@porulle/plugin-marketplace 0.1.0

package/dist/routes/disputes-returns-reviews.js

@@ -0,0 +1,179 @@
+import { router } from "@porulle/core";
+import { OpenDisputeBodySchema, RespondDisputeBodySchema, ResolveDisputeBodySchema, RequestReturnBodySchema, ShipBackReturnBodySchema, CreateReviewBodySchema, ModerateReviewBodySchema, } from "../schemas/disputes-returns-reviews.js";
+import { stripUndefined } from "./util.js";
+export function buildDisputesReturnsReviewsRoutes(services) {
+    // ═══════════════════════════════════════════════════════════════════════════
+    // DISPUTES
+    // ═══════════════════════════════════════════════════════════════════════════
+    const disputes = router("Marketplace - Disputes", "/marketplace/disputes");
+    disputes.post("/")
+        .summary("Open a dispute")
+        .auth()
+        .input(OpenDisputeBodySchema)
+        .handler(async ({ input }) => {
+        const body = input;
+        return services.dispute.open(stripUndefined({
+            subOrderId: body.subOrderId,
+            openedBy: body.openedBy,
+            reason: body.reason,
+            description: body.description,
+        }));
+    });
+    disputes.get("/")
+        .summary("List disputes")
+        .auth()
+        .handler(async ({ query }) => {
+        return services.dispute.list(stripUndefined({
+            status: query.status,
+            subOrderId: query.subOrderId,
+        }));
+    });
+    disputes.get("/{id}")
+        .summary("Get dispute by ID")
+        .auth()
+        .handler(async ({ params }) => {
+        const dispute = await services.dispute.getById(params.id);
+        if (!dispute)
+            throw new Error("Dispute not found");
+        return dispute;
+    });
+    disputes.post("/{id}/respond")
+        .summary("Respond to a dispute")
+        .auth()
+        .input(RespondDisputeBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        return services.dispute.respond(params.id, stripUndefined({
+            party: body.party,
+            note: body.note,
+            url: body.url,
+        }));
+    });
+    disputes.post("/{id}/escalate")
+        .summary("Escalate a dispute")
+        .auth()
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const updated = await services.dispute.escalate(params.id);
+        if (!updated)
+            throw new Error("Dispute not found");
+        return updated;
+    });
+    disputes.post("/{id}/resolve")
+        .summary("Resolve a dispute")
+        .auth()
+        .permission("marketplace:admin")
+        .input(ResolveDisputeBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        const updated = await services.dispute.resolve(params.id, stripUndefined({
+            resolution: body.resolution,
+            notes: body.notes,
+            refundAmountCents: body.refundAmountCents,
+            resolvedBy: body.resolvedBy,
+        }));
+        if (!updated)
+            throw new Error("Dispute not found");
+        return updated;
+    });
+    // ═══════════════════════════════════════════════════════════════════════════
+    // RETURNS
+    // ═══════════════════════════════════════════════════════════════════════════
+    const returns = router("Marketplace - Returns", "/marketplace/returns");
+    returns.post("/")
+        .summary("Request a return")
+        .auth()
+        .input(RequestReturnBodySchema)
+        .handler(async ({ input }) => {
+        const body = input;
+        return services.return.request(stripUndefined({
+            subOrderId: body.subOrderId,
+            customerId: body.customerId,
+            reason: body.reason,
+            description: body.description,
+            lineItems: body.lineItems,
+        }));
+    });
+    returns.get("/")
+        .summary("List returns")
+        .auth()
+        .handler(async ({ query }) => {
+        return services.return.list(stripUndefined({
+            subOrderId: query.subOrderId,
+            status: query.status,
+        }));
+    });
+    returns.get("/{id}")
+        .summary("Get return by ID")
+        .auth()
+        .handler(async ({ params }) => {
+        const ret = await services.return.getById(params.id);
+        if (!ret)
+            throw new Error("Return not found");
+        return ret;
+    });
+    returns.post("/{id}/ship-back")
+        .summary("Ship back a return")
+        .auth()
+        .input(ShipBackReturnBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        const updated = await services.return.shipBack(params.id, body.trackingNumber);
+        if (!updated)
+            throw new Error("Return not found");
+        return updated;
+    });
+    returns.post("/{id}/receive")
+        .summary("Mark a return as received")
+        .auth()
+        .handler(async ({ params }) => {
+        const updated = await services.return.receive(params.id);
+        if (!updated)
+            throw new Error("Return not found");
+        return updated;
+    });
+    // ═══════════════════════════════════════════════════════════════════════════
+    // REVIEWS
+    // ═══════════════════════════════════════════════════════════════════════════
+    const vendorReviews = router("Marketplace - Reviews", "/marketplace/vendors");
+    vendorReviews.post("/{id}/reviews")
+        .summary("Create a vendor review")
+        .auth()
+        .input(CreateReviewBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        return services.review.create(stripUndefined({
+            vendorId: params.id,
+            customerId: body.customerId,
+            orderId: body.orderId,
+            rating: body.rating,
+            title: body.title,
+            body: body.body,
+        }));
+    });
+    vendorReviews.get("/{id}/reviews")
+        .summary("List reviews for a vendor")
+        .auth()
+        .handler(async ({ params }) => {
+        return services.review.getForVendor(params.id);
+    });
+    const reviewsMod = router("Marketplace - Reviews", "/marketplace/reviews");
+    reviewsMod.patch("/{id}")
+        .summary("Moderate a review (update status)")
+        .auth()
+        .permission("marketplace:admin")
+        .input(ModerateReviewBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        const updated = await services.review.moderate(params.id, body.status);
+        if (!updated)
+            throw new Error("Review not found");
+        return updated;
+    });
+    return [
+        ...disputes.routes(),
+        ...returns.routes(),
+        ...vendorReviews.routes(),
+        ...reviewsMod.routes(),
+    ];
+}

