@reblu/site-next 1.13.0 → 1.14.0

package/dist/collection-BE5dhf-r.d.cts

@@ -0,0 +1,106 @@
+import { ShopProductsParams, ListResult, RebluClient } from '@reblu/site-client';
+import { ShopProductListItem, ShopFacets } from '@reblu/site-contracts';
+
+/**
+ * Parse a `URLSearchParams` (or anything with that shape — `ReadonlyURLSearchParams`
+ * from `next/navigation`, or a plain `new URLSearchParams(record)`) into
+ * `ShopProductsParams`. Hostile/unknown params are dropped: only the known
+ * scalar keys and the two bracket groups are ever read.
+ */
+declare function parseShopSearchParams(searchParams: URLSearchParams): ShopProductsParams;
+/**
+ * Serialize `ShopProductsParams` into a `URLSearchParams` — the inverse of
+ * {@link parseShopSearchParams}. Falsy/empty/undefined fields are omitted, so
+ * `parseShopSearchParams(serializeShopParams(params))` round-trips to `params`
+ * for any already-canonical (non-empty-string, in-range) input — that is the
+ * property the round-trip tests pin.
+ */
+declare function serializeShopParams(params: ShopProductsParams): URLSearchParams;
+/**
+ * Convert Next's `searchParams` route prop —
+ * `Record<string, string | string[] | undefined>`, already URL-decoded, with
+ * a repeated query key grouped into an array — into a `URLSearchParams` for
+ * {@link parseShopSearchParams}.
+ *
+ * NOT the same as `new URLSearchParams(searchParams)`: the native
+ * `URLSearchParams` constructor only accepts `Record<string, string>` —
+ * handed an array value (`{ 'attr[color]': ['red', 'blue'] }`), it calls
+ * `String()` on it, producing ONE entry `attr[color]=red,blue` instead of two
+ * repeated `attr[color]=red` / `attr[color]=blue` entries. That silently
+ * breaks `parseShopSearchParams`'s repeat-count-based array/scalar
+ * distinction (see its own module doc) for every multi-value `attr[<key>]`
+ * filter — this helper is what actually preserves the repeat.
+ */
+declare function toURLSearchParams(searchParams: Record<string, string | string[] | undefined>): URLSearchParams;
+/**
+ * The navigation seam `@reblu/site-blocks`'s `ShopFilters` calls `hrefs` — kept
+ * structurally identical to its `ShopFiltersHrefs` type WITHOUT a package
+ * dependency on `@reblu/site-blocks` (this package has none today, and this
+ * one shape does not warrant adding one). Any object matching this shape is
+ * assignable to `ShopFiltersHrefs` by structural typing.
+ */
+interface ShopFilterHrefs {
+    taxonomy: (axisKey: string, value: string | undefined) => string;
+    attr: (fieldKey: string, value: string) => string;
+    price: (min: number | undefined, max: number | undefined) => string;
+    onSale: (nextActive: boolean) => string;
+    clearAll: () => string;
+}
+/**
+ * Build `ShopFilters`' href set from the CURRENT params and pathname. Every
+ * href preserves every OTHER current param (category, q, sort, every other
+ * taxonomy/attr filter) and resets pagination (`page`) — a filter change is
+ * never silently stuck on page 4 of a now-smaller result set.
+ *
+ * Pure and framework-agnostic (no `next/navigation`): a Server Component calls
+ * it directly with its own `searchParams` prop and route pathname — no
+ * `'use client'` boundary required. See `./use-shop-filter-links` for the
+ * client-side hook that wraps this with `usePathname`/`useSearchParams`.
+ */
+declare function buildShopFilterHrefs(current: ShopProductsParams, pathname: string): ShopFilterHrefs;
+
+/**
+ * `getShopCollection` (REB-809) — fetches the product list AND its facets with
+ * the EXACT SAME params in one call. This is the seam that keeps a shop
+ * collection page correct: facet counts must reflect the same filter context
+ * the product list is showing, and a hand-rolled page that calls
+ * `client.shop.products(params)` and `client.shop.facets(someOtherParams)`
+ * separately is exactly how they drift apart.
+ *
+ * Server-safe (no `'use client'`, no React) — call it directly from an async
+ * Server Component (route `page.tsx`) with the params parsed via
+ * {@link parseShopSearchParams} from that page's `searchParams` prop.
+ */
+interface ShopCollection {
+    products: ListResult<ShopProductListItem>;
+    facets: ShopFacets;
+    /**
+     * R3-002: `'ok'` when `client.shop.facets(...)` actually succeeded;
+     * `'unavailable'` when it failed and `facets` above is the degraded
+     * {@link EMPTY_FACETS} fallback. NOT silent — check this before treating an
+     * empty `facets` as "this tenant configured no filterable axes" when it may
+     * really mean "the facets endpoint is down right now". A logged
+     * `console.warn` (see below) covers the case nobody checks this field.
+     */
+    facetsStatus: 'ok' | 'unavailable';
+}
+/**
+ * R4-facets-failure-takes-down-listing: `products` and `facets` are NOT
+ * equally critical. A product listing with no products is not a listing —
+ * that failure must propagate so the caller's own error handling (or a
+ * thrown-away `try/catch` degrading the whole page) sees it. A product
+ * listing with no FACETS is still a perfectly good listing, just without
+ * filter UI — degrading `facets` to {@link EMPTY_FACETS} on failure, instead
+ * of letting one upstream endpoint's outage take the other down too, is what
+ * `Promise.allSettled` (rather than `Promise.all`) buys here.
+ *
+ * R3-002: that degradation must not be SILENT. `console.warn`, bracket-tagged
+ * `[getShopCollection]` — the same convention `@reblu/site-next` already uses
+ * elsewhere (`route-handlers.ts`'s `[createProxyRoute]`,
+ * `set-password.tsx`'s `[SetPassword]`) — fires once per failed call, and the
+ * returned `facetsStatus: 'unavailable'` lets a caller that wants to act on
+ * it (retry, surface a banner, alert) do so without parsing a log line.
