npm - @forgecart/cli - Versions diffs - 2.202608300703.0 → 2.202609190800.0 - Mend

@forgecart/cli 2.202608300703.0 → 2.202609190800.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (76) hide show

package/dist/src/commands/init.d.ts CHANGED Viewed

@@ -1,6 +1,14 @@
 import { Command } from 'commander';
-/** Default shop API base. Overridable via `--api-url`. */
-export declare const DEFAULT_SHOP_API_URL = "https://api.forgecart.com";
+/**
+ * Default shop API base, INCLUDING the mounted path. The API serves the shop
+ * GraphQL endpoint at `/shop-api` (`app/forgecart/src/main.ts`), and the SDK
+ * takes this value verbatim as its endpoint — it swaps the scheme for the
+ * websocket and appends nothing to the path — so a pathless origin scaffolds a
+ * storefront whose every read dials a socket nothing answers (#2102): the
+ * operation rides graphql-ws's whole retry ladder and the page hangs with
+ * nothing logged. Overridable via `--api-url`.
+ */
+export declare const DEFAULT_SHOP_API_URL = "https://api.forgecart.com/shop-api";
 /**
  * Environment variable naming a dependency-warmed storefront template — a copy
  * of the bundled template with `node_modules` (and the generated
@@ -40,6 +48,17 @@ export interface InitOptions {
      * sides (deployed storefronts, loopback dev).
      */
     browserApiUrl?: string;
+    /**
+     * The storefront's PUBLIC origin (`https://shop.example.com`) — the address
+     * shoppers and crawlers reach it at.
+     *
+     * Supplied for a published storefront and deliberately OMITTED for preview
+     * pods, whose hostnames are ephemeral. The template treats absence as "this
+     * deployment has no stable address to be canonical about" and serves every
+     * route noindex with `Disallow: /` (`lib/seo/public-origin.ts`), so omitting
+     * it is the safe state rather than an incomplete one.
+     */
+    publicOrigin?: string;
     /** Whether to also scaffold a NestJS application (planned for a later phase). */
     application?: boolean;
     /**

package/dist/src/commands/init.js CHANGED Viewed

@@ -5,8 +5,16 @@ import { Command } from 'commander';
 import { print } from '../output.js';
 import { readPackageVersion } from '../version.js';
 import { writeTemplateManifest } from './template-manifest.js';
-/** Default shop API base. Overridable via `--api-url`. */
-export const DEFAULT_SHOP_API_URL = 'https://api.forgecart.com';
+/**
+ * Default shop API base, INCLUDING the mounted path. The API serves the shop
+ * GraphQL endpoint at `/shop-api` (`app/forgecart/src/main.ts`), and the SDK
+ * takes this value verbatim as its endpoint — it swaps the scheme for the
+ * websocket and appends nothing to the path — so a pathless origin scaffolds a
+ * storefront whose every read dials a socket nothing answers (#2102): the
+ * operation rides graphql-ws's whole retry ladder and the page hangs with
+ * nothing logged. Overridable via `--api-url`.
+ */
+export const DEFAULT_SHOP_API_URL = 'https://api.forgecart.com/shop-api';
 /**
  * Environment variable naming a dependency-warmed storefront template — a copy
  * of the bundled template with `node_modules` (and the generated
@@ -145,6 +153,13 @@ function buildPlatformEnv(channelToken, options) {
     if (secret) {
         entries.set('FORGECART_ADMIN_SECRET', secret);
     }
+    // Conditional for the same #1123 reason as the two above, and with a sharper
+    // consequence: a preview drive omits it, and stripping an origin an earlier
+    // drive wrote would silently de-index a live storefront.
