+        extraActions: [
+            "status",
+            "connect [--no-open]",
+            "disconnect [--yes]",
+            "sync",
+        ],
+        notYet: ["fulfillment get|set"],
         examples: [
             "frontpage modules ordering",
+            "frontpage modules ordering status",
+            "frontpage modules ordering connect --no-open",
+            "frontpage modules ordering sync",
+            "frontpage modules ordering disconnect --yes",
             "frontpage modules ordering docs",
             'frontpage modules ordering request-setup --reason "You asked for online ordering — Square setup makes it live"',
         ],
         notes: [
-            "OAuth cannot finish in this CLI. Use request-setup (editor amber bar) or the Modules hub.",
+            "Connect opens Square. Finish in the browser, then re-run status. This CLI cannot complete OAuth.",
+            "sync refreshes the Square catalog (same as the hub Sync button).",
+            "request-setup still lights the editor amber bar when you want the owner to finish there.",
+            "Fulfillment (pickup/delivery) is not in this CLI yet — use Modules or the editor.",
         ],
     },
     {
@@ -240,6 +269,8 @@ export const GOOGLE_REVIEWS_CLI_ACTIONS = [
     "disconnect",
 ];
 export const TYPED_CONFIG_CLI_ACTIONS = ["get", "set"];
+export const STRIPE_OAUTH_CLI_ACTIONS = ["status", "connect", "disconnect"];
+export const ORDERING_OAUTH_CLI_ACTIONS = ["status", "connect", "disconnect", "sync"];
 export function isCliModuleAction(key, action) {
     if (key === "google_reviews") {
         return GOOGLE_REVIEWS_CLI_ACTIONS.includes(action);
@@ -247,6 +278,12 @@ export function isCliModuleAction(key, action) {
     if (key === "callbar" || key === "forms" || key === "booking" || key === "signups") {
         return TYPED_CONFIG_CLI_ACTIONS.includes(action);
     }
+    if (key === "payments" || key === "shop") {
+        return STRIPE_OAUTH_CLI_ACTIONS.includes(action);
+    }
+    if (key === "ordering") {
+        return ORDERING_OAUTH_CLI_ACTIONS.includes(action);
+    }
     return false;
 }
 export function isDocumentedModuleKey(raw) {

package/dist/modules/oauth.d.ts

@@ -0,0 +1,4 @@
+export declare const OAUTH_CLI_KEYS: readonly ["payments", "shop", "ordering"];
+export type OauthCliKey = (typeof OAUTH_CLI_KEYS)[number];
+export declare function isOauthCliKey(key: string): key is OauthCliKey;
+export declare function runOauthHandoff(key: OauthCliKey, slug: string, action: string, flags: string[]): Promise<number>;

