create-nymbal-app 0.4.0 → 0.5.0

package/dist/index.d.ts

@@ -34,4 +34,5 @@ declare function parseCliFlags(argv: string[]): CliFlags;
 declare function main(argv?: string[], deps?: MainDeps): Promise<void>;
 declare function scaffold(dir: string, answers: Answers): Promise<void>;
 
-export { CliFlagError, type CliFlags, type MainDeps, type PackageManager, type Runner, detectPackageManager, main, parseCliFlags, scaffold };
+export { CliFlagError, detectPackageManager, main, parseCliFlags, scaffold };
+export type { CliFlags, MainDeps, PackageManager, Runner };

package/dist/index.js

@@ -18,6 +18,9 @@ async function writeAdminEnv(dir, admin) {
     "# The admin account the seed creates. Keep this file out of version control (.gitignore lists it).",
     `NYMBAL_ADMIN_EMAIL=${admin.email}`,
     `NYMBAL_ADMIN_PASSWORD=${admin.password}`,
+    "",
+    "# Encrypts the keys saved in the admin's Settings. Losing it loses them: back it up with your deploy's secrets.",
+    `NYMBAL_SECRETS_KEY=${randomBytes(32).toString("base64")}`,
     ""
   ];
   await writeFile(resolve(dir, ".env"), lines.join("\n"), { encoding: "utf8", mode: 384 });
@@ -343,10 +346,10 @@ export default defineConfig({
   security: {
     adapter: 'middleware',
     rateLimit: {
-      '/checkout': { requests: 10, window: '60s', action: 'block' },
-      '/auth/*': { requests: 5, window: '60s', action: 'challenge' },
-      '/api/*': { requests: 100, window: '60s', action: 'throttle' },
-      '/webhooks/*': { requests: 200, window: '60s', action: 'throttle' },
+      '/checkout': { requests: 10, window: '1m', action: 'block' },
+      '/auth/*': { requests: 5, window: '1m', action: 'challenge' },
+      '/api/*': { requests: 100, window: '1m', action: 'throttle' },
+      '/webhooks/*': { requests: 200, window: '1m', action: 'throttle' },
     },
     botProtection: { mode: 'managed', allowList: ['googlebot', 'bingbot', 'stripe-webhooks'] },
     headers: {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { cp, readFile, mkdir, readdir, rm, writeFile } from 'node:fs/promises'\nimport { existsSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { fileURLToPath } from 'node:url'\nimport { spawn, spawnSync } from 'node:child_process'\nimport { randomBytes } from 'node:crypto'\nimport { cancel, confirm, intro, isCancel, note, outro, select, text } from '@clack/prompts'\nimport pc from 'picocolors'\n\nconst HERE = dirname(fileURLToPath(import.meta.url))\nconst SCAFFOLD_ROOT = resolve(HERE, '..', 'scaffold')\n\nexport type PackageManager = 'npm' | 'pnpm' | 'yarn-classic' | 'yarn-berry' | 'bun'\n\ninterface Answers {\n  name: string\n  directory: string\n  currency: 'GBP' | 'USD' | 'EUR'\n  template: 'astro' | 'nextjs'\n  seedDemo: boolean\n}\n\n/**\n * Runs a command in `cwd` (with `env` when given, else the process environment) and rejects on a non-zero exit.\n * Injected into `main` so tests do not shell out.\n */\nexport type Runner = (\n  cmd: string,\n  args: string[],\n  cwd: string,\n  env?: NodeJS.ProcessEnv,\n) => Promise<void>\n\n/** The port `renderConfig` gives the API, which serves the admin at /admin/. */\nconst API_PORT = 3001\n\ninterface AdminCredentials {\n  email: string\n  password: string\n}\n\n/** A fresh admin password per project (128 bits, base64url), so no two stores share the seed's default. */\nfunction newAdminCredentials(): AdminCredentials {\n  return { email: 'admin@nymbal.local', password: randomBytes(16).toString('base64url') }\n}\n\n/** `.env` holds the admin credentials the seed (and a first `nymbal dev`) creates the admin from. */\nasync function writeAdminEnv(dir: string, admin: AdminCredentials): Promise<void> {\n  const lines = [\n    '# The admin account the seed creates. Keep this file out of version control (.gitignore lists it).',\n    `NYMBAL_ADMIN_EMAIL=${admin.email}`,\n    `NYMBAL_ADMIN_PASSWORD=${admin.password}`,\n    '',\n  ]\n  await writeFile(resolve(dir, '.env'), lines.join('\\n'), { encoding: 'utf8', mode: 0o600 })\n}\n\nfunction adminSignIn(admin: AdminCredentials): string[] {\n  return [\n    `Admin: http://localhost:${API_PORT}/admin/`,\n    `  email     ${admin.email}`,\n    `  password  ${admin.password} (saved in .env)`,\n  ]\n}\n\nexport interface MainDeps {\n  run?: Runner\n}\n\n/**\n * The `packageManager` field for the package manager that launched us (`npm_config_user_agent`), read when called.\n * Without a usable user agent it is the installed npm; undefined when npm cannot be run either.\n */\nfunction packageManagerField(): string | undefined {\n  const token = (process.env['npm_config_user_agent'] ?? '').split(' ')[0] ?? ''\n  const match = /^(npm|pnpm|yarn|bun)\\/(\\d+\\.\\d+\\.\\d+\\S*)$/.exec(token)\n  if (match) return `${match[1]}@${match[2]}`\n  const npm = spawnSync('npm', ['-v'], { encoding: 'utf8', shell: process.platform === 'win32' })\n  const version = npm.status === 0 ? npm.stdout.trim() : ''\n  return version ? `npm@${version}` : undefined\n}\n\nexport function detectPackageManager(): PackageManager {\n  const ua = process.env['npm_config_user_agent']\n  if (!ua) return 'npm'\n  const token = ua.split(' ')[0] ?? ''\n  const slash = token.indexOf('/')\n  const pm = slash >= 0 ? token.slice(0, slash) : token\n  const version = slash >= 0 ? token.slice(slash + 1) : ''\n  if (pm === 'pnpm') return 'pnpm'\n  if (pm === 'bun') return 'bun'\n  if (pm === 'yarn') {\n    const major = parseInt(version.split('.')[0] ?? '1', 10)\n    return major < 2 ? 'yarn-classic' : 'yarn-berry'\n  }\n  return 'npm'\n}\n\nfunction installCmd(pm: PackageManager): [string, string[]] {\n  switch (pm) {\n    case 'pnpm':\n      return ['pnpm', ['install']]\n    case 'bun':\n      return ['bun', ['install']]\n    case 'yarn-classic':\n    case 'yarn-berry':\n      return ['yarn', ['install']]\n    default:\n      return ['npm', ['install']]\n  }\n}\n\nfunction seedCmd(pm: PackageManager): [string, string[]] {\n  switch (pm) {\n    case 'pnpm':\n      return ['pnpm', ['exec', 'nymbal', 'seed']]\n    case 'bun':\n      return ['bunx', ['nymbal', 'seed']]\n    case 'yarn-classic':\n      return ['yarn', ['run', 'nymbal', 'seed']]\n    case 'yarn-berry':\n      return ['yarn', ['exec', 'nymbal', 'seed']]\n    default:\n      return ['npx', ['nymbal', 'seed']]\n  }\n}\n\nfunction devCmd(pm: PackageManager): string {\n  switch (pm) {\n    case 'pnpm':\n      return 'pnpm dev'\n    case 'bun':\n      return 'bun dev'\n    case 'yarn-classic':\n    case 'yarn-berry':\n      return 'yarn dev'\n    default:\n      return 'npm run dev'\n  }\n}\n\nconst TEMPLATES = ['astro', 'nextjs'] as const\nconst CURRENCIES = ['GBP', 'USD', 'EUR'] as const\n\nexport interface CliFlags {\n  name?: string\n  template?: (typeof TEMPLATES)[number]\n  currency?: (typeof CURRENCIES)[number]\n  yes: boolean\n  /** Present (false) only with `--no-install`. */\n  install?: boolean\n}\n\n/** A command-line flag that is missing its value or names a value outside the allowed set. */\nexport class CliFlagError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'CliFlagError'\n  }\n}\n\nfunction oneOf<T extends string>(flag: string, value: string, allowed: readonly T[]): T {\n  if ((allowed as readonly string[]).includes(value)) return value as T\n  throw new CliFlagError(`Unknown ${flag} \"${value}\". Allowed: ${allowed.join(', ')}`)\n}\n\n/** Parses process.argv (node and script first): --name, --template and --currency take `--flag v` or `--flag=v`. */\nexport function parseCliFlags(argv: string[]): CliFlags {\n  const flags: CliFlags = { yes: false }\n  const args = argv.slice(2)\n  let positional: string | undefined\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i]!\n    if (arg === '--yes' || arg === '-y') {\n      flags.yes = true\n      continue\n    }\n    if (arg === '--no-install') {\n      flags.install = false\n      continue\n    }\n    const match = /^--(name|template|currency)(?:=(.*))?$/s.exec(arg)\n    if (match) {\n      const flag = match[1]!\n      let value = match[2]\n      if (value === undefined) {\n        const next = args[i + 1]\n        if (next === undefined || next.startsWith('-'))\n          throw new CliFlagError(`--${flag} needs a value`)\n        value = next\n        i++\n      }\n      if (flag === 'name') flags.name = value\n      else if (flag === 'template') flags.template = oneOf('--template', value, TEMPLATES)\n      else flags.currency = oneOf('--currency', value, CURRENCIES)\n    } else if (!arg.startsWith('-') && positional === undefined) {\n      positional = arg\n    }\n  }\n  if (flags.name === undefined && positional !== undefined) flags.name = positional\n  return flags\n}\n\nexport async function main(argv: string[] = process.argv, deps: MainDeps = {}): Promise<void> {\n  const run = deps.run ?? runCmd\n  let flags: CliFlags\n  try {\n    flags = parseCliFlags(argv)\n  } catch (err) {\n    if (!(err instanceof CliFlagError)) throw err\n    process.stderr.write(`Error: ${err.message}\\n`)\n    process.exit(1)\n  }\n\n  const pm = detectPackageManager()\n\n  if (flags.yes) {\n    if (!flags.name) {\n      process.stderr.write('Error: --yes requires --name or a positional name argument\\n')\n      process.exit(1)\n    }\n    const name = flags.name.trim()\n    const answers: Answers = {\n      name,\n      directory: toDirectoryName(name),\n      currency: flags.currency ?? 'GBP',\n      template: flags.template ?? 