create-brainerce-store 1.65.0 → 1.67.0

package/templates/nextjs/base/next.config.ts

@@ -1,86 +1,103 @@
-import type { NextConfig } from 'next';
-import { OPTIMIZED_IMAGE_HOSTS } from './src/core/lib/image-hosts';
-
-// Build-time invariant — fail loud if NEXT_PUBLIC_STORE_CURRENCY is missing
-// for a production build. Next.js inlines NEXT_PUBLIC_* into the client
-// bundle at `next build` time; once inlined, the value cannot be patched at
-// deploy time. A missing env here is the root cause of non-USD stores ending
-// up with `$5,096` baked into their HTML (and indexed by Googlebot).
-//
-// In dev (`next dev`) we only warn, so local-only experiments don't break.
-if (!process.env.NEXT_PUBLIC_STORE_CURRENCY) {
-  const msg =
-    'NEXT_PUBLIC_STORE_CURRENCY is not set.\n' +
-    'Next.js inlines NEXT_PUBLIC_* vars into the client bundle at build time;\n' +
-    'a missing value will silently fall back to USD in storefront price displays\n' +
-    'and ship that to search-engine crawlers. Set it in .env.local (written by\n' +
-    'create-brainerce-store) or in your CI / hosting build env (Coolify / Vercel).';
-  if (process.env.NODE_ENV === 'production') {
-    throw new Error(`[next.config] ${msg}`);
-  } else {
-    console.warn(`[next.config] warning: ${msg}`);
-  }
-}
-
-const nextConfig: NextConfig = {
-  // isomorphic-dompurify ships jsdom, which at runtime reads stylesheet files
-  // from its own package directory. Webpack bundling breaks those relative
-  // lookups — loading it externally from node_modules keeps the paths intact.
-  //
-  // brainerce (the SDK) is imported across both the server and client
-  // compilation boundaries in ~60 files, including the [locale]/layout.tsx
-  // route (see generateStaticParams below) whose static params are resolved
-  // by a separate jest-worker child process in `next dev` (webpack). That
-  // worker requires the compiled page against the vendor-chunks manifest
-  // while the main dev server may still be writing it, which can throw
-  // "Cannot find module './vendor-chunks/brainerce.js'". Excluding it from
-  // server bundling (loaded externally from node_modules instead) avoids the
-  // race.
-  serverExternalPackages: ['isomorphic-dompurify', 'brainerce'],
-  images: {
-    // The storefront is a consumer of the Brainerce API — it has to render
-    // whatever image URLs the API returns. In practice those URLs are
-    // usually on cdn.brainerce.com, but a product/variant can still carry a
-    // raw upstream-merchant URL (WooCommerce, Shopify, self-hosted) while
-    // its image-import job is pending or failed. Rather than allowlist every
-    // possible merchant host (or hard-fail on them), only cdn.brainerce.com
-    // goes through the server-side optimizer; components render product/blog
-    // images via `CdnImage` (src/ui/shared/cdn-image.tsx), which
-    // detects any other host and renders it `unoptimized` — an unresized
-    // direct-from-origin fetch, same as this template's prior behavior —
-    // instead of next/image throwing on an unconfigured hostname. No
-    // server-side fetching of unknown hosts → no SSRF/DoS surface on this
-    // Next server.
-    remotePatterns: OPTIMIZED_IMAGE_HOSTS.map((hostname) => ({
-      protocol: 'https' as const,
-      hostname,
-      pathname: '/**',
-    })),
-  },
-  async headers() {
-    return [
-      {
-        source: '/(.*)',
-        headers: [
-          {
-            key: 'Strict-Transport-Security',
-            value: 'max-age=63072000; includeSubDomains; preload',
-          },
-          { key: 'X-Content-Type-Options', value: 'nosniff' },
-          // SAMEORIGIN (not DENY) so iframe-based payment providers (e.g. Cardcom)
-          // can redirect the iframe back to /payment-complete on the storefront
-          // itself after a successful charge — the postMessage relay needs the
-          // parent frame to be able to render our own same-origin page.
-          { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
-          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
-          {
-            key: 'Permissions-Policy',
-            value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()',
-          },
-        ],
-      },
-    ];
-  },
-};
-
-export default nextConfig;
+import type { NextConfig } from 'next';
+import { OPTIMIZED_IMAGE_HOSTS } from './src/core/lib/image-hosts';
+
+// Build-time invariant — fail loud if NEXT_PUBLIC_STORE_CURRENCY is missing
+// for a production build. Next.js inlines NEXT_PUBLIC_* into the client
+// bundle at `next build` time; once inlined, the value cannot be patched at
+// deploy time. A missing env here is the root cause of non-USD stores ending
