@nymbalhq/platform 0.0.0-stage → 0.2.0

package/dist/chunk-74KODSYJ.js

@@ -0,0 +1,2564 @@
+// src/routes/auth-middleware.ts
+function createAuthMiddleware(auth) {
+  return async (ctx) => {
+    const raw = ctx.headers.authorization;
+    const header = Array.isArray(raw) ? raw[0] : raw;
+    if (!header || !header.toLowerCase().startsWith("bearer ")) return;
+    const token = header.slice("bearer ".length).trim();
+    try {
+      const payload = await auth.verifyAccessToken(token);
+      ctx.auth = {
+        userId: payload.sub,
+        roles: payload.roles,
+        token
+      };
+    } catch {
+    }
+    return;
+  };
+}
+
+// src/routes/auth.ts
+import {
+  AuthError
+} from "@nymbalhq/types";
+
+// src/routes/envelope.ts
+import {
+  CheckoutError,
+  HttpError,
+  NotFoundError,
+  NymbalError,
+  OrderConflictError,
+  StatusTransitionError,
+  ValidationError
+} from "@nymbalhq/types";
+function ok(data, meta, status = 200) {
+  const body = { data, ...meta !== void 0 && { meta } };
+  return { status, body };
+}
+function fail(code, message, status = 400, context) {
+  const body = {
+    error: { code, message, ...context !== void 0 && { context } }
+  };
+  return { status, body };
+}
+var CHECKOUT_STATUS = {
+  "checkout.cart_empty": 409,
+  "checkout.in_progress": 409,
+  "checkout.payment_in_progress": 409,
+  "checkout.out_of_stock": 409,
+  "checkout.reservation_failed": 409,
+  "checkout.variant_missing": 422
+};
+function renderError(err) {
+  if (err instanceof HttpError) {
+    return fail(err.code, err.message, err.status);
+  }
+  if (err instanceof NotFoundError) {
+    return fail(err.code, err.message, 404, err.context);
+  }
+  if (err instanceof ValidationError) {
+    return fail(err.code, err.message, 400, err.context);
+  }
+  if (err instanceof StatusTransitionError || err instanceof OrderConflictError) {
+    return fail(err.code, err.message, 409, err.context);
+  }
+  if (err instanceof CheckoutError) {
+    return fail(err.code, err.message, CHECKOUT_STATUS[err.code] ?? 500, err.context);
+  }
+  if (err instanceof NymbalError) {
+    return fail(err.code, err.message, 500, err.context);
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  return fail("internal", message, 500);
+}
+
+// src/routes/auth.ts
+var REFRESH_COOKIE = "nymbal.refresh";
+function refreshCookies(token, maxAgeSeconds) {
+  return [
+    {
+      name: REFRESH_COOKIE,
+      value: token,
+      path: "/",
+      httpOnly: true,
+      sameSite: "lax",
+      secure: process.env.NODE_ENV === "production",
+      maxAge: maxAgeSeconds
+    }
+  ];
+}
+function expiredCookies() {
+  return [{ name: REFRESH_COOKIE, value: "", path: "/", maxAge: 0, httpOnly: true }];
+}
+function registerAuthRoutes(adapter, auth) {
+  adapter.registerRoute("POST", "/api/auth/register", async (ctx) => {
+    try {
+      const body = ctx.body;
+      if (!body?.email || !body.password) {
+        return fail("auth.invalid_input", "email and password are required", 400);
+      }
+      const registerInput = {
+        email: body.email,
+        password: body.password,
+        ...body.firstName !== void 0 && { firstName: body.firstName },
+        ...body.lastName !== void 0 && { lastName: body.lastName },
+        ...body.phone !== void 0 && { phone: body.phone }
+      };
+      const result = await auth.register(registerInput);
+      const envelope = ok(
+        { customer: result.customer, accessToken: result.tokens.accessToken, expiresIn: result.tokens.expiresIn },
+        void 0,
+        201
+      );
+      envelope.cookies = refreshCookies(result.tokens.refreshToken, 60 * 60 * 24 * 7);
+      return envelope;
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("POST", "/api/auth/login", async (ctx) => {
+    try {
+      const body = ctx.body;
+      if (!body?.email || !body.password) {
+        return fail("auth.invalid_input", "email and password are required", 400);
+      }
+      const result = await auth.login(body.email, body.password);
+      const envelope = ok({
+        customer: result.customer,
+        accessToken: result.tokens.accessToken,
+        expiresIn: result.tokens.expiresIn
+      });
+      envelope.cookies = refreshCookies(result.tokens.refreshToken, 60 * 60 * 24 * 7);
+      return envelope;
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("POST", "/api/auth/refresh", async (ctx) => {
+    try {
+      const body = ctx.body;
+      const refreshToken = body?.refreshToken ?? ctx.cookies[REFRESH_COOKIE];
+      if (!refreshToken) throw new AuthError("token_invalid", "refresh token missing");
+      const tokens = await auth.refresh(refreshToken);
+      const envelope = ok({ accessToken: tokens.accessToken, expiresIn: tokens.expiresIn });
+      envelope.cookies = refreshCookies(tokens.refreshToken, 60 * 60 * 24 * 7);
+      return envelope;
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("POST", "/api/auth/logout", async (ctx) => {
+    try {
+      const refreshToken = ctx.body?.refreshToken ?? ctx.cookies[REFRESH_COOKIE];
+      if (refreshToken) await auth.logout(refreshToken);
+      const envelope = ok({ ok: true });
+      envelope.cookies = expiredCookies();
+      return envelope;
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+}
+
+// src/routes/products.ts
+import {
+  DEFAULT_PRODUCT_SORT,
+  NotFoundError as NotFoundError2
+} from "@nymbalhq/types";
+var ORDER_BY = {
+  newest: { field: "createdAt", direction: "desc" },
+  "price-asc": { field: "priceRange.minMinor", direction: "asc", nulls: "last" },
+  "price-desc": { field: "priceRange.minMinor", direction: "desc", nulls: "last" },
+  "name-asc": { field: "name", direction: "asc" },
+  "name-desc": { field: "name", direction: "desc" }
+};
+function buildCategoryFacet(products) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const product of products) {
+    const categories = product["categories"];
+    if (!Array.isArray(categories)) continue;
+    for (const cat of categories) {
+      const entry = counts.get(cat.slug);
+      if (entry) entry.count++;
+      else counts.set(cat.slug, { name: cat.name, count: 1 });
+    }
+  }
+  return {
+    field: "category",
+    label: "Category",
+    values: Array.from(counts.entries()).map(([slug, { name, count }]) => ({
+      value: slug,
+      label: name,
+      count
+    }))
+  };
+}
+function registerProductRoutes(adapter, documentStore, storeName, reviewsAdapter, searchService) {
+  adapter.registerRoute("GET", "/api/products/search", async (ctx) => {
+    try {
+      const rawQ = ctx.query.q;
+      const q = Array.isArray(rawQ) ? rawQ[0] : rawQ;
+      if (!q || !q.trim()) return ok({ items: [], nextCursor: null, facets: [] });
+      if (!searchService) return ok({ items: [], nextCursor: null, facets: [] });
+      const rawLimit = ctx.query.limit;
+      const limit = rawLimit ? Math.min(100, Math.max(1, Number(Array.isArray(rawLimit) ? rawLimit[0] : rawLimit) || 20)) : 20;
+      const rawCursor = ctx.query.cursor;
+      const cursor = Array.isArray(rawCursor) ? rawCursor[0] : rawCursor;
+      const searchResult = await searchService.products(q.trim(), {
+        limit,
+        ...cursor !== void 0 && { cursor }
+      });
+      const slugs = searchResult.items.map((doc) => String(doc.fields?.slug ?? "")).filter(Boolean);
+      const products = await Promise.all(slugs.map((slug) => documentStore.get("products", slug)));
+      const items = products.filter(Boolean);
+      return ok({ items, nextCursor: searchResult.nextCursor, facets: [] });
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("GET", "/api/products", async (ctx) => {
+    try {
+      const rawLimit = ctx.query.limit;
+      const limit = Math.min(
+        100,
+        Math.max(1, Number(Array.isArray(rawLimit) ? rawLimit[0] : rawLimit) || 20)
+      );
+      const rawCursor = ctx.query.cursor;
+      const cursor = Array.isArray(rawCursor) ? rawCursor[0] : rawCursor;
+      const rawCategory = ctx.query.category;
+      const category = Array.isArray(rawCategory) ? rawCategory[0] : rawCategory;
+      const sort = ctx.query.sort ?? DEFAULT_PRODUCT_SORT;
+      const orderBy = ORDER_BY[sort];
+      const result = await (category ? documentStore.query("products-by-category", {
+        partitionKey: { field: "partitionKey", value: `category:${category}` },
+        orderBy,
+        limit,
+        ...cursor !== void 0 && { cursor }
+      }) : documentStore.query("products", {
+        partitionKey: { field: "storeId", value: storeName },
+        orderBy,
+        limit,
+        ...cursor !== void 0 && { cursor }
+      }));
+      const allResult = await documentStore.query("products", {
+        partitionKey: { field: "storeId", value: storeName },
+        limit: 1e3
+      });
+      const categoryFacet = buildCategoryFacet(allResult.items);
+      return ok({ items: result.items, nextCursor: result.nextCursor, facets: [categoryFacet] });
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("GET", "/api/products/:slug", async (ctx) => {
+    try {
+      const slug = ctx.params.slug;
+      if (!slug) return fail("products.slug_required", "slug param required", 400);
+      const doc = await documentStore.get("products", slug);
+      if (!doc) throw new NotFoundError2("product", slug);
+      return ok(doc);
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("GET", "/api/products/:id/reviews", async (ctx) => {
+    try {
+      const id2 = ctx.params.id;
+      if (!id2) return fail("products.id_required", "id param required", 400);
+      if (!reviewsAdapter) return ok({ items: [], nextCursor: null });
+      const rawLimit = ctx.query.limit;
+      const limit = rawLimit ? Math.min(100, Math.max(1, Number(Array.isArray(rawLimit) ? rawLimit[0] : rawLimit) || 20)) : 20;
+      const rawCursor = ctx.query.cursor;
+      const cursor = Array.isArray(rawCursor) ? rawCursor[0] : rawCursor;
+      const result = await reviewsAdapter.getProductReviews(id2, {
+        limit,
+        ...cursor && { cursor }
+      });
+      return ok(result);
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+}
+
+// src/routes/categories.ts
+function registerCategoryRoutes(adapter, documentStore, storeName) {
+  adapter.registerRoute("GET", "/api/categories", async () => {
+    try {
+      const result = await documentStore.query(
+        "categories",
+        { partitionKey: { field: "storeId", value: storeName }, limit: 500 }
+      );
