@jarwizz/create-jarshop 0.1.1 → 0.1.2

package/README.md

@@ -23,3 +23,11 @@ It creates `.env` from the committed development example only when missing,
 starts PostgreSQL, applies development migrations, runs the idempotent demo
 seed, and opens the server, worker, Dashboard, and storefront through Turbo.
 Use `pnpm db:down` to stop PostgreSQL without deleting its volume.
+
+# Template build boundary
+
+The generated Client Project template is copied from
+`starter/client-project` during this package's build. Turbo treats that source
+tree as a build input while excluding local runtime files such as `.env`,
+`node_modules`, and `dist`; a packed generator therefore always contains the
+template from the commit being verified without hashing secrets or artifacts.

package/dist/generator.js

@@ -166,18 +166,21 @@ export async function createProject(options) {
             recursive: true,
             filter: (path) => shouldIncludeTemplatePath(relative(templateRoot, path)),
         });
+        // Verify the packed template before materializing npm-safe filenames such
+        // as `gitignore.template` into their generated-project counterparts.
+        const actualDigest = await sha256Tree(staging);
+        if (actualDigest !== expectedDigest)
+            fail("Starter template digest verification failed");
         for (const [packedName, generatedName] of [
             ["gitignore.template", ".gitignore"],
             ["env.example.template", ".env.example"],
+            ["storefront/gitignore.template", "storefront/.gitignore"],
         ]) {
             const packedPath = join(staging, packedName);
             if (await pathExists(packedPath)) {
                 await rename(packedPath, join(staging, generatedName));
             }
         }
-        const actualDigest = await sha256Tree(staging);
-        if (actualDigest !== expectedDigest)
-            fail("Starter template digest verification failed");
         const templateFiles = await readTemplateFiles(staging);
         assertSafeTemplate(templateFiles);
         await writeJarShopManifests(staging, name, packageVersion, actualDigest);

