@rovela-ai/sdk 0.19.4 → 0.19.6

package/templates/store-template/app/api/admin/payment-methods/[id]/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Single Payment Method API Route
+ *
+ * PUT    /api/admin/payment-methods/[id] - Update a method
+ * DELETE /api/admin/payment-methods/[id] - Delete a method (order history keeps its label)
+ */
+
+import { updatePaymentMethodHandler, deletePaymentMethodHandler } from '@rovela-ai/sdk/admin/api'
+
+export { updatePaymentMethodHandler as PUT, deletePaymentMethodHandler as DELETE }

package/templates/store-template/app/api/admin/payment-methods/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Payment Methods API Route
+ *
+ * GET  /api/admin/payment-methods - List all methods
+ * POST /api/admin/payment-methods - Create a manual method
+ */
+
+import { getPaymentMethods, createPaymentMethodHandler } from '@rovela-ai/sdk/admin/api'
+
+export { getPaymentMethods as GET, createPaymentMethodHandler as POST }

package/templates/store-template/app/api/admin/products/[id]/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Single Product API Route
+ *
+ * GET/PUT/DELETE /api/admin/products/[id]
+ */
+
+import { getProduct, updateProduct, deleteProduct } from '@rovela-ai/sdk/admin/api'
+
+export { getProduct as GET, updateProduct as PUT, deleteProduct as DELETE }

package/templates/store-template/app/api/admin/products/bulk/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Products Bulk Action API Route
+ *
+ * POST /api/admin/products/bulk
+ *
+ * Body: { ids: string[], action: 'activate' | 'archive' | 'delete' }
+ */
+
+export { POST } from '@rovela-ai/sdk/admin/api/products-bulk'

package/templates/store-template/app/api/admin/products/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Products API Route
+ *
+ * GET/POST /api/admin/products - List/Create products
+ */
+
+import { getProducts, createProduct } from '@rovela-ai/sdk/admin/api'
+
+export { getProducts as GET, createProduct as POST }

package/templates/store-template/app/api/admin/products/stats/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Products Metrics API Route
+ *
+ * GET /api/admin/products/stats
+ *
+ * Returns: { data: { activeCount, outOfStockCount, bestSeller } }
+ *   - bestSeller is over the last 30 days, by units sold; null when no sales.
+ */
+
+export { GET } from '@rovela-ai/sdk/admin/api/products-stats'

package/templates/store-template/app/api/admin/reset-password/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Reset Password API Route
+ *
+ * Thin re-export of the SDK handler.
+ *
+ * - GET ?token=X  → non-destructive token validation (used by the UI on mount)
+ * - POST { token, password } → consume the token and update the admin's password
+ */
+
+export { GET, POST } from '@rovela-ai/sdk/admin/api/reset-password'

package/templates/store-template/app/api/admin/settings/route.ts

@@ -0,0 +1,11 @@
+/**
+ * Admin Settings API Route
+ *
+ * GET /api/admin/settings - Get store settings (with lazy init from blueprint)
+ * PUT /api/admin/settings - Update store settings
+ */
+
+import { getSettings, updateSettings } from '@rovela-ai/sdk/admin/api'
+
+export const GET = getSettings
+export const PUT = updateSettings

package/templates/store-template/app/api/admin/setup/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Setup API Route
+ *
+ * First-time admin account creation.
+ * Only works when no admins exist for the store.
+ */
+
+import { POST as handler } from '@rovela-ai/sdk/admin/api/setup'
+
+export const POST = handler

package/templates/store-template/app/api/admin/setup-guide/manual-mark/route.ts

@@ -0,0 +1,13 @@
+/**
+ * Admin Setup Guide Manual-Mark API Route
+ *
+ * POST /api/admin/setup-guide/manual-mark
+ *
+ * Body: { key: 'taxNoneNeeded' | 'legalPagesReviewed' | 'firstProductTouched'
+ *              | 'logoUploaded' | 'dismiss' | 'reopen', value: boolean }
+ *
+ * Allowlisted-key writeback to `store_settings.onboarding` JSONB. Auth gate
+ * `settings.write`. See SDK §32.
+ */
+
+export { markSetupTask as POST } from '@rovela-ai/sdk/admin/api'

