@porulle/cli 0.1.0

package/README.md

@@ -0,0 +1,40 @@
+# @porulle/cli
+
+The command-line tool. Scaffolds new stores, runs migrations, mints API keys, doctors broken setups.
+
+## Commands
+
+| Command | What |
+|---|---|
+| `porulle init <name>` | scaffold a new store from `templates/starter/` — `commerce.config.ts`, `drizzle.config.ts`, server entry, package.json wired to `@porulle/*` workspace deps |
+| `porulle dev` | start the example server with reload (delegates to the app's own `dev` script when present) |
+| `porulle migrate` | apply pending Drizzle migrations against `DATABASE_URL` |
+| `porulle generate migration` | drizzle-kit generate — produce a new SQL migration from schema diffs |
+| `porulle deploy` | thin wrapper around the app's deploy script |
+| `porulle import <file>` | run an import adapter (Shopify CSV, WooCommerce XML, flat JSON) |
+| `porulle api-key create --scope <scope>` | mint an API key with the given permission scope (replaces the deprecated `auth.devKey`) |
+| `porulle doctor` | environment + config sanity check |
+
+## Install
+
+When published:
+
+```bash
+bun add -g @porulle/cli
+porulle init my-store
+```
+
+In the monorepo today (workspace dep):
+
+```bash
+cd apps/<app> && bunx porulle init <name>
+```
+
+## Starter template
+
+`templates/starter/` is what `porulle init` copies. Adjust there to change the default scaffold.
+
+## See also
+
+- [Root README — Quick Start](../../README.md#quick-start)
+- [`SECURITY.md`](../../SECURITY.md) — why `auth.devKey` was removed (`api-key create` replaces it)

package/dist/commands/api-key.d.ts

@@ -0,0 +1,34 @@
+export declare const apiKeyCreateCommand: import("citty").CommandDef<{
+    scope: {
+        type: "string";
+        description: string;
+        required: true;
+    };
+    config: {
+        type: "string";
+        description: string;
+        default: string;
+    };
+    name: {
+        type: "string";
+        description: string;
+    };
+    "save-env": {
+        type: "boolean";
+        description: string;
+        default: false;
+    };
+    "env-var": {
+        type: "string";
+        description: string;
+    };
+}>;
+export declare const apiKeyListCommand: import("citty").CommandDef<{
+    config: {
+        type: "string";
+        description: string;
+        default: string;
+    };
+}>;
+export declare const apiKeyCommand: import("citty").CommandDef<import("citty").ArgsDef>;
+//# sourceMappingURL=api-key.d.ts.map

package/dist/commands/api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../../src/commands/api-key.ts"],"names":[],"mappings":"AAgGA,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAyH9B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;EA+B5B,CAAC;AAEH,eAAO,MAAM,aAAa,qDASxB,CAAC"}

