create-shopnex 0.0.0-edge.init → 0.15.0

package/README.md

@@ -3,26 +3,88 @@
 Try ShopNex on your machine with one command. It starts the admin (with the API and hosted checkout) and the
 storefront on an embedded database ([PGlite](https://pglite.dev)): no PostgreSQL, no Docker, no clone.
 
+## Run it
+
+```sh
+npx create-shopnex@latest
+```
+
+This creates the folder `shopnex` in the current folder and keeps the shop's database in it. Want another name?
+Add it: `npx create-shopnex@latest my-shop`.
+
+npm asks once whether to install the package: answer `y`. `@latest` makes npx fetch the newest version instead of
+reusing an older copy from its cache. With pnpm, which does not ask:
+
 ```sh
-npx create-shopnex
+pnpm create shopnex@latest
 ```
 
-The first run downloads ShopNex (one file, about 15 MB) into `~/.shopnex/app/<version>` and checks its SHA-256; later
-runs start straight away. It prints where to open the shop and the admin. Ctrl+C stops everything.
+The first run downloads ShopNex (one file, about 15 MB) into `~/.shopnex/app/<version>` (shared by all your shops) and checks its SHA-256; later
+runs start straight away. It prints where to open the shop and the admin and opens the admin's setup wizard (use
+`--no-open` to skip that). Ctrl+C stops everything. Nothing is installed globally.
+
+## What it does, and why you can trust it
+
+- **It runs on your machine only.** Both servers listen on `127.0.0.1`, and the data stays in the shop folder (`shopnex/data` by default).
+- **It downloads one file.** `create-shopnex` itself fetches only the ShopNex build from this repository's GitHub
+  releases, and checks its SHA-256 before it unpacks anything. The checksum comes from the same place as the file, so it
+  catches a damaged or half-finished download, not a tampered release: the release itself is what you trust.
+- **The source is here.** The package is
+  [`packages/create-shopnex`](https://github.com/shopnex-ai/shopnex/tree/main/packages/create-shopnex) in this
+  repository, and has no runtime dependencies: what you run is one bundled file built from that source.
+- **It is built in the open.** Releases and edge builds are published from GitHub Actions
+  ([release](https://github.com/shopnex-ai/shopnex/blob/main/.github/workflows/release.yaml),
+  [edge](https://github.com/shopnex-ai/shopnex/blob/main/.github/workflows/edge.yaml)) with npm provenance, so a
+  version's page on npmjs.com shows which commit and workflow run built it. The one exception is `0.0.0-edge.init`, the
+  first publish, made by hand to create the package. Publishing uses npm trusted publishing, so there is no long-lived
+  npm token.
 
 ## Options
 
-| Option                  | What it does                                                                          |
-| ----------------------- | ------------------------------------------------------------------------------------- |
-| `--data <folder>`       | Where the database lives. Default `~/.shopnex/data`: the same folder is the same shop |
-| `--port <n>`            | Admin, API and checkout. Default `3000`                                               |
-| `--storefront-port <n>` | Storefront. Default `4321`                                                            |
-| `--no-open`             | Do not open the browser                                                               |
-| `--app <name>`          | What to start. Only `shop` today; a picker appears once there is more than one        |
-| `--verbose`             | Show the servers' output while they start (otherwise only if one fails)               |
-| `--dry-run`             | Show what would run, and exit                                                         |
+| Option                  | What it does                                                                                              |
+| ----------------------- | --------------------------------------------------------------------------------------------------------- |
+| `[name]`                | The shop's folder, created if needed. `shopnex` when left out; the same folder is the same shop           |
+| `--port <n>`            | Admin, API and checkout. Default `3000`                                                                   |
+| `--storefront-port <n>` | Storefront. Default `4321`                                                                                |
+| `--no-open`             | Do not open the browser                                                                                   |
+| `--with <apps>`         | Also start optional apps next to the shop: `stripe`, `cj`, `shippo` (comma separated, or repeat the flag) |
+| `--app <name>`          | What to start. Only `shop` today; a picker appears once there is more than one                            |
+| `--verbose`             | Show the servers' output while they start (otherwise only if one fails)                                   |
+| `--dry-run`             | Show what would run, and exit                                                                             |
+
+## Apps: Stripe, CJ Dropshipping and Shippo
+
+```sh
+npx create-shopnex@latest --with stripe,cj,shippo
+```
+
+Each app runs as its own small server on this machine only (Stripe on port 4600, CJ Dropshipping on 4700, Shippo on 4900) and keeps
+its data in `<shop folder>/apps/`. The admin finds them by itself; install them from the admin like any app and enter
+your keys there. Stripe cannot reach a `localhost` address, so card payments need a public address for the app or
+`stripe listen`: see the Stripe app's settings page.
+
+## The shop's `.env`
+
+The first run writes `<name>/.env` (readable by you only) with the two settings a shop needs, and every run reads it:
+
+```sh
+DATABASE_URL=pglite:./.pglite     # embedded database in the shop folder (a relative path is relative to it)
+SHOPNEX_SECRET=<generated once>   # encrypts the provider keys saved in the admin and signs sessions: keep it
+```
+
+- **PostgreSQL:** set `DATABASE_URL=postgres://user:password@host:5432/shopnex` and start again. The migrations are applied
+  on start (`SHOPNEX_AUTO_MIGRATE`). The data in `.pglite/` is not moved (there is no tool for that yet).
+- **Other settings** in the file (SMTP, and so on) are passed to the admin. The address, the ports and the build's own
+  files are set by the CLI and its flags and win over the file.
+- Do not commit or share it. Without `SHOPNEX_SECRET` the saved provider keys cannot be read: a lost one means a new
+  shop.
+
+The first run also writes a `.gitignore` (keeps `.env`, `.pglite/` and the apps' keys out of git) and the
+`docker-compose.yml` (fetched from the repository, the file the [self-hosting docs](https://shopnex.ai/docs/self-hosting/docker) describe: ShopNex, the Stripe
+app and PostgreSQL from prebuilt images), for when the shop should run in Docker instead. Existing files are never
+overwritten.
 