+ */
+declare function getShopCollection(client: RebluClient, params?: ShopProductsParams): Promise<ShopCollection>;
+
+export { type ShopFilterHrefs as S, type ShopCollection as a, buildShopFilterHrefs as b, getShopCollection as g, parseShopSearchParams as p, serializeShopParams as s, toURLSearchParams as t };

package/dist/collection-BE5dhf-r.d.ts

@@ -0,0 +1,106 @@
+import { ShopProductsParams, ListResult, RebluClient } from '@reblu/site-client';
+import { ShopProductListItem, ShopFacets } from '@reblu/site-contracts';
+
+/**
+ * Parse a `URLSearchParams` (or anything with that shape — `ReadonlyURLSearchParams`
+ * from `next/navigation`, or a plain `new URLSearchParams(record)`) into
+ * `ShopProductsParams`. Hostile/unknown params are dropped: only the known
+ * scalar keys and the two bracket groups are ever read.
+ */
+declare function parseShopSearchParams(searchParams: URLSearchParams): ShopProductsParams;
+/**
+ * Serialize `ShopProductsParams` into a `URLSearchParams` — the inverse of
+ * {@link parseShopSearchParams}. Falsy/empty/undefined fields are omitted, so
+ * `parseShopSearchParams(serializeShopParams(params))` round-trips to `params`
+ * for any already-canonical (non-empty-string, in-range) input — that is the
+ * property the round-trip tests pin.
+ */
+declare function serializeShopParams(params: ShopProductsParams): URLSearchParams;
+/**
+ * Convert Next's `searchParams` route prop —
+ * `Record<string, string | string[] | undefined>`, already URL-decoded, with
+ * a repeated query key grouped into an array — into a `URLSearchParams` for
+ * {@link parseShopSearchParams}.
+ *
+ * NOT the same as `new URLSearchParams(searchParams)`: the native
+ * `URLSearchParams` constructor only accepts `Record<string, string>` —
+ * handed an array value (`{ 'attr[color]': ['red', 'blue'] }`), it calls
+ * `String()` on it, producing ONE entry `attr[color]=red,blue` instead of two
+ * repeated `attr[color]=red` / `attr[color]=blue` entries. That silently
+ * breaks `parseShopSearchParams`'s repeat-count-based array/scalar
+ * distinction (see its own module doc) for every multi-value `attr[<key>]`
+ * filter — this helper is what actually preserves the repeat.
+ */
+declare function toURLSearchParams(searchParams: Record<string, string | string[] | undefined>): URLSearchParams;
+/**
+ * The navigation seam `@reblu/site-blocks`'s `ShopFilters` calls `hrefs` — kept
+ * structurally identical to its `ShopFiltersHrefs` type WITHOUT a package
+ * dependency on `@reblu/site-blocks` (this package has none today, and this
+ * one shape does not warrant adding one). Any object matching this shape is
+ * assignable to `ShopFiltersHrefs` by structural typing.
+ */
+interface ShopFilterHrefs {
+    taxonomy: (axisKey: string, value: string | undefined) => string;
+    attr: (fieldKey: string, value: string) => string;
+    price: (min: number | undefined, max: number | undefined) => string;
+    onSale: (nextActive: boolean) => string;
+    clearAll: () => string;
+}
+/**
+ * Build `ShopFilters`' href set from the CURRENT params and pathname. Every
+ * href preserves every OTHER current param (category, q, sort, every other
+ * taxonomy/attr filter) and resets pagination (`page`) — a filter change is
+ * never silently stuck on page 4 of a now-smaller result set.
+ *
+ * Pure and framework-agnostic (no `next/navigation`): a Server Component calls
+ * it directly with its own `searchParams` prop and route pathname — no
+ * `'use client'` boundary required. See `./use-shop-filter-links` for the
+ * client-side hook that wraps this with `usePathname`/`useSearchParams`.
+ */
+declare function buildShopFilterHrefs(current: ShopProductsParams, pathname: string): ShopFilterHrefs;
+
+/**
+ * `getShopCollection` (REB-809) — fetches the product list AND its facets with
+ * the EXACT SAME params in one call. This is the seam that keeps a shop
+ * collection page correct: facet counts must reflect the same filter context
+ * the product list is showing, and a hand-rolled page that calls
+ * `client.shop.products(params)` and `client.shop.facets(someOtherParams)`
+ * separately is exactly how they drift apart.
+ *
+ * Server-safe (no `'use client'`, no React) — call it directly from an async
+ * Server Component (route `page.tsx`) with the params parsed via
+ * {@link parseShopSearchParams} from that page's `searchParams` prop.
+ */
+interface ShopCollection {
+    products: ListResult<ShopProductListItem>;
+    facets: ShopFacets;
+    /**
+     * R3-002: `'ok'` when `client.shop.facets(...)` actually succeeded;
+     * `'unavailable'` when it failed and `facets` above is the degraded
+     * {@link EMPTY_FACETS} fallback. NOT silent — check this before treating an
+     * empty `facets` as "this tenant configured no filterable axes" when it may
+     * really mean "the facets endpoint is down right now". A logged
+     * `console.warn` (see below) covers the case nobody checks this field.
+     */
+    facetsStatus: 'ok' | 'unavailable';
+}
+/**
+ * R4-facets-failure-takes-down-listing: `products` and `facets` are NOT
+ * equally critical. A product listing with no products is not a listing —
+ * that failure must propagate so the caller's own error handling (or a
+ * thrown-away `try/catch` degrading the whole page) sees it. A product
+ * listing with no FACETS is still a perfectly good listing, just without
+ * filter UI — degrading `facets` to {@link EMPTY_FACETS} on failure, instead
+ * of letting one upstream endpoint's outage take the other down too, is what
+ * `Promise.allSettled` (rather than `Promise.all`) buys here.
+ *
+ * R3-002: that degradation must not be SILENT. `console.warn`, bracket-tagged
+ * `[getShopCollection]` — the same convention `@reblu/site-next` already uses
+ * elsewhere (`route-handlers.ts`'s `[createProxyRoute]`,
+ * `set-password.tsx`'s `[SetPassword]`) — fires once per failed call, and the
+ * returned `facetsStatus: 'unavailable'` lets a caller that wants to act on
+ * it (retry, surface a banner, alert) do so without parsing a log line.
