sellify-cli 0.1.2 → 0.2.0

package/README.md

@@ -1,6 +1,6 @@
 # sellify-cli
 
-Command line for Sellify stores: build themes in your own editor with live sync, and call the GraphQL Admin API.
+Command line for Sellify: build themes in your own editor with live sync, build apps (init, dev, deploy), and call the GraphQL Admin API.
 
 ```bash
 npm install -g sellify-cli     # or run any command with: npx sellify-cli <command>
@@ -47,6 +47,24 @@ Anything that changes the **live** theme asks first. Pass `--allow-live` to skip
 
 Every file is checked on upload like in the admin code editor (Liquid syntax, section schemas, JSON templates). Files with errors are reported and skipped; the rest are saved. Themes hold text files only: `.liquid`, `.json`, `.css`, `.js` and `.svg` in `layout/`, `templates/`, `sections/`, `snippets/`, `assets/`, `config/` and `locales/`.
 
+## Apps
+
+```sh
+sellify app init my-app     # starter app: OAuth install, Admin API page, signed webhooks (no dependencies)
+cd my-app
+sellify app dev             # creates the app in your Partner dashboard, runs it, prints an install link
+```
+
+| Command | What it does |
+|---|---|
+| `sellify app init [dir] [--name <name>]` | New app folder from the starter template |
+| `sellify app dev [--port <port>] [--tunnel-url <url>] [--no-tunnel]` | Run the app locally, point its URLs at it, print an install link |
+| `sellify app link [--app <id\|client id>] [--create]` | Connect the folder to one of your apps; credentials go to `.env` |
+| `sellify app deploy` | Point the app's URLs, scopes and uninstall webhook at `application_url` |
+| `sellify app info` / `sellify app list` | The linked app / all your apps |
+
+Webhooks need a public URL: with [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) installed, `app dev` opens a free tunnel automatically, or pass `--tunnel-url`.
+
 ## Admin API
 
 ```bash

package/bin/sellify.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-// Sellify CLI: develop themes locally (pull, push, live-sync with `theme dev`) and call the GraphQL Admin API.
-// No dependencies; needs Node 20+. Authenticates with a custom app access token (read_themes / write_themes).
+// Sellify CLI: develop themes locally (pull, push, live-sync with `theme dev`), build apps (`app init`, `app dev`,
+// `app deploy`) and call the GraphQL Admin API. No dependencies; needs Node 20+. Authenticates with a browser login
+// (`sellify login`) or a custom app access token.
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
@@ -475,6 +476,251 @@ async function graphql(flags, positionals) {
   log(JSON.stringify(await gql(s, query, variables), null, 2));
 }
 