-To start over, delete the data folder (and the `<data folder>.secret` file next to it).
+To start over, delete the shop folder.
 
 ## Not for production
 
@@ -37,11 +99,10 @@ migrations: JavaScript and WebAssembly, so one file serves every OS and CPU. `cr
 own version, so a version without a release says so. The checksum comes from the same place as the file: it catches a
 damaged download, not a tampered release.
 
-`SHOPNEX_SECRET` is generated once and kept in `<data folder>.secret` (readable by you only), so the same shop keeps its
-sessions and stored keys. `SHOPNEX_BUNDLE_URL` downloads from somewhere else (a mirror; the `.sha256` sits next to it)
-and `SHOPNEX_APP_DIR` changes where builds are unpacked.
+`SHOPNEX_BUNDLE_URL` downloads from somewhere else (a mirror; the `.sha256` sits next to it) and `SHOPNEX_APP_DIR`
+changes where builds are unpacked.
 
-**Edge:** `npx create-shopnex@edge` runs the latest build of `main` (`.github/workflows/edge.yaml` replaces the file of
+**Edge:** `npx create-shopnex@edge` (or `pnpm create shopnex@edge`) runs the latest build of `main` (`.github/workflows/edge.yaml` replaces the file of
 the `edge` pre-release on every push). It downloads again only when `main` moved. It can be broken: use a release for
 anything you want to keep.
 

package/dist/main.mjs

@@ -40,7 +40,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_PKG_default;
 var init_define_PKG = __esm({
   "<define:__PKG__>"() {
-    define_PKG_default = { version: "0.0.0-edge.init", engines: { node: ">=22.22.0" } };
+    define_PKG_default = { version: "0.15.0", engines: { node: ">=22.22.0" } };
   }
 });
 
@@ -179,7 +179,7 @@ init_define_PKG();
 