package/dist/routes/payouts.d.ts

@@ -0,0 +1,6 @@
+import type { PluginRouteRegistration } from "@porulle/core";
+import type { PayoutService } from "../services/payout.js";
+export declare function buildPayoutRoutes(services: {
+    payout: PayoutService;
+}): PluginRouteRegistration[];
+//# sourceMappingURL=payouts.d.ts.map

package/dist/routes/payouts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payouts.d.ts","sourceRoot":"","sources":["../../src/routes/payouts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAC;CACvB,GAAG,uBAAuB,EAAE,CAyC5B"}

package/dist/routes/payouts.js

@@ -0,0 +1,40 @@
+import { router } from "@porulle/core";
+import { stripUndefined } from "./util.js";
+export function buildPayoutRoutes(services) {
+    const r = router("Marketplace - Payouts", "/marketplace/payouts");
+    // ─── List payouts ──────────────────────────────────────────────────────────
+    r.get("/")
+        .summary("List payouts")
+        .permission("marketplace:admin")
+        .handler(async ({ query }) => {
+        return services.payout.listPayouts(stripUndefined({
+            vendorId: query.vendorId,
+            status: query.status,
+        }));
+    });
+    // ─── Run payout cycle ──────────────────────────────────────────────────────
+    r.post("/run")
+        .summary("Run a payout cycle")
+        .permission("marketplace:admin")
+        .handler(async () => {
+        return services.payout.runPayoutCycle();
+    });
+    // ─── Retry payout ──────────────────────────────────────────────────────────
+    r.post("/{id}/retry")
+        .summary("Retry a failed payout")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        return services.payout.retryPayout(params.id);
+    });
+    // ─── Get payout by id ──────────────────────────────────────────────────────
+    r.get("/{id}")
+        .summary("Get payout by ID")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const payout = await services.payout.getPayoutById(params.id);
+        if (!payout)
+            throw new Error("Payout not found");
+        return payout;
+    });
+    return r.routes();
+}

package/dist/routes/sub-orders.d.ts

@@ -0,0 +1,6 @@
+import type { PluginRouteRegistration } from "@porulle/core";
+import type { SubOrderService } from "../services/sub-order.js";
+export declare function buildSubOrderRoutes(services: {
+    subOrder: SubOrderService;
+}): PluginRouteRegistration[];
+//# sourceMappingURL=sub-orders.d.ts.map

package/dist/routes/sub-orders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sub-orders.d.ts","sourceRoot":"","sources":["../../src/routes/sub-orders.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAKhE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,eAAe,CAAC;CAC3B,GAAG,uBAAuB,EAAE,CA2C5B"}

