robodev 0.22.0 → 0.24.0

package/templates/marketplace/api/cart/[id].ts

@@ -0,0 +1,51 @@
+import { defineApi, eq, z } from "@robodev-ai/sdk";
+import { cartItems, fail, findListing, isActiveForSale, toInt } from "../_lib";
+
+const updateBody = z.object({
+  quantity: z.preprocess((value) => toInt(value, Number.NaN), z.number().int().min(1)),
+});
+
+export const put = defineApi({
+  auth: "required",
+  body: updateBody,
+  handler: async (ctx) => {
+    const [row] = await ctx.db
+      .select()
+      .from(cartItems)
+      .where(eq(cartItems.id, ctx.params.id))
+      .limit(1);
+    if (!row || row.userId !== ctx.user!.id) return fail(404, "Cart item not found");
+    const listing = await findListing(ctx.db, row.listingId);
+    if (!listing) return fail(404, "Listing not found");
+    if (!isActiveForSale(listing) || ctx.body.quantity > listing.quantity) {
+      return fail(409, "Insufficient quantity");
+    }
+    const [updated] = await ctx.db
+      .update(cartItems)
+      .set({ quantity: ctx.body.quantity })
+      .where(eq(cartItems.id, row.id))
+      .returning();
+    return {
+      id: updated!.id,
+      userId: updated!.userId,
+      listingId: updated!.listingId,
+      quantity: updated!.quantity,
+    };
+  },
+});
+
+const remove = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    const [row] = await ctx.db
+      .select()
+      .from(cartItems)
+      .where(eq(cartItems.id, ctx.params.id))
+      .limit(1);
+    if (!row || row.userId !== ctx.user!.id) return fail(404, "Cart item not found");
+    await ctx.db.delete(cartItems).where(eq(cartItems.id, row.id));
+    return { status: 204, body: null };
+  },
+});
+
+export { remove as delete };

package/templates/marketplace/api/cart.ts

@@ -0,0 +1,70 @@
+import { and, defineApi, eq, z } from "@robodev-ai/sdk";
+import { cartItems, enrichOne, fail, findListing, isActiveForSale, toInt } from "./_lib";
+
+const addBody = z.object({
+  listingId: z.string().min(1),
+  quantity: z.preprocess((value) => toInt(value, 1), z.number().int().min(1)),
+});
+
+export const get = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    const rows = await ctx.db.select().from(cartItems).where(eq(cartItems.userId, ctx.user!.id));
+    const items = [];
+    for (const row of rows) {
+      const listing = await findListing(ctx.db, row.listingId);
+      if (!listing) continue;
+      items.push({
+        id: row.id,
+        userId: row.userId,
+        listingId: row.listingId,
+        quantity: row.quantity,
+        listing: await enrichOne(ctx, listing, ctx.user!.id),
+      });
+    }
+    return items;
+  },
+});
+
+export const post = defineApi({
+  auth: "required",
+  body: addBody,
+  handler: async (ctx) => {
+    const listing = await findListing(ctx.db, ctx.body.listingId);
+    if (!listing) return fail(404, "Listing not found");
+    if (listing.sellerId === ctx.user!.id) return fail(400, "You cannot add your own listing");
+    if (!isActiveForSale(listing)) return fail(409, "Listing is not available");
+    if (ctx.body.quantity > listing.quantity) return fail(409, "Insufficient quantity");
+
+    const [current] = await ctx.db
+      .select()
+      .from(cartItems)
+      .where(and(eq(cartItems.userId, ctx.user!.id), eq(cartItems.listingId, listing.id)))
+      .limit(1);
+    const nextQty = (current?.quantity ?? 0) + ctx.body.quantity;
+    if (nextQty > listing.quantity) return fail(409, "Insufficient quantity");
+
+    const [row] = current
+      ? await ctx.db
+          .update(cartItems)
+          .set({ quantity: nextQty })
+          .where(eq(cartItems.id, current.id))
+          .returning()
+      : await ctx.db
+          .insert(cartItems)
+          .values({
+            userId: ctx.user!.id,
+            listingId: listing.id,
+            quantity: ctx.body.quantity,
+          })
+          .returning();
+
+    return {
+      id: row!.id,
+      userId: row!.userId,
+      listingId: row!.listingId,
+      quantity: row!.quantity,
+      listing: await enrichOne(ctx, listing, ctx.user!.id),
+    };
+  },
+});

