@base44/app-plugin-commerce 0.1.0 → 0.1.2

package/README.md

@@ -73,9 +73,10 @@ From your existing Base44 app:
    npx base44 agents push
    ```
 3. **Copy the UI files:** `src/commerce/admin/` → `src/commerce/admin/` and `src/commerce/utils/` → `src/commerce/utils/`.
-4. **Confirm UI deps** — `sonner`, `recharts` and `react-markdown` all ship with the default Base44 template and are the only ones the admin needs; install any that are missing:
+4. **Confirm UI deps** — `sonner`, `recharts` and `react-markdown` all ship with the default Base44 template and are the only ones the admin needs, so usually there is **nothing to install**. Read your app's `package.json` first and install *only* the names missing from it — never re-install a package that is already a dependency:
    ```bash
-   npm i sonner recharts
+   grep -E '"(sonner|recharts|react-markdown)"' package.json   # all three listed → skip the install
+   npm i <only the missing names>
    ```
    See [`src/commerce/admin/README.md`](./src/commerce/admin/README.md) for the exact shadcn component list.
 5. **Mount the admin router** in your app:
@@ -112,6 +113,8 @@ If you build on Base44's hosted platform, use the Base44 agent/MCP to write the
 
 Publishing is manual: **Actions → Manual Package Publish → Run workflow** ([`.github/workflows/manual-publish.yml`](./.github/workflows/manual-publish.yml)).
 
-Inputs: `version` (`patch`/`minor`/`major` or an explicit `0.1.0`), `npm_tag` (`latest`, `beta`, …) and `dry_run`. The workflow bumps `package.json`, prints the tarball contents, runs `npm publish`, then commits the bump, tags `v<version>` and cuts a GitHub release. A dry run publishes nothing and leaves no tag or commit.
+Inputs: `version` (`patch`/`minor`/`major` or an explicit `0.2.0`), `npm_tag` (`latest`, `beta`, …) and `dry_run`. The workflow bumps `package.json`, prints the tarball contents, runs `npm publish`, then commits the bump, tags `v<version>` and cuts a GitHub release. A dry run publishes nothing and leaves no tag or commit.
 
-The first release needs an explicit version (the repo sits at `0.0.0`). Requirements: the repo secret/org secret **`NPM_TOKEN`** (an npm automation token with publish rights on the `@base44` scope), plus the org's `BASE44_GITHUB_ACTIONS_APP_ID` variable and `BASE44_GITHUB_ACTIONS_APP_PRIVATE_KEY` secret used to push the release commit.
+Registry auth uses **npm trusted publishing** — the workflow holds no npm token. It authenticates over OIDC (`id-token: write` plus `npm install -g npm@latest`, which needs npm ≥ 11.5.1), which also signs a provenance attestation for each release. This requires a trusted publisher on the npm package (**Settings → Trusted Publisher → GitHub Actions**, repository `base44/app-plugin-commerce`, workflow `manual-publish.yml`, no environment); if that config is missing or the workflow filename changes, publishing fails with `ENEEDAUTH`.
+
+Pushing the release commit and tag additionally needs the org's `BASE44_GITHUB_ACTIONS_APP_ID` variable and `BASE44_GITHUB_ACTIONS_APP_PRIVATE_KEY` secret.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44/app-plugin-commerce",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Base44 Commerce plugin — entities, backend functions, shared commerce engine, admin UI and the commerce skill, shipped as copyable source",
   "keywords": [
     "base44",

package/scripts/install.js

@@ -145,7 +145,8 @@
   console.log(
     "\nNext steps (see skills/commerce/installation-guidelines.md + post-installation.md):\n" +
     "  1. No deps to add: sonner, recharts and react-markdown ship with the default\n" +
-    "     Base44 template — just confirm they're there (npm i sonner recharts if not)\n" +
+    "     Base44 template — check package.json and npm i only what is truly missing;\n" +
+    "     do not re-install packages already listed as dependencies\n" +
     '  2. Mount the admin router: <Route path="/admin/*" element={<AdminApp />} />\n' +
     "     and implement the payment return page /order-received (post-installation.md)\n" +
     "  3. Grant your user the admin role, then settle the store's data — generate a catalog,\n" +