package/dist/routes/sub-orders.js

@@ -0,0 +1,44 @@
+import { router } from "@porulle/core";
+import { UpdateSubOrderStatusBodySchema } from "../schemas/sub-orders.js";
+import { stripUndefined } from "./util.js";
+export function buildSubOrderRoutes(services) {
+    const r = router("Marketplace - Sub-Orders", "/marketplace/sub-orders");
+    // ─── List sub-orders ───────────────────────────────────────────────────────
+    r.get("/")
+        .summary("List sub-orders")
+        .permission("marketplace:admin")
+        .handler(async ({ query }) => {
+        return services.subOrder.list(stripUndefined({
+            orderId: query.orderId,
+            vendorId: query.vendorId,
+            status: query.status,
+        }));
+    });
+    // ─── Get sub-order by id ───────────────────────────────────────────────────
+    r.get("/{id}")
+        .summary("Get sub-order by ID")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const subOrder = await services.subOrder.getById(params.id);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        return subOrder;
+    });
+    // ─── Force status change ───────────────────────────────────────────────────
+    r.patch("/{id}/status")
+        .summary("Force a sub-order status change")
+        .permission("marketplace:admin")
+        .input(UpdateSubOrderStatusBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        const subOrder = await services.subOrder.getById(params.id);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        // Use cancel() for cancelled status to trigger side effects
+        // (inventory release + ledger reversal)
+        return body.status === "cancelled"
+            ? services.subOrder.cancel(params.id, "Admin force cancel")
+            : services.subOrder.forceStatus(params.id, body.status);
+    });
+    return r.routes();
+}

package/dist/routes/util.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Removes keys whose value is `undefined` from an object, returning a
+ * cleaned copy that satisfies `exactOptionalPropertyTypes`.
+ *
+ * Zod's `.optional()` produces `T | undefined` in inferred types, which
+ * can't be assigned to optional properties under `exactOptionalPropertyTypes`.
+ * This helper strips those `undefined` entries at runtime and casts the
+ * result so TypeScript accepts it.
+ */
+export declare function stripUndefined<T>(obj: T): T extends Record<string, any> ? {
+    [K in keyof T]: Exclude<T[K], undefined>;
+} : T;
+/** Keys that must never be exposed in API responses. */
+declare const VENDOR_SECRET_KEYS: readonly ["storeAccessToken", "storeConsumerSecret", "storeWebhookSecret", "bankAccount"];
+/**
+ * Returns a copy of a vendor record with sensitive fields removed.
+ *
+ * Accepts any object with string keys so it works with both single vendor
+ * rows and Drizzle `InferSelectModel` types without importing the schema.
+ */
+export declare function stripVendorSecrets<T extends Record<string, unknown>>(vendor: T): Omit<T, (typeof VENDOR_SECRET_KEYS)[number]>;
+export {};
+//# sourceMappingURL=util.d.ts.map

package/dist/routes/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../src/routes/util.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;CAAE,GAAG,CAAC,CAS1H;AAED,wDAAwD;AACxD,QAAA,MAAM,kBAAkB,2FAKd,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAM7H"}

package/dist/routes/util.js

@@ -0,0 +1,41 @@
+/**
+ * Removes keys whose value is `undefined` from an object, returning a
+ * cleaned copy that satisfies `exactOptionalPropertyTypes`.
+ *
+ * Zod's `.optional()` produces `T | undefined` in inferred types, which
+ * can't be assigned to optional properties under `exactOptionalPropertyTypes`.
+ * This helper strips those `undefined` entries at runtime and casts the
+ * result so TypeScript accepts it.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function stripUndefined(obj) {
+    if (obj == null || typeof obj !== "object")
+        return obj;
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        if (value !== undefined) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/** Keys that must never be exposed in API responses. */
+const VENDOR_SECRET_KEYS = [
+    "storeAccessToken",
+    "storeConsumerSecret",
+    "storeWebhookSecret",
+    "bankAccount",
+];
+/**
+ * Returns a copy of a vendor record with sensitive fields removed.
+ *
+ * Accepts any object with string keys so it works with both single vendor
+ * rows and Drizzle `InferSelectModel` types without importing the schema.
+ */
+export function stripVendorSecrets(vendor) {
+    const copy = { ...vendor };
+    for (const key of VENDOR_SECRET_KEYS) {
+        delete copy[key];
+    }
+    return copy;
+}

package/dist/routes/vendor-portal.d.ts

@@ -0,0 +1,14 @@
+import type { PluginRouteRegistration } from "@porulle/core";
+import type { VendorService } from "../services/vendor.js";
+import type { SubOrderService } from "../services/sub-order.js";
+import type { PayoutService } from "../services/payout.js";
+import type { ReviewService } from "../services/review.js";
+import type { ReturnService } from "../services/return.js";
+export declare function buildVendorPortalRoutes(services: {
+    vendor: VendorService;
+    subOrder: SubOrderService;
+    payout: PayoutService;
+    review: ReviewService;
+    return: ReturnService;
+}): PluginRouteRegistration[];
+//# sourceMappingURL=vendor-portal.d.ts.map