package/templates/marketplace/api/categories.ts

@@ -0,0 +1,11 @@
+import { defineApi } from "@robodev-ai/sdk";
+import { categories, ensureSeed } from "./_lib";
+
+export const get = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    await ensureSeed(ctx.db);
+    const rows = await ctx.db.select().from(categories);
+    return rows.map((row) => ({ id: row.id, slug: row.slug, name: row.name }));
+  },
+});

package/templates/marketplace/api/checkout.ts

@@ -0,0 +1,157 @@
+import { defineApi, eq, z } from "@robodev-ai/sdk";
+import {
+  cartItems,
+  fail,
+  findListing,
+  isActiveForSale,
+  isSeedRecipient,
+  listings,
+  orderItems,
+  orders,
+  ORDER_STATUS,
+  toOrderDto,
+} from "./_lib";
+
+const emptyToUndefined = (value: unknown) => (value === "" || value == null ? undefined : value);
+
+const CARD_KEYS = ["pan", "number", "expiry", "cvc"] as const;
+
+const checkoutBody = z
+  .object({
+    shippingName: z.string().min(1),
+    shippingLine1: z.string().min(1),
+    shippingLine2: z.preprocess(emptyToUndefined, z.string().optional()),
+    shippingCity: z.string().min(1),
+    shippingRegion: z.preprocess(emptyToUndefined, z.string().optional()),
+    shippingPostal: z.string().min(1),
+    shippingCountry: z.string().min(1),
+    last4: z.preprocess(
+      emptyToUndefined,
+      z
+        .string()
+        .regex(/^\d{4}$/)
+        .optional(),
+    ),
+  })
+  .passthrough();
+
+export const post = defineApi({
+  auth: "required",
+  body: checkoutBody,
+  handler: async (ctx) => {
+    const raw = ctx.body as Record<string, unknown>;
+    for (const key of CARD_KEYS) {
+      if (Object.prototype.hasOwnProperty.call(raw, key)) {
+        return fail(400, "Card number fields are not accepted");
+      }
+    }
+
+    const cart = await ctx.db.select().from(cartItems).where(eq(cartItems.userId, ctx.user!.id));
+    if (cart.length === 0) return fail(400, "Cart is empty");
+
+    const lines: {
+      cartId: string;
+      listing: NonNullable<Awaited<ReturnType<typeof findListing>>>;
+      quantity: number;
+    }[] = [];
+    for (const item of cart) {
+      const listing = await findListing(ctx.db, item.listingId);
+      if (!listing) return fail(409, "Listing is not available");
+      if (listing.sellerId === ctx.user!.id) return fail(400, "You cannot buy your own listing");
+      if (!isActiveForSale(listing) || item.quantity > listing.quantity) {
+        return fail(409, "Insufficient quantity");
+      }
+      lines.push({ cartId: item.id, listing, quantity: item.quantity });
+    }
+
+    const bySeller = new Map<string, typeof lines>();
+    for (const line of lines) {
+      const group = bySeller.get(line.listing.sellerId) ?? [];
+      group.push(line);
+      bySeller.set(line.listing.sellerId, group);
+    }
+
+    const created = [];
+    const now = new Date();
+    for (const group of bySeller.values()) {
+      for (const line of group) {
+        const latest = await findListing(ctx.db, line.listing.id);
+        if (!latest || !isActiveForSale(latest) || line.quantity > latest.quantity) {
+          return fail(409, "Insufficient quantity");
+        }
+        await ctx.db
+          .update(listings)
+          .set({
+            quantity: latest.quantity - line.quantity,
+            updatedAt: now,
+          })
+          .where(eq(listings.id, latest.id));
+      }
+
+      const shippingCents = group[0]!.listing.shippingCents;
+      const lineTotal = group.reduce(
+        (sum, line) => sum + line.listing.priceCents * line.quantity,
+        0,
+      );
+      const [order] = await ctx.db
+        .insert(orders)
+        .values({
+          buyerId: ctx.user!.id,
+          buyerEmail: ctx.user!.email,
+          sellerId: group[0]!.listing.sellerId,
+          sellerEmail: group[0]!.listing.sellerEmail,
+          status: ORDER_STATUS.paid,
+          shippingName: ctx.body.shippingName,
+          shippingLine1: ctx.body.shippingLine1,
+          shippingLine2: ctx.body.shippingLine2 ?? null,
+          shippingCity: ctx.body.shippingCity,
+          shippingRegion: ctx.body.shippingRegion ?? null,
+          shippingPostal: ctx.body.shippingPostal,
+          shippingCountry: ctx.body.shippingCountry,
+          shippingCents,
+          totalCents: lineTotal + shippingCents,
+          last4: ctx.body.last4 ?? null,
+          createdAt: now,
+          updatedAt: now,
+        })
+        .returning();
+
+      const itemRows = [];
+      for (const line of group) {
+        const [item] = await ctx.db
+          .insert(orderItems)
+          .values({
+            orderId: order!.id,
+            listingId: line.listing.id,
+            title: line.listing.title,
+            qty: line.quantity,
+            unitPriceCents: line.listing.priceCents,
+          })
+          .returning();
+        itemRows.push(item!);
+        await ctx.db.delete(cartItems).where(eq(cartItems.id, line.cartId));
+      }
+
+      const dto = toOrderDto(order!, itemRows);
+      created.push(dto);
+
+      const itemSummary = itemRows.map((item) => `${item.qty} × ${item.title}`).join(", ");
+      if (!isSeedRecipient(order!.sellerEmail, order!.sellerId)) {
+        await ctx.email.send({
+          to: order!.sellerEmail,
+          subject: "Order placed",
+          text: `${ctx.user!.email} placed an order (${order!.id}): ${itemSummary}. Total ${order!.totalCents} cents.`,
+        });
+      }
+      if (!isSeedRecipient(order!.buyerEmail)) {
+        await ctx.email.send({
+          to: order!.buyerEmail,
+          subject: "Order receipt",
+          text: `Your order ${order!.id} is paid. ${itemSummary}. Total ${order!.totalCents} cents.`,
+        });
+      }
+    }
+
+    return created;
+  },
+});