+ */
+declare function getShopCollection(client: RebluClient, params?: ShopProductsParams): Promise<ShopCollection>;
+
+export { type ShopFilterHrefs as S, type ShopCollection as a, buildShopFilterHrefs as b, getShopCollection as g, parseShopSearchParams as p, serializeShopParams as s, toURLSearchParams as t };

package/dist/shop-route-handlers.cjs

@@ -0,0 +1,140 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/shop/route-handlers.ts
+var route_handlers_exports = {};
+__export(route_handlers_exports, {
+  createShopApplyDiscountRoute: () => createShopApplyDiscountRoute,
+  createShopCheckEmailRoute: () => createShopCheckEmailRoute,
+  createShopCheckoutRoute: () => createShopCheckoutRoute,
+  createShopOrderRoute: () => createShopOrderRoute,
+  createShopValidateCartRoute: () => createShopValidateCartRoute
+});
+module.exports = __toCommonJS(route_handlers_exports);
+
+// src/route-handlers.ts
+function jsonErrorResponse(status, error, message) {
+  return new Response(
+    JSON.stringify({ error, message, correlation_id: crypto.randomUUID() }),
+    { status, headers: { "Content-Type": "application/json; charset=utf-8" } }
+  );
+}
+function createProxyRoute(targetPath, opts = {}) {
+  const {
+    method = "POST",
+    forwardSetCookie = false,
+    requireJson = false,
+    invalidRequestMessage = "Solicitud no v\xE1lida",
+    timeoutMs = 8e3,
+    configurationErrorMessage = "Error de configuraci\xF3n del servidor.",
+    timeoutMessage = "La solicitud ha superado el tiempo de espera.",
+    proxyErrorMessage = "Error de conexi\xF3n con el servidor."
+  } = opts;
+  return async function handler(request) {
+    if (requireJson) {
+      const contentType = request.headers.get("content-type") ?? "";
+      if (!contentType.includes("application/json")) {
+        return jsonErrorResponse(400, "invalid_request", invalidRequestMessage);
+      }
+    }
+    const baseUrl = opts.baseUrl ?? process.env.REBLU_API_BASE_URL ?? "";
+    const apiKey = opts.apiKey ?? process.env.REBLU_API_KEY ?? "";
+    if (!baseUrl || !apiKey) {
+      console.error(
+        `[createProxyRoute] Missing configuration for ${targetPath}: ` + `${!baseUrl ? "baseUrl/REBLU_API_BASE_URL " : ""}${!apiKey ? "apiKey/REBLU_API_KEY" : ""}`.trim()
+      );
+      return jsonErrorResponse(500, "missing_configuration", configurationErrorMessage);
+    }
+    const forwardedHeaders = {};
+    const ua = request.headers.get("user-agent");
+    if (ua) forwardedHeaders["user-agent"] = ua;
+    const xff = request.headers.get("x-forwarded-for");
+    if (xff) forwardedHeaders["x-forwarded-for"] = xff;
+    const xri = request.headers.get("x-real-ip");
+    if (xri) forwardedHeaders["x-real-ip"] = xri;
+    const upperMethod = method.toUpperCase();
+    const body = upperMethod === "GET" || upperMethod === "HEAD" ? void 0 : await request.text();
+    const search = request.nextUrl?.search ?? "";
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetch(`${baseUrl}${targetPath}${search}`, {
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          "X-Reblu-Api-Key": apiKey,
+          ...forwardedHeaders
+        },
+        ...body ? { body } : {},
+        cache: "no-store",
+        signal: controller.signal
+      });
+      const data = await res.text();
+      const responseHeaders = new Headers({
+        "Content-Type": res.headers.get("Content-Type") ?? "application/json"
+      });
+      if (forwardSetCookie) {
+        for (const cookie of res.headers.getSetCookie()) {
+          responseHeaders.append("set-cookie", cookie);
+        }
+      }
+      return new Response(data, { status: res.status, headers: responseHeaders });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        console.error(`[createProxyRoute] Timed out forwarding to ${targetPath} after ${timeoutMs}ms`);
+        return jsonErrorResponse(502, "upstream_timeout", timeoutMessage);
+      }
+      console.error(`[createProxyRoute] Error forwarding to ${targetPath}:`, err);
+      return jsonErrorResponse(502, "proxy_error", proxyErrorMessage);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+
+// src/shop/route-handlers.ts
+var DEFAULT_WRITE_OPTS = { requireJson: true };
+function createShopCheckoutRoute(opts = {}) {
+  return createProxyRoute("/api/site/shop/checkout", { ...DEFAULT_WRITE_OPTS, ...opts });
+}
+function createShopValidateCartRoute(opts = {}) {
+  return createProxyRoute("/api/site/shop/validate-cart", { ...DEFAULT_WRITE_OPTS, ...opts });
+}
+function createShopApplyDiscountRoute(opts = {}) {
+  return createProxyRoute("/api/site/shop/apply-discount", { ...DEFAULT_WRITE_OPTS, ...opts });
+}
+function createShopCheckEmailRoute(opts = {}) {
+  return createProxyRoute("/api/site/shop/check-email", { ...DEFAULT_WRITE_OPTS, ...opts });
+}
+function createShopOrderRoute(opts = {}) {
+  return async function handler(request, context) {
+    const { sessionId } = await context.params;
+    const targetPath = `/api/site/shop/order/${encodeURIComponent(sessionId)}`;
+    return createProxyRoute(targetPath, { ...opts, method: "GET" })(request);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createShopApplyDiscountRoute,
+  createShopCheckEmailRoute,
+  createShopCheckoutRoute,
+  createShopOrderRoute,
+  createShopValidateCartRoute
+});
+//# sourceMappingURL=shop-route-handlers.cjs.map

