create-brainerce-store 1.52.5 → 1.54.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Brainerce Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "create-brainerce-store",
-      version: "1.52.5",
+      version: "1.54.0",
       description: "Scaffold a production-ready e-commerce storefront connected to Brainerce",
       bin: {
         "create-brainerce-store": "dist/index.js"
@@ -180,7 +180,9 @@ var BRAINERCE_RUNTIME_DEPS = Object.freeze({
   // must pin >=1.30 to get the auto-region + tax-estimate methods.
   // 1.44 adds the order-level `notes` field to SetShippingAddressDto /
   // SetCheckoutCustomerDto — the scaffolded checkout form types depend on it.
-  brainerce: "^1.44.0",
+  // 1.46 adds getAddressSuggestions/getAddressDetails — the scaffolded
+  // checkout form's address-autocomplete typeahead calls these directly.
+  brainerce: "^1.46.0",
   "isomorphic-dompurify": "^3.8.0"
 });
 

package/messages/en.json

@@ -258,6 +258,8 @@
     "selectRegion": "Select region",
     "address": "Address",
     "streetAddress": "Street address",
+    "searchingAddress": "Searching…",
+    "outsideDeliveryZone": "This address is outside our regular delivery zones. You can still continue — we'll confirm delivery by phone.",
     "apartmentSuite": "Apartment, suite, etc.",
     "aptPlaceholder": "Apt, suite, unit, etc. (optional)",
     "city": "City",

package/messages/he.json

@@ -258,6 +258,8 @@
     "selectRegion": "בחרו מחוז",
     "address": "כתובת",
     "streetAddress": "רחוב ומספר",
+    "searchingAddress": "מחפש…",
+    "outsideDeliveryZone": "הכתובת הזו מחוץ לאזורי המשלוח הרגילים שלנו. ניתן להמשיך — ניצור איתך קשר טלפוני לתיאום המשלוח.",
     "apartmentSuite": "דירה, קומה וכו׳",
     "aptPlaceholder": "דירה, קומה, כניסה (אופציונלי)",
     "city": "עיר",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-brainerce-store",
-  "version": "1.52.5",
+  "version": "1.54.0",
   "description": "Scaffold a production-ready e-commerce storefront connected to Brainerce",
   "bin": {
     "create-brainerce-store": "dist/index.js"