+// ---------- Apps (`sellify app …`: your Partner dashboard apps, through /api/cli/apps) ----------
+
+const APP_CONFIG = "sellify.app.json";
+const isLocalUrl = (u) => /^https?:\/\/(localhost|127\.0\.0\.1|[^/]+\.localhost)(:\d+)?(\/|$)/.test(u);
+
+async function appApi(s, method, path = "", body) {
+  let res;
+  try {
+    res = await fetch(`${s.url}/api/cli/apps${path}`, {
+      method,
+      headers: { "Content-Type": "application/json", "X-Sellify-Access-Token": s.token, "User-Agent": `sellify-cli/${VERSION}` },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+  } catch (e) {
+    fail(`Can't reach ${s.url} (${e.cause?.code ?? e.message}). Check --url.`);
+  }
+  const data = await res.json().catch(() => ({}));
+  if (res.status === 401) fail("Apps need a browser login. Run `sellify login` (custom app tokens can't manage apps).");
+  if (!res.ok) fail(data.error ?? `Unexpected response from ${s.url} (HTTP ${res.status}).`);
+  return data;
+}
+
+const appRoot = (flags) => resolve(flags.path || ".");
+
+function readAppConfig(root) {
+  const p = join(root, APP_CONFIG);
+  if (!existsSync(p)) fail(`${root} isn't an app folder (no ${APP_CONFIG}). Run \`sellify app init\` first or pass --path.`);
+  try {
+    return JSON.parse(readFileSync(p, "utf8"));
+  } catch (e) {
+    fail(`${APP_CONFIG} isn't valid JSON: ${e.message}`);
+  }
+}
+
+const writeAppConfig = (root, cfg) => writeFileSync(join(root, APP_CONFIG), JSON.stringify(cfg, null, 2) + "\n");
+
+/** Sets keys in the app's .env (readable only by you), keeping everything else in it. */
+function writeDotEnv(root, vars) {
+  const p = join(root, ".env");
+  const lines = existsSync(p) ? readFileSync(p, "utf8").split(/\r?\n/).filter((l, i, all) => l || i < all.length - 1) : [];
+  for (const [k, v] of Object.entries(vars)) {
+    const i = lines.findIndex((l) => l.startsWith(`${k}=`));
+    if (i >= 0) lines[i] = `${k}=${v}`;
+    else lines.push(`${k}=${v}`);
+  }
+  writeFileSync(p, lines.join("\n") + "\n", { mode: 0o600 });
+}
+
+function readDotEnv(root) {
+  const p = join(root, ".env");
+  if (!existsSync(p)) return {};
+  return Object.fromEntries(readFileSync(p, "utf8").split(/\r?\n/).flatMap((l) => (/^[A-Z0-9_]+=/.test(l) ? [[l.slice(0, l.indexOf("=")), l.slice(l.indexOf("=") + 1)]] : [])));
+}
+
+const appLine = (a) => `${a.name}  ${a.listed ? c.green(`[${a.reviewStatus === "approved" ? "listed" : `listed · ${a.reviewStatus}`}]`) : c.dim("[unlisted]")}${a.suspended ? c.red(" [suspended]") : ""}  ${c.dim(`${a.installs} install${a.installs === 1 ? "" : "s"} · ${a.clientId}`)}`;
+
+async function appInit(flags, positionals) {
+  const dir = positionals[0] || "my-sellify-app";
+  const root = resolve(dir);
+  if (existsSync(root) && readdirSync(root).length) fail(`${root} already exists and isn't empty.`);
+  const slug = dir.split(/[\\/]/).pop().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "my-sellify-app";
+  const name = flags.name || slug.replace(/-/g, " ").replace(/\b\w/g, (ch) => ch.toUpperCase());
+  const template = new URL("../templates/app/", import.meta.url);
+  mkdirSync(root, { recursive: true });
+  // npm drops dotfiles from published packages, so the template stores them without the dot.
+  for (const file of readdirSync(template)) writeFileSync(join(root, { gitignore: ".gitignore", "env.example": ".env.example" }[file] ?? file), readFileSync(new URL(file, template)));
+  const cfg = readAppConfig(root);
+  writeAppConfig(root, { ...cfg, name });
+  const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+  writeFileSync(join(root, "package.json"), JSON.stringify({ ...pkg, name: slug }, null, 2) + "\n");
+  log(`${c.green("✓")} Created ${c.bold(name)} in ${root}\n\n  cd ${relative(process.cwd(), root) || "."}\n  sellify app dev     ${c.dim("Creates the app in your Partner dashboard, runs it and prints an install link")}\n\n${c.dim("Edit server.mjs to build your app. No dependencies needed (Node 20+).")}`);
+}
+
+async function appList(flags) {
+  const s = session(flags);
+  const { apps } = await appApi(s, "GET");
+  if (!apps.length) return log(`No apps yet. Run ${c.bold("sellify app init")} to start one.`);
+  for (const a of apps) log(appLine(a));
+}
+
+/** Connects the folder to a Partner app (an existing one with --app, or a new one), and writes its credentials to .env. */
+async function linkApp(s, root, cfg, flags) {
+  let app;
+  if (flags.app) {
+    const { apps } = await appApi(s, "GET");
+    app = apps.find((a) => a.id === flags.app || a.clientId === flags.app || a.handle === flags.app);
+    if (!app) fail(`No app ${flags.app} in your Partner dashboard. Run \`sellify app list\`.`);
+  } else {
+    if (!flags.create && process.stdin.isTTY) {
+      const { apps } = await appApi(s, "GET");
+      if (apps.length) {
+        apps.forEach((a, i) => log(`  ${c.bold(i + 1)}. ${appLine(a)}`));
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        const answer = (await rl.question(`Link to which app? Number, or ${c.bold("n")} for a new one ${c.dim(`(n)`)} `)).trim();
+        rl.close();
+        app = apps[Number(answer) - 1];
+        if (answer && !/^n(ew)?$/i.test(answer) && !app) fail("Stopped.");
+      }
+    }
+    if (!app) {
+      ({ app } = await appApi(s, "POST", "", { name: cfg.name }));
+      log(`${c.green("✓")} Created ${c.bold(app.name)} in your Partner dashboard`);
+    }
+  }
+  const { app: full } = await appApi(s, "GET", `/${app.id}?secret=1`);
+  writeAppConfig(root, { ...cfg, app_id: full.id, client_id: full.clientId });
+  writeDotEnv(root, { SELLIFY_CLIENT_ID: full.clientId, SELLIFY_CLIENT_SECRET: full.clientSecret });
+  log(`${c.green("✓")} Linked to ${c.bold(full.name)} ${c.dim(`(${full.clientId}) · credentials saved to .env`)}`);
+  return full;
+}
+
+async function appLink(flags) {
+  const s = session(flags);
+  const root = appRoot(flags);
