@btst/stack 5.0.0 → 5.2.0

package/dist/packages/stack/src/plugins/ecommerce/api/operations.mjs

@@ -0,0 +1,517 @@
+import { defineOperation, OperationHttpError } from '@btst/stack/plugins/api';
+import { z } from 'zod';
+import { ecommercePermissions } from '../../../../../../plugins/ecommerce/permissions.mjs';
+import { cartItemSchema, orderStatusSchema, ordersQuerySchema, checkoutSchema, createDiscountSchema, updateInventorySchema, productSchema, productsQuerySchema } from '../schemas.mjs';
+import { getOrder, listOrders, getInventory, getDiscountCode, getProduct, listProducts } from './getters.mjs';
+import { ecommerceError, requireAtomicTransactions, releaseInventory, initializeInventory, reserveInventory, productSnapshot, createProduct } from './mutations.mjs';
+import { serializeOrder } from './serializers.mjs';
+
+const idSchema = z.object({ id: z.string().min(1).max(200) });
+const discountValidationSchema = z.object({
+  code: z.string().trim().min(1).max(100),
+  items: z.array(cartItemSchema).min(1).max(50)
+});
+const paymentSchema = z.object({
+  clientSecret: z.string().min(1).optional(),
+  redirectUrl: z.string().refine(
+    (url) => /^https?:\/\//.test(url) || url.startsWith("/") && !url.startsWith("//"),
+    "Payment URL must use HTTP(S) or a local path"
+  ).optional()
+}).refine(
+  (result) => result.clientSecret || result.redirectUrl,
+  "Payment provider returned no payment destination"
+);
+function customerId(identity) {
+  return identity && typeof identity === "object" && "id" in identity && typeof identity.id === "string" ? identity.id : void 0;
+}
+function discountAmount(discount, subtotal) {
+  if (discount.expiresAt && new Date(discount.expiresAt).getTime() <= Date.now() || discount.maxUses != null && discount.uses >= discount.maxUses)
+    ecommerceError(400, "Discount code has expired or reached its usage limit");
+  return Math.min(
+    subtotal,
+    discount.type === "percent" ? Math.floor(subtotal * discount.value / 100) : discount.value
+  );
+}
+async function sha256(value) {
+  return Array.from(
+    new Uint8Array(
+      await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))
+    ),
+    (byte) => byte.toString(16).padStart(2, "0")
+  ).join("");
+}
+function safeProduct(item, data) {
+  return {
+    ...data,
+    id: item.id,
+    slug: item.slug,
+    createdAt: item.createdAt,
+    updatedAt: item.updatedAt
+  };
+}
+function createEcommerceOperations(adapter, config, mediaAvailable = false) {
+  const currency = config.currency ?? "USD";
+  const shipping = config.shippingAmount ?? 0;
+  async function checkoutResult(order) {
+    if (order.status !== "pending")
+      ecommerceError(409, "This checkout is no longer pending");
+    let payment = JSON.parse(order.paymentData);
+    if (!payment.clientSecret && !payment.redirectUrl) {
+      const claimed = await adapter.update({
+        model: "ecommerceOrder",
+        where: [
+          { field: "id", value: order.id },
+          { field: "status", value: "pending" },
+          { field: "paymentData", value: "{}" }
+        ],
+        update: { paymentData: '{"initializing":true}', updatedAt: /* @__PURE__ */ new Date() }
+      });
+      if (!claimed)
+        ecommerceError(
+          409,
+          "Payment is initializing or needs administrator reconciliation; do not start another payment"
+        );
+      payment = paymentSchema.parse(
+        await config.paymentAdapter.createPayment({
+          amount: order.total,
+          currency: order.currency,
+          orderId: order.id,
+          metadata: { email: order.email }
+        })
+      );
+      await adapter.update({
+        model: "ecommerceOrder",
+        where: [
+          { field: "id", value: order.id },
+          { field: "paymentData", value: '{"initializing":true}' }
+        ],
+        update: { paymentData: JSON.stringify(payment), updatedAt: /* @__PURE__ */ new Date() }
+      });
+    }
+    return { orderId: order.id, accessToken: order.accessToken, payment };
+  }
+  return {
+    listProducts: defineOperation({
+      input: productsQuerySchema,
+      permission: ecommercePermissions.product.read,
+      facts: () => ({}),
+      execute: ({ input }) => listProducts(adapter, input, mediaAvailable)
+    }),
+    getProduct: defineOperation({
+      input: z.object({ slug: z.string().min(1).max(200) }),
+      permission: ecommercePermissions.product.read,
+      facts: ({ input }) => ({ slug: input.slug }),
+      execute: async ({ input }) => await getProduct(adapter, input.slug, mediaAvailable) ?? ecommerceError(404, "Product not found")
+    }),
+    createProduct: defineOperation({
