refactor: rebuild Nundar as a shop plugin and a commerce theme on Mallok

.dev.vars.example

@@ -1,29 +1,18 @@
-# Template for local environment variables. Copy to .dev.vars and fill in real
-# values — .dev.vars is gitignored.
+# Copy to `.dev.vars` for `wrangler dev`. Never commit `.dev.vars`.
 #
-#   cp .dev.vars.example .dev.vars
-#
-# Local development and tests need no secrets at all: D1, R2 and KV are
-# simulated by miniflare, migrations are applied through wrangler, and
-# drizzle-kit only generates SQL without connecting to anything.
-#
-# The variables below are needed once you deploy. Uncomment and fill them in:
-
-# Stripe payments
-# STRIPE_SECRET_KEY=
-# STRIPE_WEBHOOK_SECRET=
-# NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
+# Local only: the deployed Worker reads these from Worker secrets, which
+# `mallok create` sets with `wrangler secret put`.
 
-# Admin session signing key (generate with: openssl rand -base64 32)
-# SESSION_SECRET=
+# Signs sessions and encrypts stored plugin keys. Any 32 random bytes:
+#   openssl rand -hex 32
+MALLOK_SECRET=change-me-to-32-random-bytes
 
-# From address for transactional email
-# MAIL_FROM_ADDRESS=
+# The one-time key the first-run wizard at /_mallok/setup asks for. Without it
+# a local site cannot be claimed. Any random value:
+#   openssl rand -hex 32
+MALLOK_SETUP_KEY=change-me-to-a-random-setup-key
 
-# Theme, resolved at build time. Leave empty for the default.
-# Ships with two: "default" (technical, hairline borders, catalogue-first) and
-# "editorial" (serif, warm paper, soft shadows, application-notes-first).
-# To add your own: copy a theme directory under a new name, rename its scope
-# class in tokens.css and layout/Shell.tsx to match, register it in
-# src/themes/registry.ts, then put that name here.
-THEME=
+# Optional. With a zone-scoped Cache Purge token, an edit is visible
+# immediately; without one it is visible when the cached page expires.
+# CF_API_TOKEN=
+# CF_ZONE_ID=

.editorconfig

@@ -0,0 +1,9 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true

.github/ISSUE_TEMPLATE/bug_report.md

@@ -15,6 +15,7 @@ labels: bug
 
 **Environment**
 - Local dev or deployed to Cloudflare?
+- Mallok version (`package.json`):
 - Node version:
 - Browser (if relevant):
 

.github/ISSUE_TEMPLATE/feature_request.md

@@ -12,6 +12,8 @@ Describe the situation, not the solution.
 **What you have considered**
 
 **Scope check**
-Nundar is a single-tenant storefront template. Multi-tenant SaaS features,
-marketplace/multi-vendor flows and B2B quotation are deliberately out of scope —
-see the "Out of scope" section of the design spec.
+Nundar is a shop plugin and a commerce theme for Mallok, for a single shop on
+its own Cloudflare account. Multi-tenant SaaS and marketplace or multi-vendor
+flows are deliberately out of scope. Anything about pages, content, languages,
+the admin or caching in general belongs to Mallok rather than here — see the
+design spec in `docs/superpowers/specs/`.

.github/pull_request_template.md

@@ -3,9 +3,10 @@
 ## Why
 
 ## How it was verified
-- [ ] `pnpm test`
-- [ ] `pnpm typecheck`
-- [ ] `pnpm lint`
+- [ ] `npm run lint`
+- [ ] `npm run typecheck`
+- [ ] `npm test`
+- [ ] `npm run smoke:shop` (when the change touches the plugin, the theme or the content)
 - [ ] Checked in the browser (describe what you clicked)
 
 ## Spec impact

.github/workflows/ci.yml

@@ -16,31 +16,29 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v6
-
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
-          cache: pnpm
+          node-version-file: .nvmrc
+          cache: npm
+
+      # npm, not pnpm: Mallok's CLI installs and upgrades with npm only, and
+      # refuses a project that carries another manager's lockfile
+      - run: npm ci
 
-      - run: pnpm install --frozen-lockfile
+      - run: npm run lint
 
-      # Runs the exact command the README gives a new contributor: generate
-      # migrations, create the tables, load the seed data. Using it instead of
-      # the three underlying commands means CI also proves `pnpm setup` still
-      # works — the first command someone runs from the docs failing is the most
-      # discouraging kind of breakage.
-      #
-      # The build depends on this: generateStaticParams reads the local D1 for
-      # the product and use-case lists, so without the tables it fails with
-      # "no such table".
-      - run: pnpm setup
+      - run: npm run typecheck
 
-      - run: pnpm typecheck
+      # The project checks run in Node; the shop plugin's and the theme's tests
+      # run inside the real workerd runtime, not a Node mock
+      - run: npm test
 
-      - run: pnpm lint
+      # Stages the admin and theme assets, then a production build
+      - run: npm run build
 
-      # Tests run inside the real workerd runtime, not a Node mock
-      - run: pnpm test
+      # A real request to a real Worker: it boots, migrates and renders
+      - run: npm run smoke
 
-      - run: pnpm build
+      # The whole shop on a real Worker: settings, content published with the
+      # Mallok CLI, the seed, pages in two languages, the cart
+      - run: npm run smoke:shop

.gitignore

@@ -1,47 +1,13 @@
-# dependencies
 node_modules/
-.pnp/
-.pnp.js
-
-# builds
-.next/
-out/
-build/
 dist/
-.open-next/
-
-# cloudflare
 .wrangler/
-.dev.vars
-.dev.vars.*
-!.dev.vars.example
 
-# env
+# Local secrets and the record of what was provisioned. Never commit either:
+# the first holds credentials, the second names your Cloudflare resources.
+.dev.vars
 .env
 .env.*
-!.env.example
-
-# typescript
-next-env.d.ts
-*.tsbuildinfo
+.mallok/
 
-# Generated by build-seed-sql
-drizzle/seed.sql
-
-# test / coverage
-coverage/
-playwright-report/
-test-results/
-
-# logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-pnpm-debug.log*
-
-# editor / os
-.vscode/
-.idea/
 .DS_Store
-*.swp
+*.log

.nvmrc

@@ -0,0 +1 @@
+22