+  await linkApp(s, root, readAppConfig(root), flags);
+}
+
+/** A free Cloudflare quick tunnel (if cloudflared is installed), so Sellify can reach the local app with webhooks. */
+function startTunnel(port) {
+  return new Promise((done) => {
+    const proc = spawn("cloudflared", ["tunnel", "--no-autoupdate", "--url", `http://localhost:${port}`], { stdio: ["ignore", "pipe", "pipe"] });
+    const timer = setTimeout(() => {
+      proc.kill();
+      done(null);
+    }, 30_000);
+    proc.on("error", () => {
+      clearTimeout(timer);
+      done(null);
+    });
+    const onData = (d) => {
+      const m = String(d).match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/);
+      if (!m) return;
+      clearTimeout(timer);
+      done({ url: m[0], proc });
+    };
+    proc.stdout.on("data", onData);
+    proc.stderr.on("data", onData);
+  });
+}
+
+async function waitForApp(port, child) {
+  for (let i = 0; i < 100; i++) {
+    if (child.exitCode !== null) fail(`The app exited (code ${child.exitCode}) before it started. See the output above.`);
+    try {
+      if ((await fetch(`http://localhost:${port}/health`)).ok) return;
+    } catch {
+      // Not listening yet.
+    }
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  fail(`The app didn't answer on http://localhost:${port}/health within 20 seconds.`);
+}
+
+/** Runs the app locally, points the Partner app's URLs at it and prints an install link for the logged-in store. */
+async function appDev(flags) {
+  const s = session(flags);
+  const root = appRoot(flags);
+  let cfg = readAppConfig(root);
+  let app = cfg.app_id ? (await appApi(s, "GET", `/${cfg.app_id}`)).app : await linkApp(s, root, cfg, { create: true });
+  cfg = readAppConfig(root);
+  if (app.listed) fail(`${app.name} is listed in the App Store: app dev would point merchants' installs at your computer.\nUse a separate app for development: ${c.bold("sellify app link --create")}`);
+  let env = readDotEnv(root);
+  if (env.SELLIFY_CLIENT_ID !== app.clientId || !env.SELLIFY_CLIENT_SECRET) {
+    await linkApp(s, root, cfg, { app: app.id });
+    env = readDotEnv(root);
+  }
+
+  const port = Number(flags.port || cfg.dev_port || 3456);
+  let base = `http://localhost:${port}`;
+  let tunnel = null;
+  let webhooks = true;
+  if (flags["tunnel-url"]) base = flags["tunnel-url"].replace(/\/+$/, "");
+  else if (!isLocalUrl(s.url)) {
+    if (!flags["no-tunnel"]) {
+      log(c.dim("Opening a tunnel with cloudflared…"));
+      tunnel = await startTunnel(port);
+    }
+    if (tunnel) base = tunnel.url;
+    else webhooks = false;
+  }
+
+  const redirectPath = cfg.redirect_path || "/auth/callback";
+  const webhookPath = cfg.webhook_path || "/webhooks";
+  const { app: updated } = await appApi(s, "PATCH", `/${app.id}`, {
+    name: cfg.name,
+    appUrl: base,
+    redirectUrls: [base + redirectPath],
+    scopes: cfg.scopes ?? [],
+    uninstallWebhookUrl: webhooks ? base + webhookPath : "",
+  });
+
+  const child = spawn(cfg.dev_command || "node --watch server.mjs", {
+    cwd: root,
+    shell: true,
+    stdio: "inherit",
+    env: { ...process.env, PORT: String(port), SELLIFY_APP_URL: base, SELLIFY_ADMIN_URL: s.url, SELLIFY_CLIENT_ID: env.SELLIFY_CLIENT_ID, SELLIFY_CLIENT_SECRET: env.SELLIFY_CLIENT_SECRET },
+  });
+  const stop = (code = 0) => {
+    tunnel?.proc.kill();
+    if (child.exitCode === null) child.kill();
+    process.exit(code);
+  };
+  process.on("SIGINT", () => stop(0));
+  process.on("SIGTERM", () => stop(0));
+  await waitForApp(port, child);
+  child.on("exit", (code) => {
+    log(`${c.red("✗")} The app exited (code ${code}).`);
+    stop(code ?? 1);
+  });
+
+  log(`\n${c.green("●")} ${c.bold(updated.name)} is running
+  App        ${c.cyan(base)}
+  Install    ${c.cyan(`${base}/install?store=${encodeURIComponent(s.store)}`)}  ${c.dim(`on ${s.store}`)}
+  Webhooks   ${webhooks ? base + webhookPath : c.yellow("off: Sellify can't reach localhost. Install cloudflared, or pass --tunnel-url https://…")}
+  Partner    ${c.dim(updated.dashboardUrl)}
+${c.dim("Edits to your code restart the app. Ctrl+C to stop.")}`);
+  await new Promise(() => {});
+}
+
+/** Points the app's URLs, scopes and uninstall webhook at its production URL (application_url). */
+async function appDeploy(flags) {
+  const s = session(flags);
+  const root = appRoot(flags);
+  const cfg = readAppConfig(root);
+  if (!cfg.app_id) fail("This folder isn't linked to an app yet. Run `sellify app link` (or `sellify app dev`).");
+  const base = String(cfg.application_url || "").replace(/\/+$/, "");
+  if (!/^https:\/\//.test(base)) fail(`Set application_url in ${APP_CONFIG} to your app's public https URL first.`);
+  const { app, message } = await appApi(s, "PATCH", `/${cfg.app_id}`, {
+    name: cfg.name,
+    appUrl: base,
+    redirectUrls: [base + (cfg.redirect_path || "/auth/callback")],
+    scopes: cfg.scopes ?? [],
+    uninstallWebhookUrl: base + (cfg.webhook_path || "/webhooks"),
+  });
+  log(`${c.green("✓")} ${message}: ${c.bold(app.name)} now uses ${base}\n  Scopes     ${app.scopes.join(", ") || "none"}\n  Install    ${c.cyan(`${base}/install?store=${encodeURIComponent(s.store)}`)}\n  Partner    ${c.dim(app.dashboardUrl)}`);
+}
+
+async function appInfo(flags) {
+  const s = session(flags);
+  const cfg = readAppConfig(appRoot(flags));
+  if (!cfg.app_id) fail("This folder isn't linked to an app yet. Run `sellify app link` (or `sellify app dev`).");
+  const { app } = await appApi(s, "GET", `/${cfg.app_id}`);
+  log(`${appLine(app)}\n  App URL    ${app.appUrl || c.dim("not set")}\n  Redirect   ${app.redirectUrls.join(", ") || c.dim("not set")}\n  Scopes     ${app.scopes.join(", ") || "none"}\n  Uninstall  ${app.uninstallWebhookUrl || c.dim("no webhook")}\n  Partner    ${c.dim(app.dashboardUrl)}`);
+}
+
 // ---------- Entry ----------
 