package/templates/nextjs/base/next.config.ts

@@ -1,86 +1,86 @@
-import type { NextConfig } from 'next';
-import { OPTIMIZED_IMAGE_HOSTS } from './src/core/lib/image-hosts';
-
-// Build-time invariant — fail loud if NEXT_PUBLIC_STORE_CURRENCY is missing
-// for a production build. Next.js inlines NEXT_PUBLIC_* into the client
-// bundle at `next build` time; once inlined, the value cannot be patched at
-// deploy time. A missing env here is the root cause of non-USD stores ending
-// up with `$5,096` baked into their HTML (and indexed by Googlebot).
-//
-// In dev (`next dev`) we only warn, so local-only experiments don't break.
-if (!process.env.NEXT_PUBLIC_STORE_CURRENCY) {
-  const msg =
-    'NEXT_PUBLIC_STORE_CURRENCY is not set.\n' +
-    'Next.js inlines NEXT_PUBLIC_* vars into the client bundle at build time;\n' +
-    'a missing value will silently fall back to USD in storefront price displays\n' +
-    'and ship that to search-engine crawlers. Set it in .env.local (written by\n' +
-    'create-brainerce-store) or in your CI / hosting build env (Coolify / Vercel).';
-  if (process.env.NODE_ENV === 'production') {
-    throw new Error(`[next.config] ${msg}`);
-  } else {
-    console.warn(`[next.config] warning: ${msg}`);
-  }
-}
-
-const nextConfig: NextConfig = {
-  // isomorphic-dompurify ships jsdom, which at runtime reads stylesheet files
-  // from its own package directory. Webpack bundling breaks those relative
-  // lookups — loading it externally from node_modules keeps the paths intact.
-  //
-  // brainerce (the SDK) is imported across both the server and client
-  // compilation boundaries in ~60 files, including the [locale]/layout.tsx
-  // route (see generateStaticParams below) whose static params are resolved
-  // by a separate jest-worker child process in `next dev` (webpack). That
-  // worker requires the compiled page against the vendor-chunks manifest
-  // while the main dev server may still be writing it, which can throw
-  // "Cannot find module './vendor-chunks/brainerce.js'". Excluding it from
-  // server bundling (loaded externally from node_modules instead) avoids the
-  // race.
-  serverExternalPackages: ['isomorphic-dompurify', 'brainerce'],
-  images: {
-    // The storefront is a consumer of the Brainerce API — it has to render
-    // whatever image URLs the API returns. In practice those URLs are
-    // usually on cdn.brainerce.com, but a product/variant can still carry a
-    // raw upstream-merchant URL (WooCommerce, Shopify, self-hosted) while
-    // its image-import job is pending or failed. Rather than allowlist every
-    // possible merchant host (or hard-fail on them), only cdn.brainerce.com
-    // goes through the server-side optimizer; components render product/blog
-    // images via `CdnImage` (src/ui/shared/cdn-image.tsx), which
-    // detects any other host and renders it `unoptimized` — an unresized
-    // direct-from-origin fetch, same as this template's prior behavior —
-    // instead of next/image throwing on an unconfigured hostname. No
-    // server-side fetching of unknown hosts → no SSRF/DoS surface on this
-    // Next server.
-    remotePatterns: OPTIMIZED_IMAGE_HOSTS.map((hostname) => ({
-      protocol: 'https' as const,
-      hostname,
-      pathname: '/**',
-    })),
-  },
-  async headers() {
-    return [
-      {
-        source: '/(.*)',
-        headers: [
-          {
-            key: 'Strict-Transport-Security',
-            value: 'max-age=63072000; includeSubDomains; preload',
-          },
-          { key: 'X-Content-Type-Options', value: 'nosniff' },
-          // SAMEORIGIN (not DENY) so iframe-based payment providers (e.g. Cardcom)
-          // can redirect the iframe back to /payment-complete on the storefront
-          // itself after a successful charge — the postMessage relay needs the
-          // parent frame to be able to render our own same-origin page.
-          { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
-          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
-          {
-            key: 'Permissions-Policy',
-            value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()',
-          },
-        ],
-      },
-    ];
-  },
-};
-
-export default nextConfig;
+import type { NextConfig } from 'next';
+import { OPTIMIZED_IMAGE_HOSTS } from './src/core/lib/image-hosts';
+
+// Build-time invariant — fail loud if NEXT_PUBLIC_STORE_CURRENCY is missing
+// for a production build. Next.js inlines NEXT_PUBLIC_* into the client
+// bundle at `next build` time; once inlined, the value cannot be patched at
+// deploy time. A missing env here is the root cause of non-USD stores ending
+// up with `$5,096` baked into their HTML (and indexed by Googlebot).
+//
+// In dev (`next dev`) we only warn, so local-only experiments don't break.
+if (!process.env.NEXT_PUBLIC_STORE_CURRENCY) {
+  const msg =
+    'NEXT_PUBLIC_STORE_CURRENCY is not set.\n' +
+    'Next.js inlines NEXT_PUBLIC_* vars into the client bundle at build time;\n' +
+    'a missing value will silently fall back to USD in storefront price displays\n' +
+    'and ship that to search-engine crawlers. Set it in .env.local (written by\n' +
+    'create-brainerce-store) or in your CI / hosting build env (Coolify / Vercel).';
+  if (process.env.NODE_ENV === 'production') {
+    throw new Error(`[next.config] ${msg}`);
+  } else {
+    console.warn(`[next.config] warning: ${msg}`);
+  }
+}
+
+const nextConfig: NextConfig = {
+  // isomorphic-dompurify ships jsdom, which at runtime reads stylesheet files
+  // from its own package directory. Webpack bundling breaks those relative
+  // lookups — loading it externally from node_modules keeps the paths intact.
+  //
+  // brainerce (the SDK) is imported across both the server and client
+  // compilation boundaries in ~60 files, including the [locale]/layout.tsx
+  // route (see generateStaticParams below) whose static params are resolved
+  // by a separate jest-worker child process in `next dev` (webpack). That
+  // worker requires the compiled page against the vendor-chunks manifest
+  // while the main dev server may still be writing it, which can throw
+  // "Cannot find module './vendor-chunks/brainerce.js'". Excluding it from
+  // server bundling (loaded externally from node_modules instead) avoids the
+  // race.
+  serverExternalPackages: ['isomorphic-dompurify', 'brainerce'],
+  images: {
+    // The storefront is a consumer of the Brainerce API — it has to render
+    // whatever image URLs the API returns. In practice those URLs are
+    // usually on cdn.brainerce.com, but a product/variant can still carry a
+    // raw upstream-merchant URL (WooCommerce, Shopify, self-hosted) while
+    // its image-import job is pending or failed. Rather than allowlist every
+    // possible merchant host (or hard-fail on them), only cdn.brainerce.com
+    // goes through the server-side optimizer; components render product/blog
+    // images via `CdnImage` (src/ui/shared/cdn-image.tsx), which
+    // detects any other host and renders it `unoptimized` — an unresized
+    // direct-from-origin fetch, same as this template's prior behavior —
+    // instead of next/image throwing on an unconfigured hostname. No
+    // server-side fetching of unknown hosts → no SSRF/DoS surface on this
+    // Next server.
+    remotePatterns: OPTIMIZED_IMAGE_HOSTS.map((hostname) => ({
+      protocol: 'https' as const,
+      hostname,
+      pathname: '/**',
+    })),
+  },
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          {
+            key: 'Strict-Transport-Security',
+            value: 'max-age=63072000; includeSubDomains; preload',
+          },
+          { key: 'X-Content-Type-Options', value: 'nosniff' },
+          // SAMEORIGIN (not DENY) so iframe-based payment providers (e.g. Cardcom)
+          // can redirect the iframe back to /payment-complete on the storefront
+          // itself after a successful charge — the postMessage relay needs the
+          // parent frame to be able to render our own same-origin page.
+          { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
+          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+          {
+            key: 'Permissions-Policy',
+            value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()',
+          },
+        ],
+      },
+    ];
+  },
+};
+
+export default nextConfig;