+// up with `$5,096` baked into their HTML (and indexed by Googlebot).
+//
+// In dev (`next dev`) we only warn, so local-only experiments don't break.
+if (!process.env.NEXT_PUBLIC_STORE_CURRENCY) {
+  const msg =
+    'NEXT_PUBLIC_STORE_CURRENCY is not set.\n' +
+    'Next.js inlines NEXT_PUBLIC_* vars into the client bundle at build time;\n' +
+    'a missing value will silently fall back to USD in storefront price displays\n' +
+    'and ship that to search-engine crawlers. Set it in .env.local (written by\n' +
+    'create-brainerce-store) or in your CI / hosting build env (Coolify / Vercel).';
+  if (process.env.NODE_ENV === 'production') {
+    throw new Error(`[next.config] ${msg}`);
+  } else {
+    console.warn(`[next.config] warning: ${msg}`);
+  }
+}
+
+// Advisory only — NEVER throw here. A missing site URL is normal and expected:
+// AI builders (ChatGPT, Lovable, Bolt) and container hosts build the project
+// before the deploy domain exists, and the storefront resolves its own origin
+// from the request at runtime (src/core/lib/site-url.ts). Failing the build
+// would break exactly the flow this exists to support. The loud signal lives
+// at runtime instead, where a genuinely unresolvable origin is detectable.
+if (!process.env.SITE_URL && !process.env.NEXT_PUBLIC_SITE_URL) {
+  console.warn(
+    [
+      '[next.config] SITE_URL is not set. Canonical URLs, sitemap.xml and robots.txt',
+      'will be derived from each request (forwarded host), which works but is',
+      'request-dependent. Set SITE_URL=https://your-domain.com in your hosting',
+      "provider's environment variables once your domain is known.",
+    ].join('\n')
+  );
+}
+
+const nextConfig: NextConfig = {
+  // isomorphic-dompurify ships jsdom, which at runtime reads stylesheet files
+  // from its own package directory. Webpack bundling breaks those relative
+  // lookups — loading it externally from node_modules keeps the paths intact.
+  //
+  // brainerce (the SDK) is imported across both the server and client
+  // compilation boundaries in ~60 files, including the [locale]/layout.tsx
+  // route (see generateStaticParams below) whose static params are resolved
+  // by a separate jest-worker child process in `next dev` (webpack). That
+  // worker requires the compiled page against the vendor-chunks manifest
+  // while the main dev server may still be writing it, which can throw
+  // "Cannot find module './vendor-chunks/brainerce.js'". Excluding it from
+  // server bundling (loaded externally from node_modules instead) avoids the
+  // race.
+  serverExternalPackages: ['isomorphic-dompurify', 'brainerce'],
+  images: {
+    // The storefront is a consumer of the Brainerce API — it has to render
+    // whatever image URLs the API returns. In practice those URLs are
+    // usually on cdn.brainerce.com, but a product/variant can still carry a
+    // raw upstream-merchant URL (WooCommerce, Shopify, self-hosted) while
+    // its image-import job is pending or failed. Rather than allowlist every
+    // possible merchant host (or hard-fail on them), only cdn.brainerce.com
+    // goes through the server-side optimizer; components render product/blog
+    // images via `CdnImage` (src/ui/shared/cdn-image.tsx), which
+    // detects any other host and renders it `unoptimized` — an unresized
+    // direct-from-origin fetch, same as this template's prior behavior —
+    // instead of next/image throwing on an unconfigured hostname. No
+    // server-side fetching of unknown hosts → no SSRF/DoS surface on this
+    // Next server.
+    remotePatterns: OPTIMIZED_IMAGE_HOSTS.map((hostname) => ({
+      protocol: 'https' as const,
+      hostname,
+      pathname: '/**',
+    })),
+  },
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          {
+            key: 'Strict-Transport-Security',
+            value: 'max-age=63072000; includeSubDomains; preload',
+          },
+          { key: 'X-Content-Type-Options', value: 'nosniff' },
+          // SAMEORIGIN (not DENY) so iframe-based payment providers (e.g. Cardcom)
+          // can redirect the iframe back to /payment-complete on the storefront
+          // itself after a successful charge — the postMessage relay needs the
+          // parent frame to be able to render our own same-origin page.
+          { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
+          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+          {
+            key: 'Permissions-Policy',
+            value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()',
+          },
+        ],
+      },
+    ];
+  },
+};
+
+export default nextConfig;