 // src/cli.ts
 init_define_PKG();
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 
 // ../../node_modules/.pnpm/@clack+prompts@0.7.0/node_modules/@clack/prompts/dist/index.mjs
 init_define_PKG();
@@ -689,10 +689,10 @@ var UnavailableError = class extends Error {
 var DEFAULT_PORT = 3e3;
 var DEFAULT_STOREFRONT_PORT = 4321;
 var options = {
-  data: { type: "string" },
   port: { type: "string" },
   "storefront-port": { type: "string" },
   app: { type: "string" },
+  with: { type: "string", multiple: true },
   verbose: { type: "boolean" },
   "no-open": { type: "boolean" },
   "dry-run": { type: "boolean" },
@@ -709,21 +709,24 @@ function toPort(name, value, fallback) {
 }
 function parse(argv) {
   let values;
+  let positionals;
   try {
     ;
-    ({ values } = parseArgs({ args: argv, options, allowPositionals: false }));
+    ({ values, positionals } = parseArgs({ args: argv, options, allowPositionals: true }));
   } catch (error) {
     throw new UsageError(`${error.message}
 Run create-shopnex --help for the options.`);
   }
+  if (positionals.length > 1) throw new UsageError(`Give one shop name, got: ${positionals.join(" ")}`);
   const port = toPort("port", values.port, DEFAULT_PORT);
   const storefrontPort = toPort("storefront-port", values["storefront-port"], DEFAULT_STOREFRONT_PORT);
   if (port === storefrontPort) throw new UsageError("--port and --storefront-port must be different");
   return {
-    data: values.data,
+    name: positionals[0],
     port,
     storefrontPort,
     app: values.app,
+    with: values.with ?? [],
     verbose: Boolean(values.verbose),
     open: !values["no-open"],
     dryRun: Boolean(values["dry-run"]),
@@ -737,34 +740,10 @@ init_define_PKG();
 
 // src/plan.ts
 init_define_PKG();
-import { join as join2 } from "node:path";
-
-// src/paths.ts
-init_define_PKG();
-import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-var defaultDataDir = () => join(homedir(), ".shopnex", "data");
-function resolveDataDir(option) {
-  if (!option) return defaultDataDir();
-  const expanded = option === "~" ? homedir() : option.startsWith("~/") ? join(homedir(), option.slice(2)) : option;
-  return resolve(expanded);
-}
-var databaseUrl = (dataDir) => `pglite:${dataDir}`;
-var appCacheDir = () => process.env.SHOPNEX_APP_DIR ?? join(homedir(), ".shopnex", "app");
-function ensureSecret(dataDir) {
-  const file = `${dataDir}.secret`;
-  if (!existsSync(file)) {
-    mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, randomBytes(32).toString("hex"), { mode: 384 });
-  }
-  return readFileSync(file, "utf8").trim();
-}
-
-// src/plan.ts
+import { join } from "node:path";
 function planFromBundle(input) {
-  const { root, dataDir, port, storefrontPort, secret } = input;
+  const { root, shopDir, databaseUrl, port, storefrontPort, secret, env, extras: extras2, appKeys = {} } = input;
+  const extraUrl = (extra) => `http://localhost:${extra.port}`;