'astro',\n      seedDemo: true,\n    }\n    const targetDir = resolve(process.cwd(), answers.directory)\n    if (existsSync(targetDir)) {\n      const entries = await readdir(targetDir)\n      if (entries.length > 0) {\n        process.stderr.write(\n          `Error: Directory ${answers.directory} already exists and is not empty.\\n`,\n        )\n        process.exit(1)\n      }\n    } else {\n      await mkdir(targetDir, { recursive: true })\n    }\n    await scaffold(targetDir, answers)\n    const admin = newAdminCredentials()\n    await writeAdminEnv(targetDir, admin)\n    process.stdout.write(`Created ${answers.directory}\\n`)\n    if (flags.install !== false) {\n      await installAndSeed(targetDir, pm, answers.seedDemo, run, admin)\n    } else {\n      process.stdout.write(`Next: cd ${answers.directory} && ${installCmd(pm)[0]} install\\n`)\n    }\n    process.stdout.write(`${adminSignIn(admin).join('\\n')}\\n`)\n    return\n  }\n\n  intro(pc.cyan(pc.bold('◆ create-nymbal-app')))\n\n  const name = flags.name\n    ? flags.name\n    : ((await text({\n        message: 'Store name',\n        placeholder: 'My Store',\n        validate: (v) => (!v || v.trim().length === 0 ? 'Required' : undefined),\n      })) as string | symbol)\n\n  if (isCancel(name)) return cancel('Cancelled')\n\n  type Currency = 'GBP' | 'USD' | 'EUR'\n  const currencyOptions: { value: Currency; label: string }[] = [\n    { value: 'GBP', label: 'GBP — British Pound' },\n    { value: 'USD', label: 'USD — US Dollar' },\n    { value: 'EUR', label: 'EUR — Euro' },\n  ]\n  const currency = await select({\n    message: 'Store currency',\n    options: currencyOptions,\n    initialValue: 'GBP' as Currency,\n  })\n\n  if (isCancel(currency)) return cancel('Cancelled')\n\n  type Template = 'astro' | 'nextjs'\n  const templateOptions: { value: Template; label: string }[] = [\n    { value: 'astro', label: 'Astro (recommended — performance-first)' },\n    { value: 'nextjs', label: 'Next.js (migration-friendly)' },\n  ]\n  const template = await select({\n    message: 'Storefront template',\n    options: templateOptions,\n    initialValue: 'astro' as Template,\n  })\n\n  if (isCancel(template)) return cancel('Cancelled')\n\n  const seedDemo = (await confirm({\n    message: 'Generate demo content?',\n    initialValue: true,\n  })) as boolean | symbol\n\n  if (isCancel(seedDemo)) return cancel('Cancelled')\n\n  const shouldInstall =\n    flags.install === false\n      ? false\n      : ((await confirm({\n          message: 'Install dependencies now?',\n          initialValue: true,\n        })) as boolean | symbol)\n\n  if (isCancel(shouldInstall)) return cancel('Cancelled')\n\n  const answers: Answers = {\n    name: String(name).trim(),\n    directory: toDirectoryName(String(name).trim()),\n    currency: currency as 'GBP' | 'USD' | 'EUR',\n    template: template as 'astro' | 'nextjs',\n    seedDemo: seedDemo as boolean,\n  }\n\n  const targetDir = resolve(process.cwd(), answers.directory)\n  if (existsSync(targetDir)) {\n    const entries = await readdir(targetDir)\n    if (entries.length > 0) {\n      cancel(`Directory ${answers.directory} already exists and is not empty.`)\n      process.exit(1)\n    }\n  } else {\n    await mkdir(targetDir, { recursive: true })\n  }\n\n  note(pc.dim(`Scaffolding into ${targetDir}`), 'Creating project')\n\n  await scaffold(targetDir, answers)\n  const admin = newAdminCredentials()\n  await writeAdminEnv(targetDir, admin)\n\n  if (shouldInstall) {\n    await installAndSeed(targetDir, pm, answers.seedDemo, run, admin)\n  }\n\n  const cmd = devCmd(pm)\n  const nextSteps = [`  ${pc.cyan('cd')} ${answers.directory}`]\n  if (!shouldInstall) {\n    const [ic] = installCmd(pm)\n    nextSteps.push(`  ${pc.cyan(ic + ' install')}`)\n  }\n  nextSteps.push(`  ${pc.cyan(cmd)}`)\n\n  outro(\n    [pc.green(`✓ Created ${answers.directory}`), '', ...nextSteps, '', ...adminSignIn(admin)].join(\n      '\\n',\n    ),\n  )\n}\n\n/** Install with the detected package manager, then seed through the project's own `nymbal` bin. */\nasync function installAndSeed(\n  dir: string,\n  pm: PackageManager,\n  seedDemo: boolean,\n  run: Runner,\n  admin: AdminCredentials,\n): Promise<void> {\n  const [installBin, installArgs] = installCmd(pm)\n  process.stdout.write(`Running ${installBin} install (this may take a moment)...\\n`)\n  await run(installBin, installArgs, dir)\n  if (seedDemo) {\n    process.stdout.write('Seeding demo content...\\n')\n    const [seedBin, seedArgs] = seedCmd(pm)\n    // Explicit, so a value exported in the shell cannot replace the one in .env and the outro.\n    await run(seedBin, seedArgs, dir, {\n      ...process.env,\n      NYMBAL_ADMIN_EMAIL: admin.email,\n      NYMBAL_ADMIN_PASSWORD: admin.password,\n    })\n  }\n}\n\nexport async function scaffold(dir: string, answers: Answers): Promise<void> {\n  // Copy the chosen template directly into dir (flat — no storefront/ subdirectory)\n  await copyScaffoldDir(resolve(SCAFFOLD_ROOT, 'templates', answers.template), dir)\n\n  // Overlay the project layer (scaffold/project/<template>) on top of the template\n  // defaults. Project files WIN on path collision — this is the override model:\n  // anything in the project layer shadows the template default at the same path.\n  // scaffold/project/ lives outside scaffold/templates/, so sync-scaffold's\n  // rm -rf of scaffold/templates/* never deletes it.\n  const projectLayer = resolve(SCAFFOLD_ROOT, 'project', answers.template)\n  if (existsSync(projectLayer)) {\n    await copyScaffoldDir(projectLayer, dir)\n  }\n\n  // Write nymbal.config.ts (answers-dependent, so generated at runtime)\n  await writeFile(resolve(dir, 'nymbal.config.ts'), renderConfig(answers), 'utf8')\n\n  // Patch the copied package.json: set name to the project directory name\n  await patchPackageJson(dir, answers.directory)\n}\n\nasync function patchPackageJson(dir: string, name: string): Promise<void> {\n  const pkgPath = resolve(dir, 'package.json')\n  const pkg = JSON.parse(await readFile(pkgPath, 'utf8')) as Record<string, unknown>\n  pkg['name'] = name\n  pkg['private'] = true\n  const packageManager = packageManagerField()\n  if (packageManager) pkg['packageManager'] = packageManager\n  await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\\n', 'utf8')\n}\n\nasync function copyScaffoldDir(src: string, dest: string): Promise<void> {\n  if (!existsSync(src)) {\n    throw new Error(`Scaffold directory not found: ${src}`)\n  }\n  await cp(src, dest, {\n    recursive: true,\n    filter: (source) => !source.endsWith('node_modules'),\n  })\n  await renameDotFiles(dest)\n}\n\nasync function renameDotFiles(dir: string): Promise<void> {\n  // Non-recursive: only rename _dot.* files at the project root.\n  // All shared dotfiles (_dot.gitignore, _dot.env.example) live at template root.\n  const entries = await readdir(dir, { withFileTypes: true })\n  for (const entry of entries) {\n    if (!entry.isDirectory() && entry.name.startsWith('_dot.')) {\n      const full = resolve(dir, entry.name)\n      const renamed = resolve(dir, '.' + entry.name.slice(5))\n      await writeFile(renamed, await readFile(full))\n      await rm(full)\n    }\n  }\n}\n\nfunction renderConfig(answers: Answers): string {\n  return `import { defineConfig } from '@nymbalhq/config'\n\nexport default defineConfig({\n  store: {\n    name: '${escape(answers.name)}',\n    currency: '${answers.currency}',\n    locale: '${defaultLocale(answers.currency)}',\n    timezone: '${defaultTimezone(answers.currency)}',\n  },\n\n  template: '${answers.template}',\n\n  infrastructure: {\n    commandStore: 'sqlite',\n    documentStore: 'in-memory',\n    eventBus: 'in-process',\n  },\n\n  security: {\n    adapter: 'middleware',\n    rateLimit: {\n      '/checkout': { requests: 10, window: '60s', action: 'block' },\n      '/auth/*': { requests: 5, window: '60s', action: 'challenge' },\n      '/api/*': { requests: 100, window: '60s', action: 'throttle' },\n      '/webhooks/*': { requests: 200, window: '60s', action: 'throttle' },\n    },\n    botProtection: { mode: 'managed', allowList: ['googlebot', 'bingbot', 'stripe-webhooks'] },\n    headers: {\n      hsts: true,\n      contentSecurityPolicy: 'strict',\n      referrerPolicy: 'strict-origin-when-cross-origin',\n      xFrameOptions: 'deny',\n    },\n    csrf: true,\n  },\n\n  commerce: {\n    payments: { provider: 'native' },\n    email: { provider: 'native' },\n    reviews: { provider: 'native' },\n    search: { provider: 'native' },\n    analytics: { provider: 'native' },\n    shipping: { provider: 'native' },\n    tax: { provider: 'native' },\n    ai: { provider: 'none' },\n  },\n\n  http: {\n    adapter: 'fastify',\n    port: ${API_PORT},\n  },\n\n  deployment: {\n    strategy: 'standard',\n  },\n\n  features: {\n    staging: false,\n    heartbeat: false,\n    autoUpdates: false,\n  },\n})\n`\n}\n\nfunction defaultLocale(currency: Answers['currency']): string {\n  return currency === 'USD' ? 'en-US' : 'en-GB'\n}\n\nfunction defaultTimezone(currency: Answers['currency']): string {\n  return currency === 'USD' ? 