No secrets, no payment movement, no external account creation

PrepPort Owner Launch Wizard

Browser-friendly checklist for closing the remaining external launch blockers, recording sanitized evidence, and rerunning validation.

Ready28/32
Completion87.5%
External blockers4
Evidence missing3
Fundsblocked
Shopifyblocked

Owner Handoff

当前 PrepPort 上线进度:28/32 ready,87.5%。
剩余外部事项:4 项,其中高优先级 3 项。
建议顺序:先完成付款账户/发票流程和法律政策 review,再完成 Shopify Partner App credentials,最后完成 Search Console/GA4。
完成每个外部事项后,只记录不含密钥的 evidence,再运行工作台列出的验证命令。

Recommended Sequence

1. Payment account ready for customer deposits/invoices

high blocked_external evidence: missing
payments_business_account

Unlocks real deposit/invoice collection, wallet top-up approval, procurement payment gates, and release decisions after finance verification.

Exact Next Steps

  • Choose the launch payment stack, such as PayPal Business plus Wise/Airwallex/bank for settlement.
  • Confirm business verification, payout bank, settlement currency, fee handling, chargeback owner, refund owner, and proof-of-payment review flow.
  • Run one internal invoice/deposit test and verify that customer-submitted evidence stays in review until finance confirms settlement.
  • A business payment account and invoice/deposit workflow are approved before collecting customer funds or marking funds received.

Evidence Required

  • Payment provider and business account status
  • Settlement currency and payout destination confirmed
  • Approved invoice/deposit instruction wording stored outside chat
  • Chargeback/refund owner assigned
  • Finance rule for verifying customer-submitted payment evidence
  • Internal test invoice/deposit record or dry-run report

Safe Copy Values

  • Customer-facing legal drafts: outputs/prepport-legal-policy-drafts.md
  • Payment/legal setup handoff: https://prepportglobal.com/payment-legal-setup.html
  • Invoice package command: npm run invoice:package -- --invoice-id=INVOICE_ID
  • Business readiness command: npm run business:readiness -- --write
  • Payment gate dry-run command: npm run payment:gates-dry-run -- --write
  • Payment credential dry-run: node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=payment --dry-run
  • Payment activation dry-run: node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=payment --write-report
  • Send rule: Invoice package sendAllowed must remain false until payment instructions and invoice are approved.

Fields To Collect

  • PAYMENT_PROVIDER | secret=false | configured=undefined | Selected provider for customer deposits and invoices.
  • SETTLEMENT_CURRENCY | secret=false | configured=undefined | Currency used for quote, deposit, and invoice workflow.
  • APPROVED_PAYMENT_INSTRUCTIONS | secret=true | configured=undefined | Exact payment wording, stored only in controlled internal docs or payment platform.
  • PAYMENT_REVIEW_OWNER | secret=false | configured=undefined | Staff owner who verifies settlement before paid status, wallet credit, purchase, release, or shipment.
  • REFUND_CHARGEBACK_OWNER | secret=false | configured=undefined | Owner for refund, chargeback, overpayment, underpayment, and dispute decisions.
  • PAYPAL_CLIENT_ID | secret=false | configured=undefined | Optional PayPal API client ID when PayPal Business is selected.
  • PAYPAL_CLIENT_SECRET | secret=true | configured=undefined | Optional PayPal API secret.
  • WISE_API_TOKEN | secret=true | configured=undefined | Optional Wise API token if Wise automation is later enabled.
  • AIRWALLEX_API_KEY | secret=true | configured=undefined | Optional Airwallex API key if Airwallex automation is later enabled.
  • STRIPE_SECRET_KEY | secret=true | configured=undefined | Optional Stripe secret key for later hosted checkout/webhook automation.
  • legalReviewer | secret=false | configured=undefined | Reviewer/firm responsible for service agreement, privacy, liability, prohibited goods, sourcing liability, and trademark authorization.