+      input: z.object({
+        slug: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).max(200),
+        data: productSchema
+      }),
+      permission: ecommercePermissions.product.manage,
+      facts: () => ({}),
+      execute: async ({ input }) => {
+        const data = productSchema.parse(input.data);
+        const item = await createProduct(adapter, input.slug, data);
+        return safeProduct(item, data);
+      }
+    }),
+    updateInventory: defineOperation({
+      input: updateInventorySchema,
+      permission: ecommercePermissions.product.manage,
+      facts: ({ input }) => ({ id: input.productId }),
+      execute: async ({ input }) => {
+        requireAtomicTransactions(adapter);
+        const inventory = await initializeInventory(
+          adapter,
+          input.productId,
+          input.variantId
+        );
+        return adapter.transaction(async (tx) => {
+          await productSnapshot(tx, input.productId);
+          const updated = await tx.update({
+            model: "ecommerceInventory",
+            where: [
+              { field: "id", value: inventory.id },
+              { field: "stock", value: input.expectedStock }
+            ],
+            update: { stock: input.stock }
+          });
+          return updated ?? ecommerceError(409, "Inventory changed; reload before restocking");
+        });
+      }
+    }),
+    createDiscountCode: defineOperation({
+      input: createDiscountSchema,
+      permission: ecommercePermissions.discount.manage,
+      facts: () => ({}),
+      execute: async ({ input }) => {
+        if (await getDiscountCode(adapter, input.code))
+          ecommerceError(409, "Discount code already exists");
+        const record = await adapter.create({
+          model: "ecommerceDiscountCode",
+          data: {
+            ...input,
+            uses: 0,
+            expiresAt: input.expiresAt ? new Date(input.expiresAt) : null
+          }
+        });
+        return {
+          ...record,
+          expiresAt: record.expiresAt ? new Date(record.expiresAt).toISOString() : null
+        };
+      }
+    }),
+    validateDiscountCode: defineOperation({
+      input: discountValidationSchema,
+      permission: ecommercePermissions.discount.validate,
+      facts: () => ({}),
+      execute: async ({ input }) => {
+        let subtotal = 0;
+        const quantities = /* @__PURE__ */ new Map();
+        for (const line of input.items) {
+          const { data } = await productSnapshot(adapter, line.productId);
+          if (data.currency !== currency)
+            ecommerceError(400, "Cart currency does not match the store");
+          const variant = line.variantId ? data.variants.find((item) => item.id === line.variantId) : void 0;
+          if (data.variants.length && !variant || line.variantId && !variant)
+            ecommerceError(400, "Choose a valid product variant");
+          const key = `${line.productId}:${line.variantId ?? ""}`;
+          const quantity = (quantities.get(key) ?? 0) + line.quantity;
+          quantities.set(key, quantity);
+          const inventory = await getInventory(
+            adapter,
+            line.productId,
+            line.variantId
+          );
+          if ((inventory?.stock ?? variant?.stock ?? data.stock) < quantity)
+            ecommerceError(409, "Cart has insufficient stock");
+          subtotal += (variant?.price ?? data.price) * line.quantity;
+        }
+        const record = await getDiscountCode(adapter, input.code);
+        if (!record) ecommerceError(400, "Discount code not found");
+        const discount = discountAmount(record, subtotal);
+        return {
+          code: record.code,
+          subtotal,
+          discount,
+          total: subtotal - discount + shipping,
+          currency
+        };
+      }
+    }),
+    createCheckout: defineOperation({
+      input: checkoutSchema,
+      permission: ecommercePermissions.checkout.create,
+      facts: () => ({}),
+      execute: async ({
+        input,
+        identity,
+        request
+      }) => {
+        requireAtomicTransactions(adapter);
+        const parsed = checkoutSchema.parse(input);
+        const owner = customerId(identity);
+        const fingerprint = await sha256(
+          JSON.stringify({ ...parsed, customerId: owner ?? null })
+        );
+        const previous = await adapter.findOne({
+          model: "ecommerceOrder",
+          where: [{ field: "idempotencyKey", value: parsed.idempotencyKey }]
+        });
+        if (previous) {
+          if (previous.checkoutFingerprint !== fingerprint)