'America/New_York' : 'Europe/London'\n}\n\nfunction escape(v: string): string {\n  return v.replace(/'/g, \"\\\\'\")\n}\n\nfunction toDirectoryName(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9-_ ]/g, '')\n    .trim()\n    .replace(/\\s+/g, '-')\n}\n\nconst runCmd: Runner = (cmd, args, cwd, env = process.env) => {\n  return new Promise((resolve, reject) => {\n    const child = spawn(cmd, args, { cwd, env, stdio: 'inherit', shell: false })\n    child.on('error', reject)\n    child.on('exit', (code) => {\n      if (code === 0) return resolve()\n      reject(new Error(`${cmd} ${args.join(' ')} exited with ${code}`))\n    })\n  })\n}\n"],"mappings":";AAAA,SAAS,IAAI,UAAU,OAAO,SAAS,IAAI,iBAAiB;AAC5D,SAAS,kBAAkB;AAC3B,SAAS,SAAS,eAAe;AACjC,SAAS,qBAAqB;AAC9B,SAAS,OAAO,iBAAiB;AACjC,SAAS,mBAAmB;AAC5B,SAAS,QAAQ,SAAS,OAAO,UAAU,MAAM,OAAO,QAAQ,YAAY;AAC5E,OAAO,QAAQ;AAEf,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,gBAAgB,QAAQ,MAAM,MAAM,UAAU;AAwBpD,IAAM,WAAW;AAQjB,SAAS,sBAAwC;AAC/C,SAAO,EAAE,OAAO,sBAAsB,UAAU,YAAY,EAAE,EAAE,SAAS,WAAW,EAAE;AACxF;AAGA,eAAe,cAAc,KAAa,OAAwC;AAChF,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,sBAAsB,MAAM,KAAK;AAAA,IACjC,yBAAyB,MAAM,QAAQ;AAAA,IACvC;AAAA,EACF;AACA,QAAM,UAAU,QAAQ,KAAK,MAAM,GAAG,MAAM,KAAK,IAAI,GAAG,EAAE,UAAU,QAAQ,MAAM,IAAM,CAAC;AAC3F;AAEA,SAAS,YAAY,OAAmC;AACtD,SAAO;AAAA,IACL,2BAA2B,QAAQ;AAAA,IACnC,eAAe,MAAM,KAAK;AAAA,IAC1B,eAAe,MAAM,QAAQ;AAAA,EAC/B;AACF;AAUA,SAAS,sBAA0C;AACjD,QAAM,SAAS,QAAQ,IAAI,uBAAuB,KAAK,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK;AAC5E,QAAM,QAAQ,4CAA4C,KAAK,KAAK;AACpE,MAAI,MAAO,QAAO,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AACzC,QAAM,MAAM,UAAU,OAAO,CAAC,IAAI,GAAG,EAAE,UAAU,QAAQ,OAAO,QAAQ,aAAa,QAAQ,CAAC;AAC9F,QAAM,UAAU,IAAI,WAAW,IAAI,IAAI,OAAO,KAAK,IAAI;AACvD,SAAO,UAAU,OAAO,OAAO,KAAK;AACtC;AAEO,SAAS,uBAAuC;AACrD,QAAM,KAAK,QAAQ,IAAI,uBAAuB;AAC9C,MAAI,CAAC,GAAI,QAAO;AAChB,QAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,CAAC,KAAK;AAClC,QAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,QAAM,KAAK,SAAS,IAAI,MAAM,MAAM,GAAG,KAAK,IAAI;AAChD,QAAM,UAAU,SAAS,IAAI,MAAM,MAAM,QAAQ,CAAC,IAAI;AACtD,MAAI,OAAO,OAAQ,QAAO;AAC1B,MAAI,OAAO,MAAO,QAAO;AACzB,MAAI,OAAO,QAAQ;AACjB,UAAM,QAAQ,SAAS,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE;AACvD,WAAO,QAAQ,IAAI,iBAAiB;AAAA,EACtC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,IAAwC;AAC1D,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;AAAA,IAC7B,KAAK;AACH,aAAO,CAAC,OAAO,CAAC,SAAS,CAAC;AAAA,IAC5B,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;AAAA,IAC7B;AACE,aAAO,CAAC,OAAO,CAAC,SAAS,CAAC;AAAA,EAC9B;AACF;AAEA,SAAS,QAAQ,IAAwC;AACvD,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,QAAQ,UAAU,MAAM,CAAC;AAAA,IAC5C,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,UAAU,MAAM,CAAC;AAAA,IACpC,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,OAAO,UAAU,MAAM,CAAC;AAAA,IAC3C,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,QAAQ,UAAU,MAAM,CAAC;AAAA,IAC5C;AACE,aAAO,CAAC,OAAO,CAAC,UAAU,MAAM,CAAC;AAAA,EACrC;AACF;AAEA,SAAS,OAAO,IAA4B;AAC1C,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,IAAM,YAAY,CAAC,SAAS,QAAQ;AACpC,IAAM,aAAa,CAAC,OAAO,OAAO,KAAK;AAYhC,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,MAAwB,MAAc,OAAe,SAA0B;AACtF,MAAK,QAA8B,SAAS,KAAK,EAAG,QAAO;AAC3D,QAAM,IAAI,aAAa,WAAW,IAAI,KAAK,KAAK,eAAe,QAAQ,KAAK,IAAI,CAAC,EAAE;AACrF;AAGO,SAAS,cAAc,MAA0B;AACtD,QAAM,QAAkB,EAAE,KAAK,MAAM;AACrC,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,MAAI;AACJ,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,QAAQ,WAAW,QAAQ,MAAM;AACnC,YAAM,MAAM;AACZ;AAAA,IACF;AACA,QAAI,QAAQ,gBAAgB;AAC1B,YAAM,UAAU;AAChB;AAAA,IACF;AACA,UAAM,QAAQ,0CAA0C,KAAK,GAAG;AAChE,QAAI,OAAO;AACT,YAAM,OAAO,MAAM,CAAC;AACpB,UAAI,QAAQ,MAAM,CAAC;AACnB,UAAI,UAAU,QAAW;AACvB,cAAM,OAAO,KAAK,IAAI,CAAC;AACvB,YAAI,SAAS,UAAa,KAAK,WAAW,GAAG;AAC3C,gBAAM,IAAI,aAAa,KAAK,IAAI,gBAAgB;AAClD,gBAAQ;AACR;AAAA,MACF;AACA,UAAI,SAAS,OAAQ,OAAM,OAAO;AAAA,eACzB,SAAS,WAAY,OAAM,WAAW,MAAM,cAAc,OAAO,SAAS;AAAA,UAC9E,OAAM,WAAW,MAAM,cAAc,OAAO,UAAU;AAAA,IAC7D,WAAW,CAAC,IAAI,WAAW,GAAG,KAAK,eAAe,QAAW;AAC3D,mBAAa;AAAA,IACf;AAAA,EACF;AACA,MAAI,MAAM,SAAS,UAAa,eAAe,OAAW,OAAM,OAAO;AACvE,SAAO;AACT;AAEA,eAAsB,KAAK,OAAiB,QAAQ,MAAM,OAAiB,CAAC,GAAkB;AAC5F,QAAM,MAAM,KAAK,OAAO;AACxB,MAAI;AACJ,MAAI;AACF,YAAQ,cAAc,IAAI;AAAA,EAC5B,SAAS,KAAK;AACZ,QAAI,EAAE,eAAe,cAAe,OAAM;AAC1C,YAAQ,OAAO,MAAM,UAAU,IAAI,OAAO;AAAA,CAAI;AAC9C,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,KAAK,qBAAqB;AAEhC,MAAI,MAAM,KAAK;AACb,QAAI,CAAC,MAAM,MAAM;AACf,cAAQ,OAAO,MAAM,8DAA8D;AACnF,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,UAAMA,QAAO,MAAM,KAAK,KAAK;AAC7B,UAAMC,WAAmB;AAAA,MACvB,MAAAD;AAAA,MACA,WAAW,gBAAgBA,KAAI;AAAA,MAC/B,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU;AAAA,IACZ;AACA,UAAME,aAAY,QAAQ,QAAQ,IAAI,GAAGD,SAAQ,SAAS;AAC1D,QAAI,WAAWC,UAAS,GAAG;AACzB,YAAM,UAAU,MAAM,QAAQA,UAAS;AACvC,UAAI,QAAQ,SAAS,GAAG;AACtB,gBAAQ,OAAO;AAAA,UACb,oBAAoBD,SAAQ,SAAS;AAAA;AAAA,QACvC;AACA,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF,OAAO;AACL,YAAM,MAAMC,YAAW,EAAE,WAAW,KAAK,CAAC;AAAA,IAC5C;AACA,UAAM,SAASA,YAAWD,QAAO;AACjC,UAAME,SAAQ,oBAAoB;AAClC,UAAM,cAAcD,YAAWC,MAAK;AACpC,YAAQ,OAAO,MAAM,WAAWF,SAAQ,SAAS;AAAA,CAAI;AACrD,QAAI,MAAM,YAAY,OAAO;AAC3B,YAAM,eAAeC,YAAW,IAAID,SAAQ,UAAU,KAAKE,MAAK;AAAA,IAClE,OAAO;AACL,cAAQ,OAAO,MAAM,YAAYF,SAAQ,SAAS,OAAO,WAAW,EAAE,EAAE,CAAC,CAAC;AAAA,CAAY;AAAA,IACxF;AACA,YAAQ,OAAO,MAAM,GAAG,YAAYE,MAAK,EAAE,KAAK,IAAI,CAAC;AAAA,CAAI;AACzD;AAAA,EACF;AAEA,QAAM,GAAG,KAAK,GAAG,KAAK,0BAAqB,CAAC,CAAC;AAE7C,QAAM,OAAO,MAAM,OACf,MAAM,OACJ,MAAM,KAAK;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,UAAU,CAAC,MAAO,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa;AAAA,EAC/D,CAAC;AAEL,MAAI,SAAS,IAAI,EAAG,QAAO,OAAO,WAAW;AAG7C,QAAM,kBAAwD;AAAA,IAC5D,EAAE,OAAO,OAAO,OAAO,2BAAsB;AAAA,IAC7C,EAAE,OAAO,OAAO,OAAO,uBAAkB;AAAA,IACzC,EAAE,OAAO,OAAO,OAAO,kBAAa;AAAA,EACtC;AACA,QAAM,WAAW,MAAM,OAAO;AAAA,IAC5B,SAAS;AAAA,IACT,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC;AAED,MAAI,SAAS,QAAQ,EAAG,QAAO,OAAO,WAAW;AAGjD,QAAM,kBAAwD;AAAA,IAC5D,EAAE,OAAO,SAAS,OAAO,+CAA0C;AAAA,IACnE,EAAE,OAAO,UAAU,OAAO,+BAA+B;AAAA,EAC3D;AACA,QAAM,WAAW,MAAM,OAAO;AAAA,IAC5B,SAAS;AAAA,IACT,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC;AAED,MAAI,SAAS,QAAQ,EAAG,QAAO,OAAO,WAAW;AAEjD,QAAM,WAAY,MAAM,QAAQ;AAAA,IAC9B,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC;AAED,MAAI,SAAS,QAAQ,EAAG,QAAO,OAAO,WAAW;AAEjD,QAAM,gBACJ,MAAM,YAAY,QACd,QACE,MAAM,QAAQ;AAAA,IACd,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC;AAEP,MAAI,SAAS,aAAa,EAAG,QAAO,OAAO,WAAW;AAEtD,QAAM,UAAmB;AAAA,IACvB,MAAM,OAAO,IAAI,EAAE,KAAK;AAAA,IACxB,WAAW,gBAAgB,OAAO,IAAI,EAAE,KAAK,CAAC;AAAA,IAC9C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,QAAQ,IAAI,GAAG,QAAQ,SAAS;AAC1D,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,UAAU,MAAM,QAAQ,SAAS;AACvC,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO,aAAa,QAAQ,SAAS,mCAAmC;AACxE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,OAAO;AACL,UAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAAA,EAC5C;AAEA,OAAK,GAAG,IAAI,oBAAoB,SAAS,EAAE,GAAG,kBAAkB;AAEhE,QAAM,SAAS,WAAW,OAAO;AACjC,QAAM,QAAQ,oBAAoB;AAClC,QAAM,cAAc,WAAW,KAAK;AAEpC,MAAI,eAAe;AACjB,UAAM,eAAe,WAAW,IAAI,QAAQ,UAAU,KAAK,KAAK;AAAA,EAClE;AAEA,QAAM,MAAM,OAAO,EAAE;AACrB,QAAM,YAAY,CAAC,KAAK,GAAG,KAAK,IAAI,CAAC,IAAI,QAAQ,SAAS,EAAE;AAC5D,MAAI,CAAC,eAAe;AAClB,UAAM,CAAC,EAAE,IAAI,WAAW,EAAE;AAC1B,cAAU,KAAK,KAAK,GAAG,KAAK,KAAK,UAAU,CAAC,EAAE;AAAA,EAChD;AACA,YAAU,KAAK,KAAK,GAAG,KAAK,GAAG,CAAC,EAAE;AAElC;AAAA,IACE,CAAC,GAAG,MAAM,kBAAa,QAAQ,SAAS,EAAE,GAAG,IAAI,GAAG,WAAW,IAAI,GAAG,YAAY,KAAK,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;AAGA,eAAe,eACb,KACA,IACA,UACA,KACA,OACe;AACf,QAAM,CAAC,YAAY,WAAW,IAAI,WAAW,EAAE;AAC/C,UAAQ,OAAO,MAAM,WAAW,UAAU;AAAA,CAAwC;AAClF,QAAM,IAAI,YAAY,aAAa,GAAG;AACtC,MAAI,UAAU;AACZ,YAAQ,OAAO,MAAM,2BAA2B;AAChD,UAAM,CAAC,SAAS,QAAQ,IAAI,QAAQ,EAAE;AAEtC,UAAM,IAAI,SAAS,UAAU,KAAK;AAAA,MAChC,GAAG,QAAQ;AAAA,MACX,oBAAoB,MAAM;AAAA,MAC1B,uBAAuB,MAAM;AAAA,IAC/B,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,SAAS,KAAa,SAAiC;AAE3E,QAAM,gBAAgB,QAAQ,eAAe,aAAa,QAAQ,QAAQ,GAAG,GAAG;AAOhF,QAAM,eAAe,QAAQ,eAAe,WAAW,QAAQ,QAAQ;AACvE,MAAI,WAAW,YAAY,GAAG;AAC5B,UAAM,gBAAgB,cAAc,GAAG;AAAA,EACzC;AAGA,QAAM,UAAU,QAAQ,KAAK,kBAAkB,GAAG,aAAa,OAAO,GAAG,MAAM;AAG/E,QAAM,iBAAiB,KAAK,QAAQ,SAAS;AAC/C;AAEA,eAAe,iBAAiB,KAAa,MAA6B;AACxE,QAAM,UAAU,QAAQ,KAAK,cAAc;AAC3C,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,SAAS,MAAM,CAAC;AACtD,MAAI,MAAM,IAAI;AACd,MAAI,SAAS,IAAI;AACjB,QAAM,iBAAiB,oBAAoB;AAC3C,MAAI,eAAgB,KAAI,gBAAgB,IAAI;AAC5C,QAAM,UAAU,SAAS,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI,MAAM,MAAM;AACtE;AAEA,eAAe,gBAAgB,KAAa,MAA6B;AACvE,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,UAAM,IAAI,MAAM,iCAAiC,GAAG,EAAE;AAAA,EACxD;AACA,QAAM,GAAG,KAAK,MAAM;AAAA,IAClB,WAAW;AAAA,IACX,QAAQ,CAAC,WAAW,CAAC,OAAO,SAAS,cAAc;AAAA,EACrD,CAAC;AACD,QAAM,eAAe,IAAI;AAC3B;AAEA,eAAe,eAAe,KAA4B;AAGxD,QAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAC1D,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,YAAY,KAAK,MAAM,KAAK,WAAW,OAAO,GAAG;AAC1D,YAAM,OAAO,QAAQ,KAAK,MAAM,IAAI;AACpC,YAAM,UAAU,QAAQ,KAAK,MAAM,MAAM,KAAK,MAAM,CAAC,CAAC;AACtD,YAAM,UAAU,SAAS,MAAM,SAAS,IAAI,CAAC;AAC7C,YAAM,GAAG,IAAI;AAAA,IACf;AAAA,EACF;AACF;AAEA,SAAS,aAAa,SAA0B;AAC9C,SAAO;AAAA;AAAA;AAAA;AAAA,aAII,OAAO,QAAQ,IAAI,CAAC;AAAA,iBAChB,QAAQ,QAAQ;AAAA,eAClB,cAAc,QAAQ,QAAQ,CAAC;AAAA,iBAC7B,gBAAgB,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA,eAGnC,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAuCnB,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcpB;AAEA,SAAS,cAAc,UAAuC;AAC5D,SAAO,aAAa,QAAQ,UAAU;AACxC;AAEA,SAAS,gBAAgB,UAAuC;AAC9D,SAAO,aAAa,QAAQ,qBAAqB;AACnD;AAEA,SAAS,OAAO,GAAmB;AACjC,SAAO,EAAE,QAAQ,MAAM,KAAK;AAC9B;AAEA,SAAS,gBAAgB,MAAsB;AAC7C,SAAO,KACJ,YAAY,EACZ,QAAQ,iBAAiB,EAAE,EAC3B,KAAK,EACL,QAAQ,QAAQ,GAAG;AACxB;AAEA,IAAM,SAAiB,CAAC,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ;AAC5D,SAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,UAAM,QAAQ,MAAM,KAAK,MAAM,EAAE,KAAK,KAAK,OAAO,WAAW,OAAO,MAAM,CAAC;AAC3E,UAAM,GAAG,SAAS,MAAM;AACxB,UAAM,GAAG,QAAQ,CAAC,SAAS;AACzB,UAAI,SAAS,EAAG,QAAOA,SAAQ;AAC/B,aAAO,IAAI,MAAM,GAAG,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;AAAA,IAClE,CAAC;AAAA,EACH,CAAC;AACH;","names":["name","answers","targetDir","admin","resolve"]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { cp, readFile, mkdir, readdir, rm, writeFile } from 'node:fs/promises'\nimport { existsSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { fileURLToPath } from 'node:url'\nimport { spawn, spawnSync } from 'node:child_process'\nimport { randomBytes } from 'node:crypto'\nimport { cancel, confirm, intro, isCancel, note, outro, select, text } from '@clack/prompts'\nimport pc from 'picocolors'\n\nconst HERE = dirname(fileURLToPath(import.meta.url))\nconst SCAFFOLD_ROOT = resolve(HERE, '..', 'scaffold')\n\nexport type PackageManager = 'npm' | 'pnpm' | 'yarn-classic' | 'yarn-berry' | 'bun'\n\ninterface Answers {\n  name: string\n  directory: string\n  currency: 'GBP' | 'USD' | 'EUR'\n  template: 'astro' | 'nextjs'\n  seedDemo: boolean\n}\n\n/**\n * Runs a command in `cwd` (with `env` when given, else the process environment) and rejects on a non-zero exit.