+    const publicOrigin = options.publicOrigin?.trim();
+    if (publicOrigin) {
+        entries.set('FORGECART_PUBLIC_ORIGIN', publicOrigin);
+    }
     return entries;
 }
 /**
@@ -304,6 +319,7 @@ export function createInitCommand() {
         .option('--admin-secret <secret>', 'Channel admin secret for server-side admin operations (written to .env only)')
         .option('--api-url <url>', 'Shop API base URL written to the storefront environment', DEFAULT_SHOP_API_URL)
         .option('--browser-api-url <url>', 'Shop API URL for the shopper browser when it differs from --api-url (split-horizon pods; must be HTTPS so the session socket can use WSS)')
+        .option('--public-origin <url>', 'Public origin the storefront is served at (https://shop.example.com). Omit for preview deployments: without it every route is noindex and robots.txt disallows the whole tree')
         .option('-a, --application', 'Also scaffold a NestJS application (TODO: next phase)')
         .option('--config-only', 'Write only per-channel config into an existing pre-warmed storefront (skip the template copy)')
         .action(async (name, options) => {

package/dist/src/commands/init.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D~~,0DAA0D~~;~~AAC1D~~,MAAM,CAAC,MAAM,oBAAoB,GAAG,~~2BAA2B~~,CAAC;~~AAEhE~~;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;~~AAmEnE~~;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AACpE,CAAC;AAED,kDAAkD;AAClD,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CAAC,YAAoB;IACxD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,kBAA0B;IAC3D,MAAM,OAAO,GAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAErF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC;IAC/B,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAEpD,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAE/D,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAClD,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,CACzC,CAAC;IACF,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;QAC9E,OAAO;YACL,MAAM,EAAE,6BAA6B;YACrC,WAAW,EAAE,kBAAkB;YAC/B,oBAAoB;SACrB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,IAAkB;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,IAAI,CAAC,WAAW;QAC5B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;IACF,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,kDAAkD;AAClD,SAAS,WAAW,CAAC,YAAoB,EAAE,OAAoB;IAC7D,OAAO;QACL,OAAO,EAAE,KAAK;QACd,YAAY;QACZ,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;QAC5C,cAAc,EAAE,GAAG;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,YAAoB,EAAE,OAAoB;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,aAAa,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAAC,QAAgB,EAAE,YAAoB,EAAE,OAAoB;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC;IACf,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,QAA6B,EAC7B,SAAsB;IAEtB,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,YAAoB,EACpB,OAAoB;IAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC9B,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAClE,MAAM,CACP,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,0CAA0C;AAC1C,SAAS,cAAc,CAAC,SAAiB,EAAE,WAAoB,EAAE,aAAsB;IACrF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CACH,aAAa;QACX,CAAC,CAAC,2FAA2F;QAC7F,CAAC,CAAC,qCAAqC,CAC1C,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,aAAa,CAAC,CAAC;IACrB,KAAK,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,KAAK,CAAC,eAAe,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CACH,2EAA2E;YACzE,0BAA0B,CAC7B,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,SAAiB;IACxC,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,kFAAkF,CAAC,CAAC;IAC1F,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,aAAa,CAAC,CAAC;IACrB,KAAK,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC3B,KAAK,CAAC,eAAe,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAwB,EAAE,OAAoB;IAC1E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtE,gFAAgF;IAChF,0EAA0E;IAC1E,+EAA+E;IAC/E,kFAAkF;IAClF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,oDAAoD,SAAS,2BAA2B,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,kBAAkB,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3D,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAW,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,6BAA6B,EAAE,CAAC;QAClD,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE;YACnE,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5C,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAE/E,cAAc,CAAC,IAAI,IAAI,GAAG,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,WAAW,CAAC,yDAAyD,CAAC;SACtE,QAAQ,CAAC,QAAQ,EAAE,2DAA2D,CAAC;SAC/E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;SACnE,MAAM,CACL,yBAAyB,EACzB,8EAA8E,CAC/E;SACA,MAAM,CACL,iBAAiB,EACjB,yDAAyD,EACzD,oBAAoB,CACrB;SACA,MAAM,CACL,yBAAyB,EACzB,2IAA2I,CAC5I;SACA,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;SACpF,MAAM,CACL,eAAe,EACf,+FAA+F,CAChG;SACA,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,OAAoB,EAAE,EAAE;QAC/D,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC"}