package/dist/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,EAAE,EACF,KAAK,EACL,OAAO,EACP,QAAQ,EACR,MAAM,EACN,EAAE,EACF,IAAI,EACJ,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,UAAU,EACV,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3E,MAAM,oBAAoB,GAAG,OAAO,CAClC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,UAAU,CACX,CAAC;AACF,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AAC9D,MAAM,oBAAoB,GAAG,OAAO,CAClC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,wBAAwB,CACzB,CAAC;AA0BF,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IACvC,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,CACF,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS;gBACxD,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAC1D,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,IAAI,SAAS;gBAAE,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,aAAa;QAC1B,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAEnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,KAAK,GAAG,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,gCAAgC,OAAO,0BAA0B,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,OAAO,QAAQ;QACb,CAAC,CAAC,CAAC,MAAM,EAAE,sBAAsB,QAAQ,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC;QAC5E,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAA6C,CAAC;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,IAAY;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAoD;IAEpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,IAAI,CAAC,IAAI,KAAK,MAAM;YACpB,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACzD,CAAC;YACD,IAAI,CAAC,oDAAoD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,yCAAyC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YAC7D,KAAK,MAAM,OAAO,IAAI;gBACpB,cAAc;gBACd,iBAAiB;gBACjB,kBAAkB;aACV,EAAE,CAAC;gBACX,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CACA,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC/D,IACE,OAAO,KAAK,KAAK,QAAQ;wBACzB,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1C,CAAC;wBACD,IAAI,CACF,oBAAoB,IAAI,IAAI,KAAK,sBAAsB,IAAI,CAAC,IAAI,EAAE,CACnE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACrC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,OAAe,EACf,IAAY,EACZ,cAAsB,EACtB,cAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAClC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/B,CAAC;IAC/C,MAAM,kBAAkB,GACtB,iBAAiB,CAAC,YAAY,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAC5D,IAAI,CAAC,kBAAkB;QACrB,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAE/D,MAAM,eAAe,GAAG;QACtB,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;QAC9C,SAAS,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,cAAc,EAAE;QAC1E,cAAc,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE;QACpD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/C,QAAQ,EAAE,EAAE,uBAAuB,EAAE,kBAAkB,EAAE;KAC1D,CAAC;IACF,MAAM,iBAAiB,GAAG;QACxB,aAAa,EAAE,CAAC;QAChB,cAAc;QACd,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI;YACT;gBACE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBACpC,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC9C;SACF,CAAC,CACH;KACF,CAAC;IAEF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,SAAS,CACb,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,EACtC,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAChD,CAAC;IACF,MAAM,SAAS,CACb,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,EACxC,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA6B;IAE7B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAExE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;IAEvE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAClE,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;QACnC,IAAI,CAAC,gCAAgC,YAAY,EAAE,CAAC,CAAC;IAEvD,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,MAAM,QAAQ,CAAkB,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;IACjE,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,MAAM,QAAQ,CAAmB,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC;IAElE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC;IAE1E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE;YAC9B,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;SAC1E,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI;YACxC,CAAC,oBAAoB,EAAE,YAAY,CAAC;YACpC,CAAC,sBAAsB,EAAE,cAAc,CAAC;SAChC,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC7C,IAAI,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,cAAc;YACjC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvD,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QAEzE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;YAClD,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,EAAE,EACF,KAAK,EACL,OAAO,EACP,QAAQ,EACR,MAAM,EACN,EAAE,EACF,IAAI,EACJ,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,UAAU,EACV,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3E,MAAM,oBAAoB,GAAG,OAAO,CAClC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,UAAU,CACX,CAAC;AACF,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AAC9D,MAAM,oBAAoB,GAAG,OAAO,CAClC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,wBAAwB,CACzB,CAAC;AA0BF,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IACvC,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,CACF,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS;gBACxD,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAC1D,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,IAAI,SAAS;gBAAE,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACvE,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,aAAa;QAC1B,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAEnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,KAAK,GAAG,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,gCAAgC,OAAO,0BAA0B,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,OAAO,QAAQ;QACb,CAAC,CAAC,CAAC,MAAM,EAAE,sBAAsB,QAAQ,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC;QAC5E,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAA6C,CAAC;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,IAAY;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAoD;IAEpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,IAAI,CAAC,IAAI,KAAK,MAAM;YACpB,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACzD,CAAC;YACD,IAAI,CAAC,oDAAoD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,yCAAyC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YAC7D,KAAK,MAAM,OAAO,IAAI;gBACpB,cAAc;gBACd,iBAAiB;gBACjB,kBAAkB;aACV,EAAE,CAAC;gBACX,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CACA,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC/D,IACE,OAAO,KAAK,KAAK,QAAQ;wBACzB,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1C,CAAC;wBACD,IAAI,CACF,oBAAoB,IAAI,IAAI,KAAK,sBAAsB,IAAI,CAAC,IAAI,EAAE,CACnE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACrC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,OAAe,EACf,IAAY,EACZ,cAAsB,EACtB,cAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAClC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/B,CAAC;IAC/C,MAAM,kBAAkB,GACtB,iBAAiB,CAAC,YAAY,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAC5D,IAAI,CAAC,kBAAkB;QACrB,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAE/D,MAAM,eAAe,GAAG;QACtB,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;QAC9C,SAAS,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,cAAc,EAAE;QAC1E,cAAc,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE;QACpD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/C,QAAQ,EAAE,EAAE,uBAAuB,EAAE,kBAAkB,EAAE;KAC1D,CAAC;IACF,MAAM,iBAAiB,GAAG;QACxB,aAAa,EAAE,CAAC;QAChB,cAAc;QACd,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI;YACT;gBACE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBACpC,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC9C;SACF,CAAC,CACH;KACF,CAAC;IAEF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,SAAS,CACb,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,EACtC,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAChD,CAAC;IACF,MAAM,SAAS,CACb,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,EACxC,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA6B;IAE7B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAExE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;IAEvE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAClE,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;QACnC,IAAI,CAAC,gCAAgC,YAAY,EAAE,CAAC,CAAC;IAEvD,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,MAAM,QAAQ,CAAkB,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;IACjE,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,MAAM,QAAQ,CAAmB,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC;IAElE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC;IAE1E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE;YAC9B,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;SAC1E,CAAC,CAAC;QACH,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,cAAc;YACjC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI;YACxC,CAAC,oBAAoB,EAAE,YAAY,CAAC;YACpC,CAAC,sBAAsB,EAAE,cAAc,CAAC;YACxC,CAAC,+BAA+B,EAAE,uBAAuB,CAAC;SAClD,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC7C,IAAI,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvD,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QAEzE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;YAClD,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/template/CONTEXT.md

