react-shopwave-connect 0.2.0 → 0.4.0

package/README.md

@@ -4,6 +4,12 @@ Shopwave API client split into two clearly separated layers:
 
 - **`core`** — framework-agnostic async API functions + all TypeScript types. No React anywhere. Works in any TS/JS project (Node script, Vue, Angular, CLI, …).
 - **`hooks`** — thin React wrappers around `core`, with a consistent `{ data, loading, error, refetch }` shape. React is a **peer dependency** and is never bundled.
+- **`server` / `next`** — the other half of the contract: OAuth login and the `/api/*` route handlers that `core` calls, so an app's API routes are one line each.
+
+```
+browser / Node ──core──▶ your app's /api/<route> ──next route handlers──▶ Shopwave API
+                         (session cookie or Authorization: OAuth <token>)
+```
 
 ```
 src/
@@ -29,7 +35,7 @@ npm install react react-dom
 | `react-shopwave-connect/hooks`        | React hooks only                              |
 | `react-shopwave-connect`              | Both (re-exports `core` + `hooks`)            |
 | `react-shopwave-connect/server`       | **Server-only.** Framework-agnostic Shopwave OAuth client + token helpers |
-| `react-shopwave-connect/next`         | **Server-only.** Next.js login/callback/logout/session route handlers, token refresh, proxy guard |
+| `react-shopwave-connect/next`         | **Server-only.** Next.js login/callback/logout/session handlers, token refresh, proxy guard, and the `/api/*` route handlers (`createShopwaveApi`) |
 
 Prefer the subpath imports when you want a hard boundary — e.g. a Node service should import from `/core` so React never enters the dependency graph.
 
@@ -41,13 +47,18 @@ Every `core` function (and every hook) accepts an optional `options` argument:
 interface RequestOptions {
   baseUrl?: string;        // prefix for every path; omit in the browser to use
                            // relative URLs like "/api/products"
-  token?: string;          // forwarded as the `token` request header
+  token?: string;          // sent as `Authorization: OAuth <token>` on every
+                           // request (GET, POST, PUT, DELETE alike)
   fetch?: typeof fetch;    // custom fetch (Node < 18, tests, interceptors)
   signal?: AbortSignal;    // cancellation (hooks pass this automatically)
 }
 ```
 
-In the browser / Next.js you can usually omit `options` entirely (relative URLs resolve against the current origin). Outside the browser, pass an absolute `baseUrl` and a `token`.
+In the browser / Next.js you can usually omit `options` entirely (relative URLs resolve against the current origin, and the app's routes use the session cookie). Outside the browser, pass the absolute `baseUrl` of an app that mounts the SDK routes (see [API routes](#4-api-routes-nextjs)) and a `token`.
+
+`core` always calls `/api/<route>` paths with the request metadata in an `extras` header, so `baseUrl` must point at such an app, not at the Shopwave API itself.
+
+> **0.3 change:** the token used to travel in `extras.token` for reads and a separate `token` header for writes. It is now always the `Authorization` header. The 0.3 route handlers still accept both old forms, so older clients keep working.
 
 ---
 
@@ -64,8 +75,8 @@ import {
 } from "react-shopwave-connect/core";
 
 const options = {
-  baseUrl: "https://api.shopwave.example",
-  token: process.env.SHOPWAVE_TOKEN,
+  baseUrl: "https://admin.example.com", // an app with the SDK's /api routes
+  token: process.env.SHOPWAVE_TOKEN,    // bare access token
 };
 
 async function main() {
@@ -94,26 +105,139 @@ On Node < 18 (no global `fetch`), inject one:
 import { fetchStores } from "react-shopwave-connect/core";
 import fetch from "node-fetch";
 
