@rovela-ai/sdk 0.24.0 → 0.25.0

package/dist/emails/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/emails/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAA;IACf,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAA;IACrB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,6BAA6B;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAA;IAChB,uFAAuF;IACvF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;CAChB;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAA;IACnB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAA;IACjB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAA;IAClB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;CACpB;AAMD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAA;IACjB,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,gFAAgF;IAChF,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtD,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,YAAY,CAAA;IAC7B,yBAAyB;IACzB,gBAAgB,EAAE,MAAM,CAAA;IACxB,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uHAAuH;IACvH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,iDAAiD;IACjD,aAAa,EAAE,YAAY,CAAA;IAC3B,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,mEAAmE;IACnE,qBAAqB,EAAE,MAAM,CAAA;IAC7B,eAAe,EAAE,YAAY,CAAA;IAC7B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,yCAAyC;IACzC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,CAAA;IACxB,kCAAkC;IAClC,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAA;IACpB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAA;IACxB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;CACrB;AAMD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GACzB,oBAAoB,GACpB,SAAS,GACT,gBAAgB,GAChB,oBAAoB,GACpB,eAAe,GACf,wBAAwB,GACxB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,CAAA;AAEtB;;GAEG;AACH,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/emails/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAA;IACf,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAA;IACrB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,6BAA6B;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAA;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAA;IAChB,uFAAuF;IACvF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;CAChB;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAMD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAA;IACnB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAA;IACjB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAA;IAClB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;CACpB;AAMD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAA;IACjB,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,gFAAgF;IAChF,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtD,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,YAAY,CAAA;IAC7B,yBAAyB;IACzB,gBAAgB,EAAE,MAAM,CAAA;IACxB,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uHAAuH;IACvH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,iDAAiD;IACjD,aAAa,EAAE,YAAY,CAAA;IAC3B,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,mEAAmE;IACnE,qBAAqB,EAAE,MAAM,CAAA;IAC7B,eAAe,EAAE,YAAY,CAAA;IAC7B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,yCAAyC;IACzC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,CAAA;IACxB,kCAAkC;IAClC,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAA;IACpB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAA;IACxB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;CACrB;AAMD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GACzB,oBAAoB,GACpB,SAAS,GACT,gBAAgB,GAChB,oBAAoB,GACpB,eAAe,GACf,wBAAwB,GACxB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,CAAA;AAEtB;;GAEG;AACH,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,CAAA"}

package/docs/changelog/epoch-11-order-extras.md

@@ -40,3 +40,59 @@ None — purely additive; no existing data changes meaning.
 - Open any order in /admin — no "Additional details" card (empty metafields).
 - After a PrestaShop import with order fields mapped, imported orders show
   the card with the mapped values (e.g. "Recyclable packaging: Yes").
+
+---
+
+# 0.24.1 — email attachments + design-preview confirmations
+
+## What changed
+- `sendEmail()` accepts optional `attachments` (`{ filename, contentBase64 }[]`),
+  mapped natively on ALL THREE transports (Resend, Brevo HTTP, SMTP/nodemailer).
+  Absent = byte-identical behavior to 0.24.0.
+- Order-confirmation emails: items flagged `attachImage` (EmailOrderItem) get
+  their `imageUrl` fetched and ATTACHED (cap 4 files / 4MB each, best-effort —
+  an attachment failure can never block the confirmation), plus one localized
+  note paragraph ("Attached to this email — the preview of your custom
+  piece…", EN/FR via the render-boundary localizer).
+- Both confirmation call sites flag `attachImage` automatically for
+  NON-UUID variant refs with an image — the SDK's own configurator-line
+  discriminator (see order-service `isUuid`). Stock lines never attach.
+- Stripe path: `extractItemsFromLineItems` now reads the line's expanded
+  product `images[0]` back into `item.image` — the session builder has always
+  SET it (`product_data.images`); the webhook simply dropped it. This also
+  means STOCK product thumbnails now render in card-payment confirmations
+  (they already did on the manual path via the quote's image passthrough).
+
+## Template contract
+No new mounts, no new routes, no new dependencies. Plain pin bump.
+
+## Behavior contracts
+- Stores with no configurator lines: only visible change is item thumbnails
+  appearing in Stripe-path confirmation emails (parity with the manual path).
+- `attachments` on SendEmailOptions is additive; custom store code sending
+  emails is unaffected.
+
+## Custom-code hazards (audit greps for CC)
+- Custom code that forked `extractItemsFromLineItems` behavior won't gain the
+  image readback — grep for `rovela_item` in store-owned webhook code.
+
+## MERCHANT-DATA HAZARD
+None — additive.
+
+## Security
+- Confirmation attachments only fetch URLs on the store's own
+  `R2_PUBLIC_URL` base — item image URLs are client-suppliable checkout
+  data and must never drive arbitrary server-side fetches.
+
+## Verify
+- Place a card-paid order with a stock product: the confirmation email shows
+  the product thumbnail (previously text-only on the Stripe path).
+- A configurator line (non-UUID variant ref + image): confirmation carries
+  the preview attachment + the note paragraph.
+- A manual/COD order with a configurator line attaches the DESIGN preview,
+  not the stock product photo (the useCheckout manual body now carries
+  item.image — parity with the Stripe path).
+- Multi-view designs attach EVERY view: `CartItem.previewImages` →
+  checkout passthrough (`previewUrls` line metadata on Stripe, ≤480-char
+  guard keeps the first URL when over) → `EmailOrderItem.attachImageUrls`.
+  Attachment caps: 8 files / 4MB each / 10MB total.