+            ecommerceError(409, "Checkout key was already used for different details");
+          return checkoutResult(previous);
+        }
+        await config.hooks?.onBeforeCreateOrder?.(input, { request });
+        let existingCheckoutObserved = false;
+        let orderWriteStarted = false;
+        let order;
+        try {
+          for (const line of parsed.items)
+            await initializeInventory(adapter, line.productId, line.variantId);
+          order = await adapter.transaction(async (tx) => {
+            const existing = await tx.findOne({
+              model: "ecommerceOrder",
+              where: [
+                { field: "idempotencyKey", value: parsed.idempotencyKey }
+              ]
+            });
+            if (existing) {
+              existingCheckoutObserved = true;
+              if (existing.checkoutFingerprint !== fingerprint)
+                ecommerceError(
+                  409,
+                  "Checkout key was already used for different details"
+                );
+              return existing;
+            }
+            const lineItems = await reserveInventory(
+              tx,
+              parsed.items,
+              currency,
+              mediaAvailable
+            );
+            const subtotal = lineItems.reduce(
+              (sum, line) => sum + line.quantity * line.price,
+              0
+            );
+            let discount = 0;
+            let discountCodeId;
+            if (parsed.discountCode) {
+              const record = await tx.findOne({
+                model: "ecommerceDiscountCode",
+                where: [
+                  { field: "code", value: parsed.discountCode.toUpperCase() }
+                ]
+              });
+              if (!record) ecommerceError(400, "Discount code not found");
+              discount = discountAmount(record, subtotal);
+              const claimed = await tx.update({
+                model: "ecommerceDiscountCode",
+                where: [
+                  { field: "id", value: record.id },
+                  { field: "uses", value: record.uses }
+                ],
+                update: { uses: record.uses + 1 }
+              });
+              if (!claimed) ecommerceError(409, "Discount usage changed; retry checkout");
+              discountCodeId = record.id;
+            }
+            const total = subtotal - discount + shipping;
+            const rejection = config.paymentAdapter.validatePayment?.({
+              amount: total,
+              currency
+            });
+            if (rejection) ecommerceError(400, rejection);
+            orderWriteStarted = true;
+            return tx.create({
+              model: "ecommerceOrder",
+              data: {
+                email: parsed.email,
+                customerId: owner ?? null,
+                status: "pending",
+                lineItems: JSON.stringify(lineItems),
+                subtotal,
+                discount,
+                shipping,
+                total,
+                currency,
+                shippingAddress: JSON.stringify(parsed.shippingAddress),
+                paymentProvider: config.paymentAdapter.name ?? "custom",
+                paymentStatus: "pending",
+                paidHookDelivered: false,
+                paymentData: "{}",
+                accessToken: crypto.randomUUID(),
+                idempotencyKey: parsed.idempotencyKey,
+                checkoutFingerprint: fingerprint,
+                discountCodeId: discountCodeId ?? null,
+                inventoryReleased: false,
+                createdAt: /* @__PURE__ */ new Date(),
+                updatedAt: /* @__PURE__ */ new Date()
+              }
+            });
+          });
+        } catch (error) {
+          if (!existingCheckoutObserved && !orderWriteStarted && error instanceof OperationHttpError && error.code === "ECOMMERCE_ERROR" && [400, 404, 409].includes(error.statusCode)) {
+            throw new OperationHttpError(
+              error.statusCode,
+              error.message,
+              "CHECKOUT_NOT_CREATED",
+              error.issues
+            );
+          }
+          throw error;
+        }
+        return checkoutResult(order);
+      }
+    }),
+    listOrders: defineOperation({
+      input: ordersQuerySchema,
+      permission: ecommercePermissions.order.read,
+      facts: () => ({}),
+      execute: async ({ input }) => {
+        const page = await listOrders(adapter, input);
+        return { ...page, items: page.items.map(serializeOrder) };
+      }
+    }),
+    getOrder: defineOperation({
+      input: idSchema,
+      permission: ecommercePermissions.order.read,