package/dist/shop-route-handlers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shop/route-handlers.ts","../src/route-handlers.ts"],"sourcesContent":["/**\n * `@reblu/site-next/shop-route-handlers` (REB-829) — Route Handler factories\n * for the cart/checkout write flow (`/api/site/shop/{checkout, validate-cart,\n * apply-discount, check-email, order/[sessionId]}`). Every demo-site route\n * these replace (`app/api/shop/*`) either hand-rolled the SAME proxy\n * boilerplate `./route-handlers`'s `createProxyRoute` already generalizes\n * (checkout/validate-cart/apply-discount/check-email), or called\n * `proxyToBaseApi` directly for the one dynamic-path route (`order/\n * [sessionId]`) that `createProxyRoute` deliberately does not cover (its own\n * docblock: \"a per-request DYNAMIC targetPath... is genuinely out of scope\").\n * This module is the dynamic-path extension `createProxyRoute` named as a\n * gap, kept as its own file (not folded into `./server`, REB-809's filters/\n * collection glue) because it is a distinct concern — a page that only reads\n * shop data never needs these factories, and a cart/checkout integration\n * never needs the filters glue.\n *\n * Server-only, dependency-free (only `createProxyRoute` + the `next/server`\n * type) — same isolation direction as `./route-handlers`/`./shop/server.ts`:\n * this entry must NEVER carry `'use client'` (see `tsup.config.ts`).\n *\n * Mirrors `createProxyRoute`'s own API-key/server-only handling verbatim —\n * `REBLU_API_KEY` is read lazily, server-side, and injected as\n * `X-Reblu-Api-Key` on the upstream fetch only; it never reaches the\n * Response these handlers return to the browser.\n *\n *   // app/api/shop/checkout/route.ts\n *   export const POST = createShopCheckoutRoute()\n *\n *   // app/api/shop/order/[sessionId]/route.ts\n *   export const GET = createShopOrderRoute()\n */\nimport type { NextRequest } from 'next/server'\nimport { createProxyRoute, type CreateProxyRouteOptions } from '../route-handlers'\n\n/** Options for a fixed-path write route. `method` is always `'POST'` here. */\nexport type ShopWriteRouteOptions = Omit<CreateProxyRouteOptions, 'method'>\n\n/**\n * `requireJson: true` by default for every write route below: the browser\n * clients these proxy for (the cart/checkout UI) always set\n * `Content-Type: application/json`, and rejecting anything else with a 400\n * BEFORE the upstream fetch is strictly safer than forwarding an\n * unparseable body to base-api. A SITE with a non-JSON caller can still pass\n * `{ requireJson: false }`.\n */\nconst DEFAULT_WRITE_OPTS: ShopWriteRouteOptions = { requireJson: true }\n\n/** `POST /api/site/shop/checkout` — starts a hosted Stripe Checkout session. */\nexport function createShopCheckoutRoute(opts: ShopWriteRouteOptions = {}) {\n  return createProxyRoute('/api/site/shop/checkout', { ...DEFAULT_WRITE_OPTS, ...opts })\n}\n\n/** `POST /api/site/shop/validate-cart` — live stock/price re-check before checkout. */\nexport function createShopValidateCartRoute(opts: ShopWriteRouteOptions = {}) {\n  return createProxyRoute('/api/site/shop/validate-cart', { ...DEFAULT_WRITE_OPTS, ...opts })\n}\n\n/** `POST /api/site/shop/apply-discount` — validates a discount code against the cart. */\nexport function createShopApplyDiscountRoute(opts: ShopWriteRouteOptions = {}) {\n  return createProxyRoute('/api/site/shop/apply-discount', { ...DEFAULT_WRITE_OPTS, ...opts })\n}\n\n/** `POST /api/site/shop/check-email` — whether a guest's email already has an account. */\nexport function createShopCheckEmailRoute(opts: ShopWriteRouteOptions = {}) {\n  return createProxyRoute('/api/site/shop/check-email', { ...DEFAULT_WRITE_OPTS, ...opts })\n}\n\n/** Options for the dynamic order-lookup route. `method` is always `'GET'`. */\nexport type ShopOrderRouteOptions = Omit<CreateProxyRouteOptions, 'method'>\n\n/**\n * `GET /api/site/shop/order/[sessionId]` — the one route in this file with a\n * per-request dynamic target path, so it can't be a one-line\n * `createProxyRoute(...)` call like the others: it reads Next's route\n * `params`, builds `/api/site/shop/order/{sessionId}` per request, and\n * delegates everything else (env, timeout, forwarding, error shaping) to\n * `createProxyRoute`.\n */\nexport function createShopOrderRoute(opts: ShopOrderRouteOptions = {}) {\n  return async function handler(\n    request: NextRequest,\n    context: { params: Promise<{ sessionId: string }> },\n  ): Promise<Response> {\n    const { sessionId } = await context.params\n    const targetPath = `/api/site/shop/order/${encodeURIComponent(sessionId)}`\n    return createProxyRoute(targetPath, { ...opts, method: 'GET' })(request)\n  }\n}\n","/**\n * `@reblu/site-next/route-handlers` — server-only, dependency-free Route\n * Handler factory (REB-510 / design doc \"site-auth-package\").\n *\n * This module MUST stay dependency-free (no `@reblu/site-ui`, no React): it is\n * imported directly by `app/api/*` Route Handler files, and its own tsup entry\n * carries NO `'use client'` directive (mirrors the `cache` subpath's R4\n * precedent for the opposite direction — see `tsup.config.ts`).\n *\n * Scope: this factory covers the `/api/site/auth/*` proxy shape specifically\n * (fixed target path, JSON body passthrough, optional `Set-Cookie` forward) —\n * the same shape as every one of demo-site's 8 auth Route Handlers. It is\n * modeled on `apps/demo-site/src/lib/api/proxy.ts` (`proxyToBaseApi`) but is\n * NOT a drop-in replacement for every one of that helper's call sites: it\n * does not support a per-request DYNAMIC `targetPath` (e.g.\n * `api/shop/order/[sessionId]/route.ts`'s `` `/api/site/shop/order/${id}` ``)\n * or an arbitrary extra-`headers` passthrough — both are genuinely out of\n * scope for REB-510 (auth only). demo-site's non-auth proxy routes keep using\n * `proxyToBaseApi` directly; only the 8 auth routes are candidates to adopt\n * this factory.