package/dist/modules/oauth.js

@@ -0,0 +1,122 @@
+/**
+ * §CLI-MOD-OAUTH — payments / shop / ordering connect, status, disconnect, sync.
+ */
+import { spawn } from "node:child_process";
+import { assertNoUnknownFlags, hasFlag } from "../argv.js";
+import { apiBase, EXIT_OK, v1Get, v1Post } from "../http/client.js";
+import { emitOk, emitUsage, isJson, requireYesOrTty } from "../runtime.js";
+import { formatModuleUsage } from "./commands.js";
+export const OAUTH_CLI_KEYS = ["payments", "shop", "ordering"];
+export function isOauthCliKey(key) {
+    return OAUTH_CLI_KEYS.includes(key);
+}
+const FINISH = "Finish in the browser, then re-run status. This CLI cannot complete OAuth.";
+function pathFor(slug, key) {
+    return `/api/v1/sites/${encodeURIComponent(slug)}/modules/${encodeURIComponent(key)}`;
+}
+function resolveOpenUrl(raw) {
+    if (typeof raw !== "string" || !raw.trim())
+        return null;
+    const trimmed = raw.trim();
+    if (/^https?:\/\//i.test(trimmed))
+        return trimmed;
+    if (trimmed.startsWith("/"))
+        return `${apiBase()}${trimmed}`;
+    return null;
+}
+function openBrowser(url) {
+    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const openerArgs = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    spawn(opener, openerArgs, { detached: true, stdio: "ignore" }).unref();
+}
+function printStatus(key, data) {
+    const connection = (data.connection ?? {});
+    const display = connection.display ?? {};
+    console.log(`connected  ${connection.ready ? "yes" : "no"}`);
+    if (key === "ordering") {
+        console.log(`merchant   ${display.merchantName ?? "—"}`);
+        if (display.locationCount != null)
+            console.log(`locations  ${display.locationCount}`);
+        if (display.cardProcessing != null)
+            console.log(`cards      ${display.cardProcessing ? "yes" : "no"}`);
+        if (display.menuSyncedAt)
+            console.log(`menu sync  ${display.menuSyncedAt}`);
+    }
+    else {
+        console.log(`charges    ${display.chargesEnabled == null ? "—" : display.chargesEnabled ? "yes" : "no"}`);
+        console.log(`account    ${display.accountPresent ? "present" : "none"}`);
+        if (typeof data.sharedStripe === "string")
+            console.log(`note       ${data.sharedStripe}`);
+    }
+    if (typeof data.connectUrl === "string")
+        console.log(`connect    ${data.connectUrl}`);
+}
+export async function runOauthHandoff(key, slug, action, flags) {
+    const work = [...flags];
+    const usage = formatModuleUsage(key);
+    if (action === "status") {
+        assertNoUnknownFlags(work, "modules");
+        const data = await v1Get(pathFor(slug, key));
+        if (isJson()) {
+            emitOk("modules", data);
+            return EXIT_OK;
+        }
+        printStatus(key, data);
+        return EXIT_OK;
+    }
+    if (action === "connect") {
+        const noOpen = hasFlag(work, "--no-open");
+        assertNoUnknownFlags(work, "modules");
+        const data = await v1Post(pathFor(slug, key), { action: "connect" });
+        if (isJson()) {
+            emitOk("modules", data);
+        }
+        else {
+            const url = resolveOpenUrl(data.connectUrl);
+            if (url)
+                console.log(url);
+            console.log(typeof data.message === "string" ? data.message : FINISH);
+            if (typeof data.warning === "string")
+                console.log(data.warning);
+        }
+        const url = resolveOpenUrl(data.connectUrl);
+        if (url && !noOpen)
+            openBrowser(url);
+        return EXIT_OK;
+    }
+    if (action === "disconnect") {
+        assertNoUnknownFlags(work, "modules");
+        const label = key === "ordering"
+            ? "disconnect Square"
+            : key === "payments"
+                ? "disconnect payments (shared Stripe account with the store)"
+                : "disconnect the store (shared Stripe account with payments)";
+        const refuse = requireYesOrTty(label);
+        if (refuse)
+            return emitUsage("modules", refuse);
+        const data = await v1Post(pathFor(slug, key), { action: "disconnect" });
+        if (isJson()) {
+            emitOk("modules", data);
+            return EXIT_OK;
+        }
+        console.log(typeof data.message === "string" ? data.message : "Disconnected.");
+        if (typeof data.warning === "string" && data.warning !== data.message) {
+            console.log(data.warning);
+        }
+        return EXIT_OK;
+    }
+    if (action === "sync") {
+        if (key !== "ordering") {
+            return emitUsage("modules", `sync is only available for ordering.\n\n${usage}`);
+        }
+        assertNoUnknownFlags(work, "modules");
+        const data = await v1Post(pathFor(slug, key), { action: "sync" });
+        if (isJson()) {
+            emitOk("modules", data);
+            return EXIT_OK;
+        }
+        console.log(`Synced — ${data.itemCount ?? 0} items, ${data.locationCount ?? 0} locations.`);
+        return EXIT_OK;
+    }
+    return emitUsage("modules", `${usage}\n\nUnknown action "${action}".`);
+}