+      facts: ({ input }) => ({ id: input.id }),
+      execute: async ({ input }) => serializeOrder(
+        await getOrder(adapter, input.id) ?? ecommerceError(404, "Order not found")
+      )
+    }),
+    listMyOrders: defineOperation({
+      input: ordersQuerySchema,
+      permission: ecommercePermissions.order.own,
+      facts: () => ({ customerId: "self" }),
+      execute: async ({ input, identity }) => {
+        const id = customerId(identity);
+        if (!id) ecommerceError(401, "Sign in to view your orders");
+        const page = await listOrders(adapter, { ...input, customerId: id });
+        return { ...page, items: page.items.map(serializeOrder) };
+      }
+    }),
+    getOrderConfirmation: defineOperation({
+      input: idSchema.extend({ token: z.string().max(200) }),
+      permission: ecommercePermissions.order.confirmation,
+      facts: ({ input }) => ({ id: input.id }),
+      execute: async ({ input }) => {
+        const order = await getOrder(adapter, input.id);
+        if (!order || order.accessToken !== input.token)
+          ecommerceError(404, "Order not found");
+        return serializeOrder(order);
+      }
+    }),
+    updateOrderStatus: defineOperation({
+      input: idSchema.extend({ status: orderStatusSchema }),
+      permission: ecommercePermissions.order.update,
+      facts: ({ input }) => ({ id: input.id }),
+      execute: async ({ input }) => {
+        requireAtomicTransactions(adapter);
+        return adapter.transaction(async (tx) => {
+          const order = await tx.findOne({
+            model: "ecommerceOrder",
+            where: [{ field: "id", value: input.id }]
+          });
+          if (!order) ecommerceError(404, "Order not found");
+          const next = {
+            pending: ["cancelled"],
+            paid: ["fulfilling", "cancelled"],
+            fulfilling: ["fulfilled", "cancelled"],
+            fulfilled: [],
+            cancelled: []
+          };
+          if (order.status === input.status) return serializeOrder(order);
+          if (!next[order.status]?.includes(input.status))
+            ecommerceError(409, "Invalid order status transition");
+          const updated = await tx.update({
+            model: "ecommerceOrder",
+            where: [
+              { field: "id", value: order.id },
+              { field: "status", value: order.status },
+              { field: "updatedAt", value: order.updatedAt }
+            ],
+            update: {
+              status: input.status,
+              inventoryReleased: input.status === "cancelled" ? true : order.inventoryReleased,
+              updatedAt: new Date(
+                Math.max(Date.now(), new Date(order.updatedAt).getTime() + 1)
+              )
+            }
+          });
+          if (!updated) ecommerceError(409, "Order changed; reload and retry");
+          if (input.status === "cancelled" && !order.inventoryReleased) {
+            await releaseInventory(tx, JSON.parse(order.lineItems));
+            if (order.paymentStatus === "pending" && order.discountCodeId)
+              await tx.incrementOne({
+                model: "ecommerceDiscountCode",
+                where: [
+                  { field: "id", value: order.discountCodeId },
+                  { field: "uses", value: 0, operator: "gt" }
+                ],
+                increment: { uses: -1 }
+              });
+          }
+          return serializeOrder(updated);
+        });
+      }
+    }),
+    handleWebhook: defineOperation({
+      input: z.object({}),
+      permission: ecommercePermissions.checkout.webhook,
+      access: "public",
+      facts: () => ({}),
+      execute: async ({ request }) => {
+        if (!request) ecommerceError(400, "Webhook requires the original HTTP request");
+        let event;
+        try {
+          event = await config.paymentAdapter.handleWebhook(request);
+        } catch {
+          ecommerceError(400, "Invalid payment webhook");
+        }
+        if (!event) return { received: true };
+        const parsed = z.object({
+          orderId: z.string().min(1),
+          status: z.enum(["paid", "failed", "refunded"]),
+          paymentRef: z.string().min(1),
+          amount: z.number().int().min(0),
+          currency: z.string().regex(/^[A-Za-z]{3}$/)
+        }).parse(event);
+        requireAtomicTransactions(adapter);
+        const paid = await adapter.transaction(async (tx) => {
+          const order = await tx.findOne({
+            model: "ecommerceOrder",
+            where: [{ field: "id", value: parsed.orderId }]
+          });
+          if (!order) ecommerceError(404, "Order not found");