\n * Injected into `main` so tests do not shell out.\n */\nexport type Runner = (\n  cmd: string,\n  args: string[],\n  cwd: string,\n  env?: NodeJS.ProcessEnv,\n) => Promise<void>\n\n/** The port `renderConfig` gives the API, which serves the admin at /admin/. */\nconst API_PORT = 3001\n\ninterface AdminCredentials {\n  email: string\n  password: string\n}\n\n/** A fresh admin password per project (128 bits, base64url), so no two stores share the seed's default. */\nfunction newAdminCredentials(): AdminCredentials {\n  return { email: 'admin@nymbal.local', password: randomBytes(16).toString('base64url') }\n}\n\n/**\n * `.env` holds the admin credentials the seed (and a first `nymbal dev`) creates the admin from, and the project's own\n * key for the values the admin's Settings encrypt (32 random bytes, base64).\n */\nasync function writeAdminEnv(dir: string, admin: AdminCredentials): Promise<void> {\n  const lines = [\n    '# The admin account the seed creates. Keep this file out of version control (.gitignore lists it).',\n    `NYMBAL_ADMIN_EMAIL=${admin.email}`,\n    `NYMBAL_ADMIN_PASSWORD=${admin.password}`,\n    '',\n    \"# Encrypts the keys saved in the admin's Settings. Losing it loses them: back it up with your deploy's secrets.\",\n    `NYMBAL_SECRETS_KEY=${randomBytes(32).toString('base64')}`,\n    '',\n  ]\n  await writeFile(resolve(dir, '.env'), lines.join('\\n'), { encoding: 'utf8', mode: 0o600 })\n}\n\nfunction adminSignIn(admin: AdminCredentials): string[] {\n  return [\n    `Admin: http://localhost:${API_PORT}/admin/`,\n    `  email     ${admin.email}`,\n    `  password  ${admin.password} (saved in .env)`,\n  ]\n}\n\nexport interface MainDeps {\n  run?: Runner\n}\n\n/**\n * The `packageManager` field for the package manager that launched us (`npm_config_user_agent`), read when called.\n * Without a usable user agent it is the installed npm; undefined when npm cannot be run either.\n */\nfunction packageManagerField(): string | undefined {\n  const token = (process.env['npm_config_user_agent'] ?? '').split(' ')[0] ?? ''\n  const match = /^(npm|pnpm|yarn|bun)\\/(\\d+\\.\\d+\\.\\d+\\S*)$/.exec(token)\n  if (match) return `${match[1]}@${match[2]}`\n  const npm = spawnSync('npm', ['-v'], { encoding: 'utf8', shell: process.platform === 'win32' })\n  const version = npm.status === 0 ? npm.stdout.trim() : ''\n  return version ? `npm@${version}` : undefined\n}\n\nexport function detectPackageManager(): PackageManager {\n  const ua = process.env['npm_config_user_agent']\n  if (!ua) return 'npm'\n  const token = ua.split(' ')[0] ?? ''\n  const slash = token.indexOf('/')\n  const pm = slash >= 0 ? token.slice(0, slash) : token\n  const version = slash >= 0 ? token.slice(slash + 1) : ''\n  if (pm === 'pnpm') return 'pnpm'\n  if (pm === 'bun') return 'bun'\n  if (pm === 'yarn') {\n    const major = parseInt(version.split('.')[0] ?? '1', 10)\n    return major < 2 ? 'yarn-classic' : 'yarn-berry'\n  }\n  return 'npm'\n}\n\nfunction installCmd(pm: PackageManager): [string, string[]] {\n  switch (pm) {\n    case 'pnpm':\n      return ['pnpm', ['install']]\n    case 'bun':\n      return ['bun', ['install']]\n    case 'yarn-classic':\n    case 'yarn-berry':\n      return ['yarn', ['install']]\n    default:\n      return ['npm', ['install']]\n  }\n}\n\nfunction seedCmd(pm: PackageManager): [string, string[]] {\n  switch (pm) {\n    case 'pnpm':\n      return ['pnpm', ['exec', 'nymbal', 'seed']]\n    case 'bun':\n      return ['bunx', ['nymbal', 'seed']]\n    case 'yarn-classic':\n      return ['yarn', ['run', 'nymbal', 'seed']]\n    case 'yarn-berry':\n      return ['yarn', ['exec', 'nymbal', 'seed']]\n    default:\n      return ['npx', ['nymbal', 'seed']]\n  }\n}\n\nfunction devCmd(pm: PackageManager): string {\n  switch (pm) {\n    case 'pnpm':\n      return 'pnpm dev'\n    case 'bun':\n      return 'bun dev'\n    case 'yarn-classic':\n    case 'yarn-berry':\n      return 'yarn dev'\n    default:\n      return 'npm run dev'\n  }\n}\n\nconst TEMPLATES = ['astro', 'nextjs'] as const\nconst CURRENCIES = ['GBP', 'USD', 'EUR'] as const\n\nexport interface CliFlags {\n  name?: string\n  template?: (typeof TEMPLATES)[number]\n  currency?: (typeof CURRENCIES)[number]\n  yes: boolean\n  /** Present (false) only with `--no-install`. */\n  install?: boolean\n}\n\n/** A command-line flag that is missing its value or names a value outside the allowed set. */\nexport class CliFlagError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'CliFlagError'\n  }\n}\n\nfunction oneOf<T extends string>(flag: string, value: string, allowed: readonly T[]): T {\n  if ((allowed as readonly string[]).includes(value)) return value as T\n  throw new CliFlagError(`Unknown ${flag} \"${value}\". Allowed: ${allowed.join(', ')}`)\n}\n\n/** Parses process.argv (node and script first): --name, --template and --currency take `--flag v` or `--flag=v`. */\nexport function parseCliFlags(argv: string[]): CliFlags {\n  const flags: CliFlags = { yes: false }\n  const args = argv.slice(2)\n  let positional: string | undefined\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i]!\n    if (arg === '--yes' || arg === '-y') {\n      flags.yes = true\n      continue\n    }\n    if (arg === '--no-install') {\n      flags.install = false\n      continue\n    }\n    const match = /^--(name|template|currency)(?:=(.*))?$/s.exec(arg)\n    if (match) {\n      const flag = match[1]!\n      let value = match[2]\n      if (value === undefined) {\n        const next = args[i + 1]\n        if (next === undefined || next.startsWith('-'))\n          throw new CliFlagError(`--${flag} needs a value`)\n        value = next\n        i++\n      }\n      if (flag === 'name') flags.name = value\n      else if (flag === 'template') flags.template = oneOf('--template', value, TEMPLATES)\n      else flags.currency = oneOf('--currency', value, CURRENCIES)\n    } else if (!arg.startsWith('-') && positional === undefined) {\n      positional = arg\n    }\n  }\n  if (flags.name === undefined && positional !== undefined) flags.name = positional\n  return flags\n}\n\nexport async function main(argv: string[] = process.argv, deps: MainDeps = {}): Promise<void> {\n  const run = deps.run ?? runCmd\n  let flags: CliFlags\n  try {\n    flags = parseCliFlags(argv)\n  } catch (err) {\n    if (!(err instanceof CliFlagError)) throw err\n    process.stderr.write(`Error: ${err.message}\\n`)\n    process.exit(1)\n  }\n\n  const pm = detectPackageManager()\n\n  if (flags.yes) {\n    if (!flags.name) {\n      process.stderr.write('Error: --yes requires --name or a positional name argument\\n')\n      process.exit(1)\n    }\n    const name = flags.name.trim()\n    const answers: Answers = {\n      name,\n      directory: toDirectoryName(name),\n      currency: flags.currency ?? 'GBP',\n      template: flags.template ?? 'astro',\n      seedDemo: true,\n    }\n    const targetDir = resolve(process.cwd(), answers.directory)\n    if (existsSync(targetDir)) {\n      const entries = await readdir(targetDir)\n      if (entries.length > 0) {\n        process.stderr.write(\n          `Error: Directory ${answers.directory} already exists and is not empty.\\n`,\n        )\n        process.exit(1)\n      }\n    } else {\n      await mkdir(targetDir, { recursive: true })\n    }\n    await scaffold(targetDir, answers)\n    const admin = newAdminCredentials()\n    await writeAdminEnv(targetDir, admin)\n    process.stdout.write(`Created ${answers.directory}\\n`)\n    if (flags.install !== false) {\n      await installAndSeed(targetDir, pm, answers.seedDemo, run, admin)\n    } else {\n      process.stdout.write(`Next: cd ${answers.directory} && ${installCmd(pm)[0]} install\\n`)\n    }\n    process.stdout.write(`${adminSignIn(admin).join('\\n')}\\n`)\n    return\n  }\n\n  intro(pc.cyan(pc.bold('◆ create-nymbal-app')))\n\n  const name = flags.name\n    ? flags.name\n    : ((await text({\n        message: 'Store name',\n        placeholder: 'My Store',\n        validate: (v) => (!v || v.trim().length === 0 ? 