-await fetchStores({}, { baseUrl: "https://api.merchantstack.com", fetch });
+await fetchStores({}, { baseUrl: "https://admin.example.com", token, fetch });
+```
+
+Functions **throw** `ShopwaveApiError` on failure:
+
+```ts
+import { saveProduct, ShopwaveApiError } from "react-shopwave-connect/core";
+
+try {
+  await saveProduct({ name: "Tea", barcode: "123" });
+} catch (e) {
+  if (e instanceof ShopwaveApiError) {
+    e.status;          // HTTP status (0 = no response). 200/201 when the API answered with errors.
+    e.errors;          // api.message.errors, e.g. { 908: { id: 908, title: … } }
+    e.isUnauthorized;  // 401 or error 908 → send the user to log in
+  }
+}
+```
+
+The SDK never logs requests (older versions `console.log`ged headers, including tokens).
+
+### Saving and deleting (typed)
+
+Each entity has `save…`, `delete…` and `fetch…(id)`:
+
+```ts
+import { saveCategory, deleteCategory, fetchCategory } from "react-shopwave-connect/core";
+
+const created = await saveCategory({ title: "Drinks", parentId: null }); // no id → create
+created.id;                                                              // the new id, straight from the save
+
+const updated = await saveCategory({ id: created.id, title: "Hot drinks" }); // id → update
+
+await fetchCategory(created.id);                     // Category | null
+await fetchCategory(created.id, { deleted: true });  // include soft-deleted
+
+await deleteCategory(created.id);
 ```
 
-Functions **throw** on network failure or API errors (the error message contains the serialized API errors), so wrap calls in `try/catch`.
+| Entity    | Save / delete / read one                                  | App routes                    |
+| --------- | --------------------------------------------------------- | ----------------------------- |
+| product   | `saveProduct`, `deleteProduct`, `fetchProduct`             | `/api/products[/:id]`         |
+| category  | `saveCategory`, `deleteCategory`, `fetchCategory`          | `/api/categories[/:id]`       |
+| store     | `saveStore`, `deleteStore`, `fetchStore`                   | `/api/stores[/:id]`           |
+| promotion | `savePromotion`, `deletePromotion` (ends it), `fetchPromotion` | `/api/promotions[/:id]`       |
+| employee  | `saveEmployee`, `deleteEmployee` (retires), `fetchEmployee` | `/api/employees[/:id]`        |
+| consumer  | `fetchConsumer` only — read-only in the API                | `/api/consumer[/:id]` (GET)   |
+
+How they behave (matches what the Shopwave API does):
+
+- **Save** sends `{ <collection>: { "0": entity } }`. Shopwave upserts (an `id` means update), answers **201** and echoes the entity under the same ref with its `id` and server fields. The function checks `api.message.errors` and that the ref came back, and returns the saved entity (fields the echo leaves out are kept from your input). `saveEntities(kind, [a, b])` saves several at once and matches results back by ref.
+- **Delete** is a soft delete (read it back with `deleted: true`). Shopwave answers **205 with an empty body — also for ids that don't exist**, so a resolved promise means "accepted", not "a record was deleted".
+- **Read one** calls `GET /api/<route>/:id` and returns the record or `null`. List reads return `[]` when nothing matches (Shopwave answers with an empty body).
+- **Promotions:** Shopwave has no promotion DELETE; `deletePromotion` (and `DELETE /api/promotions/:id`) ends the promotion by setting `endDate` to now.
+- **Employees:** Shopwave has no employee DELETE, so `deleteEmployee` (and `DELETE /api/employees/:id`) retires the employee by setting `exitDate`. Updating an existing employee only changes `roleId`, `joinedDate` and `exitDate` — names and email are fixed — and the echo carries only those fields, so re-read with `fetchEmployee` if you need the stored record.
+- **Consumers** are read-only (`GET /consumer` by `ids`); their write/delete routes answer 405.
+- Errors are read from `api.message.errors` and also `api.message.error` (the name used in the [API reference](https://developer.merchantstack.com/api-reference.html)).
+
+The generic forms are `saveEntity(kind, item)`, `deleteEntityById(kind, id)` and `fetchEntityById(kind, id)`; `SHOPWAVE_ENTITIES` lists each entity's route, collection key, Shopwave path and id headers.
+