package/templates/nextjs/base/scripts/fetch-store-info.mjs

@@ -1,97 +1,104 @@
-/* eslint-disable no-console */
-/**
- * Setup script: fetches store info from Brainerce using the connection ID
- * and saves NEXT_PUBLIC_STORE_NAME (and other public fields) to .env.local.
- *
- * Run: node scripts/fetch-store-info.mjs
- */
-
-import { readFileSync, writeFileSync, existsSync } from 'fs';
-import { join } from 'path';
-
-const envPath = join(process.cwd(), '.env.local');
-
-if (!existsSync(envPath)) {
-  console.error(
-    '❌  .env.local not found. Create it first with NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID set.'
-  );
-  process.exit(1);
-}
-
-const envContent = readFileSync(envPath, 'utf-8');
-
-function getVar(content, key) {
-  const match = content.match(new RegExp(`^${key}=(.*)$`, 'm'));
-  return match ? match[1].trim() : null;
-}
-
-function setVar(content, key, value) {
-  const regex = new RegExp(`^${key}=.*$`, 'm');
-  if (regex.test(content)) {
-    return content.replace(regex, `${key}=${value}`);
-  }
-  return content.trimEnd() + `\n${key}=${value}\n`;
-}
-
-// Read either env var name. The new one is preferred; the old one is a soft
-// alias kept for backwards compatibility — the SDK accepts both.
-const connectionId =
-  getVar(envContent, 'NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID') ||
-  getVar(envContent, 'NEXT_PUBLIC_BRAINERCE_CONNECTION_ID');
-const apiUrl = (getVar(envContent, 'BRAINERCE_API_URL') || 'https://api.brainerce.com').replace(
-  /\/$/,
-  ''
-);
-
-if (!connectionId) {
-  console.error('❌  NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID is not set in .env.local');
-  process.exit(1);
-}
-
-console.log(`Fetching store info for sales channel: ${connectionId} ...`);
-
-let storeInfo;
-try {
-  // /api/vc/* enforces an Origin check: TEST channels accept local/tunnel
-  // hosts, LIVE channels require the configured domain. Prefer the project's
-  // own NEXT_PUBLIC_SITE_URL (the real domain for a LIVE store), falling back
-  // to localhost for local dev against a TEST channel.
-  const siteUrl = getVar(envContent, 'NEXT_PUBLIC_SITE_URL') || 'http://localhost:3000';
-  const res = await fetch(`${apiUrl}/api/vc/${connectionId}/info`, {
-    headers: { Origin: siteUrl },
-  });
-  if (!res.ok) {
-    console.error(`❌  API returned ${res.status}: ${await res.text()}`);
-    process.exit(1);
-  }
-  storeInfo = await res.json();
-} catch (err) {
-  console.error(`❌  Failed to reach ${apiUrl}: ${err.message}`);
-  process.exit(1);
-}
-
-const name = storeInfo.name;
-const currency = storeInfo.currency;
-
-if (!name) {
-  console.error('❌  Store info response has no `name` field:', storeInfo);
-  process.exit(1);
-}
-// Currency is NOT NULL in the backend schema — a response without it
-// is a real backend bug, not a "use the default" signal. Fail loud rather
-// than silently leaving the env stale (which would bake the previous
-// value into the next client bundle build).
-if (!currency) {
-  console.error('❌  Store info response has no `currency` field:', storeInfo);
-  process.exit(1);
-}
-
-let updated = envContent;
-updated = setVar(updated, 'NEXT_PUBLIC_STORE_NAME', name);
-updated = setVar(updated, 'NEXT_PUBLIC_STORE_CURRENCY', currency);
-
-writeFileSync(envPath, updated, 'utf-8');
-
-console.log(`✓ NEXT_PUBLIC_STORE_NAME=${name}`);
-console.log(`✓ NEXT_PUBLIC_STORE_CURRENCY=${currency}`);
-console.log('Done. Restart the dev server for changes to take effect.');
+/* eslint-disable no-console */
+/**
+ * Setup script: fetches store info from Brainerce using the connection ID
