spree_api 5.6.1 → 6.0.0.beta1

data/config/routes.rb

@@ -29,7 +29,14 @@ Spree::Core::Engine.add_routes do
             get :filters, to: 'products/filters#index'
           end
         end
+        # Public seller profiles. Read-only, and only sellers a shopper can
+        # actually buy from — see Store::SellersController.
+        resources :sellers, only: [:index, :show], id: /.+/
+
         resources :categories, only: [:index, :show], id: /.+/
+        resources :collections, only: [:index, :show] do
+          resources :products, controller: 'collections/products', only: [:index]
+        end
 
         # Carts
         resources :carts, only: [:index, :show, :create, :update, :destroy] do
@@ -48,10 +55,31 @@ Spree::Core::Engine.add_routes do
             end
           end
           resource :store_credits, only: [:create, :destroy], controller: 'carts/store_credits'
+          resource :tax_identifier, only: [:show, :update, :destroy], controller: 'carts/tax_identifiers'
+          resource :po_document, only: [:show, :create, :destroy], controller: 'carts/po_documents'
+        end
+
+        # Delivery methods (pickup discovery)
+        resources :delivery_methods, only: [:index, :show] do
+          member do
+            get :pickup_locations
+            get :pickup_points
+          end
         end
 
         # Orders (single order lookup, guest-accessible via order token)
-        resources :orders, only: [:show]
+        resources :orders, only: [:show] do
+          # Customer self-service returns — opening and viewing only; the
+          # merchant approves, receives and refunds through the Admin API.
+          resources :returns, only: [:index, :show, :create], controller: 'orders/returns' do
+            member do
+              get :label
+            end
+          end
+          resources :claims, only: [:index, :show, :create], controller: 'orders/claims'
+          # Read-only — the registration frozen onto the order at completion.
+          resource :tax_identifier, only: [:show], controller: 'orders/tax_identifiers'
+        end
 
         # Policies (return policy, privacy policy, terms of service, etc.)
         resources :policies, only: [:index, :show]
@@ -84,6 +112,14 @@ Spree::Core::Engine.add_routes do
           resources :credit_cards, only: [:index, :show, :destroy]
           resources :gift_cards, only: [:index, :show]
           resources :store_credits, only: [:index, :show]
+          # Plural for the list a checkout page offers; singular for reading or
+          # upserting one kind without knowing whether it exists yet.
+          resources :tax_identifiers, only: [:index], controller: 'tax_identifiers'
+          resource :tax_identifier, only: [:show, :update, :destroy], controller: 'tax_identifiers'
+          resources :digital_links, only: [:index, :show]
+          # GDPR subject rights the customer exercises for themselves — a copy
+          # of their data, or its erasure.
+          resources :data_requests, only: [:index, :show, :create]
           resources :payment_setup_sessions, only: [:create, :show] do
             member do
               patch :complete
@@ -91,6 +127,29 @@ Spree::Core::Engine.add_routes do
           end
         end
 
+        # Company self-service — the buyer's organization directory
+        # (docs/plans/6.0-b2b-companies-and-catalogs.md). Authorization is
+        # standing + the storefront access policy, never roles.
+        get 'account/companies', to: 'account/companies#index'
+
+        resources :companies, only: [:show, :update] do
+          resources :addresses, only: [:index, :create, :update, :destroy],
+                                controller: 'companies/addresses'
+          # POST takes customer_email — a membership for an existing customer,
+          # an invitation otherwise.
+          resources :members, only: [:index, :create, :destroy], controller: 'companies/members'
+          # DELETE revokes the invitation rather than erasing the record.
+          resources :invitations, only: [:index, :destroy], controller: 'companies/invitations'
+          # Completed purchases across the node's subtree.
+          resources :orders, only: [:index], controller: 'companies/orders'
+        end
+
+        # The invitee has no company yet — and no account — so the token flow
+        # is deliberately top-level and unauthenticated, unlike everything
+        # else about a company, which is reached through the node.
+        get 'company_invitations/:token', to: 'company_invitations#show', as: :company_invitation_lookup
+        post 'company_invitations/:token/accept', to: 'company_invitations#accept'
+
         # Wishlists
         resources :wishlists do
           resources :items, only: [:create, :update, :destroy], controller: 'wishlist_items'
@@ -98,7 +157,12 @@ Spree::Core::Engine.add_routes do
 