package/skills/commerce/installation-guidelines.md

@@ -44,7 +44,7 @@ Confirm your `base44/config.jsonc` `entitiesDir`/`functionsDir` point at these f
 1. `npx base44 entities push` — creates/updates the 24 entity schemas. *(CLI path only — the Base44 runtime deploys on write.)*
 2. `npx base44 functions deploy` — deploys the 16 functions. *(CLI path only.)*
 3. `npx base44 agents push` — registers the `commerce/StoreAdmin` agent (§3). *(CLI path only.)*
-4. Verify `sonner` and `recharts` are installed and install them if not (`npm i sonner recharts`) — they ship with the default Base44 template, as does `react-markdown`; nothing else is needed. Verify the shadcn primitives listed in [`src/commerce/admin/README.md`](../../src/commerce/admin/README.md) exist in your app.
+4. Check the app's `package.json` for `sonner`, `recharts` and `react-markdown`, and run `npm i` **only** for the ones actually absent — all three ship with the default Base44 template, so the normal outcome is no install at all. Do not re-install a package that is already a dependency. Nothing else is needed. Verify the shadcn primitives listed in [`src/commerce/admin/README.md`](../../src/commerce/admin/README.md) exist in your app.
 5. Mount the admin router (see [`post-installation.md`](./post-installation.md)).
 6. Grant your user the `admin` role.
 7. Decide the store's data with the user — generate a real starter catalog, seed the generic demo data, or leave the store empty and let the operator hit **Initialize store defaults** on the admin's first-run screen. See [`post-installation.md`](./post-installation.md) §2; both seeded options mark the business as ready and the first-run screen never appears.

package/skills/commerce/post-installation.md

@@ -11,7 +11,7 @@ The admin UI is a self-contained React app under `src/commerce/admin/`. Its only
 **Steps:**
 
 1. Copy `src/commerce/admin/` → `src/commerce/admin/` and `src/commerce/utils/` → `src/commerce/utils/` (already done if you ran `scripts/install.js`).
-2. Verify `sonner` and `recharts` are installed and install them if not (`npm i sonner recharts`) — both ship with the default Base44 template, as does `react-markdown`, which the StoreAdmin bot uses (add it if your app lacks it). The template needs **no other dependency**. Verify the shadcn primitives listed in `src/commerce/admin/README.md` are present (`npx shadcn@latest add <name>` for any missing).
+2. Check the app's `package.json` for `sonner`, `recharts` and `react-markdown` (the StoreAdmin bot uses the last one), and run `npm i` **only** for the ones actually absent — all three ship with the default Base44 template, so the normal outcome is no install at all. Do not re-install a package that is already a dependency. The template needs **no other dependency**. Verify the shadcn primitives listed in `src/commerce/admin/README.md` are present (`npx shadcn@latest add <name>` for any missing).
 3. Mount the router:
    ```jsx
    import AdminApp from "@/commerce/admin";

package/src/commerce/admin/README.md

@@ -12,11 +12,14 @@ Tailwind + shadcn/ui + React Router) to get a full store back office.
 1. Deploy the backend first (`base44/` entities + functions — see the root README).
 2. Copy this folder to `src/commerce/admin/` in your app.
 3. Confirm the deps — `sonner`, `recharts` and `react-markdown` all come with
-   the default template and are all this folder needs. Install any that are
-   missing:
+   the default template and are all this folder needs, so usually there is
+   nothing to install. Read your app's `package.json` first and install *only*
+   the names missing from it — never re-install a package that is already a
+   dependency:
 
    ```bash
-   npm i sonner recharts
+   grep -E '"(sonner|recharts|react-markdown)"' package.json   # all three listed → skip the install
+   npm i <only the missing names>
    ```
 
 4. Mount the app in your router: