create-shopnex 0.0.0-edge.542091c → 0.0.0-edge.c8ad7df

package/README.md

@@ -63,6 +63,27 @@ its data in `<shop folder>/apps/`. The admin finds them by itself; install them
 your keys there. Stripe cannot reach a `localhost` address, so card payments need a public address for the app or
 `stripe listen`: see the Stripe app's settings page.
 
+## The shop's `.env`
+
+The first run writes `<name>/.env` (readable by you only) with the two settings a shop needs, and every run reads it:
+
+```sh
+DATABASE_URL=pglite:./.pglite     # embedded database in the shop folder (a relative path is relative to it)
+SHOPNEX_SECRET=<generated once>   # encrypts the provider keys saved in the admin and signs sessions: keep it
+```
+
+- **PostgreSQL:** set `DATABASE_URL=postgres://user:password@host:5432/shopnex` and start again. The migrations are applied
+  on start (`SHOPNEX_AUTO_MIGRATE`). The data in `.pglite/` is not moved (there is no tool for that yet).
+- **Other settings** in the file (SMTP, and so on) are passed to the admin. The address, the ports and the build's own
+  files are set by the CLI and its flags and win over the file.
+- Do not commit or share it. Without `SHOPNEX_SECRET` the saved provider keys cannot be read: a lost one means a new
+  shop.
+
+The first run also writes a `.gitignore` (keeps `.env`, `.pglite/` and the apps' keys out of git) and the
+`docker-compose.yml` (fetched from the repository, the file the [self-hosting docs](https://shopnex.ai/docs/self-hosting/docker) describe: ShopNex, the Stripe
+app and PostgreSQL from prebuilt images), for when the shop should run in Docker instead. Existing files are never
+overwritten.
+
 To start over, delete the shop folder.
 
 ## Not for production
@@ -78,9 +99,8 @@ migrations: JavaScript and WebAssembly, so one file serves every OS and CPU. `cr
 own version, so a version without a release says so. The checksum comes from the same place as the file: it catches a
 damaged download, not a tampered release.
 
-`SHOPNEX_SECRET` is generated once and kept in `<name>/data.secret` (readable by you only), so the same shop keeps its
-sessions and stored keys. `SHOPNEX_BUNDLE_URL` downloads from somewhere else (a mirror; the `.sha256` sits next to it)
-and `SHOPNEX_APP_DIR` changes where builds are unpacked.
+`SHOPNEX_BUNDLE_URL` downloads from somewhere else (a mirror; the `.sha256` sits next to it) and `SHOPNEX_APP_DIR`
+changes where builds are unpacked.
 
 **Edge:** `npx create-shopnex@edge` (or `pnpm create shopnex@edge`) runs the latest build of `main` (`.github/workflows/edge.yaml` replaces the file of
 the `edge` pre-release on every push). It downloads again only when `main` moved. It can be broken: use a release for

package/dist/main.mjs

@@ -40,7 +40,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_PKG_default;
 var init_define_PKG = __esm({
   "<define:__PKG__>"() {
-    define_PKG_default = { version: "0.0.0-edge.542091c", engines: { node: ">=22.22.0" } };
+    define_PKG_default = { version: "0.0.0-edge.c8ad7df", engines: { node: ">=22.22.0" } };
   }
 });
 
@@ -179,7 +179,7 @@ init_define_PKG();
 
 // src/cli.ts
 init_define_PKG();
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 
 // ../../node_modules/.pnpm/@clack+prompts@0.7.0/node_modules/@clack/prompts/dist/index.mjs
 init_define_PKG();
@@ -740,35 +740,9 @@ init_define_PKG();
 