package/docs/changelog/epoch-12-payment-providers.md

@@ -0,0 +1,105 @@
+# E12 Payment providers — 0.25.0..0.25.0
+
+## What landed
+Two native payment providers, peers of Stripe: **PayPal** (Orders v2, Smart
+Buttons popup with a redirect fallback, server-side capture, webhook
+backstop) and **Up2pay e-Transactions** (Crédit Agricole's hosted payment
+page — HMAC-signed form redirect, RSA-verified IPN as the only payment
+truth). Merchants configure both in **Admin → Payments** (Colissimo-style
+panels: masked credentials, validate-before-persist, disconnect). Once
+connected they appear automatically in the checkout payment selector; no
+store code changes, no cards, no per-store payment logic.
+
+## SDK-internal (free via pin bump)
+- `checkout/server/{up2pay,paypal,confirm-order,external-checkout}.ts` — all
+  money logic. External orders create as `pending` (priced by `buildQuote`,
+  reference `up2pay_…`/`paypal_…` in the shared payment-intent column) and
+  flip to paid through ONE atomic claim (`claimPendingOrderPaid`) after
+  signature + amount verification against the DB order. Confirmation email
+  sends on PAID (from DB state), not at creation.
+- `checkout/api/payment-methods.ts` — the public GET now appends synthetic
+  `kind='external'` entries (id `paypal`/`up2pay`) when a provider is
+  configured + enabled. Fail-open contract unchanged.
+- `admin/components/{PaymentProviderPanels,PaymentSettings}.tsx` +
+  `admin/api/payment-providers.ts` — the Payments-tab panels.
+- `admin/components/OrderDetails.tsx` — provider-aware: PayPal/Up2pay orders
+  show a provider Payment card + status-only "Mark as refunded" (never the
+  Stripe refund flow); pending external orders read as awaiting provider
+  confirmation. Transaction ids land in the order's "Additional details"
+  (metafields).
+- `admin/integrations/registry.ts` — the `paypal` entry is REMOVED: payment
+  providers are not integrations; the hub keeps cross-domain services
+  (Brevo, pixels…). Credentials stored via the old entry keep working — the
+  columns are unchanged and now surface in Admin → Payments.
+
+## Template contract
+Eight new route mounts (plain re-exports — copy from the stock template):
+- `app/api/checkout/up2pay/route.ts` (`POST` from
+  `@rovela-ai/sdk/checkout/api/up2pay`)
+- `app/api/checkout/up2pay/ipn/route.ts` (`GET, POST` from
+  `@rovela-ai/sdk/checkout/api/up2pay-ipn`)
+- `app/api/checkout/paypal/route.ts` (`POST` from
+  `@rovela-ai/sdk/checkout/api/paypal`)
+- `app/api/checkout/paypal/capture/route.ts` (`POST` from
+  `@rovela-ai/sdk/checkout/api/paypal-capture`)
+- `app/api/checkout/paypal/return/route.ts` (`ReturnGET as GET` from
+  `@rovela-ai/sdk/checkout/api/paypal-capture`)
+- `app/api/checkout/paypal/webhook/route.ts` (`POST` from
+  `@rovela-ai/sdk/checkout/api/paypal-webhook`)
+- `app/api/admin/payments/paypal/route.ts` +
+  `app/api/admin/payments/up2pay/route.ts` (GET/POST/DELETE trios from
+  `@rovela-ai/sdk/admin/api`)
+
+## Behavior contracts
+- `CheckoutFlow` renders external providers in the existing payment
+  selector; selecting PayPal swaps the Place-order button for the Smart
+  Buttons (script from paypal.com parameterized by the PUBLIC client id).
+  Stores with a custom checkout page that still mounts the SDK
+  `CheckoutFlow` get everything free; fully custom checkouts must call the
+  new hook legs (`checkoutUp2pay` / `createPaypalOrder` /
+  `capturePaypalOrder` on `useCheckout`) to offer the providers.
+- The admin settings GET no longer returns `paypal_client_secret` /
+  `up2pay_hmac_key` (server-only strip, like `colissimo_password`).
+
+## Custom-code hazards
+- **A store built by the RETIRED `connect-paypal` feature card** carries a
