frontpage-host 0.1.15 → 0.1.16

package/AGENTS.md

@@ -109,7 +109,7 @@ Sites are Astro 6 + Tailwind v4. More detail: `frontpage help site-building` or
 ## Modules & articles
 
 - Forms: `data-fp-form` markup in pages + `frontpage modules` for enable/config. No submit JS / honeypot / `action`.
-- Wizard / connect-once modules (payments/shop/ordering): `frontpage modules <key> connect` opens the browser (Stripe or Square). Finish there, then `status`. `--no-open` for CI. `request-setup` remains valid when you want the **editor amber bar** instead. payments and shop share one Stripe account. Auto-active modules (forms/callbar/…) need markup, not request-setup. Typed settings: `frontpage modules callbar|forms|booking|signups get|set` (forms set needs `--instance`; do not target `default`). `frontpage modules <key>` prints that key's CLI usage (exit 2). Index: https://frontpage.host/developers/modules · payments/shop/ordering pages under /developers/modules/<key>
+- Wizard / connect-once modules (payments/shop/ordering): `frontpage modules <key> connect` opens Frontpage (you must be logged in there), then Stripe or Square. Already-connected sites stay live — do not retry connect. payments/shop connect needs an **admin** key; ordering connect needs **editor**. `--no-open` for CI. `request-setup` remains valid when you want the **editor amber bar** instead. payments and shop share one Stripe account — payments disconnect fails if the store still uses it. Auto-active modules (forms/callbar/…) need markup, not request-setup. Typed settings: `frontpage modules callbar|forms|booking|signups get|set` (forms set needs `--instance`; do not target `default`). `frontpage modules <key>` prints that key's CLI usage (exit 2). Index: https://frontpage.host/developers/modules · payments/shop/ordering pages under /developers/modules/<key>
 - Google reviews: platform nodes only (`data-fp-google-reviews` / `data-fp-google-ask` + required `data-fp-requires="google_reviews"`). `data-layout` is `feed` (default), `badge`, or `link`. Never invent stars, quotes, a 1–10, or a Maps URL. Do not pick a Place ID via Autocomplete and do not write `placeId` through `modules config`. Owner-supplied Place ID / Maps URL: `frontpage modules google_reviews connect --place-id …` or `--maps-url …` (server resolves + seeds). Curation: `list-reviews`, `hide --id`, `show --id`, `set-stars`, `set-sort`, `set-weight`, `reset-weights`, `refresh`, `disconnect`. Usage: `frontpage modules google_reviews`. Docs: https://frontpage.host/developers/modules/google-reviews. Ask-widget scores: `frontpage inbox google_reviews`.
 - Articles: `frontpage articles …` for lifecycle; bodies via sync under `content/` or `articles content get|set`. Section landing is an owned `src/pages/<section>/index.astro`.
 - Migrate a folder into Articles: prefer `frontpage prompt "migrate … into articles"` — do not invent a mass delete+write migration.

package/dist/modules/commands.js

@@ -139,8 +139,8 @@ export const MODULE_COMMANDS = [
             'frontpage modules payments request-setup --reason "Deposit button needs Stripe"',
         ],
         notes: [
-            "Connect opens Stripe. Finish in the browser, then re-run status. This CLI cannot complete OAuth.",
-            "payments and shop share one Stripe account — disconnect says so.",
+            "Connect needs an admin API key. It opens Frontpage (you must be logged in there), then Stripe. Already-connected sites stay live — disconnect first to switch accounts.",
+            "payments and shop share one Stripe account. Disconnecting payments fails if the store still uses that account.",
             "request-setup still lights the editor amber bar when you want the owner to finish there.",
         ],
     },
@@ -164,8 +164,8 @@ export const MODULE_COMMANDS = [
             'frontpage modules shop request-setup --reason "You asked for a store — Stripe setup makes checkout live"',
         ],
         notes: [
-            "Connect opens Stripe. Finish in the browser, then re-run status. This CLI cannot complete OAuth.",
-            "payments and shop share one Stripe account — disconnect says so.",
+            "Connect needs an admin API key. It opens Frontpage (you must be logged in there), then Stripe. Already-connected sites stay live.",
+            "payments and shop share one Stripe account. Shop disconnect keeps the account on payments.",
             "Shop still needs the shipping step in Modules if you have not set it.",
             "request-setup still lights the editor amber bar when you want the owner to finish there.",
         ],
@@ -192,7 +192,7 @@ export const MODULE_COMMANDS = [
             'frontpage modules ordering request-setup --reason "You asked for online ordering — Square setup makes it live"',
         ],
         notes: [
-            "Connect opens Square. Finish in the browser, then re-run status. This CLI cannot complete OAuth.",
+            "Connect needs an editor API key. It opens Frontpage (you must be logged in there), then Square. Already-connected sites stay live.",
             "sync refreshes the Square catalog (same as the hub Sync button).",
             "request-setup still lights the editor amber bar when you want the owner to finish there.",
             "Fulfillment (pickup/delivery) is not in this CLI yet — use Modules or the editor.",