@@ -6,9 +6,17 @@
 - `src/index-worker.ts`: background jobs using the same database.
 - `src/vendure-config.ts`: runtime composition; no automatic schema sync.
 - `src/migrations/`: explicit, versioned PostgreSQL schema changes.
+- `src/plugins/jarshop-checkout/`: server-owned checkout boundary and
+  `CheckoutAttempt` persistence seam; behavior is added by later checkout
+  slices.
 - `src/seed.ts`: idempotent development-only SK/EN demo catalog seed.
 - `storefront/`: independent Next.js application on port `3001`.
 - `storefront/lib/commerce.ts`: typed Commerce Facade used by storefront routes.
+- `storefront/lib/cart.ts`: server-owned cart mutations using an HttpOnly
+  `vendure-session` cookie; browser storage is never authoritative.
+- `storefront/lib/checkout.ts`: guest pickup/courier COD checkout boundary
+  using the idempotent JarShop Shop API mutation; Vendure remains authoritative
+  for shipping eligibility and totals.
 - `docker-compose.yml`: local PostgreSQL only; production infrastructure is
   intentionally outside this development contract.
 - `.jarshop/`: exact generator, Starter Release, package and ownership facts.
@@ -29,6 +37,8 @@
 - **Commerce SDK**: framework-neutral, typed server-side commerce operations.
 - **Commerce Facade**: this project's adapter between Next.js and the SDK.
 - **Dashboard**: Vendure's operator UI; it is not the storefront.
+- **CheckoutAttempt**: a durable idempotency record owned by the JarShop
+  checkout plugin; it never stores customer PII.
 
 ## Runtime boundary
 

package/dist/template/README.md

@@ -13,8 +13,9 @@ pnpm dev
 
 `pnpm dev` creates `.env` when needed, starts PostgreSQL, waits for readiness,
 runs development-only migrations and the idempotent demo seed, then starts the
-Vendure server, worker and storefront in Turbo TUI. PostgreSQL remains running
-after the dev processes stop; use `pnpm db:down` when you want to stop it.
+Vendure server, worker, Dashboard Vite server and storefront in Turbo TUI.
+PostgreSQL remains running after the dev processes stop; use `pnpm db:down` when
+you want to stop it.
 
 Open the generated applications at:
 
@@ -32,6 +33,19 @@ production, replace every credential and provide secrets through the deployment
 secret store. Never commit `.env`, production credentials, private keys or
 Terraform state.
 
+## Order-email transport
+
+Development uses the deterministic `file` transport from `.env.example`. It is
+valid only for `APP_ENV=dev` or `APP_ENV=test` and writes a sanitized local
+proof instead of delivering a real message.
+
+SMTP is explicit: set `JARSHOP_EMAIL_TRANSPORT=smtp` and provide every
+`JARSHOP_EMAIL_SMTP_*` value listed in `.env.example` through an untracked
+environment file or the deployment secret store. The worker validates this
+configuration before it can deliver an order email, but this starter does not
+probe or send to an SMTP provider during application startup. A provider smoke
+test is a separate operational step.
+
 Database schema changes are explicit. The server does not run migrations during
 startup. Use `pnpm db:migrate` after the database is available.
 
@@ -55,7 +69,10 @@ generated project. Check `.jarshop/ownership.json` before editing managed files.
 
 - **Unsupported Node.js:** install exact Node `24.18.0`, then rerun `pnpm dev`.
 - **Docker is not available:** start Docker Desktop and rerun the command.
-- **Port 3000 or 3001 is occupied:** stop the conflicting local process.
+- **A Vendure or storefront port is occupied:** set free `PORT` and
+  `JARSHOP_STOREFRONT_PORT` values in `.env`, then set
+  `JARSHOP_COMMERCE_ENDPOINT` and `JARSHOP_STOREFRONT_URL` to the matching
+  local URLs before rerunning `pnpm dev`.
 - **PostgreSQL port 6543 is occupied:** set the same free
   `JARSHOP_POSTGRES_PORT` and `DB_PORT` values in `.env`.
 - **Reset only running PostgreSQL:** use `pnpm db:down`. The database volume is