\n *\n *   export const POST = createProxyRoute('/api/site/auth/login')\n *\n * Deliberate behavior change vs the original (R6): `proxy.ts` reads\n * `REBLU_API_BASE_URL`/`REBLU_API_KEY` at MODULE LOAD. This factory reads them\n * LAZILY, inside the returned handler, on every request — `opts.baseUrl` /\n * `opts.apiKey` still take priority when provided.\n *\n * Why this factory reads `process.env` at all, unlike `@reblu/site-client`\n * (whose own docblock states \"the SDK never reads `process.env` itself\"):\n * `site-client` is instantiated ONCE by the consuming SITE, which already\n * owns and injects its env at that single call site. `createProxyRoute` is\n * the opposite shape on purpose — a ZERO-CONFIG one-liner meant to be called\n * once per Route Handler FILE (8+ files in a typical SITE), so requiring\n * every file to re-thread `baseUrl`/`apiKey` would defeat the \"one line\"\n * value proposition documented in the README. The env fallback is this\n * factory's deliberate ergonomic default; `opts.baseUrl`/`opts.apiKey` remain\n * available for a SITE that wants explicit, non-`process.env` control.\n *\n * Trust note on header forwarding: `X-Forwarded-For`/`X-Real-IP` are copied\n * from the incoming request VERBATIM (same as the original `proxy.ts`). On\n * Vercel the platform itself sets/overwrites these ahead of the Route\n * Handler, so they're trustworthy there — but this is a distributable SDK a\n * SITE can deploy anywhere. On a host where nothing strips inbound spoofed\n * values, a client can forge the IP base-api rate-limits on. Deploy this\n * factory only behind a platform that normalizes/overwrites these headers,\n * or in front of infra that strips client-supplied ones.\n */\nimport type { NextRequest } from 'next/server'\n\nexport interface CreateProxyRouteOptions {\n  /** Overrides `REBLU_API_BASE_URL`. Read lazily per-request when omitted. */\n  baseUrl?: string\n  /** Overrides `REBLU_API_KEY`. Read lazily per-request when omitted. */\n  apiKey?: string\n  /** @default 'POST' */\n  method?: string\n  /** Forward upstream `Set-Cookie` headers to the browser. @default false */\n  forwardSetCookie?: boolean\n  /**\n   * Reject non-`application/json` requests with a Spanish 400 before ever\n   * reaching the network — mirrors `magic-link-exchange/route.ts`'s guard.\n   * @default false\n   */\n  requireJson?: boolean\n  /**\n   * Overrides the Spanish `message` field of the `requireJson` 400 body, for\n   * a non-Spanish-default SITE. The `error` code (`invalid_request`) and\n   * shape stay fixed — only the human-facing text is overridable.\n   * @default 'Solicitud no válida'\n   */\n  invalidRequestMessage?: string\n  /**\n   * Hard timeout (ms) for the upstream fetch, enforced via `AbortController`\n   * — mirrors `@reblu/site-client`'s own `timeoutMs` (default `8000`, same\n   * value). Without this, a hung base-api response would hang the SITE's\n   * Route Handler indefinitely instead of degrading.\n   * @default 8000\n   */\n  timeoutMs?: number\n  /**\n   * Overrides the `message` field of the 500 body returned when neither\n   * `opts.baseUrl`/`opts.apiKey` nor `REBLU_API_BASE_URL`/`REBLU_API_KEY`\n   * resolve to a non-empty value.\n   * @default 'Error de configuración del servidor.'\n   */\n  configurationErrorMessage?: string\n  /**\n   * Overrides the `message` field of the 502 body returned when the\n   * upstream fetch times out.\n   * @default 'La solicitud ha superado el tiempo de espera.'\n   */\n  timeoutMessage?: string\n  /**\n   * Overrides the `message` field of the 502 body returned when the\n   * upstream fetch fails for any other reason (DNS, connection refused,\n   * etc.).\n   * @default 'Error de conexión con el servidor.'\n   */\n  proxyErrorMessage?: string\n}\n\nfunction jsonErrorResponse(status: number, error: string, message: string): Response {\n  return new Response(\n    JSON.stringify({ error, message, correlation_id: crypto.randomUUID() }),\n    { status, headers: { 'Content-Type': 'application/json; charset=utf-8' } },\n  )\n}\n\n/**\n * Creates a Next.js Route Handler that proxies `request` to\n * `${baseUrl}${targetPath}` at base-api, injecting the `X-Reblu-Api-Key`\n * server-side so it never reaches the browser.\n */\nexport function createProxyRoute(targetPath: string, opts: CreateProxyRouteOptions = {}) {\n  const {\n    method = 'POST',\n    forwardSetCookie = false,\n    requireJson = false,\n    invalidRequestMessage = 'Solicitud no válida',\n    timeoutMs = 8000,\n    configurationErrorMessage = 'Error de configuración del servidor.',\n    timeoutMessage = 'La solicitud ha superado el tiempo de espera.',\n    proxyErrorMessage = 'Error de conexión con el servidor.',\n  } = opts\n\n  return async function handler(request: NextRequest): Promise<Response> {\n    if (requireJson) {\n      const contentType = request.headers.get('content-type') ?? ''\n      if (!contentType.includes('application/json')) {\n        return jsonErrorResponse(400, 'invalid_request', invalidRequestMessage)\n      }\n    }\n\n    // Lazy, per-request env read (R6) — opts win when provided.\n    const baseUrl = opts.baseUrl ?? process.env.REBLU_API_BASE_URL ?? ''\n    const apiKey = opts.apiKey ?? process.env.REBLU_API_KEY ?? ''\n\n    if (!baseUrl || !apiKey) {\n      console.error(\n        `[createProxyRoute] Missing configuration for ${targetPath}: ` +\n          `${!baseUrl ? 'baseUrl/REBLU_API_BASE_URL ' : ''}${!apiKey ? 