package/dist/modules/oauth.d.ts

@@ -1,4 +1,12 @@
 export declare const OAUTH_CLI_KEYS: readonly ["payments", "shop", "ordering"];
 export type OauthCliKey = (typeof OAUTH_CLI_KEYS)[number];
 export declare function isOauthCliKey(key: string): key is OauthCliKey;
+export declare function resolveOpenUrl(raw: unknown): string | null;
+/** argv for the platform opener. Windows quotes the URL so `&` stays in the query. */
+export declare function browserOpenCommand(url: string, platform?: NodeJS.Platform): {
+    command: string;
+    args: string[];
+    windowsVerbatimArguments?: boolean;
+};
+export declare function openBrowser(url: string): void;
 export declare function runOauthHandoff(key: OauthCliKey, slug: string, action: string, flags: string[]): Promise<number>;

package/dist/modules/oauth.js

@@ -1,5 +1,5 @@
 /**
- * §CLI-MOD-OAUTH — payments / shop / ordering connect, status, disconnect, sync.
+ * §CLI-MOD-OAUTH / §CLI-MOD-HARD — payments / shop / ordering connect, status, disconnect, sync.
  */
 import { spawn } from "node:child_process";
 import { assertNoUnknownFlags, hasFlag } from "../argv.js";
@@ -10,11 +10,11 @@ export const OAUTH_CLI_KEYS = ["payments", "shop", "ordering"];
 export function isOauthCliKey(key) {
     return OAUTH_CLI_KEYS.includes(key);
 }
-const FINISH = "Finish in the browser, then re-run status. This CLI cannot complete OAuth.";
+const FINISH = "Open the Frontpage URL while logged in, finish Stripe or Square in the browser, then re-run status. This CLI cannot complete OAuth.";
 function pathFor(slug, key) {
     return `/api/v1/sites/${encodeURIComponent(slug)}/modules/${encodeURIComponent(key)}`;
 }
-function resolveOpenUrl(raw) {
+export function resolveOpenUrl(raw) {
     if (typeof raw !== "string" || !raw.trim())
         return null;
     const trimmed = raw.trim();
@@ -24,10 +24,25 @@ function resolveOpenUrl(raw) {
         return `${apiBase()}${trimmed}`;
     return null;
 }
-function openBrowser(url) {
-    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-    const openerArgs = process.platform === "win32" ? ["/c", "start", "", url] : [url];
-    spawn(opener, openerArgs, { detached: true, stdio: "ignore" }).unref();
+/** argv for the platform opener. Windows quotes the URL so `&` stays in the query. */
+export function browserOpenCommand(url, platform = process.platform) {
+    if (platform === "darwin")
+        return { command: "open", args: [url] };
+    if (platform !== "win32")
+        return { command: "xdg-open", args: [url] };
+    return {
+        command: "cmd",
+        args: ["/c", "start", '""', `"${url}"`],
+        windowsVerbatimArguments: true,
+    };
+}
+export function openBrowser(url) {
+    const spec = browserOpenCommand(url);
+    spawn(spec.command, spec.args, {
+        detached: true,
+        stdio: "ignore",
+        ...(spec.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+    }).unref();
 }
 function printStatus(key, data) {
     const connection = (data.connection ?? {});
@@ -68,6 +83,7 @@ export async function runOauthHandoff(key, slug, action, flags) {
         const noOpen = hasFlag(work, "--no-open");
         assertNoUnknownFlags(work, "modules");
         const data = await v1Post(pathFor(slug, key), { action: "connect" });
+        const already = data.alreadyConnected === true;
         if (isJson()) {
             emitOk("modules", data);
         }
@@ -75,12 +91,12 @@ export async function runOauthHandoff(key, slug, action, flags) {
             const url = resolveOpenUrl(data.connectUrl);
             if (url)
                 console.log(url);
-            console.log(typeof data.message === "string" ? data.message : FINISH);
+            console.log(typeof data.message === "string" ? data.message : already ? "Already connected." : FINISH);
             if (typeof data.warning === "string")
                 console.log(data.warning);
         }
         const url = resolveOpenUrl(data.connectUrl);
-        if (url && !noOpen)
+        if (url && !noOpen && !already)
             openBrowser(url);
         return EXIT_OK;
     }