package/templates/marketplace/api/health.ts

@@ -0,0 +1,7 @@
+/** GET /api/health — liveness check for the deployed project host. */
+import { defineApi, z } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  response: z.object({ ok: z.literal(true) }),
+  handler: async () => ({ ok: true as const }),
+});

package/templates/marketplace/api/listings/[id].ts

@@ -0,0 +1,101 @@
+import { defineApi, eq, z } from "@robodev-ai/sdk";
+import {
+  enrichOne,
+  ensureSeed,
+  fail,
+  findCategory,
+  findListing,
+  listingUploadFiles,
+  listings,
+  LISTING_STATUS,
+  parseListingWrite,
+  parseRemoveImageIds,
+  replaceListingImages,
+  toInt,
+} from "../_lib";
+
+const emptyToUndefined = (value: unknown) => (value === "" ? undefined : value);
+
+const listingBody = z.object({
+  title: z.string().min(1),
+  description: z.preprocess(emptyToUndefined, z.string().optional()),
+  categoryId: z.string().min(1),
+  priceCents: z.preprocess((value) => toInt(value, Number.NaN), z.number().int().min(0)),
+  quantity: z.preprocess((value) => toInt(value, Number.NaN), z.number().int().min(0)),
+  shippingCents: z.preprocess((value) => toInt(value, Number.NaN), z.number().int().min(0)),
+  shippingDays: z.preprocess((value) => toInt(value, Number.NaN), z.number().int().min(1)),
+  status: z.preprocess(emptyToUndefined, z.string().optional()),
+  removeImageIds: z.preprocess(emptyToUndefined, z.string().optional()),
+});
+
+export const get = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    await ensureSeed(ctx.db);
+    const listing = await findListing(ctx.db, ctx.params.id);
+    if (!listing) return fail(404, "Listing not found");
+    return enrichOne(ctx, listing, ctx.user!.id);
+  },
+});
+
+export const put = defineApi({
+  auth: "required",
+  multipart: true,
+  body: listingBody,
+  handler: async (ctx) => {
+    const listing = await findListing(ctx.db, ctx.params.id);
+    if (!listing) return fail(404, "Listing not found");
+    if (listing.sellerId !== ctx.user!.id)
+      return fail(403, "You can only update your own listings");
+    if (!(await findCategory(ctx.db, ctx.body.categoryId))) {
+      return fail(404, "Category not found");
+    }
+    const parsed = parseListingWrite({
+      title: ctx.body.title,
+      description: ctx.body.description,
+      categoryId: ctx.body.categoryId,
+      priceCents: ctx.body.priceCents,
+      quantity: ctx.body.quantity,
+      shippingCents: ctx.body.shippingCents,
+      shippingDays: ctx.body.shippingDays,
+      status: ctx.body.status,
+    });
+    if ("status" in parsed && "body" in parsed) return parsed;
+
+    const files = listingUploadFiles(ctx.files);
+    const removeImageIds = parseRemoveImageIds(ctx.body.removeImageIds);
+    const saved = await replaceListingImages(ctx, listing.id, files, removeImageIds, 0);
+    if ("status" in saved) return saved;
+
+    const [updated] = await ctx.db
+      .update(listings)
+      .set({
+        ...parsed,
+        updatedAt: new Date(),
+      })
+      .where(eq(listings.id, listing.id))
+      .returning();
+    if (!updated) return fail(404, "Listing not found");
+    return enrichOne(ctx, updated, ctx.user!.id);
+  },
+});
+
+const deactivate = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    const listing = await findListing(ctx.db, ctx.params.id);
+    if (!listing) return fail(404, "Listing not found");
+    if (listing.sellerId !== ctx.user!.id) {
+      return fail(403, "You can only deactivate your own listings");
+    }
+    const [updated] = await ctx.db
+      .update(listings)
+      .set({ status: LISTING_STATUS.inactive, updatedAt: new Date() })
+      .where(eq(listings.id, listing.id))
+      .returning();
+    if (!updated) return fail(404, "Listing not found");
+    return enrichOne(ctx, updated, ctx.user!.id);
+  },
+});
+
+export { deactivate as delete };