Record Evidence Command

npm run launch:evidence -- --record --blocker=payments_business_account --title="payments_business_account evidence" --summary="Owner completed the external step; no secrets included." --validation-status=needs_review

Record Evidence JSON Template

{
  "blockerId": "payments_business_account",
  "evidenceType": "payments_business_account_owner_evidence",
  "title": "Payment account ready for customer deposits/invoices completed",
  "evidenceSummary": "Replace this with a sanitized summary of what was completed, where it was confirmed, and what validation still needs to run. Do not include secrets, OAuth codes, raw payment instructions, payment account numbers, private legal advice, or customer documents.",
  "evidenceUrls": [],
  "recordedBy": "Xing Chang",
  "effectiveDate": "",
  "validationStatus": "needs_review",
  "validationCommandsRun": [],
  "safeFieldsRecorded": {
    "PAYMENT_PROVIDER": {
      "value": "",
      "purpose": "Selected provider for customer deposits and invoices.",
      "source": "owner/platform decision"
    },
    "SETTLEMENT_CURRENCY": {
      "value": "",
      "purpose": "Currency used for quote, deposit, and invoice workflow.",
      "source": "owner/platform decision"
    },
    "PAYMENT_REVIEW_OWNER": {
      "value": "",
      "purpose": "Staff owner who verifies settlement before paid status, wallet credit, purchase, release, or shipment.",
      "source": "owner/platform decision"
    },
    "REFUND_CHARGEBACK_OWNER": {
      "value": "",
      "purpose": "Owner for refund, chargeback, overpayment, underpayment, and dispute decisions.",
      "source": "owner/platform decision"
    },
    "PAYPAL_CLIENT_ID": {
      "value": "",
      "purpose": "Optional PayPal API client ID when PayPal Business is selected.",
      "source": "owner/platform decision"
    },
    "legalReviewer": {
      "value": "",
      "purpose": "Reviewer/firm responsible for service agreement, privacy, liability, prohibited goods, sourcing liability, and trademark authorization.",
      "source": "owner/platform decision"
    }
  },
  "safeCopyValuesUsedForSetup": [
    {
      "label": "Customer-facing legal drafts",
      "value": "outputs/prepport-legal-policy-drafts.md"
    },
    {
      "label": "Payment/legal setup handoff",
      "value": "https://prepportglobal.com/payment-legal-setup.html"
    },
    {
      "label": "Invoice package command",
      "value": "npm run invoice:package -- --invoice-id=INVOICE_ID"
    },
    {
      "label": "Business readiness command",
      "value": "npm run business:readiness -- --write"
    },
    {
      "label": "Payment gate dry-run command",
      "value": "npm run payment:gates-dry-run -- --write"
    },
    {
      "label": "Payment credential dry-run",
      "value": "node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=payment --dry-run"
    },
    {
      "label": "Payment activation dry-run",
      "value": "node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=payment --write-report"
    },
    {
      "label": "Send rule",
      "value": "Invoice package sendAllowed must remain false until payment instructions and invoice are approved."
    }
  ],
  "secretFieldsHandledOutsideRecord": [
    "APPROVED_PAYMENT_INSTRUCTIONS",
    "PAYPAL_CLIENT_SECRET",
    "WISE_API_TOKEN",
    "AIRWALLEX_API_KEY",
    "STRIPE_SECRET_KEY"
  ],
  "notes": "Store secrets only through the secure local/deployment credential flow. This evidence record is a sanitized launch audit note, not the secret store and not legal/payment approval by itself.",
  "suggestedValidationCommands": [
    "npm run payment:gates-dry-run -- --write",
    "npm run business:readiness -- --write",
    "npm run invoice:package -- --invoice-id=INVOICE_ID",
    "npm run launch:checklist -- --write",
    "npm run launch:blockers -- --write",
    "cd ../.. && node scripts/check-production-readiness.mjs",
    "node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=payment --dry-run",
    "node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=payment --write-report",
    "npm run payment:provider-workbench -- --write",
    "npm run commercial:launch-workbench -- --write",
    "npm run legal-payment:review-packet -- --write",
    "npm run first-customer:dry-run -- --write"
  ]
}

Validation Commands

  • npm run payment:gates-dry-run -- --write
  • npm run business:readiness -- --write
  • npm run invoice:package -- --invoice-id=INVOICE_ID
  • npm run launch:checklist -- --write
  • npm run launch:blockers -- --write
  • cd ../.. && node scripts/check-production-readiness.mjs
  • node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=payment --dry-run
  • node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=payment --write-report
  • npm run payment:provider-workbench -- --write
  • npm run commercial:launch-workbench -- --write
  • npm run legal-payment:review-packet -- --write
  • npm run first-customer:dry-run -- --write
  • npm run customer:portal-usability -- --write
  • npm run launch:closure -- --write

Cannot Be Automated

  • Software cannot verify bank settlement without approved finance process or provider integration.
  • Customer-submitted payment evidence must not automatically mark paid, credit wallet, trigger procurement, or release inventory.
  • Login, password, 2FA, payment, final legal approval, provider KYC, and platform terms approval remain human/platform-only.