 const HELP = `${c.bold("sellify")} ${VERSION} — Sellify command line
@@ -494,6 +740,15 @@ ${c.bold("Themes")} (run inside a theme folder, or pass --path <dir>)
   sellify theme publish  --theme <id>
   sellify theme delete   --theme <id> [--force]
 
+${c.bold("Apps")} (run inside an app folder, or pass --path <dir>)
+  sellify app init [dir] [--name <name>]   Start a new app from the starter template
+  sellify app dev  [--port <port>] [--tunnel-url <https url>] [--no-tunnel]
+                                           Run it locally, point the app at it and print an install link
+  sellify app link [--app <id|client id>] [--create]   Connect the folder to an app in your Partner dashboard
+  sellify app deploy                       Point the app's URLs and scopes at application_url (production)
+  sellify app info                         Show the linked app's settings
+  sellify app list                         Your apps in the Partner dashboard
+
 ${c.bold("Admin API")}
   sellify graphql '<query>' [--variables '<json>']
   sellify graphql --file query.graphql
@@ -524,6 +779,11 @@ const OPTIONS = {
   force: { type: "boolean" },
   "allow-live": { type: "boolean" },
   "no-browser": { type: "boolean" },
+  app: { type: "string" },
+  create: { type: "boolean" },
+  port: { type: "string" },
+  "tunnel-url": { type: "string" },
+  "no-tunnel": { type: "boolean" },
   help: { type: "boolean", short: "h" },
   version: { type: "boolean", short: "v" },
 };
@@ -540,6 +800,12 @@ const COMMANDS = {
   "theme open": (f) => themeOpen(f),
   "theme publish": (f) => themePublish(f),
   "theme delete": (f) => themeDelete(f),
+  "app init": (f, p) => appInit(f, p),
+  "app dev": (f) => appDev(f),
+  "app link": (f) => appLink(f),
+  "app deploy": (f) => appDeploy(f),
+  "app info": (f) => appInfo(f),
+  "app list": (f) => appList(f),
 };
 
