Aava — Autonomous Commerce Operator

Aava helps independent Indian fashion sellers turn phone photos and a spoken or typed product note into a polished, publishable listing. It combines a mobile-first merchant workspace, AI product understanding, pricing guidance, studio-style imagery, review controls, a public storefront, growth analytics, and short-form video preparation.

The interface supports English and Telugu capture, light and dark themes, and tenant-scoped merchant accounts through Supabase Auth.

What works

• Email/password and Google authentication with one isolated boutique per Supabase user
• Mobile capture for up to six JPG, PNG, or WebP product photos
• Secure direct-to-Supabase uploads, avoiding the hosting platform's request-body limit
• English or Telugu voice transcription; the editable transcript is the source used for analysis
• Vision analysis for fabric, colours, garment type, work, occasions, style, audience, and listing facts
• Budget, mid-market, and premium pricing options with reasoning
• Automatic or merchant-selected visual direction: vintage, modern, elegant, minimal, festive, or editorial
• Three vertical studio images: catalog, lifestyle, and campaign
• Image fidelity checks against the merchant's originals before approval
• Listing title, short and long copy, highlights, Instagram captions, and hashtags
• Per-asset approve/reject review, SKU assignment, and publishing
• Public storefront with natural-language product search
• Product visits, enquiries, orders, revenue, and AI-assisted growth recommendations
• Approved-product 8-second 9:16 Reel generation, preview, MP4 download, caption, hashtags, and manual sharing
• Product deletion, responsive layouts, preserved image proportions, and light/dark themes

All AI features call the configured OpenAI API. Product, task, approval, analytics, and asset metadata are stored in Supabase; original and generated media are stored in Supabase Storage.

Technology

• Next.js 16, React 19, TypeScript 5.9, and Tailwind CSS 4
• Supabase Auth, Postgres, Row Level Security, and Storage
• OpenAI Node SDK with gpt-4.1, gpt-image-2, whisper-1, and sora-2
• Vinext, Vite, Wrangler, and Cloudflare Workers-compatible hosting
• Zod for structured AI and request validation

OpenAI models used

Aava uses OpenAI in two distinct ways:

1. Development-time engineering: the application was designed, implemented, debugged, and reviewed with OpenAI Codex powered by the GPT-5 family. This includes the agentic coding workflow used to build the Next.js application, API routes, Supabase integration, responsive interface, tests, and deployment setup. Codex is a development tool and is not called when a merchant uses the deployed application.
2. Runtime product features: the deployed backend makes real OpenAI API calls using the models below. These are the models that affect API usage and cost during an Aava product workflow.

Model	How Aava uses it
gpt-4.1	Understands merchant photos and English/Telugu context; extracts product facts; generates pricing options, listing copy, natural-language storefront search results, fidelity checks, and growth recommendations
gpt-image-2	Recreates the merchant's garment as catalog, lifestyle, and campaign photography while using the original photos as product-identity references
whisper-1	Transcribes English or Telugu voice notes without translating Telugu into English; the merchant can edit the transcript before analysis
sora-2	Generates the approved product's 8-second, 9:16 Reel with a restrained premium visual direction and soft instrumental audio

The runtime currently defaults to gpt-4.1, not GPT-5 or GPT-5.6. The GPT-5 family was used through Codex to build the project; it should not be described as a production API dependency unless OPENAI_TEXT_MODEL or OPENAI_VISION_MODEL is deliberately changed and the new model is tested against Aava's structured-output schemas.

Product flow

1. The merchant signs in and captures or uploads product photos.
2. Aava transcribes English or Telugu speech, then lets the merchant correct the transcript.
3. Photos upload directly to the product-images bucket and the intake API creates a tenant-owned draft product.
4. A background task runs GPT vision analysis and saves the product truth record.
5. The merchant confirms cost, positioning, and an optional visual style.
6. Aava generates pricing, three studio images, fidelity results, and listing copy.
7. The merchant approves or rejects each review item; approval assigns a SKU and publishes the product.
8. Published products appear in the storefront and can be used to create a Sora Reel.

Prerequisites

• Node.js 22.13 or newer
• pnpm
• An OpenAI API project with billing enabled and access to the configured models
• A Supabase project
• For Google login, Google OAuth credentials configured in Supabase Auth

Local setup

git clone https://github.com/princelevin/AAVA.git
cd AAVA
pnpm install
cp .env.example .env.local
pnpm dev

Open http://localhost:3000.