         # Digital Downloads
         # Access via token in URL
-        get 'digitals/:token', to: 'digitals#show', as: :digital_download
+        get 'digital_links/:token', to: 'digital_links#show', as: :digital_link_download
+        # Token-addressed so the emailed link works from a device that was
+        # never signed in.
+        get 'data_requests/:token/download', to: 'data_request_downloads#show', as: :data_request_download
+        # Legacy path — emailed and bookmarked URLs outlive the rename. Removed in 6.1.
+        get 'digitals/:token', to: 'digital_links#show', as: :digital_download
 
         # Data Feeds (public, no auth required)
         resources :feeds, only: [:show], controller: 'data_feeds', param: :slug
@@ -106,7 +170,7 @@ Spree::Core::Engine.add_routes do
 
       namespace :admin do
         # Mounts a nested `custom_fields` resource on parents that include
-        # Spree::Metafields. See docs/plans/5.4-6.0-custom-fields-rename.md.
+        # Spree::HasCustomFields. See docs/plans/5.4-6.0-custom-fields-rename.md.
         concern :custom_fieldable do
           resources :custom_fields
         end
@@ -119,8 +183,26 @@ Spree::Core::Engine.add_routes do
           resources :translations, only: [:index], controller: 'translations'
         end
 
+        # Mounts the uniform nested products surface on parents that curate
+        # products (categories, collections, catalogs, price lists). Bulk by
+        # design: POST adds and DELETE removes any number of products in one
+        # request. `positioned: true` adds per-member reposition where the
+        # membership carries a manual order. See
+        # Spree::Api::V3::Admin::ProductMembership.
+        concern :product_membership do |options|
+          resources :products, controller: options.fetch(:controller), only: [:index, :create] do
+            patch :reposition, on: :member if options[:positioned]
+          end
+          delete 'products', to: "#{options.fetch(:controller)}#destroy"
+        end
+
         # Definitions are per resource type, not per instance.
-        resources :custom_field_definitions
+        resources :custom_field_definitions do
+          collection do
+            # What a definition can be attached to, from the registry.
+            get :resource_types
+          end
+        end
 
         # Translation discovery: the translatable-resources registry and the
         # store's supported locales. See docs/plans/5.5-6.0-resource-translations-api.md.
@@ -131,26 +213,48 @@ Spree::Core::Engine.add_routes do
         # option values in one save). Flat list of independent registry writes.
         post 'translations/batch', to: 'translations/batches#create'
 
+        # Translation coverage across a whole resource type (?resource_type=),
+        # driving the centralized Translations page's grid.
+        get 'translations', to: 'translations_coverage#index'
+
         # Authentication
         post 'auth/login', to: 'auth#create'
         post 'auth/refresh', to: 'auth#refresh'
         post 'auth/logout', to: 'auth#logout'
 
+        # Provider discovery + SSO callback — unauthenticated; both are used
+        # before a session exists. Discovery drives the dashboard login page.
+        get 'auth/providers', to: 'auth#providers'
+        get 'auth/callback/:provider', to: 'auth#callback'
+
         # Public invitation acceptance — unauthenticated; the prefixed ID +
         # token in the URL act as the credential. Mounted under `auth/` so
         # the issued refresh-token cookie's path matches `/auth/refresh`.
         get 'auth/invitations/:id/lookup', to: 'invitation_acceptances#lookup'
         post 'auth/invitations/:id/accept', to: 'invitation_acceptances#accept'
 
+        # First-run setup — unauthenticated; the one-time setup token is the
+        # credential, and the flow self-disables once any admin user exists.
+        get 'auth/setup', to: 'setup#show'
+        get 'auth/setup/countries', to: 'setup#countries'
+        post 'auth/setup', to: 'setup#create'
+
         # Public password reset — unauthenticated; the token is the credential.
         # Mounted under `auth/` so the refresh-token cookie issued on success
         # shares its path with `/auth/refresh`.
         post 'auth/password_resets', to: 'password_resets#create'
         patch 'auth/password_resets/:id', to: 'password_resets#update'
 
-        # Dashboard
+        # Semantic reporting (docs/plans/6.0-analytics-semantic-layer.md)
+        namespace :reporting do
+          post :query
+          get :schema
+          resources :saved_reports, only: %i[index show create update destroy]
+        end
+
+        # Dashboard (point-in-time counts registered on Spree.reporting)
         namespace :dashboard do
-          get :analytics
+          get :counters
         end
 
         # Current admin user + permissions (for UI permission checks)
@@ -159,7 +263,9 @@ Spree::Core::Engine.add_routes do
         patch 'me', to: 'me#update'
 
