Curls & Contemplation Author Site

Production-oriented Next.js App Router author-commerce platform. The app lives at the repository root — there is no author-site/ directory. Older docs that reference one are stale; ignore their path guidance.

Local setup

pnpm install
pnpm dev

Copy .env.example to .env.local and fill only development keys. Do not commit real secrets.

Environment variables

.env.example lists launch mode, pricing, Supabase, Stripe, Resend, MailerLite, Turnstile, admin, analytics, and observability variables by name only.

Supabase setup

Run supabase/migrations/0001_author_commerce.sql. Paid deliverable files (EPUB, card deck PDF) must be uploaded to private Storage bucket curls-deliverables, not public/.

Stripe setup

Create one-time prices for preorder ($17.99) and regular direct ($19.99). The checkout API chooses server-side price IDs and never trusts client-provided prices. Webhooks verify STRIPE_WEBHOOK_SECRET before handling events.

MailerLite and Resend

Wrappers fail safely when keys are absent. Configure MailerLite group IDs and Resend sender before production.

Secure downloads

/downloads and /api/downloads/sign require a session, check entitlement server-side, deny refunded/revoked/non-buyers, and scaffold a 3 downloads / 7 days cap. Signed URLs are generated from Supabase private Storage.

Analytics

lib/analytics.ts defines the event map. lib/events/server-analytics.ts records internal events when Supabase service credentials exist. GA4/PostHog env placeholders are present but not activated as live tracking.

Deployment

Vercel root directory: the repository root (leave the setting empty). Set preview and production env vars separately. Do not deploy production until launch QA and human legal review pass.

Testing commands

pnpm lint
pnpm typecheck
pnpm test
pnpm build

Real vs scaffolded

Real: route structure, content/config modules, launch mode CTA logic, server-side price selection, webhook signature verification path, entitlement-denial default, private Storage signing path, RLS migration intent, event map.

Scaffolded: final Supabase project, live Stripe products, MailerLite automations, Resend templates, actual admin data tables UI, Turnstile verification, GA4/PostHog browser activation, production legal copy.

Prompt 5 sandbox integration notes

Vercel settings

• Root directory: repository root (leave empty — there is no author-site/ directory)
• Install command: pnpm install
• Build command: pnpm build
• Local env file: .env.local only; never commit it.
• Keep preview and production environment variables separate. Use Stripe/Supabase sandbox projects for preview.

Stripe webhook

• Endpoint path: /api/stripe/webhook
• Test mode only until production activation gates pass.
• Required sandbox vars: STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_ID_PREORDER, STRIPE_PRICE_ID_REGULAR.

Supabase private bucket checklist

• Apply supabase/migrations/0001_author_commerce.sql.
• Create private bucket curls-deliverables.
• Upload the workbook and Daily Directives ZIPs with scripts/upload-deliverables.mjs; upload the EPUB later to its locked path.
• The v13 POD interior PDF is a print artifact for KDP/third-party POD only — it is not a site deliverable and is not uploaded to Storage.
• Do not add public read policies for paid deliverables.

Email and marketing checklist

• MailerLite: use the Pricing Confidence Kit, Preorders, Customers, Abandoned Checkout, Refunded, and Quiz groups. Groups are segments; they do not each need an automation.
• Resend: verify sender domain and configure SPF, DKIM, and DMARC before real sends.
• Turnstile: add site/secret keys before enabling remote bot verification on forms.

Analytics checklist

• GA4/PostHog are optional until consent behavior is approved.
• Client analytics require consent; server operational events may still record security/order/download events.

Production activation gates

• Human legal review complete.
• Domain and email DNS approved.
• Supabase RLS verified in sandbox.
• Stripe test checkout/webhook/refund pass.
• Protected download signing and revocation pass.
• No real secrets committed and no paid files in public/.

Sandbox integration

Prompt 6 prepares the app for real sandbox verification while keeping production locked. Use docs/website-v4/12_SANDBOX_INTEGRATION_RUNBOOK.md as the step-by-step source of truth and docs/website-v4/13_SANDBOX_TEST_RESULTS_TEMPLATE.md to record results without secrets.

Sandbox env file

1. Copy .env.sandbox.example to a local-only .env.sandbox or copy selected values into .env.local for local testing only.
2. Fill sandbox/test values only. Never use production/live API keys.
3. Never commit .env.local, .env.sandbox, signed URLs, customer exports, or provider secrets.
4. Keep production env scopes empty/blocked until launch approval.

Run the safe readiness checks:

pnpm check:sandbox

The sandbox checks hide secret values, allow missing provider credentials during scaffolding, and fail only on dangerous conditions such as live Stripe key patterns or paid EPUB/PDF files in public/.

Supabase sandbox

Apply the migration in a sandbox Supabase project:

# Run from the repository root.
supabase db push --include-all
# or run supabase/migrations/0001_author_commerce.sql in the Supabase SQL editor.

Create private Storage bucket curls-deliverables with public access disabled. Upload the local release artifact from the repo root to this private object path only:

• EPUB: books/curls-and-contemplation/epub/Curls-and-Contemplation-v13-KDP-EPUB-FINAL.epub

Source artifacts remain outside public:

• release/Curls-and-Contemplation-v13-KDP-EPUB-FINAL.epub
• release/Curls-and-Contemplation-v13-KDP-POD-RECTO-FINAL.pdf (POD print interior for KDP/third-party POD only — never uploaded to Storage)

After credentials are present, run:

pnpm check:supabase-storage

Without Supabase credentials, this check verifies locked path strings and safely skips the remote bucket/object probe.