2. Legal policies reviewed for storage, sourcing, prep, shipping, and high-risk goods

high blocked_external evidence: recorded_pending_validation
legal_policy_review

Unlocks safer customer onboarding, prohibited/high-risk goods policy, trademark/label authorization, liability boundaries, and customer-facing service terms.

Exact Next Steps

  • Send service agreement, privacy policy, prohibited/high-risk goods policy, warehouse liability wording, sourcing liability wording, and trademark/label authorization wording for review.
  • Record reviewer name or firm, review date, approved document version, unresolved issues, and any accepted residual risks.
  • Confirm onboarding still captures trademark/label authorization and prohibited/high-risk goods declarations before warehouse work starts.
  • External legal/compliance review is complete and the owner records the approved policy version/date before customer funds or high-risk work begin.

Evidence Required

  • Reviewer or firm name
  • Review date
  • Approved service agreement and privacy policy version
  • Approved prohibited/high-risk goods policy version
  • Approved warehouse, sourcing, and trademark/label authorization wording
  • List of unresolved issues is empty or explicitly owner-accepted

Safe Copy Values

  • Customer-facing legal drafts: outputs/prepport-legal-policy-drafts.md
  • Payment/legal setup handoff: https://prepportglobal.com/payment-legal-setup.html
  • Invoice package command: npm run invoice:package -- --invoice-id=INVOICE_ID
  • Business readiness command: npm run business:readiness -- --write
  • Payment gate dry-run command: npm run payment:gates-dry-run -- --write
  • Payment credential dry-run: node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=payment --dry-run
  • Payment activation dry-run: node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=payment --write-report
  • Send rule: Invoice package sendAllowed must remain false until payment instructions and invoice are approved.

Fields To Collect

  • LEGAL_REVIEW_COMPLETED_AT | secret=false | configured=undefined | Date legal review was approved.
  • LEGAL_REVIEW_OWNER | secret=false | configured=undefined | Internal owner who accepted reviewed policy set.
  • LEGAL_POLICY_VERSION | secret=false | configured=undefined | Version or path for the approved customer-facing policy set.
  • PAYMENT_PROVIDER | secret=false | configured=undefined | Provider selected for customer deposits/invoices.
  • SETTLEMENT_CURRENCY | secret=false | configured=undefined | Currency for quote/deposit/invoice workflow.
  • PAYMENT_REVIEW_OWNER | secret=false | configured=undefined | Owner who verifies settlement before paid status, wallet credit, purchase, release, or shipment.
  • REFUND_CHARGEBACK_OWNER | secret=false | configured=undefined | Owner for refund, chargeback, overpayment, underpayment, and dispute decisions.
  • PAYPAL_CLIENT_ID | secret=false | configured=undefined | Optional PayPal API client ID when PayPal Business is selected.
  • PAYPAL_CLIENT_SECRET | secret=true | configured=undefined | Optional PayPal API secret.
  • WISE_API_TOKEN | secret=true | configured=undefined | Optional Wise API token if Wise automation is later enabled.
  • AIRWALLEX_API_KEY | secret=true | configured=undefined | Optional Airwallex API key if Airwallex automation is later enabled.
  • STRIPE_SECRET_KEY | secret=true | configured=undefined | Optional Stripe secret key for later hosted checkout/webhook automation.
  • approvedPaymentInstructions | secret=true | configured=undefined | Human-approved exact wording for invoice/deposit instructions.
  • legalReviewer | secret=false | configured=undefined | Reviewer/firm responsible for service agreement, privacy, liability, prohibited goods, sourcing liability, and trademark authorization.