         # Store Settings
-        resource :store, only: [:show, :update], controller: 'store'
+        resource :store, only: [:show, :update], controller: 'store' do
+          get :data_sources
+        end
 
         # Staff & access (invitations, admin users, roles, API keys)
         resources :admin_users, only: [:index, :show, :update, :destroy]
@@ -189,7 +295,8 @@ Spree::Core::Engine.add_routes do
             end
           end
         end
-        resources :roles, only: [:index, :show]
+        resources :roles, only: [:index, :show, :create, :update, :destroy]
+        resources :permissions, only: [:index]
 
         # Direct Uploads (Active Storage)
         resources :direct_uploads, only: [:create]
@@ -216,14 +323,25 @@ Spree::Core::Engine.add_routes do
         end
 
         # Products
+        resources :product_types do
+          member do
+            post :apply_to_products
+          end
+        end
         resources :products, concerns: [:custom_fieldable, :translatable] do
           member do
             post :clone
+            # Closing a review a seller opened
+            # (docs/plans/6.0-seller-product-submission.md).
+            patch :approve
+            patch :reject
           end
           collection do
             post :bulk_status_update
             post :bulk_add_to_categories
             post :bulk_remove_from_categories
+            post :bulk_add_to_collections
+            post :bulk_remove_from_collections
             post :bulk_add_to_channels
             post :bulk_remove_from_channels
             post :bulk_add_tags
@@ -234,6 +352,29 @@ Spree::Core::Engine.add_routes do
             resources :media, controller: 'media', only: [:index, :create, :update, :destroy]
           end
           resources :media, controller: 'media', only: [:index, :create, :update, :destroy]
+          resources :digital_assets, controller: 'products/digital_assets',
+                                     only: [:index, :create, :show, :update, :destroy] do
+            collection do
+              get :providers
+            end
+          end
+        end
+
+        # Digital download grants — read and reset only; they are created by
+        # order completion, never by hand.
+        resources :digital_links, only: [:index, :show] do
+          member do
+            patch :reset
+          end
+        end
+
+        # Media library — every file in the store, placed or not. Files are put
+        # ON a product through the nested media routes above; this is where they
+        # are uploaded, browsed and deleted.
+        resources :media, controller: 'media_library', only: [:index, :show, :create, :update, :destroy] do
+          member do
+            get :usage
+          end
         end
 
         # Categories
@@ -243,39 +384,122 @@ Spree::Core::Engine.add_routes do
           end
 
           # Manual product membership + ordering within the category.
-          # (Bulk add/remove reuse POST /products/bulk_{add,remove}_*_categories.)
-          resources :products, controller: 'categories/products', only: [:index, :create, :destroy] do
-            member do
-              patch :reposition
-            end
-          end
+          concerns :product_membership, controller: 'categories/products', positioned: true
         end
 
+        # Collections (flat, merchandising). Reordering the collection itself is a
+        # plain `position` update (acts_as_list reorders on save), so there is no
+        # top-level reposition action — only the nested membership has one.
+        resources :collections, concerns: [:custom_fieldable, :translatable] do
+          # Manual product membership + ordering within the collection.
+          concerns :product_membership, controller: 'collections/products', positioned: true
+        end
+
+        # Subclass discovery for the collection rules editor, mirroring
+        # `/promotion_rules/types`. Top-level (and read-only) because rules are
+        # written through the collection's own `rules` setter, not nested CRUD.
+        get 'collection_rules/types', to: 'collection_rules#types'
+
         # Option Types (with nested option_values in payload)
         resources :option_types, concerns: [:custom_fieldable, :translatable]
 
+        # Store policies (terms of service, privacy, returns, shipping, …)
+        resources :policies, concerns: [:translatable]
+
         # Tax Categories
         resources :tax_categories
 
+        # Tax Rates — the internal tax provider's configuration
+        resources :tax_rates
+
+        # Selectable tax engines and their declared limits (discovery only)
+        resources :tax_providers, only: [:index]
+        # How sellers get paid. Discovery only — the choice itself is a store
+        # preference, so there is nothing here to create.
+        resources :payout_providers, only: [:index]
+
+        # Return / claim / refund / cancellation reasons (dropdowns + settings management)
+        resources :return_reasons
+        resources :claim_reasons
+        resources :refund_reasons
+        resources :order_cancellation_reasons
+
         # Markets
         resources :markets
 
