@rovela-ai/sdk 0.19.4 → 0.19.6

package/templates/store-template/app/api/account/orders/[id]/refund/route.ts

@@ -0,0 +1,11 @@
+/**
+ * Customer Refund Request API Route
+ *
+ * POST /api/account/orders/[id]/refund - Request a refund for an order
+ *
+ * Only available for orders that:
+ * - Belong to the authenticated customer
+ * - Have status 'paid' (not yet shipped)
+ */
+
+export { POST } from '@rovela-ai/sdk/auth/api/request-refund'

package/templates/store-template/app/api/account/orders/[id]/return/route.ts

@@ -0,0 +1,14 @@
+/**
+ * Customer Return Request API Route
+ *
+ * POST /api/account/orders/[id]/return - Request a return for a delivered order
+ *
+ * Only available for orders that:
+ * - Belong to the authenticated customer
+ * - Have status 'delivered'
+ *
+ * This creates a return request that must be approved by an admin
+ * before a refund is processed.
+ */
+
+export { POST } from '@rovela-ai/sdk/auth/api/request-return'

package/templates/store-template/app/api/account/orders/[id]/route.ts

@@ -0,0 +1,42 @@
+/**
+ * Customer Single Order API Route
+ *
+ * GET /api/account/orders/[id] - Get single order for authenticated customer
+ *
+ * Protected by `requireCustomer()`. In addition, we verify the order's
+ * `customerId` matches the authenticated customer — cross-customer access
+ * returns 403 rather than leaking existence information.
+ */
+
+import { requireCustomer } from '@rovela-ai/sdk/auth/server'
+import { findOrderById } from '@rovela-ai/sdk/core/server'
+
+export async function GET(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const guard = await requireCustomer()
+  if (!guard.ok) return guard.response
+
+  try {
+    const { id } = await params
+    const order = await findOrderById(id)
+
+    if (!order) {
+      return Response.json({ error: 'Order not found' }, { status: 404 })
+    }
+
+    // Verify the order belongs to this customer
+    if (order.customerId !== guard.customer.id) {
+      return Response.json({ error: 'Forbidden' }, { status: 403 })
+    }
+
+    return Response.json({ order })
+  } catch (error) {
+    console.error('Failed to fetch order:', error)
+    return Response.json(
+      { error: 'Failed to fetch order' },
+      { status: 500 }
+    )
+  }
+}

package/templates/store-template/app/api/account/orders/route.ts

@@ -0,0 +1,29 @@
+/**
+ * Customer Orders API Route
+ *
+ * GET /api/account/orders - Get orders for authenticated customer
+ *
+ * Protected by `requireCustomer()` which:
+ *   - Rejects unauthenticated requests (401)
+ *   - Rejects admin sessions (403) — defense in depth
+ *   - Verifies the customer row still exists in the store DB (401 if not)
+ */
+
+import { requireCustomer } from '@rovela-ai/sdk/auth/server'
+import { findOrdersWithItems } from '@rovela-ai/sdk/core/server'
+
+export async function GET() {
+  const guard = await requireCustomer()
+  if (!guard.ok) return guard.response
+
+  try {
+    const orders = await findOrdersWithItems({ customerId: guard.customer.id })
+    return Response.json({ orders })
+  } catch (error) {
+    console.error('Failed to fetch orders:', error)
+    return Response.json(
+      { error: 'Failed to fetch orders' },
+      { status: 500 }
+    )
+  }
+}

package/templates/store-template/app/api/account/profile/route.ts

@@ -0,0 +1,165 @@
+/**
+ * Customer Profile API Route
+ *
+ * GET /api/account/profile - Get current customer profile
+ * PUT /api/account/profile - Update customer name and/or email
+ *
+ * Protected by `requireCustomer()` — admins get a 403, not a 401, because
+ * the endpoint is valid but the identity class isn't.
+ */
+
+import { requireCustomer } from '@rovela-ai/sdk/auth/server'
+import {
+  findCustomerById,
+  updateCustomer,
+  emailExists,
+} from '@rovela-ai/sdk/auth/server'
+
+/**
+ * GET /api/account/profile
+ *
+ * Returns the authenticated customer's profile information.
+ */
+export async function GET() {
+  const guard = await requireCustomer()
+  if (!guard.ok) return guard.response
+
+  try {
+    const customer = await findCustomerById(guard.customer.id)
+
+    if (!customer) {
+      return Response.json({ error: 'Customer not found' }, { status: 404 })
+    }
+
+    // Return profile data (exclude sensitive fields)
+    return Response.json({
+      profile: {
+        id: customer.id,
+        email: customer.email,
+        name: customer.name,
+        phone: customer.phone ?? null,
+        emailVerified: !!customer.emailVerified,
+        createdAt: customer.createdAt,
+      },
+    })
+  } catch (error) {
+    console.error('[Profile API] Failed to fetch profile:', error)
+    return Response.json(
+      { error: 'Failed to fetch profile' },
+      { status: 500 }
+    )
+  }
+}
+
+/**
+ * PUT /api/account/profile
+ *
+ * Updates the authenticated customer's profile.
+ * Accepts: { name?: string, email?: string, phone?: string | null }
+ */
+export async function PUT(request: Request) {
+  const guard = await requireCustomer()
+  if (!guard.ok) return guard.response
+
+  try {
+    const body = await request.json()
+    const { name, email, phone } = body as {
+      name?: string
+      email?: string
+      phone?: string | null
+    }
+
+    // Validate input
+    if (name !== undefined && typeof name !== 'string') {
+      return Response.json(
+        { error: 'Name must be a string' },
+        { status: 400 }
+      )
+    }
+
+    if (name !== undefined && name.trim().length > 100) {
+      return Response.json(
+        { error: 'Name must be 100 characters or less' },
+        { status: 400 }
+      )
+    }
+
+    if (phone !== undefined && phone !== null && typeof phone !== 'string') {
+      return Response.json(
+        { error: 'Phone must be a string' },
+        { status: 400 }
+      )
+    }
+
+    if (typeof phone === 'string' && phone.trim().length > 40) {
+      return Response.json(
+        { error: 'Phone must be 40 characters or less' },
+        { status: 400 }
+      )
+    }
+
+    if (email !== undefined) {
+      if (typeof email !== 'string') {
+        return Response.json(
+          { error: 'Email must be a string' },
+          { status: 400 }
+        )
+      }
+
+      // Simple email validation
+      const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+      if (!emailRegex.test(email)) {
+        return Response.json(
+          { error: 'Invalid email format' },
+          { status: 400 }
+        )
+      }
+
+      // Check if email is already in use by another customer
+      const normalizedEmail = email.toLowerCase().trim()
+      const currentCustomer = await findCustomerById(guard.customer.id)
+
+      if (currentCustomer && currentCustomer.email !== normalizedEmail) {
+        const emailTaken = await emailExists(normalizedEmail)
+        if (emailTaken) {
+          return Response.json(
+            { error: 'Email is already registered' },
+            { status: 400 }
+          )
+        }
+      }
+    }
+
+    // Update customer
+    const updatedCustomer = await updateCustomer(guard.customer.id, {
+      name: name?.trim(),
+      email: email?.toLowerCase().trim(),
+      ...(phone !== undefined ? { phone: phone === null ? null : phone.trim() } : {}),
+    })
+
+    if (!updatedCustomer) {
+      return Response.json(
+        { error: 'Customer not found' },
+        { status: 404 }
+      )
+    }
+
+    return Response.json({
+      success: true,
+      profile: {
+        id: updatedCustomer.id,
+        email: updatedCustomer.email,
+        name: updatedCustomer.name,
+        phone: updatedCustomer.phone ?? null,
+        emailVerified: !!updatedCustomer.emailVerified,
+        createdAt: updatedCustomer.createdAt,
+      },
+    })
+  } catch (error) {
+    console.error('[Profile API] Failed to update profile:', error)
+    return Response.json(
+      { error: 'Failed to update profile' },
+      { status: 500 }
+    )
+  }
+}