+      const sorted = result.items.slice().sort((a, b) => (a.position ?? 0) - (b.position ?? 0));
+      return ok(sorted);
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+}
+
+// src/routes/cart.ts
+import "@nymbalhq/types";
+var CART_COOKIE = "nymbal.cart";
+function cookie(token) {
+  return [
+    {
+      name: CART_COOKIE,
+      value: token,
+      path: "/",
+      httpOnly: true,
+      sameSite: "lax",
+      secure: process.env.NODE_ENV === "production",
+      maxAge: 60 * 60 * 24 * 30
+    }
+  ];
+}
+function registerCartRoutes(adapter, deps) {
+  const { cart, productRepo, variantRepo } = deps;
+  adapter.registerRoute("GET", "/api/cart", async (ctx) => {
+    try {
+      const token = ctx.cookies[CART_COOKIE];
+      const existing = token ? await cart.get(token) : null;
+      if (existing) return ok(existing);
+      const fresh = await cart.getOrCreate();
+      const env = ok(fresh);
+      env.cookies = cookie(fresh.token);
+      return env;
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("POST", "/api/cart/items", async (ctx) => {
+    try {
+      const body = ctx.body;
+      if (!body?.variantId) return fail("cart.invalid", "variantId required", 400);
+      const qty = body.qty ?? 1;
+      const { variantId } = body;
+      const variant = await variantRepo.store.read((tx) => variantRepo.findById(tx, variantId));
+      if (!variant) return fail("cart.variant_missing", "variant not found", 404);
+      if (variant.stock < qty) {
+        return fail("cart.out_of_stock", "insufficient stock", 409, {
+          variantId: variant.id,
+          available: variant.stock
+        });
+      }
+      const product = await productRepo.store.read(
+        (tx) => productRepo.findById(tx, variant.productId)
+      );
+      if (!product) return fail("cart.product_missing", "product not found", 404);
+      const token = ctx.cookies[CART_COOKIE] ?? (await cart.getOrCreate()).token;
+      const updated = await cart.addItem(token, {
+        variantId: variant.id,
+        productId: product.id,
+        productName: product.name,
+        variantName: variant.name,
+        priceMinor: variant.priceMinor,
+        qty,
+        imageUrl: product.media[0]?.url ?? ""
+      });
+      const env = ok(updated);
+      env.cookies = cookie(token);
+      return env;
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("PATCH", "/api/cart/items/:variantId", async (ctx) => {
+    try {
+      const token = ctx.cookies[CART_COOKIE];
+      if (!token) return fail("cart.missing", "no active cart", 404);
+      const variantId = ctx.params.variantId;
+      if (!variantId) return fail("cart.variant_required", "variantId param required", 400);
+      const qty = ctx.body?.qty ?? 0;
+      const updated = await cart.updateItemQuantity(token, variantId, qty);
+      return ok(updated);
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("DELETE", "/api/cart/items/:variantId", async (ctx) => {
+    try {
+      const token = ctx.cookies[CART_COOKIE];
+      if (!token) return fail("cart.missing", "no active cart", 404);
+      const variantId = ctx.params.variantId;
+      if (!variantId) return fail("cart.variant_required", "variantId param required", 400);
+      const updated = await cart.removeItem(token, variantId);
+      return ok(updated);
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+  adapter.registerRoute("DELETE", "/api/cart", async (ctx) => {
+    try {
+      const token = ctx.cookies[CART_COOKIE];
+      if (!token) return fail("cart.missing", "no active cart", 404);
+      const cleared = await cart.clear(token);
+      return ok(cleared);
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+}
+
+// src/routes/checkout.ts
+import "@nymbalhq/types";
+var CART_COOKIE2 = "nymbal.cart";
+function registerCheckoutRoutes(adapter, checkout) {
+  adapter.registerRoute("POST", "/api/checkout", async (ctx) => {
+    try {
+      const body = ctx.body;
+      const cartToken = ctx.cookies[CART_COOKIE2];
+      if (!cartToken) return fail("checkout.no_cart", "No active cart", 400);
+      if (!body?.email || !body.billingAddress || !body.shippingAddress) {
+        return fail("checkout.invalid", "email, billingAddress, shippingAddress are required", 400);
+      }
+      const result = await checkout.beginCheckout({
+        cartToken,
+        ...ctx.auth?.userId !== void 0 && { customerId: ctx.auth.userId },
+        email: body.email,
+        billingAddress: body.billingAddress,
+        shippingAddress: body.shippingAddress,
+        ...body.notes !== void 0 && { notes: body.notes }
+      });
+      return ok({
+        orderId: result.orderId,
+        orderNumber: result.orderNumber,
+        paymentIntent: result.paymentIntent,
+        currency: result.currency,
+        totalMinor: result.totalMinor,
+        orderStatus: result.orderStatus,
+        payment: result.payment
+      });
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+}
+
+// src/routes/orders.ts
+import {
+  NotFoundError as NotFoundError3
+} from "@nymbalhq/types";
+
+// src/routes/role-middleware.ts
+import { AuthError as AuthError2 } from "@nymbalhq/types";
+function requireAuth(handler) {
+  return (ctx) => {
+    if (!ctx.auth?.userId) {
+      return fail("auth.unauthorized", "Authentication required", 401);
+    }
+    return handler(ctx);
+  };
+}
+function requireRole(role, handler) {
+  return (ctx) => {
+    if (!ctx.auth?.userId) {
+      return fail("auth.unauthorized", "Authentication required", 401);
+    }
+    if (!ctx.auth.roles?.includes(role)) {
+      return fail("auth.forbidden", `Role required: ${role}`, 403);
+    }
+    return handler(ctx);
+  };
+}
+
+// src/routes/orders.ts
+function registerOrderRoutes(adapter, orders, documentStore) {
+  adapter.registerRoute(
+    "GET",
+    "/api/orders",
+    requireAuth(async (ctx) => {
+      try {
+        const customerId = ctx.auth.userId;
+        const result = await documentStore.query("orders-by-customer", {
+          partitionKey: { field: "partitionKey", value: `customer:${customerId}` },
+          limit: 50
+        });
+        return ok(result.items, { nextCursor: result.nextCursor });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute("GET", "/api/orders/:orderNumber", async (ctx) => {
+    try {
+      const orderNumber = ctx.params.orderNumber;
+      if (!orderNumber) return fail("orders.invalid", "orderNumber required", 400);
+      const doc = await documentStore.get("orders", orderNumber);
+      if (!doc) throw new NotFoundError3("order", orderNumber);
+      if (ctx.auth?.userId) {
+        const o = doc;
+        if (o.customerId && o.customerId !== ctx.auth.userId) {
+          return fail("auth.forbidden", "forbidden", 403);
+        }
+      }
+      return ok(doc);
+    } catch (err) {
+      return renderError(err);
+    }
+  });
+}
+
+// src/routes/customers.ts
+import "@nymbalhq/types";
+function registerCustomerRoutes(adapter, customers) {
+  adapter.registerRoute(
+    "GET",
+    "/api/customers/me",
+    requireAuth(async (ctx) => {
+      try {
+        return ok(await customers.getProfile(ctx.auth.userId));
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "PATCH",
+    "/api/customers/me",
+    requireAuth(async (ctx) => {
+      try {
+        const patch = ctx.body;
+        const profile = await customers.updateProfile(ctx.auth.userId, {
+          ...typeof patch.firstName === "string" && { firstName: patch.firstName },
+          ...typeof patch.lastName === "string" && { lastName: patch.lastName },
+          ...typeof patch.phone === "string" && { phone: patch.phone }
+        });
+        return ok(profile);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "GET",
+    "/api/customers/me/addresses",
+    requireAuth(async (ctx) => {
+      try {
+        return ok(await customers.listAddresses(ctx.auth.userId));
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/customers/me/addresses",
+    requireAuth(async (ctx) => {
+      try {
+        const body = ctx.body;
+        if (!body || !body.addressLine1) return fail("address.invalid", "address invalid", 400);
+        const addr = await customers.addAddress(ctx.auth.userId, {
+          firstName: body.firstName,
+          lastName: body.lastName,
+          addressLine1: body.addressLine1,
+          city: body.city,
+          region: body.region,
+          postalCode: body.postalCode,
+          country: body.country,
+          isDefaultBilling: body.isDefaultBilling ?? false,
+          isDefaultShipping: body.isDefaultShipping ?? false,
+          ...body.addressLine2 !== void 0 && { addressLine2: body.addressLine2 },
+          ...body.company !== void 0 && { company: body.company },
+          ...body.phone !== void 0 && { phone: body.phone }
+        });
+        return ok(addr, void 0, 201);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "DELETE",
+    "/api/customers/me/addresses/:id",
+    requireAuth(async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("address.invalid", "id required", 400);
+        await customers.deleteAddress(ctx.auth.userId, id2);
+        return ok({ ok: true });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+}
+
+// src/routes/admin-me.ts
+function registerAdminMeRoute(adapter, deps) {
+  const { config } = deps;
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/me",
+    requireRole("admin", async (ctx) => {
+      try {
+        return ok({
+          userId: ctx.auth.userId,
+          roles: ctx.auth.roles,
+          storeName: config.store.name,
+          environment: process.env["NODE_ENV"] ?? "development"
+        });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+}
+
+// src/routes/admin-dashboard.ts
+function registerAdminDashboardRoute(adapter, deps) {
+  const { repos } = deps;
+  const { store } = repos.order;
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/dashboard",
+    requireRole("admin", async () => {
+      try {
+        const startOfToday = new Date((/* @__PURE__ */ new Date()).setHours(0, 0, 0, 0));
+        const allOrders = await store.read((tx) => repos.order.list(tx, { limit: 200 }));
+        const todayOrders = allOrders.filter((o) => new Date(o.createdAt) >= startOfToday);
+        const shippedStatuses = /* @__PURE__ */ new Set(["shipped", "delivered"]);
+        const todayOrderCount = todayOrders.length;
+        const todayRevenueMinor = todayOrders.reduce(
+          (sum, o) => sum + o.capturedMinor - o.refundedMinor,
+          0
+        );