package/dist/registry.js

@@ -348,7 +348,7 @@ export const COMMANDS = [
         dangers: [
             "Secret values are never returned — masks only",
             "request-setup surfaces an owner prompt in the editor status bar (CLI cannot show it)",
-            "payments and shop share one Stripe account — disconnect warns before teardown",
+            "payments and shop share one Stripe account — payments disconnect 409s if the store still uses it",
             "OAuth cannot finish in the terminal; connect only opens the vendor URL",
             "Do not write placeId through generic config — that skips listing resolve + seed",
         ],
@@ -596,7 +596,7 @@ export const TOPICS = {
   frontpage tokens set --group … --key … --value …
   frontpage modules list|docs|request-setup|enable|disable|archive|config <key>
   frontpage modules <key>            # that key's CLI usage
-  frontpage modules payments|shop|ordering connect [--no-open]   # opens Stripe/Square; then status
+  frontpage modules payments|shop|ordering connect [--no-open]   # opens Frontpage then Stripe/Square; then status
   frontpage modules ordering sync
   # mailing list key: signups. Index: https://frontpage.host/developers/modules
   frontpage extensions list|docs|enable|disable|config <key>
@@ -607,7 +607,7 @@ export const TOPICS = {
   Do not fake payments/checkout. LOCKED extensions → do not fake; say plan required.
   Migrate pages → articles: prefer frontpage prompt "migrate …" over mass delete+write.
   edit uses click-edit (exact single occurrence), not push / gated-write.
-  Connect opens Stripe/Square in the browser; this CLI never accepts or returns OAuth secrets.
+  Connect opens Frontpage (logged-in), then Stripe/Square; never accepts or returns OAuth secrets. payments/shop connect is admin.
   Site contract: frontpage help site-building · https://frontpage.host/developers/site-building
   Domains, billing, members, and site delete are out of v1.`,
     history: `History

package/llms.txt

@@ -8,7 +8,7 @@
 - Fonts: frontpage fonts [--slot] [--query] → exact value → tokens set fonts.<role> → APPLY font-sans|serif|mono|display. Build bundles catalog faces from tokens.ts and/or CSS font-family contexts (not prose). Inline-only without tokens works for catalog faces after rebuild; prefer tokens+utilities for brand roles.
 - Module/extension docs: frontpage modules docs <key> | frontpage extensions docs <key>
 - Search flags: --regex --case-sensitive --whole-word --files-only --context-lines --max-results
-- Modules setup: wizard modules (payments/shop/ordering): frontpage modules <key> connect [--no-open] opens Stripe/Square; finish in the browser, then status. request-setup remains valid for the editor amber bar. payments and shop share one Stripe account. frontpage modules <key> prints that key's CLI usage. Index: https://frontpage.host/developers/modules. Typed config: frontpage modules callbar|forms|booking|signups get|set (forms set needs --instance; confirm emails paid-plan only). google_reviews: frontpage modules google_reviews connect --place-id | --maps-url (server resolve + seed; no Autocomplete; do not write placeId via config). Also status, list-reviews, hide/show, set-stars, set-sort, set-weight, reset-weights, refresh, disconnect. Docs: https://frontpage.host/developers/modules/google-reviews. Markup: data-fp-google-reviews / data-fp-google-ask + required data-fp-requires="google_reviews". Ask scores: frontpage inbox google_reviews.
+- Modules setup: wizard modules (payments/shop/ordering): frontpage modules <key> connect [--no-open] opens Frontpage (logged-in browser) then Stripe/Square; already-connected stays live. payments/shop connect = admin key; ordering = editor. payments disconnect 409s if shop still uses the shared Stripe account. request-setup remains valid for the editor amber bar. frontpage modules <key> prints that key's CLI usage. Index: https://frontpage.host/developers/modules. Typed config: frontpage modules callbar|forms|booking|signups get|set (forms set needs --instance; confirm emails paid-plan only). google_reviews: frontpage modules google_reviews connect --place-id | --maps-url (server resolve + seed; no Autocomplete; do not write placeId via config). Also status, list-reviews, hide/show, set-stars, set-sort, set-weight, reset-weights, refresh, disconnect. Docs: https://frontpage.host/developers/modules/google-reviews. Markup: data-fp-google-reviews / data-fp-google-ask + required data-fp-requires="google_reviews". Ask scores: frontpage inbox google_reviews.
 - Analytics ops: frontpage analytics summary|query|funnel|timeseries|compare|sql (bare analytics = dashboard)
 - Media: frontpage media upload <file> (images/PDF ≤25 MB, video ≤50 MB, SVG/text ≤4 MB); human prints sitePath first — use /__media/uploads/<slug>/… in markup. Text/CSV is inline only (not media library; --json omits full content).
 - Prompt attachments: frontpage prompt "…" --attach <file|/__media/…|https://…> [--asset-url https://…] (same media caps as media upload)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frontpage-host",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Frontpage CLI — manage your site from the terminal",
   "type": "module",
   "bin": {