+  per-store PayPal fork. Grep: `ls app/api/checkout/paypal/` — if
+  `create-order/` exists or `route.ts` files contain implementation (not
+  bare re-exports), DELETE the fork: replace `app/api/checkout/paypal/*`
+  with the stock re-export mounts above, delete
+  `components/checkout/PayPal*`, remove the PayPal provider mount from
+  `app/layout.tsx` and the button from `app/checkout/page.tsx`, and
+  `npm uninstall @paypal/react-paypal-js @paypal/paypal-server-sdk`.
+  Credentials in `store_settings.paypal_*` are UNTOUCHED and keep working
+  (`paypal_environment` value `'production'` is accepted alongside
+  `'live'`).
+- Grep `fetch('/api/checkout/payment-methods')` consumers in custom code:
+  the response may now include `kind='external'` entries — code that
+  assumed every method is manual must not POST them to
+  `/api/checkout/manual` (it rejects `kind !== 'manual'` anyway).
+
+## DB
+`store_settings` gains 11 columns (`paypal_client_id/client_secret/
+environment/webhook_id/enabled`, `up2pay_site/rang/identifiant/hmac_key/
+environment/enabled`) — self-healed by `ensureStoreSettingsSchema` at the
+settings chokepoints; parent-branch ALTER run at ship time. Card-installed
+stores already carrying `paypal_*` columns converge idempotently
+(`ADD COLUMN IF NOT EXISTS`). No new tables.
+
+## New surfaces
+- Admin → Payments: PayPal + Up2pay panels between the Stripe card and the
+  manual payment-methods list (part of the SDK `PaymentSettings` component
+  — stores mounting it get them free; stores with a custom payments page
+  add `<PaypalProviderPanel />` + `<Up2payProviderPanel />` from
+  `@rovela-ai/sdk/admin`).
+
+## Verify
+- `npm run build` green after the pin bump.
+- `GET /api/checkout/payment-methods` returns 200 (fail-open even
+  unconfigured).
+- Admin → Payments renders the two provider panels.
+- If the store had the card-built PayPal fork: `app/api/checkout/paypal/`
+  contains ONLY re-export mounts, `@paypal/*` packages are gone from
+  package.json, and the checkout page has no leftover PayPal component
+  imports.
+- An order list/detail read works (settings + orders self-heals ran).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rovela-ai/sdk",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Rovela SDK - Pre-built e-commerce components for AI-powered store generation",
   "type": "module",
   "license": "MIT",
@@ -94,6 +94,30 @@
       "types": "./dist/checkout/api/colissimo-relays.d.ts",
       "import": "./dist/checkout/api/colissimo-relays.js"
     },
+    "./checkout/api/up2pay": {
+      "types": "./dist/checkout/api/up2pay.d.ts",
+      "import": "./dist/checkout/api/up2pay.js"
+    },
+    "./checkout/api/up2pay-ipn": {
+      "types": "./dist/checkout/api/up2pay-ipn.d.ts",
+      "import": "./dist/checkout/api/up2pay-ipn.js"
+    },
+    "./checkout/api/paypal": {
+      "types": "./dist/checkout/api/paypal.d.ts",
+      "import": "./dist/checkout/api/paypal.js"
+    },
+    "./checkout/api/paypal-capture": {
+      "types": "./dist/checkout/api/paypal-capture.d.ts",
+      "import": "./dist/checkout/api/paypal-capture.js"
+    },
+    "./checkout/api/paypal-webhook": {
+      "types": "./dist/checkout/api/paypal-webhook.d.ts",
+      "import": "./dist/checkout/api/paypal-webhook.js"
+    },
+    "./admin/api/payment-providers": {
+      "types": "./dist/admin/api/payment-providers.d.ts",
+      "import": "./dist/admin/api/payment-providers.js"
+    },
     "./checkout/server": {
       "types": "./dist/checkout/server/index.d.ts",
       "import": "./dist/checkout/server/index.js"

package/templates/store-template/.claude/skills/build-feature/SKILL.md

@@ -197,7 +197,8 @@ If the feature connects to an external service (API key, secret, tracking ID):
 