+          if (order.paymentProvider !== (config.paymentAdapter.name ?? "custom") || order.total !== parsed.amount || order.currency.toUpperCase() !== parsed.currency.toUpperCase())
+            ecommerceError(400, "Payment does not match the order");
+          if (order.paymentRef && order.paymentRef !== parsed.paymentRef)
+            ecommerceError(409, "Payment reference does not match the order");
+          if (order.paymentStatus === parsed.status)
+            return parsed.status === "paid" && !order.paidHookDelivered ? serializeOrder(order) : null;
+          if (parsed.status === "paid" && order.status !== "pending")
+            ecommerceError(409, "Order is not awaiting payment");
+          if (parsed.status === "failed" && order.paymentStatus !== "pending")
+            return null;
+          if (parsed.status === "refunded" && order.paymentStatus !== "paid")
+            ecommerceError(409, "Only a paid order can be refunded");
+          const status = parsed.status === "paid" ? "paid" : "cancelled";
+          const updated = await tx.update({
+            model: "ecommerceOrder",
+            where: [
+              { field: "id", value: order.id },
+              { field: "paymentStatus", value: order.paymentStatus },
+              { field: "updatedAt", value: order.updatedAt }
+            ],
+            update: {
+              status,
+              paymentStatus: parsed.status,
+              paymentRef: parsed.paymentRef,
+              inventoryReleased: status === "cancelled" ? true : order.inventoryReleased,
+              updatedAt: new Date(
+                Math.max(Date.now(), new Date(order.updatedAt).getTime() + 1)
+              )
+            }
+          });
+          if (!updated) ecommerceError(409, "Order changed; retry webhook");
+          if (status === "cancelled" && !order.inventoryReleased) {
+            await releaseInventory(
+              tx,
+              JSON.parse(order.lineItems)
+            );
+            if (order.paymentStatus === "pending" && order.discountCodeId)
+              await tx.incrementOne({
+                model: "ecommerceDiscountCode",
+                where: [
+                  { field: "id", value: order.discountCodeId },
+                  { field: "uses", value: 0, operator: "gt" }
+                ],
+                increment: { uses: -1 }
+              });
+          }
+          return parsed.status === "paid" ? serializeOrder(updated) : null;
+        });
+        if (paid) {
+          await config.hooks?.onAfterOrderPaid?.(paid, { request });
+          await adapter.update({
+            model: "ecommerceOrder",
+            where: [
+              { field: "id", value: paid.id },
+              { field: "paymentRef", value: parsed.paymentRef },
+              { field: "paymentStatus", value: "paid" }
+            ],
+            update: { paidHookDelivered: true }
+          });
+        }
+        return { received: true };
+      }
+    })
+  };
+}
+
+export { createEcommerceOperations, discountValidationSchema };

package/dist/packages/stack/src/plugins/ecommerce/api/plugin.cjs

@@ -0,0 +1,165 @@
+'use strict';
+
+const api = require('@btst/stack/plugins/api');
+const z = require('zod');
+const db = require('../db.cjs');
+const schemas = require('../schemas.cjs');
+const getters = require('./getters.cjs');
+const mutations = require('./mutations.cjs');
+const operations = require('./operations.cjs');
+const queryKeyDefs = require('./query-key-defs.cjs');
+
+function ecommerceBackendPlugin(config) {
+  z.z.string().regex(/^[A-Z]{3}$/).parse(config.currency ?? "USD");
+  z.z.number().int().min(0).max(1e8).parse(config.shippingAmount ?? 0);
+  const mediaAdapters = /* @__PURE__ */ new WeakSet();
+  return api.defineBackendPlugin({
+    id: "ecommerce",
+    dbPlugin: db.ecommerceSchema,
+    operations: (adapter, context) => {
+      if (!Object.values(context?.plugins ?? {}).some(
+        (plugin) => plugin.id === "cms"
+      ))
+        throw new Error(
+          "Ecommerce requires the CMS backend with PRODUCT_CONTENT_TYPE registered"
+        );
+      const mediaAvailable = Object.values(context?.plugins ?? {}).some(
+        (plugin) => plugin.id === "media"
+      );
+      if (mediaAvailable) mediaAdapters.add(adapter);
+      return operations.createEcommerceOperations(adapter, config, mediaAvailable);
+    },
+    raw: (adapter) => ({
+      prefetchForRoute: (async (key, queryClient, options) => {
+        await mutations.ensureProductContentType(adapter);
+        if (key === "shop")
+          queryClient.setQueryData(