-        # Store Credit Categories (read-only — for store credit dropdowns)
-        resources :store_credit_categories, only: [:index, :show]
-
         # Inventory
         resources :stock_locations
         resources :stock_reservations, only: [:index, :show]
-        resources :stock_items, only: [:index, :show, :update, :destroy]
-        resources :stock_transfers, only: [:index, :show, :create, :destroy]
+        resources :stock_levels, only: [:index, :show, :update, :destroy] do
+          collection do
+            post :bulk_upsert
+          end
+        end
+        resources :stock_movements, only: [:index, :show]
+        resources :stock_transfers do
+          member do
+            patch :mark_ready
+            patch :mark_in_transit
+            patch :mark_draft
+            patch :close
+            patch :cancel
+          end
+          resources :stock_receipts, only: [:index, :show, :create], module: :stock_transfers
+        end
+
+        # Purchasing
+        resources :suppliers
+        resources :purchase_orders do
+          member do
+            patch :mark_ordered
+            patch :mark_draft
+            patch :close
+            patch :cancel
+          end
+          resources :stock_receipts, only: [:index, :show, :create], module: :purchase_orders
+        end
 
         # Payment Methods
+        resources :delivery_methods do
+          collection do
+            get :calculators
+            get :fulfillment_providers
+            get :rate_providers
+          end
+          resources :rules, controller: 'delivery_methods/rules', only: [:index, :show, :create, :update, :destroy]
+        end
+        resources :tracking_carriers, only: [:index]
+        resources :delivery_method_rules, only: [] do
+          collection do
+            get :types
+          end
+        end
+        resources :delivery_zones
+        resources :package_types
+
+        resources :delivery_profiles do
+          collection do
+            get :kinds
+          end
+          resources :origin_groups, controller: 'delivery_profiles/origin_groups',
+                                    only: [:index, :show, :create, :update, :destroy]
+        end
+
         resources :payment_methods do
           collection do
             get :types
           end
         end
 
+        resources :integrations do
+          collection do
+            get :types
+          end
+          member do
+            post :test
+          end
+        end
+
         # Promotions, with nested actions/rules/coupon codes.
         resources :promotions do
           resources :promotion_actions, only: [:index, :show, :create, :update, :destroy]
@@ -305,6 +529,19 @@ Spree::Core::Engine.add_routes do
           resources :addresses, controller: 'customers/addresses'
           resources :credit_cards, controller: 'customers/credit_cards', only: [:index, :show, :destroy]
           resources :store_credits, controller: 'customers/store_credits'
+          resources :tax_identifiers, controller: 'customers/tax_identifiers' do
+            member do
+              post :validate
+            end
+          end
+
+          member do
+            # GDPR: answer a subject access request, or carry out an erasure.
+            # Both are how these requests actually arrive — by email to the
+            # merchant, from people who often can no longer sign in.
+            get :export
+            post :anonymize
+          end
 
           collection do
             post :bulk_add_to_groups
@@ -314,9 +551,164 @@ Spree::Core::Engine.add_routes do
           end
         end
 
+        # GDPR compliance log. Requests are records of what happened, so they
+        # are created and read but never edited or deleted — an editable audit
+        # trail is not one.
+        resources :data_requests, only: [:index, :show, :create]
+        resources :consent_records, only: [:index, :show]
+
         # Customer groups (segmentation; used by promotion rules + bulk customer ops)
         resources :customer_groups
 
