@unbox-plus/cli 0.20.4

package/template/.claude/skills/frontend-design/LICENSE.txt

@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/template/.claude/skills/frontend-design/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: frontend-design
+description: Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.
+license: Complete terms in LICENSE.txt
+---
+
+# Frontend Design
+
+Approach this as the design lead at a small studio known for giving every client a visual identity that could not be mistaken for anyone else's. This client has already rejected proposals that felt templated, and is paying for a distinctive point of view: make deliberate, opinionated choices about palette, typography, and layout that are specific to this brief, and take one real aesthetic risk you can justify.
+
+## Ground it in the subject
+
+If the brief does not pin down what the product or subject is, pin it yourself before designing: name one concrete subject, its audience, and the page's single job, and state your choice. If there's any information in your memory about the human's preferences, context about what they're building, or designs you've made before – use that as a hint. The subject's own world, its materials, instruments, artifacts, and vernacular, is where distinctive choices come from. Build with the brief's real content and subject matter throughout.
+
+## Design principles
+
+For web designs, the hero is a thesis. Open with the most characteristic thing in the subject's world, in whatever form makes sense for it: a headline, an image, an animation, a live demo, an interactive moment. Be deliberate with your choice: a big number with a small label, supporting stats, and a gradient accent is the template answer, only use if that's truly the best option.
+
+Typography carries the personality of the page. Pair the display and body faces deliberately, not the same families you would reach for on any other project, and set a clear type scale with intentional weights, widths, and spacing. Make the type treatment itself a memorable part of the design, not a neutral delivery vehicle for the content.
+
+Structure is information. Structural devices, numbering, eyebrows, dividers, labels, should encode something true about the content, not decorate it. Many generic designs use numbered markers (01 / 02 / 03), but that's only appropriate if the content actually is a sequence - like a real process or a typed timeline where order carries information the reader needs. Question if choices like numbered markers actually make sense before incorporating them.
+
+Leverage motion deliberately. Think about where and if animation can serve the subject: a page-load sequence, a scroll-triggered reveal, hover micro-interactions, ambient atmosphere. An orchestrated moment usually lands harder than scattered effects; choose what the direction calls for. However, sometimes less is more, and extra animation contributes to the feeling that the design is AI-generated.
+
+Match complexity to the vision. Maximalist directions need elaborate execution; minimal directions need precision in spacing, type, and detail. Elegance is executing the chosen vision well.
+
+Consider written content carefully. Often a design brief may not contain real content, and it's up to you to come up with copy. Copy can make a design feel as templated as the design itself. See the below section on writing for more guidance.
+
+## Process: brainstorm, explore, plan, critique, build, critique again
+
+For calibration: AI-generated design right now clusters around three looks: (1) a warm cream background (near #F4F1EA) with a high-contrast serif display and a terracotta accent; (2) a near-black background with a single bright acid-green or vermilion accent; (3) a broadsheet-style layout with hairline rules, zero border-radius, and dense newspaper-like columns. All three are legitimate for some briefs, but they are defaults rather than choices, and they appear regardless of subject. Where the brief pins down a visual direction, follow it exactly — the brief's own words always win, including when it asks for one of these looks. Where it leaves an axis free, don't spend that freedom on one of these defaults. Just like a human designer who's hired, there's often a careful balance between doing what you're good at and taking each project as a chance to experiment and learn.
+
+Work in two passes. First, brainstorm a short design plan based on the human's design brief: create a compact token system with color, type, layout, and signature. Color: describe the palette as 4–6 named hex values. Type: the typefaces for 2+ roles (a characterful display face that's used with restraint, a complementary body face, and a utility face for captions or data if needed). Layout: a layout concept, using one-sentence prose descriptions and ASCII wireframes to ideate and compare. Signature: the single unique element this page will be remembered by that embodies the brief in an appropriate way.
+
+Then review that plan against the brief before building: if any part of it reads like the generic default you would produce for any similar page (work through a similar prompt to see if you arrive somewhere similar) rather than a choice made for this specific brief — revise that part, say what you changed and why. Only after you've confirmed the relative uniqueness of your design plan should you start to write the code, following the revised plan exactly and deriving every color and type decision from it.
+
+When writing the code, be careful of structuring your CSS selector specificities. It's easy to generate CSS classes that cancel each other out (especially with a type-based selector like .section and a element-based selector like .cta). This can happen often with paddings/margins between sections.
+
+Try to do a lot of this planning and iteration in your thinking, and only show ideas to the user when you have higher confidence it'll delight them.
+
+## Restraint and self-critique
+
+Spend your boldness in one place. Let the signature element be the one memorable thing, keep everything around it quiet and disciplined, and cut any decoration that does not serve the brief. Not taking a risk can be a risk itself! Build to a quality floor without announcing it: responsive down to mobile, visible keyboard focus, reduced motion respected. Critique your own work as you build, taking screenshots if your environment supports it – a picture is worth 1000 tokens. Consider Chanel's advice: before leaving the house, take a look in the mirror and remove one accessory. Human creators have memory and always try to do something new, so if you have a space to quickly jot down notes about what you've tried, it can help you in future passes.
+
+## More on writing in design
+
+Words appear in a design for one reason: to make it easier to understand, and therefore easier to use. They are design material, not decoration. Bring the same intentionality to copy that you would bring to spacing and color. Before writing anything, ask what the design needs to say, and how it can best be said to help the person navigate the experience.
+
+Write from the end user's side of the screen. Name things by what people control and recognize, never by how the system is built. A person manages notifications, not webhook config. Describe what something does in plain terms rather than selling it. Being specific is always better than being clever.
+
+Use active voice as default. A control should say exactly what happens when it's used: "Save changes," not "Submit." An action keeps the same name through the whole flow, so the button that says "Publish" produces a toast that says "Published." The vocabulary of an interface is the signposting for someone navigating the product. Cohesion and consistency are how people learn their way around.
+
+Treat failure and emptiness as moments for direction, not mood. Explain what went wrong and how to fix it, in the interface's voice rather than a person's. Errors don't apologize, and they are never vague about what happened. An empty screen is an invitation to act.
+
+Keep the register conversational and tuned: plain verbs, sentence case, no filler, with tone matched to the brand and the audience. Let each element do exactly one job. A label labels, an example demonstrates, and nothing quietly does double duty.