 async function main() {
@@ -552,13 +818,14 @@ async function main() {
   const { values: flags, positionals } = parsed;
   if (flags.version) return log(VERSION);
   const [a, b, ...rest] = positionals;
-  const key = a === "theme" ? `theme ${b ?? ""}` : a;
+  const grouped = a === "theme" || a === "app";
+  const key = grouped ? `${a} ${b ?? ""}` : a;
   if (flags.help || !a || !COMMANDS[key]) {
     log(HELP);
     if (a && !flags.help && !COMMANDS[key]) process.exitCode = 1;
     return;
   }
-  await COMMANDS[key](flags, a === "theme" ? rest : [b, ...rest].filter(Boolean));
+  await COMMANDS[key](flags, grouped ? rest : [b, ...rest].filter(Boolean));
 }
 
 main().catch((e) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sellify-cli",
-  "version": "0.1.2",
-  "description": "Command line for Sellify: develop themes locally (pull, push, live sync) and call the GraphQL Admin API.",
+  "version": "0.2.0",
+  "description": "Command line for Sellify: develop themes locally (pull, push, live sync), build apps (init, dev, deploy) and call the GraphQL Admin API.",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -9,6 +9,7 @@
   },
   "files": [
     "bin",
+    "templates",
     "README.md",
     "LICENSE"
   ],
@@ -20,6 +21,7 @@
     "ecommerce",
     "liquid",
     "theme",
-    "cli"
+    "cli",
+    "apps"
   ]
 }

package/templates/app/README.md

@@ -0,0 +1,32 @@
+# My Sellify app
+
+A Sellify app with no dependencies (Node 20+). It installs on a store with OAuth, shows a page built with the GraphQL Admin API, and receives signed webhooks.
+
+## Develop
+
+```sh
+sellify login        # once
+sellify app dev      # creates the app in your Partner dashboard on first run, then runs it
+```
+
+`app dev` starts `server.mjs`, points your app's URLs at it and prints an install link for your store. Open the link, approve, and you land on the app's page. Edits restart the server automatically.
+
+Webhooks need a public URL. If [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) is installed, `app dev` opens a tunnel for you; or pass your own with `--tunnel-url https://…`.
+
+## Files
+
+| File | What it does |
+|---|---|
+| `server.mjs` | The app: `/install` → Sellify approval → `/auth/callback` (token) → `/` (your page), and `/webhooks` |
+| `sellify.app.json` | Name, scopes, webhook topics, paths, and the production `application_url` |
+| `.env` | Client ID and secret (written by `sellify app dev`; never commit it) |
+| `data/stores.json` | Access tokens per store (use a database in production) |
+
+## Ship it
+
+1. Host the app anywhere that runs Node (Render, Railway, Fly.io, a VPS) with the variables from `.env.example`.
+2. Set `application_url` in `sellify.app.json` to its https URL.
+3. Run `sellify app deploy` to point your app's URLs, scopes and uninstall webhook at it.
+4. To list it in the App Store, add a tagline, description and support email in the Partner dashboard and submit it for review.
+
+Use a separate app for development (`sellify app link --create`) once your app is live, so `app dev` never changes the URLs merchants use.

package/templates/app/env.example

@@ -0,0 +1,7 @@
+# Production settings. `sellify app dev` sets these for you while developing.
+SELLIFY_CLIENT_ID=
+SELLIFY_CLIENT_SECRET=
+# Your app's public https URL (same as application_url in sellify.app.json)
+SELLIFY_APP_URL=
+SELLIFY_ADMIN_URL=https://admin-sellifyhq.vercel.app
+PORT=3456

package/templates/app/gitignore

@@ -0,0 +1,3 @@
+node_modules/
+.env
+data/

package/templates/app/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "my-sellify-app",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "sellify app dev",
+    "start": "node server.mjs"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/templates/app/sellify.app.json

@@ -0,0 +1,12 @@
+{
+  "name": "My Sellify app",
+  "app_id": "",
+  "client_id": "",
+  "application_url": "",
+  "redirect_path": "/auth/callback",
+  "webhook_path": "/webhooks",
+  "scopes": ["read_products", "read_orders"],
+  "webhook_topics": ["ORDERS_CREATE"],
+  "dev_command": "node --watch server.mjs",
+  "dev_port": 3456
+}