+        # Marketplace sellers. Each status change is its own member action
+        # because each one is a workflow with its own arguments — mass
+        # assignment would skip the mail and the extension hooks.
+        resources :sellers, concerns: :custom_fieldable do
+          member do
+            post :invite
+            patch :approve
+            patch :suspend
+            patch :reject
+            # Where the seller stands against the marketplace's checklist,
+            # and the way back to onboarding when something has to be redone.
+            get :onboarding
+            patch :reopen_onboarding
+          end
+
+          # Where the seller stands on the ledger, one row per currency.
+          resources :balances, only: [:index], controller: 'sellers/balances'
+
+          # Settling this seller by hand. The scheduled sweep skips anyone on
+          # the `manual` interval — this is where the operator decides.
+          resources :payouts, only: [:create], controller: 'sellers/payouts'
+
+          # Who runs this seller, and the offers nobody has accepted yet.
+          # The operator is the only one who can repair a seller whose team
+          # has locked itself out, which the seller's own panel cannot do.
+          resources :team, only: [:index, :destroy], controller: 'sellers/team'
+          resources :invitations, only: [:index, :destroy], controller: 'sellers/invitations' do
+            member do
+              patch :resend
+            end
+          end
+
+          # What this seller submitted about the requirements, and the
+          # operator's decisions on it. Nested, because a submission means
+          # nothing outside the seller it belongs to.
+          resources :requirement_submissions, only: [:index, :show, :create],
+                                              controller: 'seller_requirement_submissions' do
+            member do
+              patch :accept
+              patch :reject
+              get :download
+            end
+          end
+        end
+
+        # What this marketplace asks of a seller before it will let them
+        # trade. Configuration, so it hangs off the store rather than a
+        # seller.
+        resources :seller_requirements do
+          collection do
+            get :types
+          end
+        end
+
+        # Commissions — what the marketplace charges its sellers. Rates are
+        # configuration; lines are the record of what was charged, so they are
+        # read-only.
+        resources :commission_rates do
+          collection do
+            get :rule_types
+          end
+        end
+        resources :commission_lines, only: [:index, :show]
+
+        # The fund ledger — what sellers earned, and what has been sent them.
+        # Both are written by fulfilment and by the sweep rather than by a
+        # caller, so both are read-only. The one thing an operator does is say
+        # a settlement landed, which the built-in provider depends on: it
+        # records what to send and waits to be told it went.
+        resources :seller_transfers, only: [:index, :show]
+        resources :seller_payouts, only: [:index, :show] do
+          member do
+            patch :complete
+          end
+        end
+
+        # What one checkout produced when it reached several sellers. Read-only:
+        # everything an operator acts on lives on the orders inside it.
+        resources :order_groups, only: [:index, :show]
+
+        # Business customers — a tree of company nodes. Nested collections are
+        # listed and created under their node and then addressed directly, so
+        # a caller holding an entry id does not have to know its company.
+        resources :companies do
+          # The node's address book.
+          resources :addresses, controller: 'companies/addresses'
+
+          # The people with standing over the node. Creation takes an email:
+          # a membership for an existing customer, an invitation otherwise.
+          resources :memberships, controller: 'companies/memberships',
+                                  only: [:index, :show, :create, :destroy]
+          # DELETE revokes the invitation rather than erasing the record.
+          resources :invitations, controller: 'companies/invitations',
+                                  only: [:index, :show, :destroy]
+
+          # The business's own registration — the number on its invoices, which
+          # outranks the buyer's own. Same shape as the customer's.
+          resources :tax_identifiers, controller: 'companies/tax_identifiers' do
+            member do
+              post :validate
+            end
+          end
+
+          # Exemption evidence. Accepting or withdrawing one is its own action —
+          # never mass assignment — and a verified certificate is revoked
+          # rather than deleted.
+          resources :tax_exemption_certificates, controller: 'companies/tax_exemption_certificates' do
+            member do
+              patch :verify
+              patch :revoke
+              get :download
+            end
+          end
+        end
+
+
+        # Catalogs — assortment + optional price list, assigned to a buyer
+        # audience (customer group, or company subtree).
+        resources :catalogs do
+          member do
+            post :assign
+            post :import_products
+            # Going live is its own act, not a column write: an agreement is
+            # checked before it starts reaching buyers, and what has to happen
+            # alongside hangs off the workflow's hooks.
+            patch :activate
+            patch :deactivate
+          end
+          # Assortment membership. Unordered: a catalog decides what a buyer
+          # sees, never the order they see it in.
+          concerns :product_membership, controller: 'catalogs/products'
+
+          # Commercial terms. Typed per grain rather than one rules endpoint:
+          # quantity rules are per variant, minimums are per currency.
+          #
+          # Quantity rules are written as a whole set, because the agreement
+          # editor stages every term behind the catalog's Save: a half-applied
+          # agreement is not a state to leave a merchant in. They are read
+          # back on the assortment rows themselves (`expand=quantity_rule` on
+          # this catalog's products), where the variants they roll up are
+          # already loaded (docs/plans/6.0-volume-pricing.md).
+          resources :quantity_rules, controller: 'catalogs/quantity_rules', only: [] do
+            collection { put :upsert, path: '' }
+          end
+          resources :order_minimums, controller: 'catalogs/order_minimums',
+                                     only: [:index, :show, :create, :update, :destroy]
+        end
+        resources :catalog_assignments, only: [:show, :destroy]
+
         # Price lists
         resources :price_lists do
           collection do
@@ -326,6 +718,9 @@ Spree::Core::Engine.add_routes do
             patch :activate
             patch :deactivate
           end
+          # Which products the list prices. Adding materializes placeholder
+          # prices per variant x currency; removing hard-deletes the rows.
+          concerns :product_membership, controller: 'price_lists/products'
         end
 