 // src/plan.ts
 init_define_PKG();
-import { join as join2 } from "node:path";
-
-// src/paths.ts
-init_define_PKG();
-import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-function resolveShopDir(name, cwd = process.cwd()) {
-  const trimmed = name.trim();
-  if (!trimmed) throw new UsageError("The shop name cannot be empty.");
-  const expanded = trimmed === "~" ? homedir() : trimmed.startsWith("~/") ? join(homedir(), trimmed.slice(2)) : trimmed;
-  return resolve(cwd, expanded);
-}
-var dataDirOf = (shopDir) => join(shopDir, "data");
-var databaseUrl = (dataDir) => `pglite:${dataDir}`;
-var appCacheDir = () => process.env.SHOPNEX_APP_DIR ?? join(homedir(), ".shopnex", "app");
-function ensureSecret(dataDir) {
-  const file = `${dataDir}.secret`;
-  if (!existsSync(file)) {
-    mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, randomBytes(32).toString("hex"), { mode: 384 });
-  }
-  return readFileSync(file, "utf8").trim();
-}
-
-// src/plan.ts
+import { join } from "node:path";
 function planFromBundle(input) {
-  const { root, shopDir, dataDir, port, storefrontPort, secret, extras: extras2 } = input;
+  const { root, shopDir, databaseUrl, port, storefrontPort, secret, env, extras: extras2, appKeys = {} } = input;
   const extraUrl = (extra) => `http://localhost:${extra.port}`;
   const appUrl = `http://localhost:${port}`;
   return {
@@ -777,15 +751,19 @@ function planFromBundle(input) {
     processes: [
       {
         name: "admin",
-        cwd: join2(root, "admin"),
+        cwd: join(root, "admin"),
         command: process.execPath,
         args: ["server.mjs"],
         env: {
+          // The shop's .env first: what the CLI decides (address, ports, the build's files) wins over it
+          ...env,
           NODE_ENV: "production",
           HOST: "127.0.0.1",
           PORT: String(port),
-          DATABASE_URL: databaseUrl(dataDir),
-          SHOPNEX_MIGRATIONS_DIR: join2(root, "migrations"),
+          DATABASE_URL: databaseUrl,
+          SHOPNEX_MIGRATIONS_DIR: join(root, "migrations"),
+          // PostgreSQL from the shop's .env is migrated at start, like the embedded database
+          SHOPNEX_AUTO_MIGRATE: "true",
           SHOPNEX_SECRET: secret,
           BETTER_AUTH_URL: appUrl,
           APP_URL: appUrl,
@@ -798,7 +776,7 @@ function planFromBundle(input) {
       },
       {
         name: "storefront",
-        cwd: join2(root, "storefront"),
+        cwd: join(root, "storefront"),
         command: process.execPath,
         args: ["dist/server/entry.mjs"],
         env: {
@@ -813,7 +791,7 @@ function planFromBundle(input) {
       },
       ...extras2.map((extra) => ({
         name: extra.name,
-        cwd: join2(root, "apps", extra.dir),
+        cwd: join(root, "apps", extra.dir),
         command: process.execPath,
         args: ["server.mjs"],
         env: {
@@ -822,8 +800,12 @@ function planFromBundle(input) {
           PORT: String(extra.port),
           [extra.urlEnv]: extraUrl(extra),
           SHOPNEX_INTERNAL_URL: appUrl,
-          // Its identity key and the shops' settings: kept with the shop, so the same shop stays connected
-          DATA_DIR: join2(shopDir, "apps", extra.dir)
+          // Its identity, kept with the shop so the same shop stays connected
+          [extra.keyEnv]: appKeys[extra.name] ?? "",
+          // Tables of its own: a schema in the shop's PostgreSQL, or its own embedded database
+          ...extra.database && {
+            APP_DATABASE_URL: databaseUrl.startsWith("pglite:") ? `pglite:${join(shopDir, "apps", extra.dir, ".pglite")}` : databaseUrl
+          }
         },
         readyUrl: `http://127.0.0.1:${extra.port}/shopnex/app.js`
       }))
@@ -860,12 +842,44 @@ async function pickApp(name, { interactive, list = apps }) {
   return list.find((app) => app.name === answer) ?? first;
 }
 