Record Evidence Command

npm run launch:evidence -- --record --blocker=legal_policy_review --title="legal_policy_review evidence" --summary="Owner completed the external step; no secrets included." --validation-status=needs_review

Record Evidence JSON Template

{
  "blockerId": "legal_policy_review",
  "evidenceType": "legal_policy_review_owner_evidence",
  "title": "Legal policies reviewed for storage, sourcing, prep, shipping, and high-risk goods completed",
  "evidenceSummary": "Replace this with a sanitized summary of what was completed, where it was confirmed, and what validation still needs to run. Do not include secrets, OAuth codes, raw payment instructions, payment account numbers, private legal advice, or customer documents.",
  "evidenceUrls": [],
  "recordedBy": "Xing Chang",
  "effectiveDate": "",
  "validationStatus": "needs_review",
  "validationCommandsRun": [],
  "safeFieldsRecorded": {
    "LEGAL_REVIEW_COMPLETED_AT": {
      "value": "",
      "purpose": "Date legal review was approved.",
      "source": "owner/platform decision"
    },
    "LEGAL_REVIEW_OWNER": {
      "value": "",
      "purpose": "Internal owner who accepted reviewed policy set.",
      "source": "owner/platform decision"
    },
    "LEGAL_POLICY_VERSION": {
      "value": "",
      "purpose": "Version or path for the approved customer-facing policy set.",
      "source": "owner/platform decision"
    },
    "PAYMENT_PROVIDER": {
      "value": "",
      "purpose": "Provider selected for customer deposits/invoices.",
      "source": "owner/platform decision"
    },
    "SETTLEMENT_CURRENCY": {
      "value": "",
      "purpose": "Currency for quote/deposit/invoice workflow.",
      "source": "owner/platform decision"
    },
    "PAYMENT_REVIEW_OWNER": {
      "value": "",
      "purpose": "Owner who verifies settlement before paid status, wallet credit, purchase, release, or shipment.",
      "source": "owner/platform decision"
    },
    "REFUND_CHARGEBACK_OWNER": {
      "value": "",
      "purpose": "Owner for refund, chargeback, overpayment, underpayment, and dispute decisions.",
      "source": "owner/platform decision"
    },
    "PAYPAL_CLIENT_ID": {
      "value": "",
      "purpose": "Optional PayPal API client ID when PayPal Business is selected.",
      "source": "owner/platform decision"
    },
    "legalReviewer": {
      "value": "",
      "purpose": "Reviewer/firm responsible for service agreement, privacy, liability, prohibited goods, sourcing liability, and trademark authorization.",
      "source": "owner/platform decision"
    }
  },
  "safeCopyValuesUsedForSetup": [
    {
      "label": "Customer-facing legal drafts",
      "value": "outputs/prepport-legal-policy-drafts.md"
    },
    {
      "label": "Payment/legal setup handoff",
      "value": "https://prepportglobal.com/payment-legal-setup.html"
    },
    {
      "label": "Invoice package command",
      "value": "npm run invoice:package -- --invoice-id=INVOICE_ID"
    },
    {
      "label": "Business readiness command",
      "value": "npm run business:readiness -- --write"
    },
    {
      "label": "Payment gate dry-run command",
      "value": "npm run payment:gates-dry-run -- --write"
    },
    {
      "label": "Payment credential dry-run",
      "value": "node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=payment --dry-run"
    },
    {
      "label": "Payment activation dry-run",
      "value": "node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=payment --write-report"
    },
    {
      "label": "Send rule",
      "value": "Invoice package sendAllowed must remain false until payment instructions and invoice are approved."
    }
  ],
  "secretFieldsHandledOutsideRecord": [
    "PAYPAL_CLIENT_SECRET",
    "WISE_API_TOKEN",
    "AIRWALLEX_API_KEY",
    "STRIPE_SECRET_KEY",
    "approvedPaymentInstructions"
  ],
  "notes": "Store secrets only through the secure local/deployment credential flow. This evidence record is a sanitized launch audit note, not the secret store and not legal/payment approval by itself.",
  "suggestedValidationCommands": [
    "npm run business:readiness -- --write",
    "npm run launch:checklist -- --write",
    "npm run launch:blockers -- --write",
    "cd ../.. && node scripts/check-production-readiness.mjs",
    "node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=payment --dry-run",
    "node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=payment --write-report",
    "npm run payment:provider-workbench -- --write",
    "npm run payment:gates-dry-run -- --write",
    "npm run commercial:launch-workbench -- --write",
    "npm run legal-payment:review-packet -- --write",
    "npm run first-customer:dry-run -- --write",
    "npm run customer:portal-usability -- --write"
  ]
}