+        const todayItemsShipped = todayOrders.filter((o) => shippedStatuses.has(o.status)).length;
+        const recentOrders = allOrders.slice(0, 10);
+        const productVariants = await store.read(async (tx) => {
+          const products = await repos.product.list(tx, { limit: 1e3 });
+          const out = [];
+          for (const product of products) {
+            out.push({ product, variants: await repos.variant.findByProduct(tx, product.id) });
+          }
+          return out;
+        });
+        const lowStock = [];
+        for (const { product, variants } of productVariants) {
+          for (const variant of variants) {
+            if (variant.stock <= variant.lowStockThreshold) {
+              lowStock.push({
+                variantId: variant.id,
+                productId: product.id,
+                productName: product.name,
+                sku: variant.sku,
+                stock: variant.stock,
+                threshold: variant.lowStockThreshold,
+                status: variant.stock <= 0 ? "out_of_stock" : "low_stock"
+              });
+            }
+          }
+        }
+        return ok({
+          today: {
+            orderCount: todayOrderCount,
+            revenueMinor: todayRevenueMinor,
+            itemsShipped: todayItemsShipped
+          },
+          recentOrders,
+          lowStock
+        });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+}
+
+// src/routes/admin-orders.ts
+import {
+  OrderConflictError as OrderConflictError3,
+  canTransitionOrder as canTransitionOrder2
+} from "@nymbalhq/types";
+
+// src/services/refund-service.ts
+import { v7 as uuidv7 } from "uuid";
+import {
+  EVT_ORDER_PARTIALLY_REFUNDED,
+  EVT_ORDER_REFUNDED,
+  EVT_PAYMENT_REFUNDED,
+  NotFoundError as NotFoundError4,
+  OrderConflictError as OrderConflictError2,
+  PaymentError,
+  StatusTransitionError as StatusTransitionError2,
+  ValidationError as ValidationError2,
+  canTransitionOrder,
+  paymentState,
+  refundableMinor
+} from "@nymbalhq/types";
+
+// src/money.ts
+function formatMoney(amountMinor, currency) {
+  const code = currency.toUpperCase();
+  const format = new Intl.NumberFormat("en-GB", { style: "currency", currency: code });
+  const digits = format.resolvedOptions().maximumFractionDigits ?? 2;
+  return format.format(amountMinor / 10 ** digits);
+}
+
+// src/services/refund-service.ts
+var PROVIDER_REFUND_REASON = "requested_by_customer";
+function orderPayment(order, refunds) {
+  return {
+    state: paymentState(order),
+    capturedMinor: order.capturedMinor,
+    refundedMinor: order.refundedMinor,
+    refundableMinor: refundableMinor(order, refunds),
+    currency: order.currency,
+    refunds
+  };
+}
+function settlementOf(answer, row) {
+  const matches = answer.amountMinor === row.amountMinor && answer.currency.toUpperCase() === row.currency.toUpperCase();
+  const providerRefundId = answer.refundId;
+  if (answer.status === "failed") return { status: "failed", providerRefundId, mismatch: false };
+  if (!matches) return { status: "pending", providerRefundId, mismatch: true };
+  return { status: answer.status, providerRefundId, mismatch: false };
+}
+async function refreshRefunded(repos, tx, orderId, at) {
+  const refunds = await repos.orderRefund.listByOrder(tx, orderId);
+  const refundedMinor = refunds.filter((r) => r.status === "succeeded").reduce((sum, r) => sum + r.amountMinor, 0);
+  await repos.order.setRefunded(tx, orderId, refundedMinor, at);
+  return { refunds, refundedMinor };
+}
+function createRefundService(deps) {
+  const { store, repos, publisher, logger, payments } = deps;
+  async function hold(tx, input) {
+    const order = await repos.order.lock(tx, input.orderId);
+    if (!order) throw new NotFoundError4("order", input.orderId);
+    if (input.requestId !== void 0) {
+      const earlier = await repos.orderRefund.findByRequestId(tx, order.id, input.requestId);
+      if (earlier !== null) {
+        if (earlier.amountMinor !== input.amountMinor) {
+          throw new OrderConflictError2(
+            "refund.request_reused",
+            `Request ${input.requestId} already refunded ${formatMoney(earlier.amountMinor, earlier.currency)} on order ${order.orderNumber}`,
+            {
+              context: { amountMinor: input.amountMinor, earlierAmountMinor: earlier.amountMinor }
+            }
+          );
+        }
+        const refunds = await repos.orderRefund.listByOrder(tx, order.id);
+        return { repeat: { order, payment: orderPayment(order, refunds), refund: earlier } };
+      }
+    }
+    if (order.capturedMinor <= 0 || order.captureMethod === "provider" && !order.paymentIntentId) {
+      throw new OrderConflictError2(
+        "refund.not_captured",
+        `Order ${order.orderNumber} has no captured payment to refund`
+      );
+    }
+    const refundable = refundableMinor(order, await repos.orderRefund.listByOrder(tx, order.id));
+    if (input.amountMinor > refundable) {
+      throw new OrderConflictError2(
+        "refund.exceeds_captured",
+        `Refund of ${formatMoney(input.amountMinor, order.currency)} exceeds the ${formatMoney(refundable, order.currency)} refundable on order ${order.orderNumber}`,
+        { context: { amountMinor: input.amountMinor, refundableMinor: refundable } }
+      );
+    }
+    if (!canTransitionOrder(order.status, "refunded")) {
+      throw new StatusTransitionError2("order", order.status, "refunded");
+    }
+    const row = {
+      id: uuidv7(),
+      orderId: order.id,
+      amountMinor: input.amountMinor,
+      currency: order.currency,
+      providerRefundId: null,
+      status: "pending",
+      reason: input.reason ?? null,
+      actor: input.actor,
+      createdAt: /* @__PURE__ */ new Date(),
+      requestId: input.requestId ?? null
+    };
+    await repos.orderRefund.insert(tx, row);
+    return { order, row };
+  }
+  async function moveMoney(order, row) {
+    if (order.captureMethod !== "provider") {
+      return { status: "succeeded", providerRefundId: null, mismatch: false };
+    }
+    const context = { orderId: order.id, refundId: row.id, amountMinor: row.amountMinor };
+    try {
+      const answer = await payments.refund(
+        order.paymentIntentId,
+        row.amountMinor,
+        PROVIDER_REFUND_REASON,
+        { idempotencyKey: row.id, currency: order.currency }
+      );
+      const settlement = settlementOf(answer, row);
+      if (settlement.mismatch) {
+        logger.error(
+          { ...context, answer: { amountMinor: answer.amountMinor, currency: answer.currency } },
+          "provider refund answer differs from the refund; left pending"
+        );
+      }
+      return settlement;
+    } catch (err) {
+      if (err instanceof PaymentError && err.code === "payment.refund_rejected") {
+        logger.warn({ ...context, err }, "provider refused the refund");
+        return { status: "failed", providerRefundId: null, mismatch: false };
+      }
+      logger.error({ ...context, err }, "refund outcome unknown; left pending until reconciled");
+      return { status: "pending", providerRefundId: null, mismatch: false };
+    }
+  }
+  async function settle(tx, orderId, row, settlement) {
+    const order = await repos.order.lock(tx, orderId);
+    if (!order) throw new NotFoundError4("order", orderId);
+    await repos.orderRefund.settle(tx, row.id, {
+      status: settlement.status,
+      providerRefundId: settlement.providerRefundId
+    });
+    const now = /* @__PURE__ */ new Date();
+    const { refunds, refundedMinor } = await refreshRefunded(repos, tx, order.id, now);
+    const refund = refunds.find((r) => r.id === row.id);
+    if (refund.status === "succeeded") await recordSucceeded(tx, order, refundedMinor, refund, now);
+    const fresh = await repos.order.findById(tx, order.id);
+    return { order: fresh, payment: orderPayment(fresh, refunds), refund };
+  }
+  async function recordSucceeded(tx, order, refundedMinor, refund, now) {
+    const full = refundedMinor >= order.capturedMinor;
+    const target = full ? "refunded" : "partially_refunded";
+    const note = `refund of ${formatMoney(refund.amountMinor, refund.currency)}${refund.reason ? `: ${refund.reason}` : ""}`;
+    let toStatus = order.status;
+    if (order.status !== target && canTransitionOrder(order.status, target)) {
+      await repos.order.setStatus(tx, order.id, target, now);
+      toStatus = target;
+    } else if (order.status !== target) {
+      logger.warn(
+        { orderId: order.id, refundId: refund.id, status: order.status, wanted: target },
+        "refund settled; the order status no longer allows the move and is kept"
+      );
+    }
+    await repos.orderHistory.append(tx, {
+      id: uuidv7(),
+      orderId: order.id,
+      fromStatus: order.status,
+      toStatus,
+      actor: refund.actor,
+      note,
+      timestamp: now
+    });
+    if (order.customerId) {
+      await repos.customer.incrementStats(tx, order.customerId, 0, -refund.amountMinor, now);
+    }
+    const payload = {
+      orderId: order.id,
+      refundId: refund.id,
+      amountMinor: refund.amountMinor,
+      currency: refund.currency,
+      reason: refund.reason ?? ""
+    };
+    await publisher.publish(full ? EVT_ORDER_REFUNDED : EVT_ORDER_PARTIALLY_REFUNDED, payload);
+    await publisher.publish(EVT_PAYMENT_REFUNDED, {
+      paymentId: order.captureMethod === "provider" ? order.paymentIntentId ?? "" : "",
+      orderId: order.id,
+      refundId: refund.id,
+      amountMinor: refund.amountMinor,
+      currency: refund.currency
+    });
+  }
+  return {
+    async refund(input) {
+      if (!Number.isInteger(input.amountMinor) || input.amountMinor <= 0) {
+        throw new ValidationError2("amountMinor must be a positive whole number of minor units", {
+          context: { amountMinor: input.amountMinor }
+        });
+      }
+      const held = await store.transaction((tx) => hold(tx, input));
+      if ("repeat" in held) return held.repeat;
+      const { order, row } = held;
+      const settlement = await moveMoney(order, row);
+      return store.transaction((tx) => settle(tx, order.id, row, settlement));
+    }
+  };
+}
+
+// src/routes/admin-orders.ts
+function parseNotes(rawNotes, createdAt) {
+  if (!rawNotes) return [];
+  try {
+    const parsed = JSON.parse(rawNotes);
+    if (Array.isArray(parsed)) return parsed;
+    return [{ body: rawNotes, actor: "system", at: createdAt }];
+  } catch {
+    return [{ body: rawNotes, actor: "system", at: createdAt }];