package/templates/store-template/app/api/admin/accept-invite/route.ts

@@ -0,0 +1,11 @@
+/**
+ * Admin Accept Invite API Route
+ *
+ * Thin re-export of the SDK handlers:
+ *   GET ?token=X     — non-destructive token validation (returns invitee snippet)
+ *   POST { token, password } — consume the token, activate the admin
+ *
+ * Unauthenticated — the token IS the auth.
+ */
+
+export { GET, POST } from '@rovela-ai/sdk/admin/api/accept-invite'

package/templates/store-template/app/api/admin/analytics/events/route.ts

@@ -0,0 +1,9 @@
+/**
+ * GET /api/admin/analytics/events
+ *
+ * Cursor-paginated raw event log. Admin-gated.
+ *
+ * See CLAUDE.md §46.
+ */
+
+export { GET } from '@rovela-ai/sdk/analytics/api/events'

package/templates/store-template/app/api/admin/analytics/route.ts

@@ -0,0 +1,10 @@
+/**
+ * GET /api/admin/analytics?period=today|7d|30d|90d
+ *
+ * Admin-gated dashboard payload (visitors, sessions, pageviews, conversion,
+ * top pages, top products, traffic sources, devices). Gated on settings.read.
+ *
+ * See CLAUDE.md §46.
+ */
+
+export { GET } from '@rovela-ai/sdk/analytics/api/dashboard'

package/templates/store-template/app/api/admin/analytics/visitors/route.ts

@@ -0,0 +1,9 @@
+/**
+ * GET /api/admin/analytics/visitors
+ *
+ * Per-visitor aggregate (offset-paginated). Admin-gated.
+ *
+ * See CLAUDE.md §46.
+ */
+
+export { GET } from '@rovela-ai/sdk/analytics/api/visitors'

package/templates/store-template/app/api/admin/branding/favicon/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Favicon API — SDK re-export (see @rovela-ai/sdk/admin/api/branding).
+ *
+ * Same architecture as the logo route: R2 object at the fixed key
+ * stores/{STORE_ID}/branding/favicon + store_settings.favicon_url mirror.
+ * The favicon surfaces in the browser tab (app/layout.tsx metadata) and the
+ * admin top bar tile; both fall back to the logo when no favicon is set.
+ */
+export { faviconGET as GET, faviconPOST as POST, faviconDELETE as DELETE } from '@rovela-ai/sdk/admin/api/branding'

package/templates/store-template/app/api/admin/branding/logo/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Logo API — SDK re-export (see @rovela-ai/sdk/admin/api/branding).
+ *
+ * Writes the R2 object at the fixed key stores/{STORE_ID}/branding/logo AND
+ * mirrors the URL into store_settings.logo_url (the store-side runtime
+ * mirror every settings-first surface reads: header, emails, admin top bar).
+ * GET reads the truth directly via an R2 HEAD on the fixed key.
+ */
+export { logoGET as GET, logoPOST as POST, logoDELETE as DELETE } from '@rovela-ai/sdk/admin/api/branding'

package/templates/store-template/app/api/admin/categories/[id]/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Single Category API Route
+ *
+ * GET/PUT/DELETE /api/admin/categories/[id]
+ */
+
+import { getCategory, updateCategory, deleteCategory } from '@rovela-ai/sdk/admin/api'
+
+export { getCategory as GET, updateCategory as PUT, deleteCategory as DELETE }

package/templates/store-template/app/api/admin/categories/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Categories API Route
+ *
+ * GET/POST /api/admin/categories - List/Create categories
+ */
+
+import { getCategories, createCategory } from '@rovela-ai/sdk/admin/api'
+
+export { getCategories as GET, createCategory as POST }