 - Persist credentials to `store_settings` — dedicated columns for secrets (`ALTER TABLE store_settings ADD COLUMN IF NOT EXISTS …`, read server-side at request time; NEVER `.env.local`, NEVER `NEXT_PUBLIC_`), or the `analytics` JSONB for public tracking IDs.
 - The merchant manages them at `/admin/integrations` (SDK page, already mounted). **Do NOT build a settings page, credentials form, or nav entry for keys.**
-- Known keys are auto-rendered (brevo, paypal, turnstile, ga4, google_ads, meta, tiktok, klaviyo, intercom, trustpilot). A NOVEL integration registers a descriptor (dedup by key, then append):
+- Known keys are auto-rendered (brevo, turnstile, ga4, google_ads, meta, tiktok, klaviyo, intercom, trustpilot). A NOVEL integration registers a descriptor (dedup by key, then append):
+- **Payment providers are NOT integrations**: PayPal and Up2pay e-Transactions (Crédit Agricole) are NATIVE SDK payment providers (SDK 0.25+) configured at `/admin/payments`, peers of Stripe — checkout picks them up automatically once connected. NEVER build payment-provider routes, checkout components, or credential forms for them; point the merchant to Admin → Payments.
 
 ```sql
 ALTER TABLE store_settings ADD COLUMN IF NOT EXISTS custom_integrations jsonb NOT NULL DEFAULT '[]'::jsonb;

package/templates/store-template/app/api/admin/payments/paypal/route.ts

@@ -0,0 +1,10 @@
+/**
+ * PayPal provider configuration (Admin → Payments)
+ */
+import {
+  getPaypalProviderConfig,
+  savePaypalProviderConfig,
+  deletePaypalProviderConfig,
+} from '@rovela-ai/sdk/admin/api'
+
+export { getPaypalProviderConfig as GET, savePaypalProviderConfig as POST, deletePaypalProviderConfig as DELETE }

package/templates/store-template/app/api/admin/payments/up2pay/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Up2pay e-Transactions provider configuration (Admin → Payments)
+ */
+import {
+  getUp2payProviderConfig,
+  saveUp2payProviderConfig,
+  deleteUp2payProviderConfig,
+} from '@rovela-ai/sdk/admin/api'
+
+export { getUp2payProviderConfig as GET, saveUp2payProviderConfig as POST, deleteUp2payProviderConfig as DELETE }

package/templates/store-template/app/api/checkout/paypal/capture/route.ts

@@ -0,0 +1,8 @@
+/**
+ * PayPal Capture API Route
+ *
+ * POST /api/checkout/paypal/capture - Server-side capture after the buyer
+ * approves in the PayPal popup (Smart Buttons onApprove leg).
+ */
+
+export { POST } from '@rovela-ai/sdk/checkout/api/paypal-capture'

package/templates/store-template/app/api/checkout/paypal/return/route.ts

@@ -0,0 +1,9 @@
+/**
+ * PayPal Return Route (redirect fallback)
+ *
+ * GET /api/checkout/paypal/return - Captures server-side when the buyer
+ * comes back from the hosted approval page, then redirects to the
+ * success page (or back to checkout with the cart intact).
+ */
+
+export { ReturnGET as GET } from '@rovela-ai/sdk/checkout/api/paypal-capture'

package/templates/store-template/app/api/checkout/paypal/route.ts

@@ -0,0 +1,9 @@
+/**
+ * PayPal Checkout API Route
+ *
+ * POST /api/checkout/paypal - Start a PayPal payment. The order is created
+ * as 'pending' (server-priced) with a matching PayPal order; capture
+ * happens server-side after approval.
+ */
+
+export { POST } from '@rovela-ai/sdk/checkout/api/paypal'

package/templates/store-template/app/api/checkout/paypal/webhook/route.ts

@@ -0,0 +1,9 @@
+/**
+ * PayPal Webhook Route
+ *
+ * POST /api/checkout/paypal/webhook - Async backstop: verified events
+ * confirm captures the client never reported and record PayPal-side
+ * refunds. Requires the webhook id configured in Admin → Payments.
+ */
+
+export { POST } from '@rovela-ai/sdk/checkout/api/paypal-webhook'

package/templates/store-template/app/api/checkout/up2pay/ipn/route.ts

@@ -0,0 +1,8 @@
+/**
+ * Up2pay e-Transactions IPN Route
+ *
+ * The server-to-server payment notification — the ONLY thing that flips an
+ * Up2pay order to paid (signature + amount verified against the order).
+ */
+
+export { GET, POST } from '@rovela-ai/sdk/checkout/api/up2pay-ipn'

package/templates/store-template/app/api/checkout/up2pay/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Up2pay e-Transactions Checkout API Route
+ *
+ * POST /api/checkout/up2pay - Start an Up2pay (Crédit Agricole) hosted-page
+ * payment. The order is created as 'pending' (server-priced); the IPN
+ * confirms payment server-to-server.
+ */
+
+export { POST } from '@rovela-ai/sdk/checkout/api/up2pay'

package/templates/store-template/package.json

@@ -9,7 +9,7 @@
     "lint": "eslint ."
   },
   "dependencies": {
-    "@rovela-ai/sdk": "0.24.0",
+    "@rovela-ai/sdk": "0.25.0",
     "@tailwindcss/forms": "0.5.11",
     "@tailwindcss/typography": "0.5.19",
     "autoprefixer": "10.4.24",