Validation Commands

  • npm run business:readiness -- --write
  • npm run launch:checklist -- --write
  • npm run launch:blockers -- --write
  • cd ../.. && node scripts/check-production-readiness.mjs
  • node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=payment --dry-run
  • node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=payment --write-report
  • npm run payment:provider-workbench -- --write
  • npm run payment:gates-dry-run -- --write
  • npm run commercial:launch-workbench -- --write
  • npm run legal-payment:review-packet -- --write
  • npm run first-customer:dry-run -- --write
  • npm run customer:portal-usability -- --write
  • npm run launch:closure -- --write

Cannot Be Automated

  • Legal approval cannot be self-certified by the software.
  • Exact liability, refund, prohibited goods, trademark, label authorization, and payment wording remain owner/legal approved.
  • Login, password, 2FA, payment, final legal approval, provider KYC, and platform terms approval remain human/platform-only.

3. Shopify Partner app credentials and webhook secret configured

high blocked_external evidence: missing
shopify_partner_app_credentials

Unlocks the ShipBob/NextSmartShip-style store connection path: live Shopify OAuth, paid/unfulfilled order import, customer-visible status, and tracking sync.

Exact Next Steps

  • Create or finish the Shopify Partner app using the App URL, OAuth callback URL, webhook URL, scopes, and API version from the external setup pack.
  • Store SHOPIFY_CLIENT_ID, SHOPIFY_CLIENT_SECRET, and SHOPIFY_WEBHOOK_SECRET locally through the production credential workflow, without pasting secrets into chat.
  • Restart the production backend, then run readiness and integration tests before inviting a real merchant store.
  • Validate that customers can see Shopify connection status, manual/CSV fallback, Customer API, webhooks, Action center, inventory, fulfillment, exception, and payment-evidence status in the portal.
  • Shopify Partner app credentials and webhook secret are stored locally, a test customer store can complete OAuth, order webhooks verify HMAC, and tracking sync is validated.

Evidence Required

  • Shopify app name/id and owner account recorded
  • Allowed redirection URL accepted in Shopify
  • Admin API scopes match the approved PrepPort scope list
  • Webhook secret configured server-side
  • Readiness dry-run report passes
  • OAuth install tested with an approved test store
  • ORDERS_CREATE and ORDERS_UPDATED webhook registration or equivalent app-managed webhook path verified
  • Fulfillment tracking sync preview/execution tested on a safe test order

Safe Copy Values

  • App URL: https://api.prepportglobal.com
  • Allowed redirection URL: https://api.prepportglobal.com/api/shopify/oauth/callback
  • Order webhook URL: https://api.prepportglobal.com/webhooks/shopify/orders
  • App-managed webhook topics: ORDERS_CREATE,ORDERS_UPDATED
  • Fulfillment tracking sync route: https://api.prepportglobal.com/api/fulfillment-orders/:id/shopify-sync
  • Customer portal Shopify tab: https://prepportglobal.com/customer-portal
  • Benchmark commitment: ShipBob-style visibility and integrations plus NextSmartShip-style supplier-side/global fulfillment, low-friction onboarding, quote clarity, and Shopify/API convenience
  • Target task lock: Keep Shopify/API plus customer portal tracking as the main post-launch product focus: store connection, order import, inventory reservation, exception status, tracking sync, and CSV/manual fallback must be easy for overseas sellers.
  • Recommended Admin API scopes: read_orders,read_products,read_inventory,write_fulfillments,write_assigned_fulfillment_orders,write_merchant_managed_fulfillment_orders,read_locations
  • API version: 2026-01
  • Credential activation dry-run: node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=shopify --write-report

Fields To Collect

  • SHOPIFY_CLIENT_ID | secret=false | configured=false | Build OAuth install URLs for customer stores.
  • SHOPIFY_CLIENT_SECRET | secret=true | configured=false | Verify OAuth callback and exchange authorization code server-side.
  • SHOPIFY_WEBHOOK_SECRET | secret=true | configured=false | Verify signed Shopify order webhooks.
  • SHOPIFY_APP_URL | secret=false | configured=true | Public app/API base URL used for OAuth and webhook setup.
  • SHOPIFY_SCOPES | secret=false | configured=true | Approved Admin API scope list.
  • SHOPIFY_API_VERSION | secret=false | configured=true | Pinned Shopify Admin API version.