'apiKey/REBLU_API_KEY' : ''}`.trim(),\n      )\n      return jsonErrorResponse(500, 'missing_configuration', configurationErrorMessage)\n    }\n\n    const forwardedHeaders: Record<string, string> = {}\n    const ua = request.headers.get('user-agent')\n    if (ua) forwardedHeaders['user-agent'] = ua\n    const xff = request.headers.get('x-forwarded-for')\n    if (xff) forwardedHeaders['x-forwarded-for'] = xff\n    const xri = request.headers.get('x-real-ip')\n    if (xri) forwardedHeaders['x-real-ip'] = xri\n\n    const upperMethod = method.toUpperCase()\n    const body =\n      upperMethod === 'GET' || upperMethod === 'HEAD' ? undefined : await request.text()\n    // Forward the original query string (e.g. `?slug=x`) regardless of\n    // method — `targetPath` is fixed at factory-call time, so without this a\n    // GET route configured via `{ method: 'GET' }` would silently drop it.\n    const search = request.nextUrl?.search ?? ''\n\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n\n    try {\n      const res = await fetch(`${baseUrl}${targetPath}${search}`, {\n        method,\n        headers: {\n          'Content-Type': 'application/json',\n          'X-Reblu-Api-Key': apiKey,\n          ...forwardedHeaders,\n        },\n        ...(body ? { body } : {}),\n        cache: 'no-store',\n        signal: controller.signal,\n      })\n\n      const data = await res.text()\n      const responseHeaders = new Headers({\n        'Content-Type': res.headers.get('Content-Type') ?? 'application/json',\n      })\n\n      if (forwardSetCookie) {\n        for (const cookie of res.headers.getSetCookie()) {\n          responseHeaders.append('set-cookie', cookie)\n        }\n      }\n\n      return new Response(data, { status: res.status, headers: responseHeaders })\n    } catch (err) {\n      if (err instanceof Error && err.name === 'AbortError') {\n        console.error(`[createProxyRoute] Timed out forwarding to ${targetPath} after ${timeoutMs}ms`)\n        return jsonErrorResponse(502, 'upstream_timeout', timeoutMessage)\n      }\n      console.error(`[createProxyRoute] Error forwarding to ${targetPath}:`, err)\n      return jsonErrorResponse(502, 'proxy_error', proxyErrorMessage)\n    } finally {\n      clearTimeout(timer)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACsGA,SAAS,kBAAkB,QAAgB,OAAe,SAA2B;AACnF,SAAO,IAAI;AAAA,IACT,KAAK,UAAU,EAAE,OAAO,SAAS,gBAAgB,OAAO,WAAW,EAAE,CAAC;AAAA,IACtE,EAAE,QAAQ,SAAS,EAAE,gBAAgB,kCAAkC,EAAE;AAAA,EAC3E;AACF;AAOO,SAAS,iBAAiB,YAAoB,OAAgC,CAAC,GAAG;AACvF,QAAM;AAAA,IACJ,SAAS;AAAA,IACT,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,wBAAwB;AAAA,IACxB,YAAY;AAAA,IACZ,4BAA4B;AAAA,IAC5B,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,EACtB,IAAI;AAEJ,SAAO,eAAe,QAAQ,SAAyC;AACrE,QAAI,aAAa;AACf,YAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,UAAI,CAAC,YAAY,SAAS,kBAAkB,GAAG;AAC7C,eAAO,kBAAkB,KAAK,mBAAmB,qBAAqB;AAAA,MACxE;AAAA,IACF;AAGA,UAAM,UAAU,KAAK,WAAW,QAAQ,IAAI,sBAAsB;AAClE,UAAM,SAAS,KAAK,UAAU,QAAQ,IAAI,iBAAiB;AAE3D,QAAI,CAAC,WAAW,CAAC,QAAQ;AACvB,cAAQ;AAAA,QACN,gDAAgD,UAAU,OACxD,GAAG,CAAC,UAAU,gCAAgC,EAAE,GAAG,CAAC,SAAS,yBAAyB,EAAE,GAAG,KAAK;AAAA,MACpG;AACA,aAAO,kBAAkB,KAAK,yBAAyB,yBAAyB;AAAA,IAClF;AAEA,UAAM,mBAA2C,CAAC;AAClD,UAAM,KAAK,QAAQ,QAAQ,IAAI,YAAY;AAC3C,QAAI,GAAI,kBAAiB,YAAY,IAAI;AACzC,UAAM,MAAM,QAAQ,QAAQ,IAAI,iBAAiB;AACjD,QAAI,IAAK,kBAAiB,iBAAiB,IAAI;AAC/C,UAAM,MAAM,QAAQ,QAAQ,IAAI,WAAW;AAC3C,QAAI,IAAK,kBAAiB,WAAW,IAAI;AAEzC,UAAM,cAAc,OAAO,YAAY;AACvC,UAAM,OACJ,gBAAgB,SAAS,gBAAgB,SAAS,SAAY,MAAM,QAAQ,KAAK;AAInF,UAAM,SAAS,QAAQ,SAAS,UAAU;AAE1C,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAE5D,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,IAAI;AAAA,QAC1D;AAAA,QACA,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,mBAAmB;AAAA,UACnB,GAAG;AAAA,QACL;AAAA,QACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACvB,OAAO;AAAA,QACP,QAAQ,WAAW;AAAA,MACrB,CAAC;AAED,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,kBAAkB,IAAI,QAAQ;AAAA,QAClC,gBAAgB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACrD,CAAC;AAED,UAAI,kBAAkB;AACpB,mBAAW,UAAU,IAAI,QAAQ,aAAa,GAAG;AAC/C,0BAAgB,OAAO,cAAc,MAAM;AAAA,QAC7C;AAAA,MACF;AAEA,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,QAAQ,SAAS,gBAAgB,CAAC;AAAA,IAC5E,SAAS,KAAK;AACZ,UAAI,eAAe,SAAS,IAAI,SAAS,cAAc;AACrD,gBAAQ,MAAM,8CAA8C,UAAU,UAAU,SAAS,IAAI;AAC7F,eAAO,kBAAkB,KAAK,oBAAoB,cAAc;AAAA,MAClE;AACA,cAAQ,MAAM,0CAA0C,UAAU,KAAK,GAAG;AAC1E,aAAO,kBAAkB,KAAK,eAAe,iBAAiB;AAAA,IAChE,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AACF;;;AD5JA,IAAM,qBAA4C,EAAE,aAAa,KAAK;AAG/D,SAAS,wBAAwB,OAA8B,CAAC,GAAG;AACxE,SAAO,iBAAiB,2BAA2B,EAAE,GAAG,oBAAoB,GAAG,KAAK,CAAC;AACvF;AAGO,SAAS,4BAA4B,OAA8B,CAAC,GAAG;AAC5E,SAAO,iBAAiB,gCAAgC,EAAE,GAAG,oBAAoB,GAAG,KAAK,CAAC;AAC5F;AAGO,SAAS,6BAA6B,OAA8B,CAAC,GAAG;AAC7E,SAAO,iBAAiB,iCAAiC,EAAE,GAAG,oBAAoB,GAAG,KAAK,CAAC;AAC7F;AAGO,SAAS,0BAA0B,OAA8B,CAAC,GAAG;AAC1E,SAAO,iBAAiB,8BAA8B,EAAE,GAAG,oBAAoB,GAAG,KAAK,CAAC;AAC1F;AAaO,SAAS,qBAAqB,OAA8B,CAAC,GAAG;AACrE,SAAO,eAAe,QACpB,SACA,SACmB;AACnB,UAAM,EAAE,UAAU,IAAI,MAAM,QAAQ;AACpC,UAAM,aAAa,wBAAwB,mBAAmB,SAAS,CAAC;AACxE,WAAO,iBAAiB,YAAY,EAAE,GAAG,MAAM,QAAQ,MAAM,CAAC,EAAE,OAAO;AAAA,EACzE;AACF;","names":[]}

package/dist/shop-route-handlers.d.cts

@@ -0,0 +1,62 @@
+import { NextRequest } from 'next/server';
+import { CreateProxyRouteOptions } from './route-handlers.cjs';
+
+/**
+ * `@reblu/site-next/shop-route-handlers` (REB-829) — Route Handler factories
+ * for the cart/checkout write flow (`/api/site/shop/{checkout, validate-cart,
+ * apply-discount, check-email, order/[sessionId]}`). Every demo-site route
+ * these replace (`app/api/shop/*`) either hand-rolled the SAME proxy
+ * boilerplate `./route-handlers`'s `createProxyRoute` already generalizes
+ * (checkout/validate-cart/apply-discount/check-email), or called
+ * `proxyToBaseApi` directly for the one dynamic-path route (`order/
+ * [sessionId]`) that `createProxyRoute` deliberately does not cover (its own
+ * docblock: "a per-request DYNAMIC targetPath... is genuinely out of scope").