package/template/.claude/skills/web-design-guidelines/ATTRIBUTION.md

@@ -0,0 +1,3 @@
+Skill "web-design-guidelines" vendorizado de vercel-labs/agent-skills
+(https://github.com/vercel-labs/agent-skills), licença MIT (ver README do repo).
+Copyright (c) Vercel Labs.

package/template/.claude/skills/web-design-guidelines/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: web-design-guidelines
+description: Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
+metadata:
+  author: vercel
+  version: "1.0.0"
+  argument-hint: <file-or-pattern>
+---
+
+# Web Interface Guidelines
+
+Review files for compliance with Web Interface Guidelines.
+
+## How It Works
+
+1. **Read `guidelines-snapshot.md` next to this file.** It ships with the project and contains
+   the full rule set. It is the default source — no network required.
+2. Read the specified files (or prompt user for files/pattern)
+3. Check against all rules in the snapshot
+4. Output findings in the terse `file:line` format
+
+## Guidelines Source
+
+The bundled snapshot is authoritative for normal reviews. Rules of web interface quality do
+not turn over between one QA round and the next, and a fetch costs a round trip plus the
+whole document again on every single review — inside a QA loop that repeats, that adds up
+fast for no change in findings.
+
+Fetch the upstream version **only** when one of these is true:
+
+- `guidelines-snapshot.md` is missing or unreadable;
+- the user explicitly asks for the latest upstream rules;
+- you are refreshing the snapshot itself on purpose.
+
+```
+https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md
+```
+
+If you do fetch and the content differs meaningfully, write it back over
+`guidelines-snapshot.md` so the next review starts from the newer copy.
+
+## Usage
+
+When a user provides a file or pattern argument:
+1. Read the snapshot (see above)
+2. Read the specified files
+3. Apply all rules from the snapshot
+4. Output findings using the format specified in the guidelines
+
+If no files specified, ask the user which files to review.