         # Prices (generic — covers base prices AND price-list overrides).
@@ -340,6 +735,18 @@ Spree::Core::Engine.add_routes do
         resources :gift_cards
         resources :gift_card_batches, only: [:index, :show, :create]
 
+        # Store credits across all customers. Read-only: issuing, editing and
+        # deleting a credit stays nested under the customer that holds it.
+        resources :store_credits, only: [:index, :show] do
+          resources :events, only: [:index], controller: 'store_credits/events'
+        end
+
+        # Post-sale, across all orders. Read-only — creating any of these
+        # needs an order, so writes live under /orders/:order_id/...
+        resources :returns, only: [:index, :show]
+        resources :exchanges, only: [:index, :show]
+        resources :claims, only: [:index, :show]
+
         # Channels (per-store distribution surfaces)
         resources :channels do
           member do
@@ -367,18 +774,64 @@ Spree::Core::Engine.add_routes do
             patch :complete
             patch :cancel
             patch :approve
-            patch :resume
             post :resend_confirmation
+            post :resend_digital_links
+            # The buyer's purchase order, streamed through the API so it is
+            # never reachable without admin credentials.
+            get :po_document
           end
 
           resources :items, only: [:index, :show, :create, :update, :destroy], controller: 'orders/items'
           resources :fulfillments, controller: 'orders/fulfillments', only: [:index, :show, :create, :update] do
             member do
               patch :fulfill
+              patch :mark_delivered
               patch :cancel
-              patch :resume
               patch :split
             end
+
+            resources :labels, controller: 'orders/labels', only: [:index, :show, :create, :destroy] do
+              member do
+                get :download
+                patch :refund
+              end
+            end
+            resources :deliveries, controller: 'orders/deliveries', only: [:index, :show, :create, :update, :destroy] do
+              member do
+                patch :mark_delivered
+              end
+            end
+          end
+          resources :returns, controller: 'orders/returns', only: [:index, :show, :create, :update] do
+            member do
+              patch :approve
+              patch :receive
+              patch :refund
+              patch :cancel
+            end
+
+            resources :labels, controller: 'orders/labels', only: [:index, :show, :create, :destroy] do
+              member do
+                get :download
+                patch :refund
+              end
+            end
+          end
+          resources :exchanges, controller: 'orders/exchanges', only: [:index, :show, :create, :update] do
+            member do
+              patch :approve
+              patch :receive
+              patch :fulfill
+              patch :cancel
+            end
+          end
+          resources :claims, controller: 'orders/claims', only: [:index, :show, :create, :update] do
+            member do
+              patch :approve
+              patch :resolve
+              patch :deny
+              patch :cancel
+            end
           end
           resources :payments, controller: 'orders/payments', only: [:index, :show, :create] do
             member do
@@ -387,15 +840,270 @@ Spree::Core::Engine.add_routes do
             end
           end
           resources :refunds, controller: 'orders/refunds', only: [:index, :create]
-          resources :adjustments, controller: 'orders/adjustments', only: [:index, :show]
+          resources :tax_lines, controller: 'orders/tax_lines', only: [:index, :show]
+          # Read-only — the registration frozen onto the order at completion.
+          resource :tax_identifier, controller: 'orders/tax_identifiers', only: [:show]
+          resources :discounts, controller: 'orders/discounts', only: [:index, :show, :create, :update, :destroy]
+          resources :discount_codes, controller: 'orders/discount_codes', only: [:create, :destroy]
+          resources :fees, controller: 'orders/fees', only: [:index, :show, :create, :update, :destroy]
           resources :gift_cards, controller: 'orders/gift_cards', only: [:create, :destroy]
           resource :store_credits, controller: 'orders/store_credits', only: [:create, :destroy]
         end
       end
 