Environment variables

Variable	Required	Visibility	Purpose
OPENAI_API_KEY	Yes	Server only	OpenAI API authentication
OPENAI_TEXT_MODEL	No	Server only	Text/structured model; defaults to gpt-4.1
OPENAI_VISION_MODEL	No	Server only	Product and fidelity vision model; defaults to gpt-4.1
OPENAI_IMAGE_MODEL	No	Server only	Image model; defaults to gpt-image-2
OPENAI_VIDEO_MODEL	No	Server only	Video model; defaults to sora-2
OPENAI_TRANSCRIPTION_MODEL	No	Server only	Audio model; defaults to whisper-1
NEXT_PUBLIC_SUPABASE_URL	Yes	Browser-safe	Supabase project URL
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY	Recommended	Browser-safe	Current Supabase publishable key
NEXT_PUBLIC_SUPABASE_ANON_KEY	Alternative	Browser-safe	Legacy anon-key fallback
SUPABASE_ANON_KEY	Alternative	Server only	Server-side legacy anon-key fallback
SUPABASE_SERVICE_ROLE_KEY	Yes	Server only	Privileged database and storage operations
SUPABASE_SECRET_KEY	Alternative	Server only	Modern secret-key alternative to the service-role key
NEXT_PUBLIC_APP_URL	Yes	Browser-safe	App origin, such as http://localhost:3000

Use either the recommended publishable key or one anon-key fallback. Use either SUPABASE_SERVICE_ROLE_KEY or SUPABASE_SECRET_KEY. Never expose either server secret through a NEXT_PUBLIC_ variable.

Supabase setup

1. Create storage buckets

Create these buckets in Supabase Storage:

Bucket	Access
product-images	Public
generated-assets	Public
audio	Private

2. Apply the database migrations

Run the SQL files in filename order. The first three establish the working multi-merchant app:

1. 202607210000_initial_schema.sql — products, images, approvals, tasks, indexes, grants, and initial policies
2. 202607210001_add_commerce_analytics.sql — visits, enquiries, and orders
3. 202607210002_add_auth_and_tenancy.sql — merchant profiles, auth trigger, tenant ownership, RLS, and storage policies

The migrations are idempotent and can be pasted into the Supabase SQL editor. The final tenant-aware migration replaces the intentionally permissive bootstrap policies.

3. Configure authentication

In Supabase Authentication:

• Enable email/password.
• Optionally enable Google.
• Set the local site URL to http://localhost:3000.
• Add http://localhost:3000/auth/callback and the deployed /auth/callback URL to the redirect allow list.

New users receive a merchant_profiles row automatically. Their Supabase user UUID is stored as products.business_id, so dashboard data stays separated by boutique.

4. Optional Maanvi demo store

After the first three migrations:

1. Start the app and sign up with owner name Manvitha, boutique name Maanvi, email demo@maanvi.in, and password demo123. If email confirmation is enabled, confirm the account.
2. Upload public/aava-catalog-triptych.png to generated-assets/demo/maanvi-catalog-triptych.png without changing its name or path.
3. Run 202607210003_seed_maanvi_demo_catalog.sql.
4. Run 202607210004_seed_maanvi_demo_analytics.sql.

The two seed migrations are idempotent. They add three demo catalog products plus current-month sample visits, enquiries, and completed orders. Change the demo password before any non-demo use.

Application routes

Route	Purpose
/	Public marketing homepage
/auth/sign-up	Boutique registration
/auth/sign-in	Merchant and demo sign-in
/dashboard	Tenant-scoped product workspace
/products/new	Photo, voice, transcript, language, and style capture
/products/[productId]	Analysis, clarification, generation, review, publishing, and Reel workflow
/growth	Real visits, enquiries, orders, revenue, and growth guidance
/shop?storefront=<slug>	Public boutique storefront and AI search

The route handlers under app/api cover intake, transcription, analysis, pricing, image generation, review, deletion, video generation/status, storefront search, visits, enquiries, orders, dashboard data, and growth analysis.

Project structure

app/                    Next.js pages, layouts, styles, auth callback, and API routes
components/             Shared auth, dashboard, media, sign-out, and theme components
lib/                    OpenAI orchestration, Supabase clients, auth, audio, and client utilities
public/                 Brand assets, social image, and the optional Maanvi demo catalog image
supabase/migrations/    Core schema, tenancy, analytics, and optional demo seeds
tests/                  Rendered production HTML smoke tests
worker/                 Cloudflare/Vinext worker entry point
build/                  Sites/Vite integration
proxy.ts                Supabase session refresh and merchant-route protection
vite.config.ts          Vinext/Vite build configuration

Commands

pnpm dev        # local development server
pnpm build      # production build
pnpm start      # serve the production build
pnpm typecheck  # TypeScript validation
pnpm lint       # ESLint
pnpm test       # production build plus rendered HTML smoke tests

Security notes

• .env.local, .dev.vars, build output, caches, logs, editor settings, and OS files are ignored by Git.
• The Supabase service-role/secret key and OpenAI key must remain server-only.
• Public storefront endpoints return only published products; merchant routes verify the authenticated business ID.
• Storage object paths begin with the owning user's UUID, and the tenancy migration installs matching storage policies.
• Social sharing is merchant-initiated. Aava prepares the media and copy but does not post automatically.