@vitrine-kit/vitrine 0.4.3 → 0.5.0

package/README.md

@@ -31,4 +31,4 @@ with flags is in the generated project's `CLAUDE.md`.
 
 At its core is the **feature install primitive**, shared by `init` and `add` (guarantee: "added by
 the wizard" ≡ "added later"). `add`/`update` work offline from the `~/.vitrine` cache; the network
-is only needed for `kit update`.
+is only needed for `kit update` (public npm — `@vitrine-kit/vitrine`).

package/dist/index.js

@@ -363,9 +363,13 @@ function activePaymentProvider(features) {
 }
 function renderIntegrationsRegion(features) {
   const payments = activePaymentProvider(features);
-  if (!payments) return "  integrations: {},";
+  const email = features.some((f) => f.name === "email") ? "smtp" : void 0;
+  const lines = [];
+  if (payments) lines.push(`    payments: ${JSON.stringify(payments)},`);
+  if (email) lines.push(`    email: ${JSON.stringify(email)},`);
+  if (lines.length === 0) return "  integrations: {},";
   return `  integrations: {
-    payments: ${JSON.stringify(payments)},
+${lines.join("\n")}
   },`;
 }
 function assertNoPascalCollisions(features) {
@@ -1188,15 +1192,16 @@ function diffFeatureCmd(name, registryRoot, projectRoot) {
 }
 
 // src/init.ts
+import { randomBytes } from "crypto";
 import { readdirSync as readdirSync4 } from "fs";
 import { join as join13 } from "path";
 
 // src/kit-versions.generated.ts
-var KIT_VERSION = "0.4.3";
+var KIT_VERSION = "0.5.0";
 var CONTRACTS_VERSION = "1.0.0";
 var CONTRACTS_RANGE = "^1.0.0";
 var CORE_RANGE = "^0.3.0";
-var BLUEPRINT_RANGE = "^0.2.0";
+var BLUEPRINT_RANGE = "^0.3.0";
 
 // src/kit.ts
 var REACT_RANGE = "^18.3.1";
@@ -1230,7 +1235,7 @@ var PAYMENT_PROVIDER_FEATURES = [
   "checkout-yookassa"
 ];
 function suggestFeatures(tier, registry, backend = defaultBackend(tier)) {
-  const core = ["catalog", "product-page", "seo"];
+  const core = ["catalog", "product-page", "seo", "search", "filters"];
   const shop = backend === "vendure" ? ["cart"] : ["cart", "checkout-stripe"];
   const desired = tier === "catalog" ? core : [...core, ...shop];
   return desired.filter((name) => registry.hasFeature(name));
@@ -1350,10 +1355,14 @@ function clientEnvExample(backend) {
     "# Payload secret (required; generate a random one for prod).",
     "PAYLOAD_SECRET=",
     "",
-    "# Dev admin (created only in dev when the DB is empty; the password is printed to the console).",
+    "# Dev / bootstrap admin (created when the users collection is empty in dev,",
+    "# or in production when SEED_ON_BOOT=1 \u2014 password printed to the console).",
     "DEV_ADMIN_EMAIL=",
     "DEV_ADMIN_PASSWORD=",
     "",
+    "# Docker compose: seed demo catalog + admin on first boot (default 1 in compose).",
+    "# SEED_ON_BOOT=1",
+    "",
     "# Site base URL (canonical, OG).",
     "NEXT_PUBLIC_SITE_URL=http://localhost:3000",
     "",
@@ -1362,6 +1371,18 @@ function clientEnvExample(backend) {
     ""
   ].join("\n");
 }
+function clientEnvFile(backend) {
+  const example = clientEnvExample(backend);
+  if (backend === "payload") {
+    const secret = randomBytes(24).toString("base64url");
+    return example.replace(/^PAYLOAD_SECRET=$/m, `PAYLOAD_SECRET=${secret}`);
+  }
+  if (backend === "vendure") {
+    const secret = randomBytes(24).toString("base64url");
+    return example.replace(/^VENDURE_COOKIE_SECRET=$/m, `VENDURE_COOKIE_SECRET=${secret}`);
+  }
+  return example;
+}
 function clientReadme(name, backend, tier) {
   const run = backend === "vendure" ? [
     "```bash",
@@ -1377,17 +1398,17 @@ function clientReadme(name, backend, tier) {
   ].join("\n") : [
     "```bash",
     "pnpm install",
-    "cp .env.example .env",
     "pnpm dev",
     "```",
     "",
     "- Storefront: http://localhost:3000",
     "- Admin: http://localhost:3000/admin",
     "",
-    "Without Postgres, dev starts a built-in SQLite (`.vitrine/dev.sqlite`), seeds a",
-    "demo catalog (5 products, 2 categories, size/color variants, gallery images) and creates a",
-    "dev admin (login/password printed to the console once). Disable the fallback in",
-    "dev too with `VITRINE_DB_STRICT=1`."
+    "`vitrine init` writes a starter `.env` (including `PAYLOAD_SECRET`). Copy from",
+    "`.env.example` only if you need a fresh file. Without Postgres, dev starts a built-in",
+    "SQLite (`.vitrine/dev.sqlite`), seeds a demo catalog (5 products, 2 categories,",
+    "size/color variants, gallery images) and creates a dev admin (login/password printed",
+    "to the console once). Disable the fallback in dev too with `VITRINE_DB_STRICT=1`."
   ].join("\n");
   const deploySecret = backend === "vendure" ? "export VENDURE_COOKIE_SECRET=...  # Vendure cookie secret" : "export PAYLOAD_SECRET=...         # random Payload secret";
   return `# ${name}
@@ -1426,7 +1447,7 @@ vitrine design apply     # style the new feature
 ## 5. Updates and checks
 