package/template/.claude/skills/web-design-guidelines/guidelines-snapshot.md

@@ -0,0 +1,180 @@
+---
+description: Review UI code for Vercel Web Interface Guidelines compliance
+argument-hint: <file-or-pattern>
+---
+
+# Web Interface Guidelines
+
+Review these files for compliance: $ARGUMENTS
+
+Read files, check against rules below. Output concise but comprehensive—sacrifice grammar for brevity. High signal-to-noise.
+
+## Rules
+
+### Accessibility
+
+- Icon-only buttons need `aria-label`
+- Form controls need `<label>` or `aria-label`
+- Interactive elements need keyboard handlers (`onKeyDown`/`onKeyUp`)
+- `<button>` for actions, `<a>`/`<Link>` for navigation (not `<div onClick>`)
+- Images need `alt` (or `alt=""` if decorative)
+- Decorative icons need `aria-hidden="true"`
+- Async updates (toasts, validation) need `aria-live="polite"`
+- Use semantic HTML (`<button>`, `<a>`, `<label>`, `<table>`) before ARIA
+- Headings hierarchical `<h1>`–`<h6>`; include skip link for main content
+- `scroll-margin-top` on heading anchors
+
+### Focus States
+
+- Interactive elements need visible focus: `focus-visible:ring-*` or equivalent
+- Never `outline-none` / `outline: none` without focus replacement
+- Use `:focus-visible` over `:focus` (avoid focus ring on click)
+- Group focus with `:focus-within` for compound controls
+
+### Forms
+
+- Inputs need `autocomplete` and meaningful `name`
+- Use correct `type` (`email`, `tel`, `url`, `number`) and `inputmode`
+- Never block paste (`onPaste` + `preventDefault`)
+- Labels clickable (`htmlFor` or wrapping control)
+- Disable spellcheck on emails, codes, usernames (`spellCheck={false}`)
+- Checkboxes/radios: label + control share single hit target (no dead zones)
+- Submit button stays enabled until request starts; spinner during request
+- Errors inline next to fields; focus first error on submit
+- Placeholders end with `…` and show example pattern
+- `autocomplete="off"` on non-auth fields to avoid password manager triggers
+- Warn before navigation with unsaved changes (`beforeunload` or router guard)
+
+### Animation
+
+- Honor `prefers-reduced-motion` (provide reduced variant or disable)
+- Animate `transform`/`opacity` only (compositor-friendly)
+- Never `transition: all`—list properties explicitly
+- Set correct `transform-origin`
+- SVG: transforms on `<g>` wrapper with `transform-box: fill-box; transform-origin: center`
+- Animations interruptible—respond to user input mid-animation
+
+### Typography
+
+- `…` not `...`
+- Curly quotes `"` `"` not straight `"`
+- Non-breaking spaces: `10&nbsp;MB`, `⌘&nbsp;K`, brand names
+- Loading states end with `…`: `"Loading…"`, `"Saving…"`
+- `font-variant-numeric: tabular-nums` for number columns/comparisons
+- Use `text-wrap: balance` or `text-pretty` on headings (prevents widows)
+
+### Content Handling
+
+- Text containers handle long content: `truncate`, `line-clamp-*`, or `break-words`
+- Flex children need `min-w-0` to allow text truncation
+- Handle empty states—don't render broken UI for empty strings/arrays
+- User-generated content: anticipate short, average, and very long inputs
+
+### Images
+
+- `<img>` needs explicit `width` and `height` (prevents CLS)
+- Below-fold images: `loading="lazy"`
+- Above-fold critical images: `priority` or `fetchpriority="high"`
+
+### Performance
+
+- Large lists (>50 items): virtualize (`virtua`, `content-visibility: auto`)
+- No layout reads in render (`getBoundingClientRect`, `offsetHeight`, `offsetWidth`, `scrollTop`)
+- Batch DOM reads/writes; avoid interleaving