+ * and saves NEXT_PUBLIC_STORE_NAME (and other public fields) to .env.local.
+ *
+ * Run: node scripts/fetch-store-info.mjs
+ */
+
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { join } from 'path';
+
+const envPath = join(process.cwd(), '.env.local');
+
+if (!existsSync(envPath)) {
+  console.error(
+    '❌  .env.local not found. Create it first with NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID set.'
+  );
+  process.exit(1);
+}
+
+const envContent = readFileSync(envPath, 'utf-8');
+
+function getVar(content, key) {
+  const match = content.match(new RegExp(`^${key}=(.*)$`, 'm'));
+  return match ? match[1].trim() : null;
+}
+
+function setVar(content, key, value) {
+  const regex = new RegExp(`^${key}=.*$`, 'm');
+  if (regex.test(content)) {
+    return content.replace(regex, `${key}=${value}`);
+  }
+  return content.trimEnd() + `\n${key}=${value}\n`;
+}
+
+// Read either env var name. The new one is preferred; the old one is a soft
+// alias kept for backwards compatibility — the SDK accepts both.
+const connectionId =
+  getVar(envContent, 'NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID') ||
+  getVar(envContent, 'NEXT_PUBLIC_BRAINERCE_CONNECTION_ID');
+const apiUrl = (getVar(envContent, 'BRAINERCE_API_URL') || 'https://api.brainerce.com').replace(
+  /\/$/,
+  ''
+);
+
+if (!connectionId) {
+  console.error('❌  NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID is not set in .env.local');
+  process.exit(1);
+}
+
+console.log(`Fetching store info for sales channel: ${connectionId} ...`);
+
+let storeInfo;
+try {
+  // /api/vc/* enforces an Origin check: TEST channels accept local/tunnel
+  // hosts, LIVE channels require the configured domain. Prefer an explicitly
+  // configured site URL (the real domain for a LIVE store); localhost is only
+  // a last resort, and it is correct here in a way it is NOT correct at
+  // runtime — this script runs on the developer's own machine, not on the
+  // host the storefront is deployed to.
+  const siteUrl =
+    process.env.SITE_URL ||
+    getVar(envContent, 'SITE_URL') ||
+    process.env.NEXT_PUBLIC_SITE_URL ||
+    getVar(envContent, 'NEXT_PUBLIC_SITE_URL') ||
+    'http://localhost:3000';
+  const res = await fetch(`${apiUrl}/api/vc/${connectionId}/info`, {
+    headers: { Origin: siteUrl },
+  });
+  if (!res.ok) {
+    console.error(`❌  API returned ${res.status}: ${await res.text()}`);
+    process.exit(1);
+  }
+  storeInfo = await res.json();
+} catch (err) {
+  console.error(`❌  Failed to reach ${apiUrl}: ${err.message}`);
+  process.exit(1);
+}
+
+const name = storeInfo.name;
+const currency = storeInfo.currency;
+
+if (!name) {
+  console.error('❌  Store info response has no `name` field:', storeInfo);
+  process.exit(1);
+}
+// Currency is NOT NULL in the backend schema — a response without it
+// is a real backend bug, not a "use the default" signal. Fail loud rather
+// than silently leaving the env stale (which would bake the previous
+// value into the next client bundle build).
+if (!currency) {
+  console.error('❌  Store info response has no `currency` field:', storeInfo);
+  process.exit(1);
+}
+
+let updated = envContent;
+updated = setVar(updated, 'NEXT_PUBLIC_STORE_NAME', name);
+updated = setVar(updated, 'NEXT_PUBLIC_STORE_CURRENCY', currency);
+
+writeFileSync(envPath, updated, 'utf-8');
+
+console.log(`✓ NEXT_PUBLIC_STORE_NAME=${name}`);
+console.log(`✓ NEXT_PUBLIC_STORE_CURRENCY=${currency}`);
+console.log('Done. Restart the dev server for changes to take effect.');

