create-brainerce-store 1.28.1 → 1.28.8

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "create-brainerce-store",
-      version: "1.28.1",
+      version: "1.28.8",
       description: "Scaffold a production-ready e-commerce storefront connected to Brainerce",
       bin: {
         "create-brainerce-store": "dist/index.js"
@@ -165,11 +165,14 @@ async function installDependencies(projectDir, pkgManager) {
   }
   return new Promise((resolve, reject) => {
     const isWindows = process.platform === "win32";
-    const args = pkgManager === "yarn" ? [] : ["install"];
-    const child = (0, import_child_process.spawn)(pkgManager, args, {
+    const subcommand = pkgManager === "yarn" ? "" : "install";
+    const child = isWindows ? (0, import_child_process.spawn)(`${pkgManager} ${subcommand}`.trim(), {
       cwd: projectDir,
       stdio: ["ignore", "ignore", "pipe"],
-      shell: isWindows
+      shell: true
+    }) : (0, import_child_process.spawn)(pkgManager, subcommand ? [subcommand] : [], {
+      cwd: projectDir,
+      stdio: ["ignore", "ignore", "pipe"]
     });
     let stderrBuf = "";
     child.stderr?.on("data", (chunk) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-brainerce-store",
-  "version": "1.28.1",
+  "version": "1.28.8",
   "description": "Scaffold a production-ready e-commerce storefront connected to Brainerce",
   "bin": {
     "create-brainerce-store": "dist/index.js"

package/templates/nextjs/base/next.config.ts

@@ -2,10 +2,17 @@ import type { NextConfig } from 'next';
 
 const nextConfig: NextConfig = {
   images: {
-    remotePatterns: [
-      { protocol: 'https', hostname: 'cdn.brainerce.com' },
-      { protocol: 'https', hostname: '*.brainerce.com' },
-    ],
+    // The storefront is a consumer of the Brainerce API — it has to render
+    // whatever image URLs the API returns. In practice those URLs can be on
+    // cdn.brainerce.com OR on an upstream merchant host (WooCommerce, Shopify,
+    // self-hosted) depending on whether the product's image-import job has
+    // completed on the backend. Rather than hard-fail on unknown hosts, skip
+    // the server-side optimizer entirely and let the browser fetch each image
+    // directly from origin. No server-side fetching → no SSRF or DoS surface
+    // on this Next server. Trade-off: no webp/resize/lazy optimization, so
+    // LCP is marginally worse. Acceptable; the storefront is not the right
+    // layer to enforce a hostname policy.
+    unoptimized: true,
   },
   async headers() {
     return [