API
Interactive docs: http://localhost:3001/docs (OpenAPI JSON at
/docs/json). Schemas are derived from the DTOs by the Swagger CLI plugin,
so validation rules — enums, min/max, required fields — appear in the spec
automatically. Mounted outside production only; set SWAGGER=true to force
it on.
Storefront:
GET /products?sort=&q=&minPrice=&maxPrice= # Live only
GET /products/categories
GET /products/:id # + gallery, related
GET /orders /orders/:number
GET /account/addresses | payment-methods | preferences
PATCH /account/preferences/:key
GET /feed /feed/ugc
POST /assets/upload-url
Admin:
GET /admin/overview?threshold=
GET /admin/products POST /admin/products
GET /admin/products/:id PUT /admin/products/:id
DELETE /admin/products/:id
PATCH /admin/products/:id/status # cycles Live -> Draft -> Archived
PATCH /admin/products/:id/stock # { size, delta }, clamped at 0
POST /admin/products/:id/restock?threshold=
POST /admin/restock-low?threshold=
GET /admin/orders
PATCH /admin/orders/:number/advance
GET /admin/customers
The admin routes carry no authentication yet — see Known gaps.
Cart, wishlist and session live client-side in StoreProvider; everything
else comes from MySQL.