   const appUrl = `http://localhost:${port}`;
   return {
     appUrl,
@@ -772,26 +751,32 @@ function planFromBundle(input) {
     processes: [
       {
         name: "admin",
-        cwd: join2(root, "admin"),
+        cwd: join(root, "admin"),
         command: process.execPath,
         args: ["server.mjs"],
         env: {
+          // The shop's .env first: what the CLI decides (address, ports, the build's files) wins over it
+          ...env,
           NODE_ENV: "production",
           HOST: "127.0.0.1",
           PORT: String(port),
-          DATABASE_URL: databaseUrl(dataDir),
-          SHOPNEX_MIGRATIONS_DIR: join2(root, "migrations"),
+          DATABASE_URL: databaseUrl,
+          SHOPNEX_MIGRATIONS_DIR: join(root, "migrations"),
+          // PostgreSQL from the shop's .env is migrated at start, like the embedded database
+          SHOPNEX_AUTO_MIGRATE: "true",
           SHOPNEX_SECRET: secret,
           BETTER_AUTH_URL: appUrl,
           APP_URL: appUrl,
           // Where the admin finds the storefront (Themes, the theme editor) until a Storefront URL is saved in Settings
-          STOREFRONT_URL: `http://localhost:${storefrontPort}`
+          STOREFRONT_URL: `http://localhost:${storefrontPort}`,
+          // The admin registers an optional app when its address is set (the same variable the app reads)
+          ...Object.fromEntries(extras2.map((extra) => [extra.urlEnv, extraUrl(extra)]))
         },
         readyUrl: `http://127.0.0.1:${port}/api/v1/health`
       },
       {
         name: "storefront",
-        cwd: join2(root, "storefront"),
+        cwd: join(root, "storefront"),
         command: process.execPath,
         args: ["dist/server/entry.mjs"],
         env: {
@@ -803,7 +788,27 @@ function planFromBundle(input) {
           SHOPNEX_PUBLIC_URL: appUrl
         },
         readyUrl: `http://127.0.0.1:${storefrontPort}/`
-      }
+      },
+      ...extras2.map((extra) => ({
+        name: extra.name,
+        cwd: join(root, "apps", extra.dir),
+        command: process.execPath,
+        args: ["server.mjs"],
+        env: {
+          NODE_ENV: "production",
+          HOST: "127.0.0.1",
+          PORT: String(extra.port),
+          [extra.urlEnv]: extraUrl(extra),
+          SHOPNEX_INTERNAL_URL: appUrl,
+          // Its identity, kept with the shop so the same shop stays connected
+          [extra.keyEnv]: appKeys[extra.name] ?? "",
+          // Tables of its own: a schema in the shop's PostgreSQL, or its own embedded database
+          ...extra.database && {
+            APP_DATABASE_URL: databaseUrl.startsWith("pglite:") ? `pglite:${join(shopDir, "apps", extra.dir, ".pglite")}` : databaseUrl
+          }
+        },
+        readyUrl: `http://127.0.0.1:${extra.port}/shopnex/app.js`
+      }))
     ]
   };
 }
@@ -837,6 +842,57 @@ async function pickApp(name, { interactive, list = apps }) {
   return list.find((app) => app.name === answer) ?? first;
 }
 