package/dist/template/docker-compose.yml

@@ -9,6 +9,11 @@ services:
       POSTGRES_PASSWORD: change-me-locally
     volumes:
       - postgres_db_data:/var/lib/postgresql/data
+  valkey:
+    image: valkey/valkey:9.1.1-alpine3.24@sha256:de31910896150d5e754a07d57d227cfdde4e258ddd0d1aa4607f2d2f95843715
+    ports:
+      - "${JARSHOP_VALKEY_PORT:-6380}:6379"
+    command: ["valkey-server", "--save", "", "--appendonly", "no"]
 
 volumes:
   postgres_db_data:

package/dist/template/docs/smtp-smoke.md

@@ -0,0 +1,37 @@
+# Protected SMTP smoke
+
+This procedure proves that a staging Client Project can submit one controlled
+message to its configured SMTP transport. It is an operational check, not an
+automated test and not a production deployment procedure.
+
+## Before sending
+
+1. Use a dedicated staging SMTP credential with the least provider access
+   possible. Put it only in the staging secret store or an untracked `.env`.
+2. Set `APP_ENV=staging` and `JARSHOP_EMAIL_TRANSPORT=smtp`.
+3. Provide every `JARSHOP_EMAIL_SMTP_*` value from `.env.example`.
+4. Choose a test inbox that the operator can inspect. Do not use a customer
+   address.
+5. Confirm the file transport output directory is not the proof target.
+
+## Send one controlled message
+
+```shell
+pnpm email:smoke -- --to <controlled-test-inbox> --confirm-external-send
+```
+
+The command fails before network activity unless the environment is exactly
+`staging`, SMTP is selected and valid, a valid recipient is supplied, and the
+explicit confirmation flag is present. It sends no order data, confirmation
+token, customer data or database write.
+
+## Evidence and rollback
+
+Record the immutable application commit, provider timestamp/message ID if the
+provider exposes one, and receipt in the controlled inbox. Do not record the
+recipient, credentials, SMTP response body or provider secret in GitHub,
+application logs or issue comments.
+
+If the smoke fails, rotate or revoke the staging credential if its exposure is
+suspected, correct the environment secret, and retry only after the provider
+configuration is understood. No database rollback is required.

package/dist/template/env.example.template

@@ -2,13 +2,31 @@ APP_ENV=dev
 VENDURE_DISABLE_TELEMETRY=true
 NEXT_TELEMETRY_DISABLED=1
 PORT=3000
+JARSHOP_STOREFRONT_PORT=3001
+JARSHOP_COMMERCE_ENDPOINT=http://localhost:3000/shop-api
 COOKIE_SECRET=replace-with-a-local-development-secret
 SUPERADMIN_USERNAME=superadmin
 SUPERADMIN_PASSWORD=change-me-locally
 DB_HOST=localhost
 DB_PORT=6543
 JARSHOP_POSTGRES_PORT=6543
+JARSHOP_VALKEY_PORT=6380
+JARSHOP_ACCOUNT_RATE_LIMIT_URL=redis://localhost:6380
+# Production must replace this local URL with protected Valkey credentials.
 DB_NAME=vendure
 DB_USERNAME=vendure
 DB_PASSWORD=change-me-locally
 DB_SCHEMA=public
+JARSHOP_ORDER_EMAIL_ENCRYPTION_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=
+JARSHOP_EMAIL_TRANSPORT=file
+JARSHOP_EMAIL_FILE_TRANSPORT_PATH=./static/email/jarshop-outbox
+# SMTP is an explicit environment-owned transport. Keep these values in an
+# untracked environment file or deployment secret store; do not commit real credentials.
+# JARSHOP_EMAIL_TRANSPORT=smtp
+# JARSHOP_EMAIL_SMTP_HOST=smtp.example.com
+# JARSHOP_EMAIL_SMTP_PORT=587
+# JARSHOP_EMAIL_SMTP_SECURE=false
+# JARSHOP_EMAIL_SMTP_FROM=orders@example.com
+# JARSHOP_EMAIL_SMTP_USERNAME=orders@example.com
+# JARSHOP_EMAIL_SMTP_PASSWORD=replace-in-secret-store
+JARSHOP_STOREFRONT_URL=http://localhost:3001