'Required' : undefined),\n      })) as string | symbol)\n\n  if (isCancel(name)) return cancel('Cancelled')\n\n  type Currency = 'GBP' | 'USD' | 'EUR'\n  const currencyOptions: { value: Currency; label: string }[] = [\n    { value: 'GBP', label: 'GBP — British Pound' },\n    { value: 'USD', label: 'USD — US Dollar' },\n    { value: 'EUR', label: 'EUR — Euro' },\n  ]\n  const currency = await select({\n    message: 'Store currency',\n    options: currencyOptions,\n    initialValue: 'GBP' as Currency,\n  })\n\n  if (isCancel(currency)) return cancel('Cancelled')\n\n  type Template = 'astro' | 'nextjs'\n  const templateOptions: { value: Template; label: string }[] = [\n    { value: 'astro', label: 'Astro (recommended — performance-first)' },\n    { value: 'nextjs', label: 'Next.js (migration-friendly)' },\n  ]\n  const template = await select({\n    message: 'Storefront template',\n    options: templateOptions,\n    initialValue: 'astro' as Template,\n  })\n\n  if (isCancel(template)) return cancel('Cancelled')\n\n  const seedDemo = (await confirm({\n    message: 'Generate demo content?',\n    initialValue: true,\n  })) as boolean | symbol\n\n  if (isCancel(seedDemo)) return cancel('Cancelled')\n\n  const shouldInstall =\n    flags.install === false\n      ? false\n      : ((await confirm({\n          message: 'Install dependencies now?',\n          initialValue: true,\n        })) as boolean | symbol)\n\n  if (isCancel(shouldInstall)) return cancel('Cancelled')\n\n  const answers: Answers = {\n    name: String(name).trim(),\n    directory: toDirectoryName(String(name).trim()),\n    currency: currency as 'GBP' | 'USD' | 'EUR',\n    template: template as 'astro' | 'nextjs',\n    seedDemo: seedDemo as boolean,\n  }\n\n  const targetDir = resolve(process.cwd(), answers.directory)\n  if (existsSync(targetDir)) {\n    const entries = await readdir(targetDir)\n    if (entries.length > 0) {\n      cancel(`Directory ${answers.directory} already exists and is not empty.`)\n      process.exit(1)\n    }\n  } else {\n    await mkdir(targetDir, { recursive: true })\n  }\n\n  note(pc.dim(`Scaffolding into ${targetDir}`), 'Creating project')\n\n  await scaffold(targetDir, answers)\n  const admin = newAdminCredentials()\n  await writeAdminEnv(targetDir, admin)\n\n  if (shouldInstall) {\n    await installAndSeed(targetDir, pm, answers.seedDemo, run, admin)\n  }\n\n  const cmd = devCmd(pm)\n  const nextSteps = [`  ${pc.cyan('cd')} ${answers.directory}`]\n  if (!shouldInstall) {\n    const [ic] = installCmd(pm)\n    nextSteps.push(`  ${pc.cyan(ic + ' install')}`)\n  }\n  nextSteps.push(`  ${pc.cyan(cmd)}`)\n\n  outro(\n    [pc.green(`✓ Created ${answers.directory}`), '', ...nextSteps, '', ...adminSignIn(admin)].join(\n      '\\n',\n    ),\n  )\n}\n\n/** Install with the detected package manager, then seed through the project's own `nymbal` bin. */\nasync function installAndSeed(\n  dir: string,\n  pm: PackageManager,\n  seedDemo: boolean,\n  run: Runner,\n  admin: AdminCredentials,\n): Promise<void> {\n  const [installBin, installArgs] = installCmd(pm)\n  process.stdout.write(`Running ${installBin} install (this may take a moment)...\\n`)\n  await run(installBin, installArgs, dir)\n  if (seedDemo) {\n    process.stdout.write('Seeding demo content...\\n')\n    const [seedBin, seedArgs] = seedCmd(pm)\n    // Explicit, so a value exported in the shell cannot replace the one in .env and the outro.\n    await run(seedBin, seedArgs, dir, {\n      ...process.env,\n      NYMBAL_ADMIN_EMAIL: admin.email,\n      NYMBAL_ADMIN_PASSWORD: admin.password,\n    })\n  }\n}\n\nexport async function scaffold(dir: string, answers: Answers): Promise<void> {\n  // Copy the chosen template directly into dir (flat — no storefront/ subdirectory)\n  await copyScaffoldDir(resolve(SCAFFOLD_ROOT, 'templates', answers.template), dir)\n\n  // Overlay the project layer (scaffold/project/<template>) on top of the template\n  // defaults. Project files WIN on path collision — this is the override model:\n  // anything in the project layer shadows the template default at the same path.\n  // scaffold/project/ lives outside scaffold/templates/, so sync-scaffold's\n  // rm -rf of scaffold/templates/* never deletes it.\n  const projectLayer = resolve(SCAFFOLD_ROOT, 'project', answers.template)\n  if (existsSync(projectLayer)) {\n    await copyScaffoldDir(projectLayer, dir)\n  }\n\n  // Write nymbal.config.ts (answers-dependent, so generated at runtime)\n  await writeFile(resolve(dir, 'nymbal.config.ts'), renderConfig(answers), 'utf8')\n\n  // Patch the copied package.json: set name to the project directory name\n  await patchPackageJson(dir, answers.directory)\n}\n\nasync function patchPackageJson(dir: string, name: string): Promise<void> {\n  const pkgPath = resolve(dir, 'package.json')\n  const pkg = JSON.parse(await readFile(pkgPath, 'utf8')) as Record<string, unknown>\n  pkg['name'] = name\n  pkg['private'] = true\n  const packageManager = packageManagerField()\n  if (packageManager) pkg['packageManager'] = packageManager\n  await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\\n', 'utf8')\n}\n\nasync function copyScaffoldDir(src: string, dest: string): Promise<void> {\n  if (!existsSync(src)) {\n    throw new Error(`Scaffold directory not found: ${src}`)\n  }\n  await cp(src, dest, {\n    recursive: true,\n    filter: (source) => !source.endsWith('node_modules'),\n  })\n  await renameDotFiles(dest)\n}\n\nasync function renameDotFiles(dir: string): Promise<void> {\n  // Non-recursive: only rename _dot.* files at the project root.\n  // All shared dotfiles (_dot.gitignore, _dot.env.example) live at template root.\n  const entries = await readdir(dir, { withFileTypes: true })\n  for (const entry of entries) {\n    if (!entry.isDirectory() && entry.name.startsWith('_dot.')) {\n      const full = resolve(dir, entry.name)\n      const renamed = resolve(dir, '.' + entry.name.slice(5))\n      await writeFile(renamed, await readFile(full))\n      await rm(full)\n    }\n  }\n}\n\nfunction renderConfig(answers: Answers): string {\n  return `import { defineConfig } from '@nymbalhq/config'\n\nexport default defineConfig({\n  store: {\n    name: '${escape(answers.name)}',\n    currency: '${answers.currency}',\n    locale: '${defaultLocale(answers.currency)}',\n    timezone: '${defaultTimezone(answers.currency)}',\n  },\n\n  template: '${answers.template}',\n\n  infrastructure: {\n    commandStore: 'sqlite',\n    documentStore: 'in-memory',\n    eventBus: 'in-process',\n  },\n\n  security: {\n    adapter: 'middleware',\n    rateLimit: {\n      '/checkout': { requests: 10, window: '1m', action: 'block' },\n      '/auth/*': { requests: 5, window: '1m', action: 'challenge' },\n      '/api/*': { requests: 100, window: '1m', action: 'throttle' },\n      '/webhooks/*': { requests: 200, window: '1m', action: 'throttle' },\n    },\n    botProtection: { mode: 'managed', allowList: ['googlebot', 'bingbot', 'stripe-webhooks'] },\n    headers: {\n      hsts: true,\n      contentSecurityPolicy: 'strict',\n      referrerPolicy: 'strict-origin-when-cross-origin',\n      xFrameOptions: 'deny',\n    },\n    csrf: true,\n  },\n\n  commerce: {\n    payments: { provider: 'native' },\n    email: { provider: 'native' },\n    reviews: { provider: 'native' },\n    search: { provider: 'native' },\n    analytics: { provider: 'native' },\n    shipping: { provider: 'native' },\n    tax: { provider: 'native' },\n    ai: { provider: 'none' },\n  },\n\n  http: {\n    adapter: 'fastify',\n    port: ${API_PORT},\n  },\n\n  deployment: {\n    strategy: 'standard',\n  },\n\n  features: {\n    staging: false,\n    heartbeat: false,\n    autoUpdates: false,\n  },\n})\n`\n}\n\nfunction defaultLocale(currency: Answers['currency']): string {\n  return currency === 'USD' ? 'en-US' : 'en-GB'\n}\n\nfunction defaultTimezone(currency: Answers['currency']): string {\n  return currency === 'USD' ? 'America/New_York' : 'Europe/London'\n}\n\nfunction escape(v: string): string {\n  return v.replace(/'/g, \"\\\\'\")\n}\n\nfunction toDirectoryName(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9-_ ]/g, '')\n    .trim()\n    .replace(/\\s+/g, '-')\n}\n\nconst runCmd: Runner = (cmd, args, cwd, env = process.env) => {\n  return new Promise((resolve, reject) => {\n    const child = spawn(cmd, args, { cwd, env, stdio: 'inherit', shell: false })\n    child.on('error', reject)\n    child.on('exit', (code) => {\n      if (code === 0) return resolve()\n      reject(new Error(`${cmd} ${args.join(' ')} exited with ${code}`))\n    })\n  })\n}\n"],"mappings":";AAAA,SAAS,IAAI,UAAU,OAAO,SAAS,IAAI,iBAAiB;AAC5D,SAAS,kBAAkB;AAC3B,SAAS,SAAS,eAAe;AACjC,SAAS,qBAAqB;AAC9B,SAAS,OAAO,iBAAiB;AACjC,SAAS,mBAAmB;AAC5B,SAAS,QAAQ,SAAS,OAAO,UAAU,MAAM,OAAO,QAAQ,YAAY;AAC5E,OAAO,QAAQ;AAEf,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,gBAAgB,QAAQ,MAAM,MAAM,UAAU;AAwBpD,IAAM,WAAW;AAQjB,SAAS,sBAAwC;AAC/C,SAAO,EAAE,OAAO,sBAAsB,UAAU,YAAY,EAAE,EAAE,SAAS,WAAW,EAAE;AACxF;AAMA,eAAe,cAAc,KAAa,OAAwC;AAChF,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,sBAAsB,MAAM,KAAK;AAAA,IACjC,yBAAyB,MAAM,QAAQ;AAAA,IACvC;AAAA,IACA;AAAA,IACA,sBAAsB,YAAY,EAAE,EAAE,SAAS,QAAQ,CAAC;AAAA,IACxD;AAAA,EACF;AACA,QAAM,UAAU,QAAQ,KAAK,MAAM,GAAG,MAAM,KAAK,IAAI,GAAG,EAAE,UAAU,QAAQ,MAAM,IAAM,CAAC;AAC3F;AAEA,SAAS,YAAY,OAAmC;AACtD,SAAO;AAAA,IACL,2BAA2B,QAAQ;AAAA,IACnC,eAAe,MAAM,KAAK;AAAA,IAC1B,eAAe,MAAM,QAAQ;AAAA,EAC/B;AACF;AAUA,SAAS,sBAA0C;AACjD,QAAM,SAAS,QAAQ,IAAI,uBAAuB,KAAK,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK;AAC5E,QAAM,QAAQ,4CAA4C,KAAK,KAAK;AACpE,MAAI,MAAO,QAAO,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AACzC,QAAM,MAAM,UAAU,OAAO,CAAC,IAAI,GAAG,EAAE,UAAU,QAAQ,OAAO,QAAQ,aAAa,QAAQ,CAAC;AAC9F,QAAM,UAAU,IAAI,WAAW,IAAI,IAAI,OAAO,KAAK,IAAI;AACvD,SAAO,UAAU,OAAO,OAAO,KAAK;AACtC;AAEO,SAAS,uBAAuC;AACrD,QAAM,KAAK,QAAQ,IAAI,uBAAuB;AAC9C,MAAI,CAAC,GAAI,QAAO;AAChB,QAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,CAAC,KAAK;AAClC,QAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,QAAM,KAAK,SAAS,IAAI,MAAM,MAAM,GAAG,KAAK,IAAI;AAChD,QAAM,UAAU,SAAS,IAAI,MAAM,MAAM,QAAQ,CAAC,IAAI;AACtD,MAAI,OAAO,OAAQ,QAAO;AAC1B,MAAI,OAAO,MAAO,QAAO;AACzB,MAAI,OAAO,QAAQ;AACjB,UAAM,QAAQ,SAAS,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE;AACvD,WAAO,QAAQ,IAAI,iBAAiB;AAAA,EACtC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,IAAwC;AAC1D,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;AAAA,IAC7B,KAAK;AACH,aAAO,CAAC,OAAO,CAAC,SAAS,CAAC;AAAA,IAC5B,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;AAAA,IAC7B;AACE,aAAO,CAAC,OAAO,CAAC,SAAS,CAAC;AAAA,EAC9B;AACF;AAEA,SAAS,QAAQ,IAAwC;AACvD,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,QAAQ,UAAU,MAAM,CAAC;AAAA,IAC5C,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,UAAU,MAAM,CAAC;AAAA,IACpC,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,OAAO,UAAU,MAAM,CAAC;AAAA,IAC3C,KAAK;AACH,aAAO,CAAC,QAAQ,CAAC,QAAQ,UAAU,MAAM,CAAC;AAAA,IAC5C;AACE,aAAO,CAAC,OAAO,CAAC,UAAU,MAAM,CAAC;AAAA,EACrC;AACF;AAEA,SAAS,OAAO,IAA4B;AAC1C,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,IAAM,YAAY,CAAC,SAAS,QAAQ;AACpC,IAAM,aAAa,CAAC,OAAO,OAAO,KAAK;AAYhC,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,MAAwB,MAAc,OAAe,SAA0B;AACtF,MAAK,QAA8B,SAAS,KAAK,EAAG,QAAO;AAC3D,QAAM,IAAI,aAAa,WAAW,IAAI,KAAK,KAAK,eAAe,QAAQ,KAAK,IAAI,CAAC,EAAE;AACrF;AAGO,SAAS,cAAc,MAA0B;AACtD,QAAM,QAAkB,EAAE,KAAK,MAAM;AACrC,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,MAAI;AACJ,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,QAAQ,WAAW,QAAQ,MAAM;AACnC,YAAM,MAAM;AACZ;AAAA,IACF;AACA,QAAI,QAAQ,gBAAgB;AAC1B,YAAM,UAAU;AAChB;AAAA,IACF;AACA,UAAM,QAAQ,0CAA0C,KAAK,GAAG;AAChE,QAAI,OAAO;AACT,YAAM,OAAO,MAAM,CAAC;AACpB,UAAI,QAAQ,MAAM,CAAC;AACnB,UAAI,UAAU,QAAW;AACvB,cAAM,OAAO,KAAK,IAAI,CAAC;AACvB,YAAI,SAAS,UAAa,KAAK,WAAW,GAAG;AAC3C,gBAAM,IAAI,aAAa,KAAK,IAAI,gBAAgB;AAClD,gBAAQ;AACR;AAAA,MACF;AACA,UAAI,SAAS,OAAQ,OAAM,OAAO;AAAA,eACzB,SAAS,WAAY,OAAM,WAAW,MAAM,cAAc,OAAO,SAAS;AAAA,UAC9E,OAAM,WAAW,MAAM,cAAc,OAAO,UAAU;AAAA,IAC7D,WAAW,CAAC,IAAI,WAAW,GAAG,KAAK,eAAe,QAAW;AAC3D,mBAAa;AAAA,IACf;AAAA,EACF;AACA,MAAI,MAAM,SAAS,UAAa,eAAe,OAAW,OAAM,OAAO;AACvE,SAAO;AACT;AAEA,eAAsB,KAAK,OAAiB,QAAQ,MAAM,OAAiB,CAAC,GAAkB;AAC5F,QAAM,MAAM,KAAK,OAAO;AACxB,MAAI;AACJ,MAAI;AACF,YAAQ,cAAc,IAAI;AAAA,EAC5B,SAAS,KAAK;AACZ,QAAI,EAAE,eAAe,cAAe,OAAM;AAC1C,YAAQ,OAAO,MAAM,UAAU,IAAI,OAAO;AAAA,CAAI;AAC9C,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,KAAK,qBAAqB;AAEhC,MAAI,MAAM,KAAK;AACb,QAAI,CAAC,MAAM,MAAM;AACf,cAAQ,OAAO,MAAM,8DAA8D;AACnF,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,UAAMA,QAAO,MAAM,KAAK,KAAK;AAC7B,UAAMC,WAAmB;AAAA,MACvB,MAAAD;AAAA,MACA,WAAW,gBAAgBA,KAAI;AAAA,MAC/B,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU;AAAA,IACZ;AACA,UAAME,aAAY,QAAQ,QAAQ,IAAI,GAAGD,SAAQ,SAAS;AAC1D,QAAI,WAAWC,UAAS,GAAG;AACzB,YAAM,UAAU,MAAM,QAAQA,UAAS;AACvC,UAAI,QAAQ,SAAS,GAAG;AACtB,gBAAQ,OAAO;AAAA,UACb,oBAAoBD,SAAQ,SAAS;AAAA;AAAA,QACvC;AACA,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF,OAAO;AACL,YAAM,MAAMC,YAAW,EAAE,WAAW,KAAK,CAAC;AAAA,IAC5C;AACA,UAAM,SAASA,YAAWD,QAAO;AACjC,UAAME,SAAQ,oBAAoB;AAClC,UAAM,cAAcD,YAAWC,MAAK;AACpC,YAAQ,OAAO,MAAM,WAAWF,SAAQ,SAAS;AAAA,CAAI;AACrD,QAAI,MAAM,YAAY,OAAO;AAC3B,YAAM,eAAeC,YAAW,IAAID,SAAQ,UAAU,KAAKE,MAAK;AAAA,IAClE,OAAO;AACL,cAAQ,OAAO,MAAM,YAAYF,SAAQ,SAAS,OAAO,WAAW,EAAE,EAAE,CAAC,CAAC;AAAA,CAAY;AAAA,IACxF;AACA,YAAQ,OAAO,MAAM,GAAG,YAAYE,MAAK,EAAE,KAAK,IAAI,CAAC;AAAA,CAAI;AACzD;AAAA,EACF;AAEA,QAAM,GAAG,KAAK,GAAG,KAAK,0BAAqB,CAAC,CAAC;AAE7C,QAAM,OAAO,MAAM,OACf,MAAM,OACJ,MAAM,KAAK;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,UAAU,CAAC,MAAO,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa;AAAA,EAC/D,CAAC;AAEL,MAAI,SAAS,IAAI,EAAG,QAAO,OAAO,WAAW;AAG7C,QAAM,kBAAwD;AAAA,IAC5D,EAAE,OAAO,OAAO,OAAO,2BAAsB;AAAA,IAC7C,EAAE,OAAO,OAAO,OAAO,uBAAkB;AAAA,IACzC,EAAE,OAAO,OAAO,OAAO,kBAAa;AAAA,EACtC;AACA,QAAM,WAAW,MAAM,OAAO;AAAA,IAC5B,SAAS;AAAA,IACT,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC;AAED,MAAI,SAAS,QAAQ,EAAG,QAAO,OAAO,WAAW;AAGjD,QAAM,kBAAwD;AAAA,IAC5D,EAAE,OAAO,SAAS,OAAO,+CAA0C;AAAA,IACnE,EAAE,OAAO,UAAU,OAAO,+BAA+B;AAAA,EAC3D;AACA,QAAM,WAAW,MAAM,OAAO;AAAA,IAC5B,SAAS;AAAA,IACT,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC;AAED,MAAI,SAAS,QAAQ,EAAG,QAAO,OAAO,WAAW;AAEjD,QAAM,WAAY,MAAM,QAAQ;AAAA,IAC9B,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC;AAED,MAAI,SAAS,QAAQ,EAAG,QAAO,OAAO,WAAW;AAEjD,QAAM,gBACJ,MAAM,YAAY,QACd,QACE,MAAM,QAAQ;AAAA,IACd,SAAS;AAAA,IACT,cAAc;AAAA,EAChB,CAAC;AAEP,MAAI,SAAS,aAAa,EAAG,QAAO,OAAO,WAAW;AAEtD,QAAM,UAAmB;AAAA,IACvB,MAAM,OAAO,IAAI,EAAE,KAAK;AAAA,IACxB,WAAW,gBAAgB,OAAO,IAAI,EAAE,KAAK,CAAC;AAAA,IAC9C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,QAAQ,IAAI,GAAG,QAAQ,SAAS;AAC1D,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,UAAU,MAAM,QAAQ,SAAS;AACvC,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO,aAAa,QAAQ,SAAS,mCAAmC;AACxE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,OAAO;AACL,UAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAAA,EAC5C;AAEA,OAAK,GAAG,IAAI,oBAAoB,SAAS,EAAE,GAAG,kBAAkB;AAEhE,QAAM,SAAS,WAAW,OAAO;AACjC,QAAM,QAAQ,oBAAoB;AAClC,QAAM,cAAc,WAAW,KAAK;AAEpC,MAAI,eAAe;AACjB,UAAM,eAAe,WAAW,IAAI,QAAQ,UAAU,KAAK,KAAK;AAAA,EAClE;AAEA,QAAM,MAAM,OAAO,EAAE;AACrB,QAAM,YAAY,CAAC,KAAK,GAAG,KAAK,IAAI,CAAC,IAAI,QAAQ,SAAS,EAAE;AAC5D,MAAI,CAAC,eAAe;AAClB,UAAM,CAAC,EAAE,IAAI,WAAW,EAAE;AAC1B,cAAU,KAAK,KAAK,GAAG,KAAK,KAAK,UAAU,CAAC,EAAE;AAAA,EAChD;AACA,YAAU,KAAK,KAAK,GAAG,KAAK,GAAG,CAAC,EAAE;AAElC;AAAA,IACE,CAAC,GAAG,MAAM,kBAAa,QAAQ,SAAS,EAAE,GAAG,IAAI,GAAG,WAAW,IAAI,GAAG,YAAY,KAAK,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;AAGA,eAAe,eACb,KACA,IACA,UACA,KACA,OACe;AACf,QAAM,CAAC,YAAY,WAAW,IAAI,WAAW,EAAE;AAC/C,UAAQ,OAAO,MAAM,WAAW,UAAU;AAAA,CAAwC;AAClF,QAAM,IAAI,YAAY,aAAa,GAAG;AACtC,MAAI,UAAU;AACZ,YAAQ,OAAO,MAAM,2BAA2B;AAChD,UAAM,CAAC,SAAS,QAAQ,IAAI,QAAQ,EAAE;AAEtC,UAAM,IAAI,SAAS,UAAU,KAAK;AAAA,MAChC,GAAG,QAAQ;AAAA,MACX,oBAAoB,MAAM;AAAA,MAC1B,uBAAuB,MAAM;AAAA,IAC/B,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,SAAS,KAAa,SAAiC;AAE3E,QAAM,gBAAgB,QAAQ,eAAe,aAAa,QAAQ,QAAQ,GAAG,GAAG;AAOhF,QAAM,eAAe,QAAQ,eAAe,WAAW,QAAQ,QAAQ;AACvE,MAAI,WAAW,YAAY,GAAG;AAC5B,UAAM,gBAAgB,cAAc,GAAG;AAAA,EACzC;AAGA,QAAM,UAAU,QAAQ,KAAK,kBAAkB,GAAG,aAAa,OAAO,GAAG,MAAM;AAG/E,QAAM,iBAAiB,KAAK,QAAQ,SAAS;AAC/C;AAEA,eAAe,iBAAiB,KAAa,MAA6B;AACxE,QAAM,UAAU,QAAQ,KAAK,cAAc;AAC3C,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,SAAS,MAAM,CAAC;AACtD,MAAI,MAAM,IAAI;AACd,MAAI,SAAS,IAAI;AACjB,QAAM,iBAAiB,oBAAoB;AAC3C,MAAI,eAAgB,KAAI,gBAAgB,IAAI;AAC5C,QAAM,UAAU,SAAS,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI,MAAM,MAAM;AACtE;AAEA,eAAe,gBAAgB,KAAa,MAA6B;AACvE,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,UAAM,IAAI,MAAM,iCAAiC,GAAG,EAAE;AAAA,EACxD;AACA,QAAM,GAAG,KAAK,MAAM;AAAA,IAClB,WAAW;AAAA,IACX,QAAQ,CAAC,WAAW,CAAC,OAAO,SAAS,cAAc;AAAA,EACrD,CAAC;AACD,QAAM,eAAe,IAAI;AAC3B;AAEA,eAAe,eAAe,KAA4B;AAGxD,QAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAC1D,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,YAAY,KAAK,MAAM,KAAK,WAAW,OAAO,GAAG;AAC1D,YAAM,OAAO,QAAQ,KAAK,MAAM,IAAI;AACpC,YAAM,UAAU,QAAQ,KAAK,MAAM,MAAM,KAAK,MAAM,CAAC,CAAC;AACtD,YAAM,UAAU,SAAS,MAAM,SAAS,IAAI,CAAC;AAC7C,YAAM,GAAG,IAAI;AAAA,IACf;AAAA,EACF;AACF;AAEA,SAAS,aAAa,SAA0B;AAC9C,SAAO;AAAA;AAAA;AAAA;AAAA,aAII,OAAO,QAAQ,IAAI,CAAC;AAAA,iBAChB,QAAQ,QAAQ;AAAA,eAClB,cAAc,QAAQ,QAAQ,CAAC;AAAA,iBAC7B,gBAAgB,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA,eAGnC,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAuCnB,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcpB;AAEA,SAAS,cAAc,UAAuC;AAC5D,SAAO,aAAa,QAAQ,UAAU;AACxC;AAEA,SAAS,gBAAgB,UAAuC;AAC9D,SAAO,aAAa,QAAQ,qBAAqB;AACnD;AAEA,SAAS,OAAO,GAAmB;AACjC,SAAO,EAAE,QAAQ,MAAM,KAAK;AAC9B;AAEA,SAAS,gBAAgB,MAAsB;AAC7C,SAAO,KACJ,YAAY,EACZ,QAAQ,iBAAiB,EAAE,EAC3B,KAAK,EACL,QAAQ,QAAQ,GAAG;AACxB;AAEA,IAAM,SAAiB,CAAC,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ;AAC5D,SAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,UAAM,QAAQ,MAAM,KAAK,MAAM,EAAE,KAAK,KAAK,OAAO,WAAW,OAAO,MAAM,CAAC;AAC3E,UAAM,GAAG,SAAS,MAAM;AACxB,UAAM,GAAG,QAAQ,CAAC,SAAS;AACzB,UAAI,SAAS,EAAG,QAAOA,SAAQ;AAC/B,aAAO,IAAI,MAAM,GAAG,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;AAAA,IAClE,CAAC;AAAA,EACH,CAAC;AACH;","names":["name","answers","targetDir","admin","resolve"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nymbal-app",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Scaffold a new Nymbal commerce project",
   "license": "MIT",
   "repository": {
@@ -30,8 +30,9 @@
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "tsup": "^8.3.5",
-    "typescript": "^5.6.3",
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "tsup": "^9.0.0",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^3.0.0"
   },
   "scripts": {
@@ -39,6 +40,6 @@
     "dev": "tsup --watch",
     "sync:scaffold": "node ./scripts/sync-scaffold.mjs",
     "test": "vitest run",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.json --noEmit --rootDir ../.."
   }
 }