+// src/app-keys.ts
+init_define_PKG();
+import { generateKeyPairSync } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+var newAppKey = () => `snxk_${generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "der" }).toString("base64url")}`;
+function loadAppKeys(shopDir, extras2, { write }) {
+  const keys = {};
+  for (const extra of extras2) {
+    const file = join2(shopDir, "apps", extra.dir, "app-key");
+    if (!existsSync(file)) {
+      if (!write) {
+        keys[extra.name] = "";
+        continue;
+      }
+      mkdirSync(dirname(file), { recursive: true });
+      writeFileSync(file, newAppKey(), { mode: 384, flag: "wx" });
+    }
+    chmodSync(file, 384);
+    keys[extra.name] = readFileSync(file, "utf8").trim();
+  }
+  return keys;
+}
+
 // src/extras.ts
 init_define_PKG();
 var extras = [
-  { name: "stripe", label: "Stripe", dir: "stripe", port: 4600, urlEnv: "STRIPE_APP_URL" },
-  { name: "cj", label: "CJ Dropshipping", dir: "cj-dropshipping", port: 4700, urlEnv: "CJ_DROPSHIPPING_APP_URL" },
-  { name: "shippo", label: "Shippo", dir: "shippo", port: 4900, urlEnv: "SHIPPO_APP_URL" }
+  { name: "stripe", label: "Stripe", dir: "stripe", port: 4600, urlEnv: "STRIPE_APP_URL", keyEnv: "STRIPE_APP_KEY" },
+  {
+    name: "cj",
+    label: "CJ Dropshipping",
+    dir: "cj-dropshipping",
+    port: 4700,
+    urlEnv: "CJ_DROPSHIPPING_APP_URL",
+    keyEnv: "CJ_DROPSHIPPING_APP_KEY",
+    database: true
+  },
+  { name: "shippo", label: "Shippo", dir: "shippo", port: 4900, urlEnv: "SHIPPO_APP_URL", keyEnv: "SHIPPO_APP_KEY" }
 ];
 function pickExtras(values, list = extras) {
   const names = (values ?? []).flatMap((value) => value.split(",")).map((name) => name.trim().toLowerCase());
@@ -892,15 +906,29 @@ import {
   renameSync,
   rmSync
 } from "node:fs";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { spawnSync } from "node:child_process";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
+
+// src/paths.ts
+init_define_PKG();
+import { homedir } from "node:os";
+import { join as join3, resolve } from "node:path";
+function resolveShopDir(name, cwd = process.cwd()) {
+  const trimmed = name.trim();
+  if (!trimmed) throw new UsageError("The shop name cannot be empty.");
+  const expanded = trimmed === "~" ? homedir() : trimmed.startsWith("~/") ? join3(homedir(), trimmed.slice(2)) : trimmed;
+  return resolve(cwd, expanded);
+}
+var appCacheDir = () => process.env.SHOPNEX_APP_DIR ?? join3(homedir(), ".shopnex", "app");
+
+// src/bundle.ts
 var isEdge = (version) => /-edge\./.test(version);
 var bundleName = (version) => `shopnex-v${version}-node.tgz`;
 var bundleUrl = (version) => process.env.SHOPNEX_BUNDLE_URL ?? (isEdge(version) ? "https://github.com/shopnex-ai/shopnex/releases/download/edge/shopnex-edge-node.tgz" : `https://github.com/shopnex-ai/shopnex/releases/download/v${version}/${bundleName(version)}`);
-var bundleDir = (key) => join3(appCacheDir(), key);
-var isInstalled = (key) => existsSync2(join3(bundleDir(key), "manifest.json"));
+var bundleDir = (key) => join4(appCacheDir(), key);
+var isInstalled = (key) => existsSync2(join4(bundleDir(key), "manifest.json"));
 var installedEdges = () => existsSync2(appCacheDir()) ? readdirSync(appCacheDir()).filter((name) => /^edge-[0-9a-f]{12}$/.test(name)) : [];
 async function get(url, what, version) {
   let response;
@@ -964,8 +992,8 @@ async function resolveBundle({ version }) {
     }
     const label = edge ? "the latest edge build" : `ShopNex ${version}`;
     say(`Downloading ${label}`);
-    work = mkdtempSync(join3(appCacheDir(), `${key}.tmp-`));
-    const file = join3(work, "bundle.tgz");
+    work = mkdtempSync(join4(appCacheDir(), `${key}.tmp-`));
+    const file = join4(work, "bundle.tgz");
     const actual = await download(
       await get(url, "ShopNex", version),
       file,
@@ -977,13 +1005,13 @@ async function resolveBundle({ version }) {
       );
     }
     say("Unpacking");
-    const unpacked = join3(work, "app");
+    const unpacked = join4(work, "app");
     mkdirSync2(unpacked);
     const tar = spawnSync("tar", ["-xzf", file, "-C", unpacked], { encoding: "utf8" });
     if (tar.error || tar.status !== 0) {
       throw new UnavailableError(`Could not unpack the download with tar: ${tar.error?.message ?? tar.stderr.trim()}`);
     }
-    const manifestFile = join3(unpacked, "manifest.json");
+    const manifestFile = join4(unpacked, "manifest.json");
     const manifest = existsSync2(manifestFile) ? JSON.parse(readFileSync2(manifestFile, "utf8")) : void 0;
     if (edge ? !manifest : manifest?.version !== version) {
       throw new UnavailableError(
@@ -1016,6 +1044,81 @@ function assertNode(version, enginesRange) {
   }
 }
 