package/dist/template/gitignore.template

@@ -7,4 +7,6 @@ dist/
 .env
 static/assets/*
 static/email/test-emails/*
+static/email/jarshop-outbox/*
+src/gql/
 !.gitkeep

package/dist/template/package.json

@@ -7,9 +7,10 @@
   },
   "packageManager": "pnpm@11.18.0",
   "scripts": {
-    "dev:server": "vendure dev server",
-    "dev:worker": "vendure dev worker",
-    "dev:storefront": "pnpm --dir storefront dev --port 3001",
+    "dev:server": "tsx ./src/index.ts",
+    "dev:worker": "tsx ./src/index-worker.ts",
+    "dev:dashboard": "vite --config vite.config.mts",
+    "dev:storefront": "tsx ./src/dev-storefront.ts",
     "dev": "tsx ./src/dev.ts",
     "build": "vendure build all",
     "build:server": "vendure build server",
@@ -17,13 +18,16 @@
     "build:dashboard": "vendure build dashboard",
     "start:server": "node ./dist/index.js",
     "start:worker": "node ./dist/index-worker.js",
-    "db:up": "docker compose up -d postgres_db",
-    "db:migrate": "vendure migrate --run",
+    "db:up": "docker compose up -d postgres_db valkey",
+    "db:migrate": "tsx ./src/migrate.ts",
     "db:seed": "tsx ./src/seed.ts",
+    "email:smoke": "tsx ./src/email-smoke.ts",
     "stack:up": "pnpm db:up",
     "db:down": "docker compose down"
   },
   "dependencies": {
+    "@nestjs/common": "11.1.28",
+    "@nestjs/graphql": "13.1.0",
     "@vendure/asset-server-plugin": "3.7.1",
     "@vendure/common": "3.7.1",
     "@vendure/core": "3.7.1",
@@ -31,10 +35,14 @@
     "@vendure/email-plugin": "3.7.1",
     "@vendure/graphiql-plugin": "3.7.1",
     "dotenv": "17.4.2",
+    "nodemailer": "9.0.4",
     "pg": "8.22.0",
+    "react": "19.2.4",
     "typeorm": "0.3.31"
   },
   "devDependencies": {
+    "@types/nodemailer": "8.0.1",
+    "@types/react": "19.2.14",
     "@vendure/cli": "3.7.1",
     "gql.tada": "1.11.3",
     "graphql": "16.14.2",

package/dist/template/pnpm-lock.yaml

@@ -8,6 +8,12 @@ importers:
 
   .:
     dependencies:
+      '@nestjs/common':
+        specifier: 11.1.28
+        version: 11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0)
+      '@nestjs/graphql':
+        specifier: 13.1.0
+        version: 13.1.0(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(graphql@16.14.2)(reflect-metadata@0.2.2)(ts-morph@21.0.1)
       '@vendure/asset-server-plugin':
         specifier: 3.7.1
         version: 3.7.1(supports-color@7.2.0)
@@ -29,13 +35,25 @@ importers:
       dotenv:
         specifier: 17.4.2
         version: 17.4.2
+      nodemailer:
+        specifier: 9.0.4
+        version: 9.0.4
       pg:
         specifier: 8.22.0
         version: 8.22.0
+      react:
+        specifier: 19.2.4
+        version: 19.2.4
       typeorm:
         specifier: 0.3.31
         version: 0.3.31(pg@8.22.0)(supports-color@7.2.0)(ts-node@10.9.2(@types/node@26.1.2)(typescript@5.8.2))
     devDependencies:
+      '@types/nodemailer':
+        specifier: 8.0.1
+        version: 8.0.1
+      '@types/react':
+        specifier: 19.2.14
+        version: 19.2.14
       '@vendure/cli':
         specifier: 3.7.1
         version: 3.7.1(@types/node@26.1.2)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.20.3)
@@ -2395,6 +2413,9 @@ packages:
     peerDependencies:
       '@types/react': ^19.2.0
 
+  '@types/react@19.2.14':
+    resolution: {integrity: sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==}
+
   '@types/react@19.2.18':
     resolution: {integrity: sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w==}
 
@@ -5345,6 +5366,10 @@ packages:
       react: '>=16.6.0'
       react-dom: '>=16.6.0'
 