+- Prefer uncontrolled inputs; controlled inputs must be cheap per keystroke
+- Add `<link rel="preconnect">` for CDN/asset domains
+- Critical fonts: `<link rel="preload" as="font">` with `font-display: swap`
+
+### Navigation & State
+
+- URL reflects state—filters, tabs, pagination, expanded panels in query params
+- Links use `<a>`/`<Link>` (Cmd/Ctrl+click, middle-click support)
+- Deep-link all stateful UI (if uses `useState`, consider URL sync via nuqs or similar)
+- Destructive actions need confirmation modal or undo window—never immediate
+
+### Touch & Interaction
+
+- `touch-action: manipulation` (prevents double-tap zoom delay)
+- `-webkit-tap-highlight-color` set intentionally
+- `overscroll-behavior: contain` in modals/drawers/sheets
+- During drag: disable text selection, `inert` on dragged elements
+- `autoFocus` sparingly—desktop only, single primary input; avoid on mobile
+
+### Safe Areas & Layout
+
+- Full-bleed layouts need `env(safe-area-inset-*)` for notches
+- Avoid unwanted scrollbars: `overflow-x-hidden` on containers, fix content overflow
+- Flex/grid over JS measurement for layout
+
+### Dark Mode & Theming
+
+- `color-scheme: dark` on `<html>` for dark themes (fixes scrollbar, inputs)
+- `<meta name="theme-color">` matches page background
+- Native `<select>`: explicit `background-color` and `color` (Windows dark mode)
+
+### Locale & i18n
+
+- Dates/times: use `Intl.DateTimeFormat` not hardcoded formats
+- Numbers/currency: use `Intl.NumberFormat` not hardcoded formats
+- Detect language via `Accept-Language` / `navigator.languages`, not IP
+- Brand names, code tokens, identifiers: wrap with `translate="no"` to prevent garbled auto-translation
+
+### Hydration Safety
+
+- Inputs with `value` need `onChange` (or use `defaultValue` for uncontrolled)
+- Date/time rendering: guard against hydration mismatch (server vs client)
+- `suppressHydrationWarning` only where truly needed
+
+### Hover & Interactive States
+
+- Buttons/links need `hover:` state (visual feedback)
+- Interactive states increase contrast: hover/active/focus more prominent than rest
+
+### Content & Copy
+
+- Active voice: "Install the CLI" not "The CLI will be installed"
+- Title Case for headings/buttons (Chicago style)
+- Numerals for counts: "8 deployments" not "eight"
+- Specific button labels: "Save API Key" not "Continue"
+- Error messages include fix/next step, not just problem
+- Second person; avoid first person
+- `&` over "and" where space-constrained
+
+### Anti-patterns (flag these)
+
+- `user-scalable=no` or `maximum-scale=1` disabling zoom
+- `onPaste` with `preventDefault`
+- `transition: all`
+- `outline-none` without focus-visible replacement
+- Inline `onClick` navigation without `<a>`
+- `<div>` or `<span>` with click handlers (should be `<button>`)
+- Images without dimensions
+- Large arrays `.map()` without virtualization
+- Form inputs without labels
+- Icon buttons without `aria-label`
+- Hardcoded date/number formats (use `Intl.*`)
+- `autoFocus` without clear justification
+
+## Output Format
+
+Group by file. Use `file:line` format (VS Code clickable). Terse findings.
+
+```text
+## src/Button.tsx
+
+src/Button.tsx:42 - icon button missing aria-label
+src/Button.tsx:18 - input lacks label
+src/Button.tsx:55 - animation missing prefers-reduced-motion
+src/Button.tsx:67 - transition: all → list properties
+
+## src/Modal.tsx
+
+src/Modal.tsx:12 - missing overscroll-behavior: contain
+src/Modal.tsx:34 - "..." → "…"
+
+## src/Card.tsx
+
+✓ pass
+```
+
+State issue + location. Skip explanation unless fix non-obvious. No preamble.