package/dist/commands/api-key.js

@@ -0,0 +1,202 @@
+import { defineCommand } from "citty";
+import { resolve, join } from "node:path";
+import { writeFileSync, readFileSync, existsSync } from "node:fs";
+/**
+ * Boots the commerce engine in-process and returns the auth instance.
+ * Uses dynamic import to avoid compile-time dependency on @porulle/core.
+ */
+async function bootEngine(configPath) {
+    const absPath = resolve(process.cwd(), configPath);
+    const configModule = await import(absPath);
+    const config = await configModule.default;
+    // Dynamic import — resolved at runtime from the consumer's node_modules
+    const corePkg = "@porulle/core";
+    const { createServer } = await import(/* webpackIgnore: true */ corePkg);
+    const { app, kernel } = await createServer(config);
+    const auth = kernel.auth;
+    return { config, auth, app, kernel };
+}
+/**
+ * Finds or creates an admin user for key ownership.
+ */
+async function findOrCreateAdminUser(app, config) {
+    // Try to create an admin user via the auth API
+    const email = "admin@local.dev";
+    const password = "admin-setup-" + Date.now();
+    const res = await app.request("http://localhost/api/auth/sign-up/email", {
+        method: "POST",
+        headers: { "content-type": "application/json", origin: "http://localhost" },
+        body: JSON.stringify({ email, password, name: "Admin" }),
+    });
+    if (res.ok) {
+        const data = (await res.json());
+        if (data?.user?.id)
+            return data.user.id;
+    }
+    // If signup fails (user exists), try sign-in
+    const signInRes = await app.request("http://localhost/api/auth/sign-in/email", {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            origin: "http://localhost",
+        },
+        body: JSON.stringify({ email, password }),
+    });
+    if (signInRes.ok) {
+        const data = (await signInRes.json());
+        if (data?.user?.id)
+            return data.user.id;
+    }
+    throw new Error("Could not find or create an admin user. Create one first via /api/auth/sign-up/email");
+}
+export const apiKeyCreateCommand = defineCommand({
+    meta: {
+        name: "create",
+        description: "Create an API key for a predefined scope",
+    },
+    args: {
+        scope: {
+            type: "string",
+            description: "Scope name (defined in commerce.config.ts auth.apiKeyScopes)",
+            required: true,
+        },
+        config: {
+            type: "string",
+            description: "Path to commerce.config.ts",
+            default: "./commerce.config.ts",
+        },
+        name: {
+            type: "string",
+            description: "Key name (default: scope name)",
+        },
+        "save-env": {
+            type: "boolean",
+            description: "Save key to .env.local",
+            default: false,
+        },
+        "env-var": {
+            type: "string",
+            description: "Env variable name (used with --save-env)",
+        },
+    },
+    async run({ args }) {
+        const { config, auth, app } = await bootEngine(args.config);
+        const scopes = config.auth?.apiKeyScopes;
+        if (!scopes || Object.keys(scopes).length === 0) {
+            console.error("No apiKeyScopes defined in commerce.config.ts");
+            console.error("");
+            console.error("Add scopes to your config:");
+            console.error("  auth: {");
+            console.error("    apiKeyScopes: {");
+            console.error('      storefront: { prefix: "uc_pub_", permissions: { catalog: ["read"] }, ... }');
+            console.error("    }");
+            console.error("  }");
+            process.exit(1);
+        }
+        const scopeDef = scopes[args.scope];
+        if (!scopeDef) {
+            console.error(`Unknown scope: "${args.scope}"`);
+            console.error("");
+            console.error("Available scopes:");
+            for (const [name, def] of Object.entries(scopes)) {
+                console.error(`  ${name} — ${def.description}`);