Stripe test mode

In Stripe Dashboard Test mode:

1. Create product Curls & Contemplation — Direct Preorder with one-time $17.99 price and set STRIPE_PRICE_ID_PREORDER.
2. Create product Curls & Contemplation — Direct Regular Edition with one-time $19.99 price and set STRIPE_PRICE_ID_REGULAR.
3. Set test keys only: NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY, STRIPE_SECRET_KEY, and STRIPE_WEBHOOK_SECRET.
4. Create a test webhook endpoint at /api/stripe/webhook for checkout.session.completed, checkout.session.expired, charge.refunded, optional payment_intent.succeeded, and subscription placeholder events.

If Stripe CLI is available:

stripe login
stripe listen --forward-to localhost:3000/api/stripe/webhook
stripe trigger checkout.session.completed
stripe trigger charge.refunded

Run:

pnpm check:stripe-test

The check fails on live key patterns and skips safely if test credentials are missing.

Resend and MailerLite sandbox

Configure Resend sandbox/test sender values: RESEND_API_KEY, RESEND_FROM_EMAIL, and SUPPORT_EMAIL. Test order confirmation, download access, Pricing Confidence Kit delivery, bonus claim received, refund/access revoked, and support receipt messages only against approved test recipients. Production SPF, DKIM, and DMARC remain a launch gate.

Configure MailerLite groups for Pricing Confidence Kit, Preorders, Customers, Abandoned Checkout, Refunded, and Quiz. Set the matching MAILERLITE_GROUP_* IDs and test group assignment without sending a production broadcast.

Turnstile and analytics sandbox

Use Turnstile sandbox/test keys when available. Missing keys must fail safely and must not cause forms to trust unverified high-risk submissions.

GA4 and PostHog are optional sandbox integrations. Consent mode must block marketing analytics until accepted, while server-side operational events may record fulfillment/security events without signed URLs, secrets, tokens, or full PII.

Production remains blocked

Before production activation, Michael must approve legal copy, domain/email DNS, Supabase RLS, private Storage, Stripe test checkout/webhook/refund, protected download revocation, Resend/MailerLite sandbox sends, analytics consent behavior, and final launch QA. Do not activate live payments or a subscription offer in Prompt 6.

Prompt 7 sandbox verification

Prompt 7 documents provider-readiness without using production keys or deploying production. The complete report lives at docs/website-v4/14_SANDBOX_VERIFICATION_REPORT.md from this app directory.

Run the safe verification suite from the repository root:

pnpm check:sandbox
pnpm check:sandbox-env
pnpm check:deliverables
pnpm check:supabase-storage
pnpm check:stripe-test

Read docs/website-v4/14_SANDBOX_VERIFICATION_REPORT.md for the pass/fail/skipped table, missing env names, and next actions. Missing sandbox credentials are expected to report as skipped unless a dangerous live/prod pattern is detected. Placeholder values copied from example files are treated as missing, not provider-ready.

Provider-backed checks remain blocked until sandbox-only credentials are configured through secure local runtime variables or Vercel Preview env. Do not commit .env.local, .env.sandbox, API keys, signed URLs, customer exports, or provider secrets. Production remains locked: no live payments, no production deploy, and no live subscription offer.

Prompt 8 final handoff

Prompt 8 consolidated all website-related files into this self-contained app, which now lives at the repository root (it was author-site/ at the time). A future operator should start here, then read:

• docs/website-v4/15_FINAL_HANDOFF.md
• docs/website-v4/16_PRODUCTION_ACTIVATION_CHECKLIST.md
• docs/website-v4/17_FINAL_QA_REPORT.md
• docs/website-v4/18_VERCEL_PREVIEW_DEPLOYMENT_GUIDE.md

Preview may be deployed from Vercel with the root directory left at the repository root, after sandbox env vars are configured. Production remains blocked until Michael approves legal copy, claims, domain, live payment activation, provider configuration, and the production activation checklist.

Missing Gaps and Action Items

Following a recent codebase audit, several critical action items remain before the site can be considered fully production-ready. These are intentional gates or pending setup items that require human action:

1. Live Production Credentials (Blocked by Design)

The site is currently built to run in a sandbox. Live keys for Stripe (live payment processing), Supabase (production database/storage), Resend (email delivery), MailerLite (production subscriber groups), and Turnstile (bot protection) are intentionally left out. How to add it:

• Obtain live API keys from each respective provider.
• Inject them securely into the Vercel Production Environment Variables settings.
• Do not commit these keys to the repository or .env.local.

2. Funnel 4 (Ascension Ladder / Subscriptions)

Funnels 1, 2, and 3 are fully wired. Funnel 4 is intentionally stubbed per project rules. The database has "placeholder" tables for memberships, but the actual checkout flow and dashboard are not built. How to add it:

• Wait for explicit owner approval to activate paid subscriptions in v1.
• Once approved, build the subscription checkout flow leveraging the existing memberships and membership_events tables in Supabase.
• Update content/funnels.ts to replace "PROPOSED" pricing with actual live Stripe Price IDs.

3. Legal and Policy Approvals

The legal documents (Privacy Policy, Terms, Preorder Policy, Digital Delivery Policy) are outlines. How to add it:

• A human/attorney review must be conducted to finalize the copy for these pages.
• Update the respective .tsx files in app/privacy/, app/terms/, etc., with the approved text.

4. Admin Role Configuration

The Admin Dashboard (/admin/*) is wired to fetch real data from Supabase, but requires an authorized admin account to view it. How to add it:

• Add the owner's email address to the ADMIN_EMAILS environment variable as a comma-separated list.
• Ensure the user logs in via the site's authentication flow.

5. Final Domain & DNS Setup

How to add it:

• Select and approve the final domain.
• Configure DNS records for the domain, email sender (SPF, DKIM, DMARC for Resend), and point the domain to the Vercel production project.