package/templates/store-template/app/api/admin/setup-guide/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Setup Guide API Route
+ *
+ * GET /api/admin/setup-guide
+ *
+ * Returns the 9 setup-guide tasks + per-tier progress for the dashboard
+ * card. Auth gate `settings.read`. See SDK §32 for the full spec.
+ */
+
+export { getSetupGuide as GET } from '@rovela-ai/sdk/admin/api'

package/templates/store-template/app/api/admin/shipping/carriers/[id]/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Single Shipping Carrier API Route
+ *
+ * GET/PUT/DELETE /api/admin/shipping/carriers/[id]
+ */
+
+import { getShippingCarrier, updateShippingCarrier, deleteShippingCarrier } from '@rovela-ai/sdk/admin/api'
+
+export { getShippingCarrier as GET, updateShippingCarrier as PUT, deleteShippingCarrier as DELETE }

package/templates/store-template/app/api/admin/shipping/carriers/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Shipping Carriers API Route
+ *
+ * GET/POST /api/admin/shipping/carriers - List/Create shipping carriers
+ */
+
+import { getShippingCarriers, createShippingCarrier } from '@rovela-ai/sdk/admin/api'
+
+export { getShippingCarriers as GET, createShippingCarrier as POST }

package/templates/store-template/app/api/admin/shipping/rates/[id]/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Single Shipping Rate API Route
+ *
+ * PUT/DELETE /api/admin/shipping/rates/[id]
+ */
+
+import { updateShippingRate, deleteShippingRate } from '@rovela-ai/sdk/admin/api'
+
+export { updateShippingRate as PUT, deleteShippingRate as DELETE }

package/templates/store-template/app/api/admin/shipping/rates/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Shipping Rates API Route
+ *
+ * POST /api/admin/shipping/rates - Create shipping rate
+ */
+
+import { createShippingRate } from '@rovela-ai/sdk/admin/api'
+
+export { createShippingRate as POST }

package/templates/store-template/app/api/admin/shipping/shippo/api-key/route.ts

@@ -0,0 +1 @@
+export { saveShippoApiKey as POST, deleteShippoApiKey as DELETE } from '@rovela-ai/sdk/admin/api'

package/templates/store-template/app/api/admin/shipping/shippo/validate/route.ts

@@ -0,0 +1 @@
+export { validateShippoApiKey as POST } from '@rovela-ai/sdk/admin/api'

package/templates/store-template/app/api/admin/shipping/zones/[id]/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Single Shipping Zone API Route
+ *
+ * GET/PUT/DELETE /api/admin/shipping/zones/[id]
+ */
+
+import { getShippingZone, updateShippingZone, deleteShippingZone } from '@rovela-ai/sdk/admin/api'
+
+export { getShippingZone as GET, updateShippingZone as PUT, deleteShippingZone as DELETE }

package/templates/store-template/app/api/admin/shipping/zones/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Shipping Zones API Route
+ *
+ * GET/POST /api/admin/shipping/zones - List/Create shipping zones
+ */
+
+import { getShippingZones, createShippingZone } from '@rovela-ai/sdk/admin/api'
+
+export { getShippingZones as GET, createShippingZone as POST }

package/templates/store-template/app/api/admin/stats/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Stats API Route
+ *
+ * GET /api/admin/stats - Dashboard metrics
+ */
+
+import { getStats } from '@rovela-ai/sdk/admin/api'
+
+export { getStats as GET }

package/templates/store-template/app/api/admin/stripe-status/route.ts

@@ -0,0 +1 @@
+export { getStripeStatus as GET } from '@rovela-ai/sdk/admin/api'