package/scaffold/project/astro/src/pages/index.astro

@@ -1,9 +1,9 @@
 ---
 import '../styles/pages/home.css'
+import NymbalElement from '@nymbalhq/web-components/astro'
+import { cardProductOf } from '@nymbalhq/web-components/ssr'
 import BaseLayout from '../layouts/BaseLayout.astro'
 import HeroSection from '../components/HeroSection.astro'
-import CategoryNav from '../components/CategoryNav.astro'
-import ProductCard from '../components/ProductCard.astro'
 import NewsletterSignup from '../components/NewsletterSignup.astro'
 import { fetchProducts, fetchCategories } from '../lib/api'
 import { organizationJsonLd } from '../lib/seo'
@@ -13,7 +13,6 @@ const [productResult, categories] = await Promise.all([
   fetchCategories(),
 ])
 
-const products = productResult.items
 const jsonLd = organizationJsonLd('Nymbal', Astro.url.origin)
 ---
 
@@ -30,7 +29,7 @@ const jsonLd = organizationJsonLd('Nymbal', Astro.url.origin)
       Welcome to your store — this homepage is yours to customise.
     </p>
     <h2 class="section-title">Shop by Category</h2>
-    <CategoryNav categories={categories} />
+    <NymbalElement tag="nymbal-category-nav" attributes={{ categories: JSON.stringify(categories) }} />
   </section>
 
   <section class="featured-section section">
@@ -39,19 +38,18 @@ const jsonLd = organizationJsonLd('Nymbal', Astro.url.origin)
         <h2 class="section-title" style="margin-bottom: 0;">Our Featured Picks</h2>
         <a href="/products" class="featured-link">View all</a>
       </div>
-      {products.length > 0 ? (
-        <div class="product-grid">
-          {products.map((product) => (
-            <ProductCard product={product} />
-          ))}
-        </div>
-      ) : (
-        <p style="text-align: center; color: var(--nymbal-color-text-muted, #71717a);">
-          Products coming soon.
-        </p>
-      )}
+      <NymbalElement tag="nymbal-product-grid" attributes={{ products: JSON.stringify(productResult.items.map(cardProductOf)) }} />
     </div>
   </section>
 
   <NewsletterSignup />
 </BaseLayout>
+
+<script>
+  import '../lib/client.js'
+  import { NymbalCategoryNav } from '@nymbalhq/web-components/elements/nymbal-category-nav'
+  import { NymbalProductGrid } from '@nymbalhq/web-components/elements/nymbal-product-grid'
+
+  NymbalCategoryNav.define()
+  NymbalProductGrid.define()
+</script>

package/scaffold/templates/astro/_dot.node-version

@@ -1 +1 @@
-22.23.3
+26.12.1

package/scaffold/templates/astro/astro.config.mjs

@@ -1,6 +1,26 @@
+import { fileURLToPath } from 'node:url'
 import { defineConfig } from 'astro/config'
 import node from '@astrojs/node'
 
+const OWN_ELEMENTS = fileURLToPath(new URL('./src/elements/index.ts', import.meta.url))
+
+/**
+ * NYMBAL_ELEMENTS_ENTRY (an absolute path) is the store's elements entry in place of src/elements/index.ts, on the
+ * server and in the browser (the E2E override fixture).
+ */
+function elementsEntry(entry) {
+  return {
+    name: 'nymbal-elements-entry',
+    enforce: 'pre',
+    async resolveId(source, importer, options) {
+      if (importer === undefined || importer === entry) return null
+      const resolved = await this.resolve(source, importer, { ...options, skipSelf: true })
+      return resolved?.id === OWN_ELEMENTS ? entry : null
+    },
+  }
+}
+const elementsEntryPath = process.env.NYMBAL_ELEMENTS_ENTRY
+
 // NYMBAL_STOREFRONT_PORT lets `nymbal dev` (and a developer) pick a free port
 // when the default 4321 is taken by another project. The `astro dev --port`
 // flag still overrides this, so `nymbal dev` (which passes --port explicitly)
@@ -11,4 +31,7 @@ export default defineConfig({
   output: 'server',
   adapter: node({ mode: 'standalone' }),
   server: { port },
+  // The page's CSS travels in its HTML, so the first paint waits on no stylesheet request (perf-budgets.json: LCP).
+  build: { inlineStylesheets: 'always' },
+  vite: { plugins: elementsEntryPath ? [elementsEntry(elementsEntryPath)] : [] },
 })

package/scaffold/templates/astro/package.json

@@ -17,42 +17,42 @@
     "seed": "nymbal seed"
   },
   "dependencies": {
-    "nymbal": "1.1.0",
-    "@nymbalhq/config": "1.1.0",
-    "@nymbalhq/platform": "1.1.0",
-    "@nymbalhq/stack": "1.1.0",
+    "nymbal": "1.2.0",
+    "@nymbalhq/config": "1.2.0",
+    "@nymbalhq/platform": "1.2.0",
+    "@nymbalhq/stack": "1.2.0",
     "@astrojs/node": "^11.1.8",
-    "@nymbalhq/sdk": "1.1.0",
-    "@nymbalhq/types": "1.1.0",
-    "@nymbalhq/web-components": "1.1.0",
+    "@nymbalhq/sdk": "1.2.0",
+    "@nymbalhq/types": "1.2.0",
+    "@nymbalhq/web-components": "1.2.0",
     "astro": "^7.4.0"
   },
   "devDependencies": {
     "@astrojs/check": "^0.9.10",
-    "typescript": "^5.6.3"
+    "typescript": "npm:@typescript/typescript6@^6.0.2"
   },
   "pnpm": {
     "overrides": {
-      "nymbal": "1.1.0",
-      "@nymbalhq/config": "1.1.0",
-      "@nymbalhq/http": "1.1.0",
-      "@nymbalhq/platform": "1.1.0",
-      "@nymbalhq/react": "1.1.0",
-      "@nymbalhq/sdk": "1.1.0",
-      "@nymbalhq/stack": "1.1.0",
-      "@nymbalhq/types": "1.1.0",
-      "@nymbalhq/web-components": "1.1.0"
+      "nymbal": "1.2.0",
+      "@nymbalhq/config": "1.2.0",
+      "@nymbalhq/http": "1.2.0",
+      "@nymbalhq/platform": "1.2.0",
+      "@nymbalhq/react": "1.2.0",
+      "@nymbalhq/sdk": "1.2.0",
+      "@nymbalhq/stack": "1.2.0",
+      "@nymbalhq/types": "1.2.0",
+      "@nymbalhq/web-components": "1.2.0"
     }
   },
   "overrides": {
-    "nymbal": "1.1.0",
-    "@nymbalhq/config": "1.1.0",
-    "@nymbalhq/http": "1.1.0",
-    "@nymbalhq/platform": "1.1.0",
-    "@nymbalhq/react": "1.1.0",
-    "@nymbalhq/sdk": "1.1.0",
-    "@nymbalhq/stack": "1.1.0",
-    "@nymbalhq/types": "1.1.0",
-    "@nymbalhq/web-components": "1.1.0"
+    "nymbal": "1.2.0",
+    "@nymbalhq/config": "1.2.0",
+    "@nymbalhq/http": "1.2.0",
+    "@nymbalhq/platform": "1.2.0",
+    "@nymbalhq/react": "1.2.0",
+    "@nymbalhq/sdk": "1.2.0",
+    "@nymbalhq/stack": "1.2.0",
+    "@nymbalhq/types": "1.2.0",
+    "@nymbalhq/web-components": "1.2.0"
   }
 }