package/dist/routes/vendor-portal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor-portal.d.ts","sourceRoot":"","sources":["../../src/routes/vendor-portal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAqB3D,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;CACvB,GAAG,uBAAuB,EAAE,CAkP5B"}

package/dist/routes/vendor-portal.js

@@ -0,0 +1,255 @@
+import { router } from "@porulle/core";
+import { vendorEntities } from "../schema.js";
+import { eq } from "@porulle/core/drizzle";
+import { UpdateVendorProfileBodySchema, UploadVendorDocumentBodySchema, ShipSubOrderBodySchema, CancelSubOrderBodySchema, RespondToReviewBodySchema, ApproveReturnBodySchema, RejectReturnBodySchema, } from "../schemas/vendor-portal.js";
+import { stripUndefined, stripVendorSecrets } from "./util.js";
+/** Helper to extract vendorId from actor and throw if missing. */
+function requireVendorId(actor) {
+    const vendorId = actor?.vendorId;
+    if (!vendorId)
+        throw new Error("Forbidden");
+    return vendorId;
+}
+export function buildVendorPortalRoutes(services) {
+    const r = router("Marketplace - Vendor Portal", "/marketplace/vendor/me");
+    // ─── Get my vendor profile ─────────────────────────────────────────────────
+    r.get("/")
+        .summary("Get my vendor profile")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        const vendor = await services.vendor.getById(vendorId);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(vendor);
+    });
+    // ─── Update my vendor profile ──────────────────────────────────────────────
+    r.patch("/")
+        .summary("Update my vendor profile")
+        .auth()
+        .input(UpdateVendorProfileBodySchema)
+        .handler(async ({ actor, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        const updated = await services.vendor.update(vendorId, stripUndefined(body));
+        if (!updated)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(updated);
+    });
+    // ─── Upload document ───────────────────────────────────────────────────────
+    r.post("/documents")
+        .summary("Upload a document for my vendor profile")
+        .auth()
+        .input(UploadVendorDocumentBodySchema)
+        .handler(async ({ actor, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        return services.vendor.uploadDocument(vendorId, {
+            type: body.type,
+            fileUrl: body.fileUrl,
+        });
+    });
+    // ─── List my documents ─────────────────────────────────────────────────────
+    r.get("/documents")
+        .summary("List my vendor documents")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        return services.vendor.listDocuments(vendorId);
+    });
+    // ─── List my products ──────────────────────────────────────────────────────
+    r.get("/products")
+        .summary("List my products")
+        .auth()
+        .handler(async ({ actor, db }) => {
+        const vendorId = requireVendorId(actor);
+        const drizzle = db;
+        const entities = await drizzle
+            .select()
+            .from(vendorEntities)
+            .where(eq(vendorEntities.vendorId, vendorId));
+        return entities;
+    });
+    // ─── List my sub-orders ────────────────────────────────────────────────────
+    r.get("/orders")
+        .summary("List my sub-orders")
+        .auth()
+        .handler(async ({ actor, query }) => {
+        const vendorId = requireVendorId(actor);
+        const status = query.status;
+        return services.subOrder.listByVendor(vendorId, stripUndefined({ status }));
+    });
+    // ─── Get single sub-order ──────────────────────────────────────────────────
+    r.get("/orders/{subOrderId}")
+        .summary("Get a single sub-order")
+        .auth()
+        .handler(async ({ actor, params }) => {
+        const vendorId = requireVendorId(actor);
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return subOrder;
+    });
+    // ─── Confirm sub-order ─────────────────────────────────────────────────────
+    r.post("/orders/{subOrderId}/confirm")
+        .summary("Confirm a sub-order")
+        .auth()
+        .handler(async ({ actor, params }) => {
+        const vendorId = requireVendorId(actor);
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return services.subOrder.confirm(params.subOrderId);
+    });
+    // ─── Ship sub-order ────────────────────────────────────────────────────────
+    r.post("/orders/{subOrderId}/ship")
+        .summary("Ship a sub-order")
+        .auth()
+        .input(ShipSubOrderBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return services.subOrder.ship(params.subOrderId, {
+            trackingNumber: body.trackingNumber,
+            carrier: body.carrier,
+        });
+    });
+    // ─── Deliver sub-order ─────────────────────────────────────────────────────
+    r.post("/orders/{subOrderId}/deliver")
+        .summary("Mark a sub-order as delivered")
+        .auth()
+        .handler(async ({ actor, params }) => {
+        const vendorId = requireVendorId(actor);
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return services.subOrder.deliver(params.subOrderId);
+    });