1	+ {"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AA8EnE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AACpE,CAAC;AAED,kDAAkD;AAClD,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CAAC,YAAoB;IACxD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,kBAA0B;IAC3D,MAAM,OAAO,GAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAErF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC;IAC/B,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAEpD,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAE/D,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAClD,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,CACzC,CAAC;IACF,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;QAC9E,OAAO;YACL,MAAM,EAAE,6BAA6B;YACrC,WAAW,EAAE,kBAAkB;YAC/B,oBAAoB;SACrB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,IAAkB;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,IAAI,CAAC,WAAW;QAC5B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;IACF,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,kDAAkD;AAClD,SAAS,WAAW,CAAC,YAAoB,EAAE,OAAoB;IAC7D,OAAO;QACL,OAAO,EAAE,KAAK;QACd,YAAY;QACZ,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;QAC5C,cAAc,EAAE,GAAG;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,YAAoB,EAAE,OAAoB;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,aAAa,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAAC,QAAgB,EAAE,YAAoB,EAAE,OAAoB;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC;IACf,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,QAA6B,EAC7B,SAAsB;IAEtB,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,YAAoB,EACpB,OAAoB;IAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAC9B,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAClE,MAAM,CACP,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,0CAA0C;AAC1C,SAAS,cAAc,CAAC,SAAiB,EAAE,WAAoB,EAAE,aAAsB;IACrF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CACH,aAAa;QACX,CAAC,CAAC,2FAA2F;QAC7F,CAAC,CAAC,qCAAqC,CAC1C,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,aAAa,CAAC,CAAC;IACrB,KAAK,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,KAAK,CAAC,eAAe,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CACH,2EAA2E;YACzE,0BAA0B,CAC7B,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,SAAiB;IACxC,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,kFAAkF,CAAC,CAAC;IAC1F,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,aAAa,CAAC,CAAC;IACrB,KAAK,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC3B,KAAK,CAAC,eAAe,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAwB,EAAE,OAAoB;IAC1E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtE,gFAAgF;IAChF,0EAA0E;IAC1E,+EAA+E;IAC/E,kFAAkF;IAClF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,oDAAoD,SAAS,2BAA2B,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,kBAAkB,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3D,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAW,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,6BAA6B,EAAE,CAAC;QAClD,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE;YACnE,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5C,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAE/E,cAAc,CAAC,IAAI,IAAI,GAAG,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,WAAW,CAAC,yDAAyD,CAAC;SACtE,QAAQ,CAAC,QAAQ,EAAE,2DAA2D,CAAC;SAC/E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;SACnE,MAAM,CACL,yBAAyB,EACzB,8EAA8E,CAC/E;SACA,MAAM,CACL,iBAAiB,EACjB,yDAAyD,EACzD,oBAAoB,CACrB;SACA,MAAM,CACL,yBAAyB,EACzB,2IAA2I,CAC5I;SACA,MAAM,CACL,uBAAuB,EACvB,+KAA+K,CAChL;SACA,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;SACpF,MAAM,CACL,eAAe,EACf,+FAA+F,CAChG;SACA,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,OAAoB,EAAE,EAAE;QAC/D,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@forgecart/cli",
-  "version": "2.202608300703.0",
+  "version": "2.202609190800.0",
   "type": "module",
   "description": "CLI for scaffolding and operating ForgeCart channel storefronts",
   "bin": {

package/templates/storefront/README.md CHANGED Viewed

@@ -125,10 +125,40 @@ backstops.
 ## Sessions
 The anonymous session is minted by the API on the first cart mutation and
-persisted into the httpOnly `forgecart-session` cookie by the action runner.
-The `/__fc/track` analytics relay may **establish** that identity for pure
-browsers but never replaces an existing cookie, and the tracker defers its
-first flush so a fast add-to-cart wins the first-touch race.
+persisted into the session cookie PAIR — the httpOnly `forgecart-session` plus
+its JS-readable `forgecart-session-client` mirror, whose one contract lives in
+[`src/lib/session-cookies.ts`](src/lib/session-cookies.ts) — by the action
+runner. The `/__fc/track` and `/__fc/identify` relays may **establish** that
+pair for pure browsers but never replace an existing cookie, and the tracker
+defers its first flush so a fast add-to-cart wins the first-touch race. The
+mirror is what the browser's shop socket boots its auth from: written without
+it, a relay-established session would never reach the client at all.
+## Account links
+Two routes exist because the PLATFORM links to them from the e-mails it sends
+a shopper, not because anything in this storefront navigates there:
+| Route                        | Mail                | What it does                                                 |
+| ---------------------------- | ------------------- | ------------------------------------------------------------ |
+| `/verify?token=…`            | e-mail verification | consumes the token on RENDER and reports the outcome          |
+| `/reset-password?token=…`    | password reset      | renders the new-password form; the SUBMIT consumes the token  |
+| `/reset-password` (no token) | —                   | asks for an address and has a new link sent                   |
+**Do not rename or prefix them.** The path and the `?token=` parameter are the
+contract with the mail templates, and a link already sitting in a shopper's
+inbox cannot be re-issued. They are in the once-per-store set
+([`src/lib/locale/grammar.ts`](src/lib/locale/grammar.ts)), so they never carry
+a locale prefix, and in `NOINDEX_PATHS`
+([`src/lib/seo/noindex.ts`](src/lib/seo/noindex.ts)), so they are `noindex`,
+absent from the XML sitemap and `Disallow`ed in `robots.txt` — a crawler that
+fetched one would spend a real shopper's one-shot token.