package/template/.env.example

@@ -0,0 +1,158 @@
+# ═══════════════════════════════════════════════════════════════════════════════════════
+# REGRA DESTE ARQUIVO: comentário SEMPRE em linha própria, NUNCA depois do valor.
+# `CHAVE=   # texto` parece vazio, mas para muita ferramenta (import de env na Vercel, Docker,
+# CI, `source`) o texto É o valor. Foi assim que uma loja em produção ficou com META_PIXEL_ID
+# igual a uma frase em português: o guard "se tem valor" passou, a Meta rejeitou, e cada
+# page view virou um 502. O lib/env-check.ts avisa no boot se algum valor parecer comentário.
+# ═══════════════════════════════════════════════════════════════════════════════════════
+# Copie para .env.local e preencha. SERVER-ONLY = nunca vai ao browser, sem prefixo NEXT_PUBLIC_.
+#
+# ⚠️ Valores com caracteres especiais (#, $, &, *, espaço, aspas) entre CRASES, com $ escapado:
+#   UNBOX_PASS=`#minhaSenha\$123`
+#   (aspas duplas não protegem uma aspa interna e aspas simples NÃO impedem a expansão de $1;
+#   o create-unbox-store já grava assim. No painel da Vercel, cole o valor cru, sem aspas.)
+# Sem aspas, o # vira comentário e o valor chega truncado. Os scripts (unbox:test etc.)
+# leem o .env.local com o MESMO parser do Next (scripts/load-env.ts), então o valor que
+# funciona no `next dev` funciona igual nos scripts.
+
+# --- Unbox (server-only) ---
+# API de PARCEIROS (nova, recomendada): uma api key única por parceiro, para todas as lojas
+# dele. Preenchida → signIn e as leituras compatíveis passam por partners.unbox.com.br;
+# carrinho/checkout seguem no core até a Unbox publicar as escritas lá. A loja específica é
+# autenticada pelo UNBOX_USER/UNBOX_PASS no signIn.
+# api key do PARCEIRO (ex.: da2-...)
+UNBOX_PARTNER_API_KEY=
+UNBOX_PARTNER_GRAPHQL_URL=https://partners.unbox.com.br/graphql
+# OBRIGATÓRIA com a key de parceiro: x-captcha-verification do signIn (pedir à Unbox)
+UNBOX_CAPTCHA_BYPASS=
+
+# Modelo antigo (key por loja) — ainda suportado; ignorado nas rotas cobertas pela API de
+# parceiros quando UNBOX_PARTNER_API_KEY está preenchida. Segue usado no x-captcha-verification
+# do core (placeOrder, OTP) enquanto o checkout não migra.
+# chave da loja (x-api-key no signin REST E x-captcha-verification)
+UNBOX_API_KEY=
+# usuário de API da loja (ex.: api_minhaloja)
+UNBOX_USER=
+# senha do usuário de API
+UNBOX_PASS=
+# opcional: extraído do JWT (arn:unbox:shopId) se vazio
+UNBOX_SHOP_ID=
+# opcional: extraído do JWT (arn:unbox:shopSlug) se vazio
+UNBOX_SHOP_SLUG=
+UNBOX_AUTH_URL=https://api.unbox.com.br
+UNBOX_GRAPHQL_URL=https://core.unbox.com.br/graphql
+# secret(s) do subscribeToWebhook. Um por assinatura → LISTA separada por vírgula (ex.: secretA,secretB)
+UNBOX_WEBHOOK_SECRET=
+
+# --- App (server-only) ---
+# string aleatória forte (cookies/rotas internas)
+SESSION_SECRET=
+# protege /api/revalidate
+REVALIDATE_SECRET=
+# Webhook do CRM (Revi/Klaviyo) p/ carrinho abandonado. Eventos que a loja envia (POST JSON):
+#   checkout_started — na hora em que o e-mail é digitado no checkout; SEMPRE traz recoveryUrl
+#                      (link /checkout?id=&token=[&freq=]&step=1 que restaura o carrinho em
+#                      qualquer aparelho). É ele que arma o fluxo de abandono no CRM.
+#   order_created    — pedido fechado (mesmo cartId): o CRM cancela o fluxo armado.