package/templates/store-template/app/api/admin/check/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Check API Route
+ *
+ * Check if any admin exists for the store.
+ * Used by login page to determine whether to show setup or login form.
+ */
+
+import { GET as handler } from '@rovela-ai/sdk/admin/api/check'
+
+export const GET = handler

package/templates/store-template/app/api/admin/customer-groups/[id]/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Single Customer Group API Route
+ *
+ * PUT    /api/admin/customer-groups/[id] - Update a group
+ * DELETE /api/admin/customer-groups/[id] - Delete a group (members are ungrouped)
+ */
+
+import { updateCustomerGroupHandler, deleteCustomerGroupHandler } from '@rovela-ai/sdk/admin/api'
+
+export { updateCustomerGroupHandler as PUT, deleteCustomerGroupHandler as DELETE }

package/templates/store-template/app/api/admin/customer-groups/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Customer Groups API Route
+ *
+ * GET  /api/admin/customer-groups - List groups (with member counts)
+ * POST /api/admin/customer-groups - Create a group
+ */
+
+import { getCustomerGroups, createCustomerGroupHandler } from '@rovela-ai/sdk/admin/api'
+
+export { getCustomerGroups as GET, createCustomerGroupHandler as POST }

package/templates/store-template/app/api/admin/customers/[id]/addresses/[addressId]/route.ts

@@ -0,0 +1,15 @@
+/**
+ * Admin Customer Address — update / set-default / archive one address.
+ *
+ * PATCH  /api/admin/customers/[id]/addresses/[addressId]  → update / set default
+ * DELETE /api/admin/customers/[id]/addresses/[addressId]  → soft-delete (archive)
+ *
+ * Gated by `customers.write` inside the SDK handlers.
+ */
+
+import {
+  updateCustomerAddressAdmin,
+  deleteCustomerAddressAdmin,
+} from '@rovela-ai/sdk/admin/api'
+
+export { updateCustomerAddressAdmin as PATCH, deleteCustomerAddressAdmin as DELETE }

package/templates/store-template/app/api/admin/customers/[id]/addresses/route.ts

@@ -0,0 +1,15 @@
+/**
+ * Admin Customer Address Book — list + create.
+ *
+ * GET  /api/admin/customers/[id]/addresses  → list a customer's saved addresses
+ * POST /api/admin/customers/[id]/addresses  → create an address for the customer
+ *
+ * Gated by `customers.read` / `customers.write` inside the SDK handlers.
+ */
+
+import {
+  listCustomerAddressesAdmin,
+  createCustomerAddressAdmin,
+} from '@rovela-ai/sdk/admin/api'
+
+export { listCustomerAddressesAdmin as GET, createCustomerAddressAdmin as POST }

package/templates/store-template/app/api/admin/customers/[id]/route.ts

@@ -0,0 +1,11 @@
+/**
+ * Admin Single Customer API Route
+ *
+ * GET /api/admin/customers/[id] - Get customer details
+ * PUT /api/admin/customers/[id] - Update customer
+ * DELETE /api/admin/customers/[id] - Delete (anonymize) customer
+ */
+
+import { getCustomer, updateCustomer, deleteCustomer } from '@rovela-ai/sdk/admin/api'
+
+export { getCustomer as GET, updateCustomer as PUT, deleteCustomer as DELETE }

package/templates/store-template/app/api/admin/customers/bulk/route.ts

@@ -0,0 +1,8 @@
+/**
+ * Admin Customers Bulk API Route
+ *
+ * POST /api/admin/customers/bulk - Bulk group assign / soft delete
+ * Body: { ids: string[], action: 'assign_group' | 'delete', groupId?: string | null }
+ */
+
+export { bulkCustomers as POST } from '@rovela-ai/sdk/admin/api'

package/templates/store-template/app/api/admin/customers/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Customers API Route
+ *
+ * GET /api/admin/customers - List customers
+ */
+
+import { getCustomers } from '@rovela-ai/sdk/admin/api'
+
+export { getCustomers as GET }