Record Evidence Command

npm run launch:evidence -- --record --blocker=shopify_partner_app_credentials --title="shopify_partner_app_credentials evidence" --summary="Owner completed the external step; no secrets included." --validation-status=needs_review

Record Evidence JSON Template

{
  "blockerId": "shopify_partner_app_credentials",
  "evidenceType": "shopify_partner_app_credentials_owner_evidence",
  "title": "Shopify Partner app credentials and webhook secret configured completed",
  "evidenceSummary": "Replace this with a sanitized summary of what was completed, where it was confirmed, and what validation still needs to run. Do not include secrets, OAuth codes, raw payment instructions, payment account numbers, private legal advice, or customer documents.",
  "evidenceUrls": [],
  "recordedBy": "Xing Chang",
  "effectiveDate": "",
  "validationStatus": "needs_review",
  "validationCommandsRun": [],
  "safeFieldsRecorded": {
    "SHOPIFY_CLIENT_ID": {
      "value": "",
      "purpose": "Build OAuth install URLs for customer stores.",
      "source": "owner/platform decision"
    },
    "SHOPIFY_APP_URL": {
      "value": "",
      "purpose": "Public app/API base URL used for OAuth and webhook setup.",
      "source": "owner/platform decision"
    },
    "SHOPIFY_SCOPES": {
      "value": "",
      "purpose": "Approved Admin API scope list.",
      "source": "owner/platform decision"
    },
    "SHOPIFY_API_VERSION": {
      "value": "",
      "purpose": "Pinned Shopify Admin API version.",
      "source": "owner/platform decision"
    }
  },
  "safeCopyValuesUsedForSetup": [
    {
      "label": "App URL",
      "value": "https://api.prepportglobal.com"
    },
    {
      "label": "Allowed redirection URL",
      "value": "https://api.prepportglobal.com/api/shopify/oauth/callback"
    },
    {
      "label": "Order webhook URL",
      "value": "https://api.prepportglobal.com/webhooks/shopify/orders"
    },
    {
      "label": "App-managed webhook topics",
      "value": "ORDERS_CREATE,ORDERS_UPDATED"
    },
    {
      "label": "Fulfillment tracking sync route",
      "value": "https://api.prepportglobal.com/api/fulfillment-orders/:id/shopify-sync"
    },
    {
      "label": "Customer portal Shopify tab",
      "value": "https://prepportglobal.com/customer-portal"
    },
    {
      "label": "Benchmark commitment",
      "value": "ShipBob-style visibility and integrations plus NextSmartShip-style supplier-side/global fulfillment, low-friction onboarding, quote clarity, and Shopify/API convenience"
    },
    {
      "label": "Target task lock",
      "value": "Keep Shopify/API plus customer portal tracking as the main post-launch product focus: store connection, order import, inventory reservation, exception status, tracking sync, and CSV/manual fallback must be easy for overseas sellers."
    },
    {
      "label": "Recommended Admin API scopes",
      "value": "read_orders,read_products,read_inventory,write_fulfillments,write_assigned_fulfillment_orders,write_merchant_managed_fulfillment_orders,read_locations"
    },
    {
      "label": "API version",
      "value": "2026-01"
    },
    {
      "label": "Credential activation dry-run",
      "value": "node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=shopify --write-report"
    }
  ],
  "secretFieldsHandledOutsideRecord": [
    "SHOPIFY_CLIENT_SECRET",
    "SHOPIFY_WEBHOOK_SECRET"
  ],
  "notes": "Store secrets only through the secure local/deployment credential flow. This evidence record is a sanitized launch audit note, not the secret store and not legal/payment approval by itself.",
  "suggestedValidationCommands": [
    "npm run shopify:production-readiness -- --write",
    "npm run shopify:readiness-dry-run -- --write",
    "node --test test/shopify-integration.test.mjs test/shopify-production-readiness.test.mjs",
    "npm run launch:checklist -- --write",
    "npm run launch:blockers -- --write",
    "cd ../.. && node scripts/check-production-readiness.mjs",
    "cd ../.. && node scripts/remote-customer-platform-smoke.mjs --base-url=https://api.prepportglobal.com --site-url=https://prepportglobal.com",
    "node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=shopify --dry-run",
    "node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=shopify --write-report",
    "node scripts/check-production-readiness.mjs",
    "npm run shopify:production-readiness -- --write && npm run shopify:readiness-dry-run -- --write && node --test test/shopify-integration.test.mjs test/shopify-production-readiness.test.mjs && node scripts/check-production-readiness.mjs"
  ]
}