package/templates/nextjs/base/src/app/agents.md/route.ts

@@ -7,7 +7,8 @@
  * works. /llms.txt mirrors the same information in the older convention —
  * keep the two consistent.
  */
-import { getServerClient } from '@/core/lib/brainerce';
+import { getServerClient } from '@/core/lib/brainerce.server';
+import { getCanonicalSiteUrl } from '@/core/lib/site-url';
 
 export const revalidate = 3600;
 
@@ -18,7 +19,7 @@ interface CategoryNodeLike {
 }
 
 export async function GET() {
-  const baseUrl = process.env.NEXT_PUBLIC_SITE_URL || 'https://example.com';
+  const baseUrl = await getCanonicalSiteUrl();
   // Machine-readable product feed served by the Brainerce API per channel —
   // the same artifact Google/Microsoft/Perplexity ingest; agents can read the
   // whole catalog in one structured fetch instead of crawling page by page.
@@ -27,7 +28,7 @@ export async function GET() {
     process.env.NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID ||
     process.env.NEXT_PUBLIC_BRAINERCE_CONNECTION_ID ||
     '';
-  const client = getServerClient();
+  const client = await getServerClient();
 
   const [info, categoriesRes] = await Promise.all([
     client.getStoreInfo().catch(() => null),

package/templates/nextjs/base/src/app/api/auth/me/route.ts

@@ -1,59 +1,65 @@
-import { NextResponse } from 'next/server';
-import { cookies, headers } from 'next/headers';
-
-const BACKEND_URL = (process.env.BRAINERCE_API_URL || 'https://api.brainerce.com').replace(
-  /\/$/,
-  ''
-);
-
-const CONNECTION_ID =
-  process.env.NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID ||
-  process.env.NEXT_PUBLIC_BRAINERCE_CONNECTION_ID ||
-  '';
-
-const TOKEN_COOKIE = 'brainerce_customer_token';
-const LOGGED_IN_COOKIE = 'brainerce_logged_in';
-
-/**
- * Auth status check endpoint.
- * Reads the httpOnly cookie, validates against backend, returns auth state.
- */
-export async function GET() {
-  const cookieStore = await cookies();
-  const tokenCookie = cookieStore.get(TOKEN_COOKIE);
-
-  if (!tokenCookie?.value) {
-    return NextResponse.json({ isLoggedIn: false });
-  }
-
-  // Derive Origin from the incoming request so the backend's BrowserOriginGuard accepts it
-  const requestHeaders = await headers();
-  const host = requestHeaders.get('host') || 'localhost:3000';
-  const proto = requestHeaders.get('x-forwarded-proto') || 'http';
-  const origin = requestHeaders.get('origin') || `${proto}://${host}`;
-
-  try {
-    // Validate token by calling backend profile endpoint
-    const response = await fetch(`${BACKEND_URL}/api/vc/${CONNECTION_ID}/customers/me`, {
-      headers: {
-        Authorization: `Bearer ${tokenCookie.value}`,
-        'Content-Type': 'application/json',
-        Origin: origin,
-      },
-    });
-
-    if (!response.ok) {
-      // Token is invalid or expired — clear cookies
-      const res = NextResponse.json({ isLoggedIn: false });