package/templates/app/server.mjs

@@ -0,0 +1,228 @@
+// A Sellify app with no dependencies (Node 20+):
+//   /install?store=…  → the merchant approves on Sellify (OAuth) → /auth/callback stores the store's access token
+//   /                 → the app's page: opened from the Sellify admin (signed link) or after installing
+//   /webhooks         → signed webhooks (orders/create, app/uninstalled, …)
+// `sellify app dev` runs it with the right URLs and credentials. In production set the variables from .env.example.
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+
+loadEnvFile(".env");
+const config = JSON.parse(readFileSync(new URL("./sellify.app.json", import.meta.url), "utf8"));
+const PORT = Number(process.env.PORT || 3456);
+const APP_URL = (process.env.SELLIFY_APP_URL || config.application_url || `http://localhost:${PORT}`).replace(/\/+$/, "");
+const ADMIN_URL = (process.env.SELLIFY_ADMIN_URL || "https://admin-sellifyhq.vercel.app").replace(/\/+$/, "");
+const CLIENT_ID = process.env.SELLIFY_CLIENT_ID;
+const CLIENT_SECRET = process.env.SELLIFY_CLIENT_SECRET;
+const SCOPES = config.scopes ?? [];
+const REDIRECT_URL = APP_URL + (config.redirect_path ?? "/auth/callback");
+const WEBHOOK_URL = APP_URL + (config.webhook_path ?? "/webhooks");
+const API_VERSION = "2026-10";
+
+if (!CLIENT_ID || !CLIENT_SECRET) {
+  console.error("Missing SELLIFY_CLIENT_ID / SELLIFY_CLIENT_SECRET. Run `sellify app dev` (it sets them), or copy .env.example to .env.");
+  process.exit(1);
+}
+
+// ---------- Installs (one access token per store; a database in a real app) ----------
+
+const DATA = new URL("./data/stores.json", import.meta.url);
+const stores = existsSync(DATA) ? JSON.parse(readFileSync(DATA, "utf8")) : {};
+const saveStores = () => {
+  mkdirSync(new URL("./data/", import.meta.url), { recursive: true });
+  writeFileSync(DATA, JSON.stringify(stores, null, 2));
+};
+const recentWebhooks = [];
+
+// ---------- Signatures ----------
+
+const hmacHex = (message) => createHmac("sha256", CLIENT_SECRET).update(message).digest("hex");
+const same = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+
+/** Links from Sellify (app launch, OAuth callback) carry hmac = hex HMAC-SHA256 of the other params, sorted, "k=v&k=v". */
+function verifyQuery(params) {
+  const hmac = params.get("hmac") ?? "";
+  const message = [...params.keys()].filter((k) => k !== "hmac").sort().map((k) => `${k}=${params.get(k)}`).join("&");
+  const fresh = Math.abs(Date.now() / 1000 - Number(params.get("timestamp"))) < 600;
+  return fresh && same(hmac, hmacHex(message));
+}
+
+/** Webhooks carry X-Sellify-Hmac-Sha256 = base64 HMAC-SHA256 of the raw body. */
+const verifyWebhook = (raw, header) => same(header ?? "", createHmac("sha256", CLIENT_SECRET).update(raw).digest("base64"));
+
+// A signed cookie remembers which store the browser is using the app for.
+const sign = (value) => `${value}.${hmacHex(`cookie:${value}`).slice(0, 32)}`;
+const unsign = (signed = "") => {
+  const i = signed.lastIndexOf(".");
+  const value = signed.slice(0, i);
+  return i > 0 && same(signed, sign(value)) ? value : null;
+};
+const cookies = (req) => Object.fromEntries((req.headers.cookie ?? "").split(";").map((p) => p.trim().split("=")).filter(([k]) => k).map(([k, ...v]) => [k, decodeURIComponent(v.join("="))]));
+const secure = APP_URL.startsWith("https:") ? "; Secure" : "";
+const setCookie = (name, value, maxAge) => `${name}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}`;
+
+// ---------- Admin API ----------
+
+async function graphql(store, query, variables = {}) {
+  const res = await fetch(`${ADMIN_URL}/api/admin/${API_VERSION}/graphql`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-Sellify-Access-Token": stores[store].token },
+    body: JSON.stringify({ query, variables }),
+  });
+  const body = await res.json();
+  if (res.status === 401) throw Object.assign(new Error("Token revoked"), { revoked: true });
+  if (body.errors?.length) throw new Error(body.errors[0].message);
+  return body.data;
+}
+
+/** Points the store's webhook subscriptions at this app's current URL (tunnel URLs change between `app dev` runs). */
+async function syncWebhooks(store) {
+  const topics = (config.webhook_topics ?? []).filter((t) => t !== "APP_UNINSTALLED");
+  const { webhookSubscriptions } = await graphql(store, "{ webhookSubscriptions { id topic callbackUrl } }");
+  for (const sub of webhookSubscriptions) {