+// src/app-keys.ts
+init_define_PKG();
+import { generateKeyPairSync } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+var newAppKey = () => `snxk_${generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "der" }).toString("base64url")}`;
+function loadAppKeys(shopDir, extras2, { write }) {
+  const keys = {};
+  for (const extra of extras2) {
+    const file = join2(shopDir, "apps", extra.dir, "app-key");
+    if (!existsSync(file)) {
+      if (!write) {
+        keys[extra.name] = "";
+        continue;
+      }
+      mkdirSync(dirname(file), { recursive: true });
+      writeFileSync(file, newAppKey(), { mode: 384, flag: "wx" });
+    }
+    chmodSync(file, 384);
+    keys[extra.name] = readFileSync(file, "utf8").trim();
+  }
+  return keys;
+}
+
+// src/extras.ts
+init_define_PKG();
+var extras = [
+  { name: "stripe", label: "Stripe", dir: "stripe", port: 4600, urlEnv: "STRIPE_APP_URL", keyEnv: "STRIPE_APP_KEY" },
+  {
+    name: "cj",
+    label: "CJ Dropshipping",
+    dir: "cj-dropshipping",
+    port: 4700,
+    urlEnv: "CJ_DROPSHIPPING_APP_URL",
+    keyEnv: "CJ_DROPSHIPPING_APP_KEY",
+    database: true
+  },
+  { name: "shippo", label: "Shippo", dir: "shippo", port: 4900, urlEnv: "SHIPPO_APP_URL", keyEnv: "SHIPPO_APP_KEY" }
+];
+function pickExtras(values, list = extras) {
+  const names = (values ?? []).flatMap((value) => value.split(",")).map((name) => name.trim().toLowerCase());
+  const picked = [];
+  for (const name of names.filter(Boolean)) {
+    const found = list.find((extra) => extra.name === name);
+    if (!found)
+      throw new UsageError(`Unknown app "${name}" for --with. Available: ${list.map((e2) => e2.name).join(", ")}.`);
+    if (!picked.includes(found)) picked.push(found);
+  }
+  return picked;
+}
+
 // src/bundle.ts
 init_define_PKG();
 import { createHash } from "node:crypto";
@@ -850,15 +906,29 @@ import {
   renameSync,
   rmSync
 } from "node:fs";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { spawnSync } from "node:child_process";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
+
+// src/paths.ts
+init_define_PKG();
+import { homedir } from "node:os";
+import { join as join3, resolve } from "node:path";
+function resolveShopDir(name, cwd = process.cwd()) {
+  const trimmed = name.trim();
+  if (!trimmed) throw new UsageError("The shop name cannot be empty.");
+  const expanded = trimmed === "~" ? homedir() : trimmed.startsWith("~/") ? join3(homedir(), trimmed.slice(2)) : trimmed;
+  return resolve(cwd, expanded);
+}
+var appCacheDir = () => process.env.SHOPNEX_APP_DIR ?? join3(homedir(), ".shopnex", "app");
+
+// src/bundle.ts
 var isEdge = (version) => /-edge\./.test(version);
 var bundleName = (version) => `shopnex-v${version}-node.tgz`;
 var bundleUrl = (version) => process.env.SHOPNEX_BUNDLE_URL ?? (isEdge(version) ? "https://github.com/shopnex-ai/shopnex/releases/download/edge/shopnex-edge-node.tgz" : `https://github.com/shopnex-ai/shopnex/releases/download/v${version}/${bundleName(version)}`);
-var bundleDir = (key) => join3(appCacheDir(), key);
-var isInstalled = (key) => existsSync2(join3(bundleDir(key), "manifest.json"));
+var bundleDir = (key) => join4(appCacheDir(), key);
+var isInstalled = (key) => existsSync2(join4(bundleDir(key), "manifest.json"));
 var installedEdges = () => existsSync2(appCacheDir()) ? readdirSync(appCacheDir()).filter((name) => /^edge-[0-9a-f]{12}$/.test(name)) : [];
 async function get(url, what, version) {
   let response;
@@ -922,8 +992,8 @@ async function resolveBundle({ version }) {
     }
     const label = edge ? "the latest edge build" : `ShopNex ${version}`;
     say(`Downloading ${label}`);
-    work = mkdtempSync(join3(appCacheDir(), `${key}.tmp-`));
-    const file = join3(work, "bundle.tgz");
+    work = mkdtempSync(join4(appCacheDir(), `${key}.tmp-`));
+    const file = join4(work, "bundle.tgz");
     const actual = await download(
       await get(url, "ShopNex", version),
       file,
@@ -935,13 +1005,13 @@ async function resolveBundle({ version }) {
       );
     }
     say("Unpacking");
-    const unpacked = join3(work, "app");
+    const unpacked = join4(work, "app");
     mkdirSync2(unpacked);
     const tar = spawnSync("tar", ["-xzf", file, "-C", unpacked], { encoding: "utf8" });
     if (tar.error || tar.status !== 0) {
       throw new UnavailableError(`Could not unpack the download with tar: ${tar.error?.message ?? tar.stderr.trim()}`);
     }
-    const manifestFile = join3(unpacked, "manifest.json");
+    const manifestFile = join4(unpacked, "manifest.json");
     const manifest = existsSync2(manifestFile) ? JSON.parse(readFileSync2(manifestFile, "utf8")) : void 0;
     if (edge ? !manifest : manifest?.version !== version) {
       throw new UnavailableError(
@@ -974,6 +1044,81 @@ function assertNode(version, enginesRange) {
   }
 }
 