package/dist/registry.js

@@ -328,6 +328,8 @@ export const COMMANDS = [
             "frontpage modules callbar set --phone +14085551234 --sms no",
             "frontpage modules forms get",
             "frontpage modules forms set --instance lead-gen --notify-email hi@example.com",
+            "frontpage modules ordering connect --no-open",
+            "frontpage modules payments status",
             "frontpage modules docs forms",
             "frontpage modules docs google_reviews",
             "frontpage modules docs signups",
@@ -340,11 +342,14 @@ export const COMMANDS = [
             "Key-first and verb-first both work: `modules google_reviews enable` = `modules enable google_reviews`",
             "google_reviews extras: connect / resolve / status / list-reviews / hide / show / set-stars / set-sort / set-weight / reset-weights / refresh / disconnect / write-review-url",
             "callbar/forms/booking/signups: typed get / set (same whitelist as `modules config`)",
+            "payments/shop/ordering: connect opens the browser; finish there, then status. --no-open for CI. request-setup still lights the editor amber bar.",
             "See https://frontpage.host/developers/modules and /developers/modules/google-reviews",
         ],
         dangers: [
             "Secret values are never returned — masks only",
             "request-setup surfaces an owner prompt in the editor status bar (CLI cannot show it)",
+            "payments and shop share one Stripe account — disconnect warns before teardown",
+            "OAuth cannot finish in the terminal; connect only opens the vendor URL",
             "Do not write placeId through generic config — that skips listing resolve + seed",
         ],
         seeAlso: ["articles", "inbox"],
@@ -590,7 +595,9 @@ export const TOPICS = {
   frontpage fonts [list|search] [--slot …] [--query …]
   frontpage tokens set --group … --key … --value …
   frontpage modules list|docs|request-setup|enable|disable|archive|config <key>
-  frontpage modules <key>            # that key's CLI usage (generic only in this phase)
+  frontpage modules <key>            # that key's CLI usage
+  frontpage modules payments|shop|ordering connect [--no-open]   # opens Stripe/Square; then status
+  frontpage modules ordering sync
   # mailing list key: signups. Index: https://frontpage.host/developers/modules
   frontpage extensions list|docs|enable|disable|config <key>
   frontpage settings get|set
@@ -600,7 +607,7 @@ export const TOPICS = {
   Do not fake payments/checkout. LOCKED extensions → do not fake; say plan required.
   Migrate pages → articles: prefer frontpage prompt "migrate …" over mass delete+write.
   edit uses click-edit (exact single occurrence), not push / gated-write.
-  Module OAuth and secret values are not exposed via the CLI.
+  Connect opens Stripe/Square in the browser; this CLI never accepts or returns OAuth secrets.
   Site contract: frontpage help site-building · https://frontpage.host/developers/site-building
   Domains, billing, members, and site delete are out of v1.`,
     history: `History

package/llms.txt

@@ -8,7 +8,7 @@
 - Fonts: frontpage fonts [--slot] [--query] → exact value → tokens set fonts.<role> → APPLY font-sans|serif|mono|display. Build bundles catalog faces from tokens.ts and/or CSS font-family contexts (not prose). Inline-only without tokens works for catalog faces after rebuild; prefer tokens+utilities for brand roles.
 - Module/extension docs: frontpage modules docs <key> | frontpage extensions docs <key>
 - Search flags: --regex --case-sensitive --whole-word --files-only --context-lines --max-results
-- Modules setup: frontpage modules request-setup <key> --reason "…" (owner status bar; CLI cannot show it). frontpage modules <key> prints that key's CLI usage. Index: https://frontpage.host/developers/modules. Typed config: frontpage modules callbar|forms|booking|signups get|set (forms set needs --instance; confirm emails paid-plan only). google_reviews: frontpage modules google_reviews connect --place-id | --maps-url (server resolve + seed; no Autocomplete; do not write placeId via config). Also status, list-reviews, hide/show, set-stars, set-sort, set-weight, reset-weights, refresh, disconnect. Docs: https://frontpage.host/developers/modules/google-reviews. Markup: data-fp-google-reviews / data-fp-google-ask + required data-fp-requires="google_reviews". Ask scores: frontpage inbox google_reviews.
+- Modules setup: wizard modules (payments/shop/ordering): frontpage modules <key> connect [--no-open] opens Stripe/Square; finish in the browser, then status. request-setup remains valid for the editor amber bar. payments and shop share one Stripe account. frontpage modules <key> prints that key's CLI usage. Index: https://frontpage.host/developers/modules. Typed config: frontpage modules callbar|forms|booking|signups get|set (forms set needs --instance; confirm emails paid-plan only). google_reviews: frontpage modules google_reviews connect --place-id | --maps-url (server resolve + seed; no Autocomplete; do not write placeId via config). Also status, list-reviews, hide/show, set-stars, set-sort, set-weight, reset-weights, refresh, disconnect. Docs: https://frontpage.host/developers/modules/google-reviews. Markup: data-fp-google-reviews / data-fp-google-ask + required data-fp-requires="google_reviews". Ask scores: frontpage inbox google_reviews.
 - Analytics ops: frontpage analytics summary|query|funnel|timeseries|compare|sql (bare analytics = dashboard)
 - Media: frontpage media upload <file> (images/PDF ≤25 MB, video ≤50 MB, SVG/text ≤4 MB); human prints sitePath first — use /__media/uploads/<slug>/… in markup. Text/CSV is inline only (not media library; --json omits full content).
 - Prompt attachments: frontpage prompt "…" --attach <file|/__media/…|https://…> [--asset-url https://…] (same media caps as media upload)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frontpage-host",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Frontpage CLI — manage your site from the terminal",
   "type": "module",
   "bin": {