+### Merchant, current user and image uploads
+
+The merchant and the logged-in user are single records (one per login), and images go to the Shopwave CDN:
+
+```ts
+import {
+  fetchMerchant, updateMerchant, fetchUser,
+  uploadMerchantImage, setMerchantImage, getMerchantImageUrl,
+  merchantLinksToForm, merchantLinksFromForm,
+} from "react-shopwave-connect/core";
+
+const merchant = await fetchMerchant();          // Merchant | null
+const user = await fetchUser();                  // User | null  ({ id, firstName, lastName, email, employee })
+
+// Reads the merchant, merges the patch over it and saves the record, so
+// fields you don't mention (companyNumber, vatNumber, links, …) are kept.
+// Returns the merchant as stored (read back after the save).
+await updateMerchant({ vatNumber: "123456789", links: merchantLinksFromForm({ website: "https://example.com" }) });
+
+// Images: fit to the slot's size, upload with the slot's kind, then save the file name.
+const image = await uploadMerchantImage(file, "square");          // { id, url, path }
+await updateMerchant({ imageIds: setMerchantImage(merchant?.imageIds, "square", image.id) });
+getMerchantImageUrl(saved.imageIds, "square");                     // HTTPS URL for <img src>
+```
+
+The shapes below are the ones adminV1 saves and adminV2 reads, so all three admins share one record (confirmed on the live API with merchant 5644, 30 Sep 2026):
+
+| Field | Shape |
+|---|---|
+| `imageIds` | `{ logo: { receipt, square }, feature: [ … ] }` — **file names** on write (the uploader's `fileName`), **full `http://static.merchantstack.com/…` URLs** on read |
+| `colours` | `{ primary: { main, highlight, contrast } }` (hex strings; adminV2 uses `primary.main` behind the logo) |
+| `links` | `{ website: { home }, social: { twitter, facebook, instagram } }` |
+
+- **Merchant fields** (`GET`/`POST /merchant`): `id`, `name`, `description`, `companyNumber`, `vatNumber`, `categoryId`, `estAnnualRevenue`, `note`, and the three objects above. The API returns `{}` for an empty object.
+- **What the live API does on `POST /merchant`** (checked 30 Sep 2026): it replaces the record. A scalar field left out (`companyNumber`, `vatNumber`, `note`, …) becomes `null`; an object field left out (`colours`, `links`, `imageIds`) is kept, and one that is sent replaces the stored one (`{}` clears it). It answers **205 with an empty body**. It silently cuts `companyNumber` to 11 characters and `vatNumber` to 9 (a UK VAT number without `GB`).
+- **`updateMerchant(patch, { merge })`**: `merge` (default `true`) reads first and merges the scalar fields, so nothing is wiped. Object fields (`MERCHANT_OBJECT_FIELDS`) are sent only when the patch has them, and then replace the stored one — to change one image, pass the whole `imageIds` (`setMerchantImage` does that). `imageIds` is always sent as file names (`toStoredImageIds`), so you can pass back what you read. It refuses a different merchant `id`, never sends `createdDate`/`modifiedDate`, rejects values longer than `MERCHANT_FIELD_MAX_LENGTH` (`validateMerchant(m)` lists them) instead of letting the API cut them, and returns the merchant **read back after the save**, so you see exactly what was kept. `merge: false` sends only the patch (which must include `id`, and clears the scalar fields you leave out).
+- **Merchant image slots** (`MERCHANT_IMAGE_SLOTS`): the API doesn't resize, and adminV1 accepts only these exact sizes.
+
+  | Slot | Stored at | Upload kind | Size |
+  |---|---|---|---|
+  | `receipt` | `imageIds.logo.receipt` | `merchant` | 576 × 325 |
+  | `square` | `imageIds.logo.square` | `merchant` | 1000 × 1000 |
+  | `featured` | `imageIds.feature[0]` | `merchantFeature` | 1200 × 600 |
+
+  The API builds each image URL from its key, not from where the file was uploaded (`logo.*` → `…/merchant/<id>/logo/<file>`, `feature` → `…/feature/<file>`), so the featured image must be uploaded as `merchantFeature`. `POST /merchant` stores all three objects with the SDK's `{ merchant: … }` body; adminV1's `{ merchants: { "0": … } }` form isn't needed.
+
+  `uploadMerchantImage(file, slot, { fit = true })` scales and centre-crops the image to the slot's size in the browser (`fitImageToSize`, `coverCrop`) and uploads it with the slot's kind; `fit: false` sends the file as-is. `getMerchantImage` / `getMerchantImageUrl` / `setMerchantImage` read and write a slot; `imageFileName(url)` gives the file name in a URL. Hook: `useUploadMerchantImage()`.