+// src/env.ts
+init_define_PKG();
+import { randomBytes } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, appendFileSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { isAbsolute, join as join5, resolve as resolve2 } from "node:path";
+import { parseEnv } from "node:util";
+var DEFAULT_DATABASE_URL = "pglite:./.pglite";
+var template = (secret) => `# ShopNex: the settings of this shop. Edit, then start it again.
+#
+# Where the data lives. The default is an embedded database in ./.pglite (PGlite): one process owns it, for trying
+# ShopNex out. For a real database use PostgreSQL, for example:
+# DATABASE_URL=postgres://user:password@localhost:5432/shopnex
+# (docker-compose.yml runs ShopNex and PostgreSQL in Docker)
+DATABASE_URL=${DEFAULT_DATABASE_URL}
+
+# Encrypts the provider keys saved in the admin and signs sessions. Keep it: a new one logs everyone out and makes the
+# saved keys unreadable. Do not share this file.
+SHOPNEX_SECRET=${secret}
+`;
+var resolveDatabaseUrl = (url, shopDir) => {
+  if (!url.startsWith("pglite:")) return url;
+  const path = url.slice("pglite:".length);
+  return isAbsolute(path) ? url : `pglite:${resolve2(shopDir, path)}`;
+};
+var redactUrl = (url) => url.replace(/\/\/([^:@/]+):[^@/]*@/, "//$1:***@");
+function loadShopEnv(shopDir, { write }) {
+  const file = join5(shopDir, ".env");
+  const exists = existsSync3(file);
+  const { DATABASE_URL, SHOPNEX_SECRET, ...rest } = exists ? parseEnv(readFileSync3(file, "utf8")) : {};
+  const secret = SHOPNEX_SECRET?.trim() || (write ? randomBytes(32).toString("hex") : "");
+  const databaseUrl = DATABASE_URL?.trim() || DEFAULT_DATABASE_URL;
+  if (write) {
+    if (!exists) {
+      mkdirSync3(shopDir, { recursive: true });
+      writeFileSync2(file, template(secret), { mode: 384 });
+    } else {
+      const missing = [
+        DATABASE_URL?.trim() ? "" : `DATABASE_URL=${DEFAULT_DATABASE_URL}`,
+        SHOPNEX_SECRET?.trim() ? "" : `SHOPNEX_SECRET=${secret}`
+      ].filter(Boolean);
+      if (missing.length)
+        appendFileSync(file, `${readFileSync3(file, "utf8").endsWith("\n") ? "" : "\n"}${missing.join("\n")}
+`);
+    }
+  }
+  return { databaseUrl: resolveDatabaseUrl(databaseUrl, shopDir), secret, rest, file };
+}
+
+// src/scaffold.ts
+init_define_PKG();
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join6 } from "node:path";
+var GITIGNORE = `# ShopNex: secrets and local data stay out of git
+.env
+.pglite/
+apps/*/.pglite/
+apps/*/app-key
+`;
+var composeUrl = (version) => `https://raw.githubusercontent.com/shopnex-ai/shopnex/${isEdge(version) ? "main" : `v${version}`}/deploy/docker-compose.yml`;
+async function writeScaffold(shopDir, version, fetcher = fetch) {
+  mkdirSync4(shopDir, { recursive: true });
+  const gitignore = join6(shopDir, ".gitignore");
+  if (!existsSync4(gitignore)) writeFileSync3(gitignore, GITIGNORE);
+  const compose = join6(shopDir, "docker-compose.yml");
+  if (existsSync4(compose)) return;
+  const url = composeUrl(version);
+  try {
+    const response = await fetcher(url, { signal: AbortSignal.timeout(5e3) });
+    if (!response.ok) return `docker-compose.yml was not added: ${url} answered ${response.status}`;
+    writeFileSync3(compose, await response.text());
+  } catch (error) {
+    return `docker-compose.yml was not added: ${url} could not be fetched (${error instanceof Error ? error.message : error})`;
+  }
+}
+
 // src/theme.ts
 init_define_PKG();
 var import_picocolors2 = __toESM(require_picocolors(), 1);
@@ -988,14 +1133,14 @@ init_define_PKG();
 import { spawn } from "node:child_process";
 import { connect } from "node:net";
 var import_picocolors3 = __toESM(require_picocolors(), 1);
-var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 function portInUse(port) {
-  const tryHost = (host) => new Promise((resolve2) => {
+  const tryHost = (host) => new Promise((resolve3) => {
     const socket = connect({ port, host });
     socket.setTimeout(500);
-    socket.once("connect", () => (socket.destroy(), resolve2(true)));
-    socket.once("timeout", () => (socket.destroy(), resolve2(false)));
-    socket.once("error", () => resolve2(false));
+    socket.once("connect", () => (socket.destroy(), resolve3(true)));
+    socket.once("timeout", () => (socket.destroy(), resolve3(false)));
+    socket.once("error", () => resolve3(false));
   });
   return Promise.all([tryHost("127.0.0.1"), tryHost("::1")]).then((used) => used.some(Boolean));
 }
@@ -1021,7 +1166,7 @@ function openBrowser(url) {
   child.unref();
 }
 function runPlan(plan, { open, verbose }) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const children = [];
     const tails = /* @__PURE__ */ new Map();
     let stopping = false;
@@ -1039,7 +1184,7 @@ function runPlan(plan, { open, verbose }) {
         } catch {
         }
       }
-      setTimeout(() => resolve2(code), 300);
+      setTimeout(() => resolve3(code), 300);
     };
     for (const [index, proc] of plan.processes.entries()) {
       const child = spawn(proc.command, proc.args, {
@@ -1102,57 +1247,81 @@ function runPlan(plan, { open, verbose }) {
 }
 