package/templates/store-template/app/api/admin/discounts/[id]/route.ts

@@ -0,0 +1,11 @@
+/**
+ * Admin Single Discount API Route
+ *
+ * PUT    /api/admin/discounts/[id] - Update a discount
+ * DELETE /api/admin/discounts/[id] - Delete a discount (order history keeps
+ * its code + amount snapshots; redemption records survive)
+ */
+
+import { updateDiscountHandler, deleteDiscountHandler } from '@rovela-ai/sdk/admin/api'
+
+export { updateDiscountHandler as PUT, deleteDiscountHandler as DELETE }

package/templates/store-template/app/api/admin/discounts/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Discounts API Route
+ *
+ * GET  /api/admin/discounts - List all discounts
+ * POST /api/admin/discounts - Create a discount (code or automatic)
+ */
+
+import { getDiscounts, createDiscountHandler } from '@rovela-ai/sdk/admin/api'
+
+export { getDiscounts as GET, createDiscountHandler as POST }

package/templates/store-template/app/api/admin/emails/preview/route.ts

@@ -0,0 +1,4 @@
+/**
+ * Admin emails API — live HTML preview (sample data + drafts, nothing sent).
+ */
+export { previewEmail as POST } from '@rovela-ai/sdk/admin/api/emails'

package/templates/store-template/app/api/admin/emails/route.ts

@@ -0,0 +1,5 @@
+/**
+ * Admin emails API — registry + overrides + theme state (GET), saves (PUT).
+ * SDK re-export (see @rovela-ai/sdk/admin/api/emails).
+ */
+export { GET, PUT } from '@rovela-ai/sdk/admin/api/emails'

package/templates/store-template/app/api/admin/emails/test/route.ts

@@ -0,0 +1,4 @@
+/**
+ * Admin emails API — send the sample email to the signed-in admin.
+ */
+export { sendTestEmail as POST } from '@rovela-ai/sdk/admin/api/emails'

package/templates/store-template/app/api/admin/files/route.ts

@@ -0,0 +1,8 @@
+/**
+ * Admin Files API Route
+ *
+ * GET    /api/admin/files - List the store's media library (R2 listing)
+ * DELETE /api/admin/files - Delete one file by key (system assets protected)
+ */
+
+export { getStoreFilesHandler as GET, deleteStoreFileHandler as DELETE } from '@rovela-ai/sdk/media/api'

package/templates/store-template/app/api/admin/forgot-password/route.ts

@@ -0,0 +1,7 @@
+/**
+ * Admin Forgot Password API Route
+ *
+ * Thin re-export of the SDK handler.
+ */
+
+export { POST } from '@rovela-ai/sdk/admin/api/forgot-password'

package/templates/store-template/app/api/admin/linked-customer/route.ts

@@ -0,0 +1,11 @@
+/**
+ * Admin Linked-Customer API Route
+ *
+ * Thin re-export of the SDK handler:
+ *   GET — returns { hasLinkedCustomer } for the current admin.
+ *
+ * Powers the conditional "My customer account" entry in the admin user
+ * menu (R112). Gated on the SDK's `requireAdmin()`.
+ */
+
+export { GET } from '@rovela-ai/sdk/admin/api/linked-customer'

package/templates/store-template/app/api/admin/locations/[id]/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Location API Route (single)
+ *
+ * PUT    /api/admin/locations/[id] - Update a location
+ * DELETE /api/admin/locations/[id] - Delete a location
+ */
+
+import { updateLocationHandler, deleteLocationHandler } from '@rovela-ai/sdk/admin/api'
+
+export { updateLocationHandler as PUT, deleteLocationHandler as DELETE }

package/templates/store-template/app/api/admin/locations/route.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin Locations API Route
+ *
+ * GET  /api/admin/locations - List store locations
+ * POST /api/admin/locations - Create a location
+ */
+
+import { getLocations, createLocationHandler } from '@rovela-ai/sdk/admin/api'
+
+export { getLocations as GET, createLocationHandler as POST }