+ * This module is the dynamic-path extension `createProxyRoute` named as a
+ * gap, kept as its own file (not folded into `./server`, REB-809's filters/
+ * collection glue) because it is a distinct concern — a page that only reads
+ * shop data never needs these factories, and a cart/checkout integration
+ * never needs the filters glue.
+ *
+ * Server-only, dependency-free (only `createProxyRoute` + the `next/server`
+ * type) — same isolation direction as `./route-handlers`/`./shop/server.ts`:
+ * this entry must NEVER carry `'use client'` (see `tsup.config.ts`).
+ *
+ * Mirrors `createProxyRoute`'s own API-key/server-only handling verbatim —
+ * `REBLU_API_KEY` is read lazily, server-side, and injected as
+ * `X-Reblu-Api-Key` on the upstream fetch only; it never reaches the
+ * Response these handlers return to the browser.
+ *
+ *   // app/api/shop/checkout/route.ts
+ *   export const POST = createShopCheckoutRoute()
+ *
+ *   // app/api/shop/order/[sessionId]/route.ts
+ *   export const GET = createShopOrderRoute()
+ */
+
+/** Options for a fixed-path write route. `method` is always `'POST'` here. */
+type ShopWriteRouteOptions = Omit<CreateProxyRouteOptions, 'method'>;
+/** `POST /api/site/shop/checkout` — starts a hosted Stripe Checkout session. */
+declare function createShopCheckoutRoute(opts?: ShopWriteRouteOptions): (request: NextRequest) => Promise<Response>;
+/** `POST /api/site/shop/validate-cart` — live stock/price re-check before checkout. */
+declare function createShopValidateCartRoute(opts?: ShopWriteRouteOptions): (request: NextRequest) => Promise<Response>;
+/** `POST /api/site/shop/apply-discount` — validates a discount code against the cart. */
+declare function createShopApplyDiscountRoute(opts?: ShopWriteRouteOptions): (request: NextRequest) => Promise<Response>;
+/** `POST /api/site/shop/check-email` — whether a guest's email already has an account. */
+declare function createShopCheckEmailRoute(opts?: ShopWriteRouteOptions): (request: NextRequest) => Promise<Response>;
+/** Options for the dynamic order-lookup route. `method` is always `'GET'`. */
+type ShopOrderRouteOptions = Omit<CreateProxyRouteOptions, 'method'>;
+/**
+ * `GET /api/site/shop/order/[sessionId]` — the one route in this file with a
+ * per-request dynamic target path, so it can't be a one-line
+ * `createProxyRoute(...)` call like the others: it reads Next's route
+ * `params`, builds `/api/site/shop/order/{sessionId}` per request, and
+ * delegates everything else (env, timeout, forwarding, error shaping) to
+ * `createProxyRoute`.
+ */
+declare function createShopOrderRoute(opts?: ShopOrderRouteOptions): (request: NextRequest, context: {
+    params: Promise<{
+        sessionId: string;
+    }>;
+}) => Promise<Response>;
+
+export { type ShopOrderRouteOptions, type ShopWriteRouteOptions, createShopApplyDiscountRoute, createShopCheckEmailRoute, createShopCheckoutRoute, createShopOrderRoute, createShopValidateCartRoute };

package/dist/shop-route-handlers.d.ts

@@ -0,0 +1,62 @@
+import { NextRequest } from 'next/server';
+import { CreateProxyRouteOptions } from './route-handlers.js';
+
+/**
+ * `@reblu/site-next/shop-route-handlers` (REB-829) — Route Handler factories
+ * for the cart/checkout write flow (`/api/site/shop/{checkout, validate-cart,
+ * apply-discount, check-email, order/[sessionId]}`). Every demo-site route
+ * these replace (`app/api/shop/*`) either hand-rolled the SAME proxy
+ * boilerplate `./route-handlers`'s `createProxyRoute` already generalizes
+ * (checkout/validate-cart/apply-discount/check-email), or called
+ * `proxyToBaseApi` directly for the one dynamic-path route (`order/
+ * [sessionId]`) that `createProxyRoute` deliberately does not cover (its own
+ * docblock: "a per-request DYNAMIC targetPath... is genuinely out of scope").
+ * This module is the dynamic-path extension `createProxyRoute` named as a
+ * gap, kept as its own file (not folded into `./server`, REB-809's filters/
+ * collection glue) because it is a distinct concern — a page that only reads
+ * shop data never needs these factories, and a cart/checkout integration
+ * never needs the filters glue.
+ *
+ * Server-only, dependency-free (only `createProxyRoute` + the `next/server`
+ * type) — same isolation direction as `./route-handlers`/`./shop/server.ts`:
+ * this entry must NEVER carry `'use client'` (see `tsup.config.ts`).
+ *
+ * Mirrors `createProxyRoute`'s own API-key/server-only handling verbatim —
+ * `REBLU_API_KEY` is read lazily, server-side, and injected as
+ * `X-Reblu-Api-Key` on the upstream fetch only; it never reaches the
+ * Response these handlers return to the browser.