+  }
+}
+function registerAdminOrdersRoutes(adapter, deps) {
+  const { order, checkout, refund, repos } = deps;
+  const { store } = repos.order;
+  async function withPayments(tx, orders) {
+    const refunds = await repos.orderRefund.listByOrders(
+      tx,
+      orders.map((o) => o.id)
+    );
+    return orders.map((o) => ({ ...o, payment: orderPayment(o, refunds.get(o.id) ?? []) }));
+  }
+  async function adminOrder(fresh) {
+    const [read] = await store.read((tx) => withPayments(tx, [fresh]));
+    return read;
+  }
+  async function findOrder(tx, idOrNumber) {
+    return await repos.order.findById(tx, idOrNumber) ?? await repos.order.findByOrderNumber(tx, idOrNumber);
+  }
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/orders",
+    requireRole("admin", async (ctx) => {
+      try {
+        const q = ctx.query;
+        const statusRaw = Array.isArray(q.status) ? q.status[0] : q.status;
+        const dateFrom = Array.isArray(q.dateFrom) ? q.dateFrom[0] : q.dateFrom;
+        const dateTo = Array.isArray(q.dateTo) ? q.dateTo[0] : q.dateTo;
+        const customer = Array.isArray(q.customer) ? q.customer[0] : q.customer;
+        const search = Array.isArray(q.q) ? q.q[0] : q.q;
+        const limitRaw = Array.isArray(q.limit) ? q.limit[0] : q.limit;
+        const offsetRaw = Array.isArray(q.offset) ? q.offset[0] : q.offset;
+        const limit = limitRaw ? Math.min(parseInt(limitRaw, 10) || 50, 200) : 50;
+        const offset = offsetRaw ? parseInt(offsetRaw, 10) || 0 : 0;
+        const listOpts = {
+          limit: limit + offset + 200,
+          // over-fetch for in-memory filtering
+          offset: 0
+        };
+        if (statusRaw) listOpts.status = statusRaw;
+        let orders = await store.read((tx) => repos.order.list(tx, listOpts));
+        if (dateFrom) {
+          const from = new Date(dateFrom);
+          orders = orders.filter((o) => new Date(o.createdAt) >= from);
+        }
+        if (dateTo) {
+          const to = new Date(dateTo);
+          orders = orders.filter((o) => new Date(o.createdAt) <= to);
+        }
+        if (customer) {
+          const lc = customer.toLowerCase();
+          orders = orders.filter(
+            (o) => (o.customerId ?? "").toLowerCase().includes(lc) || o.email.toLowerCase().includes(lc)
+          );
+        }
+        if (search) {
+          const lc = search.toLowerCase();
+          orders = orders.filter(
+            (o) => o.orderNumber.toLowerCase().includes(lc) || o.email.toLowerCase().includes(lc)
+          );
+        }
+        const page = orders.slice(offset, offset + limit);
+        return ok(await store.read((tx) => withPayments(tx, page)));
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/orders/:orderNumber",
+    requireRole("admin", async (ctx) => {
+      try {
+        const orderNumber = ctx.params.orderNumber;
+        if (!orderNumber) return fail("admin.invalid", "orderNumber required", 400);
+        const detail = await store.read(async (tx) => {
+          const found = await repos.order.findByOrderNumber(tx, orderNumber);
+          if (!found) return null;
+          const [read] = await withPayments(tx, [found]);
+          return { ...read, history: await repos.orderHistory.listByOrder(tx, found.id) };
+        });
+        if (!detail) return fail("orders.not_found", `Order not found: ${orderNumber}`, 404);
+        return ok(detail);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/orders/:id/confirm",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const current = await order.getById(id2);
+        if (canTransitionOrder2(current.status, "confirmed") && current.capturedMinor === 0) {
+          throw new OrderConflictError3(
+            "order.unpaid",
+            `Order ${current.orderNumber} is unpaid: record its payment to confirm it`
+          );
+        }
+        const fresh = await order.updateStatus(id2, "confirmed", `admin:${ctx.auth.userId}`);
+        return ok(await adminOrder(fresh));
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/orders/:id/process",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const fresh = await order.updateStatus(id2, "processing", `admin:${ctx.auth.userId}`);
+        return ok(await adminOrder(fresh));
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/orders/:id/cancel",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const body = ctx.body;
+        const reason = body?.reason ?? "Cancelled by admin";
+        const fresh = await order.cancel(id2, reason, `admin:${ctx.auth.userId}`);
+        return ok(await adminOrder(fresh));
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/orders/:id/mark-paid",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const body = ctx.body;
+        const fresh = await checkout.markPaid(id2, `admin:${ctx.auth.userId}`, body?.note);
+        return ok(await adminOrder(fresh));
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/orders/:id/mark-delivered",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const fresh = await order.markDelivered(id2, `admin:${ctx.auth.userId}`);
+        return ok(await adminOrder(fresh));
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/orders/:id/ship",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const body = ctx.body;
+        if (!body?.trackingNumber || !body.carrier) {
+          return fail("orders.invalid", "trackingNumber and carrier required", 400);
+        }
+        const fresh = await order.markShipped(
+          id2,
+          body.trackingNumber,
+          body.carrier,
+          `admin:${ctx.auth.userId}`
+        );
+        return ok(await adminOrder(fresh));
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/orders/:id/refund",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const body = ctx.body;
+        const result = await refund.refund({
+          orderId: id2,
+          amountMinor: body.amountMinor,
+          ...body.reason !== void 0 && { reason: body.reason },
+          ...body.requestId !== void 0 && { requestId: body.requestId },
+          actor: `admin:${ctx.auth.userId}`
+        });
+        return ok(result);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/orders/:id/timeline",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const history = await store.read(async (tx) => {
+          const found = await findOrder(tx, id2);
+          return found ? repos.orderHistory.listByOrder(tx, found.id) : null;
+        });
+        if (!history) return fail("orders.not_found", `Order not found: ${id2}`, 404);
+        return ok(history);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/orders/:id/notes",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const found = await store.read((tx) => findOrder(tx, id2));
+        if (!found) return fail("orders.not_found", `Order not found: ${id2}`, 404);
+        const notes = parseNotes(found.notes, found.createdAt);
+        return ok(notes);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/orders/:id/notes",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const body = ctx.body;
+        if (!body?.body?.trim()) {
+          return fail("orders.invalid", "note body required", 400);
+        }
+        const newNote = {
+          body: body.body.trim(),
+          actor: `admin:${ctx.auth.userId}`,
+          at: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        const noted = await store.transaction(async (tx) => {
+          const found = await findOrder(tx, id2);
+          if (!found) return false;
+          const updated = [...parseNotes(found.notes, found.createdAt), newNote];
+          await repos.order.setNotes(tx, found.id, JSON.stringify(updated), /* @__PURE__ */ new Date());
+          return true;
+        });
+        if (!noted) return fail("orders.not_found", `Order not found: ${id2}`, 404);
+        return ok({ note: newNote });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/orders/:id/resend-confirmation",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        return ok({ sent: true, orderId: id2 });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+}
+
+// src/routes/admin-products.ts
+function registerAdminProductsRoutes(adapter, deps) {
+  const { product } = deps;
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/products",
+    requireRole("admin", async (ctx) => {
+      try {
+        const q = ctx.query;
+        const statusRaw = Array.isArray(q.status) ? q.status[0] : q.status;
+        const search = Array.isArray(q.q) ? q.q[0] : q.q;
+        const limitRaw = Array.isArray(q.limit) ? q.limit[0] : q.limit;
+        const offsetRaw = Array.isArray(q.offset) ? q.offset[0] : q.offset;
+        const limit = limitRaw ? Math.min(parseInt(limitRaw, 10) || 50, 200) : 50;
+        const offset = offsetRaw ? parseInt(offsetRaw, 10) || 0 : 0;
+        const listOpts = {
+          limit: limit + offset + 200,
+          offset: 0
+        };
+        if (statusRaw) listOpts.status = statusRaw;
+        let products = await product.list(listOpts);
+        if (search) {
+          const lc = search.toLowerCase();
+          products = products.filter((p) => p.name.toLowerCase().includes(lc));
+        }
+        const page = products.slice(offset, offset + limit);
+        return ok(page);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/products",
+    requireRole("admin", async (ctx) => {
+      try {
+        const snap = await product.create(ctx.body);
+        return ok(snap, void 0, 201);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "PATCH",
+    "/api/admin/products/:id",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const snap = await product.update(
+          id2,
+          ctx.body
+        );
+        return ok(snap);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "DELETE",
+    "/api/admin/products/:id",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        await product.delete(id2);
+        return ok({ ok: true });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/products/:id/publish",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        await product.publish(id2);
+        return ok({ ok: true });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/products/:id/unpublish",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        await product.unpublish(id2);
+        return ok({ ok: true });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/products/:id/archive",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const snap = await product.update(id2, { status: "archived" });
