Minimal Nuxt Storefront

The project includes a buildable examples/nuxt-storefront application. It reads the API base and public store identifier from public runtime configuration. It contains no client secret and no fabricated product fallback.

The example separates 401, 403, 404, 429/challenge, network failures, and invalid response shapes. Empty API results remain empty. It currently constructs no OAuth endpoint, initiates no sign-in, exchanges no code, and stores no token. Account authorization waits for the API security review and a public-only artifact.

After authorization is formally opened, a durable production session must use a same-origin BFF that stores only its own minimal app grant. It must not imitate Ayalink sign-in, collect password/MFA, or share the Ayalink global-session Cookie with a merchant domain. DPoP and refresh-token rotation remain unavailable capabilities.