+The COPY is yours to rewrite. The states behind it are not invented per page:
+[`src/lib/account/`](src/lib/account/) maps the shop API's `ErrorCode`s onto a
+small state set (verified / link-invalid / wrong-store / …) that both pages
+render, and each surface stamps `data-fc-account-mode` + `data-fc-account-state`
+onto the element it renders, so the state is readable from the served HTML.
 ## Project layout
@@ -142,6 +172,8 @@ src/
     cart-actions.ts      # cart Server Actions (incl. coupons)
     checkout-actions.ts  # checkout Server Actions
     cart-context.tsx     # client cart state + typed error channel
+    account-actions.ts   # password-reset Server Actions
+    account/             # pure account-link rules (token, states, ErrorCode map)
   components/
     Header.tsx           # top nav with live cart count
     ProductCard.tsx      # product tile
@@ -152,6 +184,10 @@ src/
       AddressStep.tsx      # autocomplete + countries + phone
       RatesStep.tsx        # grouped radio-card rate selection
       PaymentFormEmbed.tsx # origin-checked hosted-form host
+    account/
+      AccountMessage.tsx           # the one outcome block both account pages use
+      ResetPasswordForm.tsx        # set a new password from a reset token
+      RequestPasswordResetForm.tsx # ask for a reset link
   app/
     layout.tsx           # html shell + header/footer + CartProvider
     error.tsx            # route render backstop
@@ -160,6 +196,8 @@ src/
     products/            # grid + [slug] detail
     cart/page.tsx        # cart
     checkout/page.tsx    # the stepped checkout
+    verify/page.tsx          # e-mail verification link target
+    reset-password/page.tsx  # password-reset link target + request form
 ```
 ## Development

package/templates/storefront/next.config.js CHANGED Viewed

@@ -37,13 +37,35 @@ const nextConfig = {
     'dashboard.test.forgecart.com', // test dashboard origin that embeds the editor
     'dashboard.forgecart.com', // prod dashboard origin that embeds the editor
   ],
-  // PROGRESSIVE PRE-RENDERING (Next 16: Cache Components). Every route builds
-  // a STATIC shell and streams its dynamic holes (product data, experiment
-  // branches, the shopper's cart) per request — uncached IO must sit inside a
-  // Suspense boundary, which is exactly how the pages are structured. `next
-  // dev` semantics are unchanged; the built/published storefront gets the
-  // prerendered shells.
-  cacheComponents: true,
+  // CACHE COMPONENTS: OFF, explicitly — and the explicitness is the point.
+  //
+  // The root layout reads the request locale (`x-forgecart-locale`) to set
+  // `<html lang>`, which is an attribute on the document root and therefore
+  // structurally outside every Suspense boundary. Under Cache Components that
+  // combination is not buildable: `headers()` returns a hanging promise, and a
+  // component aborted with no Suspense frame in its stack raises `blocking-route`
+  // → `StaticGenBailoutError`. The only escape Next offers is a `<Suspense>`
+  // ABOVE `<body>` — in its own words, "an explicit signal from the user that
+  // they acknowledge the empty shell".
+  //
+  // Taking that escape would cost the locale contract entirely. A real 308/404
+  // is assigned only when the render promise REJECTS (`renderToStream`'s catch);
+  // with a boundary above, React resolves as CLIENT_RENDERED instead, so
+  // `notFound()` / `permanentRedirect()` from the layout would emit a 200
+  // carrying a 404 page — a soft-404, indexed rather than dropped, which is the
+  // exact failure this storefront's locale routing exists to prevent.
+  //
+  // Nothing is given up by turning it off: the escape hatch yields an empty
+  // prelude on every route anyway (identical TTFB), and the template uses no
+  // `use cache`. The per-route Suspense boundaries below still stream their
+  // holes — that is core SSR, not a Cache Components feature.
+  //
+  // Written as an explicit `false` rather than omitted: `enforceExperimentalFeatures`
+  // re-enables an UNDEFINED value ("we do respect an explicit value in the user
+  // config"), so on a future 16.x under this package's caret range a deleted key
+  // would silently restore the failure above — in the merchant's scaffold, far
+  // from this repo's CI. An explicit false is immune.