+      # The marketplace seller panel. A branch of its own rather than a
+      # narrowing of :admin — every endpoint here scope-fetches through
+      # current_seller, which is what makes cross-seller access impossible by
+      # construction rather than by rule.
+      namespace :seller do
+        # Everything unauthenticated lives under auth/, so the refresh
+        # cookie's path covers it and nothing else.
+        post 'auth/login', to: 'auth#create'
+        post 'auth/refresh', to: 'auth#refresh'
+        post 'auth/logout', to: 'auth#logout'
+        get 'auth/providers', to: 'auth#providers'
+
+        # Public invitation acceptance — unauthenticated; the prefixed ID +
+        # token in the emailed link are the credential.
+        get 'auth/invitations/:id/lookup', to: 'invitation_acceptances#lookup'
+        post 'auth/invitations/:id/accept', to: 'invitation_acceptances#accept'
+
+        # Public password reset — unauthenticated; the emailed token is the
+        # credential. Under `auth/` so the refresh cookie issued on success
+        # shares its path with `/auth/refresh`.
+        post 'auth/password_resets', to: 'password_resets#create'
+        patch 'auth/password_resets/:id', to: 'password_resets#update'
+
+        get 'me', to: 'me#show'
+
+        # Singular: the seller in play is always `current_seller`.
+        resource :profile, only: [:show, :update], controller: 'profile'
+
+        # The seller's own registrations — a collection, like a company's: a
+        # business trading in several regimes holds one in each.
+        resources :tax_identifiers, only: [:index, :create, :update, :destroy],
+                                    controller: 'tax_identifiers' do
+          member do
+            post :validate
+          end
+        end
+
+        resources :team, only: [:index, :create, :destroy], controller: 'team'
+
+        # Creating an invitation is hiring, so it lives on `team`; chasing or
+        # withdrawing one is bookkeeping on the offer.
+        resources :invitations, only: [:index, :destroy], controller: 'invitations' do
+          member do
+            patch :resend
+          end
+        end
+
+        resources :products, only: [:index, :show, :create, :update, :destroy] do
+          # Status moves are actions, not an attribute: putting a product on
+          # sale is the marketplace's call, so a seller asks rather than sets.
+          member do
+            patch :submit
+            patch :draft
+            patch :archive
+          end
+
+          # The same three moves over a selection. Only the ones a seller may
+          # make alone: there is no bulk route onto `active`, because reaching
+          # it is the operator's decision on one listing at a time.
+          collection do
+            post :bulk_submit
+            post :bulk_status_update
+            delete :bulk_destroy
+          end
+        end
+
+
+        # What this seller has sold. Cancelling is a member action because it
+        # is a workflow with its own arguments, and fulfilling is nested: a
+        # parcel means nothing outside the order it belongs to.
+        #
+        # No `update`: an order is created by a shopper checking out and its
+        # terms are the marketplace's, so the branch routes no general write.
+        # Correcting a delivery address is the one exception a merchant of
+        # record needs, and it is its own named action rather than a PATCH
+        # that would accept whatever the order serializer happens to permit.
+        resources :orders, only: [:index, :show] do
+          member do
+            patch :cancel
+            patch :address
+          end
+
+          # Singular: an order has one set of notes, so they are a resource to
+          # read and update rather than a verb on the order.
+          resource :notes, only: [:show, :update], controller: 'orders/notes'
+
+          # No `mark_delivered`: that a parcel arrived is the buyer's word,
+          # not the sender's, so confirming receipt stays with the operator
+          # and the carrier feed.
+          resources :fulfillments, only: [:index, :show, :update], controller: 'orders/fulfillments' do
+            member do
+              patch :fulfill
+              patch :cancel
+              patch :split
+            end
+
+            # A parcel's consignments and its postage. Both hang off the
+            # fulfillment because that is what actually travels.
+            resources :deliveries, controller: 'orders/deliveries', only: [:index, :show, :create, :update, :destroy]
+            resources :labels, controller: 'orders/labels', only: [:index, :show, :create, :destroy] do
+              member do
+                get :download
+              end
+            end
+          end
+
+          # Putting a sale right. The seller is merchant of record for their
+          # own child order, so taking the goods back and giving the money
+          # back are theirs (docs/plans/6.0-seller-order-management.md).
+          # Every status move is its own action, because each carries
+          # arguments of its own — receiving records what actually arrived,
+          # refunding names a method and an amount.
+          resources :returns, only: [:index, :show, :create], controller: 'orders/returns' do
+            member do
+              patch :approve
+              patch :receive
+              patch :refund
+              patch :cancel
+            end
+          end
+
+          resources :exchanges, only: [:index, :show, :create], controller: 'orders/exchanges' do