+  react@19.2.4:
+    resolution: {integrity: sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==}
+    engines: {node: '>=0.10.0'}
+
   react@19.2.8:
     resolution: {integrity: sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==}
     engines: {node: '>=0.10.0'}
@@ -7012,7 +7037,7 @@ snapshots:
 
   '@graphql-tools/schema@10.0.23(graphql@16.14.2)':
     dependencies:
-      '@graphql-tools/merge': 9.0.24(graphql@16.14.2)
+      '@graphql-tools/merge': 9.2.2(graphql@16.14.2)
       '@graphql-tools/utils': 10.8.6(graphql@16.14.2)
       graphql: 16.14.2
       tslib: 2.8.1
@@ -7424,7 +7449,7 @@ snapshots:
       '@apollo/server': 4.13.0(graphql@16.14.2)(supports-color@7.2.0)
       '@apollo/server-plugin-landing-page-graphql-playground': 4.0.1(@apollo/server@4.13.0(graphql@16.14.2)(supports-color@7.2.0))
       '@nestjs/common': 11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0)
-      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(supports-color@7.2.0))(reflect-metadata@0.2.2)(rxjs@7.8.2)
       '@nestjs/graphql': 13.1.0(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(graphql@16.14.2)(reflect-metadata@0.2.2)(ts-morph@21.0.1)
       graphql: 16.14.2
       iterall: 1.3.0
@@ -7443,7 +7468,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@nestjs/core@11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28)(reflect-metadata@0.2.2)(rxjs@7.8.2)':
+  '@nestjs/core@11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(supports-color@7.2.0))(reflect-metadata@0.2.2)(rxjs@7.8.2)':
     dependencies:
       '@nestjs/common': 11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0)
       fast-safe-stringify: 2.1.1
@@ -7462,7 +7487,7 @@ snapshots:
       '@graphql-tools/schema': 10.0.23(graphql@16.14.2)
       '@graphql-tools/utils': 10.8.6(graphql@16.14.2)
       '@nestjs/common': 11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0)
-      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(supports-color@7.2.0))(reflect-metadata@0.2.2)(rxjs@7.8.2)
       '@nestjs/mapped-types': 2.1.0(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(reflect-metadata@0.2.2)
       chokidar: 4.0.3
       fast-glob: 3.3.3
@@ -7491,7 +7516,7 @@ snapshots:
   '@nestjs/platform-express@11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(supports-color@7.2.0)':
     dependencies:
       '@nestjs/common': 11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0)
-      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(supports-color@7.2.0))(reflect-metadata@0.2.2)(rxjs@7.8.2)
       cors: 2.8.6
       express: 5.2.1(supports-color@7.2.0)
       multer: 2.2.0
@@ -7503,7 +7528,7 @@ snapshots:
   '@nestjs/typeorm@11.0.3(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.31(pg@8.22.0)(supports-color@7.2.0)(ts-node@10.9.2(@types/node@26.1.2)(typescript@5.8.2)))':
     dependencies:
       '@nestjs/common': 11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0)
-      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(supports-color@7.2.0))(reflect-metadata@0.2.2)(rxjs@7.8.2)
       reflect-metadata: 0.2.2
       rxjs: 7.8.2
       typeorm: 0.3.31(pg@8.22.0)(supports-color@7.2.0)(ts-node@10.9.2(@types/node@26.1.2)(typescript@5.8.2))
@@ -8371,6 +8396,10 @@ snapshots:
     dependencies:
       '@types/react': 19.2.18
 
+  '@types/react@19.2.14':
+    dependencies:
+      csstype: 3.2.3
+
   '@types/react@19.2.18':
     dependencies:
       csstype: 3.2.3
@@ -8567,7 +8596,7 @@ snapshots:
       '@graphql-tools/stitch': 10.2.2(graphql@16.14.2)
       '@nestjs/apollo': 13.1.0(@apollo/server@4.13.0(graphql@16.14.2)(supports-color@7.2.0))(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(@nestjs/graphql@13.1.0(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(graphql@16.14.2)(reflect-metadata@0.2.2)(ts-morph@21.0.1))(graphql@16.14.2)
       '@nestjs/common': 11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0)
-      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/platform-express@11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(supports-color@7.2.0))(reflect-metadata@0.2.2)(rxjs@7.8.2)
       '@nestjs/graphql': 13.1.0(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(graphql@16.14.2)(reflect-metadata@0.2.2)(ts-morph@21.0.1)
       '@nestjs/platform-express': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(supports-color@7.2.0)
       '@nestjs/typeorm': 11.0.3(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@7.2.0))(@nestjs/core@11.1.28)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.31(pg@8.22.0)(supports-color@7.2.0)(ts-node@10.9.2(@types/node@26.1.2)(typescript@5.8.2)))
@@ -11969,6 +11998,8 @@ snapshots:
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
 