+    if (sub.callbackUrl !== WEBHOOK_URL || !topics.includes(sub.topic)) await graphql(store, "mutation($id: ID!) { webhookSubscriptionDelete(id: $id) { userErrors { message } } }", { id: sub.id });
+  }
+  for (const topic of topics) {
+    if (webhookSubscriptions.some((s) => s.topic === topic && s.callbackUrl === WEBHOOK_URL)) continue;
+    const { webhookSubscriptionCreate: r } = await graphql(
+      store,
+      "mutation($topic: WebhookTopic!, $url: String!) { webhookSubscriptionCreate(topic: $topic, callbackUrl: $url) { userErrors { message } } }",
+      { topic, url: WEBHOOK_URL },
+    );
+    if (r.userErrors.length) console.warn(`[webhooks] ${store} ${topic}: ${r.userErrors[0].message}`);
+  }
+}
+
+// ---------- Pages ----------
+
+const esc = (s) => String(s ?? "").replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+const page = (title, body) => `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${esc(title)}</title>
+<style>body{margin:0;font:15px/1.5 system-ui,sans-serif;background:#f6f5f0;color:#111}main{max-width:760px;margin:0 auto;padding:40px 20px}h1{font-size:24px;margin:0 0 4px}
+.muted{color:#666}.card{background:#fff;border-radius:12px;padding:18px 20px;margin-top:16px;box-shadow:0 0 0 1px #0000000f}table{width:100%;border-collapse:collapse}
+td,th{text-align:left;padding:6px 0;border-bottom:1px solid #eee;font-size:14px}th{font-weight:500;color:#666}code{background:#f0efe9;padding:1px 5px;border-radius:4px}
+input{padding:8px 10px;border:1px solid #ccc;border-radius:8px}button{padding:8px 14px;border:0;border-radius:8px;background:#0b5d3b;color:#fff;cursor:pointer}</style>
+<main>${body}</main></html>`;
+
+async function home(store) {
+  const canOrders = SCOPES.includes("read_orders") || SCOPES.includes("write_orders");
+  const data = await graphql(
+    store,
+    `{ shop { name myshopifyDomain } products(first: 5) { nodes { title totalInventory } } ${canOrders ? "orders(first: 5) { nodes { name createdAt displayFinancialStatus totalPrice { amount currencyCode } } }" : ""} }`,
+  );
+  const rows = (items, cells) => items.map((x) => `<tr>${cells(x).map((v) => `<td>${esc(v)}</td>`).join("")}</tr>`).join("") || `<tr><td class="muted">Nothing yet</td></tr>`;
+  return page(
+    config.name,
+    `<h1>${esc(config.name)}</h1><p class="muted">Installed on <b>${esc(data.shop.name)}</b> · ${esc(data.shop.myshopifyDomain)}</p>
+    <div class="card"><b>Latest products</b><table><tr><th>Title</th><th>Stock</th></tr>${rows(data.products.nodes, (p) => [p.title, p.totalInventory])}</table></div>
+    ${canOrders ? `<div class="card"><b>Latest orders</b><table><tr><th>Order</th><th>Status</th><th>Total</th></tr>${rows(data.orders.nodes, (o) => [o.name, o.displayFinancialStatus, `${o.totalPrice.currencyCode} ${o.totalPrice.amount}`])}</table></div>` : ""}
+    <div class="card"><b>Webhooks received</b> <span class="muted">(since the app started)</span><table>${rows(recentWebhooks.filter((w) => w.store === store), (w) => [w.at, w.topic])}</table></div>
+    <p class="muted">Edit <code>server.mjs</code> to build your app. Docs: ${esc(ADMIN_URL.replace("admin", "dev"))}/docs</p>`,
+  );
+}
+
+const landing = () =>
+  page(config.name, `<h1>${esc(config.name)}</h1><p class="muted">Open this app from your Sellify admin, or install it on a store:</p>
+  <form class="card" action="/install"><input name="store" placeholder="your-store" required> <button>Install</button></form>`);
+
+// ---------- Server ----------
+
+const send = (res, status, body, headers = {}) => res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", ...headers }).end(body);
+const redirect = (res, location, headers = {}) => res.writeHead(302, { Location: location, ...headers }).end();
+const readBody = (req) => new Promise((resolve) => {
+  const chunks = [];
+  req.on("data", (c) => chunks.push(c)).on("end", () => resolve(Buffer.concat(chunks)));
+});
+const validStore = (s) => /^[a-z0-9][a-z0-9-]{0,62}$/.test(s ?? "");
+
+async function handle(req, res) {
+  const url = new URL(req.url, APP_URL);
+  const q = url.searchParams;
+
+  if (url.pathname === "/health") return send(res, 200, "ok", { "Content-Type": "text/plain" });
+
+  // 1. Start an install: send the merchant to Sellify to approve the scopes.
+  if (url.pathname === "/install") {
+    const store = q.get("store")?.trim().toLowerCase();
+    if (!validStore(store)) return send(res, 400, landing());
+    const state = randomBytes(16).toString("hex");