package/templates/store-template/app/api/admin/tax-zones/[id]/route.ts

@@ -0,0 +1,7 @@
+/**
+ * Admin Single Tax Zone API Route
+ *
+ * GET/PUT/DELETE /api/admin/tax-zones/[id]
+ */
+
+export { getTaxZone as GET, updateTaxZone as PUT, deleteTaxZone as DELETE } from '@rovela-ai/sdk/admin/api'

package/templates/store-template/app/api/admin/tax-zones/route.ts

@@ -0,0 +1,7 @@
+/**
+ * Admin Tax Zones API Route
+ *
+ * GET/POST /api/admin/tax-zones - List/Create tax zones
+ */
+
+export { getTaxZones as GET, createTaxZone as POST } from '@rovela-ai/sdk/admin/api'

package/templates/store-template/app/api/admin/users/[id]/route.ts

@@ -0,0 +1,14 @@
+/**
+ * Admin Users API Route — detail + actions
+ *
+ * Thin re-export of the SDK handlers:
+ *   GET    — detail (users.read)
+ *   PATCH  — { action: 'deactivate' | 'reactivate' } (users.write)
+ *   DELETE — hard delete (users.delete, owner only)
+ */
+
+export {
+  getUser as GET,
+  PATCH,
+  DELETE,
+} from '@rovela-ai/sdk/admin/api/users'

package/templates/store-template/app/api/admin/users/route.ts

@@ -0,0 +1,12 @@
+/**
+ * Admin Users API Route — list + invite
+ *
+ * Thin re-export of the SDK handlers:
+ *   GET  — list all admins (users.read)
+ *   POST — invite a new admin (users.write; Phase 3)
+ *
+ * The SDK enforces all permissions and invariants; this file just mounts
+ * the handlers at the expected path.
+ */
+
+export { GET, POST } from '@rovela-ai/sdk/admin/api/users'

package/templates/store-template/app/api/admin-auth/[...nextauth]/route.ts

@@ -0,0 +1,17 @@
+/**
+ * Store Admin Authentication Route
+ *
+ * Dedicated NextAuth endpoint for admin sign-in/sign-out/session. Writes
+ * its own cookie (`__Secure-rovela.admin.session-token`), completely
+ * separate from the storefront customer session cookie. Both can coexist
+ * in the same browser.
+ *
+ * Customer authentication lives at /api/auth/[...nextauth].
+ */
+
+import NextAuth from 'next-auth'
+import { createAdminAuthOptions } from '@rovela-ai/sdk/admin'
+
+const handler = NextAuth(createAdminAuthOptions())
+
+export { handler as GET, handler as POST }

package/templates/store-template/app/api/analytics/track/route.ts

@@ -0,0 +1,12 @@
+/**
+ * POST /api/analytics/track
+ *
+ * Storefront analytics event ingest. Public endpoint — events are pseudonymous
+ * (visitor_id is a random UUID, no PII). The SDK handler validates the event,
+ * filters bots + admin sessions, derives device/country, and inserts to the
+ * store's own Neon branch.
+ *
+ * See CLAUDE.md §46.
+ */
+
+export { POST } from '@rovela-ai/sdk/analytics/api/track'

package/templates/store-template/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,19 @@
+/**
+ * Storefront Customer Authentication Route
+ *
+ * Handles customer sign-in/sign-up/session for the storefront.
+ * Uses the 'credentials' provider and writes the customer session cookie
+ * (`__Secure-rovela.customer.session-token`).
+ *
+ * Admin authentication lives at a SEPARATE endpoint:
+ *   /api/admin-auth/[...nextauth]
+ * with its own cookie (`__Secure-rovela.admin.session-token`), so an admin
+ * and a customer session can coexist in the same browser.
+ */
+
+import NextAuth from 'next-auth'
+import { createCustomerAuthOptions } from '@rovela-ai/sdk/auth'
+
+const handler = NextAuth(createCustomerAuthOptions())
+
+export { handler as GET, handler as POST }