package/scaffold/templates/astro/src/components/SkipNav.astro

@@ -1,3 +1,5 @@
 ---
+// In a landmark of its own: the header's links are in its shadow root, where a checker cannot tell the skip link
+// comes before them, so it would count it as content outside every landmark.
 ---
-<a href="#main" class="skip-nav">Skip to main content</a>
+<nav aria-label="Skip link"><a href="#main" class="skip-nav">Skip to main content</a></nav>

package/scaffold/templates/astro/src/elements/index.ts

@@ -0,0 +1,11 @@
+// This store's own elements. Everything here runs before any Nymbal element is defined (src/lib/client.ts runs it
+// first, and every page script imports that), and Nymbal leaves alone any tag that is already defined, so an element
+// defined here under a Nymbal tag replaces Nymbal's. The server renders Nymbal's elements too, so a replacement is
+// also named in `serverElements`, and the server renders it under the tag (src/lib/server-elements.ts). Import
+// @nymbalhq/web-components/hydrate-support before lit, so the element takes over what the server rendered:
+//
+//   import '@nymbalhq/web-components/hydrate-support'
+//   import { MyMiniCart } from './my-mini-cart.js'
+//   if (typeof window !== 'undefined') customElements.define('nymbal-mini-cart', MyMiniCart)
+//   export const serverElements = { 'nymbal-mini-cart': MyMiniCart }
+export const serverElements = {}

package/scaffold/templates/astro/src/layouts/BaseLayout.astro

@@ -1,17 +1,24 @@
 ---
 import '../styles/global.css'
+import NymbalElement from '@nymbalhq/web-components/astro'
 import SkipNav from '../components/SkipNav.astro'
-import Header from '../components/Header.astro'
-import Footer from '../components/Footer.astro'
+import { FOOTER, HEADER, headerSlots } from '../lib/chrome'
+import { fetchCapabilities, fetchCart, type CartProjection } from '../lib/api'
 
 interface Props {
   title: string
   description?: string
   ogImage?: string
   jsonLd?: Record<string, unknown>
+  /** The shopper's cart, when the page has read it already (fetchCart); the layout reads it otherwise. */
+  cart?: CartProjection | null
 }
 
 const { title, description = 'Shop the Nymbal store', ogImage, jsonLd } = Astro.props
+const cart =
+  Astro.props.cart !== undefined ? Astro.props.cart : await fetchCart(Astro.request.headers.get('cookie'))
+const capabilities = await fetchCapabilities()
+const canSearch = capabilities?.search.capabilities.includes('search') ?? false
 const canonicalUrl = Astro.url.href
 ---
 <!doctype html>
@@ -22,6 +29,8 @@ const canonicalUrl = Astro.url.href
     <title>{title}</title>
     <meta name="description" content={description} />
     <link rel="canonical" href={canonicalUrl} />
+    <!-- A page's own head links, early: the product page preloads its LCP image here. -->
+    <slot name="head" />
 
     <!-- Open Graph -->
     <meta property="og:title" content={title} />
@@ -37,11 +46,13 @@ const canonicalUrl = Astro.url.href
   </head>
   <body>
     <SkipNav />
-    <Header />
+    <NymbalElement tag="nymbal-site-header" attributes={HEADER}>
+      <Fragment set:html={headerSlots(canSearch, cart?.itemCount)} />
+    </NymbalElement>
     <main id="main">
       <slot />
     </main>
-    <Footer />
+    <NymbalElement tag="nymbal-site-footer" attributes={FOOTER} />
 
     <!-- Web component overlays (rendered outside main flow) -->
     <nymbal-cart-drawer></nymbal-cart-drawer>

package/scaffold/templates/astro/src/lib/api.ts

@@ -1,6 +1,11 @@
-import type { DenormalisedProduct, ProductListResult, ReviewsListResult } from '@nymbalhq/sdk'
+import type {
+  DenormalisedProduct,
+  ProductListResult,
+  ProductSearchResult,
+  ReviewsListResult,
+} from '@nymbalhq/sdk'
 import { DEFAULT_PRODUCT_SORT, PRODUCT_SORT_KEYS } from '@nymbalhq/types'
-import type { Category, Order, ProductSortKey, StoreCapabilities } from '@nymbalhq/types'
+import type { Cart, Category, Order, ProductSortKey, StoreCapabilities } from '@nymbalhq/types'
 
 const API_URL = import.meta.env.NYMBAL_API_URL ?? 'http://localhost:3001'
 
@@ -27,13 +32,34 @@ export async function fetchProducts(params?: {
   }
 }
 
+/** The API failed: it did not answer, answered an error other than a 404, or answered with no data. */
+export class ApiUnavailableError extends Error {
+  override name = 'ApiUnavailableError'
+}
+
+/** `GET <path>`'s data; null on a 404; rejects with ApiUnavailableError (or fetch's own error) on any other failure. */
+async function apiData<T>(path: string): Promise<T | null> {
+  const res = await fetch(`${API_URL}${path}`)
+  if (res.status === 404) return null
+  if (!res.ok) throw new ApiUnavailableError(`GET ${path} answered ${res.status}`)
+  const envelope = (await res.json()) as { data?: T | null }
+  if (envelope.data === undefined || envelope.data === null) {
+    throw new ApiUnavailableError(`GET ${path} answered no data`)
+  }
+  return envelope.data
+}
+
+/** What the store can do, as the API sent it; rejects when the API fails. */
+export async function loadCapabilities(): Promise<StoreCapabilities> {
+  const capabilities = await apiData<StoreCapabilities>('/api/capabilities')
+  if (capabilities === null) throw new ApiUnavailableError('GET /api/capabilities answered 404')
+  return capabilities
+}
+
 /** What the store can do, which decides what the page renders; null when the API did not answer. */
 export async function fetchCapabilities(): Promise<StoreCapabilities | null> {
   try {
-    const res = await fetch(`${API_URL}/api/capabilities`)
-    if (!res.ok) return null
-    const envelope = (await res.json()) as { data: StoreCapabilities }
-    return envelope.data ?? null
+    return await loadCapabilities()
   } catch (err) {
     console.error('[api] fetchCapabilities failed', err)
     return null
@@ -47,34 +73,37 @@ export function sortFromUrl(url: URL, catalog?: StoreCapabilities['catalog']): P
   return keys.find((key) => key === sort) ?? catalog?.defaultSort ?? DEFAULT_PRODUCT_SORT
 }
 
+/** A product as the API sent it; null when the API has none (a 404); rejects when the API fails. */
+export async function loadProduct(slug: string): Promise<DenormalisedProduct | null> {
+  return apiData<DenormalisedProduct>(`/api/products/${encodeURIComponent(slug)}`)
+}
+
 export async function fetchProduct(slug: string): Promise<DenormalisedProduct | null> {
   try {
-    const res = await fetch(`${API_URL}/api/products/${encodeURIComponent(slug)}`)
-    if (!res.ok) return null
-    const envelope = (await res.json()) as { data: DenormalisedProduct }
-    return envelope.data ?? null
+    return await loadProduct(slug)
   } catch (err) {
     console.error('[api] fetchProduct failed', err)
     return null
   }
 }
 
-const SEED_CATEGORIES: Category[] = [
-  { id: 'cat_apparel', parentId: null, name: 'Apparel', slug: 'apparel', description: 'Clothing and accessories', position: 0, createdAt: '2024-01-01T00:00:00Z' },
-  { id: 'cat_home', parentId: null, name: 'Home', slug: 'home', description: 'Home goods and decor', position: 1, createdAt: '2024-01-01T00:00:00Z' },
-  { id: 'cat_electronics', parentId: null, name: 'Electronics', slug: 'electronics', description: 'Gadgets and devices', position: 2, createdAt: '2024-01-01T00:00:00Z' },
-  { id: 'cat_books', parentId: null, name: 'Books', slug: 'books', description: 'Books and reading', position: 3, createdAt: '2024-01-01T00:00:00Z' },
-]
+/** The store's categories as the API sent them; rejects when the API fails. */
+export async function loadCategories(): Promise<Category[]> {
+  const categories = await apiData<Category[]>('/api/categories')
+  if (categories === null) throw new ApiUnavailableError('GET /api/categories answered 404')
+  return categories
+}
 
+/**
+ * The store's categories, or none when the API failed: a page renders per request and no shared cache keeps it, so
+ * the next request shows the store's own; a list the API did not send would link to categories the store lacks.
+ */
 export async function fetchCategories(): Promise<Category[]> {
   try {
-    const res = await fetch(`${API_URL}/api/categories`)
-    if (!res.ok) return SEED_CATEGORIES
-    const envelope = (await res.json()) as { data: Category[] }
-    return envelope.data ?? SEED_CATEGORIES
+    return await loadCategories()
   } catch (err) {
     console.error('[api] fetchCategories failed', err)
-    return SEED_CATEGORIES
+    return []
   }
 }
 
@@ -101,3 +130,66 @@ export async function fetchReviews(productId: string): Promise<ReviewsListResult
     return { items: [], nextCursor: null }
   }
 }
+
+/** The cart the cart elements take as their `cart` attribute: its lines and sums, never the cart token. */
+export interface CartProjection {
+  items: Cart['items']
+  subtotalMinor: number
+  currency: string
+  itemCount: number
+}
+
+const CART_COOKIE = 'nymbal.cart'
+
+/** The `nymbal.cart` value in a request's Cookie header, or null. */
+function cartToken(cookie: string | null): string | null {
+  for (const pair of (cookie ?? '').split(';')) {
+    const [name, ...value] = pair.trim().split('=')
+    if (name === CART_COOKIE && value.length > 0) return value.join('=')
+  }
+  return null
+}
+
+/**
+ * The shopper's cart, read with the request's `nymbal.cart` cookie, as the projection the elements take. Null without
+ * the cookie: `GET /api/cart` with none would make a cart the page could not keep, so the element renders its shell
+ * and the browser fills it. The cookie reaches this server when the store and the API share a host or a proxy.
+ */
+export async function fetchCart(cookie: string | null): Promise<CartProjection | null> {
+  const token = cartToken(cookie)
+  if (token === null) return null
+  try {
+    const res = await fetch(`${API_URL}/api/cart`, {
+      headers: { Cookie: `${CART_COOKIE}=${token}` },
+    })
+    if (!res.ok) return null
+    const { items, subtotalMinor, currency } = ((await res.json()) as { data: Cart }).data
+    return {
+      items,
+      subtotalMinor,
+      currency,
+      itemCount: items.reduce((n, item) => n + item.qty, 0),
+    }
+  } catch (err) {
+    console.error('[api] fetchCart failed', err)
+    return null
+  }
+}
+
+/** The search the search page shows for `q` (and its category), as the search store would hold it. */
+export async function fetchSearch(
+  q: string,
+  category: string | null,
+): Promise<ProductSearchResult | null> {
+  const url = new URL('/api/products/search', API_URL)
+  url.searchParams.set('q', q)
+  if (category) url.searchParams.set('category', category)
+  try {
+    const res = await fetch(url.toString())
+    if (!res.ok) return null
+    return ((await res.json()) as { data: ProductSearchResult }).data ?? null
+  } catch (err) {
+    console.error('[api] fetchSearch failed', err)
+    return null
+  }
+}