+    // ─── Cancel sub-order ──────────────────────────────────────────────────────
+    r.post("/orders/{subOrderId}/cancel")
+        .summary("Cancel a sub-order")
+        .auth()
+        .input(CancelSubOrderBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return services.subOrder.cancel(params.subOrderId, body.reason);
+    });
+    // ─── List my payouts ───────────────────────────────────────────────────────
+    r.get("/payouts")
+        .summary("List my payouts")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        return services.payout.listPayouts({ vendorId });
+    });
+    // ─── My balance ────────────────────────────────────────────────────────────
+    r.get("/balance")
+        .summary("Get my balance")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        const balance = await services.payout.getBalance(vendorId);
+        const ledger = await services.payout.getLedger(vendorId);
+        return { balanceCents: balance, ledger };
+    });
+    // ─── My analytics ──────────────────────────────────────────────────────────
+    r.get("/analytics")
+        .summary("Get my analytics")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        const rating = await services.review.getAggregateRating(vendorId);
+        const balance = await services.payout.getBalance(vendorId);
+        return { rating, balanceCents: balance };
+    });
+    // ─── My reviews ────────────────────────────────────────────────────────────
+    r.get("/reviews")
+        .summary("List my reviews")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        return services.review.getForVendor(vendorId, true);
+    });
+    // ─── Respond to review ─────────────────────────────────────────────────────
+    r.post("/reviews/{id}/respond")
+        .summary("Respond to a review")
+        .auth()
+        .input(RespondToReviewBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        // IDOR prevention: verify the review belongs to this vendor
+        const vendorReviews = await services.review.getForVendor(vendorId, true);
+        const ownsReview = vendorReviews.some((rev) => rev.id === params.id);
+        if (!ownsReview)
+            throw new Error("Forbidden: review does not belong to this vendor");
+        const updated = await services.review.respond(params.id, body.response);
+        if (!updated)
+            throw new Error("Review not found");
+        return updated;
+    });
+    // ─── My returns ────────────────────────────────────────────────────────────
+    r.get("/returns")
+        .summary("List my returns")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        return services.return.listByVendor(vendorId);
+    });
+    // ─── Approve return ────────────────────────────────────────────────────────
+    r.post("/returns/{id}/approve")
+        .summary("Approve a return request")
+        .auth()
+        .input(ApproveReturnBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const ret = await services.return.getById(params.id);
+        if (!ret)
+            throw new Error("Return not found");
+        const subOrder = await services.subOrder.getById(ret.subOrderId);
+        if (!subOrder || subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        const body = input;
+        const updated = await services.return.vendorApprove(params.id, body.refundAmountCents);
+        if (!updated)
+            throw new Error("Return not found");
+        return updated;
+    });
+    // ─── Reject return ─────────────────────────────────────────────────────────
+    r.post("/returns/{id}/reject")
+        .summary("Reject a return request")
+        .auth()
+        .input(RejectReturnBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const ret = await services.return.getById(params.id);
+        if (!ret)
+            throw new Error("Return not found");
+        const subOrder = await services.subOrder.getById(ret.subOrderId);
+        if (!subOrder || subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        const body = input;
+        const updated = await services.return.vendorReject(params.id, body.notes);
+        if (!updated)
+            throw new Error("Return not found");
+        return updated;
+    });
+    return r.routes();
+}

package/dist/routes/vendors.d.ts

@@ -0,0 +1,11 @@
+import type { PluginRouteRegistration } from "@porulle/core";
+import type { VendorService } from "../services/vendor.js";
+import type { PayoutService } from "../services/payout.js";
+import type { ReviewService } from "../services/review.js";
+import type { MarketplacePluginOptions } from "../types.js";
+export declare function buildVendorRoutes(services: {
+    vendor: VendorService;
+    payout: PayoutService;
+    review: ReviewService;
+}, options?: MarketplacePluginOptions): PluginRouteRegistration[];
+//# sourceMappingURL=vendors.d.ts.map

package/dist/routes/vendors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendors.d.ts","sourceRoot":"","sources":["../../src/routes/vendors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAU5D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;CACvB,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,uBAAuB,EAAE,CAoLhE"}