package/templates/marketplace/api/listings/paginate.ts

@@ -0,0 +1,29 @@
+import { defineApi, desc } from "@robodev-ai/sdk";
+import {
+  browsePredicate,
+  enrichListings,
+  ensureSeed,
+  listings,
+  paginate,
+  parseOptionalInt,
+} from "../_lib";
+
+export const get = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    await ensureSeed(ctx.db);
+    const query = ctx.query as Record<string, unknown>;
+    const search = typeof query.search === "string" ? query.search : undefined;
+    const categoryId = typeof query.categoryId === "string" ? query.categoryId : undefined;
+    const rows = await ctx.db
+      .select()
+      .from(listings)
+      .where(browsePredicate(search, categoryId))
+      .orderBy(desc(listings.createdAt));
+    const page = paginate(rows, parseOptionalInt(query.page), parseOptionalInt(query.limit));
+    return {
+      ...page,
+      items: await enrichListings(ctx, page.items, ctx.user!.id),
+    };
+  },
+});

package/templates/marketplace/api/listings.ts

@@ -0,0 +1,90 @@
+import { defineApi, desc, eq, z } from "@robodev-ai/sdk";
+import {
+  browsePredicate,
+  enrichListings,
+  enrichOne,
+  ensureSeed,
+  fail,
+  findCategory,
+  isTruthyQuery,
+  listingUploadFiles,
+  listings,
+  MAX_LISTING_IMAGES,
+  parseListingWrite,
+  replaceListingImages,
+  toInt,
+} from "./_lib";
+
+const emptyToUndefined = (value: unknown) => (value === "" ? undefined : value);
+
+const listingBody = z.object({
+  title: z.string().min(1),
+  description: z.preprocess(emptyToUndefined, z.string().optional()),
+  categoryId: z.string().min(1),
+  priceCents: z.preprocess((value) => toInt(value, Number.NaN), z.number().int().min(0)),
+  quantity: z.preprocess((value) => toInt(value, Number.NaN), z.number().int().min(0)),
+  shippingCents: z.preprocess((value) => toInt(value, Number.NaN), z.number().int().min(0)),
+  shippingDays: z.preprocess((value) => toInt(value, Number.NaN), z.number().int().min(1)),
+  status: z.preprocess(emptyToUndefined, z.string().optional()),
+});
+
+export const get = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    await ensureSeed(ctx.db);
+    const query = ctx.query as Record<string, unknown>;
+    const mine = isTruthyQuery(query.mine);
+    const search = typeof query.search === "string" ? query.search : undefined;
+    const categoryId = typeof query.categoryId === "string" ? query.categoryId : undefined;
+    const rows = mine
+      ? await ctx.db
+          .select()
+          .from(listings)
+          .where(eq(listings.sellerId, ctx.user!.id))
+          .orderBy(desc(listings.createdAt))
+      : await ctx.db
+          .select()
+          .from(listings)
+          .where(browsePredicate(search, categoryId))
+          .orderBy(desc(listings.createdAt));
+    return enrichListings(ctx, rows, ctx.user!.id);
+  },
+});
+
+export const post = defineApi({
+  auth: "required",
+  multipart: true,
+  body: listingBody,
+  handler: async (ctx) => {
+    if (!(await findCategory(ctx.db, ctx.body.categoryId))) {
+      return fail(404, "Category not found");
+    }
+    const parsed = parseListingWrite({
+      title: ctx.body.title,
+      description: ctx.body.description,
+      categoryId: ctx.body.categoryId,
+      priceCents: ctx.body.priceCents,
+      quantity: ctx.body.quantity,
+      shippingCents: ctx.body.shippingCents,
+      shippingDays: ctx.body.shippingDays,
+      status: ctx.body.status,
+    });