+#   abandoned_cart   — alternativa via cron (scripts/abandoned-cart.ts), mesmo formato de link.
+CRM_WEBHOOK_URL=
+# preenchida = usa o checkout PADRÃO hospedado pela Unbox em vez do /checkout customizado
+# deste projeto. O CLI preenche sozinho; preenchendo à mão, duas coisas custaram um dia de
+# tentativa e erro em produção:
+#   1. CAMINHO COMPLETO, não o domínio. A raiz é a home da loja e ignora os parâmetros em
+#      silêncio:  ✅ https://sualoja.com.br/carrinho/finalizar-pedido   ❌ https://sualoja.com.br
+#   2. MESMO DOMÍNIO da loja. Loja em um host e checkout em outro (ex.: loja.unbox.com.br +
+#      seguro.sualoja.com.br) manda o cliente para o /login; com os dois em sualoja.com.br, funciona.
+# A URL leva ?id=&token=&freq=&step=1. O token faz parte do contrato, não é ruído.
+UNBOX_HOSTED_CHECKOUT_URL=
+
+# --- Meta Conversions API (server-only) — espelha o Pixel pelo servidor (dedupe por event_id) ---
+# opcional: mesmo ID do NEXT_PUBLIC_META_PIXEL_ID (usado pela /api/capi)
+META_PIXEL_ID=
+# opcional: token de acesso da Conversions API (Eventos > Configurações)
+# SEGREDO DE SERVIDOR: nunca vai ao documento do editor nem ao browser. O painel do editor só mostra
+# se está configurado, nunca o valor.
+META_CAPI_TOKEN=
+
+# --- Público ---
+# --- Porta de preview (/acesso): prévia privada com captura de lead ---
+# A porta se escopa pelo DOMÍNIO sozinha: SÓ existe nos hosts de preview
+# (*.vercel.app, *.myunbox.com.br + PREVIEW_HOSTS). Em domínio PRÓPRIO da marca e no
+# localhost ela some sem mexer em nada. Nome/marca/WhatsApp/e-mail liberam por cookie
+# de 30 dias. Time interno: qualquer URL com ?chave=<PREVIEW_PASSWORD> entra sem
+# formulário (ex.: https://loja.vercel.app/?chave=unbox).
+# chave do time + assinatura do cookie (padrão "unbox"); trocar derruba acessos
+PREVIEW_PASSWORD=
+# opcional: cria Pessoa + Negócio no Pipedrive a cada lead da prévia
+PIPEDRIVE_API_TOKEN=
+# opcional: webhook (Slack/Zapier) avisado a cada lead
+PREVIEW_WEBHOOK_URL=
+# opcional: sufixos EXTRAS de host onde a porta liga (vírgula)
+PREVIEW_HOSTS=
+# opcional: "1" desliga a porta em qualquer host (kill switch)
+PREVIEW_DISABLED=
+# opcional: "1" liga a porta em qualquer host (testar no localhost)
+PREVIEW_FORCE=
+
+NEXT_PUBLIC_SITE_URL=http://localhost:3000
+# nome de exibição da loja (manifest/PWA; o CLI preenche no scaffold)
+NEXT_PUBLIC_SITE_NAME=
+# opcional: e-mail usado pelos scripts de teste (unbox:test, unbox:order:pix)
+UNBOX_TEST_EMAIL=
+# opcional: URL do endpoint ao rodar unbox:webhook:subscribe
+WEBHOOK_ENDPOINT=
+# opcional (GA4 via gtag.js)
+# Container GTM da PRÓPRIA loja (a marca que tem agência costuma ter um). Com ele preenchido,
+# o Pixel do código é DESLIGADO: Pixel no container e no código conta PageView duas vezes, e a
+# inflação é silenciosa. Quem configura o container precisa saber de uma coisa: numa SPA, o
+# gatilho "All Pages" só pega o carregamento inicial. Para contar troca de rota, a tag de
+# pageview tem que escutar o evento personalizado `dataLayerReady` (a loja o emite em toda rota).
+# Para onde vai o e-mail capturado nos blocos de newsletter (rodapé, catálogo e a seção da home).
+# É a URL que recebe o POST do formulário: endpoint do CRM/ESP (Klaviyo, Revi, Mailchimp) ou uma
+# rota própria. SEM ISSO OS BLOCOS NÃO RENDERIZAM, de propósito: formulário que engole o e-mail em
+# silêncio é pior que não ter formulário, porque a pessoa acha que se cadastrou.