+  cacheComponents: false,
   experimental: {
     // Persist Turbopack's dev compile artifacts to `.next` so a pod can serve
     // a PRE-WARMED `.next` baked at build time instead of paying a cold first

package/templates/storefront/src/app/%5F%5Ffc/identify/route.ts ADDED Viewed

@@ -0,0 +1,205 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+import {
+  forwardMarketingIdentifiers,
+  type MarketingIdentifierInput,
+} from '../../../lib/identify-forward';
+import { CLICK_ID_VALUE_MAX_LENGTH } from '../../../lib/marketing-params';
+import { SESSION_COOKIE, establishSessionCookies } from '../../../lib/session-cookies';
+import { getUpstreamConfig, isObviousBot } from '../../../lib/track-forward';
+/**
+ * Same-origin marketing-identity relay (#1596).
+ *
+ * A shopper arriving from an ad carries the platform's CLICK ID in the landing
+ * URL and nowhere else — no cookie, no header, and gone the moment they reach a
+ * second page. `lib/marketing-params.ts` reads it on the client, the landing
+ * page POSTs what it found here, and this handler forwards the batch to the
+ * ForgeCart shop API as one `setMarketingIdentifiers` mutation.
+ *
+ * The upstream hop itself (raw HTTP GraphQL with the channel token, the shopper
+ * session as Bearer, and every failure resolving to an empty outcome instead of
+ * a throw) lives in `src/lib/identify-forward.ts`. This route owns everything
+ * request-shaped: parsing untrusted JSON, per-identifier validation, the bot
+ * gate, session threading and cookie persistence.
+ *
+ * Sibling by construction: `../track/route.ts` relays EVENTS over the same
+ * transport, through the same gates, onto the same session cookie PAIR (both
+ * routes write it through `src/lib/session-cookies.ts`) — read the two
+ * together, and change them together. They stay separate routes because a
+ * click ID is not an event: it names the IDENTITY the events belong to, it is
+ * sent once per landing rather than once per batch, and the ad platforms read
+ * it back out of that identity months later when a conversion is reported.
+ *
+ * Inert guard: before `forgecart init` writes `.env` (the image-build prewarm)
+ * there is no shop to talk to, so every submitted key answers `rejected` with
+ * zero upstream calls and the server never crashes.
+ *
+ * Session capture: the shop API surfaces a freshly minted session in the
+ * response `extensions` exactly once. The relay may ESTABLISH the shopper
+ * identity — persisting that mint into BOTH homes of the session pair, the
+ * httpOnly `forgecart-session` cookie and its JS-readable mirror
+ * `forgecart-session-client` (`src/lib/session-cookies.ts`) — when the request
+ * arrived cookie-less, but it never REPLACES an existing cookie. The asymmetry
+ * is the sibling's, for the sibling's reason: an incoming cookie is either a
+ * live session owned by the cart path (clobbering it would vanish a
+ * just-created cart) or a stale one, whose replacement is the cart path's job.
+ *
+ * Writing both homes matters most HERE (#1733). On an ad landing this route
+ * runs before anything else — `ForgeTracker` awaits it before enqueuing the
+ * first page_view — so it is what establishes the session the click ID has just
+ * been attached to. Write the httpOnly half alone and the shopper's own socket
+ * boots unauthenticated, its first cart operation mints a RIVAL session, and
+ * the click ID stays on an identity the settled order never resolves to: the
+ * attribution this route exists to make possible, lost behind a 200. Presence
+ * is still read from the httpOnly copy alone — it is the authoritative one, and
+ * the mirror is client-writable.
+ *
+ * Folder name: `%5F%5Ffc` is URL-encoded `__fc` — the App Router treats
+ * `_`-prefixed folders as PRIVATE (excluded from routing), and the `%5F` escape
+ * is Next's documented way to serve a literal-underscore URL segment. A folder
+ * literally named `__fc` would silently 404.
+ */
+/**
+ * The largest identifier list this route will look at.
+ *
+ * A landing page sends at most one entry per click ID it recognises: three
+ * today (`lib/marketing-params.ts`), six registered backend-side. Sixteen is
+ * headroom for every registration that could plausibly be added without
+ * admitting a list no client of ours would ever send — past it the caller is
+ * not our page, and the request is refused whole rather than trimmed, because
+ * silently keeping a prefix of somebody else's batch is the worse answer.