 // src/cli.ts
-var pkg = typeof define_PKG_default !== "undefined" ? define_PKG_default : JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8"));
+var pkg = typeof define_PKG_default !== "undefined" ? define_PKG_default : JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8"));
 var HELP = `create-shopnex ${pkg.version}: try ShopNex on this machine with one command.
 
 Usage
-  create-shopnex [options]
+  create-shopnex [name] [options]   (name defaults to shopnex)
 
+Creates the folder <name> (shopnex when you leave it out) with the shop's settings (.env) and, by default, its
+database. Change DATABASE_URL in the .env to use PostgreSQL.
 Starts the admin (with the API and checkout) and the storefront on an embedded database. Nothing else to install.
 This is for trying ShopNex out: one process owns the data. For a real shop use Docker or PostgreSQL.
 
 Options
-  --data <folder>          where the database lives (default ~/.shopnex/data); the same folder is the same shop
   --port <n>               admin, API and checkout (default 3000)
   --storefront-port <n>    storefront (default 4321)
   --no-open                do not open the browser
+  --with <apps>            also start optional apps: stripe, cj, shippo (comma separated, or repeat the flag)
   --app <name>             what to start (default shop; a picker appears once there is more than one)
   --verbose                show the output of the servers while they start
   --dry-run                show what would run and exit
   -h, --help               this text
   -v, --version            the version
 `;
-function describe({ dataDir, plan, source }) {
-  return [
-    `Source      ${source}`,
-    `Data        ${dataDir}`,
-    `Admin       ${plan.appUrl}/admin`,
-    `Storefront  ${plan.storefrontUrl}`
-  ].join("\n");
+function describe({
+  shopDir,
+  database,
+  plan,
+  source,
+  extras: extras2 = []
+}) {
+  const rows = [
+    ["Source", source],
+    ["Folder", shopDir],
+    ["Database", redactUrl(database)],
+    ["Admin", `${plan.appUrl}/admin`],
+    ["Storefront", plan.storefrontUrl],
+    ...extras2.map((extra) => [extra.label, `http://localhost:${extra.port} (install it from the admin)`])
+  ];
+  const width = Math.max(...rows.map(([label]) => label?.length ?? 0)) + 2;
+  return rows.map(([label, value]) => `${label?.padEnd(width)}${value}`).join("\n");
 }
+var DEFAULT_SHOP_NAME = "shopnex";
 async function run(argv) {
   const options2 = parse(argv);
   if (options2.help) return void console.log(HELP);
   if (options2.version) return void console.log(pkg.version);
   assertNode(process.versions.node, pkg.engines.node);
   oe(brandBadge(` create-shopnex ${pkg.version} `));
-  const dataDir = resolveDataDir(options2.data);
+  const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const name = options2.name ?? DEFAULT_SHOP_NAME;
+  const shopDir = resolveShopDir(name);
+  const extras2 = pickExtras(options2.with);
+  const shopEnv = loadShopEnv(shopDir, { write: !options2.dryRun });
+  const scaffoldWarning = options2.dryRun ? void 0 : await writeScaffold(shopDir, pkg.version);
+  if (scaffoldWarning) f2.warn(scaffoldWarning);
   const ports = [
     { port: options2.port, flag: "--port" },
-    { port: options2.storefrontPort, flag: "--storefront-port" }
+    { port: options2.storefrontPort, flag: "--storefront-port" },
+    ...extras2.map((extra) => ({ port: extra.port, flag: `--with (${extra.name} needs it free)` }))
   ];
   if (!options2.dryRun) await assertPortsFree(ports);
   const root = options2.dryRun ? bundleDir(pkg.version) : await resolveBundle({ version: pkg.version });
   const source = isEdge(pkg.version) ? "ShopNex edge (the latest build from main, checked on every run)" : `ShopNex ${pkg.version} ${isInstalled(pkg.version) ? "(downloaded)" : "(downloaded on the first run)"}`;
-  const app = await pickApp(options2.app, { interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY) });
+  const app = await pickApp(options2.app, { interactive });
   const plan = app.plan({
     root,
-    dataDir,
+    shopDir,
+    extras: extras2,
+    databaseUrl: shopEnv.databaseUrl,
+    env: shopEnv.rest,
     port: options2.port,
     storefrontPort: options2.storefrontPort,
-    secret: options2.dryRun ? "" : ensureSecret(dataDir)
+    secret: shopEnv.secret,
+    appKeys: loadAppKeys(shopDir, extras2, { write: !options2.dryRun })
   });
-  le(describe({ dataDir, plan, source }), app.label);
+  le(describe({ shopDir, database: shopEnv.databaseUrl, plan, source, extras: extras2 }), app.label);
   if (options2.dryRun) return $e("Dry run: nothing was started.");
   f2.warn("This is a trial database: it is not for production.");
   process.exitCode = await runPlan(plan, { open: options2.open, verbose: options2.verbose });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-shopnex",
-  "version": "0.0.0-edge.init",
+  "version": "0.15.0",
   "description": "Try ShopNex with one command: npx create-shopnex starts the admin and the storefront on an embedded database, nothing else to install",
   "license": "MIT",
   "homepage": "https://shopnex.ai",