+        return ok(snap);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/products/:id/duplicate",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const original = await product.getById(id2);
+        const newSlug = `${original.slug}-copy`;
+        const snap = await product.create({
+          slug: newSlug,
+          name: `${original.name} (Copy)`,
+          description: original.description,
+          shortDescription: original.shortDescription,
+          status: "draft",
+          type: original.type,
+          seoTitle: original.seoTitle,
+          seoDescription: original.seoDescription,
+          media: original.media,
+          metadata: original.metadata,
+          categoryIds: original.categoryIds,
+          variants: original.variants.map((v) => ({
+            sku: `${v.sku}-COPY`,
+            name: v.name,
+            priceMinor: v.priceMinor,
+            compareAtPriceMinor: v.compareAtPriceMinor,
+            weightGrams: v.weightGrams,
+            dimensions: v.dimensions,
+            stock: v.stock,
+            lowStockThreshold: v.lowStockThreshold,
+            options: v.options,
+            status: v.status
+          }))
+        });
+        return ok(snap, void 0, 201);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/products/:id/enhance",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const body = ctx.body;
+        if (!body?.field) return fail("admin.invalid", "field required", 400);
+        const validFields = ["description", "alt", "title", "seoDescription"];
+        if (!validFields.includes(body.field)) {
+          return fail("admin.invalid", `field must be one of: ${validFields.join(", ")}`, 400);
+        }
+        if (!deps.ai) {
+          return fail("admin.unavailable", "AI adapter not configured", 503);
+        }
+        const context = body.context ?? {};
+        let prompt;
+        switch (body.field) {
+          case "description":
+            prompt = `Write a compelling product description for: ${context["name"] ?? "this product"}. Current description: ${context["current"] ?? "(empty)"}. Keep it under 200 words, engaging, and highlight key benefits.`;
+            break;
+          case "seoDescription":
+            prompt = `Write an SEO meta description (under 155 chars) for product: ${context["name"] ?? "this product"}`;
+            break;
+          case "title":
+            prompt = `Write an SEO title tag (under 60 chars) for product: ${context["name"] ?? "this product"}`;
+            break;
+          case "alt":
+            prompt = `Write alt text for a product image of: ${context["name"] ?? "this product"}. Keep it under 100 chars, descriptive.`;
+            break;
+          default:
+            return fail("admin.invalid", "unknown field", 400);
+        }
+        const suggestion = await deps.ai.complete(prompt, { maxTokens: 300 });
+        return ok({ suggestion });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+}
+
+// src/routes/admin-inventory.ts
+function stockStatus(stock, threshold) {
+  if (stock <= 0) return "out_of_stock";
+  if (stock <= threshold) return "low_stock";
+  return "in_stock";
+}
+function urgencyOrder(status) {
+  if (status === "out_of_stock") return 0;
+  if (status === "low_stock") return 1;
+  return 2;
+}
+function registerAdminInventoryRoutes(adapter, deps) {
+  const { inventory, product, repos } = deps;
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/inventory",
+    requireRole("admin", async (ctx) => {
+      try {
+        const q = ctx.query;
+        const statusFilter = Array.isArray(q.status) ? q.status[0] : q.status;
+        const search = Array.isArray(q.q) ? q.q[0] : q.q;
+        const limitRaw = Array.isArray(q.limit) ? q.limit[0] : q.limit;
+        const offsetRaw = Array.isArray(q.offset) ? q.offset[0] : q.offset;
+        const limit = limitRaw ? Math.min(parseInt(limitRaw, 10) || 100, 500) : 100;
+        const offset = offsetRaw ? parseInt(offsetRaw, 10) || 0 : 0;
+        const allProducts = await product.list({ limit: 1e3 });
+        let rows = [];
+        for (const p of allProducts) {
+          for (const variant of p.variants) {
+            rows.push({
+              variantId: variant.id,
+              productId: p.id,
+              productName: p.name,
+              sku: variant.sku,
+              options: variant.options,
+              stock: variant.stock,
+              threshold: variant.lowStockThreshold,
+              status: stockStatus(variant.stock, variant.lowStockThreshold),
+              updatedAt: variant.updatedAt
+            });
+          }
+        }
+        if (statusFilter) {
+          rows = rows.filter((r) => r.status === statusFilter);
+        }
+        if (search) {
+          const lc = search.toLowerCase();
+          rows = rows.filter(
+            (r) => r.sku.toLowerCase().includes(lc) || r.productName.toLowerCase().includes(lc)
+          );
+        }
+        rows.sort((a, b) => {
+          const urgencyDiff = urgencyOrder(a.status) - urgencyOrder(b.status);
+          if (urgencyDiff !== 0) return urgencyDiff;
+          return a.stock - b.stock;
+        });
+        const page = rows.slice(offset, offset + limit);
+        return ok(page);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/inventory/:variantId/adjust",
+    requireRole("admin", async (ctx) => {
+      try {
+        const variantId = ctx.params.variantId;
+        if (!variantId) return fail("admin.invalid", "variantId required", 400);
+        const body = ctx.body;
+        if (body?.delta == null) return fail("inventory.invalid", "delta required", 400);
+        if (!body.reason) return fail("inventory.invalid", "reason required", 400);
+        const result = await inventory.adjustStock(
+          variantId,
+          body.delta,
+          body.reason,
+          `admin:${ctx.auth.userId}`
+        );
+        return ok({ newQty: result.newQty, variantId });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/inventory/:variantId/history",
+    requireRole("admin", async (ctx) => {
+      try {
+        const variantId = ctx.params.variantId;
+        if (!variantId) return fail("admin.invalid", "variantId required", 400);
+        const history = await repos.stockAdjustment.store.read(
+          (tx) => repos.stockAdjustment.listByVariant(tx, variantId, 100)
+        );
+        return ok(history);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+}
+
+// src/routes/admin-customers.ts
+function computeStats(orders) {
+  if (orders.length === 0) {
+    return {
+      orderCount: 0,
+      lifetimeRevenueMinor: 0,
+      avgOrderValueMinor: 0,
+      firstOrderAt: null,
+      lastOrderAt: null
+    };
+  }
+  const sorted = [...orders].sort(
+    (a, b) => new Date(a.createdAt).getTime() - new Date(b.createdAt).getTime()
+  );
+  const paidStatuses = /* @__PURE__ */ new Set([
+    "confirmed",
+    "processing",
+    "shipped",
+    "delivered",
+    "partially_refunded"
+  ]);
+  const lifetimeRevenueMinor = orders.filter((o) => paidStatuses.has(o.status)).reduce((sum, o) => sum + o.totalMinor, 0);
+  return {
+    orderCount: orders.length,
+    lifetimeRevenueMinor,
+    avgOrderValueMinor: orders.length > 0 ? Math.round(lifetimeRevenueMinor / orders.length) : 0,
+    firstOrderAt: sorted[0]?.createdAt ?? null,
+    lastOrderAt: sorted[sorted.length - 1]?.createdAt ?? null
+  };
+}
+function registerAdminCustomersRoutes(adapter, deps) {
+  const { repos } = deps;
+  const { store } = repos.customer;
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/customers",
+    requireRole("admin", async (ctx) => {
+      try {
+        const q = ctx.query;
+        const search = Array.isArray(q.q) ? q.q[0] : q.q;
+        const sortRaw = Array.isArray(q.sort) ? q.sort[0] : q.sort;
+        const limitRaw = Array.isArray(q.limit) ? q.limit[0] : q.limit;
+        const offsetRaw = Array.isArray(q.offset) ? q.offset[0] : q.offset;
+        const limit = limitRaw ? Math.min(parseInt(limitRaw, 10) || 50, 200) : 50;
+        const offset = offsetRaw ? parseInt(offsetRaw, 10) || 0 : 0;
+        const customerResults = await store.read(async (tx) => {
+          const allOrders = await repos.order.list(tx, { limit: 500 });
+          const customerIdSet = /* @__PURE__ */ new Set();
+          for (const o of allOrders) {
+            if (o.customerId) customerIdSet.add(o.customerId);
+          }
+          return Promise.all([...customerIdSet].map((id2) => repos.customer.findById(tx, id2)));
+        });
+        let customers = customerResults.filter((c) => c !== null).map(({ passwordHash: _pw, ...rest }) => rest);
+        if (search) {
+          const lc = search.toLowerCase();
+          customers = customers.filter(
+            (c) => c.email.toLowerCase().includes(lc) || c.firstName.toLowerCase().includes(lc) || c.lastName.toLowerCase().includes(lc)
+          );
+        }
+        const sortField = sortRaw?.split(":")[0] ?? "totalSpentMinor";
+        const sortDir = sortRaw?.split(":")[1] ?? "desc";
+        customers.sort((a, b) => {
+          const aVal = a[sortField];
+          const bVal = b[sortField];
+          const aNum = typeof aVal === "number" ? aVal : 0;
+          const bNum = typeof bVal === "number" ? bVal : 0;
+          return sortDir === "asc" ? aNum - bNum : bNum - aNum;
+        });
+        const page = customers.slice(offset, offset + limit);
+        return ok({ customers: page });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/customers/:id",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const found = await store.read(async (tx) => {
+          const raw = await repos.customer.findById(tx, id2);
+          return raw ? { raw, orders: await repos.order.listByCustomer(tx, id2) } : null;
+        });
+        if (!found) return fail("customers.not_found", `Customer not found: ${id2}`, 404);
+        const { passwordHash: _pw, ...customer } = found.raw;
+        const { orders } = found;
+        const stats = computeStats(orders);
+        return ok({ customer, stats });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/customers/:id/orders",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const orders = await store.read((tx) => repos.order.listByCustomer(tx, id2));
+        return ok(orders);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/customers/:id/notes",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const body = ctx.body;