+            }
+            process.exit(1);
+        }
+        console.log(`Creating ${args.scope} API key...`);
+        // Find or create an admin user for key ownership
+        const userId = await findOrCreateAdminUser(app, config);
+        const result = await auth.api.createApiKey({
+            body: {
+                configId: args.scope,
+                userId,
+                name: args.name ?? `${args.scope}-key`,
+                permissions: scopeDef.permissions,
+                ...(scopeDef.rateLimit
+                    ? {
+                        rateLimitEnabled: true,
+                        rateLimitMax: scopeDef.rateLimit.maxRequests,
+                        rateLimitTimeWindow: scopeDef.rateLimit.timeWindow,
+                    }
+                    : {}),
+            },
+        });
+        console.log("");
+        console.log(`  Scope:       ${args.scope}`);
+        console.log(`  Description: ${scopeDef.description}`);
+        console.log(`  Prefix:      ${scopeDef.prefix}`);
+        console.log(`  Key:         ${result.key}`);
+        console.log(`  ID:          ${result.id}`);
+        console.log("");
+        console.log("  Permissions:");
+        for (const [resource, actions] of Object.entries(scopeDef.permissions)) {
+            console.log(`    ${resource}: ${actions.join(", ")}`);
+        }
+        if (scopeDef.rateLimit) {
+            console.log(`  Rate limit:  ${scopeDef.rateLimit.maxRequests} req / ${scopeDef.rateLimit.timeWindow}ms`);
+        }
+        if (args["save-env"]) {
+            const envFile = join(process.cwd(), ".env.local");
+            const varName = args["env-var"] ?? `UC_${args.scope.toUpperCase().replace(/-/g, "_")}_KEY`;
+            const line = `${varName}=${result.key}`;
+            if (existsSync(envFile)) {
+                const existing = readFileSync(envFile, "utf-8");
+                if (existing.includes(varName + "=")) {
+                    // Replace existing
+                    const updated = existing.replace(new RegExp(`^${varName}=.*$`, "m"), line);
+                    writeFileSync(envFile, updated);
+                }
+                else {
+                    writeFileSync(envFile, existing.trimEnd() + "\n" + line + "\n");
+                }
+            }
+            else {
+                writeFileSync(envFile, line + "\n");
+            }
+            console.log(`  Saved to:    .env.local as ${varName}`);
+        }
+        console.log("");
+        console.log("This is the only time the full key is shown. Store it securely.");
+        process.exit(0);
+    },
+});
+export const apiKeyListCommand = defineCommand({
+    meta: {
+        name: "list",
+        description: "List existing API keys",
+    },
+    args: {
+        config: {
+            type: "string",
+            description: "Path to commerce.config.ts",
+            default: "./commerce.config.ts",
+        },
+    },
+    async run({ args }) {
+        const { config } = await bootEngine(args.config);
+        const scopes = config.auth?.apiKeyScopes ?? {};
+        console.log("Defined API key scopes:");
+        console.log("");
+        for (const [name, def] of Object.entries(scopes)) {
+            console.log(`  ${name}`);
+            console.log(`    ${def.description}`);
+            console.log(`    Prefix: ${def.prefix}`);
+            console.log(`    Permissions: ${Object.entries(def.permissions).map(([r, a]) => `${r}:${a.join(",")}`).join(" | ")}`);
+            if (def.rateLimit) {
+                console.log(`    Rate limit: ${def.rateLimit.maxRequests} req / ${def.rateLimit.timeWindow}ms`);
+            }
+            console.log("");
+        }
+        process.exit(0);
+    },
+});
+export const apiKeyCommand = defineCommand({
+    meta: {
+        name: "api-key",
+        description: "Manage API keys (create, list)",
+    },
+    subCommands: {
+        create: apiKeyCreateCommand,
+        list: apiKeyListCommand,
+    },
+});