+    if ("status" in parsed && "body" in parsed) return parsed;
+    const uploaded = listingUploadFiles(ctx.files);
+    if (uploaded.length > MAX_LISTING_IMAGES) return fail(400, "Too many images");
+    const files = uploaded.slice(0, MAX_LISTING_IMAGES);
+
+    const [row] = await ctx.db
+      .insert(listings)
+      .values({
+        sellerId: ctx.user!.id,
+        sellerName: ctx.user!.name ?? ctx.user!.email,
+        sellerEmail: ctx.user!.email,
+        ...parsed,
+      })
+      .returning();
+    const saved = await replaceListingImages(ctx, row!.id, files, [], 0);
+    if ("status" in saved) return saved;
+    return enrichOne(ctx, row!, ctx.user!.id);
+  },
+});

package/templates/marketplace/api/me.ts

@@ -0,0 +1,14 @@
+/** GET /api/me — current project user (Robodev Auth required). */
+import { defineApi, z } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  auth: "required",
+  response: z.object({
+    user: z.object({
+      id: z.string(),
+      email: z.string(),
+      name: z.string().nullable().optional(),
+    }),
+  }),
+  handler: async ({ user }) => ({ user }),
+});

package/templates/marketplace/api/orders/[id]/complete.ts

@@ -0,0 +1,27 @@
+import { defineApi, eq } from "@robodev-ai/sdk";
+import { fail, orderItems, orders, ORDER_STATUS, sendMail, toOrderDto } from "../../_lib";
+
+export const post = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    const [order] = await ctx.db.select().from(orders).where(eq(orders.id, ctx.params.id)).limit(1);
+    if (!order) return fail(404, "Order not found");
+    if (order.buyerId !== ctx.user!.id) {
+      return fail(403, "Only the buyer can complete this order");
+    }
+    if (order.status !== ORDER_STATUS.shipped) return fail(409, "Order is not shipped");
+    const [updated] = await ctx.db
+      .update(orders)
+      .set({ status: ORDER_STATUS.completed, updatedAt: new Date() })
+      .where(eq(orders.id, order.id))
+      .returning();
+    const items = await ctx.db.select().from(orderItems).where(eq(orderItems.orderId, order.id));
+    await sendMail(ctx.email, {
+      to: order.sellerEmail,
+      sellerId: order.sellerId,
+      subject: "Order completed",
+      text: `Order ${order.id} was marked completed by the buyer.`,
+    });
+    return toOrderDto(updated!, items);
+  },
+});

package/templates/marketplace/api/orders/[id]/ship.ts

@@ -0,0 +1,24 @@
+import { defineApi, eq } from "@robodev-ai/sdk";
+import { fail, orderItems, orders, ORDER_STATUS, sendMail, toOrderDto } from "../../_lib";
+
+export const post = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    const [order] = await ctx.db.select().from(orders).where(eq(orders.id, ctx.params.id)).limit(1);
+    if (!order) return fail(404, "Order not found");
+    if (order.sellerId !== ctx.user!.id) return fail(403, "Only the seller can ship this order");
+    if (order.status !== ORDER_STATUS.paid) return fail(409, "Order is not awaiting shipment");
+    const [updated] = await ctx.db
+      .update(orders)
+      .set({ status: ORDER_STATUS.shipped, updatedAt: new Date() })
+      .where(eq(orders.id, order.id))
+      .returning();
+    const items = await ctx.db.select().from(orderItems).where(eq(orderItems.orderId, order.id));
+    await sendMail(ctx.email, {
+      to: order.buyerEmail,
+      subject: "Order shipped",
+      text: `Your order ${order.id} has shipped.`,
+    });
+    return toOrderDto(updated!, items);
+  },
+});