+NEXT_PUBLIC_NEWSLETTER_ACTION=
+
+NEXT_PUBLIC_GTM_ID=
+
+# Frase que descreve a loja (meta description e cartão de compartilhamento). Sem ela, a loja vai
+# ao ar sem description: o build avisa. Escreva o que a loja vende e para quem.
+NEXT_PUBLIC_SITE_DESCRIPTION=
+
+NEXT_PUBLIC_GA_ID=
+# opcional (Meta Pixel no browser)
+NEXT_PUBLIC_META_PIXEL_ID=
+# ⚠ Se o Pixel também estiver num container GTM da loja, DEIXE ESTA VARIÁVEL VAZIA. O mesmo
+#   pixel carregado duas vezes ("Duplicate Pixel ID" no console) conta cada conversão em dobro
+#   e distorce a otimização das campanhas. Um lugar só: aqui OU no GTM, nunca os dois.
+# Os IDs acima (GTM próprio, GA4, Meta Pixel) e os abaixo o lojista também pode definir na aba Apps
+# do painel do editor. O que ele PUBLICA lá vence o valor daqui, provedor a provedor, e um provedor
+# nunca dispara duas vezes. Aqui é o cadastro da loja: vale enquanto o painel não define. O formato
+# é conferido na leitura (lib/editable, recusaDeRastreio): valor fora do formato ou placeholder
+# ("GTM-XXXXXXX", "todo") é ignorado, não carrega script quebrado.
+# opcional: TikTok Pixel (começa com C, cerca de 20 letras e números)
+NEXT_PUBLIC_TIKTOK_PIXEL_ID=
+# opcional: Pinterest Tag (13 dígitos)
+NEXT_PUBLIC_PINTEREST_TAG_ID=
+# opcional: botão flutuante de WhatsApp; só dígitos com DDI (ex.: 5511999998888)
+NEXT_PUBLIC_WHATSAPP_NUMERO=
+# opcional: mensagem inicial do botão de WhatsApp (até 300 caracteres)
+NEXT_PUBLIC_WHATSAPP_MENSAGEM=
+
+# --- Editor de loja do cliente (o lojista edita textos, fotos, cores e vitrines sem mexer no código) ---
+# Sem EDITOR_URL a camada editável fica DESLIGADA e a loja renderiza só o que está no código.
+# Com ela, a loja lê o conteúdo publicado em <EDITOR_URL>/api/content/<slug>/published (ISR de 300 s)
+# e aplica por cima do código; sem documento publicado, nada muda.
+# URL do editor (servidor): de onde a loja lê o publicado e o JWKS que valida os tokens do editor
+EDITOR_URL=https://editor.myunbox.com.br
+# origem do editor vista pelo navegador: entra no frame-ancestors (next.config.ts) e no postMessage
+# da prévia. Sem ela o modo edição nunca liga, e o gate (npm run unbox:editavel) para em NÃO RODOU.
+NEXT_PUBLIC_EDITOR_ORIGIN=https://editor.myunbox.com.br
+# slug desta loja NO EDITOR. O create-unbox-store carimba o mesmo slug em lib/editable/config.ts, e
+# esta variável só sobrepõe aquele literal: preencha se o `slug` da entrada da loja no shops.json do
+# editor for outro. É variável PRÓPRIA: não é o UNBOX_SHOP_SLUG da plataforma (os dois costumam
+# coincidir, e no dia em que divergirem o editor deixa de achar a loja sem dizer por quê).
+UNBOX_EDITOR_SHOP=
+# opcional: lista JSON de rotas editáveis (ex.: ["/","/produtos"]). SÓ é lida se a varredura de
+# app/(loja)/ não encontrar a pasta em produção (ver lib/rotas-editaveis.ts); normalmente fica vazia.
+UNBOX_ROTAS_EDITAVEIS=

package/template/.mcp.json.example

@@ -0,0 +1,14 @@
+{
+  "mcpServers": {
+    "unbox": {
+      "url": "https://mcp.unbox.com.br/mcp",
+      "headers": {
+        "x-unbox-mcp-token": "SEU_UNBOX_MCP_TOKEN",
+        "x-unbox-api-key": "SUA_UNBOX_PARTNER_API_KEY",
+        "x-unbox-username": "SEU_UNBOX_USER",
+        "x-unbox-password": "SUA_UNBOX_PASS",
+        "x-unbox-integration-mode": "headless"
+      }
+    }
+  }
+}

package/template/.nvmrc

@@ -0,0 +1 @@
+22