Validation Commands

  • npm run shopify:production-readiness -- --write
  • npm run shopify:readiness-dry-run -- --write
  • node --test test/shopify-integration.test.mjs test/shopify-production-readiness.test.mjs
  • npm run launch:checklist -- --write
  • npm run launch:blockers -- --write
  • cd ../.. && node scripts/check-production-readiness.mjs
  • cd ../.. && node scripts/remote-customer-platform-smoke.mjs --base-url=https://api.prepportglobal.com --site-url=https://prepportglobal.com
  • node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=shopify --dry-run
  • node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=shopify --write-report
  • node scripts/check-production-readiness.mjs
  • npm run shopify:production-readiness -- --write && npm run shopify:readiness-dry-run -- --write && node --test test/shopify-integration.test.mjs test/shopify-production-readiness.test.mjs && node scripts/check-production-readiness.mjs

Cannot Be Automated

  • A real merchant must approve OAuth scopes.
  • Shopify secrets and store tokens must stay server-side and must not be printed in reports.
  • Login, password, 2FA, payment, final legal approval, provider KYC, and platform terms approval remain human/platform-only.

4. Search Console and Analytics connected

medium blocked_external evidence: missing
analytics_search_console

Unlocks customer acquisition measurement through Search Console, sitemap submission, GA4 web stream, and privacy-safe conversion reporting.

Exact Next Steps

  • Create Search Console property for prepportglobal.com and complete domain or URL-prefix verification.
  • Create GA4 property and record the Measurement ID in deployment/site config.
  • Submit https://prepportglobal.com/sitemap.xml and verify robots.txt is reachable.
  • Confirm analytics receives only privacy-safe conversion/event metadata, not customer messages, payment data, tokens, or product documents.
  • Search Console and GA4 properties exist for prepportglobal.com, the sitemap is submitted, a measurement ID is deployed, and privacy-safe event collection is verified.

Evidence Required

  • Search Console property owner account
  • Verification method and date
  • Sitemap submission status
  • GA4 property name and Measurement ID
  • First-party website event summary after deployment
  • Privacy check confirming no customer PII/raw message text/payment data is sent

Safe Copy Values

  • Domain property: prepportglobal.com
  • Sitemap URL: https://prepportglobal.com/sitemap.xml
  • Robots URL: https://prepportglobal.com/robots.txt
  • Canonical live site: https://prepportglobal.com
  • WWW site: https://www.prepportglobal.com
  • Analytics setup handoff: https://prepportglobal.com/analytics-setup.html
  • First-party website event endpoint: https://api.prepportglobal.com/api/public/website-event
  • Website event summary command: npm run website:events -- --write
  • Analytics readiness dry-run command: npm run analytics:readiness-dry-run -- --write
  • Analytics credential dry-run: node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=analytics --dry-run
  • Analytics activation dry-run: node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=analytics --write-report
  • Search Console DNS dry-run: SEARCH_CONSOLE_VERIFICATION_TXT=<Google TXT value> node scripts/configure-google-search-console-dns.mjs --json
  • Search Console DNS apply after owner approval: SEARCH_CONSOLE_VERIFICATION_TXT=<Google TXT value> node scripts/configure-google-search-console-dns.mjs --apply
  • Search Console DNS verify: SEARCH_CONSOLE_VERIFICATION_TXT=<Google TXT value> node scripts/configure-google-search-console-dns.mjs --verify

Fields To Collect

  • GA4_MEASUREMENT_ID | secret=false | configured=undefined | Public Measurement ID used by the website.
  • SEARCH_CONSOLE_OWNER | secret=false | configured=undefined | Account responsible for Search Console property.
  • SEARCH_CONSOLE_VERIFICATION | secret=false | configured=undefined | DNS or URL-prefix verification note; avoid private account notes.
  • SEARCH_CONSOLE_VERIFICATION_TXT | secret=false | configured=undefined | Google verification record if domain verification is required.