+ */
+const MAX_IDENTIFIERS = 16;
+interface IdentifyResponseBody {
+  /** Identifier keys the backend recognised and stored. */
+  accepted: readonly string[];
+  /**
+   * Keys the backend does not know — a NORMAL outcome, never an error. The
+   * upstream partitions the submitted keys against its identifier registry,
+   * stores the ones it knows and reports the rest; nothing was rolled back and
+   * nothing may be retried. A key landing here means only that this storefront
+   * and the backend registry disagree about a spelling, which is a deployment
+   * fact worth being able to read.
+   */
+  rejected: readonly string[];
+}
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Every answer this route gives is the same pair of key lists. */
+function respond(accepted: readonly string[], rejected: readonly string[]): NextResponse {
+  const body: IdentifyResponseBody = { accepted, rejected };
+  return NextResponse.json(body);
+}
+/** Parse the request body into a bounded identifier array, or `null` when malformed. */
+async function parseIdentifiers(request: NextRequest): Promise<unknown[] | null> {
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return null;
+  }
+  if (!isPlainObject(body) || !Array.isArray(body.identifiers)) return null;
+  if (body.identifiers.length === 0 || body.identifiers.length > MAX_IDENTIFIERS) return null;
+  return body.identifiers;
+}
+/**
+ * Validate one raw entry into a `MarketingIdentifierInput`, or `null` when it
+ * is not a usable pair. The route rebuilds the pair from untrusted JSON rather
+ * than trusting anything the client typed, so only these two fields cross.
+ *
+ * Both strings share the click-ID bound. The key is looked up in a registry
+ * whose entries are short words, so its cap is a garbage fence rather than a
+ * limit anyone can reach honestly — and a second number for the same purpose
+ * would be one more thing to keep in step, for no gain. The value's bound is
+ * the one that matters and is deliberately generous: Meta's `fbclid` routinely
+ * runs past 128 characters, and a click ID short by one character matches
+ * nothing at the platform that issued it.
+ */
+function validateIdentifier(raw: unknown): MarketingIdentifierInput | null {
+  if (!isPlainObject(raw)) return null;
+  const { key, value } = raw;
+  if (typeof key !== 'string' || key.length === 0 || key.length > CLICK_ID_VALUE_MAX_LENGTH) {
+    return null;
+  }
+  if (typeof value !== 'string' || value.length === 0 || value.length > CLICK_ID_VALUE_MAX_LENGTH) {
+    return null;
+  }
+  return { key, value };
+}
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  const submitted = await parseIdentifiers(request);
+  if (!submitted) {
+    return NextResponse.json({ error: 'malformed identifiers' }, { status: 400 });
+  }
+  // Validation runs BEFORE the gates here, unlike the event sibling: its reject
+  // shape is positional (one result per submitted item) and can be built from
+  // the raw batch, while this route answers with KEYS — which exist only once
+  // an entry has been proven to carry one.
+  const identifiers: MarketingIdentifierInput[] = [];
+  for (const entry of submitted) {
+    const identifier = validateIdentifier(entry);
+    // A malformed entry is DROPPED, never a 400: one bad pair must not cost a
+    // shopper the attribution the others carry. It is then absent from both
+    // answer lists rather than reported as rejected, so `rejected` keeps its
+    // single meaning — "the upstream does not know this key" — and can never be
+    // read as "you sent junk".
+    if (identifier) identifiers.push(identifier);
+  }
+  // Nothing survived validation: answer the empty verdict without an upstream
+  // call. Forwarding an empty list would mint a session for a request that has
+  // nothing to store against it.
+  if (identifiers.length === 0) return respond([], []);
+  const rejectAll = (): NextResponse => respond([], identifiers.map((identifier) => identifier.key));
+  // Inert before `forgecart init` writes `.env` (image-prewarm contract).
+  if (!getUpstreamConfig()) return rejectAll();
+  const userAgent = request.headers.get('user-agent') ?? '';
+  if (isObviousBot(userAgent)) return rejectAll();
+  const incomingSession = request.cookies.get(SESSION_COOKIE)?.value ?? null;
+  const forwardedFor = request.headers.get('x-forwarded-for');
+  // #1014: mirror the browser's low-entropy Client Hints trio upstream —
+  // Chromium sends them on every request; the shop API's device identification
+  // prefers them over the frozen UA.
+  const secChUa = request.headers.get('sec-ch-ua') ?? undefined;
+  const secChUaMobile = request.headers.get('sec-ch-ua-mobile') ?? undefined;
+  const secChUaPlatform = request.headers.get('sec-ch-ua-platform') ?? undefined;
+  // One call for the whole list: the mutation takes an array and the backend
+  // writes it against a single identity, so there is no per-item sequencing to
+  // get wrong here (the event relay loops only because `trackEvent` takes one
+  // event at a time).