package/templates/store-template/app/api/auth/forgot-password/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Forgot Password Route
+ *
+ * POST /api/auth/forgot-password - Request password reset
+ */
+
+import { POST as handler } from '@rovela-ai/sdk/auth/api/forgot-password'
+
+export const POST = handler

package/templates/store-template/app/api/auth/register/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Customer Registration Route
+ *
+ * POST /api/auth/register - Register new customer
+ */
+
+import { POST as handler } from '@rovela-ai/sdk/auth/api/register'
+
+export const POST = handler

package/templates/store-template/app/api/auth/resend-verification/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Resend Verification Route
+ *
+ * POST /api/auth/resend-verification - Resend verification email
+ */
+
+import { POST as handler } from '@rovela-ai/sdk/auth/api/resend-verification'
+
+export const POST = handler

package/templates/store-template/app/api/auth/reset-password/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Reset Password Route
+ *
+ * GET/POST /api/auth/reset-password - Validate token / Reset password
+ */
+
+import { GET as getHandler, POST as postHandler } from '@rovela-ai/sdk/auth/api/reset-password'
+
+export const GET = getHandler
+export const POST = postHandler

package/templates/store-template/app/api/auth/verify-email/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Email Verification Route
+ *
+ * GET/POST /api/auth/verify-email - Verify customer email
+ */
+
+import { GET as getHandler, POST as postHandler } from '@rovela-ai/sdk/auth/api/verify-email'
+
+export const GET = getHandler
+export const POST = postHandler

package/templates/store-template/app/api/categories/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Categories API Route
+ *
+ * GET /api/categories - List all categories
+ * Wires directly to SDK handler.
+ */
+
+import { getCategories } from '@rovela-ai/sdk/products'
+
+export const GET = getCategories

package/templates/store-template/app/api/checkout/countries/route.ts

@@ -0,0 +1,7 @@
+/**
+ * GET /api/checkout/countries
+ *
+ * Returns allowed shipping countries from store settings.
+ * Used by CheckoutFlow to filter country dropdown in ShippingForm.
+ */
+export { CountriesGET as GET } from '@rovela-ai/sdk/checkout'

package/templates/store-template/app/api/checkout/discount/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Checkout Discount Preview API Route
+ *
+ * POST /api/checkout/discount - Validate a discount code against the current
+ * cart (and surface automatic promotions) before placing the order. Runs the
+ * same server-side pricing pipeline as order creation.
+ */
+
+export { POST } from '@rovela-ai/sdk/checkout/api/discount'

package/templates/store-template/app/api/checkout/manual/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Manual Checkout API Route
+ *
+ * POST /api/checkout/manual - Place an order with a manual payment method
+ * (cash on delivery, wire transfer…). Order is created as 'pending'; the
+ * merchant marks it paid from the admin. All amounts are recomputed
+ * server-side from the database.
+ */
+
+export { POST } from '@rovela-ai/sdk/checkout/api/manual'

package/templates/store-template/app/api/checkout/payment-methods/route.ts

@@ -0,0 +1,8 @@
+/**
+ * Checkout Payment Methods API Route (public)
+ *
+ * GET /api/checkout/payment-methods - Enabled payment methods offered at
+ * checkout alongside card payments.
+ */
+
+export { GET } from '@rovela-ai/sdk/checkout/api/payment-methods'

package/templates/store-template/app/api/checkout/pickup-locations/route.ts

@@ -0,0 +1,8 @@
+/**
+ * Checkout Pickup Locations API Route (public)
+ *
+ * GET /api/checkout/pickup-locations - Pickup-enabled store locations for the
+ * checkout's "Pick up in store" selector. Empty list = toggle hidden.
+ */
+
+export { GET } from '@rovela-ai/sdk/checkout/api/pickup-locations'