+// src/env.ts
+init_define_PKG();
+import { randomBytes } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, appendFileSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { isAbsolute, join as join5, resolve as resolve2 } from "node:path";
+import { parseEnv } from "node:util";
+var DEFAULT_DATABASE_URL = "pglite:./.pglite";
+var template = (secret) => `# ShopNex: the settings of this shop. Edit, then start it again.
+#
+# Where the data lives. The default is an embedded database in ./.pglite (PGlite): one process owns it, for trying
+# ShopNex out. For a real database use PostgreSQL, for example:
+# DATABASE_URL=postgres://user:password@localhost:5432/shopnex
+# (docker-compose.yml runs ShopNex and PostgreSQL in Docker)
+DATABASE_URL=${DEFAULT_DATABASE_URL}
+
+# Encrypts the provider keys saved in the admin and signs sessions. Keep it: a new one logs everyone out and makes the
+# saved keys unreadable. Do not share this file.
+SHOPNEX_SECRET=${secret}
+`;
+var resolveDatabaseUrl = (url, shopDir) => {
+  if (!url.startsWith("pglite:")) return url;
+  const path = url.slice("pglite:".length);
+  return isAbsolute(path) ? url : `pglite:${resolve2(shopDir, path)}`;
+};
+var redactUrl = (url) => url.replace(/\/\/([^:@/]+):[^@/]*@/, "//$1:***@");
+function loadShopEnv(shopDir, { write }) {
+  const file = join5(shopDir, ".env");
+  const exists = existsSync3(file);
+  const { DATABASE_URL, SHOPNEX_SECRET, ...rest } = exists ? parseEnv(readFileSync3(file, "utf8")) : {};
+  const secret = SHOPNEX_SECRET?.trim() || (write ? randomBytes(32).toString("hex") : "");
+  const databaseUrl = DATABASE_URL?.trim() || DEFAULT_DATABASE_URL;
+  if (write) {
+    if (!exists) {
+      mkdirSync3(shopDir, { recursive: true });
+      writeFileSync2(file, template(secret), { mode: 384 });
+    } else {
+      const missing = [
+        DATABASE_URL?.trim() ? "" : `DATABASE_URL=${DEFAULT_DATABASE_URL}`,
+        SHOPNEX_SECRET?.trim() ? "" : `SHOPNEX_SECRET=${secret}`
+      ].filter(Boolean);
+      if (missing.length)
+        appendFileSync(file, `${readFileSync3(file, "utf8").endsWith("\n") ? "" : "\n"}${missing.join("\n")}
+`);
+    }
+  }
+  return { databaseUrl: resolveDatabaseUrl(databaseUrl, shopDir), secret, rest, file };
+}
+
+// src/scaffold.ts
+init_define_PKG();
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join6 } from "node:path";
+var GITIGNORE = `# ShopNex: secrets and local data stay out of git
+.env
+.pglite/
+apps/*/.pglite/
+apps/*/app-key
+`;
+var composeUrl = (version) => `https://raw.githubusercontent.com/shopnex-ai/shopnex/${isEdge(version) ? "main" : `v${version}`}/deploy/docker-compose.yml`;
+async function writeScaffold(shopDir, version, fetcher = fetch) {
+  mkdirSync4(shopDir, { recursive: true });
+  const gitignore = join6(shopDir, ".gitignore");
+  if (!existsSync4(gitignore)) writeFileSync3(gitignore, GITIGNORE);
+  const compose = join6(shopDir, "docker-compose.yml");
+  if (existsSync4(compose)) return;
+  const url = composeUrl(version);
+  try {
+    const response = await fetcher(url, { signal: AbortSignal.timeout(5e3) });
+    if (!response.ok) return `docker-compose.yml was not added: ${url} answered ${response.status}`;
+    writeFileSync3(compose, await response.text());
+  } catch (error) {
+    return `docker-compose.yml was not added: ${url} could not be fetched (${error instanceof Error ? error.message : error})`;
+  }
+}
+
 // src/theme.ts
 init_define_PKG();
 var import_picocolors2 = __toESM(require_picocolors(), 1);
@@ -1030,14 +1133,14 @@ init_define_PKG();
 import { spawn } from "node:child_process";
 import { connect } from "node:net";
 var import_picocolors3 = __toESM(require_picocolors(), 1);
-var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 function portInUse(port) {
-  const tryHost = (host) => new Promise((resolve2) => {
+  const tryHost = (host) => new Promise((resolve3) => {
     const socket = connect({ port, host });
     socket.setTimeout(500);
-    socket.once("connect", () => (socket.destroy(), resolve2(true)));
-    socket.once("timeout", () => (socket.destroy(), resolve2(false)));
-    socket.once("error", () => resolve2(false));
+    socket.once("connect", () => (socket.destroy(), resolve3(true)));
+    socket.once("timeout", () => (socket.destroy(), resolve3(false)));
+    socket.once("error", () => resolve3(false));
   });
   return Promise.all([tryHost("127.0.0.1"), tryHost("::1")]).then((used) => used.some(Boolean));
 }
@@ -1063,7 +1166,7 @@ function openBrowser(url) {
   child.unref();
 }
 function runPlan(plan, { open, verbose }) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const children = [];
     const tails = /* @__PURE__ */ new Map();
     let stopping = false;
@@ -1081,7 +1184,7 @@ function runPlan(plan, { open, verbose }) {
         } catch {
         }
       }
-      setTimeout(() => resolve2(code), 300);
+      setTimeout(() => resolve3(code), 300);
     };
     for (const [index, proc] of plan.processes.entries()) {
       const child = spawn(proc.command, proc.args, {
@@ -1144,13 +1247,14 @@ function runPlan(plan, { open, verbose }) {
 }
 
