create-brainerce-store 1.75.0 → 1.77.0

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "create-brainerce-store",
-      version: "1.75.0",
+      version: "1.77.0",
       description: "Scaffold a production-ready e-commerce storefront connected to Brainerce",
       bin: {
         "create-brainerce-store": "dist/index.js"
@@ -48,7 +48,8 @@ var require_package = __commonJS({
         clean: "rimraf dist",
         release: "pnpm build && node ../../scripts/publish-workspace-package.js .",
         "check:template-parity": "node scripts/check-template-parity.js",
-        prepublishOnly: "node scripts/check-template-parity.js && node ../../scripts/check-publishable.js ./package.json"
+        "check:sdk-published": "node scripts/check-sdk-published.js",
+        prepublishOnly: "node scripts/check-template-parity.js && node scripts/check-sdk-published.js && node ../../scripts/check-publishable.js ./package.json"
       },
       dependencies: {
         chalk: "^4.1.2",
@@ -266,12 +267,45 @@ var BRAINERCE_RUNTIME_DEPS = Object.freeze({
   // not compile against `checkout.tenders`.)
   //
   // 2.1.0 was published on 2026-09-03 and the tarball was checked for the
-  // methods the template calls, so this range is satisfiable. The RELEASE ORDER
-  // rule above still stands for the NEXT bump: publish brainerce first, confirm
-  // it on the registry with `npm pack` (not `npm view`, which serves a stale
-  // cache), and only then publish the CLI — a floor above the published SDK is
-  // unsatisfiable and kills every scaffold at install.
-  brainerce: "^2.2.0",
+  // methods the template calls, so this range is satisfiable.
+  //
+  // 2.2.0 completes the gift-card surface. `Order.tenders` records how an order
+  // was actually paid, so an order that a gift card covered in part no longer
+  // reads as underpaid in the scaffolded order history and confirmation page,
+  // and the admin gift-card methods (issue/list/adjust/reissue) round out the
+  // v1 API. Nothing under `src/ui/` calls the admin half and nothing should:
+  // issuing mints stored value and needs an admin key, which a storefront must
+  // never hold. The floor moved to ^2.2.0 for the `tenders` field alone.
+  //
+  // ⛔ THE RELEASE ORDER RULE WAS BROKEN AT THIS BUMP. Do not cite 2.2.0 as
+  // precedent that the rule holds. The registry timestamps say the opposite:
+  //
+  //     create-brainerce-store@1.75.0   2026-09-05T17:52:59.904Z
+  //     brainerce@2.2.0                 2026-09-05T17:53:37.083Z  (38s later)
+  //
+  // For 38 seconds `npx create-brainerce-store` produced a project whose
+  // install died on an unsatisfiable ^2.2.0. It self-healed, which is exactly
+  // why it went unnoticed. The rule is no longer enforced by this comment:
+  // `create-brainerce-store/scripts/check-sdk-published.js` reads this floor,
+  // asks the npm registry directly whether that exact version exists, and fails
+  // `prepublishOnly` when it does not. Run it yourself with
+  // `pnpm --filter create-brainerce-store check:sdk-published`.
+  //
+  // ⛔ Do not verify a release with `npm view`. In this environment it serves a
+  // stale cache and has reported live packages as unpublished.
+  //
+  // 2.3.0 takes the customer auth token out of every `localStorage` example in
+  // the published README, which is the copy an agent building against this
+  // starter reads. It also turns thirteen methods that returned 404 into a
+  // throw that names the alternative, and adds `Idempotency-Key` to the
+  // gift-card writes. It also adds `pendingPoints`, `pendingPointsConfirmAt`
+  // and `program.pendingDays` to `LoyaltyStatus` — and THAT the templates do
+  // need: the scaffolded rewards panel reads all three to tell a shopper who
+  // just ordered that their points are on the way instead of showing them a
+  // bare 0, so an older SDK fails type-check at scaffold time. This floor is
+  // load-bearing now; it is no longer only about provably getting the
+  // corrected README.
+  brainerce: "^2.4.0",
   "isomorphic-dompurify": "^3.8.0"
 });
 