+- **Links:** `merchantLinksToForm(links)` gives flat fields (`website`, `twitter`, `facebook`, `instagram`) from the stored shape, flat keys or the old array form; `merchantLinksFromForm(fields)` builds the stored shape; `normalizeMerchantLinks(links)` converts any of them to the stored shape. Colour keys: `MERCHANT_COLOUR_KEYS`.
+- **User** (`GET /user`): the live API returns `id`, `firstName`, `lastName`, `email` and `employee: { merchantId, roleId, stores }` — no `createdDate` and **no `merchant`**, although the reference lists them. There's no option to include it (adminV1 also reads `GET /merchant` separately and attaches it to its session). Read the merchant with `fetchMerchant()`.
+- **`uploadImage(file, { kind, fileName? })`** posts the file to `/api/upload`, which `PUT`s it to Shopwave's `/uploader` (multipart `file`, header `contentType: <kind>`). Kinds: `merchant`, `merchantFeature`, `product`, `user`, `applicationLogo`, `applicationImages` (the last two sent as the API's own spelling, `applicaionLogo`/`applicaionImages`). Live: 201 `{ fileName, path }`. Returns `{ id, url, path }`: `id` is the generated file name (what records store), `path` the URL as the API gave it (`http://static.merchantstack.com/images/…`, which has no HTTPS endpoint), and `url` the same file over HTTPS via `getImageUrl(path)` (`SHOPWAVE_IMAGE_BASE_URL`, the S3 bucket behind the CDN). The upload alone changes no record.
+
+`SHOPWAVE_RESOURCES` (merchant, user) and `SHOPWAVE_UPLOAD` are shared with the server routes, like `SHOPWAVE_ENTITIES`.
 
 ### Available `core` functions
 
 | Domain    | Function(s)                                              |
 | --------- | ------------------------------------------------------- |
-| category  | `fetchCategories`                                       |
-| consumer  | `fetchConsumers`                                        |
-| employee  | `fetchEmployees`                                        |
-| product   | `fetchProducts`, `fetchProductsMap` (batched, keyed)    |
-| store     | `fetchStores`                                           |
+| category  | `fetchCategories`, `fetchCategory`, `saveCategory`, `deleteCategory` |
+| consumer  | `fetchConsumers`, `fetchConsumer` (read-only)            |
+| employee  | `fetchEmployees`, `fetchEmployee`, `saveEmployee`, `deleteEmployee` |
+| product   | `fetchProducts`, `fetchProductsMap` (batched, keyed), `fetchProduct`, `saveProduct`, `deleteProduct` |
+| promotion | `fetchPromotions`, `fetchPromotion`, `savePromotion`, `deletePromotion` |
+| store     | `fetchStores` (now with `storeIds`), `fetchStore`, `saveStore`, `deleteStore` |
 | report    | `fetchReport`                                           |
+| merchant  | `fetchMerchant`, `updateMerchant`, `validateMerchant`; links `merchantLinksToForm`, `merchantLinksFromForm`, `normalizeMerchantLinks`; images `MERCHANT_IMAGE_SLOTS`, `uploadMerchantImage`, `getMerchantImage`, `getMerchantImageUrl`, `setMerchantImage`, `toStoredImageIds`, `imageFileName` |
+| user      | `fetchUser`                                              |
+| upload    | `uploadImage`, `getImageUrl`, `fitImageToSize`, `readImageSize`, `coverCrop` |
 | session   | `fetchSession`, `loginPath`, `logoutPath`, `logout`     |
-| entity    | `deleteEntity`, `submitEntity`                          |
+| entity    | `saveEntity`, `saveEntities`, `deleteEntityById`, `fetchEntityById`; low-level `submitEntity` / `deleteEntity` (raw endpoint) |
+| errors    | `ShopwaveApiError`, `getApiErrorMap`, `assertNoApiErrors` |
 | basket    | `buildBasketReportQuery`, `parseBasketReportData`, `combineBasketRows`, `computeBasketSummary`, … (pure transforms) |
 
-All types/interfaces (`Product`, `Store`, `Category`, `Consumer`, `Employee`, `ReportQueryMap`, `Basket*`, `apiResponse`, …) are exported from `core` too.
+All types/interfaces (`Product`, `Store`, `Category`, `Consumer`, `Employee`, `Merchant`, `User`, `UploadedImage`, `ReportQueryMap`, `Basket*`, `apiResponse`, …) are exported from `core` too.
 
 ---
 
@@ -122,9 +246,13 @@ All types/interfaces (`Product`, `Store`, `Category`, `Consumer`, `Employee`, `R
 Every auto-fetching hook returns the same shape:
 