package/templates/store-template/app/api/admin/me/password/route.ts

@@ -0,0 +1,13 @@
+/**
+ * Admin Me Password API Route
+ *
+ * Thin re-export of the SDK handler. This route is mounted separately
+ * from `/api/admin/me` because Next.js uses the HTTP method name as the
+ * export binding — we have two PATCH handlers (one for profile, one for
+ * password), and they need distinct route files.
+ *
+ *   PATCH /api/admin/me/password — change own password
+ *                                  Body: { currentPassword, newPassword }
+ */
+
+export { PATCH_PASSWORD as PATCH } from '@rovela-ai/sdk/admin/api/me'

package/templates/store-template/app/api/admin/me/route.ts

@@ -0,0 +1,11 @@
+/**
+ * Admin Me API Route
+ *
+ * Thin re-export of the SDK handlers:
+ *   GET   — return the caller's own profile
+ *   PATCH — update own name / email
+ *
+ * The password change endpoint lives at /api/admin/me/password.
+ */
+
+export { GET, PATCH } from '@rovela-ai/sdk/admin/api/me'

package/templates/store-template/app/api/admin/orders/[id]/refund/route.ts

@@ -0,0 +1,7 @@
+/**
+ * Admin Order Refund API Route
+ *
+ * POST /api/admin/orders/[id]/refund - Process a refund via Stripe
+ */
+
+export { POST } from '@rovela-ai/sdk/admin/api/refund'

package/templates/store-template/app/api/admin/orders/[id]/return/approve/route.ts

@@ -0,0 +1,7 @@
+/**
+ * Admin Return Approval API Route
+ *
+ * POST /api/admin/orders/[id]/return/approve - Approve a return request and process refund
+ */
+
+export { APPROVE_POST as POST } from '@rovela-ai/sdk/admin/api/return'

package/templates/store-template/app/api/admin/orders/[id]/return/reject/route.ts

@@ -0,0 +1,7 @@
+/**
+ * Admin Return Rejection API Route
+ *
+ * POST /api/admin/orders/[id]/return/reject - Reject a return request
+ */
+
+export { REJECT_POST as POST } from '@rovela-ai/sdk/admin/api/return'

package/templates/store-template/app/api/admin/orders/[id]/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Single Order API Route
+ *
+ * GET/PUT /api/admin/orders/[id]
+ */
+
+import { getOrder, updateOrder } from '@rovela-ai/sdk/admin/api'
+
+export { getOrder as GET, updateOrder as PUT }

package/templates/store-template/app/api/admin/orders/[id]/ship-with-shippo/route.ts

@@ -0,0 +1,6 @@
+/**
+ * Purchase Shippo shipping label for an order
+ */
+import { shipWithShippo } from '@rovela-ai/sdk/admin/api'
+
+export { shipWithShippo as POST }

package/templates/store-template/app/api/admin/orders/[id]/shippo-rates/route.ts

@@ -0,0 +1,6 @@
+/**
+ * Get Shippo shipping rates for an order
+ */
+import { getShippoRatesForOrder } from '@rovela-ai/sdk/admin/api'
+
+export { getShippoRatesForOrder as GET }

package/templates/store-template/app/api/admin/orders/bulk/route.ts

@@ -0,0 +1,8 @@
+/**
+ * Admin Orders Bulk API Route
+ *
+ * POST /api/admin/orders/bulk - Bulk status update
+ * Body: { ids: string[], status: OrderStatus, notifyCustomer?: boolean }
+ */
+
+export { bulkUpdateOrders as POST } from '@rovela-ai/sdk/admin/api'

package/templates/store-template/app/api/admin/orders/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Admin Orders API Route
+ *
+ * GET /api/admin/orders - List orders
+ */
+
+import { getOrders } from '@rovela-ai/sdk/admin/api'
+
+export { getOrders as GET }