+            queryKeyDefs.ECOMMERCE_QUERY_KEYS.list(options.filters ?? {}, options.endpoint),
+            await getters.listProducts(
+              adapter,
+              options.filters,
+              mediaAdapters.has(adapter)
+            )
+          );
+        else {
+          const product = await getters.getProduct(
+            adapter,
+            options.slug ?? "",
+            mediaAdapters.has(adapter)
+          );
+          if (!product) mutations.ecommerceError(404, "Product not found");
+          queryClient.setQueryData(
+            queryKeyDefs.ECOMMERCE_QUERY_KEYS.detail(product.slug, options.endpoint),
+            product
+          );
+        }
+      })
+    }),
+    routes: (_adapter, _context, operations$1) => ({
+      listProducts: api.createEndpoint(
+        "/shop/products",
+        { method: "GET", query: schemas.productsQuerySchema, requireRequest: true },
+        operations$1.listProducts.route((ctx) => ctx.query)
+      ),
+      getProduct: api.createEndpoint(
+        "/shop/products/:slug",
+        { method: "GET", requireRequest: true },
+        operations$1.getProduct.route((ctx) => ({ slug: ctx.params.slug }))
+      ),
+      createProduct: api.createEndpoint(
+        "/shop/products",
+        {
+          method: "POST",
+          body: z.z.object({ slug: z.z.string(), data: schemas.productSchema }),
+          requireRequest: true
+        },
+        operations$1.createProduct.route((ctx) => ctx.body)
+      ),
+      updateInventory: api.createEndpoint(
+        "/shop/inventory",
+        { method: "PATCH", body: schemas.updateInventorySchema, requireRequest: true },
+        operations$1.updateInventory.route((ctx) => ctx.body)
+      ),
+      createDiscountCode: api.createEndpoint(
+        "/shop/discounts",
+        { method: "POST", body: schemas.createDiscountSchema, requireRequest: true },
+        operations$1.createDiscountCode.route((ctx) => ctx.body)
+      ),
+      validateDiscountCode: api.createEndpoint(
+        "/shop/discounts/validate",
+        {
+          method: "POST",
+          body: operations.discountValidationSchema,
+          requireRequest: true
+        },
+        operations$1.validateDiscountCode.route((ctx) => {
+          ctx.setHeader("cache-control", "private, no-store");
+          return ctx.body;
+        })
+      ),
+      createCheckout: api.createEndpoint(
+        "/shop/checkout",
+        { method: "POST", body: schemas.checkoutSchema, requireRequest: true },
+        operations$1.createCheckout.route((ctx) => {
+          ctx.setHeader("cache-control", "private, no-store");
+          return ctx.body;
+        })
+      ),
+      listOrders: api.createEndpoint(
+        "/shop/orders",
+        { method: "GET", query: schemas.ordersQuerySchema, requireRequest: true },
+        operations$1.listOrders.route((ctx) => {
+          ctx.setHeader("cache-control", "private, no-store");
+          return ctx.query;
+        })
+      ),
+      listMyOrders: api.createEndpoint(
+        "/shop/orders/mine",
+        { method: "GET", query: schemas.ordersQuerySchema, requireRequest: true },
+        operations$1.listMyOrders.route((ctx) => {
+          ctx.setHeader("cache-control", "private, no-store");
+          return ctx.query;
+        })
+      ),
+      getOrder: api.createEndpoint(
+        "/shop/orders/:id",
+        { method: "GET", requireRequest: true },
+        operations$1.getOrder.route((ctx) => {
+          ctx.setHeader("cache-control", "private, no-store");
+          return { id: ctx.params.id };
+        })
+      ),
+      getOrderConfirmation: api.createEndpoint(
+        "/shop/orders/:id/confirmation",
+        {
+          method: "GET",
+          query: z.z.object({ token: z.z.string().max(200) }),
+          requireRequest: true
+        },
+        operations$1.getOrderConfirmation.route((ctx) => {
+          ctx.setHeader("cache-control", "private, no-store");
+          return { id: ctx.params.id, token: ctx.query.token };
+        })
+      ),
+      updateOrderStatus: api.createEndpoint(
+        "/shop/orders/:id",
+        {
+          method: "PATCH",
+          body: z.z.object({ status: schemas.orderStatusSchema }),
+          requireRequest: true
+        },
+        operations$1.updateOrderStatus.route((ctx) => ({
+          id: ctx.params.id,
+          status: ctx.body.status
+        }))
+      ),
+      handleWebhook: api.createEndpoint(
+        "/shop/webhook",
+        { method: "POST", requireRequest: true, disableBody: true },
+        operations$1.handleWebhook.route(() => ({}))
+      )
+    })
+  });
+}
+
+exports.ecommerceBackendPlugin = ecommerceBackendPlugin;