package/templates/nextjs/base/src/app/blog/[slug]/page.tsx.ejs

@@ -13,11 +13,14 @@ import type { Metadata } from 'next';
 import { notFound } from 'next/navigation';
 import Link from 'next/link';
 import { CdnImage as Image } from '@/ui/shared/cdn-image';
+import { ArticleJsonLd } from '@/components/seo/article-json-ld';
 
 import { getServerClient } from '@/core/lib/brainerce';
 import { sanitizeHtml } from '@/core/lib/sanitize';
 import { decodeSlug } from '@/core/lib/utils';
 
+const SITE_URL = process.env.NEXT_PUBLIC_SITE_URL || 'https://example.com';
+
 <% if (i18nEnabled) { %>
 type PageProps = {
   params: Promise<{ locale: string; slug: string }>;
@@ -49,30 +52,21 @@ export async function generateMetadata({ params }: PageProps): Promise<Metadata>
 export default async function BlogPostPage({ params }: PageProps) {
   const { locale, slug: rawSlug } = await params;
   const slug = decodeSlug(rawSlug);
-  const post = await getServerClient(locale).blog.getPost(slug).catch(() => null);
+  const client = getServerClient(locale);
+  const [post, storeInfo] = await Promise.all([
+    client.blog.getPost(slug).catch(() => null),
+    client.getStoreInfo().catch(() => null),
+  ]);
   if (!post) notFound();
 
   const isHe = locale === 'he';
   const dir = isHe ? 'rtl' : 'ltr';
   const backLabel = isHe ? '← חזרה לבלוג' : '← Back to blog';
-
-  const articleJsonLd = {
-    '@context': 'https://schema.org',
-    '@type': 'Article',
-    headline: post.title,
-    description: post.excerpt ?? undefined,
-    image: post.coverImageUrl ?? undefined,
-    datePublished: post.publishedAt ?? undefined,
-    dateModified: post.updatedAt,
-    author: post.author ? { '@type': 'Person', name: post.author } : undefined,
-  };
+  const articleUrl = `${SITE_URL}/blog/${post.slug}`;
 
   return (
     <main dir={dir} className="mx-auto max-w-3xl px-4 py-10 sm:px-6 lg:px-8">
-      <script
-        type="application/ld+json"
-        dangerouslySetInnerHTML={{ __html: JSON.stringify(articleJsonLd).replace(/</g, '\\u003c') }}
-      />
+      <ArticleJsonLd post={post} url={articleUrl} organizationName={storeInfo?.name} />
 
       {/* Back link */}
       <Link
@@ -182,26 +176,18 @@ export async function generateMetadata({ params }: PageProps): Promise<Metadata>
 export default async function BlogPostPage({ params }: PageProps) {
   const { slug: rawSlug } = await params;
   const slug = decodeSlug(rawSlug);
-  const post = await getServerClient().blog.getPost(slug).catch(() => null);
+  const client = getServerClient();
+  const [post, storeInfo] = await Promise.all([
+    client.blog.getPost(slug).catch(() => null),
+    client.getStoreInfo().catch(() => null),
+  ]);
   if (!post) notFound();
 
-  const articleJsonLd = {
-    '@context': 'https://schema.org',
-    '@type': 'Article',
-    headline: post.title,
-    description: post.excerpt ?? undefined,
-    image: post.coverImageUrl ?? undefined,
-    datePublished: post.publishedAt ?? undefined,
-    dateModified: post.updatedAt,
-    author: post.author ? { '@type': 'Person', name: post.author } : undefined,
-  };
+  const articleUrl = `${SITE_URL}/blog/${post.slug}`;
 
   return (
     <main className="mx-auto max-w-3xl px-4 py-10 sm:px-6 lg:px-8">
-      <script
-        type="application/ld+json"
-        dangerouslySetInnerHTML={{ __html: JSON.stringify(articleJsonLd).replace(/</g, '\\u003c') }}
-      />
+      <ArticleJsonLd post={post} url={articleUrl} organizationName={storeInfo?.name} />
 