 \`\`\`bash
-vitrine kit update       # update the local registry/templates cache from GitHub
+vitrine kit update       # update the local registry/templates cache from npm
 vitrine diff <feature>   # preview a feature update
 vitrine update [feature] # 3-way merge of the new feature version (base = your snapshot)
 vitrine doctor           # consistency: vitrine.json \u2194 files \u2194 packages \u2194 env
@@ -1471,6 +1492,7 @@ function scaffoldBase(opts) {
     `import type { SiteConfig } from '@vitrine-kit/contracts';
 
 export const siteConfig: SiteConfig = {
+  name: ${JSON.stringify(name)},
   backend: ${JSON.stringify(backend)},
   tier: ${JSON.stringify(tier)},
   // vitrine:features:start
@@ -1511,7 +1533,7 @@ _No features installed yet._
 | \`vitrine diff <feature>\` | Preview an update (without writing) | before \`update\` | \`--registry\` |
 | \`vitrine doctor\` | Consistency: \`vitrine.json\` \u2194 files \u2194 packages \u2194 env | after edits, when in doubt | \`--registry\` |
 | \`vitrine design apply\` | Apply the design from \`/design\` to tokens (via Claude Code) | after \`add\` or a rebrand | \`--bin\`, \`--dry-run\` |
-| \`vitrine kit update\` | Update the local registry/templates cache from GitHub | before updating features | \`--from\`, \`--version\`, \`--channel\` |
+| \`vitrine kit update\` | Update the local registry/templates cache from npm | before updating features | \`[version]\`, \`--from\`, \`--channel\` |
 | \`vitrine kit status\` | Cache version vs the CLI's expected one | diagnostics | \u2014 |
 | \`vitrine self-update\` | Update the CLI itself | rarely | \`--dry-run\` |
 