 ```ts
-{ data, loading, error, refetch }
+{ data, loading, fetching, error, errorStatus, refetch }
 ```
 
+- `loading` is true only while there's nothing to show yet (first load, or the params changed).
+- `refetch()` keeps the current `data` on screen until the new data arrives (`fetching` is true meanwhile), so lists don't flash a skeleton after every save. A failed refetch keeps the old data and sets `error`.
+- `errorStatus` is the HTTP status of the last error.
+
 ```tsx
 "use client";
 import { useProduct, useStore } from "react-shopwave-connect/hooks";
@@ -152,12 +280,14 @@ const { data } = useProduct({ storeId }, { baseUrl: "https://api.merchantstack.c
 
 ### Auto-fetch hooks (`useEffect`-based)
 
-`useCategory`, `useConsumer`, `useEmployee`, `useProduct`, `usePromotion`, `useStore`, `useReport`, `useSession`.
+`useCategory`, `useConsumer`, `useEmployee`, `useProduct`, `usePromotion`, `useStore`, `useReport`, `useSession`, `useMerchant`, `useUser` (`useUser({ enabled: false })` stays idle).
 They fetch on mount and re-run when their arguments change. `useConsumer` and `useReport` stay idle until you pass ids / a query (they return `loading: false`, `data: null` until then). `refetch()` replaces the old `reloadFlag` argument.
 