-      res.cookies.delete(TOKEN_COOKIE);
-      res.cookies.delete(LOGGED_IN_COOKIE);
-      return res;
-    }
-
-    const customer = await response.json();
-    return NextResponse.json({ isLoggedIn: true, customer });
-  } catch {
-    // Backend unreachable — don't clear cookies, might be temporary
-    return NextResponse.json({ isLoggedIn: false, error: 'Service unavailable' }, { status: 503 });
-  }
-}
+import { NextResponse } from 'next/server';
+import { cookies, headers } from 'next/headers';
+import { getRequestOrigin } from '@/core/lib/site-url';
+
+const BACKEND_URL = (process.env.BRAINERCE_API_URL || 'https://api.brainerce.com').replace(
+  /\/$/,
+  ''
+);
+
+const CONNECTION_ID =
+  process.env.NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID ||
+  process.env.NEXT_PUBLIC_BRAINERCE_CONNECTION_ID ||
+  '';
+
+const TOKEN_COOKIE = 'brainerce_customer_token';
+const LOGGED_IN_COOKIE = 'brainerce_logged_in';
+
+/**
+ * Auth status check endpoint.
+ * Reads the httpOnly cookie, validates against backend, returns auth state.
+ */
+export async function GET() {
+  const cookieStore = await cookies();
+  const tokenCookie = cookieStore.get(TOKEN_COOKIE);
+
+  if (!tokenCookie?.value) {
+    return NextResponse.json({ isLoggedIn: false });
+  }
+
+  // The backend compares this against the sales channel's configured domain, so
+  // it must be the storefront's real public origin. This route used to build it
+  // by hand and got three things wrong at once: it read `host` but not
+  // `x-forwarded-host` (an internal container host behind a proxy), it defaulted
+  // the protocol to `http` (never matching an `https://` configured domain), and
+  // it preferred the CLIENT-SUPPLIED `Origin` header — the same value the BFF
+  // proxy deliberately refuses to forward, because trusting it lets a caller
+  // pick which storefront the backend thinks it is talking to. The localhost
+  // fallback then made a Live channel reject every logged-in session check.
+  const origin = await getRequestOrigin(await headers());
+
+  try {
+    // Validate token by calling backend profile endpoint
+    const response = await fetch(`${BACKEND_URL}/api/vc/${CONNECTION_ID}/customers/me`, {
+      headers: {
+        Authorization: `Bearer ${tokenCookie.value}`,
+        'Content-Type': 'application/json',
+        Origin: origin,
+      },
+    });
+
+    if (!response.ok) {
+      // Token is invalid or expired — clear cookies
+      const res = NextResponse.json({ isLoggedIn: false });
+      res.cookies.delete(TOKEN_COOKIE);
+      res.cookies.delete(LOGGED_IN_COOKIE);
+      return res;
+    }
+
+    const customer = await response.json();
+    return NextResponse.json({ isLoggedIn: true, customer });
+  } catch {
+    // Backend unreachable — don't clear cookies, might be temporary
+    return NextResponse.json({ isLoggedIn: false, error: 'Service unavailable' }, { status: 503 });
+  }
+}