+  react@19.2.4: {}
+
   react@19.2.8: {}
 
   readable-stream@3.6.2:

package/dist/template/src/dev-storefront.ts

@@ -0,0 +1,58 @@
+import { spawn } from "node:child_process";
+import { resolve } from "node:path";
+import dotenv from "dotenv";
+
+const root = resolve(__dirname, "..");
+const inheritedEnvironment = { ...process.env };
+
+function parsePort(value: string): number {
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+    throw new Error(
+      "JARSHOP_STOREFRONT_PORT must be an integer from 1 to 65535.",
+    );
+  }
+  return port;
+}
+
+async function main(): Promise<void> {
+  dotenv.config({ path: resolve(root, ".env"), quiet: true });
+  const storefrontPort = parsePort(
+    process.env.JARSHOP_STOREFRONT_PORT ?? "3001",
+  );
+  const commerceEndpoint =
+    process.env.JARSHOP_COMMERCE_ENDPOINT ??
+    `http://localhost:${process.env.PORT ?? "3000"}/shop-api`;
+  const child = spawn(
+    "pnpm",
+    ["--dir", "storefront", "dev", "--port", String(storefrontPort)],
+    {
+      cwd: root,
+      stdio: "inherit",
+      // Values from the root .env are intentionally not forwarded to Next.
+      // Server, worker and database credentials therefore stay inside their
+      // own process; the local storefront receives only the commerce endpoint
+      // and its server-only local Valkey URL.
+      env: {
+        ...inheritedEnvironment,
+        JARSHOP_COMMERCE_ENDPOINT: commerceEndpoint,
+        JARSHOP_ACCOUNT_RATE_LIMIT_URL:
+          process.env.JARSHOP_ACCOUNT_RATE_LIMIT_URL ??
+          "redis://localhost:6380",
+        NEXT_TELEMETRY_DISABLED: process.env.NEXT_TELEMETRY_DISABLED ?? "1",
+      },
+    },
+  );
+  await new Promise<void>((resolvePromise, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) resolvePromise();
+      else reject(new Error(`storefront exited with ${signal ?? code}`));
+    });
+  });
+}
+
+main().catch((error: unknown) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exitCode = 1;
+});

package/dist/template/src/dev.ts

@@ -1,6 +1,6 @@
-import { copyFile, access } from "node:fs/promises";
+import { access, appendFile, copyFile, readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
-import { createServer } from "node:net";
+import { createConnection, createServer } from "node:net";
 import { resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import dotenv from "dotenv";
@@ -45,12 +45,59 @@ async function assertPortAvailable(
   });
 }
 
+async function assertServiceReachable(
+  port: number,
+  service: string,
+): Promise<void> {
+  await new Promise<void>((resolvePromise, reject) => {
+    const socket = createConnection({ host: "127.0.0.1", port });
+    const cleanup = () => {
+      socket.removeAllListeners();
+      socket.destroy();
+    };
+    socket.once("connect", () => {
+      cleanup();
+      resolvePromise();
+    });
+    socket.once("error", (error) => {
+      cleanup();
+      reject(error);
+    });
+    socket.setTimeout(500, () => {
+      cleanup();
+      reject(new Error(`${service} is not reachable on localhost:${port}`));
+    });
+  });
+}
+
 async function ensureEnv() {
   try {
     await access(envFile);
   } catch {
     await copyFile(envExample, envFile);
     console.log("Created local .env from .env.example");
+    return;
+  }
+
+  const [currentEnvironment, exampleEnvironment] = await Promise.all([
+    readFile(envFile, "utf8"),
+    readFile(envExample, "utf8"),
+  ]);
+  const currentKeys = new Set(
+    currentEnvironment
+      .split(/\r?\n/)
+      .flatMap((line) => line.match(/^([A-Z][A-Z0-9_]*)=/)?.[1] ?? []),
+  );
+  const missingDefaults = exampleEnvironment.split(/\r?\n/).filter((line) => {
+    const key = line.match(/^([A-Z][A-Z0-9_]*)=/)?.[1];
+    return key !== undefined && !currentKeys.has(key);
+  });
+
+  if (missingDefaults.length > 0) {
+    await appendFile(envFile, `\n${missingDefaults.join("\n")}\n`);
+    console.log(
+      `Added ${missingDefaults.length} missing local default${missingDefaults.length === 1 ? "" : "s"} from .env.example`,
+    );
   }
 }
 
