Prebuilt Storefront Prompt

Build a production-ready Crave restaurant storefront.

Use the exact @craveup/storefront-sdk@2.0.1 package with:
const crave = createStorefrontClient({
  baseUrl: process.env.NEXT_PUBLIC_CRAVEUP_API_URL!,
  sessionStore,
  getAuthToken,
});

Requirements:
- Published catalog reads are anonymous; never add a browser API key.
- Use versioned sessionStorage scoped by canonical API environment, merchant, and location for cart capability and revision state.
- Keep cart capabilities, customer JWTs, receipt tokens, and PaymentIntent client secrets out of URLs, logs, analytics, and persistent storage.
- Start ordering sessions with idempotency, then use SDK cart methods so capability, ETag, If-Match, and idempotency headers remain consistent.
- On CART_CONFLICT, reload current cart state before presenting a retry.
- Include merchantSlug in customer login and OTP requests.
- Confirm payments with Stripe.js and poll all four order-result states: payment_pending, order_pending, completed, failed. Never assume success.
- Capture receipt capabilities from URL fragments, remove the fragment immediately, and keep each capability only in tab-scoped storage scoped by API environment, merchant, and receipt ID.
- Keep Stripe secret keys, POS credentials, loyalty credentials, webhook secrets, and private Crave integration keys on the API service.
- Use exact CORS origins for each deployed storefront.

Before completion, run tests, lint, type checking, a production build, a browser-bundle credential scan, and a sandbox end-to-end ordering check. Report exact commands and remaining deployment requirements.