@@ -1559,6 +1581,7 @@ The step is idempotent: re-running converges and doesn't accumulate cruft.
   writeText(join13(root, "lib", "blueprint.ts"), renderBlueprintFile([]));
   writeText(join13(root, "theme", "client.css"), renderNeutralTheme());
   writeText(join13(root, ".env.example"), clientEnvExample(backend));
+  writeText(join13(root, ".env"), clientEnvFile(backend));
   writeText(join13(root, "package.json"), `${JSON.stringify(clientPackageJson(name, backend), null, 2)}
 `);
 }
@@ -1573,43 +1596,89 @@ function initProject(opts) {
 
 // src/kit-update.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync9, mkdtempSync, readdirSync as readdirSync5, rmSync as rmSync4, statSync as statSync2 } from "fs";
+import { existsSync as existsSync9, mkdtempSync, rmSync as rmSync4 } from "fs";
 import { tmpdir } from "os";
-import { join as join14, resolve as resolve6 } from "path";
-var REPO = "vitrine-kit/vitrine";
-function hasBin(bin) {
-  const probe = process.platform === "win32" ? "where" : "which";
-  return spawnSync2(probe, [bin], { stdio: "ignore" }).status === 0;
+import { dirname as dirname7, join as join14, resolve as resolve6 } from "path";
+var NPM_PKG = "@vitrine-kit/vitrine";
+function resolveNpmCli() {
+  const candidates = [
+    join14(dirname7(process.execPath), "node_modules", "npm", "bin", "npm-cli.js"),
+    join14(dirname7(process.execPath), "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+  ];
+  return candidates.find((p2) => existsSync9(p2)) ?? null;
 }
-function acquireFromGh(tmp, version) {
-  if (!hasBin("gh")) {
-    throw new Error("[vitrine] network update needs gh (GitHub CLI), or pass --from <dir>");
-  }
-  if (!hasBin("tar")) {
-    throw new Error("[vitrine] unpacking needs tar, or pass --from <dir>");
+function hasNpm() {
+  if (resolveNpmCli()) return true;
+  const probe = process.platform === "win32" ? "where" : "which";
+  return spawnSync2(probe, ["npm"], { stdio: "ignore", shell: process.platform === "win32" }).status === 0;
+}
+function runNpm(args, opts = {}) {
+  const cli = resolveNpmCli();
+  if (cli) {
+    return spawnSync2(process.execPath, [cli, ...args], {
+      encoding: opts.encoding,
+      stdio: opts.stdio ?? "inherit"
+    });
   }
-  const dl = spawnSync2(
-    "gh",
-    ["release", "download", ...version ? [version] : [], "--repo", REPO, "--archive=tar.gz", "--dir", tmp, "--clobber"],
-    { stdio: "inherit" }
+  return spawnSync2("npm", args, {
+    encoding: opts.encoding,
+    stdio: opts.stdio ?? "inherit",
+    shell: process.platform === "win32"
+  });
+}
+function resolveKitNpmSpec(version) {
+  if (!version || version === "latest") return `${NPM_PKG}@latest`;
+  if (version.startsWith(`${NPM_PKG}@`)) return version;
+  if (version.startsWith("@") && version.includes("/")) return version;
+  const semver = version.replace(/^v/, "");
+  return `${NPM_PKG}@${semver}`;
+}
+function acquireFromNpm(tmp, version) {
+  if (!hasNpm()) {
+    throw new Error("[vitrine] network update needs npm, or pass --from <dir>");
+  }
+  const spec = resolveKitNpmSpec(version);
+  if (!/^[@A-Za-z0-9_./-]+$/.test(spec)) {
+    throw new Error(`[vitrine] invalid kit version/spec: ${version}`);
+  }
+  const install = runNpm(
+    [
+      "install",
+      spec,
+      "--prefix",
+      tmp,
+      "--no-save",
+      "--ignore-scripts",
+      "--no-package-lock",
+      "--registry",
+      "https://registry.npmjs.org/"
+    ],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
   );
-  if (dl.status !== 0) {
-    throw new Error("[vitrine] gh release download failed (check access/auth: gh auth status, and gh auth login if needed)");
-  }
-  const tarball = readdirSync5(tmp).find((f) => f.endsWith(".tar.gz"));
-  if (!tarball) throw new Error("[vitrine] release tarball not found after download");