+  const outcome = await forwardMarketingIdentifiers(identifiers, {
+    sessionToken: incomingSession,
+    userAgent,
+    forwardedFor,
+    secChUa,
+    secChUaMobile,
+    secChUaPlatform,
+  });
+  const response = respond(outcome.accepted, outcome.rejected);
+  // Establish-only persist: write the session ONLY when the request arrived
+  // without one, and then into BOTH of its homes — the httpOnly original the
+  // server reads and the mirror the shopper's own socket boots from. A mint
+  // against an EXISTING cookie is never persisted here — replacing a live
+  // session would vanish the cart it holds, and replacing a stale one belongs
+  // to the cart path (see the module docstring).
+  if (!incomingSession && outcome.sessionToken) {
+    establishSessionCookies(response, outcome.sessionToken);
+  }
+  return response;
+}

package/templates/storefront/src/app/%5F%5Ffc/track/route.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
+import { SESSION_COOKIE, establishSessionCookies } from '../../../lib/session-cookies';
 import {
   forwardTrackEvent,
   getUpstreamConfig,
@@ -30,14 +31,25 @@ import {
  * response `extensions` (`forgecart-auth-token`) exactly once; the first
  * touched item captures it and the remaining items of the batch ride it as
  * Bearer (one identity per batch). The relay may ESTABLISH the shopper
- * identity — persisting the mint into the httpOnly `forgecart-session` cookie
- * (same attributes as the cart actions') when the request arrived cookie-less
- * — but it never REPLACES an existing cookie. The asymmetry is deliberate:
- * an incoming cookie that the upstream re-mints against is either a live
- * session owned by the cart path (clobbering it would vanish a just-created
- * cart — the first-touch double-mint race) or a stale one, whose replacement
- * is the cart path's job (the SDK adopts re-mints and the cart actions
- * persist them; the relay replacing it here would race those writers).
+ * identity — persisting that mint into BOTH homes of the session pair, the
+ * httpOnly `forgecart-session` cookie and its JS-readable mirror
+ * `forgecart-session-client`, through the contract `src/lib/session-cookies.ts`
+ * owns and `src/lib/session-actions.ts#syncShopSession` writes too — but it
+ * never REPLACES an existing cookie. The asymmetry is deliberate: an incoming
+ * cookie that the upstream re-mints against is either a live session owned by
+ * the cart path (clobbering it would vanish a just-created cart — the
+ * first-touch double-mint race) or a stale one, whose replacement is the cart
+ * path's job (the SDK adopts re-mints and `syncShopSession` persists them; the
+ * relay replacing it here would race those writers).
+ *
+ * Both homes or neither (#1733): the browser's shop socket boots its auth from
+ * the MIRROR (`lib/shop-session.ts`), so a session established into the httpOnly
+ * half alone never reaches the client at all — the first cart operation mints a
+ * RIVAL session, `syncShopSession` overwrites the pair with it, and the events
+ * this batch just recorded stay on a session no attribution read resolves to.
+ * Presence, in contrast, is read from the httpOnly copy ALONE: it is the
+ * authoritative one, the mirror is derived from it, and a client-writable cookie
+ * must not be able to decide whether this relay establishes at all.
  *
  * Residual window: two writers that BOTH start cookie-less inside the same
  * in-flight window remain last-writer-wins. With the tracker's deferred first
@@ -55,10 +67,6 @@ import {
  * A folder literally named `__fc` would silently 404.
  */
-const SESSION_COOKIE = 'forgecart-session';
-/** Mirrors `cart-actions.ts#persistSession` — the cookie is one shared identity. */
-const SESSION_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
 /** The tracker flushes at ≤10 events; anything past this is not our client. */
 const MAX_BATCH_SIZE = 50;
@@ -169,18 +177,13 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
   }
   const response = NextResponse.json({ results });
-  // Establish-only persist: write the cookie ONLY when the request arrived
-  // without one. A mint against an EXISTING cookie is never persisted here —
-  // replacing a live session would vanish the cart it holds (first-touch
-  // double-mint race), and replacing a stale one belongs to the cart path,
-  // whose SDK capture + persist owns re-mints (see the module docstring).