+ *
+ *   // app/api/shop/checkout/route.ts
+ *   export const POST = createShopCheckoutRoute()
+ *
+ *   // app/api/shop/order/[sessionId]/route.ts
+ *   export const GET = createShopOrderRoute()
+ */
+
+/** Options for a fixed-path write route. `method` is always `'POST'` here. */
+type ShopWriteRouteOptions = Omit<CreateProxyRouteOptions, 'method'>;
+/** `POST /api/site/shop/checkout` — starts a hosted Stripe Checkout session. */
+declare function createShopCheckoutRoute(opts?: ShopWriteRouteOptions): (request: NextRequest) => Promise<Response>;
+/** `POST /api/site/shop/validate-cart` — live stock/price re-check before checkout. */
+declare function createShopValidateCartRoute(opts?: ShopWriteRouteOptions): (request: NextRequest) => Promise<Response>;
+/** `POST /api/site/shop/apply-discount` — validates a discount code against the cart. */
+declare function createShopApplyDiscountRoute(opts?: ShopWriteRouteOptions): (request: NextRequest) => Promise<Response>;
+/** `POST /api/site/shop/check-email` — whether a guest's email already has an account. */
+declare function createShopCheckEmailRoute(opts?: ShopWriteRouteOptions): (request: NextRequest) => Promise<Response>;
+/** Options for the dynamic order-lookup route. `method` is always `'GET'`. */
+type ShopOrderRouteOptions = Omit<CreateProxyRouteOptions, 'method'>;
+/**
+ * `GET /api/site/shop/order/[sessionId]` — the one route in this file with a
+ * per-request dynamic target path, so it can't be a one-line
+ * `createProxyRoute(...)` call like the others: it reads Next's route
+ * `params`, builds `/api/site/shop/order/{sessionId}` per request, and
+ * delegates everything else (env, timeout, forwarding, error shaping) to
+ * `createProxyRoute`.
+ */
+declare function createShopOrderRoute(opts?: ShopOrderRouteOptions): (request: NextRequest, context: {
+    params: Promise<{
+        sessionId: string;
+    }>;
+}) => Promise<Response>;
+
+export { type ShopOrderRouteOptions, type ShopWriteRouteOptions, createShopApplyDiscountRoute, createShopCheckEmailRoute, createShopCheckoutRoute, createShopOrderRoute, createShopValidateCartRoute };

package/dist/shop-route-handlers.js

@@ -0,0 +1,109 @@
+// src/route-handlers.ts
+function jsonErrorResponse(status, error, message) {
+  return new Response(
+    JSON.stringify({ error, message, correlation_id: crypto.randomUUID() }),
+    { status, headers: { "Content-Type": "application/json; charset=utf-8" } }
+  );
+}
+function createProxyRoute(targetPath, opts = {}) {
+  const {
+    method = "POST",
+    forwardSetCookie = false,
+    requireJson = false,
+    invalidRequestMessage = "Solicitud no v\xE1lida",
+    timeoutMs = 8e3,
+    configurationErrorMessage = "Error de configuraci\xF3n del servidor.",
+    timeoutMessage = "La solicitud ha superado el tiempo de espera.",
+    proxyErrorMessage = "Error de conexi\xF3n con el servidor."
+  } = opts;
+  return async function handler(request) {
+    if (requireJson) {
+      const contentType = request.headers.get("content-type") ?? "";
+      if (!contentType.includes("application/json")) {
+        return jsonErrorResponse(400, "invalid_request", invalidRequestMessage);
+      }
+    }
+    const baseUrl = opts.baseUrl ?? process.env.REBLU_API_BASE_URL ?? "";
+    const apiKey = opts.apiKey ?? process.env.REBLU_API_KEY ?? "";
+    if (!baseUrl || !apiKey) {
+      console.error(
+        `[createProxyRoute] Missing configuration for ${targetPath}: ` + `${!baseUrl ? "baseUrl/REBLU_API_BASE_URL " : ""}${!apiKey ? "apiKey/REBLU_API_KEY" : ""}`.trim()
+      );
+      return jsonErrorResponse(500, "missing_configuration", configurationErrorMessage);
+    }
+    const forwardedHeaders = {};
+    const ua = request.headers.get("user-agent");
+    if (ua) forwardedHeaders["user-agent"] = ua;
+    const xff = request.headers.get("x-forwarded-for");
+    if (xff) forwardedHeaders["x-forwarded-for"] = xff;
+    const xri = request.headers.get("x-real-ip");
+    if (xri) forwardedHeaders["x-real-ip"] = xri;
+    const upperMethod = method.toUpperCase();
+    const body = upperMethod === "GET" || upperMethod === "HEAD" ? void 0 : await request.text();
+    const search = request.nextUrl?.search ?? "";
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetch(`${baseUrl}${targetPath}${search}`, {
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          "X-Reblu-Api-Key": apiKey,
+          ...forwardedHeaders
+        },
+        ...body ? { body } : {},
+        cache: "no-store",
+        signal: controller.signal
+      });
+      const data = await res.text();
+      const responseHeaders = new Headers({
+        "Content-Type": res.headers.get("Content-Type") ?? "application/json"
+      });
+      if (forwardSetCookie) {
+        for (const cookie of res.headers.getSetCookie()) {
+          responseHeaders.append("set-cookie", cookie);
+        }
+      }
+      return new Response(data, { status: res.status, headers: responseHeaders });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        console.error(`[createProxyRoute] Timed out forwarding to ${targetPath} after ${timeoutMs}ms`);
+        return jsonErrorResponse(502, "upstream_timeout", timeoutMessage);
+      }
+      console.error(`[createProxyRoute] Error forwarding to ${targetPath}:`, err);
+      return jsonErrorResponse(502, "proxy_error", proxyErrorMessage);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+
+// src/shop/route-handlers.ts
+var DEFAULT_WRITE_OPTS = { requireJson: true };
+function createShopCheckoutRoute(opts = {}) {
+  return createProxyRoute("/api/site/shop/checkout", { ...DEFAULT_WRITE_OPTS, ...opts });
+}
+function createShopValidateCartRoute(opts = {}) {
+  return createProxyRoute("/api/site/shop/validate-cart", { ...DEFAULT_WRITE_OPTS, ...opts });
+}
+function createShopApplyDiscountRoute(opts = {}) {
+  return createProxyRoute("/api/site/shop/apply-discount", { ...DEFAULT_WRITE_OPTS, ...opts });
+}
+function createShopCheckEmailRoute(opts = {}) {
+  return createProxyRoute("/api/site/shop/check-email", { ...DEFAULT_WRITE_OPTS, ...opts });
+}
+function createShopOrderRoute(opts = {}) {
+  return async function handler(request, context) {
+    const { sessionId } = await context.params;
+    const targetPath = `/api/site/shop/order/${encodeURIComponent(sessionId)}`;
+    return createProxyRoute(targetPath, { ...opts, method: "GET" })(request);
+  };
+}
+export {
+  createShopApplyDiscountRoute,
+  createShopCheckEmailRoute,
+  createShopCheckoutRoute,
+  createShopOrderRoute,
+  createShopValidateCartRoute
+};
+//# sourceMappingURL=shop-route-handlers.js.map