 ### Manually-triggered hooks (`useCallback`-based)
 
-`useDelete`, `useSubmit`, `useLogout` return `{ mutate, data, loading, error }` — nothing fires until you call `mutate`:
+For saves and deletes, prefer calling the typed `core` functions (`saveProduct`, `deleteStore`, …) from your event handlers — they return the saved entity with its id.
+
+`useUpdateMerchant`, `useUploadImage`, `useUploadMerchantImage`, `useDelete`, `useSubmit`, `useLogout` return `{ mutate, data, loading, error, errorStatus }` — nothing fires until you call `mutate`:
 
 ```tsx
 import { useDelete, useSubmit } from "react-shopwave-connect/hooks";
@@ -303,9 +433,65 @@ export function AccountButton() {
 
 Use plain links / `window.location` for login and logout — they are full-page redirects to the auth server, not client-side navigations.
 
+### 4. API routes (Next.js)
+
+`core` calls `/api/<route>` on your app. `createShopwaveApi` provides those routes, using the session from step 1:
+
+```ts
+// lib/shopwave.ts
+import { createShopwaveApi } from "react-shopwave-connect/next";
+import { auth } from "@/lib/auth";
+
+export const shopwave = createShopwaveApi({ auth, apiUrl: process.env.SHOPWAVE_API_SERVER_URL! });
+```
+
+```ts
+// app/api/products/route.ts       — list/filter, create/update
+import { shopwave } from "@/lib/shopwave";
+export const { GET, POST, PUT } = shopwave.collection("product");
+
+// app/api/products/[id]/route.ts  — read one, update, delete
+import { shopwave } from "@/lib/shopwave";
+export const { GET, PUT, DELETE } = shopwave.item("product");
+
+// app/api/report/route.ts         — any other Shopwave path, read-only
+import { shopwave } from "@/lib/shopwave";
+export const { GET } = shopwave.passthrough("report");
+
+// app/api/merchant/route.ts       — read / update the merchant
+export const { GET, PUT } = shopwave.resource("merchant");
+
+// app/api/user/route.ts           — the logged-in user (read-only)
+export const { GET } = shopwave.resource("user");
+
+// app/api/upload/route.ts         — image upload (uploadImage)
+export const { POST } = shopwave.upload();              // or upload({ maxBytes, accept })
+```
+
+- `resource("merchant")`: `PUT`/`POST` take `{ merchant: {…} }` or the bare object and send every field on as `postBody`. The `id` is required (400 without it), because a POST without one would create a second merchant. `resource("user")` answers 405 to writes.
+- `upload()`: takes multipart `file` + `kind`, checks the size (default 10 MB → 413) and type (default `image/*` → 415), and `PUT`s only the file to `/uploader` with the `contentType` header. `extras` are ignored on uploads. Shopwave's reply (201 `{ fileName, path }`) is passed through.
+
+Entities: `product`, `category`, `store`, `promotion`, `employee` (DELETE retires via `exitDate`), `promotion` (DELETE ends it via `endDate`), `consumer` (mounted at `/api/consumer`; GET only, writes answer 405). For anything else, `shopwave.forward(request, { method, path, headers, postBody })` does the same token/refresh/encoding work for a custom handler.
+
+Every handler:
+
+- uses the caller's `Authorization: OAuth <token>` when present (also the legacy `token` header / `extras.token`), otherwise the logged-in user's token; `401` when there's neither. Turn caller tokens off with `allowRequestToken: false`.
+- turns the `extras` JSON header into upstream headers, dropping `Authorization`, `token`, `Cookie`, `Host`, `x-accept-version` and other transport headers; `400` if it isn't a JSON object.
+- sends writes as the form field `postBody=<JSON>`, accepting the SDK shape `{ products: { "0": {…} } }`, the older `{ products: { new | updated: {…} } }`, or a bare entity. Item `PUT` forces the id from the URL.
+- on HTTP 401 or API error 908 with the session token, refreshes once and retries.
+- answers with Shopwave's own status and body (201 + echo for saves, 205 + empty body for deletes, error envelopes as-is); `502` if the API can't be reached. Only the method and path are ever logged.
+
+For calls that bring their own token (scripts, the integration tests), let them past the proxy guard:
+
+```ts
+await auth.protect(request, { publicPaths: [...], allowRequestToken: true });
+```
+
+Options: `apiVersion` (default `"2.0"`), `fetch`, `entities` (override a route/header, e.g. `{ employee: { idHeader: "userId" } }`), `blockedExtras`, `onError`.
+
 ### Other frameworks
 
-`react-shopwave-connect/server` has the same building blocks without Next.js: `createShopwaveOAuth(config)` → `buildLoginUrl({ state })`, `exchangeCode(code)`, `refreshToken(token)`, `buildLogoutUrl()`, plus `createState`, `sanitizeReturnTo`, `isTokenExpired`, `isExpiredTokenResponse` and `authorizationHeader`. Store the token in your framework's session (Express `express-session`, iron-session's `getIronSession(req, res)`, …).
+`react-shopwave-connect/server` has the same building blocks without Next.js: `createShopwaveOAuth(config)` → `buildLoginUrl({ state })`, `exchangeCode(code)`, `refreshToken(token)`, `buildLogoutUrl()`, plus `createState`, `sanitizeReturnTo`, `isTokenExpired`, `isExpiredTokenResponse` and `authorizationHeader`. The API routes are `createShopwaveApiHandlers({ apiUrl, getAuthorization })` — plain `Request → Response` handlers, the same ones `createShopwaveApi` wraps. Store the token in your framework's session (Express `express-session`, iron-session's `getIronSession(req, res)`, …).
 
 ### Moving an existing app over
 
@@ -329,27 +515,28 @@ npm run typecheck   # tsc --noEmit
 
 ## Testing
 
-Unit tests (offline, no credentials) cover the OAuth client, token handling, the Next.js handlers (with an in-memory cookie store) and the session client:
+Unit tests (offline, no credentials) cover the OAuth client, token handling, the Next.js handlers (with an in-memory cookie store), the session client, the request layer (token header, errors, no logging), the typed save/delete/read functions, the API route handlers (extras filtering, refresh-and-retry, body normalisation, 205 pass-through) and the hooks' query state:
 