-  if (!incomingSession && sessionToken) {
-    response.cookies.set(SESSION_COOKIE, sessionToken, {
-      httpOnly: true,
-      sameSite: 'lax',
-      path: '/',
-      maxAge: SESSION_COOKIE_MAX_AGE_SECONDS,
-    });
-  }
+  // Establish-only persist: write the session ONLY when the request arrived
+  // without one — and then into BOTH of its homes, which is all
+  // `establishSessionCookies` does. A mint against an EXISTING cookie is never
+  // persisted here — replacing a live session would vanish the cart it holds
+  // (first-touch double-mint race), and replacing a stale one belongs to the
+  // cart path, whose SDK capture + persist owns re-mints (see the module
+  // docstring).
+  if (!incomingSession && sessionToken) establishSessionCookies(response, sessionToken);
   return response;
 }

package/templates/storefront/src/app/__forge_beacon/route.ts CHANGED Viewed

@@ -10,7 +10,7 @@
  *
  * Gated entirely on `NODE_ENV === 'development'`: a deployed `next start` storefront
  * answers 404 here and forwards nothing — the whole beacon path ships only in the
- * in-pod dev-server. Request access keeps it out of the static prerender (cacheComponents) so it
+ * in-pod dev-server. Request access keeps it out of any static prerender so it
  * behaves identically under `next dev` and a dev build.
  */

package/templates/storefront/src/app/cart/page.tsx CHANGED Viewed

@@ -1,14 +1,25 @@
+import type { Metadata } from 'next';
 import { connection } from 'next/server';
 import { Suspense } from 'react';
 import { CartView } from '../../components/CartView';
 import { getChannelSellingPlanGroups } from '../../lib/forgecart';
+import { getRequestLocale } from '../../lib/locale/request-binding';
+import { routeRobots } from '../../lib/seo/noindex';
+/**
+ * Never indexable: a cart is per-shopper state, identical in copy for everyone
+ * and meaningless to a visitor arriving from a search result.
+ */
+export function generateMetadata(): Metadata {
+  return { robots: routeRobots('/cart') };
+}
 /**
  * Cart route. The shopper's cart itself lives on their OWN websocket
  * (`CartView` hydrates it client-side); the server's only read here is the
  * PUBLIC channel subscription plans off the anonymous channel singleton —
- * streamed as a hole so the shell stays static (cacheComponents).
+ * streamed as a hole while the shell renders.
  */
 export default function CartPage() {
   return (
@@ -20,11 +31,12 @@ export default function CartPage() {
 async function CartWithPlans() {
   await connection();
+  const { binding } = await getRequestLocale();
   // Channel-wide subscription plans are public channel data — the one
   // server-fetched input; the "Subscribe to your whole order" box renders
   // only when there are any.
   const channelGroups = await getChannelSellingPlanGroups();
-  return <CartView channelGroups={channelGroups} />;
+  return <CartView channelGroups={channelGroups} locale={binding} />;
 }
 function CartRouteSkeleton() {

package/templates/storefront/src/app/checkout/page.tsx CHANGED Viewed

@@ -1,13 +1,24 @@
+import type { Metadata } from 'next';
 import { connection } from 'next/server';
 import { Suspense } from 'react';
 import { CheckoutGate } from '../../components/checkout/CheckoutGate';
 import { getAvailableCountries } from '../../lib/forgecart';
+import { getRequestLocale } from '../../lib/locale/request-binding';
+import { routeRobots } from '../../lib/seo/noindex';
+/**
+ * Never indexable: checkout is a funnel step, not a destination, and every
+ * nested step inherits the decision through `NOINDEX_PATHS`.
+ */
+export function generateMetadata(): Metadata {
+  return { robots: routeRobots('/checkout') };
+}
 /**
  * Checkout entry. The server's only job here is the PUBLIC prefetch — the
  * channel's shipping countries off the anonymous channel singleton, streamed
- * as a hole (cacheComponents). The session work (the order itself, every
+ * as a hole. The session work (the order itself, every
  * checkout mutation) lives on the shopper's websocket: `CheckoutGate`
  * hydrates the live cart client-side and mounts the flow, or shows the
  * honest empty state.
@@ -25,8 +36,9 @@ export default function CheckoutPage() {
 async function CheckoutWithCountries() {
   await connection();
+  const { binding } = await getRequestLocale();
   const countries = await getAvailableCountries();
-  return <CheckoutGate countries={countries} />;
+  return <CheckoutGate countries={countries} locale={binding} />;
 }
 function CheckoutRouteSkeleton() {