+        if (!body?.body?.trim()) {
+          return fail("customers.invalid", "note body required", 400);
+        }
+        const newNote = {
+          body: body.body.trim(),
+          actor: `admin:${ctx.auth.userId}`,
+          at: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        const noted = await store.transaction(async (tx) => {
+          const raw = await repos.customer.findById(tx, id2);
+          if (!raw) return false;
+          const existingNotes = raw.metadata.adminNotes ?? [];
+          const updatedMeta = {
+            ...raw.metadata,
+            adminNotes: [...existingNotes, newNote]
+          };
+          await repos.customer.update(tx, id2, {
+            metadata: updatedMeta,
+            updatedAt: /* @__PURE__ */ new Date()
+          });
+          return true;
+        });
+        if (!noted) return fail("customers.not_found", `Customer not found: ${id2}`, 404);
+        return ok({ note: newNote });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+}
+
+// src/routes/admin-search.ts
+function registerAdminSearchRoute(adapter, deps) {
+  const { product, repos } = deps;
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/search",
+    requireRole("admin", async (ctx) => {
+      try {
+        const qRaw = Array.isArray(ctx.query.q) ? ctx.query.q[0] : ctx.query.q;
+        if (!qRaw?.trim()) {
+          return fail("search.invalid", "q parameter required", 400);
+        }
+        const q = qRaw.toLowerCase();
+        const allOrders = await repos.order.store.read((tx) => repos.order.list(tx, { limit: 100 }));
+        const matchedOrders = allOrders.filter(
+          (o) => o.orderNumber.toLowerCase().includes(q) || o.email.toLowerCase().includes(q)
+        ).slice(0, 5);
+        const allProducts = await product.list({ limit: 200 });
+        const matchedProducts = allProducts.filter((p) => p.name.toLowerCase().includes(q) || p.slug.toLowerCase().includes(q)).slice(0, 5);
+        const customerResults = await repos.order.store.read(async (tx) => {
+          const allOrdersFull = await repos.order.list(tx, { limit: 500 });
+          const customerIdSet = /* @__PURE__ */ new Set();
+          for (const o of allOrdersFull) {
+            if (o.customerId) customerIdSet.add(o.customerId);
+          }
+          return Promise.all([...customerIdSet].map((id2) => repos.customer.findById(tx, id2)));
+        });
+        const matchedCustomers = customerResults.filter((c) => c !== null).filter(
+          (c) => c.email.toLowerCase().includes(q) || c.firstName.toLowerCase().includes(q) || c.lastName.toLowerCase().includes(q)
+        ).slice(0, 5).map(({ passwordHash: _pw, ...rest }) => rest);
+        return ok({
+          orders: matchedOrders,
+          products: matchedProducts,
+          customers: matchedCustomers
+        });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+}
+
+// src/routes/admin-reviews.ts
+function registerAdminReviewsRoutes(adapter, deps) {
+  const { reviewRepo } = deps;
+  adapter.registerRoute(
+    "GET",
+    "/api/admin/reviews",
+    requireRole("admin", async () => {
+      try {
+        const pending = await reviewRepo.store.read((tx) => reviewRepo.listByStatus(tx, "pending"));
+        return ok(pending);
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/reviews/:id/moderate",
+    requireRole("admin", async (ctx) => {
+      try {
+        const id2 = ctx.params.id;
+        if (!id2) return fail("admin.invalid", "id required", 400);
+        const body = ctx.body;
+        if (!body?.status || !["approved", "rejected"].includes(body.status)) {
+          return fail("reviews.invalid", "status must be approved|rejected", 400);
+        }
+        const status = body.status;
+        await reviewRepo.store.transaction(
+          (tx) => reviewRepo.setModerationStatus(tx, id2, status, `admin:${ctx.auth.userId}`, /* @__PURE__ */ new Date())
+        );
+        return ok({ ok: true });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+}
+
+// src/routes/admin.ts
+function registerAdminRoutes(adapter, deps) {
+  const { config, services, repos, adapters } = deps;
+  registerAdminMeRoute(adapter, { config });
+  registerAdminDashboardRoute(adapter, { repos, config });
+  registerAdminOrdersRoutes(adapter, {
+    order: services.order,
+    checkout: services.checkout,
+    refund: services.refund,
+    repos
+  });
+  registerAdminProductsRoutes(adapter, { product: services.product, ai: adapters.ai });
+  registerAdminInventoryRoutes(adapter, {
+    inventory: services.inventory,
+    product: services.product,
+    repos
+  });
+  registerAdminCustomersRoutes(adapter, { order: services.order, repos });
+  registerAdminSearchRoute(adapter, {
+    order: services.order,
+    product: services.product,
+    repos
+  });
+  registerAdminReviewsRoutes(adapter, {
+    reviewsAdapter: adapters.reviews,
+    reviewRepo: repos.review
+  });
+}
+
+// src/routes/admin-static.ts
+import { readFile, realpath, stat } from "fs/promises";
+import { extname, resolve, sep } from "path";
+var MIME = /* @__PURE__ */ new Map([
+  [".html", "text/html; charset=utf-8"],
+  [".js", "text/javascript; charset=utf-8"],
+  [".mjs", "text/javascript; charset=utf-8"],
+  [".css", "text/css; charset=utf-8"],
+  [".json", "application/json; charset=utf-8"],
+  [".svg", "image/svg+xml"],
+  [".png", "image/png"],
+  [".jpg", "image/jpeg"],
+  [".jpeg", "image/jpeg"],
+  [".webp", "image/webp"],
+  [".ico", "image/x-icon"],
+  [".woff", "font/woff"],
+  [".woff2", "font/woff2"],
+  [".ttf", "font/ttf"]
+]);
+var BUILD_HINT = "The Nymbal admin is not built. Run `pnpm --filter @nymbalhq/admin build` in the Nymbal repository, or install the `@nymbalhq/admin` package beside `nymbal`.\n";
+var notFound = (body = "Not found\n") => ({
+  status: 404,
+  headers: { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-cache" },
+  body
+});
+async function fileWithin(root, requestPath) {
+  if (requestPath.includes("\0") || requestPath.includes("\\")) return null;
+  const candidate = resolve(root, `.${sep}${requestPath}`);
+  if (candidate !== root && !candidate.startsWith(root + sep)) return null;
+  try {
+    if (!(await stat(candidate)).isFile()) return null;
+    const real = await realpath(candidate);
+    return real.startsWith(root + sep) ? real : null;
+  } catch {
+    return null;
+  }
+}
+function registerAdminStaticRoute(adapter, root) {
+  adapter.registerRoute("GET", "/admin", async () => ({
+    status: 308,
+    headers: { Location: "/admin/" },
+    body: void 0
+  }));
+  let realRoot = null;
+  const resolvedRoot = () => realRoot ??= root === null ? Promise.resolve(null) : realpath(root).catch(() => null);
+  const serve = async (wildcard) => {
+    const base = await resolvedRoot();
+    if (base === null) return notFound(BUILD_HINT);
+    const requestPath = wildcard === "" ? "index.html" : wildcard;
+    const file = await fileWithin(base, requestPath);
+    if (file !== null) {
+      const ext = extname(file).toLowerCase();
+      return {
+        status: 200,
+        headers: {
+          "Content-Type": MIME.get(ext) ?? "application/octet-stream",
+          "Cache-Control": requestPath.startsWith("assets/") ? "public, max-age=31536000, immutable" : "no-cache"
+        },
+        body: await readFile(file)
+      };
+    }
+    if (requestPath !== "index.html" && MIME.has(extname(requestPath).toLowerCase())) {
+      return notFound();
+    }
+    const index = await fileWithin(base, "index.html");
+    if (index === null) return notFound(BUILD_HINT);
+    return {
+      status: 200,
+      headers: { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" },
+      body: await readFile(index)
+    };
+  };
+  adapter.registerRoute("GET", "/admin/", () => serve(""));
+  adapter.registerRoute("GET", "/admin/*", (ctx) => serve(ctx.params["*"] ?? ""));
+}
+
+// src/routes/events-sse.ts
+import { createHmac, randomBytes } from "crypto";
+import "@nymbalhq/types";
+var TICKET_TTL_SECONDS = 60;
+var NONCE_COLLECTION = "sse-ticket-nonces";
+function sign(payload, secret) {
+  const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const sig = createHmac("sha256", secret).update(body).digest("base64url");
+  return `${body}.${sig}`;
+}
+function verify(token, secret) {
+  const [body, sig] = token.split(".");
+  if (!body || !sig) return null;
+  const expected = createHmac("sha256", secret).update(body).digest("base64url");
+  if (expected !== sig) return null;
+  try {
+    return JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function registerEventsSseRoute(adapter, deps) {
+  const { eventBus, documentStore, ticketSecret } = deps;
+  adapter.registerRoute(
+    "POST",
+    "/api/admin/events/ticket",
+    requireRole("admin", (ctx) => {
+      try {
+        const nonce = randomBytes(12).toString("base64url");
+        const payload = {
+          uid: ctx.auth.userId,
+          roles: ctx.auth.roles ?? ["admin"],
+          iat: Math.floor(Date.now() / 1e3),
+          nonce
+        };
+        const token = sign(payload, ticketSecret);
+        return ok({ ticket: token, expiresIn: TICKET_TTL_SECONDS });
+      } catch (err) {
+        return renderError(err);
+      }
+    })
+  );
+  adapter.registerStreamRoute("GET", "/api/admin/events", async (ctx, stream) => {
+    const rawTicket = ctx.query.ticket;
+    const ticket = Array.isArray(rawTicket) ? rawTicket[0] : rawTicket;
+    if (!ticket) {
+      stream.send({ event: "error", data: { code: "ticket.missing" } });
+      stream.close();
+      return;
+    }
+    const payload = verify(ticket, ticketSecret);
+    if (!payload) {
+      stream.send({ event: "error", data: { code: "ticket.invalid" } });
+      stream.close();
+      return;
+    }
+    if (Math.floor(Date.now() / 1e3) - payload.iat > TICKET_TTL_SECONDS) {
+      stream.send({ event: "error", data: { code: "ticket.expired" } });
+      stream.close();
+      return;
+    }
+    const nonceKey = `${payload.uid}:${payload.nonce}`;
+    const seen = await documentStore.get(NONCE_COLLECTION, nonceKey);
+    if (seen) {
+      stream.send({ event: "error", data: { code: "ticket.replayed" } });
+      stream.close();
+      return;
+    }
+    await documentStore.put(NONCE_COLLECTION, nonceKey, { seen: true }, { ttl: 120 });
+    if (!payload.roles.includes("admin")) {
+      stream.send({ event: "error", data: { code: "ticket.forbidden" } });
+      stream.close();
+      return;
+    }