package/templates/store-template/app/api/checkout/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Checkout API Route
+ *
+ * POST /api/checkout - Create Stripe Checkout session
+ * Wires directly to SDK handler.
+ */
+
+import { POST as handler } from '@rovela-ai/sdk/checkout/api'
+
+export const POST = handler

package/templates/store-template/app/api/checkout/shipping/route.ts

@@ -0,0 +1,21 @@
+/**
+ * Shipping calculation API route
+ *
+ * POST /api/checkout/shipping
+ * Calculates available shipping options based on address and cart items.
+ * Supports both manual (zone-based) and Shippo (carrier API) modes.
+ *
+ * @example
+ * ```ts
+ * const response = await fetch('/api/checkout/shipping', {
+ *   method: 'POST',
+ *   headers: { 'Content-Type': 'application/json' },
+ *   body: JSON.stringify({
+ *     address: { firstName, lastName, line1, city, state, postalCode, country },
+ *     items: [{ price: 2999, quantity: 2 }]
+ *   })
+ * })
+ * const { options, flatOptions, mode } = await response.json()
+ * ```
+ */
+export { ShippingPOST as POST } from '@rovela-ai/sdk/checkout/api'

package/templates/store-template/app/api/checkout/status/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Checkout Status Route
+ *
+ * GET /api/checkout/status - Check if payments are configured
+ *
+ * Used by CheckoutButton component to verify the store can accept payments
+ * before showing the checkout button.
+ */
+
+export { GET } from '@rovela-ai/sdk/checkout/api/payment-status'