-  if (spawnSync2("tar", ["-xzf", join14(tmp, tarball), "-C", tmp], { stdio: "inherit" }).status !== 0) {
-    throw new Error("[vitrine] tarball extraction failed");
+  if (install.status !== 0) {
+    const err = (install.stderr || install.stdout || install.error?.message || "").toString().trim();
+    throw new Error(
+      `[vitrine] npm install ${spec} failed${err ? `: ${err}` : ""} \u2014 check https://www.npmjs.com/package/@vitrine-kit/vitrine`
+    );
   }
-  const root = readdirSync5(tmp).map((f) => join14(tmp, f)).find((p2) => statSync2(p2).isDirectory() && existsSync9(join14(p2, "registry", "_index.json")));
-  if (!root) throw new Error("[vitrine] the unpacked tarball has no registry/_index.json");
-  return root;
+  const kitRoot = join14(tmp, "node_modules", "@vitrine-kit", "vitrine", "kit");
+  if (existsSync9(join14(kitRoot, "registry", "_index.json"))) return kitRoot;
+  throw new Error(
+    "[vitrine] installed package has no kit/registry/_index.json \u2014 reinstall @vitrine-kit/vitrine or pass --from <dir>"
+  );
 }
 function warnOnVersionMismatch(root, requested) {
   if (!requested) return;
   const tagSemver = requested.match(/^@vitrine-kit\/vitrine@(.+)$/)?.[1] ?? requested.match(/^v?(\d+\.\d+\.\d+\S*)$/)?.[1];
-  const pkgFile = join14(root, "packages", "cli", "package.json");
-  if (!tagSemver || !exists(pkgFile)) return;
+  if (!tagSemver || tagSemver === "latest") return;
+  const pkgCandidates = [
+    join14(root, "..", "package.json"),
+    // …/vitrine/kit → …/vitrine/package.json
+    join14(root, "packages", "cli", "package.json"),
+    join14(root, "package.json")
+  ];
+  const pkgFile = pkgCandidates.find((p2) => exists(p2));
+  if (!pkgFile) return;
   const version = readJson(pkgFile).version;
   if (version && version !== tagSemver) {
     console.warn(`[vitrine] requested "${requested}" but the downloaded kit is @vitrine-kit/vitrine@${version}`);
@@ -1621,7 +1690,7 @@ function kitUpdate(opts = {}) {
   }
   const tmp = mkdtempSync(join14(tmpdir(), "vitrine-kit-"));
   try {
-    const source = acquireFromGh(tmp, opts.version);
+    const source = acquireFromNpm(tmp, opts.version);
     warnOnVersionMismatch(source, opts.version);
     return populateCache(source, { home: opts.home, channel: opts.channel ?? "stable" });
   } finally {
@@ -1647,7 +1716,7 @@ function selfUpdate(opts = {}) {
     console.log(`[vitrine] npm ${args.join(" ")}`);
     return 0;
   }
-  const res = spawnSync2("npm", args, { stdio: "inherit" });
+  const res = runNpm(args, { stdio: "inherit" });
   if (res.error) throw res.error;
   return res.status ?? 0;
 }
@@ -1691,8 +1760,8 @@ design.command("apply").description("Apply the design from /design to the tokens
   if (code !== 0) process.exit(code);
 });
 var kit = program.command("kit").description("Local tooling (the ~/.vitrine registry cache)");
-kit.command("update").description("Update the local registry/templates cache from GitHub (or --from <dir>)").option("--from <path>", "local kit tree (clone / unpacked tarball) instead of the network").option("--version <tag>", "a specific release").option("--channel <channel>", "stable | main", "stable").action((opts) => {
-  const res = kitUpdate({ from: opts.from, version: opts.version, channel: opts.channel });
+kit.command("update").description("Update the local registry/templates cache from npm (or --from <dir>)").argument("[version]", "npm version or dist-tag (default: latest)").option("--from <path>", "local kit tree (clone / unpacked package) instead of the network").option("--channel <channel>", "stable | main", "stable").action((version, opts) => {
+  const res = kitUpdate({ from: opts.from, version, channel: opts.channel });
   console.log(`Cache updated to kit ${res.kitVersion}.`);
   console.log(formatChangelog(res.changelog));
 });