       <Link
         href="/blog"

package/templates/nextjs/base/src/app/category/[slug]/page.tsx

@@ -0,0 +1,92 @@
+import type { Metadata } from 'next';
+import { notFound } from 'next/navigation';
+import type { Product } from 'brainerce';
+import { getServerClient } from '@/core/lib/brainerce';
+import { buildMetaDescription } from '@/core/lib/seo';
+import { sanitizeHtml } from '@/core/lib/sanitize';
+import { decodeSlug } from '@/core/lib/utils';
+import { CategoryJsonLd } from '@/components/seo/category-json-ld';
+import { ProductGrid } from '@/ui/product/product-grid';
+
+type Props = {
+  params: Promise<{ slug: string; locale?: string }>;
+};
+
+/**
+ * Category (collection) landing page — the highest-leverage organic-SEO
+ * surface: it ranks for broad "research intent" queries ("running shoes")
+ * that individual product pages never capture. Merchant-authored copy (from
+ * the dashboard SEO hub) renders BELOW the grid so products stay above the
+ * fold, and CollectionPage + BreadcrumbList structured data feeds rich
+ * results + AI answers. Products come from getProducts, so this page is one
+ * metadata read + one listing read.
+ */
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { slug: rawSlug, locale } = await params;
+  const slug = decodeSlug(rawSlug);
+  try {
+    const category = await getServerClient(locale).getCategoryBySlug(slug);
+    const description =
+      category.metaDescription || buildMetaDescription(category.description) || category.name;
+    const canonicalSlug = category.slug || slug;
+    const canonicalPath =
+      locale ? `/${locale}/category/${canonicalSlug}` : `/category/${canonicalSlug}`;
+    return {
+      title: category.name,
+      description,
+      alternates: { canonical: canonicalPath },
+      openGraph: {
+        title: category.name,
+        description,
+        type: 'website',
+        images: category.image ? [{ url: category.image, alt: category.name }] : [],
+      },
+      twitter: {
+        card: 'summary_large_image',
+        title: category.name,
+        description,
+        images: category.image ? [category.image] : [],
+      },
+    };
+  } catch {
+    return { title: 'Category not found' };
+  }
+}
+
+export default async function CategoryPage({ params }: Props) {
+  const { slug: rawSlug, locale } = await params;
+  const slug = decodeSlug(rawSlug);
+  const client = getServerClient(locale);
+
+  const category = await client.getCategoryBySlug(slug).catch(() => null);
+  if (!category) notFound();
+
+  // The listing endpoint owns pagination/FX/publish gating — reuse it rather
+  // than duplicating a product query here.
+  const { data: products } = await client
+    .getProducts({ categories: [category.id], limit: 48 })
+    .catch(() => ({ data: [] as Product[] }));
+
+  const baseUrl = process.env.NEXT_PUBLIC_SITE_URL || '';
+  const url = `${baseUrl}/category/${category.slug || slug}`;
+
+  return (
+    <>
+      <CategoryJsonLd category={category} url={url} />
+      <div className="container mx-auto px-4 py-8">
+        <header className="mb-6">
+          <h1 className="text-3xl font-bold tracking-tight">{category.name}</h1>
+        </header>
+
+        <ProductGrid products={products} />
+
+        {category.description ? (
+          <div
+            className="prose prose-neutral dark:prose-invert mt-12 max-w-none border-t pt-8"
+            dangerouslySetInnerHTML={{ __html: sanitizeHtml(category.description) }}
+          />
+        ) : null}
+      </div>
+    </>
+  );
+}

package/templates/nextjs/base/src/app/indexnow-key.txt/route.ts

@@ -0,0 +1,26 @@
+/**
+ * IndexNow key file — GET /indexnow-key.txt
+ *
+ * Brainerce's SEO Autopilot pings IndexNow (instant search-engine indexing)
+ * whenever a blog post publishes. The ping includes
+ * `keyLocation: https://<your-domain>/indexnow-key.txt`, and search engines
+ * verify ownership by fetching this file and matching the key.
+ *
+ * The key comes from `getStoreInfo().seo.indexNowKey` — it is NOT a secret
+ * (the file is public by protocol design). Returns 404 until the platform
+ * generates a key for this sales channel, which is harmless.
+ */
+import { getServerClient } from '@/core/lib/brainerce';
+
+export const revalidate = 3600;
+
+export async function GET() {
+  const info = await getServerClient()
+    .getStoreInfo()
+    .catch(() => null);
+  const key = info?.seo?.indexNowKey;
+  if (!key) return new Response(null, { status: 404 });
+  return new Response(key, {
+    headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+  });
+}