+    const authorize = new URL(`${ADMIN_URL}/oauth/authorize`);
+    for (const [k, v] of Object.entries({ client_id: CLIENT_ID, scope: SCOPES.join(","), redirect_uri: REDIRECT_URL, state, store })) authorize.searchParams.set(k, v);
+    return redirect(res, authorize.toString(), { "Set-Cookie": setCookie("sellify_state", state, 600) });
+  }
+
+  // 2. The merchant approved (or cancelled): check the signature and state, then swap the code for a token.
+  if (url.pathname === (config.redirect_path ?? "/auth/callback")) {
+    if (!verifyQuery(q)) return send(res, 400, page("Error", "<h1>Invalid signature</h1><p>Start the install again.</p>"));
+    if (q.get("state") !== cookies(req).sellify_state) return send(res, 400, page("Error", "<h1>This install link expired</h1><p>Start the install again.</p>"));
+    if (q.get("error")) return send(res, 200, page("Cancelled", "<h1>Install cancelled</h1>"));
+    const store = q.get("store");
+    const r = await fetch(`${ADMIN_URL}/api/oauth/access_token`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ client_id: CLIENT_ID, client_secret: CLIENT_SECRET, code: q.get("code") }) });
+    const grant = await r.json();
+    if (!r.ok || !grant.access_token) return send(res, 400, page("Error", `<h1>Couldn't finish installing</h1><p>${esc(grant.error)}</p>`));
+    stores[store] = { token: grant.access_token, scope: grant.scope, shop: q.get("shop"), installedAt: new Date().toISOString() };
+    saveStores();
+    await syncWebhooks(store).catch((e) => console.warn(`[webhooks] ${store}: ${e.message}`));
+    console.log(`[install] ${store} installed the app (${grant.scope})`);
+    return redirect(res, "/", { "Set-Cookie": [setCookie("sellify_store", sign(store), 86400), setCookie("sellify_state", "", 0)] });
+  }
+
+  // 3. Webhooks: check the signature on the raw body before trusting anything in it.
+  if (url.pathname === (config.webhook_path ?? "/webhooks") && req.method === "POST") {
+    const raw = await readBody(req);
+    if (!verifyWebhook(raw, req.headers["x-sellify-hmac-sha256"])) return send(res, 401, "bad signature", { "Content-Type": "text/plain" });
+    const topic = req.headers["x-sellify-topic"];
+    const payload = JSON.parse(raw.toString("utf8"));
+    const shop = req.headers["x-sellify-shop-domain"];
+    const store = payload.store ?? Object.keys(stores).find((s) => stores[s].shop === shop) ?? shop;
+    if (topic === "app/uninstalled") {
+      delete stores[store];
+      saveStores();
+    }
+    recentWebhooks.unshift({ at: new Date().toLocaleTimeString(), topic, store });
+    recentWebhooks.length = Math.min(recentWebhooks.length, 20);
+    console.log(`[webhook] ${topic} from ${store}`);
+    return send(res, 200, "ok", { "Content-Type": "text/plain" });
+  }
+
+  // 4. The app's page. Opened from the Sellify admin with a signed link, or after installing (cookie).
+  if (url.pathname === "/") {
+    let store = unsign(cookies(req).sellify_store);
+    const headers = {};
+    if (q.has("hmac")) {
+      if (!verifyQuery(q)) return send(res, 400, page("Error", "<h1>Invalid signature</h1>"));
+      store = q.get("store");
+      headers["Set-Cookie"] = setCookie("sellify_store", sign(store), 86400);
+    }
+    if (!store) return send(res, 200, landing());
+    if (!stores[store]) return redirect(res, `/install?store=${encodeURIComponent(store)}`);
+    try {
+      return send(res, 200, await home(store), headers);
+    } catch (e) {
+      if (!e.revoked) throw e;
+      delete stores[store];
+      saveStores();
+      return redirect(res, `/install?store=${encodeURIComponent(store)}`);
+    }
+  }
+
+  send(res, 404, page("Not found", "<h1>Not found</h1>"));
+}
+
+createServer((req, res) =>
+  handle(req, res).catch((e) => {
+    console.error(e);
+    if (!res.headersSent) send(res, 500, page("Error", "<h1>Something went wrong</h1>"));
+  }),
+).listen(PORT, () => {
+  console.log(`${config.name} is running on ${APP_URL} (port ${PORT})`);
+  // Installs from earlier runs: move their webhooks to this run's URL.
+  for (const store of Object.keys(stores)) syncWebhooks(store).catch((e) => console.warn(`[webhooks] ${store}: ${e.message}`));
+});
+
+function loadEnvFile(file) {
+  if (!existsSync(file)) return;
+  for (const line of readFileSync(file, "utf8").split(/\r?\n/)) {
+    const m = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);
+    if (m && process.env[m[1]] === undefined) process.env[m[1]] = m[2].replace(/^(['"])(.*)\1$/, "$2");
+  }
+}