package/messages/en.json

@@ -296,7 +296,12 @@
     "customFieldsTimeNoneLeft": "Every time on this date has already passed. Please pick a later date.",
     "customFieldsTimeTo": "to",
     "changeOptions": "Change options",
-    "surcharges": "Additional charges"
+    "surcharges": "Additional charges",
+    "fullyCovered": "Your gift cards cover this order",
+    "fullyCoveredHint": "Nothing left to pay. Place the order to finish.",
+    "placeOrder": "Place order",
+    "placing": "Placing order...",
+    "placeFailed": "We could not place the order. Please try again."
   },
   "checkoutForm": {
     "email": "Email",
@@ -348,6 +353,7 @@
     "joinSubtitle": "Join us to start shopping",
     "creatingAccount": "Creating account...",
     "createAccount": "Create Account",
+    "referralApplied": "Your friend's invitation is applied. Your welcome gift lands with this account.",
     "alreadyHaveAccount": "Already have an account?",
     "email": "Email",
     "emailPlaceholder": "you@example.com",
@@ -565,8 +571,15 @@
   },
   "loyalty": {
     "title": "Rewards",
+    "widgetTitle": "Your rewards",
+    "referralGreeting": "{name} sent you a gift",
+    "referralGreetingAnonymous": "A friend sent you a gift",
+    "referralReward": "Your welcome gift: {reward}",
+    "referralCta": "Create your account to claim it",
     "pointsFallback": "points",
     "readyToSpend": "Ready to spend. Points from a recent order become available after they clear.",
+    "pending": "{points} {pointsName} from a recent order are still clearing.",
+    "pendingWithDate": "{points} {pointsName} from a recent order become available on {date}.",
     "earningPaused": "The rewards programme is paused, so orders are not earning right now. Points you already have can still be spent.",
     "toNextTierPoints": "{amount} {pointsName} to {tier}",
     "toNextTierSpend": "{amount} more spent to reach {tier}",

package/messages/he.json

@@ -296,7 +296,12 @@
     "customFieldsTimeNoneLeft": "כל השעות בתאריך הזה כבר עברו. בחרו תאריך מאוחר יותר.",
     "customFieldsTimeTo": "עד",
     "changeOptions": "שנה אפשרויות",
-    "surcharges": "תוספות"
+    "surcharges": "תוספות",
+    "fullyCovered": "כרטיסי המתנה מכסים את ההזמנה",
+    "fullyCoveredHint": "לא נותר מה לשלם. השלימו את ההזמנה כדי לסיים.",
+    "placeOrder": "השלמת ההזמנה",
+    "placing": "משלים...",
+    "placeFailed": "לא הצלחנו להשלים את ההזמנה. נסו שוב."
   },
   "checkoutForm": {
     "email": "אימייל",
@@ -348,6 +353,7 @@
     "joinSubtitle": "הצטרפו אלינו והתחילו לקנות",
     "creatingAccount": "יוצר חשבון...",
     "createAccount": "צור חשבון",
+    "referralApplied": "ההזמנה מהחבר שלכם נקלטה. מתנת ההצטרפות תחכה לכם בחשבון הזה.",
     "alreadyHaveAccount": "כבר יש לכם חשבון?",
     "email": "אימייל",
     "emailPlaceholder": "you@example.com",
@@ -565,8 +571,15 @@
   },
   "loyalty": {
     "title": "מועדון הטבות",
+    "widgetTitle": "ההטבות שלך",
+    "referralGreeting": "{name} שלח/ה לכם מתנה",
+    "referralGreetingAnonymous": "חבר שלח לכם מתנה",
+    "referralReward": "מתנת ההצטרפות שלכם: {reward}",
+    "referralCta": "פתחו חשבון כדי לממש",
     "pointsFallback": "נקודות",
     "readyToSpend": "זמינות למימוש. נקודות מהזמנה אחרונה יהפכו לזמינות לאחר תקופת המתנה.",
+    "pending": "{points} {pointsName} מהזמנה אחרונה עדיין בתקופת המתנה.",
+    "pendingWithDate": "{points} {pointsName} מהזמנה אחרונה יהפכו לזמינות ב-{date}.",
     "earningPaused": "תוכנית ההטבות מושהית, ולכן הזמנות לא צוברות נקודות כרגע. את הנקודות שכבר צברת ניתן לממש.",
     "toNextTierPoints": "{amount} {pointsName} עד {tier}",
     "toNextTierSpend": "עוד {amount} בקניות כדי להגיע ל-{tier}",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-brainerce-store",
-  "version": "1.75.0",
+  "version": "1.77.0",
   "description": "Scaffold a production-ready e-commerce storefront connected to Brainerce",
   "bin": {
     "create-brainerce-store": "dist/index.js"
@@ -17,7 +17,8 @@
     "clean": "rimraf dist",
     "release": "pnpm build && node ../../scripts/publish-workspace-package.js .",
     "check:template-parity": "node scripts/check-template-parity.js",
-    "prepublishOnly": "node scripts/check-template-parity.js && node ../../scripts/check-publishable.js ./package.json"
+    "check:sdk-published": "node scripts/check-sdk-published.js",
+    "prepublishOnly": "node scripts/check-template-parity.js && node scripts/check-sdk-published.js && node ../../scripts/check-publishable.js ./package.json"
   },
   "dependencies": {
     "chalk": "^4.1.2",