package/dist/commands/deploy.d.ts

@@ -0,0 +1,13 @@
+export declare const deployCommand: import("citty").CommandDef<{
+    target: {
+        type: "string";
+        required: true;
+        description: string;
+    };
+    prod: {
+        type: "boolean";
+        default: false;
+        description: string;
+    };
+}>;
+//# sourceMappingURL=deploy.d.ts.map

package/dist/commands/deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa;;;;;;;;;;;EA4CxB,CAAC"}

package/dist/commands/deploy.js

@@ -0,0 +1,45 @@
+import { spawn } from "node:child_process";
+import { defineCommand } from "citty";
+import consola from "consola";
+export const deployCommand = defineCommand({
+    meta: {
+        name: "deploy",
+        description: "Deploy UnifiedCommerce app to a target environment.",
+    },
+    args: {
+        target: {
+            type: "string",
+            required: true,
+            description: "Deployment target. Supported: vercel",
+        },
+        prod: {
+            type: "boolean",
+            default: false,
+            description: "Deploy production build",
+        },
+    },
+    async run({ args }) {
+        const target = String(args.target).toLowerCase();
+        if (target !== "vercel") {
+            throw new Error(`Unsupported deploy target: ${target}. Currently supported: vercel.`);
+        }
+        const command = process.platform === "win32" ? "npx.cmd" : "npx";
+        const deployArgs = ["vercel", "deploy"];
+        if (args.prod)
+            deployArgs.push("--prod");
+        consola.info(`Running deploy for target=${target} (${deployArgs.join(" ")})`);
+        await new Promise((resolvePromise, rejectPromise) => {
+            const proc = spawn(command, deployArgs, {
+                stdio: "inherit",
+                shell: false,
+            });
+            proc.on("exit", (code) => {
+                if (code === 0)
+                    resolvePromise();
+                else
+                    rejectPromise(new Error(`Deploy command failed with code ${code}`));
+            });
+            proc.on("error", rejectPromise);
+        });
+    },
+});