 ```bash
 npm test            # = npm run test:unit
 ```
 
-Integration tests run against a live API using [Vitest](https://vitest.dev). Tests are located in `tests/integration/` and cover full CRUD lifecycles for Products, Categories, Consumers, and Employees.
+Integration tests use [Vitest](https://vitest.dev) and run against **an app that mounts the SDK routes** (e.g. AdminUI on `npm run dev`), which forwards to the Shopwave API. They cover create → read (by id and by filter) → update → delete with the typed functions for Products and Categories, create → read → role update → retire for Employees, read-only checks for Consumers, plus unknown ids and the legacy `submitEntity` body. They create and delete real records on the account behind the token.
 
 ### Environment Variables
 
 | Variable    | Description                          | Example                                   |
 |-------------|--------------------------------------|-------------------------------------------|
-| `API_URL`   | Base URL for the API                 | `https://api.staging.merchantstack.com`   |
-| `API_TOKEN` | Authentication token                 | `your-staging-token`                      |
+| `API_URL`   | Origin of the app with the SDK routes | `http://localhost:3000`                  |
+| `API_TOKEN` | Bare Shopwave access token (no `OAuth`/`Bearer` prefix) | `111ad…`                |
 
 ### Running Tests
 
 ```bash
 # Set environment variables
-export API_URL=https://api.staging.merchantstack.com
-export API_TOKEN=your-staging-token
+# with the app running (AdminUI: npm run dev)
+export API_URL=http://localhost:3000
+export API_TOKEN=<bare access token>
 
 # Run all integration tests
 npm run test:integration
@@ -366,6 +553,10 @@ tests/
     server.test.ts                 # OAuth client, tokens, returnTo/state
     next.test.ts                   # Next.js handlers, refresh, proxy guard
     session-client.test.ts         # fetchSession / loginPath / logoutPath
+    request.test.ts                # token header, ShopwaveApiError, no logging
+    entities.test.ts               # save/delete/fetch-by-id per entity
+    api-routes.test.ts             # /api route handlers
+    query-state.test.ts            # useQuery keeps data while refetching
   integration/
     setup.ts                       # Shared config and helpers
     products.integration.test.ts   # Products CRUD lifecycle