package/templates/nextjs/base/.env.local.ejs

@@ -1,52 +1,62 @@
-# Brainerce Sales Channel — preferred env var name.
-NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID=<%= connectionId %>
-# Legacy alias kept for backwards compatibility — both are accepted by the SDK.
-# @deprecated will be removed when SDK 2.0 ships.
-NEXT_PUBLIC_BRAINERCE_CONNECTION_ID=<%= connectionId %>
-
-# Store info (pre-fetched during setup to avoid flash on first load)
-NEXT_PUBLIC_STORE_NAME=<%- storeNameEnv %>
-NEXT_PUBLIC_STORE_CURRENCY=<%- currencyEnv %>
-
-# Backend API URL (server-side only — used by BFF proxy and SSR, never exposed to browser)
-BRAINERCE_API_URL=<%- apiBaseUrlEnv %>
-
-# Public API origin for the AI chat widget (public, unauthenticated endpoints only).
-# The widget streams chat directly from the browser, so this one IS public.
-NEXT_PUBLIC_BRAINERCE_API_URL=<%- apiBaseUrlEnv %>
-
-# Public site URL — canonical tags, sitemap.xml, robots.txt, JSON-LD, and the
-# Origin header the Brainerce backend checks against your sales channel's
-# configured domain.
-#
-# Intentionally unset. Nothing at setup time knows where this store will be
-# served from, so the storefront resolves its own origin at runtime: hosting
-# platform variables first (Vercel / Netlify / Render / Railway / Cloudflare
-# Pages), then the incoming request's forwarded host. It is correct in local
-# development and on any host, with nothing set here.
-#
-# ⛔ Do not write a placeholder address into this variable. A wrong absolute
-# URL is indistinguishable from a right one to a search crawler, so a guess
-# here is worse than leaving it empty. Either set your real domain or nothing.
-#
-# Once you have that domain, set it — an explicit value is the only source a
-# request header cannot forge, and it keeps canonical URLs stable across
-# preview deployments:
-#
-#   SITE_URL=https://shop.example.com
-#
-# Set it in your hosting provider's environment variables, not in this file:
-# .env.local is gitignored and never travels with a deploy.
-# `NEXT_PUBLIC_SITE_URL` is still read as a backwards-compatible alias.
-#
-# On some hosts SITE_URL is NOT optional. Platforms whose proxy forwards
-# requests to the app as `Host: localhost:<port>` (OpenAI Sites /
-# *.chatgpt.site, among others) hide the real hostname from the server, so
-# nothing can be resolved from the request. Set SITE_URL there, or server-side
-# API calls send `Origin: http://localhost:3000` and a sales channel with a
-# configured Domain rejects them with 403.
-
-# Optional: floating WhatsApp contact button (used by some designs, e.g.
-# passepartout). Digits only, international format without "+"
-# (e.g. 14155550123). Leave unset to hide the button.
-# NEXT_PUBLIC_WHATSAPP_PHONE=
+# Brainerce Sales Channel — preferred env var name.
+NEXT_PUBLIC_BRAINERCE_SALES_CHANNEL_ID=<%= connectionId %>
+# Legacy alias kept for backwards compatibility — both are accepted by the SDK.
+# @deprecated will be removed when SDK 2.0 ships.
+NEXT_PUBLIC_BRAINERCE_CONNECTION_ID=<%= connectionId %>