package/kit/registry/_index.json

@@ -1,11 +1,11 @@
 {
   "$schema": "../schemas/registry-index.schema.json",
-  "kitVersion": "0.4.3",
+  "kitVersion": "0.5.0",
   "contracts": "1.0.0",
   "features": {
     "catalog": {
       "title": "Product catalog",
-      "kitVersion": "0.4.3",
+      "kitVersion": "0.5.0",
       "tier": [
         "catalog",
         "simple-store",
@@ -14,7 +14,7 @@
     },
     "product-page": {
       "title": "Product page",
-      "kitVersion": "0.4.3",
+      "kitVersion": "0.5.0",
       "tier": [
         "catalog",
         "simple-store",
@@ -23,7 +23,52 @@
     },
     "seo": {
       "title": "SEO — metadata and JSON-LD",
-      "kitVersion": "0.4.3",
+      "kitVersion": "0.5.0",
+      "tier": [
+        "catalog",
+        "simple-store",
+        "full-store"
+      ]
+    },
+    "search": {
+      "title": "Product search",
+      "kitVersion": "0.5.0",
+      "tier": [
+        "catalog",
+        "simple-store",
+        "full-store"
+      ]
+    },
+    "filters": {
+      "title": "Catalog sort and filters",
+      "kitVersion": "0.5.0",
+      "tier": [
+        "catalog",
+        "simple-store",
+        "full-store"
+      ]
+    },
+    "wishlist": {
+      "title": "Wishlist",
+      "kitVersion": "0.5.0",
+      "tier": [
+        "catalog",
+        "simple-store",
+        "full-store"
+      ]
+    },
+    "reviews": {
+      "title": "Product reviews",
+      "kitVersion": "0.5.0",
+      "tier": [
+        "catalog",
+        "simple-store",
+        "full-store"
+      ]
+    },
+    "i18n": {
+      "title": "Locale switcher and path prefixes",
+      "kitVersion": "0.5.0",
       "tier": [
         "catalog",
         "simple-store",
@@ -32,7 +77,7 @@
     },
     "cart": {
       "title": "Cart",
-      "kitVersion": "0.4.3",
+      "kitVersion": "0.5.0",
       "tier": [
         "simple-store",
         "full-store"
@@ -40,7 +85,23 @@
     },
     "checkout": {
       "title": "Checkout",
-      "kitVersion": "0.4.3",
+      "kitVersion": "0.5.0",
+      "tier": [
+        "simple-store",
+        "full-store"
+      ]
+    },
+    "accounts": {
+      "title": "Accounts — login and order history",
+      "kitVersion": "0.5.0",
+      "tier": [
+        "simple-store",
+        "full-store"
+      ]
+    },
+    "email": {
+      "title": "Transactional email",
+      "kitVersion": "0.5.0",
       "tier": [
         "simple-store",
         "full-store"
@@ -48,7 +109,7 @@
     },
     "checkout-stripe": {
       "title": "Payment — Stripe",
-      "kitVersion": "0.4.3",
+      "kitVersion": "0.5.0",
       "tier": [
         "simple-store",
         "full-store"
@@ -56,7 +117,7 @@
     },
     "checkout-paddle": {
       "title": "Payment — Paddle",
-      "kitVersion": "0.4.3",
+      "kitVersion": "0.5.0",
       "tier": [
         "simple-store",
         "full-store"
@@ -64,7 +125,7 @@
     },
     "checkout-yookassa": {
       "title": "Payment — YooKassa",
-      "kitVersion": "0.4.3",
+      "kitVersion": "0.5.0",
       "tier": [
         "simple-store",
         "full-store"

