## agent setup

```bash
mercemur agent setup
```

Points Claude Code or Cursor at Mercemur's MCP server, so an agent can read your catalogue and
edit your storefront. Detects what is installed; pass `--client claude-code` or `--client cursor`
to pick one, `--global` for your home directory, `--status` to see what is configured.

<Note>
  **No credential is written.** The endpoint advertises its authorization server, so your agent
  opens a consent screen where you choose the store and the scopes. That is why the file this
  writes is safe to commit. Existing servers in your configuration are preserved.
</Note>

Restart your agent afterwards. An MCP client reads its tool list once, when it connects.

## config

```bash
mercemur config                                  # what is in effect, and why
mercemur config --set store=acme.mercemur.com    # write .mercemur.json
mercemur config --set api=https://... --global   # write the global config
mercemur config --unset api
mercemur config --edit                           # open it in $EDITOR
```

Only `store` and `api` are settable. An unknown key is refused rather than stored, because a
setting that is silently ignored looks like a feature that does not work.

<Warning>
  There is no setting for an API key, deliberately. Keys live in your OS keychain; a config file
  is a thing people commit.
</Warning>

### Profiles

One config file, many accounts. Useful when you work across several stores.

```bash
mercemur config --profile acme --set store=acme.mercemur.com
mercemur config --profile globex --set store=globex.mercemur.com

mercemur theme pull --profile acme
mercemur logs tail --profile globex
```

`--profile` works on every command. A profile sits between the environment and the project file in
precedence, per field: an explicit `--store` still wins, and a profile that names only a store
still inherits the project's `api`.

An unknown profile name is an error that lists the ones you have, rather than quietly falling back
to your default store. Each profile resolves its own key from the keychain, so `mercemur login
--store acme.mercemur.com` once per account is all the setup there is.

## sandbox create

```bash
mercemur sandbox create --email you@example.com
mercemur sandbox create --from-git
```

Registers an account, creates a store, mints a secret key and puts it in your keychain, so a new
machine or an automated workflow can start immediately.

<Warning>
  This is a **real account and it does not expire.** There is no seven-day clock and nothing
  cleans it up. The password is shown once and generated with a cryptographic source; write it
  down.
</Warning>

## fixtures

```bash
mercemur fixtures ./seed.json
mercemur fixtures ./seed.json --dry-run
```

Runs a series of API calls in order, each able to read what an earlier one returned.

```json seed.json
{
  "fixtures": [
    { "name": "shirt", "path": "/products", "method": "post",
      "params": { "title": "T-shirt", "status": "active" } },
    { "name": "variant", "path": "/product-variants", "method": "post",
      "params": { "product_id": "${shirt:id}", "price_minor": 1999 } }
  ]
}
```

| Reference | Reads |
|---|---|
| `${name:field}` | A field from an earlier fixture's response |
| `${name:a.b.0.c}` | A nested field, indexing lists by number |
| `${.env:VAR}` | An environment variable |
| `${.env:VAR\|fallback}` | An environment variable with a default |

A reference that is the **whole** value keeps its type, so `"${shirt:price_minor}"` sends the
number `1999` rather than the string `"1999"`. Money on this API is integer minor units, so that
distinction is the difference between a working seed and a rejected one.

Requests stop at the first failure, because a later one usually depends on an earlier one having
worked, and continuing produces a wall of errors whose first line is the only real one.

## logs

```bash
mercemur logs list --limit 20
mercemur logs list --action promotion.created
mercemur logs tail
```

The record of writes to your store: who changed what, newest first.

<Warning>
  This is an **audit log, not a webhook feed.** Its action names are dotted
  (`promotion.created`) and webhook topics are slashed (`products/created`). The two sets are
  disjoint and neither accepts the other's values. To receive events as they happen, use
  [webhooks](/cli/webhooks).
</Warning>

`tail` polls and prints each entry once. `--json` is refused there, as it is on `theme dev`; for
scripted output run `logs list --json` in your own loop.

## open and docs

```bash
mercemur open dashboard
mercemur open apikeys
mercemur open --list
mercemur docs cli/overview
mercemur docs search webhook
```

`open` takes a shortcut name and launches your browser; `--url` prints the address instead, which
is what you want over ssh. `docs search` matches page paths and works offline.