package/templates/store-template/app/api/contact/route.ts

@@ -0,0 +1,164 @@
+/**
+ * Contact Form API Route
+ *
+ * POST /api/contact - Send contact form message to store owner
+ *
+ * Uses SDK email system to send formatted emails.
+ */
+
+import { NextRequest, NextResponse } from 'next/server'
+import {
+  sendEmail,
+  baseLayout,
+  getEmailConfig,
+  getSupportEmail,
+  escapeHtml,
+} from '@rovela-ai/sdk/emails'
+
+// =============================================================================
+// Types
+// =============================================================================
+
+interface ContactFormData {
+  name: string
+  email: string
+  subject: string
+  message: string
+}
+
+// =============================================================================
+// Validation
+// =============================================================================
+
+function validateContactForm(data: unknown): {
+  valid: boolean
+  error?: string
+  data?: ContactFormData
+} {
+  if (!data || typeof data !== 'object') {
+    return { valid: false, error: 'Invalid request body' }
+  }
+
+  const { name, email, subject, message } = data as Record<string, unknown>
+
+  if (typeof name !== 'string' || name.trim().length < 2) {
+    return { valid: false, error: 'Name must be at least 2 characters' }
+  }
+
+  if (typeof email !== 'string' || !email.includes('@') || email.length < 5) {
+    return { valid: false, error: 'Please provide a valid email address' }
+  }
+
+  if (typeof subject !== 'string' || subject.trim().length < 5) {
+    return { valid: false, error: 'Subject must be at least 5 characters' }
+  }
+
+  if (typeof message !== 'string' || message.trim().length < 10) {
+    return { valid: false, error: 'Message must be at least 10 characters' }
+  }
+
+  return {
+    valid: true,
+    data: {
+      name: name.trim(),
+      email: email.trim().toLowerCase(),
+      subject: subject.trim(),
+      message: message.trim(),
+    },
+  }
+}
+
+// =============================================================================
+// POST Handler
+// =============================================================================
+
+export async function POST(request: NextRequest) {
+  try {
+    // Parse request body
+    const body = await request.json()
+
+    // Validate form data
+    const validation = validateContactForm(body)
+    if (!validation.valid || !validation.data) {
+      return NextResponse.json(
+        { success: false, error: validation.error },
+        { status: 400 }
+      )
+    }
+
+    const { name, email, subject, message } = validation.data
+
+    // Get email configuration
+    const config = await getEmailConfig()
+
+    // Determine recipient - store owner or support email
+    const recipientEmail =
+      process.env.STORE_OWNER_EMAIL || (await getSupportEmail())
+
+    // Build email content
+    const emailContent = `
+      <h1 style="margin: 0 0 24px 0; font-family: 'Plus Jakarta Sans', system-ui, sans-serif; font-size: 30px; font-weight: 700; color: #0A0A0A; text-align: center; line-height: 1.1;">New Contact Form Message</h1>
+      <p style="margin: 0 0 16px 0; font-family: 'Plus Jakarta Sans', system-ui, sans-serif; font-size: 16px; font-weight: 400; line-height: 1.625; color: #78716C;">You've received a new message from your store's contact form.</p>
+
+      <table style="width: 100%; border-collapse: collapse; margin: 24px 0;">
+        <tr>
+          <td style="padding: 12px 0; border-bottom: 1px solid #E8DFD3; font-weight: 600; width: 100px;">From:</td>
+          <td style="padding: 12px 0; border-bottom: 1px solid #E8DFD3;">${escapeHtml(name)}</td>
+        </tr>
+        <tr>
+          <td style="padding: 12px 0; border-bottom: 1px solid #E8DFD3; font-weight: 600;">Email:</td>
+          <td style="padding: 12px 0; border-bottom: 1px solid #E8DFD3;">
+            <a href="mailto:${escapeHtml(email)}" style="color: #0CAF7D; text-decoration: none;">${escapeHtml(email)}</a>
+          </td>
+        </tr>
+        <tr>
+          <td style="padding: 12px 0; border-bottom: 1px solid #E8DFD3; font-weight: 600;">Subject:</td>
+          <td style="padding: 12px 0; border-bottom: 1px solid #E8DFD3;">${escapeHtml(subject)}</td>
+        </tr>
+      </table>
+
+      <h2 style="margin: 24px 0 16px 0; font-family: 'Plus Jakarta Sans', system-ui, sans-serif; font-size: 20px; font-weight: 600; color: #0A0A0A;">Message</h2>
+      <div style="background-color: #F7F7F7; border-radius: 8px; padding: 20px; margin-top: 16px;">
+        <p style="margin: 0; white-space: pre-wrap; line-height: 1.6;">${escapeHtml(message)}</p>
+      </div>
+
+      <p style="margin: 24px 0 0 0; font-family: 'Plus Jakarta Sans', system-ui, sans-serif; font-size: 14px; font-weight: 400; line-height: 1.625; color: #78716C;"><em>You can reply directly to this email to respond to ${escapeHtml(name)}.</em></p>
+    `
+
+    // Render with base layout
+    const html = baseLayout({
+      config,
+      title: `Contact: ${subject}`,
+      content: emailContent,
+    })
+
+    // Send email with reply-to set to customer's email
+    const result = await sendEmail({
+      to: recipientEmail,
+      subject: `[${config.storeName}] Contact: ${subject}`,
+      html,
+      replyTo: email,
+    })
+
+    if (!result.success) {
+      console.error('[Contact API] Email send failed:', result.error)
+      return NextResponse.json(
+        { success: false, error: 'Failed to send message. Please try again.' },
+        { status: 500 }
+      )
+    }
+
+    console.log('[Contact API] Message sent successfully to:', recipientEmail)
+
+    return NextResponse.json({
+      success: true,
+      message: 'Message sent successfully',
+    })
+  } catch (error) {
+    console.error('[Contact API] Error:', error)
+    return NextResponse.json(
+      { success: false, error: 'An unexpected error occurred' },
+      { status: 500 }
+    )
+  }
+}

package/templates/store-template/app/api/media/presign/route.ts

@@ -0,0 +1,7 @@
+/**
+ * Media Presign API Route
+ *
+ * POST /api/media/presign - Generate presigned URL for file upload
+ */
+
+export { POST } from '@rovela-ai/sdk/media/api'