+    const subscription = await eventBus.subscribe(
+      ["order.*", "payment.*", "inventory.*", "adapter.*"],
+      (event) => {
+        stream.send({
+          id: event.id,
+          event: event.type,
+          data: { id: event.id, type: event.type, timestamp: event.timestamp, payload: event.payload }
+        });
+      },
+      { name: "sse-admin-events" }
+    );
+    stream.onClose(() => {
+      subscription.unsubscribe().catch(() => void 0);
+    });
+    stream.send({ event: "connected", data: { at: (/* @__PURE__ */ new Date()).toISOString() } });
+  });
+  void fail;
+}
+
+// src/routes/webhooks-stripe.ts
+import {
+  EVT_PAYMENT_FAILED,
+  PaymentError as PaymentError2
+} from "@nymbalhq/types";
+var HANDLER = "webhook:stripe";
+function registerStripeWebhookRoute(adapter, deps) {
+  const { payments, checkout, publisher, store, processedEvents, orders } = deps;
+  async function publishFailed(tx, paymentIntentId, reason) {
+    const order = paymentIntentId ? await orders.findByPaymentIntentId(tx, paymentIntentId) : null;
+    await publisher.publish(EVT_PAYMENT_FAILED, {
+      paymentId: paymentIntentId,
+      orderId: order?.id ?? "",
+      reason
+    });
+  }
+  async function handle(tx, result) {
+    if (result.kind === "payment.captured") {
+      const paymentIntentId = result.paymentIntentId ?? "";
+      if (paymentIntentId === "" || typeof result.amountMinor !== "number" || typeof result.currency !== "string" || result.currency === "") {
+        await publishFailed(tx, paymentIntentId, "malformed_capture");
+        return ok({ finalized: false, reason: "malformed_capture" });
+      }
+      const finalized = await checkout.finalize(paymentIntentId, {
+        amountMinor: result.amountMinor,
+        currency: result.currency
+      });
+      return finalized.finalized ? ok({ finalized: true, orderNumber: finalized.orderNumber }) : ok({ finalized: false, reason: finalized.reason });
+    }
+    if (result.kind === "payment.failed" && result.paymentIntentId) {
+      await publishFailed(tx, result.paymentIntentId, result.reason ?? "unknown");
+      return ok({ failed: true });
+    }
+    return ok({ ignored: true });
+  }
+  adapter.registerRoute(
+    "POST",
+    "/api/webhooks/stripe",
+    async (ctx) => {
+      try {
+        const rawSig = ctx.headers["stripe-signature"];
+        const sig = Array.isArray(rawSig) ? rawSig[0] : rawSig;
+        if (!sig) return fail("webhook.signature_missing", "stripe-signature header missing", 400);
+        if (ctx.rawBody === void 0) {
+          return fail("webhook.raw_body_missing", "the HTTP adapter kept no raw request body", 500);
+        }
+        let result;
+        try {
+          result = await payments.parseWebhook(ctx.rawBody, sig);
+        } catch (err) {
+          if (err instanceof PaymentError2 && err.code === "payment.webhook_invalid") {
+            return fail("webhook.invalid", "signature verification failed", 400);
+          }
+          throw err;
+        }
+        if (!result.verified) return fail("webhook.invalid", "signature verification failed", 400);
+        return await store.transaction(async (tx) => {
+          if (await processedEvents.seen(tx, HANDLER, result.eventId)) return ok({ deduped: true });
+          const answer = await handle(tx, result);
+          await processedEvents.markProcessed(tx, HANDLER, result.eventId, /* @__PURE__ */ new Date());
+          return answer;
+        });
+      } catch (err) {
+        return renderError(err);
+      }
+    },
+    { csrf: false, rawBody: true }
+  );
+}
+
+// src/routes/validated-adapter.ts
+import {
+  ConfigError
+} from "@nymbalhq/types";
+
+// src/routes/schemas.ts
+import { z } from "zod";
+import { PRODUCT_SORT_KEYS } from "@nymbalhq/types";
+var id = z.string().min(1);
+var queryValue = z.union([z.string(), z.array(z.string())]).optional();
+var paging = { limit: queryValue, offset: queryValue };
+var idParams = z.object({ id });
+var orderIdParams = idParams;
+var variantIdParams = z.object({ variantId: id });
+var orderNumberParams = z.object({ orderNumber: id });
+var address = z.object({
+  firstName: z.string(),
+  lastName: z.string(),
+  company: z.string().optional(),
+  addressLine1: z.string().min(1),
+  addressLine2: z.string().optional(),
+  city: z.string(),
+  region: z.string(),
+  postalCode: z.string(),
+  country: z.string(),
+  phone: z.string().optional()
+});
+var money = z.number().int();
+var productStatus = z.enum(["draft", "active", "archived"]);
+var productMedia = z.object({ url: z.string(), altText: z.string(), position: z.number() });
+var variantDimensions = z.object({
+  lengthMm: z.number().optional(),
+  widthMm: z.number().optional(),
+  heightMm: z.number().optional()
+});
+var productVariant = z.object({
+  id: z.string().optional(),
+  sku: z.string(),
+  name: z.string(),
+  priceMinor: money,
+  compareAtPriceMinor: money.nullable().optional(),
+  weightGrams: z.number().nullable().optional(),
+  dimensions: variantDimensions.nullable().optional(),
+  stock: z.number().int(),
+  lowStockThreshold: z.number().int().optional(),
+  options: z.array(z.object({ name: z.string(), value: z.string() })),
+  status: z.enum(["active", "inactive"]).optional()
+});
+var productFields = {
+  description: z.string().optional(),
+  shortDescription: z.string().optional(),
+  status: productStatus.optional(),
+  type: z.enum(["simple", "variable"]).optional(),
+  seoTitle: z.string().optional(),
+  seoDescription: z.string().optional(),
+  media: z.array(productMedia).optional(),
+  metadata: z.record(z.unknown()).optional(),
+  categoryIds: z.array(z.string()).optional()
+};
+var noteBody = z.object({ body: z.string().min(1) });
+var optionalRefresh = z.object({ refreshToken: z.string().optional() }).optional();
+var routeSchemas = {
+  // Auth
+  "POST /api/auth/register": {
+    name: "auth.register",
+    description: "Create a customer account and sign it in.",
+    body: z.object({
+      email: z.string().min(1),
+      password: z.string().min(1),
+      firstName: z.string().optional(),
+      lastName: z.string().optional(),
+      phone: z.string().optional()
+    })
+  },
+  "POST /api/auth/login": {
+    name: "auth.login",
+    description: "Sign a customer in with email and password.",
+    body: z.object({ email: z.string().min(1), password: z.string().min(1) })
+  },
+  "POST /api/auth/refresh": {
+    name: "auth.refresh",
+    description: "Exchange a refresh token for a new access token.",
+    body: optionalRefresh
+  },
+  "POST /api/auth/logout": {
+    name: "auth.logout",
+    description: "Revoke the refresh token and clear its cookie.",
+    body: optionalRefresh
+  },
+  // Catalogue
+  "GET /api/categories": {
+    name: "categories.list",
+    description: "List the store categories in display order."
+  },
+  "GET /api/products/search": {
+    name: "products.search",
+    description: "Search products by text.",
+    query: z.object({ q: queryValue, limit: queryValue, cursor: queryValue })
+  },
+  "GET /api/products": {
+    name: "products.list",
+    description: "List products, optionally in one category, in one of the sort orders (default newest).",
+    query: z.object({
+      limit: queryValue,
+      cursor: queryValue,
+      category: queryValue,
+      sort: z.enum(PRODUCT_SORT_KEYS).optional()
+    })
+  },
+  "GET /api/products/:slug": {
+    name: "products.get",
+    description: "Get one product by slug.",
+    params: z.object({ slug: id })
+  },
+  "GET /api/products/:id/reviews": {
+    name: "products.reviews",
+    description: "List the published reviews of a product.",
+    params: idParams,
+    query: z.object({ limit: queryValue, cursor: queryValue })
+  },
+  // Cart
+  "GET /api/cart": {
+    name: "cart.get",
+    description: "Get the current cart, creating one when there is none."
+  },
+  "POST /api/cart/items": {
+    name: "cart.addItem",
+    description: "Add a quantity of a variant to the cart.",
+    body: z.object({ variantId: id, qty: z.number().int().positive().optional() })
+  },
+  "PATCH /api/cart/items/:variantId": {
+    name: "cart.updateItem",
+    description: "Set the quantity of a variant in the cart.",
+    params: variantIdParams,
+    body: z.object({ qty: z.number().int().nonnegative() })
+  },
+  "DELETE /api/cart/items/:variantId": {
+    name: "cart.removeItem",
+    description: "Remove a variant from the cart.",
+    params: variantIdParams
+  },
+  "DELETE /api/cart": {
+    name: "cart.clear",
+    description: "Remove every item from the cart."
+  },
+  // Checkout and orders
+  "POST /api/checkout": {
+    name: "checkout.begin",
+    description: "Place an order for the cart and start its payment.",
+    body: z.object({
+      email: z.string().min(1),
+      billingAddress: address,
+      shippingAddress: address,
+      notes: z.string().optional()
+    })
+  },
+  "GET /api/orders": {
+    name: "orders.list",
+    description: "List the signed-in customer's orders."
+  },
+  "GET /api/orders/:orderNumber": {
+    name: "orders.get",
+    description: "Get one order by its number.",
+    params: orderNumberParams
+  },
+  // Customer account
+  "GET /api/customers/me": {
+    name: "customers.me",
+    description: "Get the signed-in customer's profile."
+  },
+  "PATCH /api/customers/me": {
+    name: "customers.updateMe",
+    description: "Update the signed-in customer's name or phone.",
+    body: z.object({
+      firstName: z.string().optional(),
+      lastName: z.string().optional(),
+      phone: z.string().optional()
+    })
+  },
+  "GET /api/customers/me/addresses": {
+    name: "customers.addresses",
+    description: "List the signed-in customer's saved addresses."
+  },
+  "POST /api/customers/me/addresses": {
+    name: "customers.addAddress",
+    description: "Save an address for the signed-in customer.",
+    body: address.extend({
+      isDefaultBilling: z.boolean().optional(),
+      isDefaultShipping: z.boolean().optional()
+    })
+  },
+  "DELETE /api/customers/me/addresses/:id": {
+    name: "customers.removeAddress",
+    description: "Delete one of the signed-in customer's saved addresses.",
+    params: idParams
+  },
+  // Admin: session and overview
+  "GET /api/admin/me": {
+    name: "admin.me",
+    description: "Get the signed-in admin and the store it administers."
+  },
+  "GET /api/admin/dashboard": {
+    name: "admin.dashboard",
+    description: "Today's order figures, recent orders and low stock."