package/templates/marketplace/api/orders/[id].ts

@@ -0,0 +1,15 @@
+import { defineApi, eq } from "@robodev-ai/sdk";
+import { fail, orderItems, orders, toOrderDto } from "../_lib";
+
+export const get = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    const [order] = await ctx.db.select().from(orders).where(eq(orders.id, ctx.params.id)).limit(1);
+    if (!order) return fail(404, "Order not found");
+    if (order.buyerId !== ctx.user!.id && order.sellerId !== ctx.user!.id) {
+      return fail(403, "You cannot view this order");
+    }
+    const items = await ctx.db.select().from(orderItems).where(eq(orderItems.orderId, order.id));
+    return toOrderDto(order, items);
+  },
+});

package/templates/marketplace/api/purchases.ts

@@ -0,0 +1,19 @@
+import { defineApi, desc, eq } from "@robodev-ai/sdk";
+import { orderItems, orders, toOrderDto } from "./_lib";
+
+export const get = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    const rows = await ctx.db
+      .select()
+      .from(orders)
+      .where(eq(orders.buyerId, ctx.user!.id))
+      .orderBy(desc(orders.createdAt));
+    const result = [];
+    for (const order of rows) {
+      const items = await ctx.db.select().from(orderItems).where(eq(orderItems.orderId, order.id));
+      result.push(toOrderDto(order, items));
+    }
+    return result;
+  },
+});

package/templates/marketplace/api/reviews.ts

@@ -0,0 +1,58 @@
+import { and, defineApi, eq, z } from "@robodev-ai/sdk";
+import { fail, orderItems, orders, ORDER_STATUS, reviews, toReviewDto } from "./_lib";
+
+const emptyToUndefined = (value: unknown) => (value === "" ? undefined : value);
+
+export const get = defineApi({
+  auth: "required",
+  handler: async (ctx) => {
+    const query = ctx.query as Record<string, unknown>;
+    const listingId = typeof query.listingId === "string" ? query.listingId : "";
+    if (!listingId) return fail(400, "listingId is required");
+    const rows = await ctx.db.select().from(reviews).where(eq(reviews.listingId, listingId));
+    return rows.map(toReviewDto);
+  },
+});
+
+export const post = defineApi({
+  auth: "required",
+  body: z.object({
+    listingId: z.string().min(1),
+    orderId: z.string().min(1),
+    rating: z.number().int().min(1).max(5),
+    body: z.preprocess(emptyToUndefined, z.string().optional()),
+  }),
+  handler: async (ctx) => {
+    const [order] = await ctx.db
+      .select()
+      .from(orders)
+      .where(eq(orders.id, ctx.body.orderId))
+      .limit(1);
+    if (!order) return fail(404, "Order not found");
+    if (order.buyerId !== ctx.user!.id) return fail(403, "Only the buyer can review");
+    if (order.status !== ORDER_STATUS.completed) return fail(403, "Order is not completed");
+    const [line] = await ctx.db
+      .select()
+      .from(orderItems)
+      .where(and(eq(orderItems.orderId, order.id), eq(orderItems.listingId, ctx.body.listingId)))
+      .limit(1);
+    if (!line) return fail(403, "Listing is not on this order");
+    const [existing] = await ctx.db
+      .select()
+      .from(reviews)
+      .where(and(eq(reviews.orderId, order.id), eq(reviews.listingId, ctx.body.listingId)))
+      .limit(1);
+    if (existing) return fail(409, "Review already exists");
+    const [row] = await ctx.db
+      .insert(reviews)
+      .values({
+        listingId: ctx.body.listingId,
+        orderId: order.id,
+        buyerId: ctx.user!.id,
+        rating: ctx.body.rating,
+        body: ctx.body.body ?? null,
+      })
+      .returning();
+    return toReviewDto(row!);
+  },
+});