package/kit/registry/accounts/docs/accounts.md

@@ -0,0 +1,20 @@
+# Feature: accounts
+
+Customer accounts (Payload `customers` auth collection) plus guest order lookup by email.
+
+## Modules
+- `customers` collection — added via blueprint `addCollection` (email/password auth)
+- `orders.customer` — optional relationship field (set on webhook fulfill when email matches)
+- `/account` — signed-in dashboard or sign-in / register / guest lookup
+- `/account/login`, `/account/register`
+- `/account/forgot-password`, `/account/reset-password?token=`
+- `/account/orders` — orders for the session email or `?email=` guest query
+- `AccountLink` — header link
+
+## Auth
+Uses Payload's built-in REST: `POST /api/customers`, `/login`, `/logout`,
+`/forgot-password`, `/reset-password`. Session cookies are managed by Payload.
+Forgot-password emails go through the Payload email adapter (`email` feature / console).
+
+## Guest lookup
+Still available without an account — enter the checkout email on `/account`.

package/kit/registry/accounts/feature.json

@@ -0,0 +1,55 @@
+{
+  "$schema": "../../schemas/feature.schema.json",
+  "name": "accounts",
+  "title": "Accounts — login and order history",
+  "kitVersion": "0.5.0",
+  "requiresContracts": ">=1.0.0 <2.0.0",
+  "tier": [
+    "simple-store",
+    "full-store"
+  ],
+  "registryDependencies": [
+    "checkout"
+  ],
+  "corePackages": {
+    "@vitrine-kit/core": ">=0.1.0",
+    "@vitrine-kit/payload-blueprint": ">=0.2.0"
+  },
+  "npm": [],
+  "files": [
+    {
+      "from": "files/components/accounts/",
+      "to": "components/accounts/"
+    },
+    {
+      "from": "files/lib/accounts/",
+      "to": "lib/accounts/"
+    },
+    {
+      "from": "files/app/",
+      "to": "app/"
+    }
+  ],
+  "config": {
+    "set": {
+      "features.accounts": true
+    }
+  },
+  "slots": [
+    {
+      "slot": "global.header-actions",
+      "component": "AccountLink",
+      "order": 25
+    }
+  ],
+  "blueprint": {
+    "extend": "order",
+    "addFields": [
+      "customer"
+    ]
+  },
+  "env": [],
+  "claudeDoc": "docs/accounts.md",
+  "conflicts": [],
+  "removable": true
+}

package/kit/registry/accounts/files/app/(frontend)/account/forgot-password/page.tsx

@@ -0,0 +1,24 @@
+import type { Metadata } from 'next';
+import { ForgotPasswordForm } from '@/components/accounts/ForgotPasswordForm';
+
+export const metadata: Metadata = {
+  title: 'Forgot password',
+  robots: { index: false, follow: false },
+};
+
+export default function ForgotPasswordPage() {
+  return (
+    <div className="flex max-w-md flex-col gap-section">
+      <header className="flex flex-col gap-unit">
+        <h1 className="font-heading text-fg">Forgot password</h1>
+        <p className="text-muted-fg">
+          Enter your account email. We send a reset link when the address is registered.
+        </p>
+      </header>
+      <ForgotPasswordForm />
+      <a href="/account/login" className="w-fit text-fg underline underline-offset-2">
+        Back to sign in
+      </a>
+    </div>
+  );
+}