+            member do
+              patch :approve
+              patch :receive
+              patch :fulfill
+              patch :cancel
+            end
+          end
+
+          resources :claims, only: [:index, :show, :create], controller: 'orders/claims' do
+            member do
+              patch :approve
+              patch :resolve
+              patch :deny
+              patch :cancel
+            end
+          end
+        end
+
+        # The marketplace's own vocabularies. Read-only: a seller picks a
+        # reason, the operator decides what the reasons are.
+        resources :return_reasons, only: [:index]
+        resources :claim_reasons, only: [:index]
+        resources :order_cancellation_reasons, only: [:index]
+
+        # Registry data — which carriers a tracking number can be pinned to.
+        resources :tracking_carriers, only: [:index]
+
+        resources :direct_uploads, only: [:create]
+
+        # CSV of what this seller sold, or of their catalogue. Created, polled
+        # and downloaded — no index, since a seller has no history page to
+        # list, and no destroy, since retention is the marketplace's business.
+        resources :exports, only: [:create, :show] do
+          member do
+            get :download
+          end
+        end
+
+        # Bulk-listing a catalog by CSV. The operator's pipeline, narrowed to
+        # this seller: rows may only resolve onto their own products, and the
+        # products they create are theirs and land as drafts for review
+        # (docs/plans/5.6-admin-spa-csv-import.md).
+        resources :imports, only: [:index, :show, :create, :destroy] do
+          collection do
+            get :template
+            get :example
+          end
+          member do
+            patch :complete_mapping
+            patch :retry_failed_rows
+            get :download
+          end
+          resources :rows, only: [:index], controller: 'import_rows'
+        end
+
+        # The types a seller may list against. Read only — defining a type is
+        # the operator's (docs/plans/6.0-seller-product-submission.md).
+        resources :product_types, only: [:index, :show]
+
+        # The marketplace's delivery vocabulary, for the product form's picker.
+        # Read only: a seller assigns a profile, never creates one
+        # (docs/plans/6.0-multi-vendor-marketplace.md, Decision 13).
+        resources :delivery_profiles, only: [:index]
+
+        # The marketplace's zones, for the destination picker on a seller's
+        # own method. Read only for the same reason profiles are: where the
+        # marketplace ships is its own decision
+        # (docs/plans/6.0-multi-vendor-marketplace.md, Decision 13).
+        resources :delivery_zones, only: [:index]
+
+        # How this seller ships. The listing carries the marketplace methods
+        # shared with sellers alongside the seller's own; only the seller's
+        # own can be written.
+        resources :delivery_methods do
+          collection do
+            get :calculators
+            get :rule_types
+          end
+        end
+
+        # What this seller packs into. The listing carries the marketplace's
+        # own packaging alongside the seller's; only the seller's own can be
+        # written (docs/plans/6.0-seller-package-types.md).
+        resources :package_types
+
+        # No destroy: a location holds stock levels and is named on historical
+        # fulfillments, so a seller retires one by deactivating it.
+        resources :stock_locations, only: [:index, :show, :create, :update]
+
+        resources :countries, only: [:index]
+
+        # The seller's own policy documents.
+        resources :policies
+
+        # The seller's own books, read-only: where they stand, what each
+        # order earned them, and what has been sent. Written by fulfilment
+        # and the sweep, never by the seller.
+        resources :balances, only: [:index]
+        resources :transfers, only: [:index, :show]
+        resources :payouts, only: [:index, :show]
+
+        # Singular: the checklist is always `current_seller`'s.
+        resource :onboarding, only: [:show], controller: 'onboarding' do
+          post :submit_for_review
+          # A fresh link to the payout provider's own onboarding. A POST
+          # because asking for one creates the account at the provider if the
+          # seller has none.
+          post :payout_account
+        end
+
+        resources :requirements, only: [] do
+          resources :submissions, only: [:create], controller: 'requirement_submissions'
+        end
+        resources :requirement_submissions, only: [] do
+          member do
+            get :download
+          end
+        end
+      end
+
       # Webhooks (outside of store namespace — no API key authentication)
       namespace :webhooks do
         post 'payments/:payment_method_id', to: 'payments#create', as: :payment_webhook
+        post 'fulfillments/:integration_id', to: 'fulfillments#create', as: :fulfillment_webhook
+        # Marketplace events about sellers rather than about a payment —
+        # whether a seller may be paid, and whether a payout reached their
+        # bank. A separate endpoint because providers scope these separately:
+        # events originating in a seller's own account arrive on a different
+        # subscription, with a different signing secret, than the
+        # marketplace's own payment events.
+        post 'payouts/:payment_method_id', to: 'payouts#create', as: :payout_webhook
       end
     end
   end