Record Evidence Command

npm run launch:evidence -- --record --blocker=analytics_search_console --title="analytics_search_console evidence" --summary="Owner completed the external step; no secrets included." --validation-status=needs_review

Record Evidence JSON Template

{
  "blockerId": "analytics_search_console",
  "evidenceType": "analytics_search_console_owner_evidence",
  "title": "Search Console and Analytics connected completed",
  "evidenceSummary": "Replace this with a sanitized summary of what was completed, where it was confirmed, and what validation still needs to run. Do not include secrets, OAuth codes, raw payment instructions, payment account numbers, private legal advice, or customer documents.",
  "evidenceUrls": [],
  "recordedBy": "Xing Chang",
  "effectiveDate": "",
  "validationStatus": "needs_review",
  "validationCommandsRun": [],
  "safeFieldsRecorded": {
    "GA4_MEASUREMENT_ID": {
      "value": "",
      "purpose": "Public Measurement ID used by the website.",
      "source": "owner/platform decision"
    },
    "SEARCH_CONSOLE_OWNER": {
      "value": "",
      "purpose": "Account responsible for Search Console property.",
      "source": "owner/platform decision"
    },
    "SEARCH_CONSOLE_VERIFICATION": {
      "value": "",
      "purpose": "DNS or URL-prefix verification note; avoid private account notes.",
      "source": "owner/platform decision"
    },
    "SEARCH_CONSOLE_VERIFICATION_TXT": {
      "value": "",
      "purpose": "Google verification record if domain verification is required.",
      "source": "owner/platform decision"
    }
  },
  "safeCopyValuesUsedForSetup": [
    {
      "label": "Domain property",
      "value": "prepportglobal.com"
    },
    {
      "label": "Sitemap URL",
      "value": "https://prepportglobal.com/sitemap.xml"
    },
    {
      "label": "Robots URL",
      "value": "https://prepportglobal.com/robots.txt"
    },
    {
      "label": "Canonical live site",
      "value": "https://prepportglobal.com"
    },
    {
      "label": "WWW site",
      "value": "https://www.prepportglobal.com"
    },
    {
      "label": "Analytics setup handoff",
      "value": "https://prepportglobal.com/analytics-setup.html"
    },
    {
      "label": "First-party website event endpoint",
      "value": "https://api.prepportglobal.com/api/public/website-event"
    },
    {
      "label": "Website event summary command",
      "value": "npm run website:events -- --write"
    },
    {
      "label": "Analytics readiness dry-run command",
      "value": "npm run analytics:readiness-dry-run -- --write"
    },
    {
      "label": "Analytics credential dry-run",
      "value": "node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=analytics --dry-run"
    },
    {
      "label": "Analytics activation dry-run",
      "value": "node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=analytics --write-report"
    },
    {
      "label": "Search Console DNS dry-run",
      "value": "SEARCH_CONSOLE_VERIFICATION_TXT=<Google TXT value> node scripts/configure-google-search-console-dns.mjs --json"
    }
  ],
  "secretFieldsHandledOutsideRecord": [],
  "notes": "Store secrets only through the secure local/deployment credential flow. This evidence record is a sanitized launch audit note, not the secret store and not legal/payment approval by itself.",
  "suggestedValidationCommands": [
    "npm run analytics:readiness-dry-run -- --write",
    "npm run website:events -- --write",
    "npm run launch:checklist -- --write",
    "npm run launch:blockers -- --write",
    "cd ../.. && node scripts/check-production-readiness.mjs",
    "node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=analytics --dry-run",
    "node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=analytics --write-report",
    "npm run analytics:search-setup-pack -- --write"
  ]
}

Validation Commands

  • npm run analytics:readiness-dry-run -- --write
  • npm run website:events -- --write
  • npm run launch:checklist -- --write
  • npm run launch:blockers -- --write
  • cd ../.. && node scripts/check-production-readiness.mjs
  • node scripts/configure-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --require=analytics --dry-run
  • node scripts/activate-production-credentials.mjs --from-file=/tmp/prepport-production-credentials.env --groups=analytics --write-report
  • npm run analytics:search-setup-pack -- --write

Cannot Be Automated

  • Google property ownership and domain verification require external account action.
  • Login, password, 2FA, payment, final legal approval, provider KYC, and platform terms approval remain human/platform-only.

Post Owner Completion Commands

Safety Notes