package/kit/registry/accounts/files/app/(frontend)/account/login/page.tsx

@@ -0,0 +1,29 @@
+import type { Metadata } from 'next';
+import { LoginForm } from '@/components/accounts/LoginForm';
+
+export const metadata: Metadata = {
+  title: 'Sign in',
+  robots: { index: false, follow: false },
+};
+
+export default function AccountLoginPage() {
+  return (
+    <div className="flex max-w-md flex-col gap-section">
+      <header className="flex flex-col gap-unit">
+        <h1 className="font-heading text-fg">Sign in</h1>
+        <p className="text-muted-fg">
+          No account yet?{' '}
+          <a href="/account/register" className="underline underline-offset-2">
+            Create one
+          </a>
+        </p>
+      </header>
+      <LoginForm />
+      <p className="text-sm text-muted-fg">
+        <a href="/account/forgot-password" className="underline underline-offset-2">
+          Forgot password?
+        </a>
+      </p>
+    </div>
+  );
+}

package/kit/registry/accounts/files/app/(frontend)/account/orders/page.tsx

@@ -0,0 +1,90 @@
+import type { Metadata } from 'next';
+import { getPayload } from 'payload';
+import config from '@payload-config';
+import { formatMoney } from '@/lib/cart/data';
+import { getCustomer } from '@/lib/accounts/session';
+import { LogoutButton } from '@/components/accounts/LogoutButton';
+
+export const metadata: Metadata = {
+  title: 'Your orders',
+  robots: { index: false, follow: false },
+};
+
+interface PageProps {
+  searchParams: Promise<{ email?: string }>;
+}
+
+export default async function AccountOrdersPage({ searchParams }: PageProps) {
+  const customer = await getCustomer();
+  const { email: raw } = await searchParams;
+  const guestEmail = raw?.trim().toLowerCase() ?? '';
+  const email = customer?.email?.trim().toLowerCase() || guestEmail;
+
+  if (!email?.includes('@')) {
+    return (
+      <div className="flex flex-col gap-gutter">
+        <h1 className="font-heading text-fg">Your orders</h1>
+        <p className="text-muted-fg">Sign in or provide a valid email on the account page.</p>
+        <a href="/account" className="w-fit text-fg underline underline-offset-2">
+          Back
+        </a>
+      </div>
+    );
+  }
+
+  const payload = await getPayload({ config });
+  const res = await payload.find({
+    collection: 'orders',
+    where: { email: { equals: email } },
+    sort: '-createdAt',
+    limit: 50,
+    overrideAccess: true,
+  });
+
+  const orders = res.docs as Array<{
+    id: string | number;
+    status?: string;
+    total?: number;
+    currency?: string;
+    createdAt?: string;
+    paymentRef?: string;
+  }>;
+
+  return (
+    <div className="flex flex-col gap-section">
+      <header className="flex flex-col gap-unit">
+        <h1 className="font-heading text-fg">Your orders</h1>
+        <p className="text-muted-fg">
+          Showing orders for <span className="text-fg">{email}</span>
+          {customer ? ' (signed in)' : ' (guest lookup)'}
+        </p>
+      </header>
+      {orders.length === 0 ? (
+        <p className="text-muted-fg">No orders found for that email.</p>
+      ) : (
+        <ul role="list" className="flex flex-col gap-gutter">
+          {orders.map((o) => (
+            <li key={String(o.id)} className="flex flex-col gap-unit border-b border-border py-unit">
+              <p className="text-fg">
+                Order #{String(o.id)} — {o.status ?? 'unknown'}
+              </p>
+              <p className="text-muted-fg">
+                {typeof o.total === 'number' ? formatMoney(o.total, o.currency ?? 'USD') : '—'}
+                {o.createdAt ? ` · ${new Date(o.createdAt).toLocaleString()}` : ''}
+              </p>
+              {o.paymentRef ? (
+                <p className="text-sm text-muted-fg">Ref: {o.paymentRef}</p>
+              ) : null}
+            </li>
+          ))}
+        </ul>
+      )}
+      <div className="flex flex-wrap gap-gutter">
+        <a href="/account" className="w-fit text-fg underline underline-offset-2">
+          Account
+        </a>
+        {customer ? <LogoutButton /> : null}
+      </div>
+    </div>
+  );
+}