 // src/cli.ts
-var pkg = typeof define_PKG_default !== "undefined" ? define_PKG_default : JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8"));
+var pkg = typeof define_PKG_default !== "undefined" ? define_PKG_default : JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8"));
 var HELP = `create-shopnex ${pkg.version}: try ShopNex on this machine with one command.
 
 Usage
   create-shopnex [name] [options]   (name defaults to shopnex)
 
-Creates the folder <name> (shopnex when you leave it out) and keeps the shop's database in it.
+Creates the folder <name> (shopnex when you leave it out) with the shop's settings (.env) and, by default, its
+database. Change DATABASE_URL in the .env to use PostgreSQL.
 Starts the admin (with the API and checkout) and the storefront on an embedded database. Nothing else to install.
 This is for trying ShopNex out: one process owns the data. For a real shop use Docker or PostgreSQL.
 
@@ -1167,6 +1271,7 @@ Options
 `;
 function describe({
   shopDir,
+  database,
   plan,
   source,
   extras: extras2 = []
@@ -1174,6 +1279,7 @@ function describe({
   const rows = [
     ["Source", source],
     ["Folder", shopDir],
+    ["Database", redactUrl(database)],
     ["Admin", `${plan.appUrl}/admin`],
     ["Storefront", plan.storefrontUrl],
     ...extras2.map((extra) => [extra.label, `http://localhost:${extra.port} (install it from the admin)`])
@@ -1191,8 +1297,10 @@ async function run(argv) {
   const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
   const name = options2.name ?? DEFAULT_SHOP_NAME;
   const shopDir = resolveShopDir(name);
-  const dataDir = dataDirOf(shopDir);
   const extras2 = pickExtras(options2.with);
+  const shopEnv = loadShopEnv(shopDir, { write: !options2.dryRun });
+  const scaffoldWarning = options2.dryRun ? void 0 : await writeScaffold(shopDir, pkg.version);
+  if (scaffoldWarning) f2.warn(scaffoldWarning);
   const ports = [
     { port: options2.port, flag: "--port" },
     { port: options2.storefrontPort, flag: "--storefront-port" },
@@ -1206,12 +1314,14 @@ async function run(argv) {
     root,
     shopDir,
     extras: extras2,
-    dataDir,
+    databaseUrl: shopEnv.databaseUrl,
+    env: shopEnv.rest,
     port: options2.port,
     storefrontPort: options2.storefrontPort,
-    secret: options2.dryRun ? "" : ensureSecret(dataDir)
+    secret: shopEnv.secret,
+    appKeys: loadAppKeys(shopDir, extras2, { write: !options2.dryRun })
   });
-  le(describe({ shopDir, plan, source, extras: extras2 }), app.label);
+  le(describe({ shopDir, database: shopEnv.databaseUrl, plan, source, extras: extras2 }), app.label);
   if (options2.dryRun) return $e("Dry run: nothing was started.");
   f2.warn("This is a trial database: it is not for production.");
   process.exitCode = await runPlan(plan, { open: options2.open, verbose: options2.verbose });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-shopnex",
-  "version": "0.0.0-edge.542091c",
+  "version": "0.0.0-edge.c8ad7df",
   "description": "Try ShopNex with one command: npx create-shopnex starts the admin and the storefront on an embedded database, nothing else to install",
   "license": "MIT",
   "homepage": "https://shopnex.ai",