+
+# Store info (pre-fetched during setup to avoid flash on first load)
+NEXT_PUBLIC_STORE_NAME=<%- storeNameEnv %>
+NEXT_PUBLIC_STORE_CURRENCY=<%- currencyEnv %>
+
+# Backend API URL (server-side only — used by BFF proxy and SSR, never exposed to browser)
+#
+# ⛔ There is no API key here, and there must never be one. This storefront runs
+# entirely on the PUBLIC sales channel credentials above. An admin key
+# (brainerce_*) in a browser-reachable app is readable by anyone who opens
+# devtools, and it is full write access to the live store. In particular, never
+# give this project the `gift_cards:issue` scope: it mints stored value.
+# Redeeming a card from the storefront needs no key at all (applyGiftCard /
+# removeGiftCard / checkGiftCardBalance); issuing one is a dashboard action, or
+# server-side on infrastructure the merchant controls.
+BRAINERCE_API_URL=<%- apiBaseUrlEnv %>
+
+# Public API origin for the AI chat widget (public, unauthenticated endpoints only).
+# The widget streams chat directly from the browser, so this one IS public.
+NEXT_PUBLIC_BRAINERCE_API_URL=<%- apiBaseUrlEnv %>
+
+# Public site URL — canonical tags, sitemap.xml, robots.txt, JSON-LD, and the
+# Origin header the Brainerce backend checks against your sales channel's
+# configured domain.
+#
+# Intentionally unset. Nothing at setup time knows where this store will be
+# served from, so the storefront resolves its own origin at runtime: hosting
+# platform variables first (Vercel / Netlify / Render / Railway / Cloudflare
+# Pages), then the incoming request's forwarded host. It is correct in local
+# development and on any host, with nothing set here.
+#
+# ⛔ Do not write a placeholder address into this variable. A wrong absolute
+# URL is indistinguishable from a right one to a search crawler, so a guess
+# here is worse than leaving it empty. Either set your real domain or nothing.
+#
+# Once you have that domain, set it — an explicit value is the only source a
+# request header cannot forge, and it keeps canonical URLs stable across
+# preview deployments:
+#
+#   SITE_URL=https://shop.example.com
+#
+# Set it in your hosting provider's environment variables, not in this file:
+# .env.local is gitignored and never travels with a deploy.
+# `NEXT_PUBLIC_SITE_URL` is still read as a backwards-compatible alias.
+#
+# On some hosts SITE_URL is NOT optional. Platforms whose proxy forwards
+# requests to the app as `Host: localhost:<port>` (OpenAI Sites /
+# *.chatgpt.site, among others) hide the real hostname from the server, so
+# nothing can be resolved from the request. Set SITE_URL there, or server-side
+# API calls send `Origin: http://localhost:3000` and a sales channel with a
+# configured Domain rejects them with 403.
+
+# Optional: floating WhatsApp contact button. Nothing shipped reads this today,
+# including the `atelier` design. It is a naming convention for a button you
+# build. Digits only, international format without "+"
+# (e.g. 14155550123). Leave unset to hide the button.
+# NEXT_PUBLIC_WHATSAPP_PHONE=