package/dist/commands/dev.d.ts

@@ -0,0 +1,15 @@
+export declare function loadDotenvFilesIfPresent(cwd: string): void;
+export declare function isMissingUserTableError(error: unknown): boolean;
+export declare function runDrizzleKitPush(cwd: string, env: NodeJS.ProcessEnv): Promise<void>;
+export declare function maybeBootstrapDevDatabase(options: {
+    cwd: string;
+    nodeEnv: string | undefined;
+    databaseUrl: string | undefined;
+}): Promise<void>;
+export declare const devCommand: import("citty").CommandDef<{
+    port: {
+        type: "string";
+        default: string;
+    };
+}>;
+//# sourceMappingURL=dev.d.ts.map

package/dist/commands/dev.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../src/commands/dev.ts"],"names":[],"mappings":"AAgBA,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAuB1D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAM/D;AA4BD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;AAED,eAAO,MAAM,UAAU;;;;;EAgDrB,CAAC"}

package/dist/commands/dev.js

@@ -0,0 +1,173 @@
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { defineCommand } from "citty";
+import consola from "consola";
+import postgres from "postgres";
+const DRIZZLE_CONFIG_CANDIDATES = [
+    "drizzle.config.ts",
+    "drizzle.config.mjs",
+    "drizzle.config.cjs",
+    "drizzle.config.js",
+    "drizzle.config.json",
+];
+export function loadDotenvFilesIfPresent(cwd) {
+    for (const name of [".env.local", ".env"]) {
+        const path = join(cwd, name);
+        if (!existsSync(path))
+            continue;
+        const content = readFileSync(path, "utf8");
+        for (const rawLine of content.split("\n")) {
+            const line = rawLine.trim();
+            if (!line || line.startsWith("#"))
+                continue;
+            const eq = line.indexOf("=");
+            if (eq <= 0)
+                continue;
+            const key = line.slice(0, eq).trim();
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+                continue;
+            if (process.env[key] !== undefined)
+                continue;
+            let val = line.slice(eq + 1).trim();
+            if ((val.startsWith('"') && val.endsWith('"')) ||
+                (val.startsWith("'") && val.endsWith("'"))) {
+                val = val.slice(1, -1);
+            }
+            process.env[key] = val;
+        }
+    }
+}
+export function isMissingUserTableError(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const err = error;
+    if (err.code === "42P01")
+        return true;
+    if (typeof err.message !== "string")
+        return false;
+    return err.message.includes('relation "user" does not exist');
+}
+function resolveDrizzleConfigFileName(cwd) {
+    for (const name of DRIZZLE_CONFIG_CANDIDATES) {
+        if (existsSync(join(cwd, name)))
+            return name;
+    }
+    return undefined;
+}
+function spawnCwdForDrizzleKit(projectCwd) {
+    let dir = projectCwd;
+    for (;;) {
+        if (existsSync(join(dir, "node_modules", "drizzle-orm"))) {
+            return dir;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    const cliPackageRoot = join(dirname(fileURLToPath(import.meta.url)), "../..");
+    const workspaceRoot = join(cliPackageRoot, "..", "..");
+    const corePkg = join(workspaceRoot, "packages", "core");
+    if (existsSync(join(corePkg, "node_modules", "drizzle-orm"))) {
+        return corePkg;
+    }
+    return projectCwd;
+}
+export async function runDrizzleKitPush(cwd, env) {
+    const configName = resolveDrizzleConfigFileName(cwd);
+    if (!configName) {
+        throw new Error("No drizzle.config.ts (or .mjs/.js/.json) found — cannot bootstrap the database.");
+    }
+    const configPath = join(cwd, configName);
+    const spawnCwd = spawnCwdForDrizzleKit(cwd);
+    await new Promise((resolvePromise, rejectPromise) => {
+        const proc = spawn(process.platform === "win32" ? "npx.cmd" : "npx", ["drizzle-kit", "push", "--force", "--config", configPath], { cwd: spawnCwd, stdio: "inherit", shell: false, env });
+        proc.on("exit", (code) => {
+            if (code === 0)
+                resolvePromise();
+            else {
+                rejectPromise(new Error(`drizzle-kit push exited with code ${code ?? "unknown"}`));
+            }
+        });
+        proc.on("error", rejectPromise);
+    });
+}
+export async function maybeBootstrapDevDatabase(options) {
+    if (options.nodeEnv === "production")
+        return;
+    const databaseUrl = options.databaseUrl?.trim();
+    if (!databaseUrl)
+        return;
+    let sql;
+    try {
+        sql = postgres(databaseUrl, { max: 1 });
+        await sql `SELECT 1 FROM "user" LIMIT 1`;
+    }
+    catch (error) {
+        if (!isMissingUserTableError(error))
+            throw error;
+        const configName = resolveDrizzleConfigFileName(options.cwd);
+        if (!configName) {
+            throw new Error("Core auth tables are missing and no Drizzle config was found. Add drizzle.config.ts or run `bun run db:push`.");
+        }
+        console.log("⚠ Tables missing — running drizzle-kit push to bootstrap…");
+        if (sql) {
+            await sql.end({ timeout: 5 });
+            sql = undefined;
+        }
+        await runDrizzleKitPush(options.cwd, {
+            ...process.env,
+            DATABASE_URL: databaseUrl,
+        });
+        console.log("✓ Bootstrap complete. Starting dev server…");
+        return;
+    }
+    finally {
+        if (sql)
+            await sql.end({ timeout: 5 });
+    }
+}
+export const devCommand = defineCommand({
+    meta: {
+        name: "dev",
+        description: "Run local dev server with file watching",
+    },
+    args: {
+        port: {
+            type: "string",
+            default: "3000",
+        },
+    },
+    async run({ args }) {
+        const port = String(args.port);
+        consola.info(`Starting dev server on port ${port}`);
+        loadDotenvFilesIfPresent(process.cwd());
+        try {
+            await maybeBootstrapDevDatabase({
+                cwd: process.cwd(),
+                nodeEnv: process.env.NODE_ENV,
+                databaseUrl: process.env.DATABASE_URL,
+            });
+        }
+        catch (error) {
+            consola.error(error);
+            consola.error("Try `bun run db:push` manually or check your DATABASE_URL.");
+            process.exit(1);
+        }
+        const proc = spawn(process.platform === "win32" ? "npx.cmd" : "npx", ["tsx", "watch", "src/dev-server.ts", "--port", port], {
+            stdio: "inherit",
+            shell: false,
+        });
+        await new Promise((resolvePromise, rejectPromise) => {
+            proc.on("exit", (code) => {
+                if (code === 0)
+                    resolvePromise();
+                else
+                    rejectPromise(new Error(`dev exited with code ${code}`));
+            });
+            proc.on("error", rejectPromise);
+        });
+    },
+});

package/dist/commands/doctor.d.ts

@@ -0,0 +1,8 @@
+export declare const doctorCommand: import("citty").CommandDef<{
+    cwd: {
+        type: "string";
+        description: string;
+        default: string;
+    };
+}>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAyMA,eAAO,MAAM,aAAa;;;;;;EAiRxB,CAAC"}