@@ -77,6 +124,10 @@ async function dockerReady() {
     process.env.JARSHOP_POSTGRES_PORT ?? process.env.DB_PORT ?? "6543",
     "JARSHOP_POSTGRES_PORT",
   );
+  const valkeyPort = parsePort(
+    process.env.JARSHOP_VALKEY_PORT ?? "6380",
+    "JARSHOP_VALKEY_PORT",
+  );
   try {
     await run("docker", ["info"], { stdio: "ignore" });
   } catch {
@@ -86,7 +137,7 @@ async function dockerReady() {
   }
 
   try {
-    await run("docker", ["compose", "up", "-d", "postgres_db"]);
+    await run("docker", ["compose", "up", "-d", "postgres_db", "valkey"]);
   } catch {
     throw new Error(
       `PostgreSQL could not start on port ${dbPort}. Stop the conflicting service or choose another JARSHOP_POSTGRES_PORT.`,
@@ -109,6 +160,13 @@ async function dockerReady() {
         ],
         { stdio: "ignore" },
       );
+      // `pg_isready` proves readiness inside Docker. Docker Desktop can expose
+      // the container before its host port proxy is available, so also prove
+      // the connection that migrations use from the local machine.
+      await Promise.all([
+        assertServiceReachable(dbPort, "PostgreSQL"),
+        assertServiceReachable(valkeyPort, "Valkey"),
+      ]);
       return;
     } catch {
       await delay(1000);
@@ -124,9 +182,13 @@ async function main() {
   dotenv.config({ path: envFile, quiet: true });
   assertRuntime();
   const serverPort = parsePort(process.env.PORT ?? "3000", "PORT");
+  const storefrontPort = parsePort(
+    process.env.JARSHOP_STOREFRONT_PORT ?? "3001",
+    "JARSHOP_STOREFRONT_PORT",
+  );
   await Promise.all([
     assertPortAvailable(serverPort, "Vendure"),
-    assertPortAvailable(3001, "storefront"),
+    assertPortAvailable(storefrontPort, "storefront"),
   ]);
   const isDev = (process.env.APP_ENV ?? "dev") === "dev";
   if (isDev) {
@@ -141,6 +203,7 @@ async function main() {
     "run",
     "dev:server",
     "dev:worker",
+    "dev:dashboard",
     "dev:storefront",
     `--ui=${turboUi}`,
   ];

package/dist/template/src/email-smoke.ts

@@ -0,0 +1,27 @@
+import "dotenv/config";
+import { parseSmtpSmokeCommand } from "./plugins/jarshop-checkout/email-smoke-core.js";
+import { createConfiguredOrderEmailTransport } from "./plugins/jarshop-checkout/order-email-transport.js";
+
+async function main(): Promise<void> {
+  const command = parseSmtpSmokeCommand(process.argv.slice(2), process.env);
+  const transport = createConfiguredOrderEmailTransport();
+  await transport.deliver({
+    deliveryId: 1,
+    email: {
+      recipient: command.recipient,
+      subject: "JarShop SMTP transport smoke",
+      text: [
+        "This is a controlled JarShop SMTP transport smoke message.",
+        "No customer order, bearer token, or checkout data is included.",
+      ].join("\n"),
+    },
+  });
+  console.log("SMTP smoke email was accepted by the configured transport.");
+}
+
+main().catch(() => {
+  console.error(
+    "SMTP smoke delivery failed. Check the provider configuration without copying credentials into logs.",
+  );
+  process.exitCode = 1;
+});