+  },
+  "GET /api/admin/search": {
+    name: "admin.search",
+    description: "Search orders, products and customers.",
+    query: z.object({ q: queryValue })
+  },
+  // Admin: orders
+  "GET /api/admin/orders": {
+    name: "admin.orders.list",
+    description: "List orders, filtered by status, date, customer or text.",
+    query: z.object({
+      status: queryValue,
+      dateFrom: queryValue,
+      dateTo: queryValue,
+      customer: queryValue,
+      q: queryValue,
+      ...paging
+    })
+  },
+  "GET /api/admin/orders/:orderNumber": {
+    name: "admin.orders.get",
+    description: "Get one order with its status history.",
+    params: orderNumberParams
+  },
+  "POST /api/admin/orders/:id/confirm": {
+    name: "admin.orders.confirm",
+    description: "Move a paid order to confirmed; an unpaid order is refused (record its payment instead).",
+    params: orderIdParams
+  },
+  "POST /api/admin/orders/:id/process": {
+    name: "admin.orders.process",
+    description: "Move a confirmed order to processing.",
+    params: orderIdParams
+  },
+  "POST /api/admin/orders/:id/cancel": {
+    name: "admin.orders.cancel",
+    description: "Cancel an order nothing was captured for, with an optional reason.",
+    params: orderIdParams,
+    body: z.object({ reason: z.string().optional() }).optional()
+  },
+  "POST /api/admin/orders/:id/mark-paid": {
+    name: "admin.orders.markPaid",
+    description: "Record a payment of the order's total taken outside the store, confirming the order.",
+    params: orderIdParams,
+    body: z.object({ note: z.string().optional() }).optional()
+  },
+  "POST /api/admin/orders/:id/mark-delivered": {
+    name: "admin.orders.markDelivered",
+    description: "Move a shipped order to delivered.",
+    params: orderIdParams
+  },
+  "POST /api/admin/orders/:id/ship": {
+    name: "admin.orders.ship",
+    description: "Mark an order shipped with its tracking number and carrier.",
+    params: orderIdParams,
+    body: z.object({ trackingNumber: z.string().min(1), carrier: z.string().min(1) })
+  },
+  "POST /api/admin/orders/:id/refund": {
+    name: "admin.orders.refund",
+    description: "Refund part or all of what an order captured, through the payments provider. A repeated requestId answers the refund it made and moves no money.",
+    params: orderIdParams,
+    body: z.object({
+      amountMinor: money.positive(),
+      reason: z.string().optional(),
+      requestId: z.string().uuid().optional()
+    })
+  },
+  "GET /api/admin/orders/:id/timeline": {
+    name: "admin.orders.timeline",
+    description: "List an order's status history.",
+    params: orderIdParams
+  },
+  "GET /api/admin/orders/:id/notes": {
+    name: "admin.orders.notes",
+    description: "List an order's internal notes.",
+    params: orderIdParams
+  },
+  "POST /api/admin/orders/:id/notes": {
+    name: "admin.orders.addNote",
+    description: "Add an internal note to an order.",
+    params: orderIdParams,
+    body: noteBody
+  },
+  "POST /api/admin/orders/:id/resend-confirmation": {
+    name: "admin.orders.resendConfirmation",
+    description: "Resend an order's confirmation email.",
+    params: orderIdParams
+  },
+  // Admin: products
+  "GET /api/admin/products": {
+    name: "admin.products.list",
+    description: "List products, filtered by status or name.",
+    query: z.object({ status: queryValue, q: queryValue, ...paging })
+  },
+  "POST /api/admin/products": {
+    name: "admin.products.create",
+    description: "Create a product with its variants.",
+    body: z.object({
+      slug: z.string().min(1),
+      name: z.string().min(1),
+      ...productFields,
+      variants: z.array(productVariant).optional()
+    })
+  },
+  "PATCH /api/admin/products/:id": {
+    name: "admin.products.update",
+    description: "Update a product's fields.",
+    params: idParams,
+    body: z.object({ name: z.string().optional(), ...productFields })
+  },
+  "DELETE /api/admin/products/:id": {
+    name: "admin.products.delete",
+    description: "Delete a product.",
+    params: idParams
+  },
+  "POST /api/admin/products/:id/publish": {
+    name: "admin.products.publish",
+    description: "Make a product visible in the store.",
+    params: idParams
+  },
+  "POST /api/admin/products/:id/unpublish": {
+    name: "admin.products.unpublish",
+    description: "Hide a product from the store.",
+    params: idParams
+  },
+  "POST /api/admin/products/:id/archive": {
+    name: "admin.products.archive",
+    description: "Archive a product.",
+    params: idParams
+  },
+  "POST /api/admin/products/:id/duplicate": {
+    name: "admin.products.duplicate",
+    description: "Copy a product as a draft.",
+    params: idParams
+  },
+  "POST /api/admin/products/:id/enhance": {
+    name: "admin.products.enhance",
+    description: "Suggest copy for one product field with the AI adapter.",
+    params: idParams,
+    body: z.object({
+      field: z.enum(["description", "alt", "title", "seoDescription"]),
+      context: z.record(z.string()).optional()
+    })
+  },
+  // Admin: inventory
+  "GET /api/admin/inventory": {
+    name: "admin.inventory.list",
+    description: "List variant stock, most urgent first.",
+    query: z.object({ status: queryValue, q: queryValue, ...paging })
+  },
+  "POST /api/admin/inventory/:variantId/adjust": {
+    name: "admin.inventory.adjust",
+    description: "Adjust a variant's stock by a delta, with a reason.",
+    params: variantIdParams,
+    body: z.object({
+      delta: z.number().int(),
+      reason: z.enum([
+        "sale",
+        "return",
+        "manual",
+        "import",
+        "reservation-commit",
+        "reservation-release"
+      ])
+    })
+  },
+  "GET /api/admin/inventory/:variantId/history": {
+    name: "admin.inventory.history",
+    description: "List a variant's stock adjustments.",
+    params: variantIdParams
+  },
+  // Admin: customers
+  "GET /api/admin/customers": {
+    name: "admin.customers.list",
+    description: "List customers who have ordered, filtered and sorted.",
+    query: z.object({ q: queryValue, sort: queryValue, ...paging })
+  },
+  "GET /api/admin/customers/:id": {
+    name: "admin.customers.get",
+    description: "Get one customer with order statistics.",
+    params: idParams
+  },
+  "GET /api/admin/customers/:id/orders": {
+    name: "admin.customers.orders",
+    description: "List one customer's orders.",
+    params: idParams
+  },
+  "POST /api/admin/customers/:id/notes": {
+    name: "admin.customers.addNote",
+    description: "Add an internal note to a customer.",
+    params: idParams,
+    body: noteBody
+  },
+  // Admin: reviews
+  "GET /api/admin/reviews": {
+    name: "admin.reviews.pending",
+    description: "List reviews awaiting moderation."
+  },
+  "POST /api/admin/reviews/:id/moderate": {
+    name: "admin.reviews.moderate",
+    description: "Approve or reject a review.",
+    params: idParams,
+    body: z.object({ status: z.enum(["approved", "rejected"]) })
+  },
+  // Admin: live events
+  "POST /api/admin/events/ticket": {
+    name: "admin.events.ticket",
+    description: "Issue a one-time ticket for the admin event stream."
+  },
+  "GET /api/admin/events": {
+    name: "admin.events.stream",
+    description: "Stream order, payment and inventory events to the admin (SSE).",
+    query: z.object({ ticket: queryValue })
+  },
+  // Webhooks
+  "POST /api/webhooks/stripe": {
+    name: "webhooks.stripe",
+    description: "Receive a signed Stripe event.",
+    // The signature covers the raw bytes, and a malformed event is answered by the handler itself.
+    body: z.unknown()
+  },
+  // The admin SPA, served when attachHttp is given an admin root (or NYMBAL_ADMIN_DIST is set)
+  "GET /admin": {
+    name: "admin.app.redirect",
+    description: "Redirect to the admin app."
+  },
+  "GET /admin/": {
+    name: "admin.app.index",
+    description: "Serve the admin app."
+  },
+  "GET /admin/*": {
+    name: "admin.app.asset",
+    description: "Serve the admin app and its assets.",
+    params: z.object({ "*": z.string().optional() })
+  }
+};
+
+// src/routes/validated-adapter.ts
+var PARTS = ["params", "query", "body"];
+function schemaFor(method, path) {
+  const key = `${method} ${path}`;
+  const schema = routeSchemas[key];
+  if (!schema) {
+    throw new ConfigError(`route ${key} has no entry in routeSchemas`, {
+      code: "config.route_schema_missing",
+      context: { method, path }
+    });
+  }
+  return schema;
+}
+function parseInput(schema, ctx) {
+  const issues = [];
+  const parsed = {
+    params: {},
+    query: {},
+    body: void 0
+  };
+  for (const part of PARTS) {
+    const partSchema = schema[part];
+    if (!partSchema) continue;
+    const result = partSchema.safeParse(ctx[part]);
+    if (result.success) parsed[part] = result.data;
+    else {
+      for (const issue of result.error.issues) {
+        issues.push({ path: [part, ...issue.path], message: issue.message });
+      }
+    }
+  }
+  if (issues.length > 0) return { ok: false, issues };
+  return {
+    ok: true,
+    ctx: {
+      ...ctx,
+      params: parsed.params,
+      query: parsed.query,
+      body: parsed.body
+    }
+  };
+}
+function invalid(issues) {
+  return fail("validation.failed", "The request input is invalid", 400, { issues });
+}
+function validatedAdapter(adapter) {
+  return {
+    registerRoute(method, path, handler, options) {
+      const schema = schemaFor(method, path);
+      adapter.registerRoute(
+        method,
+        path,
+        async (ctx) => {
+          const input = parseInput(schema, ctx);
+          return input.ok ? handler(input.ctx) : invalid(input.issues);
+        },
+        options
+      );
+    },
+    registerStreamRoute(method, path, handler, options) {
+      const schema = schemaFor(method, path);
+      adapter.registerStreamRoute(
+        method,
+        path,
+        async (ctx, stream) => {
+          const input = parseInput(schema, ctx);
+          if (input.ok) return handler(input.ctx, stream);
+          stream.send({ event: "error", data: { code: "validation.failed", issues: input.issues } });
+          stream.close();
+        },
+        options
+      );
+    },
+    registerMiddleware(middleware) {
+      adapter.registerMiddleware(middleware);
+    },
+    setDefaultHeaders(headers) {
+      adapter.setDefaultHeaders(headers);
+    },
+    start(port, host) {
+      return adapter.start(port, host);
+    },
+    stop() {
+      return adapter.stop();
+    }
+  };
+}
+
+// src/routes/register.ts
+function registerAllRoutes(deps) {
+  const { config, services, adapters, repos, documentStore, eventBus, publisher } = deps;
+  const adapter = validatedAdapter(deps.adapter);
+  adapter.registerMiddleware(createAuthMiddleware(services.auth));
+  registerAuthRoutes(adapter, services.auth);
+  registerCategoryRoutes(adapter, documentStore, config.store.name);
+  registerProductRoutes(
+    adapter,
+    documentStore,
+    config.store.name,
+    adapters.reviews,
+    services.search
+  );
+  registerCartRoutes(adapter, {
+    cart: services.cart,
+    productRepo: repos.product,
+    variantRepo: repos.variant
+  });
+  registerCheckoutRoutes(adapter, services.checkout);
+  registerOrderRoutes(adapter, services.order, documentStore);
+  registerCustomerRoutes(adapter, services.customer);
+  registerAdminRoutes(adapter, {
+    config,
+    services,
+    repos,
+    adapters
+  });
+  registerEventsSseRoute(adapter, {
+    eventBus,
+    documentStore,
+    ticketSecret: config.security.auth.jwtSecret
+  });
+  registerStripeWebhookRoute(adapter, {
+    payments: adapters.payments,
+    checkout: services.checkout,
+    publisher,
+    store: repos.processedEvent.store,
+    processedEvents: repos.processedEvent,
+    orders: repos.order
+  });
+  if (deps.adminRoot !== void 0) registerAdminStaticRoute(adapter, deps.adminRoot);
+}
+
+export {
+  formatMoney,
+  PROVIDER_REFUND_REASON,
+  orderPayment,
+  settlementOf,
+  refreshRefunded,
+  createRefundService,
+  registerAdminStaticRoute,
+  routeSchemas,
+  registerAllRoutes
+};
+//# sourceMappingURL=chunk-74KODSYJ.js.map